Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

X86 MMU fault handling is turing complete

github.com

Post reply on HN
Print view View original

31–40 of 41 posts

Re: X86 MMU fault handling is turing complete

#31

Post by limmeau »

duaneb wrote: post #20
phyalow wrote: post #18

Earlier quoted context omitted.

If you read through the slides @ https://github.com/jbangert/trapcc/blob/master/slides/PFLA-s... there is potential to bypass hardware memory protection. Very interesting.

Ahh, ok. Might actually be enough to, say, copy an encryption key out of kernel memory then?

Most of the techniques described in the slides require ring-0 privileges (replacing descriptor tables and page tables etc). If you have those privileges, you can copy what you want anyway.

Unless the encryption key is guarded by something with SMM privileges -- has that been done?

Re: X86 MMU fault handling is turing complete

#32

Post by jd007 »

tptacek wrote: post #4

This is more or less the greatest thing I've learned about in the last couple years. What's happening here is that they're getting computation without executing any instructions , simply through the process of using the MMU hardware to "resolve addresses". The page directory system has been set up in such a way that address resolution effects a virtual machine that they can code to. This works because when you attemp…

Isn't it a bit misleading to say that they are getting computation without executing any instructions? It's true that they are not executing any x86 instructions from the CPU, but the MMU is doing all the work by executing its instructions of address resolution.

Actually is it even true that they are not executing any x86 instructions on the CPU? From my understanding, the handling of page faults needs the CPU to execute some instructions. Maybe I'm wrong, if so could you enlighten me? Thanks.

Re: X86 MMU fault handling is turing complete

#33

Post by simias »

jd007 wrote: post #32
tptacek wrote: post #4

This is more or less the greatest thing I've learned about in the last couple years. What's happening here is that they're getting computation without executing any instructions , simply through the process of using the MMU hardware to "resolve addresses". The page directory system has been set up in such a way that address resolution effects a virtual machine that they can code to. This works because when you attemp…

Isn't it a bit misleading to say that they are getting computation without executing any instructions? It's true that they are not executing any x86 instructions from the CPU, but the MMU is doing all the work by executing its instructions of address resolution. Actually is it even true that they are not executing any x86 instructions on the CPU? From my understanding, the handling of page faults needs the CPU to exe…

I'm not very familiar with the x86 architecture, but usually when there's a fault the CPU generally attempts to lookup the address of a "callback" function in an interrupt/fault vector.

I suppose if you setup everything very carefully you can make it fault over and over again without giving it the time to execute any instruction.

Without looking into the specifics, I think it's very possible that the CPU is not actually executing any instructions, just waiting for the MMU to get a hold of itself. After all, in order to simply load the instructions you need the MMU to be responsive (or deactivated I suppose, if there's such a thing as no-MMU x86).

Re: X86 MMU fault handling is turing complete

#35

Post by duaneb »

limmeau wrote: post #31
duaneb wrote: post #20

Earlier quoted context omitted.

Ahh, ok. Might actually be enough to, say, copy an encryption key out of kernel memory then?

Most of the techniques described in the slides require ring-0 privileges (replacing descriptor tables and page tables etc). If you have those privileges, you can copy what you want anyway. Unless the encryption key is guarded by something with SMM privileges -- has that been done?

Well the original idea was a rootkit, which traditionally requires ring-0 privileges to install in the first case.

Re: X86 MMU fault handling is turing complete

#36

Post by jd007 »

simias wrote: post #33
jd007 wrote: post #32

Earlier quoted context omitted.

Isn't it a bit misleading to say that they are getting computation without executing any instructions? It's true that they are not executing any x86 instructions from the CPU, but the MMU is doing all the work by executing its instructions of address resolution. Actually is it even true that they are not executing any x86 instructions on the CPU? From my understanding, the handling of page faults needs the CPU to exe…

I'm not very familiar with the x86 architecture, but usually when there's a fault the CPU generally attempts to lookup the address of a "callback" function in an interrupt/fault vector. I suppose if you setup everything very carefully you can make it fault over and over again without giving it the time to execute any instruction. Without looking into the specifics, I think it's very possible that the CPU is not actua…

If I understand MMU correctly, it is merely an address translator and physical memory data fetcher. It cannot process page faults, and when it encounters one, it will have to signal the CPU, because the CPU and the OS on top of it knows how to handle faults. Even if faults are generated repeatedly, doesn't the CPU still have to execute the instructions to push the stack which is how this "instruction-less" machine works? Unless there are certain PFs where the MMU will not signal the CPU and tries to handle the fault by itself.

Re: X86 MMU fault handling is turing complete

#37

Post by limmeau »

jd007 wrote: post #36
simias wrote: post #33

Earlier quoted context omitted.

I'm not very familiar with the x86 architecture, but usually when there's a fault the CPU generally attempts to lookup the address of a "callback" function in an interrupt/fault vector. I suppose if you setup everything very carefully you can make it fault over and over again without giving it the time to execute any instruction. Without looking into the specifics, I think it's very possible that the CPU is not actua…

If I understand MMU correctly, it is merely an address translator and physical memory data fetcher. It cannot process page faults, and when it encounters one, it will have to signal the CPU, because the CPU and the OS on top of it knows how to handle faults. Even if faults are generated repeatedly, doesn't the CPU still have to execute the instructions to push the stack which is how this "instruction-less" machine wo…

The MMU is not so cleanly separable from the CPU on x86.

386 has both a segment mechanism and a paging mechanism. The segment mechanism has several luxury features like automatic saving and restoring of task context. It is possible to set up a segment descriptor so that the CPU, when jumping (or faulting) to an address in the segment, will automatically save task state at one address (taken from a register) and restore task state from another address (taken from the descriptor). Ibelieve that's what they use here. Hence, free memory accesses.

Post reply on HN