# US 7,610,426 B1 · System management mode code modifications to increase computer system security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,610,426 B1 - Document ID: US7610426B1 - Status: Granted - Kind: B1 - Application number: 11/644,224 - Filed: 2006-12-22 - Granted: 2009-10-27 - Earliest claimed: 2006-12-22 - Inventors: David A. Dunn - Web page: https://patentgrep.com/patent/US7610426B1 ## CPC - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 2221/2105: Dual mode as a secondary aspect - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods for processing more securely. Embodiments provide effective and efficient mechanisms for reducing APIC interference with accesses to SMRAM, where enhanced SMM code implementing these mechanisms effectively reduces APIC attacks and increases the security of proprietary, confidential or otherwise secure data stored in SMRAM. ## Claims ### Claim 1 A method for increasing the security of a computer system using an x86-compliant processor, wherein said method is performed by a system management mode (SMM) process, said method comprising: upon execution of a system management interrupt (SMI), storing a first memory location in a component selected from a group consisting of a register and a memory to which an advanced programmable interrupt controller (APIC) is mapped prior to said SMI; moving said mapping of said APIC to an updated memory location; and executing at least one system management mode (SMM) task while said APIC is mapped to said updated memory location. ### Claim 2 (depends on 1) The method of claim 1 further comprising: returning said mapping of said APIC to said first memory location; and executing a resume (RSM) instruction. ### Claim 3 (depends on 1) The method of claim 1, wherein said updated memory location is a default memory location for said APIC used upon reset of said processor. ### Claim 4 (depends on 1) The method of claim 1, wherein said updated memory location reduces interference of said mapping of said APIC with said at least one SMM task. ### Claim 5 (depends on 1) The method of claim 1, wherein said updated memory location causes an overlap of said mapping of said APIC with a portion of system management random access memory (SMRAM) in a memory, and wherein said overlap is less than or equal to a predetermined allowable overlap. ### Claim 6 (depends on 1) The method of claim 1 further comprising: identifying a location of a portion of system management random access memory (SMRAM) in a memory; determining whether said mapping of said APIC overlaps a portion of SMRAM within said memory; and upon determining an overlap, moving said mapping of said APIC to a default memory location for said APIC used upon reset of said processor. ### Claim 7 (depends on 1) The method of claim 1 further comprising: identifying a location of a portion of system management random access memory (SMRAM) in a memory; determining whether said mapping of said APIC overlaps a portion of SMRAM within said memory; and upon determining an overlap, moving said mapping of said APIC to a memory location where interference of said mapping of said APIC with said at least one SMM task is reduced. ### Claim 8 (depends on 1) The method of claim 1, wherein said first memory location is stored in a register of said processor. ### Claim 9 (depends on 1) The method of claim 1, wherein said first memory location is stored within a portion of a save-state map of said memory. ### Claim 10 A method for increasing the security of a computer system using an x86-compliant processor, wherein said method is performed by system management mode (SMM) process, said method comprising: upon execution of a system management interrupt (SMI), disabling an advanced programmable interrupt controller (APIC) associated with said processor; and executing at least one system management mode (SMM) task while said APIC is disabled. ### Claim 11 (depends on 10) The method of claim 10 further comprising: determining whether said APIC is enabled prior to said disabling of said APIC; and if said APIC is enabled, then re-enabling said APIC before execution of a resume (RSM) instruction. ### Claim 12 (depends on 10) The method of claim 10 further comprising: determining whether said APIC is enabled prior to said disabling of said APIC; and if said APIC is not enabled, then bypassing said disabling of said APIC and executing a resume (RSM) instruction after said executing at least one SMM task. ### Claim 13 (depends on 10) The method of claim 10, wherein said disabling and said enabling are performed by changing a state of a global flag within a model specific register of said processor. ### Claim 14 (depends on 10) The method of claim 10, wherein said disabling and said enabling are performed by changing a state of a software flag within a register of said APIC. ### Claim 15 A method for increasing the security of a computer system using an x86-compliant processor, wherein said method is performed by a system management mode (SMM) process, said method comprising: identifying a first location in a memory, wherein said first location comprises an address to which a portion of an advanced programmable interrupt controller (APIC) is mapped; identifying a second location in said memory, wherein said second location comprises a portion of system management random access memory (SMRAM); determining an allowable overlap of an address range indicated by said first location and an address range indicated by said second location; determining a current overlap of an address range indicated by said first location and an address range indicated by said second location; and upon determining that said current overlap is greater than said allowable overlap, preventing said processor from resuming execution of an operating system of said computer system. ### Claim 16 (depends on 15) The method of claim 15, wherein said preventing said processor from resuming execution of said operating system comprises executing a halt instruction. ### Claim 17 (depends on 15) The method of claim 15, wherein said preventing said processor from resuming execution of said operating system comprises executing an infinite loop. ### Claim 18 (depends on 15) The method of claim 15, wherein said first location is a base address of said mapping of said portion of said APIC. ### Claim 19 (depends on 15) The method of claim 15, wherein said second location is a base address of said SMRAM. ### Claim 20 A method for increasing the security of a computer system using an x86-compliant processor, wherein said method is performed by a system management mode (SMM) process, said method comprising: identifying a location in a memory, wherein said location comprises an address to which a portion of an advanced programmable interrupt controller (APIC) is mapped; determining if interference by said APIC mapping in said location with at least one system management mode (SMM) task is acceptable; and upon determining that said interference is not acceptable, preventing said processor from resuming execution of an operating system of said computer system. ### Claim 21 (depends on 20) The method of claim 20, wherein said preventing said processor from resuming execution of said operating system comprises executing a halt instruction. ### Claim 22 (depends on 20) The method of claim 20, wherein said preventing said processor from resuming execution of said operating system comprises executing an infinite loop. ### Claim 23 (depends on 20) The method of claim 20, wherein said location is a base address of said mapping of said portion of said APIC.