Abstract:
In some examples, in response to a computing device powering on, a protected memory area inaccessible to an operating system is created, where the protected memory area includes information relating to instructions and an indication settable to a first value to indicate that the instructions are allowed to access a memory external of the protected memory area, and a second value to indicate that the instructions are not allowed to access the memory external of the protected memory area. In response to creating the protected memory area, the indication is modified from the first value to the second value to restrict the instructions when executed from accessing the memory external of the protected memory area. In response to modifying the indication, code in the computing device is launched, the launched code comprising the operating system or firmware.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
       [0001]    This is a continuation of U.S. application Ser. No. 14/391,209, filed Oct. 8, 2014, which is a national stage application under 35 U.S.C. §371 of PCT/US2012/049045, filed Jul. 31, 2012, which are both hereby incorporated by reference in their entirety. 
     
    
     BACKGROUND 
       [0002]    When managing security for a computing device, an operating system of the computing device can be used to manage access between applications and content of the computing device. The operating system can control access to secure content on the computing device, such as financial information and/or identification information for a user. If the operating system is compromised due to malicious software, the malicious software can circumvent the security of the computing device to gain access to secured content. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0003]    Various features and advantages of the disclosed embodiments will be apparent from the detailed description which follows, taken in conjunction with the accompanying drawings, which together illustrate, by way of example, features of the disclosed embodiments. 
           [0004]      FIG. 1  illustrates a computing device with option read only memory and a system management page table according to an example. 
           [0005]      FIG. 2  illustrates a block diagram of a controller creating a system management memory page table according to an example. 
           [0006]      FIGS. 3A and 3B  illustrate a block diagram of a controller modifying a system management memory page table according to an example. 
           [0007]      FIG. 4  is a flow chart illustrating a method for managing a computing device according to an example. 
           [0008]      FIG. 5  is a flow chart illustrating a method for managing a computing device according to an example. 
       
    
    
     DETAILED DESCRIPTION 
       [0009]    A computing device creates a system management (SMM) page table in response to powering on from a power off state. The power off state can be a mechanical off state or a soft off state of the computing device. For the purposes of this application, the SMM page table is a data structure included within system management memory of the computing device. The system management memory is a protected area of memory, such as random access memory, included within the computing device. The SMM page table includes pages which store mappings between locations of the system management memory and virtual addresses used by applications or processes of the computing device. 
         [0010]    In one embodiment, the pages in the SMM page table include content, such as lines of executable code. In another embodiment, the pages of the SMM page table include addresses of the system management memory where the lines of executable code reside. Each page included in the SMM page table includes a corresponding executable bit. An executable bit includes a flag or register which identifies whether the contents of the corresponding page can access content residing outside the system management memory. The computing device can modify the executable bits to restrict the lines of code from the SMM page table and/or the system management memory from accessing content residing outside the system management memory. 
         [0011]    The computing device modifies the executable bit of the pages included in the SMM page table before an option read only memory (ROM) of the computing device is launched. For the purposes of this application, the option ROM includes an operating system of the computing device or a firmware of a component that is launched by a basic input/output system (BIOS) of the computing device. The option ROM resides outside of the system management memory. The computing device can modify the executable bits by disabling the executable or by setting the executable bits to not execute. 
         [0012]    As a result, by modifying the executable bits of the page table before the option ROM is launched, the computing device restricts lines of code of the SMM page table and/or the system management memory from making calls to the option ROM residing outside the system management memory. By restricting the lines of code from the SMM page table and/or the system management memory from accessing content outside the system management memory, the content of the SMM page table and system management memory are protected from malicious content residing outside the system management memory. 
         [0013]      FIG. 1  illustrates a computing device  100  with option read only memory (ROM)  145  to create a system management page table  130  according to an example. In one embodiment, the computing device  100  can be a notebook, a netbook, a tablet, a desktop, a workstation, a server, and/or an all-in-one system. In another embodiment, the computing device  100  can be a cellular device, a smart phone, a PDA (Personal Digital Assistant), an E (Electronic)-Reader, and/or any additional computing device  100  to create a system management memory page table  130 . 
