Secure communication channel for system management mode

A system for securing system management mode (SMM) in a computer system that includes computing hardware (HW), the system comprising:

• a central processing unit (CPU) of the HW that, when operational, is configurable to execute first code in a normal mode, and second code in a SMM;
• a SMM control engine implementable at least in part on the HW to transition the CPU from the normal mode to the SMM in response to a SMM transition call, and to control access by the CPU in the SMM to data from an originator of the SMM transition call based on an authorization state assigned to the SMM transition call;
• and
• an authorization engine implementable at least in part on the HW to perform authentication of the originator of the SMM transition call in response to the SMM transition call and to assign the authorization state based on an authentication result;
• wherein the SMM control engine is to prevent the CPU in the SMM from accessing the data in response to the authentication result being a failure of authentication.

At least one non-transitory computer-readable medium comprising instructions that, when executed on computing hardware (HW) including a central processing unit (CPU) that is operative in a normal mode and a system management mode (SMM), cause the computing hardware to:

• execute, by the CPU, first code in a normal mode, and second code in a SSM;
• transition the CPU from the normal mode to the SMM in response to a SMM transition call, and to control access by the CPU in the SMM to data from an originator of the SMM transition call based on an authorization state assigned to the SMM transition call;
• perform authentication of the originator of the SMM transition call in response to the SMM transition call and to assign the authorization state based on an authentication result;
• and
• prevent the CPU in the SMM from accessing the data in response to the authentication result being a failure of authentication.

A method for securing system management mode (SMM) in a computer system that includes computing hardware (HW) including a central processing unit (CPU) that is operative in a normal mode and SMM, the method comprising:

• executing, by the CPU, first code in a normal mode, and second code in a SSM;
• transitioning the CPU from the normal mode to the SMM in response to a SMM transition call, and controlling access by the CPU in the SMM to data from an originator of the SMM transition call based on an authorization state assigned to the SMM transition call;
• performing authentication of the originator of the SMM transition call in response to the SMM transition call and assigning the authorization state based on an authentication result;
• and
• preventing the CPU in the SMM from accessing the data in response to the authentication result being a failure of authentication.