Limiting a number of illegitimate interrupts from switching a central processing unit to a system management mode
AssigneeMicrosoft Technology Licensing, LLC
InventorsMallik Bulusu, Muhammad A. Ahmed, Ganesh Kumar A, Kiran Bangalore Sathyanarayana, Pingfan Song
Life of this patent
Estimating the term…
Abstract
Disclosed herein is a system for limiting the rate at which system management interrupts can suspend normal execution of a central processing unit (CPU) by switching the operating mode of the CPU from one of the real mode or the protected mode to the system management mode. The rate limits imposed by the system provides a protective layer against cyberattacks (e.g., a distributed denial-of-service (DDoS) attack) from malicious actors and ensures the CPU can be more efficient regarding the execution of workloads (e.g., processing threads).
Claims20
A method implemented by a baseboard management controller for limiting a number of illegitimate interrupts from switching an operating mode of a central processing unit from a real operating mode or a protected operating mode to a system management operating mode, the method comprising:
- defining, for each of a plurality of different types of interrupts, a threshold number of interrupts that are allowed to switch the operating mode of the central processing unit from the real operating mode or the protected operating mode to the system management operating mode, wherein:
- the baseboard management controller is configured to respectively manage the plurality of different types of interrupts via a plurality of different interfaces;
- and
- the threshold number of interrupts defined for a first type of interrupt is different than the threshold number of interrupts defined for a second type of interrupt;
- tracking, via a respective interface for the first type of interrupt, a number of interrupts that have been allowed to switch the operating mode of the central processing unit from the real operating mode or the protected operating mode to the system management operating mode;
- determining, based on the tracking, that the number of interrupts has satisfied the threshold number of interrupts defined for the first type of interrupt;
- and
- preventing, based on the determining, additional interrupts of the first type of interrupt from being allowed to switch the operating mode of the central processing unit from the real operating mode or the protected operating mode to the system management operating mode.
A method implemented by a baseboard management controller for limiting a number of illegitimate interrupts from switching an operating mode of a central processing unit from a real operating mode or a protected operating mode to a system management operating mode, the method comprising:
- defining, for each of a plurality of different types of interrupts, a threshold number of interrupts that are allowed to switch the operating mode of the central processing unit from the real operating mode or the protected operating mode to the system management operating mode, wherein:
- the baseboard management controller is configured to respectively manage the plurality of different types of interrupts via a plurality of different interfaces;
- and
- the threshold number of interrupts defined for a first type of interrupt is different than the threshold number of interrupts defined for a second type of interrupt;
- receiving a first interrupt invocation request via a respective interface for the first type of interrupt;
- determining that a current number of interrupts, for the first type of interrupt, that have been allowed to switch the operating mode of the central processing unit from the real operating mode or the protected operating mode to the system management operating mode does not satisfy the threshold number of interrupts defined for the first type of interrupt;
- in response to determining that the current number of interrupts, for the first type of interrupt, that have been allowed to switch the operating mode of the central processing unit from the real operating mode or the protected operating mode to the system management operating mode does not satisfy the threshold number of interrupts defined for the first type of interrupt, invoking a first interrupt, based on the first interrupt invocation request, that switches the operating mode of the central processing unit from the real operating mode or the protected operating mode to the system management operating mode;
- incrementing the current number of interrupts, for the first type of interrupt, by one;
- receiving a second interrupt invocation request via a respective interface for the first type of interrupt;
- determining that the current number of interrupts, for the first type of interrupt, that have been allowed to switch the operating mode of the central processing unit from the real operating mode or the protected operating mode to the system management operating mode satisfies the threshold number of interrupts defined for the first type of interrupt;
- and
- in response to determining that the current number of interrupts, for the first type of interrupt, that have been allowed to switch the operating mode of the central processing unit from the real operating mode or the protected operating mode to the system management operating mode satisfies the threshold number of interrupts defined for the first type of interrupt, preventing a second interrupt from being invoked based on the second interrupt invocation request.
A baseboard management controller configured to perform operations comprising:
- tracking, via a respective interface for each of a plurality of different types of interrupts, a number of interrupts that have been allowed to switch an operating mode of a central processing unit from a real operating mode or a protected operating mode to a system management operating mode;
- determining, based on the tracking, that the number of interrupts for a first type of interrupt has satisfied a threshold number of interrupts defined for the first type of interrupt, wherein the threshold number of interrupts defined for the first type of interrupt is different than a threshold number of interrupts defined for a second type of interrupt;
- and
- preventing, based on the determining, additional interrupts for the first type of interrupt from being allowed to switch the operating mode of the central processing unit from the real operating mode or the protected operating mode to the system management operating mode.
Dependencies are inferred from the claim text.