System Management Mode
Encyclopedia
System Management Mode (SMM) is an operating mode in which all normal execution (including the operating system
) is suspended, and special separate software (usually firmware
or a hardware-assisted debugger
) is executed in high-privilege mode. It was first released with the Intel 386SL. While initially special SL versions were required for SMM, Intel incorporated SMM in its mainline 486 and Pentium processors in 1993. AMD copied Intel's SMM with the Enhanced Am486
processors in 1994. It is available in all later microprocessor
s in the x86 architecture
.
Operating system
An operating system is a set of programs that manage computer hardware resources and provide common services for application software. The operating system is the most important type of system software in a computer system...
) is suspended, and special separate software (usually firmware
Firmware
In electronic systems and computing, firmware is a term often used to denote the fixed, usually rather small, programs and/or data structures that internally control various electronic devices...
or a hardware-assisted debugger
Debugger
A debugger or debugging tool is a computer program that is used to test and debug other programs . The code to be examined might alternatively be running on an instruction set simulator , a technique that allows great power in its ability to halt when specific conditions are encountered but which...
) is executed in high-privilege mode. It was first released with the Intel 386SL. While initially special SL versions were required for SMM, Intel incorporated SMM in its mainline 486 and Pentium processors in 1993. AMD copied Intel's SMM with the Enhanced Am486
Am486
The Am486 is a 80486-class family of computer processors that was produced by AMD in the 1990s. Intel beat AMD to market by nearly four years, but AMD priced its 40 MHz 486 at or below Intel's price for a 33 MHz chip, offering about 20% better performance for the same price.While...
processors in 1994. It is available in all later microprocessor
Microprocessor
A microprocessor incorporates the functions of a computer's central processing unit on a single integrated circuit, or at most a few integrated circuits. It is a multipurpose, programmable device that accepts digital data as input, processes it according to instructions stored in its memory, and...
s in the x86 architecture
X86 architecture
The term x86 refers to a family of instruction set architectures based on the Intel 8086 CPU. The 8086 was launched in 1978 as a fully 16-bit extension of Intel's 8-bit based 8080 microprocessor and also introduced segmentation to overcome the 16-bit addressing barrier of such designs...
.
Usage
Some uses of SMM are:- Handle system events like memory or chipset errors.
- Manage system safety functions, such as shutdown on high CPU temperature and turning the fans on and off.
- Security functions, such as flash device lock down require SMM support on some chipsets.
- Deeper sleep power management support on Intel systems.
- Control power management operations, such as managing the voltage regulator moduleVoltage regulator moduleA voltage regulator module or VRM, sometimes called PPM , is a buck converter that provides a microprocessor the appropriate supply voltage, converting +5 V or +12 V to a much lower voltage required by the CPU. Some are soldered to the motherboard while others are installed in an open slot...
s. - Emulate motherboard hardware that is unimplemented or buggy.
- Emulate a PS/2 mouse or keyboard by converting the messages from USB versions of those peripherals to the messages that would have been generated had PS/2 versions of such hardware been connected.
- Centralize system configuration, such as on Toshiba and IBM notebook computers.
- Hackers can break into SMM to run high-privileged rootkits as shown at Black HatBlack Hat BriefingsThe Black Hat Conference is a computer security conference that brings together a variety of people interested in information security. Representatives of federal agencies and corporations attend along with hackers. The Briefings take place regularly in Las Vegas, Barcelona and Tokyo...
2008. - Emulate or forward calls to a Trusted Platform ModuleTrusted Platform ModuleIn computing, Trusted Platform Module is both the name of a published specification detailing a secure cryptoprocessor that can store cryptographic keys that protect information, as well as the general name of implementations of that specification, often called the "TPM chip" or "TPM Security...
(TPM).
Entering SMM
SMM is entered via the SMI (system management interrupt), which is caused by:- Motherboard hardware or chipset signaling via a designated pin SMI# of the processor chip. This signal can be an independent event.
- Software SMI triggered by the system software via an I/O access to a location considered special by the motherboard logic (port 0B2h is common).
- An IO write to a location which the firmware has requested that the processor chip act on.
Problems
- By design, the operating system cannot override or disable the SMI.
- Since the SMM code (SMI handler) is installed by the system firmware (BIOSBIOSIn IBM PC compatible computers, the basic input/output system , also known as the System BIOS or ROM BIOS , is a de facto standard defining a firmware interface....
), the OS and the SMM code may have expectations about hardware settings that are incompatible, such as different ideas of how the Advanced Programmable Interrupt ControllerAdvanced Programmable Interrupt ControllerIn computing, an Advanced Programmable Interrupt Controller is a more complex Programmable Interrupt Controller than Intel's original types such as the 8259A...
(APIC) should be set up. - Operations in SMM take CPU time away from the OS, since the CPU state must be stored to memory (SMRAM) and any write-back caches must be flushed. This can destroy real-time behavior and cause clock ticks to get lost. The Windows and Linux kernels define an ‘SMI Timeout’ setting a period within which SMM handlers must return control to the operating system or it will ‘hang’ or ‘crash’.
- The SMM may disrupt the behavior of real-timeReal-time computingIn computer science, real-time computing , or reactive computing, is the study of hardware and software systems that are subject to a "real-time constraint"— e.g. operational deadlines from event to system response. Real-time programs must guarantee response within strict time constraints...
applications with constrained timing requirements. - A digital logic analyzerLogic analyzerA logic analyzer is an electronic instrument which displays signals in a digital circuit. A logic analyzer may convert the captured data into timing diagrams, protocol decodes, state machine traces, assembly language, or correlate assembly with source-level software.Presently, there are three...
may be required to determine if the CPU has entered SMM (checking state of SMIACT# pin of CPU). - Recovering the SMI handler code to analyze it for bugs, vulnerabilities and secrets requires a logic analyzer or disassembly of the system firmware.
See also
- MediaGXMediaGXThe MediaGX CPU was an x86 processor manufactured and designed by Cyrix and later after merger manufactured by National Semiconductor, and was introduced in 1997. The core is based on the integration of the Cyrix Cx5x86 CPU core with hardware to process video and audio output...
processor which implements nonexistent hardware via SMM - Intel 80486SLIntel 80486SLThe Intel's i486SL is the power-saving variant of the i486DX microprocessor. The SL was designed for use in mobile computers. It was produced between November 1992 and June 1993. Clock speeds available were 20, 25 and 33 MHz...
- Extensible Firmware InterfaceExtensible Firmware InterfaceThe Unified Extensible Firmware Interface is a specification that defines a software interface between an operating system and platform firmware...
(EFI) - Coreboot implements an open source SMM/SMI handler for some chipsets