Everything you wanted to know about x86 microcode - but might have - - PowerPoint PPT Presentation

▶
everything you wanted to know about x86 microcode but
SMART_READER_LITE
LIVE PREVIEW

Everything you wanted to know about x86 microcode - but might have - - PowerPoint PPT Presentation

Dec 05, 2023 384 likes •1.42k views

Everything you wanted to know about x86 microcode - but might have been afraid to ask 34 th Chaos Communication Congress, Leipzig December 28, 2017 Philipp Koppe, Benjamin Kollenda, Marc Fyrbiak, Christian Kison, Robert Gawlik, Christof Paar,

slide-1
SLIDE 1

Everything you wanted to know about x86 microcode - but might have been afraid to ask

34th Chaos Communication Congress, Leipzig

December 28, 2017 Philipp Koppe, Benjamin Kollenda, Marc Fyrbiak, Christian Kison, Robert Gawlik, Christof Paar, Thorsten Holz

Horst Görtz Institute for IT-Security Ruhr-Universität Bochum <firstname.lastname>@rub.de emproof www.emproof.de

slide-2
SLIDE 2

Outline

  • What is microcode?
  • Architectural crash course
  • Is it hackable?
  • Demo

1

slide-3
SLIDE 3

Outline

  • What is microcode?
  • Architectural crash course
  • Is it hackable?
  • Demo

1

slide-4
SLIDE 4

What is microcode?

2

slide-5
SLIDE 5

What is microcode?

2

slide-6
SLIDE 6

Previous Work

3

slide-7
SLIDE 7

Previous Work

3

slide-8
SLIDE 8

Previous Work

3

slide-9
SLIDE 9

Previous Work

3

slide-10
SLIDE 10

Previous Work

3

slide-11
SLIDE 11

What is it used for?

4

slide-12
SLIDE 12

What is it used for?

  • Instruction decoding

4

slide-13
SLIDE 13

What is it used for?

  • Instruction decoding
  • Fix CPU bugs

4

slide-14
SLIDE 14

What is it used for?

  • Instruction decoding
  • Fix CPU bugs
  • Exception handling

4

slide-15
SLIDE 15

What is it used for?

  • Instruction decoding
  • Fix CPU bugs
  • Exception handling
  • Power Management

4

slide-16
SLIDE 16

What is it used for?

  • Instruction decoding
  • Fix CPU bugs
  • Exception handling
  • Power Management
  • Complex features (Intel SGX)

4

slide-17
SLIDE 17

x86 ISA is complex

C3 ret

5

slide-18
SLIDE 18

x86 ISA is complex

C3 ret 48 b8 88 77 66 55 movabs rax ,0 x1122334455667788 44 33 22 11

5

slide-19
SLIDE 19

x86 ISA is complex

C3 ret 48 b8 88 77 66 55 movabs rax ,0 x1122334455667788 44 33 22 11 64 ff 03 inc DWORD PTR fs:[ ebx]

5

slide-20
SLIDE 20

x86 ISA is complex

C3 ret 48 b8 88 77 66 55 movabs rax ,0 x1122334455667788 44 33 22 11 64 ff 03 inc DWORD PTR fs:[ ebx] 64 67 66 f0 ff 07 lock inc WORD PTR fs:[bx]

5

slide-21
SLIDE 21

x86 ISA is complex

C3 ret 48 b8 88 77 66 55 movabs rax ,0 x1122334455667788 44 33 22 11 64 ff 03 inc DWORD PTR fs:[ ebx] 64 67 66 f0 ff 07 lock inc WORD PTR fs:[bx] 2e c4 e2 71 96 84 vfmaddsub132ps xmm0 , xmm1 , be 34 23 12 01 xmmword ptr cs: [esi + edi * 4 + 0x11223344]

5

slide-22
SLIDE 22

Micro Ops

pop [ebx]

6

slide-23
SLIDE 23

Micro Ops

pop [ebx]

  • load

temp , [esp] store [ebx], temp add esp , 4

6

slide-24
SLIDE 24

x86 CPUs are prone to errors

7

slide-25
SLIDE 25

x86 CPUs are prone to errors

7

slide-26
SLIDE 26

x86 CPUs are prone to errors

7

slide-27
SLIDE 27

x86 CPUs are prone to errors

7

slide-28
SLIDE 28

Outline

  • What is microcode?
  • Architectural crash course
  • Is it hackable?
  • Demo

8

slide-29
SLIDE 29

x86 Instruction Decoding

9

slide-30
SLIDE 30

x86 Instruction Decoding

10

slide-31
SLIDE 31

Microcode Engine (Vector Decoder)