         [0014]    The computing device  100  includes a controller  120 , a storage component  140  including option ROM, a system management memory page table  130 , and a communication channel  150  for the computing device  100  and/or one or more components of the computing device  100  to communicate with one another. In one embodiment, the computing device  100  also includes a security application stored on a non-volatile computer readable medium included in or accessible to the computing device  100 . For the purposes of this application, the security application is firmware or an application which can be utilized independently and/or in conjunction with the controller  120  to manage the computing device  100 . In one embodiment, the security application is a Basic Input/Output System (BIOS) of the computing device  100 . 
         [0015]    The computing device  100  can initially be in a power off state. For the purposes of this application, the power off state includes a mechanical off state or a soft off state where one or more components of the computing device  100  do not receive power. In response to transitioning from the power off state to a power on state, the controller  120  and/or the security application proceed to create a system management memory page table  130  in system management memory of the computing device  100 . For the purposes of this application, the system management memory is a protected area of memory, such as a restricted or a secured partition of the memory. The memory can be a random access memory and/or any additional memory component of the computing device  100 . The system management memory is inaccessible to applications, an operating system, and/or an option ROM  145  of the computing device  100 . 
         [0016]    For the purposes of this application, the system management memory (SMM) page table  130  is a data structure included within the system management memory which includes pages with executable bits. A data structure identifies how data is organized and managed as a SMM page table  130  in the system management memory. The pages of the SMM page table  130  correspond to mappings between addresses of the system management memory and virtual addresses of the computing device  100 . The addresses of the system management memory correspond to locations of the system management memory. The virtual addresses include addresses for applications, processes, firmware, and/or an option ROM  145  residing outside of the system management memory. 
         [0017]    An executable bit for a corresponding page of the SMM page table  130  identifies whether the contents of the corresponding page can access content residing outside the system management memory. In one example, the executable bit can be a flag which can be set. In another example, the executable bit can be a register which can be set or modified. The contents of a page table can include lines of code or addresses corresponding to locations of the system management memory where the lines of code reside. For the purposes of this application, the lines of code include a sequence of numbers and/or characters corresponding to instructions which can be executed. 
         [0018]    In response to creating the system management memory page table  130 , the controller  120  and/or the security application can modify the executable bits for each page of the system management memory page table  130  before an option ROM  145  of the computing device  100  is launched. In one embodiment, modifying the executable bits includes the controller  120  and/or the security application disabling the executable bits, such that the content included in the corresponding page cannot be executed and cannot execute content residing outside the system management memory. In another embodiment, the controller  120  and/or the security application can modify the executable bits by disabling them, such that the content included in the corresponding pages are inaccessible and do not access content residing outside the system management memory. 
         [0019]    In response to modifying the executable bits, the controller  120  and/or the security application can proceed to launch an option ROM  145  of the computing device  100 . For the purposes of this application, the option ROM  145  can be an operating system of the computing device  100  or a firmware of a component of the computing device  100 . The firmware can be used by the controller  120  and/or the security application to manage and communicate with the corresponding component. For example, the option ROM  145  can be a video firmware for a video component of the computing device  100 . The option ROM  145  can be included on a storage component  140  of the computing device  100 . 
         [0020]      FIG. 2  illustrates a block diagram of a controller  220  creating a system management memory page table  250  according to an example. As noted above, the security application  210  can be utilized independently and/or in conjunction with the controller  220  to manage the computing device. In one embodiment, the security application  210  can be a BIOS of the computing device. In another embodiment, the security application can be firmware embedded onto one or more components of the computing device. In other embodiments, the security application  210  can be an application accessible from a non-volatile computer readable memory of the computing device. The computer readable memory is a tangible apparatus that contains, stores, communicates, or transports the application for use by or in connection with the computing device. The computer readable memory can be a hard drive, a compact disc, a flash disk, a network drive or any other tangible apparatus coupled to the computing device. 
