Non-volatile Memory Write Access Control via SMM Thread Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
During System Management Mode (SMM) in processors, enabling write access to non-volatile memory before all processor threads are fully pulled into SMM creates a window for untrusted code to potentially write to the memory, compromising the computing device.
Innovation Solution
A computing device disables write access to non-volatile memory upon booting, verifies that all processor threads are in SMM via a system management interrupt, and only enables write access after successful verification, then re-disables it upon exiting SMM, using communication interfaces and registers to control access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If write access to non-volatile memory is enabled during SMM before all processor threads are pulled into SMM, then firmware upgrade and configuration operations can be performed, but untrusted code may write to the non-volatile memory and compromise the computing device
Solution Approach 1:
The patent applies preliminary action by checking whether all processor threads have been pulled into SMM before enabling write access to the non-volatile memory. This pre-verification step ensures that the security condition is met before the actual write operation is allowed, preventing untrusted code from compromising the memory during the transition period.
2Reliability
If write access to non-volatile memory is disabled upon booting, then security is maintained, but firmware upgrade and configuration operations cannot be performed until SMM is fully established
Solution Approach 1:
The patent applies dynamics by making the write access control state dynamic rather than static. The write access to non-volatile memory is initially disabled upon booting, then dynamically enabled only after the verification that all processor threads are in SMM, and finally disabled again upon exiting SMM. This dynamic control allows firmware operations to be performed at the appropriate time while maintaining security throughout the process.
Data Source
AI summary
An example non-transitory computer readable storage medium comprising instructions that when executed cause a processor of a computing device to: in response to a trigger of a system management mode (SMM), verify all processor threads have been pulled into the SMM; in response to a successful verification, enable write access to a non-volatile memory of the computing device via two registers, where the writing access is disabled upon booting of the computing device; and upon exiting the SMM, disable the write access via the two registers.