System Management Mode
Get System Management Mode essential facts below. View Videos or join the System Management Mode discussion. Add System Management Mode to your PopFlock.com topic list for future reference or share this resource on social media.
System Management Mode

System Management Mode (SMM, sometimes called ring -2 in reference to protection rings)[1][2] is an operating mode of x86 central processor units (CPUs) in which all normal execution, including the operating system, is suspended. An alternate software system which usually resides in the computer's firmware, or a hardware-assisted debugger, is then executed with high privileges.

It was first released with the Intel 386SL.[3] While initially special SL versions were required for SMM, Intel incorporated SMM in its mainline 486 and Pentium processors in 1993. AMD implemented Intel's SMM with the Am386 processors in 1991.[4] It is available in all later microprocessors in the x86 architecture.

Some ARM processors also include the Management Mode, for the system firmware (such as UEFI).[5]

Operation

SMM is a special-purpose operating mode provided for handling system-wide functions like power management, system hardware control, or proprietary OEM designed code. It is intended for use only by system firmware (BIOS or UEFI), not by applications software or general-purpose systems software. The main benefit of SMM is that it offers a distinct and easily isolated processor environment that operates transparently to the operating system or executive and software applications.

In order to achieve transparency, SMM imposes certain rules. The SMM can only be entered through SMI (System Management Interrupt). The processor executes the SMM code in a separate address space (SMRAM) that has to be made inaccessible to other operating modes of the CPU by the firmware.[6]

System Management Mode can address up to 4GB memory as huge real mode. In x86-64 processors, SMM can address >4GB memory as real address mode.[7]

Usage

Initially, System Management Mode was used for implementing power management and hardware control features like Advanced Power Management (APM). However, BIOS manufacturers and OEMs have relied on SMM for newer functionality like Advanced Configuration and Power Interface (ACPI).[8][9]

Some uses of the System Management Mode are:

System Management Mode can also be abused to run high-privileged rootkits, as demonstrated at Black Hat 2008[13] and 2015.[14]

Entering SMM

SMM is entered via the SMI (system management interrupt), which is invoked by:

  • Motherboard hardware or chipset signaling via a designated pin SMI# of the processor chip.[15] This signal can be an independent event.
  • Software SMI triggered by the system software via an I/O access to a location considered special by the motherboard logic (port 0B2h is common).[16]
  • An I/O write to a location which the firmware has requested that the processor chip act on.

By entering SMM, the processor looks for the first instruction at the address SMBASE (SMBASE register content) + 8000H (by default 38000H), using registers CS = 3000H and EIP = 8000H. The CS register value (3000H) is due to the use of real mode memory addresses by the processor when in SMM. In this case, the CS is internally appended with 0H on its rightmost end .

Problems

By design, the operating system cannot override or disable the SMI. Due to this fact, it is a target for malicious rootkits to reside in,[17][18] including NSA's "implants"[19] which have individual code names for specific hardware, like SOUFFLETROUGH for Juniper Networks firewalls,[20] SCHOOLMONTANA for J-series routers of the same company,[21] DEITYBOUNCE for DELL,[22] or IRONCHEF for HP Proliant servers.[23]

Improperly designed and insufficiently tested SMM BIOS code can make the wrong assumptions and not work properly when interrupting some other x86 operating modes like PAE or 64-bit long mode.[24] According to the documentation of the Linux kernel, around 2004, such buggy implementations of the USB legacy support feature were a common cause of crashes, for example on motherboards based on the Intel E7505 chipset.[10]

Since the SMM code (SMI handler) is installed by the system firmware (BIOS), the OS and the SMM code may have expectations about hardware settings that are incompatible, such as different ideas of how the Advanced Programmable Interrupt Controller (APIC) should be set up.

