System and method for securing embedded controller communications by verifying host system management mode execution
An information handling system includes a processor operable to provide a branch trace message, and an embedded controller coupled to the processor via a primary interface and via a management interface. The embedded controller receives a management transaction from the processor via the primary interface. In response to receiving the management transaction, the embedded controller requests the branch trace message via the management interface and determines if the processor is operating in a system management mode based upon the branch trace message.
1. An information handling system, comprising:
a processor operable to provide a branch trace message; and
an embedded controller coupled to the processor via a primary interface and via a management interface, wherein the embedded controller is operable to:
receive a management transaction from the processor via the primary interface; and
in response to receiving the management transaction, to:
request, via the management interface, the branch trace message; and
determine if the processor is operating in a system management mode based upon the branch trace message.
2. The information handling system of claim 1 , wherein the embedded controller is further operable to:
execute the management transaction in response to determining that the processor is operating in the system management mode.
3. The information handling system of claim 1 , wherein the embedded controller is further operable to:
drop the management transaction in response to determining that the processor is not operating in the system management mode.
4. The information handling system of claim 1 , further comprising:
a memory including a system management mode memory range;
wherein the embedded controller stores the system management mode memory range.
5. The information handling system of claim 4 , wherein the embedded controller is further operable to receive the system management mode memory range from the processor.
6. The information handling system of claim 4 , wherein in determining if the processor is operating in a system management mode, the embedded controller is further operable to:
determine a memory location of code being executed by the processor from the branch trace message; and
compare the memory location with the system management mode memory range; and
determine if the processor is operating in the system management mode based upon the comparison.
7. The information handling system of claim 6 , wherein the processor is determined to be operating in the system management mode when the memory location is in the system management mode memory range.
8. The information handling system of claim 6 , wherein the processor is determined to not be operating in the system management mode when the memory location is not in the system management mode memory range.
9. The information handling system of claim 1 , wherein:
the embedded controller includes a security mode; and
the embedded controller operates to request the branch trace message and to determine if the processor is operating in the system management mode when the embedded controller is operating in the security mode.
10. A method comprising:
receiving, at an embedded controller of an information handling system, a management transaction from a processor of the information handling system, wherein the embedded controller is coupled to the processor via a primary interface and via a management interface, and the management transaction is received via the primary interface; and
in response to receiving the management transaction, to:
request, via the management interface, a branch trace message; and
determine, by the embedded controller, if the processor is operating in a system management mode based upon the branch trace message.
11. The method of claim 10 , further comprising:
executing, by the embedded controller, the management transaction in response to determining that the processor is operating in the system management mode.
12. The method of claim 10 , further comprising:
dropping, by the embedded controller, the management transaction in response to determining that the processor is not operating in the system management mode.
13. The method of claim 10 , wherein:
the information handling system comprises a memory including a system management mode memory range;
the method further comprising storing, by the embedded controller, the system management mode memory range.
14. The method of claim 13 , further comprising:
receiving, by the embedded controller, the system management mode memo range from the processor.
15. The method of claim 13 , wherein in determining if the processor is operating in a system management mode, the method further comprises:
determining, by the embedded controller, a memory location of code being executed by the processor from the branch trace message; and
comparing the memory location with the system management mode memory range; and
determining if the processor is operating in the system management mode based upon the comparison.
16. The method of claim 10 , wherein:
the embedded controller includes a security mode; and
the embedded controller operates to request the branch trace message and to determine if the processor is operating in the system management mode when the embedded controller is operating in the security mode.
17. A non-transitory computer-readable medium including code for performing a method, the method comprising:
receiving, at an embedded controller of an information handling system, a management transaction from a processor of the information handling system, wherein the embedded controller is coupled to the processor via a primary interface and via a management interface, and the management transaction is received via the primary interface; and
in response to receiving the management transaction:
requesting, via the management interface, a branch trace message; and
determining, by the embedded controller, if the processor is operating in a system management mode based upon the branch trace message.
18. The computer-readable medium of claim 17 , the method further comprising:
executing, by the embedded controller, the management transaction in response to determining that the processor is operating in the system management mode.
19. The computer-readable medium of claim 17 , wherein:
the information handling system comprises a memory including a system management mode memory range;
the method further comprising storing, by the embedded controller, the system management mode memory range.
20. The computer-readable medium of claim 17 , wherein:
the embedded controller includes a security mode; and
the embedded controller operates to request the branch trace message and to determine if the processor is operating in the system management mode when the embedded controller is operating in the security mode.