11

slide-32
SLIDE 32

Microcode Engine (Vector Decoder)

11

slide-33
SLIDE 33

Microcode Engine (Vector Decoder)

11

slide-34
SLIDE 34

Microcode Engine (Vector Decoder)

11

slide-35
SLIDE 35

Microcode Engine (Vector Decoder)

11

slide-36
SLIDE 36

Microcode Update Mechanism

  • Kernel mode
  • Load microcode update into RAM
  • Write virtual address to MSR 0xC0010020
  • Microcode patches not persistent

12

slide-37
SLIDE 37

Microcode Update File Format

13

slide-38
SLIDE 38

Microcode Update File Format

13

slide-39
SLIDE 39

Outline

  • What is microcode?
  • Architectural crash course
  • Is it hackable?
  • Demo

14

slide-40
SLIDE 40

Is it hackable?

15

slide-41
SLIDE 41

Is it hackable?

  • CPUs updatable

15

slide-42
SLIDE 42

Is it hackable?

  • CPUs updatable
  • Update drivers in Linux kernel

15

slide-43
SLIDE 43

Is it hackable?

  • CPUs updatable
  • Update drivers in Linux kernel
  • Microcode updates

15

slide-44
SLIDE 44

Is it hackable?

  • CPUs updatable
  • Update drivers in Linux kernel
  • Microcode updates
  • Update file format

15

slide-45
SLIDE 45

Is it hackable?

  • CPUs updatable
  • Update drivers in Linux kernel
  • Microcode updates
  • Update file format
  • Hints that there is no strong crypto

15

slide-46
SLIDE 46

Unknown Instruction Set

16

slide-47
SLIDE 47

Unknown Instruction Set

16

slide-48
SLIDE 48

Unknown Instruction Set

16

slide-49
SLIDE 49

Is it hackable?

  • Update drivers in Linux kernel
  • Microcode updates
  • Update file format
  • Hints that there is no strong crypto

17

slide-50
SLIDE 50

Is it hackable?

  • Update drivers in Linux kernel
  • Microcode updates
  • Update file format
  • Hints that there is no strong crypto
  • CPU accepts modified updates

17

slide-51
SLIDE 51

Is it hackable?

  • Update drivers in Linux kernel
  • Microcode updates
  • Update file format
  • Hints that there is no strong crypto
  • CPU accepts modified updates
  • Yes!

17

slide-52
SLIDE 52

Framework

18

slide-53
SLIDE 53

Framework

18

slide-54
SLIDE 54

Framework

18

slide-55
SLIDE 55

Framework

18

slide-56
SLIDE 56

Framework

18

slide-57
SLIDE 57

Heatmaps

19

slide-58
SLIDE 58

Reverse Engineering Setting

  • Unknown instruction set analysis
  • Black box model with oracle
  • Feed inputs, filter and observe outputs
  • Infer structure, encoding, meaning

20

slide-59
SLIDE 59

Processor Oracle

21

slide-60
SLIDE 60

Processor Oracle

21

slide-61
SLIDE 61

Processor Oracle

21

slide-62
SLIDE 62

Processor Oracle

21

slide-63
SLIDE 63

Early attempts

Input:

eax 00000101 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4?? 0000000000000111110100000001111011000000000000000000000011010101

22

slide-64
SLIDE 64

Early attempts

Input:

eax 00000101 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4?? 0000000000000111110100000001111011000000000000000000000011010101

Output:

eax 000001 d6 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4??

22

slide-65
SLIDE 65

Early attempts

Input:

eax 00000101 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4?? 00000000000001111101000000011110110000000000000000000000 01010101

23

slide-66
SLIDE 66

Early attempts

Input:

eax 00000101 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4?? 00000000000001111101000000011110110000000000000000000000 01010101

Output:

eax 000001 56 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4??

