WO2018058566A1

WO2018058566A1 - Extended memory for smm transfer monitor

Info

Publication number: WO2018058566A1
Application number: PCT/CN2016/101183
Authority: WO
Inventors: Jiewen Jacques YAO; Vincent J. Zimmer
Original assignee: Intel Corporation
Priority date: 2016-09-30
Filing date: 2016-09-30
Publication date: 2018-04-05
Also published as: CN109937407B; DE112016007289T5; CN109937407A

Abstract

Virtual memory is allocated to a system management mode (SMM) process to extend a secure memory reserved for SMM. The SMM process requests a page of the virtual memory for which no mapping exists to the secure memory: if a page is available in the secure memory, the virtual memory page is mapped to the available page and if a page is not available, a page in the secure memory is selected for replacement by the virtual memory page. The selected page is encrypted and moved to an external storage device. The virtual memory page is mapped to the address of the selected page in the first memory. If a mapping exists for the virtual memory page to encrypted data in the external storage device then this data is moved to the secure memory address mapped to the virtual memory page and decrypted before the virtual memory page is accessed.

Description

EXTENDED MEMORY FOR SMM TRANSFER MONITOR

TECHNICAL FIELD

Embodiments described herein generally relate to information processing and security, more particularly, to extending the memory available for use by a system management mode (SMM) transfer monitor (STM) of a computer system.

BACKGROUND

In computer systems, system management mode (SMM) refers to an operating mode of x86-family central processor units (CPUs) in which all normal execution, including the operating system (OS) , is suspended based on the occurrence of a system mode interrupt (SMI) and special system software is executed with special privileges (such as access to all system memories) . SMM may be used to handle system-wide functions like power management, hardware control, OS validation, cryptography, or proprietary original equipment manufacturer (OEM) -designed code. SMM is generally used only by system firmware, not by generic applications or even general-purpose system software. In this way, the SMM is able to offer an isolated computing environment that operates independently of the operating system, any hypervisors (HVs) , or any other application software.

However, the SMM may be used as an attack vector for malware, such as rootkits. Even though the executable code in the SMM may be firmware-based and error-free, a variety of techniques for tampering with the operation of the SMM have been reported. For instance, data objects (such as variables, parameter values, function calls, etc. ) may be passed to the SMM by the OS, and these data objects may be exploited to gain access to the SMM’s special privilege level. The possibility of a malware attack is further compounded by the fact that SMM operates outside the reach of anti-malware programs that are installed on and under the control of the operating system.

One method for protecting software that is critical to the operation of a computing device is through segregation of the software. For example, segregated in a virtual machine environment such as, for example, the Virtual Technology (VT) functionality incorporated on many modern processors, in which one or more machine managers control virtual machines operating in different operational environments with distinct privilege levels. For example, VT defines a primary monitor mode wherein virtual machine monitor (VMM) or HVs are able to de-privilege guest OSs. Similarly, VT also provides an STM that may de-privilege an SMI handler such that it runs as a guest of the STM in SMM. SMM may initiate, based on detecting an SMI, with the current state of the processor being saved and all other processes being stopped. High privilege operations may then be performed, such as, for example, debugging, hardware management, security functions, emulation, etc., followed by the computing device resuming operation based on the saved state.

In some cases the VMM or HV may themselves require monitoring since there is no assurance that these high privilege programs will not be used for nefarious operations. However, peer monitoring by a program in the normal execution environment may be difficult or even impossible since the VMM or HV maintain a highest privilege in the computing system. In this regard, a separate memory space called system management ram (SMRAM) exists that is accessible during the SMM. The SMRAM may be used to maintain the STM. The STM is loaded into a portion of the top segment of SMRAM referred to as the monitor segment, or MSEG, which is set aside for use by the STM.

BRIEF DESCRIPTION OF THE DRAWINGS

In the drawings, which are not necessarily drawn to scale, like numerals may describe similar components in different views. Like numerals having different letter suffixes may represent different instances of similar components. Some embodiments are illustrated by way of example, and not limitation, in the figures of the accompanying drawings.

