...huh, I was wondering why serial machine code prankster xoreaxeaxeax was keeping lists of extremely long-running instructions.

Hopefully this is at least only possible in kernel mode, right?

Right?!

▲

tptacek 3 hours ago | parent | next [-]

Is it really a long running instruction? I mean, obviously yes, but what makes it slow is that it's doing an MMIO copy from a slow source. It's like a read(2) system call being "slow" because the fd is associated with a socket to the moon.

	▲	tuetuopay 3 hours ago \| parent \| next [-]
		It's an instruction in the sense that timing boundaries are x86 instruction boundaries, which is what the security model bases itself on. So yeah, not an instruction in the strict CPU sense (microcode + micro-ops), but in the useful sense.
	▲	kmeisthax an hour ago \| parent \| prev [-]
		A read that happens to touch a particular torment nexus fd is still a long-running syscall, even if the syscall servicing routine itself is not long-running. The underlying problem is that program code that is "in a syscall" or "in an instruction" is in a special state for which interruption might not be possible or implemented well[0]. [0] Remember ITS and the PC2 problem?

▲

xxpor 4 hours ago | parent | prev | next [-]

Maybe with vfio/igb_uio/uio_pci_generic? Still root level access.

▲

PunchyHamster an hour ago | parent | prev [-]

Given that you can connect essentially PCIe devices thru USB it is probably exploitable?

Find out which device is accessible to user and does MMIO, emulate it on FPGA, make it slooooooooow. All it needs to do is for driver to trigger a "right" access". GPU comes to mind