System management mode code modifications to increase computer system security
OwnerDavid A. Dunninventor
Life of this patent
Estimating the term…
Abstract
Methods for processing more securely. Embodiments provide effective and efficient mechanisms for reducing APIC interference with accesses to SMRAM, where enhanced SMM code implementing these mechanisms effectively reduces APIC attacks and increases the security of proprietary, confidential or otherwise secure data stored in SMRAM.
Claims23
A method for increasing the security of a computer system using an x86-compliant processor, wherein said method is performed by a system management mode (SMM) process, said method comprising:
- upon execution of a system management interrupt (SMI), storing a first memory location in a component selected from a group consisting of a register and a memory to which an advanced programmable interrupt controller (APIC) is mapped prior to said SMI;
- moving said mapping of said APIC to an updated memory location;
- and
- executing at least one system management mode (SMM) task while said APIC is mapped to said updated memory location.
A method for increasing the security of a computer system using an x86-compliant processor, wherein said method is performed by system management mode (SMM) process, said method comprising:
- upon execution of a system management interrupt (SMI), disabling an advanced programmable interrupt controller (APIC) associated with said processor;
- and
- executing at least one system management mode (SMM) task while said APIC is disabled.
A method for increasing the security of a computer system using an x86-compliant processor, wherein said method is performed by a system management mode (SMM) process, said method comprising:
- identifying a first location in a memory, wherein said first location comprises an address to which a portion of an advanced programmable interrupt controller (APIC) is mapped;
- identifying a second location in said memory, wherein said second location comprises a portion of system management random access memory (SMRAM);
- determining an allowable overlap of an address range indicated by said first location and an address range indicated by said second location;
- determining a current overlap of an address range indicated by said first location and an address range indicated by said second location;
- and
- upon determining that said current overlap is greater than said allowable overlap, preventing said processor from resuming execution of an operating system of said computer system.
A method for increasing the security of a computer system using an x86-compliant processor, wherein said method is performed by a system management mode (SMM) process, said method comprising:
- identifying a location in a memory, wherein said location comprises an address to which a portion of an advanced programmable interrupt controller (APIC) is mapped;
- determining if interference by said APIC mapping in said location with at least one system management mode (SMM) task is acceptable;
- and
- upon determining that said interference is not acceptable, preventing said processor from resuming execution of an operating system of said computer system.
Dependencies are inferred from the claim text.