Режим системного управления процессоров x86 (SMM)

Operating mode of x86 central processor units

System Management Mode (SMM, sometimes called ring −2 in reference to protection rings) is an operating mode of x86 central processor units (CPUs) in which all normal execution, including the operating system, is suspended. An alternate software system which usually resides in the computer's firmware, or a hardware assisted debugger, is then executed with high privileges. It was first released with the Intel 386SL. While initially special SL versions were required for SMM, Intel incorporated SMM in its mainline 486 and Pentium processors in 1993. AMD implemented Intel's SMM with the Am386 processors in 1991. It is available in all later microprocessors in the x86 architecture. In ARM architecture the Exception Level 3 (EL3) mode is also referred as Secure Monitor Mode or System Management Mode.

SMM is a special purpose operating mode provided for handling system wide functions like power management, system hardware control, or proprietary OEM designed code. It is intended for use only by system firmware (BIOS or UEFI), not by applications software or general purpose systems software. The main benefit of SMM is that it offers a distinct and easily isolated processor environment that operates transparently to the operating system or executive and software applications. In order to achieve transparency, SMM imposes certain rules. The SMM can only be entered through SMI (System Management Interrupt). The processor executes the SMM code in a separate address space (SMRAM) that has to be made inaccessible to other operating modes of the CPU by the firmware. System Management Mode can address up to 4 GB memory as huge real mode. In x86 64 processors, SMM can address >4 GB memory as real address mode.

By design, the operating system cannot override or disable the SMI. Due to this fact, it is a target for malicious rootkits to reside in, including NSA's "implants", which have individual code names for specific hardware, like SOUFFLETROUGH for Juniper Networks firewalls, SCHOOLMONTANA for J series routers of the same company, DEITYBOUNCE for DELL, or IRONCHEF for HP Proliant servers. Improperly designed and insufficiently tested SMM BIOS code can make the wrong assumptions and not work properly when interrupting some other x86 operating modes like PAE or 64 bit long mode. According to the documentation of the Linux kernel, around 2004, such buggy implementations of the USB legacy support feature were a common cause of crashes, for example, on motherboards based on the Intel E7505 chipset. There is also some overhead involved with switching in and out of SMM, since the CPU state must be stored to memory (SMRAM) and any write back caches must be flushed. This can destroy real time behavior and cause clock ticks to get lost. The Windows and Linux kernels define an "SMI Timeout" setting a period within which SMM handlers must return control to the operating system, or it will "hang" or "crash". The SMM may disrupt the behavior of real time applications with constrained timing requirements. A logic analyzer may be required to determine whether the CPU has entered SMM (checking state of SMIACT# pin of CPU). Recovering the SMI handler code to analyze it for bugs, vulnerabilities and secrets requires a logic analyzer or disassembly of the system firmware.