23

slide-67
SLIDE 67

Early attempts

Input:

eax 00000101 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4?? 00000000000001111101000000011110110000000000000000000000 01010101

Output:

eax 000001 56 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4??

eax = eax + 0x55

23

slide-68
SLIDE 68

Early attempts

Input:

eax 00000101 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4?? 00000000000001111101000000011110110000000000000000000000 01010101

Output:

eax 000001 56 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4??

eax = eax + 0x55

Imm 000000000000011111010000000111101100000000000000 0000000001010101 0x55

23

slide-69
SLIDE 69

Early attempts

Input:

eax 00000101 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4?? 0000000 11 0000111110100000001111011000000000000000000000011010101

24

slide-70
SLIDE 70

Early attempts

Input:

eax 00000101 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4?? 0000000 11 0000111110100000001111011000000000000000000000011010101

Output:

eax 000001 d4 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4??

24

slide-71
SLIDE 71

Early attempts

Input:

eax 00000101 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4?? 00000001100001111101000000011110110000000000000000000000 01010101

25

slide-72
SLIDE 72

Early attempts

Input:

eax 00000101 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4?? 00000001100001111101000000011110110000000000000000000000 01010101

Output:

eax 000001 54 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4??

25

slide-73
SLIDE 73

Early attempts

Input:

eax 00000101 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4?? 00000001100001111101000000011110110000000000000000000000 01010101

Output:

eax 000001 54 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4??

eax = eax ⊕ 0x55

25

slide-74
SLIDE 74

Early attempts

Input:

eax 00000101 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4?? 00000001100001111101000000011110110000000000000000000000 01010101

Output:

eax 000001 54 ebx 00000101 ecx 00000102 edx 00000103 esi 00000104 edi 00000105 ebp 00000106 esp 0013 b4??

eax = eax ⊕ 0x55

Uk1 Operation Imm 000000110 00011111010000000111101100000000000000 0000000001010101 xor 0x55

25

slide-75
SLIDE 75

Micro Op Encoding

Uk1 Operation SwapOps OpMode Op1 Uk2 PZSFlags CFlag Uk3 OpClass SegReg Size Op2 RegMode Uk4 Uk5Imm Imm u

  • oooooooo x

m 111111 uuu f f u CCC ssss zzz 222222 r uuuuuu u iiiiiiiiiiiiiiii 001111100 0 1 011111 010 0 000 1111 011 010110 0 000000 0 0000000011010101 div2 t24q reg

  • s4

64b t15q 0xd5 Uk1 Operation SwapOps OpMode Op1 Uk2 PZSFlags CFlag Uk3 OpClass SegReg Size Op2 RegMode Uk4 Uk5Reg Op3 Uk6Reg u

  • oooooooo x

m 111111 uuu f f u CCC ssss zzz 222222 r uuuuuu uu 333333 uuuuuuuuu 001111111 1 101001 100 0 001 0111 010 101010 1 010000 00 010000 000000000 ld regmd5 ld rs 32b t35d t9d Uk1 ShortOprn Condition SwapOps OpMode Op1 Uk2 PZSFlags CFlag Uk3 OpClass SegReg Size Op2 RegMode Uk4 RomAddr u

  • ccccc

x m 111111 uuu f f u CCC ssss zzz 222222 r uuuuuu aaaaaaaaaaaaaaaaa 0101 00100 1 1 111001 101 0 000 1111 011 111011 0 000000 00000000000000011 jcc EZF t50q reg

  • s4

64b t52q 0x3 Uk1 Action Uk2 RomAddr uuuuuuuuuuuuuuu ooo uu aaaaaaaaaaaa 111111111111110 010 10 010110100101 branch 0x5a5

26

slide-76
SLIDE 76

Infer Logic of ROM Triads

27

slide-77
SLIDE 77

Infer Logic of ROM Triads

27

slide-78
SLIDE 78

Infer Logic of ROM Triads

27

slide-79
SLIDE 79

Infer Logic of ROM Triads

27

slide-80
SLIDE 80

Hardware Analysis

28

slide-81
SLIDE 81

Hardware Analysis

28

slide-82
SLIDE 82

Hardware Analysis

28

slide-83
SLIDE 83

RE Results

  • Heatmaps

29

slide-84
SLIDE 84

RE Results

  • Heatmaps
  • 29 Micro Ops
  • Logic, arithmetic, load, store
  • Write x86 program counter
  • Conditional microcode branch