Operations in SMM take CPU time away from the applications, operating system kernel and hypervisor, with the effects magnified for multicore processors since each SMI causes all cores to switch modes.[25] There is also some overhead involved with switching in and out of SMM, since the CPU state must be stored to memory (SMRAM) and any write-back caches must be flushed. This can destroy real-time behavior and cause clock ticks to get lost. The Windows and Linux kernels define an 'SMI Timeout' setting a period within which SMM handlers must return control to the operating system or it will 'hang' or 'crash'.

The SMM may disrupt the behavior of real-time applications with constrained timing requirements.

A logic analyzer may be required to determine if the CPU has entered SMM (checking state of SMIACT# pin of CPU).[15] Recovering the SMI handler code to analyze it for bugs, vulnerabilities and secrets requires a logic analyzer or disassembly of the system firmware.

See also

References

  1. ^ Domas, Christopher (2015-07-20). "The Memory Sinkhole" (PDF). Black Hat. Retrieved .
  2. ^ Tereshkin, Alexander and Wojtczuk, Rafal (2009-07-29). "Introducing Ring -3 Rootkits" (PDF). Invisible Things Lab, Black Hat USA. p. 4. Retrieved .CS1 maint: uses authors parameter (link)
  3. ^ "SMIs Are EEEEVIL (Part 1)". msdn.com. Microsoft.
  4. ^ "AMD Am386SX/SXL/SXLV Datasheet" (PDF). AMD.
  5. ^ https://documentation-service.arm.com/static/5ed11e40ca06a95ce53f905c?token=
  6. ^ "Intel 64 and IA-32 Architectures Developer's Manual: Vol. 3B" (PDF). Intel.
  7. ^ Intel 64 and IA-32 Software Development Manual, Vol. 3, System Management Mode
  8. ^ "SMIs Are EEEEVIL (Part 2)". msdn.com. Microsoft.
  9. ^ "System Management Mode - OSDev Wiki". wiki.osdev.org. Retrieved .
  10. ^ a b Vojtech Pavlik (January 2004). "Linux kernel documentation: USB Legacy support". kernel.org. Retrieved .
  11. ^ Google Tech Talks - Coreboot - 00:34:30
  12. ^ UEFI Platform Initialization Specification
  13. ^ Robert McMillan (2008-05-10). "Hackers find a new place to hide rootkits". InfoWorld.
  14. ^ Rob Williams (2015-08-07). "Researchers Discover Rootkit Exploit In Intel Processors That Dates Back To 1997". HotHardware.com.
  15. ^ a b Intel's System Management Mode by Robert R. Collins
  16. ^ US 5963738  - Computer system for reading/writing system configuration using I/O instruction
  17. ^ Shawn Embleton; Sherri Sparks; Cliff Zou (September 2008). "SMM Rootkits: A New Breed of OS Independent Malware" (PDF). ACM. Retrieved .
  18. ^ "Hackers Find a New Place to Hide Rootkits". PC World. 2008-05-09. Retrieved .
  19. ^ #1 Source for Leaks Around the World! (2013-12-30). "NSA's ANT Division Catalog of Exploits for Nearly Every Major Software/Hardware/Firmware | LeakSource". Leaksource.wordpress.com. Retrieved .
  20. ^ "Schneier on Security: SOUFFLETROUGH: NSA Exploit of the Day". Schneier.com. 2013-12-30. Retrieved .
  21. ^ "Schneier on Security: SCHOOLMONTANA: NSA Exploit of the Day". Schneier.com. 2008-05-30. Retrieved .
  22. ^ "Schneier on Security". schneier.com.
  23. ^ "Schneier on Security: IRONCHEF: NSA Exploit of the Day". Schneier.com. 2014-01-03. Retrieved .
  24. ^ http://images0.cnitblog.com/cnitblog_com/yuhensong/mode.JPG
  25. ^ Brian Delgado and Karen L. Karavanic, "Performance Implications of System Management Mode," 2013 IEEE International Symposium on Workload Characterization, Sept. 22-24, Portland, OR USA.

Further reading


  This article uses material from the Wikipedia page available here. It is released under the Creative Commons Attribution-Share-Alike License 3.0.

System_Management_Mode
 



 



 
Music Scenes