FIG. 1 is a high-level block diagram illustrating a basic relationship between operating modes of a central processing unit (CPU) according to embodiments described herein.

FIG. 2 is a block diagram illustrating a computer system in the example form of a general-purpose machine.

FIG. 3 is a diagram illustrating an exemplary hardware and software architecture of a computing device such as the one depicted in FIG. 2, in which various interfaces between hardware components and software components are shown.

FIG. 4 is a block diagram illustrating processing devices according to some embodiments.

FIG. 5 is a block diagram illustrating an example MSEG portion of SMRAM reserved for the STM according to a standard implementation.

FIG. 6 is a block diagram illustrating an MSEG and an EMSEG virtual memory, according to certain embodiments.

FIG. 7 is a block diagram illustrating a physical memory page (P-MSEG) in the MSEG, virtual memory pages (V-EMSEG) in the EMSEG and storage memory pages (S-EMSEG) in external storage, according to certain embodiments.

FIG. 8 is a flow diagram illustrating a method for initializing the EMSEG and allocating a page swap file in the external storage, according to certain embodiments.

FIG. 9 is a flow diagram illustrating a method for allocating pages of V-EMSEG to an STM process, according to certain embodiments.

FIG. 10 is a flow diagram illustrating a method for extending the memory available for use by the STM, according to certain embodiments.

FIG. 11 is a flow diagram illustrating a method for reclaiming the set of virtual memory pages allocated to the STM, according to certain embodiments.

FIG. 12 is a block diagram illustrating the P-MSEG page in the MSEG, V-EMSEG pages in EMSEG, S-EMSEG pages in external storage, and a communication buffer between the MSEG and the external storage, according to certain embodiments.

FIG. 13 is a flow diagram illustrating a method for extending the memory available for use by an STM with the aid of a VMM, according to certain embodiments.

DETAILED DESCRIPTION

Aspects of the embodiments are directed to extending the memory (e.g., MSEG in SMRAM) available for use by a system management mode (SMM) transfer monitor (STM) of a computer system. The computer system may be one physical machine, or may be distributed among multiple physical machines, such as by role or function, or by process thread in the case of a cloud computing distributed model. In various embodiments certain operations may run in virtual machines that in turn are executed on one or more physical machines. It will be understood by persons of skill in the art that features of the invention may be realized by a variety of different suitable machine implementations.

The SMRAM that is accessible during the SMM often has size limitations. For example, a typical memory configuration for STM only provides for 2MB or 3MB for use as the MSEG. This may be insufficient since the STM needs to construct a full system execution environment, like a stack for each processor, a virtual machine control structure (VMCS) for each processor, an external page table (EPT) for an SMM guest, an extended page table (EPT) for an SMM guest, a page table for itself, an area to record protected resources, an area to record the BIOS resource, the STM kernel itself, etc.

As depicted, there are two operating modes: Normal mode 102, and SMM 104. There may be additional operating modes for the CPU, and a practical computer system may support many additional operations； but for the sake of clarity the two modes of interest are detailed. In normal mode 102 the CPU executes the code of a hypervisor (e.g., virtual machine monitor) when the computer system is configured to run virtual machines as. In addition, in normal mode 102 the computer system may execute one or more operating systems, including a variety of device and system drivers, and application programs. SMM 104 is reserved for the execution of specialized firmware that may access the secure SMRAM, typically for the purpose of configuring the computer system, checking the integrity of software to be executed in normal mode 102, and various other purposes. However, as discussed above, SMM 104 may be compromised, and therefore embodiments of a more robust configuration for STM that may provide more memory for use as the MSEG are described herein.

As represented at 106, the CPU may transition from normal mode 102 to SMM 104. The SMM 104 may be called by a program, such as a system driver, or some other portion of an operating system (e.g., a VMM via a VMCALL) , for instance, running in normal mode 102. The CPU may also transition from SMM 104 to normal mode 102 based on a call from a SMM process, such as a system control interrupt (SCI) from the STM. In general, the calls to transition from normal mode 102 to SMM 104 and vice versa may be accompanied by a passing of some data 108, e.g., code, variables, parameters, and the like as described below.