         [0021]    The computing device can power on from a power off state. For the purposes of this application, the power off state includes a mechanical off state or a soft off state of the computing device. If the computing device is in a mechanical off state, the computing device does not receive any power. If the computing device is in a soft off state, the computing device may receive a small amount of power, such as less than 2 watts of power. When powering on from a power off state, one or more components of the computing device can receive power for the components and the computing device to become operational. 
         [0022]    When powering on, an option read only memory (ROM)  245  of the computing device can attempt to launch. For the purposes of this application, the option ROM  245  can be an operating system or a firmware for a component of the computing device. For example, the option ROM  245  can be a firmware of a video component of the computing device. If the controller  220  and/or the security application  210  detect the option ROM  245  attempting to launch, the controller  220  and/or the security application  210  can halt the launch attempt from the option ROM  245 . In one embodiment, halting the launch attempt includes the controller  220  and/or the security application  210  intercepting a launch request and suspending the launch request for the option ROM  245 . 
         [0023]    Before the option ROM  245  is launched, the controller  220  and/or the security application  210  create a SMM page table  230  in a system management memory  250  of the computing device. For the purposes of this application, the system management memory  250  includes a secured location or partition of a memory of the computing device which the controller  220  and/or the security application  210  can access. The system management memory  250  is inaccessible to applications, processes, and/or firmware residing outside of the system management memory  250 . The memory can be random access memory and/or any additional memory component of the computing device. 
         [0024]    As noted above, the SMM page table  230  is included within the system management memory  250  and includes one or more pages  260  with corresponding executable bits  265 . The pages  260  of the SMM page table  230  map addresses of the system management memory  250  to virtual addresses of the computing device. In one embodiment, the pages  260  of the SMM page table  230  include lines of code which can be executed. The lines of code correspond to executable instructions stored on locations of the system management memory  250 . In another embodiment, the pages  260  of the SMM page table  230  include addresses which correspond to locations of the system management memory  250  containing the lines of code. 
         [0025]    As shown in  FIG. 2 , each page  260  of the SMM page table  230  includes executable bits  265 . The executable bits  265  can be registers and/or flags which identify whether the content included in the corresponding page  260  or the system management memory  250  can access content residing outside the system management memory  250 . The controller  220  and/or the security application  210  can modify the executable bits  265  for each page  260  included in the SMM page table  230  before an option ROM  245  of the computing device is launched. In one embodiment, the controller  220  and/or the security application  210  modify the executable bits  265  immediately in response to the SMM page table  230  being created. In another embodiment, the controller  220  and/or the security application  210  modify the executable bits  265  immediately before the option ROM  245  is launched. 
         [0026]      FIGS. 3A and 3B  illustrate a block diagram of a controller  320  modifying a SMM page table  330  according to an example. When modifying the SMM page table  330 , the controller  320  and/or the security application  310  can modify each executable bit  365  in the SMM page table  330  before an option ROM is launched. In one example, as shown in  FIG. 3A , when modifying an executable bit  365 , the controller  320  and/or the security application  310  disable the executable bit  365  for each page  360  in the system management memory page table  330 . By disabling the executable bit  365 , the controller  320  and/or the security application  310  can restrict lines of code residing on the corresponding page  360  and/or the system management memory  350  from making calls and executing any content residing outside the system management memory  350 . 
         [0027]    If the controller  320  and/or the security application  310  detect any attempts to access content outside the system management memory, the controller  320  and/or the security application  310  block the lines of code from being executed. In another embodiment, the controller  320  and/or the security application  310  can block the content residing outside the system management memory  350  from being accessed. In other embodiments, when disabling the executable bit, the lines of code residing on the SMM page table  330  and/or the system management memory  350  can appear inaccessible. 
