ACPI tables contain ACPI Machine Language, or AML, which is executed by an interpreter in the kernel at boot. Certain ACPI tables, such as the DSDT, are necessary to support hardware ACPI events such as resuming a suspended system. To access these tables, which are stored on the BIOS flash, the kernel maps them to memory, causing any access to the tables to re-read from the actual flash chip itself every time the access occurs. This means that an attacker who modifies the BIOS flash contents while a system is running may be able to activate the payload by triggering an ACPI event, causing the newly modified malicious DSDT AML being re-read and executed.
I know precious little about ACPI, but this has always been my understanding. My questions:
Am I correct that an ACPI table modified at runtime will be executed during certain ACPI events?
If this is true, then what specific events can trigger this (resume from S3, hotplugs, etc.)?
Which tables are re-read from flash? Is it only the DSDT? The SSDT? Is it system-specific?
This is relevant because, if my understanding is correct, it would allow an attacker that can modify the BIOS flash to bypass TPM-based SRTM protection at runtime, even if the CRTM is read-only.