FIG. 2 is a block diagram illustrating a computer system in the example form of a general-purpose machine. In certain embodiments, programming of the computer system 200 according to one or more particular algorithms produces a special-purpose machine upon execution of that programming. In a networked deployment, the computer system 200 may operate in the capacity of either a server or a client machine in server-client network environments, or it may act as a peer machine in peer-to-peer (or distributed) network environments. The computer system 200 may take any suitable form factor, such as a personal computer (PC) workstation, a server, whether rack-mounted, or stand-alone, a mainframe computer, a cluster computing system, or the like, a set-top box, as well as a mobile or portable computing system, such as a laptop/notebook PC, an onboard vehicle system, wearable device, a tablet PC, a hybrid tablet, a personal digital assistant (PDA) , a mobile telephone or, more generally, any machine capable of executing instructions (sequential or otherwise) that specify actions to be taken by that machine.

Example computer system 200 includes at least one processor 202 (e.g., a central processing unit (CPU) , a graphics processing unit (GPU) or both, processor cores, compute nodes, etc. ) , a main memory 204 and a static memory 206, which communicate with each other via a link 208 (e.g., bus) . The computer system 200 may further include a video display unit 210, an alphanumeric input device 212 (e.g., a keyboard) , and a user interface (UI) navigation device 214 (e.g., a mouse) . In an embodiment, the video display unit 210, input device 212 and UI navigation device 214 are incorporated into a touch screen display. The computer system 200 may additionally include a storage device 216 (e.g., a drive unit) , a signal generation device 218 (e.g., a speaker) , a network interface device (NID) 220, and one or more sensors (not shown) , such as a global positioning system (GPS) sensor, compass, accelerometer, or other sensor.

The storage device 216 includes a machine-readable medium 222 on which is stored one or more sets of data structures and instructions 224 (e.g., software) embodying or utilized by any one or more of the methodologies or functions described herein. The instructions 224 may also reside, completely or at least partially, within the main memory 204, static memory 206, and/or within the processor 202 during execution thereof by the computer system 200, with the main memory 204, static memory 206, and the processor 202 also constituting machine-readable media.

While the machine-readable medium 222 is illustrated in an example embodiment to be a single medium, the term “machine-readable medium” may include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) that store the one or more instructions 224. The term “machine-readable medium” shall also be taken to include any tangible medium that is capable of storing, encoding or carrying instructions for execution by the machine and that cause the machine to perform any one or more of the methodologies of the present disclosure or that is capable of storing, encoding or carrying data structures utilized by or associated with such instructions. The term “machine-readable medium” shall accordingly be taken to include, but not be limited to, solid-state memories, and optical and magnetic media. Specific examples of machine-readable media include non-volatile memory, including but not limited to, by way of example, semiconductor memory devices (e.g., electrically programmable read-only memory (EPROM) , electrically erasable programmable read-only memory (EEPROM) ) and flash memory devices； magnetic disks such as internal hard disks and removable disks； magneto-optical disks； and CD-ROM and DVD-ROM disks.

NID 220 according to various embodiments may take any suitable form factor. In one such embodiment, NID 220 is in the form of a network interface card (NIC) that interfaces with processor 202 via link 208. In one example, link 208 includes a PCI Express (PCIe) bus, including a slot into which the NIC form-factor may engage. In another embodiment, NID 220 is a network interface circuit laid out on a motherboard together with local link circuitry, processor interface circuitry, other input/output circuitry, memory circuitry, storage device and peripheral controller circuitry, and the like. In another embodiment, NID 220 is a peripheral that interfaces with link 208 via a peripheral input/output port such as a universal serial bus (USB) port. NID 220 transmits and receives data over transmission medium 226, which may be wired or wireless (e.g., radio frequency, infra-red or visible light spectra, etc. ) , fiber optics, or the like.

