15 results about "System Management Mode" patented technology

An apparatus is disclosed. The apparatus comprises one or more processors to receive a request to trigger a system management interrupt (SMI), execute policy shim code to enforce access control policy in a first privilege level and dispatch the SMI to shield code to enforce the access security policy to perform a system management mode (SMM) and execute the shield code to perform the SMM, including retrieving an operating system (OS) memory preserved warm reset (MPWR) context, saving the context and issuing a warm reset.

The application provides an IPMI command processing method, device, system and electronic equipment. The method comprises the following steps: obtaining state information of a BMC; determining whether the BMC is currently in a fault state according to the state information of the BMC; triggering an interrupt signal and transmitting the interrupt signal to a BIOS to modify the IPMI retry count of the BMC to a preset minimum IPMI retry count based on the BIOS in the case that it is determined that the BMC is currently in the fault state; and exiting a system management mode when the IPMI command retry count reaches the preset minimum IPMI retry count. The BMC is detected in the fault state, and the IPMI retry count is modified to the preset minimum IPMI retry count in the case that it is determined that the BMC is faulty, so as to reduce the number of repeated IPMI command transmissions and shorten the running time of the server in the system management mode, thereby improving the server system performance.

The invention discloses a BIOS firmware security verification method and system based on a trusted execution environment, and belongs to the technical field of computer security, the BIOS firmware security verification method comprises the following steps: obtaining a complete mirror image, a key configuration variable and a system management mode code snippet of BIOS firmware, and processing data in the trusted execution environment to generate a trusted baseline snapshot; monitoring a high-risk system event, and triggering the verification of the running state of the BIOS according to the high-risk system event; reading data in the current memory and comparing the data with the trusted baseline snapshot to generate a tampering detection result and abnormal behavior judgment; and executing hierarchical response according to the threat level, and executing a hot repair operation for a high threat event. According to the method, the trusted execution environment is adopted to realize monitoring and active repair during operation, malicious tampering in the memory can be found and repaired immediately, and the safety and reliability of BIOS firmware during operation of an operating system are improved.

The specification provides a memory power consumption configuration method, device and equipment and readable storage medium, the method comprises: in response to SMI interrupt, enter system management mode SMM, write function field for configuring memory power to memory power register;According to the target power parameter in the function field, configure the memory power consumption limit;If CPU usage is equal to or higher than the idle threshold, write the first power parameter as the target power parameter, and the memory runs at the first rated working frequency corresponding to the first power parameter;The idle threshold is pre-set;If the CPU usage is lower than the idle threshold, write the second power parameter as the target power parameter, and configure the memory working frequency to make the memory run at the second rated working frequency corresponding to the second power parameter;The second power is lower than the first power. Through the technical scheme of the specification, the power waste when the CPU usage is low can be effectively avoided.

Systems and methods to support system management mode (SMM) update and telemetry in runtime for bare metal deployments. During runtime operation of a host operating system on a bare metal platform having a management controller and including a processing unit on which the host operating system (OS) and host BIOS are executed, an out-of-band runtime update is performed to update secure execution mode (e.g., SMM) runtime firmware for the bare metal platform using an out-of-band channel comprising an interrupt driven, shared memory-based data exchange channel between the management controller and the host BIOS. This enables secure execution mode runtime firmware to be updated without during runtime without having to reboot the platform or restart the OS kernel. The out-of-band channel also supports exchange of telemetry data logged by the host BIOS during the runtime update with the management controller.

A system is disclosed for Input / Output (I / O) device emulation that allows a service provider to configure and enforce a policy for software access to some or all I / O resources in a platform. I / O device emulation enables service providers to protect their platforms from malicious guest software that may be executed on associated platforms that has direct access to I / O resources in case of bare-metal servers, escalates the privilege level from guest to host in case of hosted-Virtual Machine servers, or escalates the privilege level from guest to System Management Mode in case of either bare-metal servers or hosted-Virtual Machine servers. The technology enables service providers to protect their platforms from malicious guest software running on their platforms that either has direct access to legacy I / O and memory mapped I / O resources. In one illustrative example, the platform may include a microprocessor.

Examples described herein relate to an interface and a core coupled to the interface, wherein based on a configuration, the core is to respond to an interrupt indicating an error by outputting error data to a management controller while permitting thread execution on the core. In some examples, based on the configuration, the core is to invoke the management controller to handle errors and not enter System Management Mode (SMM).

