4 ms·

Does that include all the secret documentation for stuff like LOADALL, ICEBP etc? http://www.drdobbs.com/undocumented-corner/184410285 http://www.drdobbs.com/u

by rasz_pl 10y ago

Does that include all the secret documentation for stuff like LOADALL, ICEBP etc? http://www.drdobbs.com/undocumented-corner/184410285 http://www.drdobbs.com/undocumented-corner/184410285 http://www.rcollins.org/articles/loadall/tspec_a3_doc.html http://www.rcollins.org/articles/loadall/tspec_a3_doc.html You will love this paragraph: "Unlike the 286 LOADALL, the 386 LOADALL is still an Intel top secret. l do not know of any document that describes its use, format, or acknowledges its existence. Very few people at Intel wil1 acknowledge that LOADALL even exists in the 80386 mask. The official Intel line is that, due to U.S. Military pressure, LOADALL was removed from the 80386 mask over a year ago. However, running the program in Listing-2 demonstrates that LOADALL is alive, well, and still available on the latest stepping of the 80386." Just imagine whats in Intel chips now due to NSA pressure :/

ethbro 10y ago
For those curious about the "what" and who don't know x86 opcodes from memory, from the first link and in its earliest incarnation, "LOADALL restores the microprocessor state from the State Save Map that is saved during the transition from user mode to ICE mode. LOADALL loads enough of the microprocessor state to ensure return to any processor operating mode."
mikeash 10y ago
Why would the US military be pressuring Intel to remove obscure instructions in ancient CPU designs?
qb45 10y ago
Not sure what to love here, it's a debug feature which, according to your source, Intel promised the US Mil to remove for some reasons but ultimately didn't. There certainly are undocumented debug facilities in modern CPUs. For one example, the leaked Socket AM3 datasheet clearly shows a JTAG interface, though I don't know if it's operational in production silicon. Hopefully, debug capabilities cannot be used to pwn the CPU from unprivileged code without external debug hardware which could pwn the CPU anyway by itself. It's not even clear if they are enabled in production chips at all. LOADALL for example worked only in RING0 and got ultimately removed early in the 486 days so it seems Intel cared about security somewhat (and probably also about future compatibility, to be honest, it's not fun when software relies on features you want to change in the next generation). Nowadays they should care even more - if software backdoors were available and leaked to the public, the magnitude of shit happening in all those cloud companies would be monumental.
- rasz_pl 10y ago
  > if software backdoors were available and leaked to the public https://www.blackhat.com/us-15/briefings.html#the-memory-sinkhole-unleashing-an-x86-design-flaw-allowing-universal-privilege-escalation https://www.blackhat.com/us-15/briefings.html#the-memory-sin... conveniently "discovered" by a 3 letter agency favorite principle contractor (Batelle Memorial Institute - have fun researching them) employee just after everybody switched to the next(fixed) cpu generation.
  - qb45 10y ago
    I doubt that this can be used for VM escape because it requires access to the physical LAPIC and afaik hypervisors wouldn't allow VMs to touch this. It also doesn't work from userspace so pretty much all you can do with it is hacking SMM from a kernel running on the bare metal. Maybe useful for rootkits, but truth be told 3LAs seem to have no problem making non-SMM malware undetectable by commercial AVs. See stuxnet :) > conveniently "discovered" by a 3 letter agency favorite principle contractor Not sure what you are alluding to. 3LAs wouldn't want this to be known if it was their job, methinks.
    - redblacktree 10y ago
      I think he's saying that the 3LAs knew about it for a long time, but publicly "discovered" the flaw when it was no longer useful to them (after everyone had upgraded)

by rasz_pl 10y ago

ethbro 10y ago

For those curious about the "what" and who don't know x86 opcodes from memory, from the first link and in its earliest incarnation, "LOADALL restores the microprocessor state from the State Save Map that is saved during the transition from user mode to ICE mode. LOADALL loads enough of the microprocessor state to ensure return to any processor operating mode."

mikeash 10y ago

Why would the US military be pressuring Intel to remove obscure instructions in ancient CPU designs?

qb45 10y ago

Not sure what to love here, it's a debug feature which, according to your source, Intel promised the US Mil to remove for some reasons but ultimately didn't. There certainly are undocumented debug facilities in modern CPUs. For one example, the leaked Socket AM3 datasheet clearly shows a JTAG interface, though I don't know if it's operational in production silicon. Hopefully, debug capabilities cannot be used to pwn the CPU from unprivileged code without external debug hardware which could pwn the CPU anyway by itself. It's not even clear if they are enabled in production chips at all. LOADALL for example worked only in RING0 and got ultimately removed early in the 486 days so it seems Intel cared about security somewhat (and probably also about future compatibility, to be honest, it's not fun when software relies on features you want to change in the next generation). Nowadays they should care even more - if software backdoors were available and leaked to the public, the magnitude of shit happening in all those cloud companies would be monumental.

rasz_pl 10y ago
> if software backdoors were available and leaked to the public https://www.blackhat.com/us-15/briefings.html#the-memory-sinkhole-unleashing-an-x86-design-flaw-allowing-universal-privilege-escalation https://www.blackhat.com/us-15/briefings.html#the-memory-sin... conveniently "discovered" by a 3 letter agency favorite principle contractor (Batelle Memorial Institute - have fun researching them) employee just after everybody switched to the next(fixed) cpu generation.
- qb45 10y ago
  I doubt that this can be used for VM escape because it requires access to the physical LAPIC and afaik hypervisors wouldn't allow VMs to touch this. It also doesn't work from userspace so pretty much all you can do with it is hacking SMM from a kernel running on the bare metal. Maybe useful for rootkits, but truth be told 3LAs seem to have no problem making non-SMM malware undetectable by commercial AVs. See stuxnet :) > conveniently "discovered" by a 3 letter agency favorite principle contractor Not sure what you are alluding to. 3LAs wouldn't want this to be known if it was their job, methinks.
  - redblacktree 10y ago
    I think he's saying that the 3LAs knew about it for a long time, but publicly "discovered" the flaw when it was no longer useful to them (after everyone had upgraded)