FIG. 3 is a diagram illustrating an exemplary hardware and software architecture of a computing device such as the one depicted in FIG. 2, in which various interfaces between hardware components and software components are shown. As indicated by HW, hardware components are represented below the divider line, whereas software components denoted by SW reside above the divider line. On the hardware side, processing devices 302 (which may include one or more microprocessors, digital signal processors, etc., each having one or more processor cores, are interfaced with memory management device 304 and system interconnect 306. Memory management device 304 provides mappings between virtual memory used by processes being executed, and the physical memory. Memory management device 304 may be an integral part of a central processing unit which also includes the processing devices 302.

Interconnect 306 includes a backplane such as memory, data, and control lines, as well as the interface with input/output devices, e.g., PCI, USB, etc. Memory 308 (e.g., dynamic random access memory -DRAM) and non-volatile memory 309 such as flash memory (e.g., electrically-erasable read-only memory –EEPROM, NAND Flash, NOR Flash, etc. ) are interfaced with memory management device 304 and interconnect 306 via memory controller 310. This architecture may support direct memory access (DMA) by peripherals in some embodiments. I/O devices, including video and audio adapters, non-volatile storage, external peripheral links such as USB, Bluetooth, etc., as well as network interface devices such as those communicating via Wi-Fi or LTE-family interfaces, are collectively represented as I/O devices and networking 312, which interface with interconnect 306 via corresponding I/O controllers 314.

On the software side, a pre-operating system (pre-OS) environment 316, which is executed at initial system start-up and is responsible for initiating the boot-up of the operating system. One traditional example of pre-OS environment 316 is a system basic input/output system (BIOS) . In present-day systems, a unified extensible firmware interface (UEFI) is implemented. Pre-OS environment 316, is responsible for initiating the launching of the operating system, but also provides an execution environment for embedded applications.

System management mode (SMM) represents code executed in a special-purpose operating mode of processing devices 302 that is provided for handling system-wide functions like power management, system hardware control, or proprietary OEM designed code. In general, SMM is intended for use by system firmware, not by applications software or general-purpose systems software, though SMM may be called by a system management interrupt (SMI) initiated by the software stack. SMM provides a distinct and isolated processor environment that operates transparently to the operating system or executive and software applications. Processing devices 302 execute the SMM code in a separate address space (e.g. SMRAM) that is inaccessible to other operating modes of the processing devices 302.

Operating system (OS) 318 provides a kernel that controls the hardware devices, manages memory access for programs in memory, coordinates tasks and facilitates multi-tasking, organizes data to be stored, assigns memory space and other resources, loads program binary code into memory, initiates execution of the application program which then interacts with the user and with hardware devices, and detects and responds to various defined interrupts. Also, operating system 318 provides device drivers, and a variety of common services such as those that facilitate interfacing with peripherals and networking, that provide abstraction for application programs so that the applications do not need to be responsible for handling the details of such common operations. Operating system 318 additionally provides a graphical user interface (GUI) that facilitates interaction with the user via peripheral devices such as a monitor, keyboard, mouse, microphone, video camera, touchscreen, and the like.

Runtime system 320 implements portions of an execution model, including such operations as putting parameters onto the stack before a function call, the behavior of disk input/output (I/O) , and parallel execution-related behaviors. Runtime system 320 may also perform support services such as type checking, debugging, or code generation and optimization.

Libraries 322 include collections of program functions that provide further abstraction for application programs. These include shared libraries, dynamic linked libraries (DLLs) , for example. Libraries 322 may be integral to the operating system 318, runtime system 320, or may be added-on features, or even remotely-hosted. Libraries 322 define an application program interface (API) through which a variety of function calls may be made by application programs 324 to invoke the services provided by the operating system 318. Application programs 324 are those programs that perform useful tasks for users, beyond the tasks performed by lower-level system programs that coordinate the basis operability of the computing device itself.

