Method for protecting a privilege level of system management mode of a computer system
View Patent ↗A method for protecting a privilege level of a system management mode (SMM) of a computer system is disclosed. A SMM program is loaded into a special memory (SMRAM) area within a system memory of a computer. A first program, a second program, and a vector table are loaded into a general area of the system memory. Before the booting process of the computer has been completed, a reference hash value of the first program is determined by the SMM program, and the reference hash value is stored in the SMRAM area. A hash value of the first program is the computed by the SMM program. After the computer has been operating under an operating environment of an operating system, the computed hash value is compared to the reference hash value. When the computed hash value matches the reference hash value, the first program is called by the SMM program.
1. A method comprising:
loading a system management mode (SMM) program into a special memory (SMRAM) area within a system memory of a computer, and loading a first program, a second program, and a vector table into a general area of said system memory;
determining a reference hash value of said first program by said SMM program before booting of said computer has been completed, and storing said reference hash value in said SMRAM area;
determining a hash value of said first program by said SMM program;
comparing said hash value with said reference hash value, after said computer has been operating under an operating environment of an operating system; and
calling said first program by said SMM program when said hash value matches said reference hash value.
2. The method of claim 1 , wherein said method further includes
storing by said SMM program a vector address corresponding to an interrupt type for calling said first program into said SMRAM area, wherein said vector address is obtained from said vector table before said operating system operates; and
rewriting by said SMM program said vector address corresponding to said interrupt type for calling said first program, with said vector address stored in said SMRAM area, before said calling said first program by said SMM program.
3. The method of claim 2 , wherein said method further includes
returning said rewritten vector address corresponding to said interrupt type for calling said first program to said vector table, after said calling said first program by said SMM program.
4. The method of claim 2 , wherein said method further includes
rewriting by said SMM program at least one vector address corresponding to an interrupt type for calling said second program and instruction code to return to said first program so that, when said first program executes an instruction to call said second program in said SMM, said second program executes instruction code to return to said first program without executing substantial instruction code; and
calling said second program by said first program in said SMM, after said rewriting at least one of the vector address and said instruction code.
5. The method of claim 4 , wherein said instruction code to return to said first program is an IRET instruction code.
6. The method of claim 4 , wherein said method further includes
returning said rewritten at least one vector address corresponding to said interrupt type for calling said second program and said instruction code to return to said first program to a pre-rewrite state, after said calling said second program.
7. The method of claim 1 , wherein said SMM program is a program for performing password authentication, said first program is a video BIOS for controlling a video chip, and said second program is a system BIOS for providing system information.
8. The method of claim 1 , wherein said comparing and said calling are performed in a period during which said computer resumes from a suspend state.
9. A computer comprising:
a processor capable of operating in a system management mode (SMM);
a chipset for asserting a system management interrupt (SMI) to cause said processor to operate in said SMM; and
a main memory having a SMRAM area in which a SMM program is loaded, and a general area in which a first program, a second program, and a vector table are loaded, wherein said SMM program causes said computer to
compute a reference hash value of said first program in a period during which said chipset asserts said SMI, and after said computer has been operating under an operating environment of an operating system,
compute a hash value of said first program,
compare said computed hash value to said reference hash value, and
call said first program in said SMM when said hash value matches said reference hash value.
10. The computer of claim 9 , wherein said SMM program causes said computer to
store a vector address corresponding to an interrupt type for calling said first program into said SMRAM area, said vector address being obtained from said vector table before said operating system operates; and
before calling said first program, organize said vector table so that said first program is called when said vector address stored in said SMRAM area is used to call said first program.
11. The computer of claim 10 , wherein said SMM program causes said computer to rewrite at least one of said second program and a vector address so as to return to said first program without substantially executing said second program when said first program calls said second program in said SMM mode.
12. The computer of claim 11 , wherein said first program is a video BIOS called from said SMM program by an INT 10h instruction, said second program is a system BIOS called from said video BIOS by an INT 15h instruction, and said code of said second program is IRET instruction code.
13. The computer of claim 12 , wherein said chipset asserts said SMI when said computer resumes from a suspend mode.