Live data from Hacker News

Exploiting System Management Mode with a very long interrupt

github.com

21–30 of 82 posts

Re: Exploiting System Management Mode with a very long interrupt

#21

...huh, I was wondering why serial machine code prankster xoreaxeaxeax was keeping lists of extremely long-running instructions. Hopefully this is at least only possible in kernel mode, right? Right?!

Given that you can connect essentially PCIe devices thru USB it is probably exploitable?

Find out which device is accessible to user and does MMIO, emulate it on FPGA, make it slooooooooow. All it needs to do is for driver to trigger a "right" access". GPU comes to mind

Re: Exploiting System Management Mode with a very long interrupt

#23
post #12

...huh, I was wondering why serial machine code prankster xoreaxeaxeax was keeping lists of extremely long-running instructions. Hopefully this is at least only possible in kernel mode, right? Right?!

Is it really a long running instruction ? I mean, obviously yes, but what makes it slow is that it's doing an MMIO copy from a slow source. It's like a read(2) system call being "slow" because the fd is associated with a socket to the moon.

A read that happens to touch a particular torment nexus fd is still a long-running syscall, even if the syscall servicing routine itself is not long-running. The underlying problem is that program code that is "in a syscall" or "in an instruction" is in a special state for which interruption might not be possible or implemented well[0].

[0] Remember ITS and the PC2 problem?

Re: Exploiting System Management Mode with a very long interrupt

#24

Almost nothing from this GitHub profile posted until the last four days. From a meta perspective what is going on? What am I missing? Why is this GitHub profile suddenly getting massive attention and making front page so frequently?

This rosenbridge repos commits claim to be 8 years old https://github.com/xoreaxeaxeax/rosenbridge

Re: Exploiting System Management Mode with a very long interrupt

#25
post #24

Almost nothing from this GitHub profile posted until the last four days. From a meta perspective what is going on? What am I missing? Why is this GitHub profile suddenly getting massive attention and making front page so frequently?

This rosenbridge repos commits claim to be 8 years old https://github.com/xoreaxeaxeax/rosenbridge

Yep there are links as far back as 11 years ago posted here. But I’m saying why suddenly in four days is this GitHub profile linked in lots of front page threads?

Is it just that one thread brought attention and several people are slowly digesting the other repos on that profile? Or is there another meta reason?

Re: Exploiting System Management Mode with a very long interrupt

#26
post #17

Earlier quoted context omitted.

system management mode does a lot of stuff, some of which is time critical. If your system is overheating and one of the cores is stuck off in the weeds, it's probably better to get on with the thermal response rather than waiting forever. Also, the System Management Interrupts are supposed to return to normal processing in some finite timespan; a timeout bounds the wait time.

If it is critical it should not be running on same cores

Using the example above, if a CPU core is overheating, can you down clock that core using and instruction run on another core? I don't actually know that much about how the hardware actually works at that level, so I am genuinely asking.

Re: Exploiting System Management Mode with a very long interrupt

#27

Almost nothing from this GitHub profile posted until the last four days. From a meta perspective what is going on? What am I missing? Why is this GitHub profile suddenly getting massive attention and making front page so frequently?

DEFCON the fun hacking conference in las Vegas that happened last weekend.

Re: Exploiting System Management Mode with a very long interrupt

#28
> The code waits for all cores to enter SMM, or for up to 1 second, whichever occurs first.

See, this is why the mantra that all blocking operations should have a timeout is stupid and short-sighted no matter how many times junior devs and AIs bleat it in code review. Continuing after arbitrary timeouts usually violates invariants, and failing after arbitrary timeouts introduces hard-to-debug failures under load.

Better for the system to hang so you can debug it --- and maybe reboot as a whole via a watchdog --- than for the code to say "Oh, this operation is supposed to be done after one second, but isn't. Situation normal, everything fine. We continue."

No. That situation is very much not fine.

Re: Exploiting System Management Mode with a very long interrupt

#29

It's nice to see SMM is as terrible idea now as it was at moment of conception. All coz they can't be arsed to put a tiny management core separate from the rest and save a penny

ARM has EL3, which is basically the same thing. There's nothing inherently wrong with the CPU having multiple privilege levels. The problem with SMM has always been its user-hostile opaque implementation, not that the technical mechanism exists.

Re: Exploiting System Management Mode with a very long interrupt

#30
post #17

Unclear why there is a 1 second timeout at all. Presumably the patch for that will be to make it an infinity timeout.

system management mode does a lot of stuff, some of which is time critical. If your system is overheating and one of the cores is stuck off in the weeds, it's probably better to get on with the thermal response rather than waiting forever. Also, the System Management Interrupts are supposed to return to normal processing in some finite timespan; a timeout bounds the wait time.

It could also react to hitting the timeout with a hard reset. Annoying perhaps, but at least safe. Ancient principle of system design is that when you must fail, it is better to fail safe than fail deadly even when it's annoying in the short term.
Post reply on HN