STM-PE : To enforce or not to enforce?

[tlaurion]

• Firmware Security blog “Stateless Laptop” tag

  • (2015) Joanna Rutoswka - State considered harmful - A proposal for a stateless laptop (new paper + conference) – Invisible Labs blog
  • (2015) Johanna Rutowska paper: States considered harmful
  • (2015) 32c3 - lecture: Towards (reasonably) trustworthy x86 laptops
    • TXT untrusted, vt-d promises flawed
      • To be “trusted”, would require FOSS SMM to be jailed behind SMI Transfer Mode (STM)
        • (2019) OSFC conference - NSA - Eugene Myers - Implementing STM support for Coreboot
        • (2019) Digestible hig-level article
        • (2019) Code merged under coreboot
        • STM-PE still not widely deployed in the wild

• (2017) Stateless laptop (QubesOS blog post - level 2 certification envisioned for 2019)

  • Never happened. State still considered harmful and untrustworthy.

• (2019) Trammel Hudson - SpiSpy - Open Source SPI emulation

  • (2019) Trammel Hudson - TOCTU blog post (and linked lecture)
    • Time of Check Time of Use (TOCTU)
      • Lots of vulnerability discovered, showing Bootguard failing promises.

• (2019) Trammel Hudson & Peter Bosch - HITB2019AMS – Lecture: TOCTOU Attacks Against Secure Boot And BootGuard

  • (2019) Peter Bosch - Boot Guard TOCTOU CVE-2019-11098 – blog post
  • (2019) Trammel Hudson – SpiSpy - Lecture: SPI flash device emulation Open source tools for flash emulation and research
    • Permits to see what happens from PCH to SPI
      • TOCTU proofs given. Speakers made to beep while bootguard was on (tampering of bootguard proven)
        • So.... What do we do with failed premises?

---

So what do we do now?

• To have VT-D/TXT/DRTM promises, STM-PE is needed.
  • Do we trust STM-PE

[tlaurion]

@marmarek ? ping you to here off channel

[arhabd]

(2018) STM/PE & XHIM — Eugene Myers, NSA — Platform Security Summit 2018
(2018) Using the Intel STM for Protected Execution
(2022) Dasharo issue #82 Coreboot, SMM (System Management Mode) and performance differences
(2018) SMM-based Runtime Integrity Measurement — Brian Delgado, Intel — Platform Security Summit 2018
(??)STM-PE on github
(2022) Dasharo issue #132 Intel STM/PPAM support

[arhabd]

(2013) Performance Implications of System Management Mode

[arhabd]

(2011) SICE: a hardware-level strongly isolated computing environment for x86 multi-core platforms

[arhabd]

(2023) Ringhopper - How We Almost Zero day'd the World

[arhabd]

(2022) Finding SMM Privilege-Escalation Vulnerabilities in
UEFI Firmware with Protocol-Centric Static Analysis

[tlaurion]

(2025+) https://github.com/9elements/LinuxBootSMM

[tlaurion]

2024 On MSI setup guide Dasharo/dasharo-issues#132 (comment)

Traces as well for OptiPlex 9010 Dasharo/dasharo-issues#132 (comment)

Direct input for #1739

[tlaurion]

@marmarek ping again