29

slide-85
SLIDE 85

RE Results

  • Heatmaps
  • 29 Micro Ops
  • Logic, arithmetic, load, store
  • Write x86 program counter
  • Conditional microcode branch
  • Sequence word
  • Next triad, sequence complete, unconditional branch

29

slide-86
SLIDE 86

RE Results

  • Heatmaps
  • 29 Micro Ops
  • Logic, arithmetic, load, store
  • Write x86 program counter
  • Conditional microcode branch
  • Sequence word
  • Next triad, sequence complete, unconditional branch
  • Substitution engine

29

slide-87
SLIDE 87

Augment x86 instructions

  • Jump back to ROM
  • DIV
  • Emulate instruction logic
  • IMUL, SHRD, CMPXCHG, ENTER

30

slide-88
SLIDE 88

Microprograms

  • Instrumentation

31

slide-89
SLIDE 89

Microprograms

  • Instrumentation
  • Remote microcode attacks
  • Control flow hijack in browsers induced by microcode
  • Triggered remotely with ASM.JS, WebAssembly

31

slide-90
SLIDE 90

Microprograms

  • Instrumentation
  • Remote microcode attacks
  • Control flow hijack in browsers induced by microcode
  • Triggered remotely with ASM.JS, WebAssembly
  • Cryptographic microcode Trojans
  • Introduce timing side-channels in constant-time ECC implementation
  • Inject faults to enable fault attacks

31

slide-91
SLIDE 91

Sample Microprogram (simplified)

sub.Z t1d , eax jcc EZF , 0x2

  • r t12d , eax , 0x8

32

slide-92
SLIDE 92

Sample Microprogram (simplified)

sub.Z t1d , eax jcc EZF , 0x2

  • r t12d , eax , 0x8

div2 t15q , t24q , 0xd5 srl t13w , ax , 0x8 div1.C t19d , t12d , t56d

32

slide-93
SLIDE 93

Sample Microprogram (simplified)

sub.Z t1d , eax jcc EZF , 0x2

  • r t12d , eax , 0x8

div2 t15q , t24q , 0xd5 srl t13w , ax , 0x8 div1.C t19d , t12d , t56d mov t9d , t9d , regmd4 add.EP t56d , edx , t56d jcc True , -0x800

32

slide-94
SLIDE 94

Sample Microprogram (simplified)

sub.Z t1d , eax jcc EZF , 0x2

  • r t12d , eax , 0x8

div2 t15q , t24q , 0xd5 srl t13w , ax , 0x8 div1.C t19d , t12d , t56d mov t9d , t9d , regmd4 add.EP t56d , edx , t56d jcc True , -0x800 mov eax , eax add t1d , pcd , 1 writePC t1d

32

slide-95
SLIDE 95

Outline

  • What is microcode?
  • Architectural crash course
  • Is it hackable?
  • Demo

33

slide-96
SLIDE 96

Demo - Bug Attack Overview

  • attack on implementation of otherwise secure crypto
  • introduces error into calculation
  • enables reconstruction of key material
  • bug implemented via microcode update

34

slide-97
SLIDE 97

Security issues

35

slide-98
SLIDE 98

Security issues

  • No signature, any update accepted

35

slide-99
SLIDE 99

Security issues

  • No signature, any update accepted
  • Backdoors are possible

35

slide-100
SLIDE 100

Security issues

  • No signature, any update accepted
  • Backdoors are possible
  • Not really fixable (well, hardware recall...)

35

slide-101
SLIDE 101

Security issues

  • No signature, any update accepted
  • Backdoors are possible
  • Not really fixable (well, hardware recall...)
  • Hacky fix: load update to brick update mechanism

35

slide-102
SLIDE 102

Security issues

  • No signature, any update accepted
  • Backdoors are possible
  • Not really fixable (well, hardware recall...)
  • Hacky fix: load update to brick update mechanism
  • But: requires strong attacker and old CPUs

35

slide-103
SLIDE 103

Conclusion

  • Microcode can be reversed and changed
  • visit us at CCL 0, Multipurpose area ("Binary Security" in c3nav)!
  • sample updates available on Github

https://github.com/RUB-SysSec/Microcode

Horst Görtz Institute for IT-Security Ruhr-Universität Bochum emproof www.emproof.de

36