Earlier quoted context omitted.
system management mode does a lot of stuff, some of which is time critical. If your system is overheating and one of the cores is stuck off in the weeds, it's probably better to get on with the thermal response rather than waiting forever. Also, the System Management Interrupts are supposed to return to normal processing in some finite timespan; a timeout bounds the wait time.
If it is critical it should not be running on same cores
Exploiting System Management Mode with a very long interrupt
71–79 of 79 posts
Re: Exploiting System Management Mode with a very long interrupt
#72The timeout idea is interesting. If firmware can strictly bound SMM execution time, would that actually eliminate this class of attack, or just turn it into a crash/DoS instead?
Re: Exploiting System Management Mode with a very long interrupt
#73It's nice to see SMM is as terrible idea now as it was at moment of conception. All coz they can't be arsed to put a tiny management core separate from the rest and save a penny
Re: Exploiting System Management Mode with a very long interrupt
#74Earlier quoted context omitted.
A read that happens to touch a particular torment nexus fd is still a long-running syscall, even if the syscall servicing routine itself is not long-running. The underlying problem is that program code that is "in a syscall" or "in an instruction" is in a special state for which interruption might not be possible or implemented well[0]. [0] Remember ITS and the PC2 problem?
For other people who didn't immediately recognize "ITS and the PC2 problem" and want the backstory it starts in the last paragraph of page 312: https://web.mit.edu/~simsong/www/ugh.pdf
But if a signal comes inside a syscall the user-mode program counter is the syscall instruction, not the exact position in kernel mode within the syscall. What should the kernel push on the stack? Obviously it can't push the kernel PC as that would be a huge vulnerability, and it would lose all the state on the kernel stack anyway. If the syscall is a quick one like getpid, it can just finish the syscall and then do the signal, but if it's read, then it's a problem.
The proper solution is for read to somehow save its state, store the user PC of the syscall instruction, then exit the syscall and do the signal, and when the signal is done it goes back to the syscall. This is doable enough for read, since you just advance the buffer and decrease the length, though you still need a way to return the correct total number of bytes. It's completely infeasible for anything more complicated than that, like many ioctls.
So instead the worse-is-better solution was used. If read gets a signal, it turns itself into a "quick" syscall by just giving up on waiting for more bytes and returning whatever it has already read, which may be 0 bytes. It finishes immediately, does the syscall and returns to the syscall's caller. It is the application's problem to deal with the fact this can happen.
On Windows NT they can actually mix kernel and user stack frames arbitrarily. User code can call into kernel code that can call into user code that can call into kernel code, etc, and kernel debuggers can see the whole thing. I have no idea how they do this. Unix doesn't - Unix is strictly user code calling into kernel code via syscalls.
Re: Exploiting System Management Mode with a very long interrupt
#75Earlier quoted context omitted.
A read that happens to touch a particular torment nexus fd is still a long-running syscall, even if the syscall servicing routine itself is not long-running. The underlying problem is that program code that is "in a syscall" or "in an instruction" is in a special state for which interruption might not be possible or implemented well[0]. [0] Remember ITS and the PC2 problem?
I have a reproducible way to have a pwrite syscall on a specific SSD on a specific machine take 15+ seconds and completely block any syscall related to that SSD by any other thread or core during that amount of time. I tried and couldn't preempt it either (sched_fifo and preempt kernel options). I should have a look soon with Intel PT to check whether it's on the same instruction every time :)
In Linux, any thread running in the kernel is unkillable unless that section of kernel code made arrangements to be killable. When kernel code blocks, you can get unkillable processes. They show as D state (uninterruptible wait).
Re: Exploiting System Management Mode with a very long interrupt
#76Earlier quoted context omitted.
> failing after arbitrary timeouts introduces hard-to-debug failures under load What needs to fail here is the instruction doing insanely slow MMIO. That's not going to be too hard to debug; none of the examples of suitably slow instructions are anywhere close to reasonable, and a fault on a vmovdqu in MMIO address space is a big red flag. And this attack requires enough ridiculous behavior from coordinating software…
I initially agreed with your idea, but realized the problem. At the bus/inter agent communication level, the CPU has sent a read request and is expecting a response. These protocols are usually synchronous with no clear cancellation semantics. There are probably core resources tracking then expected response and if you just freed one of those up and ended the instruction with an exception, you could later have what a…
Re: Exploiting System Management Mode with a very long interrupt
#77Technically this is not a vulnerability because you need to be root. I would rather call it "taking back control of your hardware". SMM is an evil thing because the user cannot control it or look into SMM memory region. Why do CPU vendors implement a mode that cannot be controlled by the user? Obviously to use it in user-hostile purposes (software copying prevention and reporting, DRM, government access backdoors, et…
Re: Exploiting System Management Mode with a very long interrupt
#78Earlier quoted context omitted.
It certainly is a vulnerability, because SMM is a higher privilege level than root. (The fact that there is such a thing as a higher privilege level than root is what annoys people).
"Vulnerability" has a negative meaning, so let's name it in a positive way, like "jailbreak", "liberation" or something.
Giving it a new name doesn't mean the original name is less correct. Vulnerability is a relative definition. It's a vulnerability in the context of the chipmakers security model but not necessarily yours. It could be a hidden feature in your world.
Re: Exploiting System Management Mode with a very long interrupt
#79Earlier quoted context omitted.
The author’s take on this in the Mitigations section makes sense to me: > Remove the timeout, and a legitimately stuck core hangs the platform on the first SMI. Increase the timeout, and you kill performance on many-core platforms that are forced to quiesce all cores every SMM entry. It's not clear what the best path forward is, or if there is even a path forward at all.
Reads like AI.