The present application relates to the technical field of servers, and discloses a system management memory allocation method, a program running method, a system, and a product. The system management memory allocation method comprises: starting a basic input / output system, initializing a system management mode environment, and configuring a system management mode service; acquiring a number of physical processors of a server on which the method located, and a number of cores carried by each physical processor, and calculating a total number of cores; on the basis of the total number of cores, determining a corresponding core interval, and on the basis of the core interval, determining a first target capacity of a system management memory to be configured; on the basis of the first target capacity, allocating system management memory for driving updates in a system management mode. Using the present method, flexible and automatic SMRAM memory allocation for servers having different hardware configurations can be implemented, so as to satisfy normal operation of an SDU.

A system is disclosed for Input / Output (I / O) device emulation that allows a service provider to configure and enforce a policy for software access to some or all I / O resources in a platform. I / O device emulation enables service providers to protect their platforms from malicious guest software that may be executed on associated platforms that has direct access to I / O resources in case of bare-metal servers, escalates the privilege level from guest to host in case of hosted-Virtual Machine servers, or escalates the privilege level from guest to System Management Mode in case of either bare-metal servers or hosted-Virtual Machine servers. The technology enables service providers to protect their platforms from malicious guest software running on their platforms that either has direct access to legacy I / O and memory mapped I / O resources. In one illustrative example, the platform may include a microprocessor.

The present application provides a code sharing method and apparatus, a switch, a multi-host system, a device, and a medium. The method includes: determining to enable a system management mode of a current host; sending a system management mode initialization request to a switch in a multi-host system, where the switch is configured to determine, based on the system management mode initialization request, a target shared memory module for storing system management mode code among a plurality of shared memory modules in the multi-host system, and a system management random access memory area corresponding to the system management mode code in the target shared memory module, and establish a data connection between the current host and the target shared memory module; and initializing the system management mode of the current host based on the system management mode code.

The technology describe herein includes upon entering a mode of a processor that is not visible to an operating system (OS), setting a flag indicating entry into the mode and saving an identifier (ID) of an error causing entry into the mode; and responsive to a system reset initiation while in the mode, booting a basic input / output system (BIOS), creating an error record to be accessible to the OS after booting, the error record including the flag and the error ID, and booting the OS.

The invention belongs to the technical field of computers, and discloses a method and a system for printing Debug by a BIOS (Basic Input / Output System) and a computer storage medium, and the method comprises the following steps: storing a generated debugging log into a specified data area of a nonvolatile memory in a firmware running stage of a computer terminal; sending a log reading request to the firmware of the computer terminal through a management interface of the operating system in an operating stage of the operating system; triggering system management interruption based on the log reading request, and enabling a processor to enter a system management mode and execute a log processing program in computer terminal firmware; reading the debugging log from the specified data area by utilizing the log processing program; and returning the debugging log to the operating system through the management interface so as to analyze and present the debugging log in the operating system. According to the method, the BIOS of the Debug version does not need to be recompiled, a serial port debugging line does not need to be connected, the starting-up speed is not influenced, and recurrence analysis of problems is facilitated.

The present application relates to a system and method for executing a newly added instruction, the method comprising: receiving an instruction; determining whether the received instruction is a newly added instruction; and when the received instruction is a newly added instruction: generating a simulation identifier, wherein the simulation identifier is a first value; issuing a system management interrupt based on the simulation identifier; entering a system management mode in response to the system management interrupt, and simulating execution of the received instruction in the system management mode to generate a simulation execution result; and storing the simulation execution result in a system management memory. Thus, without modifying the micro-architecture of a processor, a newly added instruction supported by a later generation processor can be implemented on a previous generation processor, thereby greatly reducing the workload for design, testing, etc., and thus saving a large amount of cost.

Various embodiments generally relate to establishing trust in system management mode. An operating system management mode driver can invoke system management mode and provide a signature to the system management mode to utilize the signature to authenticate the driver. Additionally, a hash value of the driver can be used to determine whether the driver is authorized to invoke system management mode or a particular operation or feature of system management mode.

The invention relates to the technical field of computers, and discloses an EC security protection method, computer equipment and a computer readable storage medium. The EC security protection method comprises the following steps: providing an access forbidding list and storing the access forbidding list to a BIOS; when a register access request of the EC is received, triggering the CPU to enter a system management mode, and executing security verification operation in the system management mode: determining a current to-be-accessed target register, and judging whether the target register exists in an access forbidding list or not; and if yes, controlling the EC to exit the configuration mode so as to terminate the current access operation aiming at the target register. According to the embodiment of the invention, the access operation for each register in the access forbidding list can be intercepted from a hardware bottom layer, so that the problem of EC function failure or hardware damage caused by malicious access operation is avoided, and the safety of the EC is improved.