         [0028]    In another example, as shown in  FIG. 3B , when modifying an executable bit  365 , the controller  320  and/or the security application  310  can set the executable bit  365  to not execute. As a result, if any request is made to access and execute the lines of code or address of the corresponding page  360  or the system management memory  350 , the controller  320  and/or the security application  310  reject the requests. Additionally, if any content from outside the system management memory  350  attempts to access the contents of the SMM page table  330  and/or the system management memory  350 , the controller  320  and/or the security application  310  can reject the request. 
         [0029]    In response to modifying the executable bits  365 , the controller  320  and/or the security application  310  can allow an option ROM of the computing device to continue launching. Allowing the option ROM to launch can include unblocking the option ROM from launching. In one embodiment, launching the option ROM includes allowing a previously suspended launch request to resume. 
         [0030]    In one embodiment, once the option ROM has been launched, the controller  320  and/or the security application  310  can detect for lines of code of the system management memory  350  attempting to execute lines of code residing outside the system management memory  350  and/or vice versa. If the controller  320  and/or the security application  310  detect lines of code from the system management memory  350  attempting to execute lines of code residing outside the system management memory  350  and/or vice versa, the controller  320  and/or the security application  310  can proceed to generate fault. The fault can reject the request, halt the lines of code from executing, and/or hang the controller  320  and/or the security application  310 . The controller  320  and/or the security application  310  can also generate a report of the attempted access. The report can be outputted on a display component or stored on as a file log. 
         [0031]      FIG. 4  is a flow chart illustrating a method for managing a computing device according to an example. The controller and/or the management application initially detect for the computing device powering on and proceed to create a system management memory page table in response to a computing device powering on at  400 . As noted above, the system management memory page table is created in a system management memory of the computing device and each page of the system management page table includes executable bits. The controller and/or the management application proceed to modify the executable bits for each of the pages before option read only memory of the computing device is launched at  410 . The method is then complete. In other embodiments, the method of  FIG. 4  includes additional steps in addition to and/or in lieu of those depicted in  FIG. 4 . 
         [0032]      FIG. 5  is a flow chart illustrating a method for managing a computing device according to an example. The controller and/or the management application initially detect for the computing device powering on. In response to the computing device powering on, the controller and/or the management application create a system management memory page table within system management memory of the computing device at  500 . The system management page table includes pages with executable bits. The controller and/or the management application proceed to modify the executable bits before an option read only memory of the computing device is launched. The option read only memory is an operating system and/or a firmware corresponding to a component of the computing device. 
         [0033]    In one embodiment, when modifying the executable bit, the controller and/or the management application can disable the executable bit such that the executable bit and any lines of code in the corresponding page or a corresponding address of the system management memory is prohibited from execution at  510 . In another embodiment, when modifying the executable bit, the controller and/or the management application set the executable bit to not execute at  520 . 
         [0034]    By modifying the executable bits, any lines of code residing in the SMM page table and/or the system management memory do not execute content residing outside of the system management memory. Additionally, any content, such as the option ROM, residing outside the system management memory cannot access and execute code or addresses residing in the pages of the system management memory page table. Once the executable bits for each page table have been modified, the controller and/or the security application can proceed to launch the option ROM. 
         [0035]    In response to launching the option ROM, the controller and/or the management application can also detect if any lines of code from the SMM page table and/or the system management memory code attempt to access and execute content residing outside the system management memory at  530 . If no lines of code attempts to execute code outside of the system management memory, the method can be complete. If the controller and/or the security application detect any code from the SMM page table and/or the system management memory attempting to access and execute content residing outside the system management memory, the controller and/or the security application proceed to generate a fault message at  540 . The method is then complete. In other embodiments, the method of  FIG. 5  includes additional steps in addition to and/or in lieu of those depicted in  FIG. 5 .