I'm amused at the lengths the readme goes to in order to drive home the fact that this needs to be a LOOOOOOOOOOOOOOOOOOOONG instruction, including the unnecessarily long code block illustration. The topic is interesting anyway, but that makes it way more entertaining.
Do you think a short instruction is okay or does it need to be long? The instructions were a bit unclear in that regard :D
Exploiting System Management Mode with a very long interrupt
11–20 of 77 posts
Re: Exploiting System Management Mode with a very long interrupt
#12...huh, I was wondering why serial machine code prankster xoreaxeaxeax was keeping lists of extremely long-running instructions. Hopefully this is at least only possible in kernel mode, right? Right?!
Re: Exploiting System Management Mode with a very long interrupt
#13...huh, I was wondering why serial machine code prankster xoreaxeaxeax was keeping lists of extremely long-running instructions. Hopefully this is at least only possible in kernel mode, right? Right?!
Is it really a long running instruction ? I mean, obviously yes, but what makes it slow is that it's doing an MMIO copy from a slow source. It's like a read(2) system call being "slow" because the fd is associated with a socket to the moon.
Re: Exploiting System Management Mode with a very long interrupt
#14Re: Exploiting System Management Mode with a very long interrupt
#15The designers of the firmware anticipate this attack but punt it to the vendor, apparently: // // Platform implementor should choose a timeout value appropriately: [snip] // - The timeout value must be longer than longest possible IO operation in the system
Re: Exploiting System Management Mode with a very long interrupt
#16> Instruction latency analysis usually focuses on performance optimization—making code run as fast as possible. The Assembly Hall of Shame takes the opposite approach: searching for the absolute floor of single-instruction performance.
Fun stuff!
Re: Exploiting System Management Mode with a very long interrupt
#17Unclear why there is a 1 second timeout at all. Presumably the patch for that will be to make it an infinity timeout.
Also, the System Management Interrupts are supposed to return to normal processing in some finite timespan; a timeout bounds the wait time.
Re: Exploiting System Management Mode with a very long interrupt
#18I'm amused at the lengths the readme goes to in order to drive home the fact that this needs to be a LOOOOOOOOOOOOOOOOOOOONG instruction, including the unnecessarily long code block illustration. The topic is interesting anyway, but that makes it way more entertaining.
Do you think a short instruction is okay or does it need to be long? The instructions were a bit unclear in that regard :D
Re: Exploiting System Management Mode with a very long interrupt
#19All coz they can't be arsed to put a tiny management core separate from the rest and save a penny
Re: Exploiting System Management Mode with a very long interrupt
#20Unclear why there is a 1 second timeout at all. Presumably the patch for that will be to make it an infinity timeout.
system management mode does a lot of stuff, some of which is time critical. If your system is overheating and one of the cores is stuck off in the weeds, it's probably better to get on with the thermal response rather than waiting forever. Also, the System Management Interrupts are supposed to return to normal processing in some finite timespan; a timeout bounds the wait time.