SMM

Question about which tools to use, bugs, the best way to implement a function, etc should go here. Don't forget to see if your question is answered in the wiki first! When in doubt post here.
Cemre
Member
Member
Posts: 31
Joined: Fri Nov 09, 2007 5:25 am

Post by Cemre »

Cemre said about its 'transparency' to the software so I'm wondering how one can detect that SMI interrupt occured (without checking MoBo registers). Maybe RDTSC instruction (with 'normal' interrupts disabled):

1. check ticks with RDTSC
2. execute some code which usually takes, say 2000 cycles
3. check ticks with RDTSC
4. time=[3.] - [1.]

If we detected that time=18000 cycles (for example), would that indicate SMI as a cause (or maybe NMI?). Just curious...
Hi,

I just googled the internet a little bit with keywords SMM and RDTSC, TSC and found a mailing list that has the following sentence in one of them.
At least some SMM implementations restore the old TSC value. Sad but true.
Here is the link:
http://linux.derkeiler.com/Mailing-List ... 06014.html
http://linux.derkeiler.com/Mailing-List ... 06012.html

It looks even TSC is not a way of detecting SMM.

Although some BIOS bugs, motherboard pins may allow detection or possibly disabling of SMM, practically, an OS is defenceless against SMM.
arkady
Posts: 17
Joined: Wed Jan 02, 2008 3:14 pm
Location: Poland

Post by arkady »

I've made a simple test with usb mouse connected - running a loop 16.384 times with ints disabled. When I didn't move the mouse, a loop took 2178 cycles/each to execute - 0,0197s in whole (and as an 'anomaly': 2241 cyc.every 32nd time and 2300-2400 cyc.-8 times in all 16.384 passes - why? I don't know). When I was moving the mouse, I noticed that 6 times a loop was executing approx. 1.145.000 cycles - over 500 times longer than usual! This time all passes took 0,0235s to execute. I think SMIs may be responsible for these differences, or maybe not...?

Cemre, as you said, seems like SMI handler can modify TSC and prevent us from knowing it was ever triggered. But I wonder - what would be the purpose of that? AFAIK, we can both read 'the original' SMI handler and 'modify' it if this wasn't disabled by BIOS. So why would the designers want to hide the fact that the handler was executed? Another question is why we would like to know that it was ever triggered? 8)
Cemre
Member
Member
Posts: 31
Joined: Fri Nov 09, 2007 5:25 am

Post by Cemre »

arkady wrote:When I didn't move the mouse, a loop took 2178 cycles/each to execute - 0,0197s in whole (and as an 'anomaly': 2241 cyc.every 32nd time and 2300-2400 cyc.-8 times in all 16.384 passes - why? I don't know).
For the small changes of cycles when not moving the mouse: ( 2178, 2241, 2300-2400 ): The CPU internal core usually tries to execute instructions out of order in a random fashion, and tries to re-order them. however tight loops, or small differences between execution of each micro-op in the core, micro-op syncronization issues, may create resonances ( couldn't find a better word :) ) which you observe every 8-32-64 loops. therefore cycles per instructions ( and TSC ) is usually not unique. I guess this is why you get like 2241 clocks each 32nd time and etc. I think that would explain the "anomaly"
arkady wrote: When I was moving the mouse, I noticed that 6 times a loop was executing approx. 1.145.000 cycles - over 500 times longer than usual! This time all passes took 0,0235s to execute. I think SMIs may be responsible for these differences, or maybe not...?
Most probably it is SMI :) Less ( but not zero ) probably, since USB mouse will try to use the system BUS when you move it, to try sending interrupts or etc... this may be effecting the internal CPU core. but it wouldn't take 500 times longer :) it is most probably SMI.
Cemre, as you said, seems like SMI handler can modify TSC and prevent us from knowing it was ever triggered. But I wonder - what would be the purpose of that? AFAIK, we can both read 'the original' SMI handler and 'modify' it if this wasn't disabled by BIOS. So why would the designers want to hide the fact that the handler was executed? Another question is why we would like to know that it was ever triggered? 8)
Cemre wrote: Microsoft doesn't want people to use SMI for hardware virtualizing because some boards come with buggy BIOS that corrupt PCI, ACPI or USB state to handle USBtoPS/2 mouse, which confuses windows and worst case, brings it down. But well who listens to what microsoft says
I think board manufacturers are worried about microsoft. let's think of a ( rare ) case where microsoft IS able to detect an SMI by reading TSC before and after an assembly "out" or "in" instruction ( or by some other detection method ). and if the system crashes afterwards, this will be reflected to system logs, microsoft can simply blame the board manufacturer for the crash to come clean out of it.

I know it is a rare issue but microsoft is really searching for things like that nowadays ( since windows has a bad crash publicity :) ) so that everyone doesn't always blame a crash to windows. They would say, "buy a microsoft USB mouse" :) or "don't use the mouse in PS/2 mode and retry" :) even, change/update your motherboard/bios. So the board manufacturers are trying to make windows unable to detect it. ( legal issues )

Another one might be; "to be able to recover from a known BIOS bug". if microsoft or an OS developper knows that a certain BIOS type causes a PCI or USB state change when it tries to simulate USBtoPS/2 mouse, they might simply try to recover that state by rewriting PCI or USB registers after receiving the mouse input.

USBtoPS/2 mouse simulation is becoming one of the most used cases of SMM those days, and it is really prone to errors on the USB bus, I heard that some people are unable to use their USB wireless dongles, or Bluetooth dongles when they enable PS/2 mode.

Best wishes.
arkady
Posts: 17
Joined: Wed Jan 02, 2008 3:14 pm
Location: Poland

Post by arkady »

Having read some information on the net, I'm wondering whether the SMM has always been like it is now. I know that quite a few 'practical applications' of its functionality are used nowadays, like USB mouse or power management. I'm sure there was less some 5-10 yrs ago.. However, SMM itself didn't much change, I think (when it was introduced, by the way..?).

At first glance, it looks VERY powerful - you can't disable it or may even not know that it executes. But after a while it turns out that SMI can be modified and triggered by accessing IO registers. Well, now it looks 'only' powerful :wink: ...and a potential threat to security, as some say - I think only a potential one because I haven't heard of anyone ever misusing SMM. Viruses, worms and alike are much more simple to spread after all.

So SMM is probably in interest of BIOS designers only, am I right? OS designers would probably like to make direct use of its possibilties (=manipulate it), but do they..? Most of us are aware of RMode, PMode and VirtM, just omitting SMMode. Maybe because there is no easy way to adapt it for own purposes without affecting the whole system. Also, it requires some knowlegde about certain machine (?). That's why we don't pay too much attention to SMMode unless we want to make use of some 'normally unavailable tricks' :)

Summing up, SMM remains unnoticed though we use it everyday. Still, it's powerful :wink: .... Just to know that SMM exists and is sometimes running somewhere there..in the background :)

p.s. Thx you all guys (esp. Cemre) for your contribution!
Post Reply