Smm protection utilizing ring separation and smi isolation
OwnerKirk D. Brannock, Jiewen Yaoinventors
Life of this patent
Estimating the term…
Abstract
In one embodiment, a processor comprises a plurality of system resources accessible to processes executed at a first privilege level but generally not accessible to processes executing at a second privilege level; a memory to store an access control policy; and an execution unit to: execute a system management interrupt (SMI) handler at the second privilege level; and execute a policy manager at the first privilege level, the policy manager to detect a request from the SMI handler to access a first system resource of the plurality of system resources; and access the first system resource on behalf of the SMI handler in response to a determination that the access control policy allows the SMI handler to access the first system resource.
Claims20
A processor comprising:
- a plurality of system resources accessible to processes executed at a first privilege level but generally not accessible to processes executing at a second privilege level;
- a memory to store an access control policy;
- and
- an execution unit to:
- execute a system management interrupt (SMI) handler at the second privilege level;
- and
- execute a policy manager at the first privilege level, the policy manager to:
- detect a request from the SMI handler to access a first system resource of the plurality of system resources;
- and
- access the first system resource on behalf of the SMI handler in response to a determination that the access control policy allows the SMI handler to access the first system resource.
A method comprising:
- storing an access control policy for a plurality of system resources accessible to processes executed at a first privilege level but generally not accessible to processes executing at a second privilege level;
- executing a system management interrupt (SMI) handler at the second privilege level;
- and
- executing a policy manager at the first privilege level, the policy manager to:
- detect a request from the SMI handler to access a first system resource of the plurality of system resources;
- and
- access the first system resource on behalf of the SMI handler in response to a determination that the access control policy allows the SMI handler to access the first system resource.
At least one non-transitory machine readable storage medium having instructions stored thereon, the instructions when executed by a machine to cause the machine to:
- store an access control policy for a plurality of system resources accessible to processes executed at a first privilege level but generally not accessible to processes executing at a second privilege level;
- execute a system management interrupt (SMI) handler at the second privilege level;
- and
- execute a policy manager at the first privilege level, the policy manager to:
- detect a request from the SMI handler to access a first system resource of the plurality of system resources;
- and
- access the first system resource on behalf of the SMI handler in response to a determination that the access control policy allows the SMI handler to access the first system resource.
Dependencies are inferred from the claim text.