FIG. 4 is a block diagram illustrating an example of processing devices 302 according to some embodiments. CPU 410 may contain one or more processing cores 412. As an illustrative example, CPU 410 may be an x86-type of processor. Processing devices 302 may also include a graphics processing unit (GPU) 414. In these embodiments, GPU 414 may be a specialized co-processor that offloads certain computationally-intensive operations, particularly those associated with graphics rendering, from CPU 410. Notably, CPU 410 and GPU 414 generally work collaboratively, sharing access to memory resources, I/O channels, etc.

Processing devices 302 also include caretaker processor 416. Caretaker processor 416 generally does not participate in the processing work to carry out software code as CPU 410 and GPU 414 do. In some embodiments, caretaker processor 416 does not share memory space with CPU 410 and GPU 414, and is therefore not arranged to execute operating system or application programs. Instead, caretaker processor 416 may execute dedicated firmware that supports the technical workings of CPU 410, GPU 414, and other components of the computer system. In some embodiments, caretaker processor is implemented as a microcontroller device, which may be physically present on the same integrated circuit die as CPU 410, or may be present on a distinct integrated circuit die. Caretaker processor 416 may also include a dedicated set of I/O facilities to enable it to communicate with external entities. In one type of embodiment, caretaker processor 416 is implemented using a manageability engine (ME) or platform security processor (PSP) . The hardware, software, and other components illustrated in FIGS. 2-4 may be configured, temporarily or permanently, to perform the operations of the methods described herein.

FIG. 5 is a block diagram illustrating an example MSEG 502 portion of SMRAM reserved for the STM according to a standard implementation. The physical address 504 in the MSEG 502 is the only way to allocate memory by the SMM to the STM process since no additional memory is available, virtual or otherwise. The embodiments described herein are provided to remove some of the runtime barriers (e.g., limited amount of memory for MSEG) to having a peer monitor/SMM Transfer Monitor (STM) being used by a system. The STM which may have many memory intensive features, but only a limited amount SMRAM. Specifically, the MSEG used by the STM may be exhausted by having too many CPUs. Embodiments described herein relieve such MSEG space pressure by using a virtual memory crypto-paging technique to balloon the memory footprint for the STM while at the same time avoiding disruption by potentially hostile code.

The typical SMRAM in an SMM top segment (TSEG) is 8 MB, or 16MB and this limited amount may be called upon to support a confidential debugger, a BIOS SMI Handler and the STM. As noted above, this leaves a typical configuration for STM of only 2MB or 3MB. Embodiments described herein provide a way to extend memory usage in STM using a virtual memory concept that includes security considerations. In this way, it is possible for the STM have access to only 2 or 3 MB of physical MSEG but have access to an arbitrary amount of virtual MSEG (e.g., extended MSEG or EMSEG) .

FIG. 6 is a block diagram illustrating an MSEG 502 and an EMSEG 602 virtual memory, according to certain embodiments. The extended MSEG (EMSEG 602) provides a virtual memory to support the STM. The solid line indicates the current mapping between virtual address 604 of EMSEG 602 to physical address 504 of MSEG 502. The dotted lines indicate possible mappings between other virtual addresses of EMSEG 602 and MSEG 502. Further details of these mappings will be discussed below. The external storage 606 may include a storage device to hold the data corresponding to the virtual addresses in the EMSEG 602. The external storage 606 may be physical memory, or NV storage such as NVMe/UFS/NAND flash memory.

FIG. 7 is a block diagram illustrating a physical memory page (P-MSEG) in a first memory MSEG 502, virtual memory pages (V-EMSEG) in EMSEG 602 and storage memory pages (S-EMSEG) in second memory external storage 606, according to certain embodiments.

As noted above, the EMSEG 602 is an extended MSEG memory space. The P-EMSEG is a physical memory page (e.g., “2” ) , reserved in traditional MSEG 502, that may be mapped to the virtual memory in EMSEG 602. The V-EMSEG are virtual memory pages in EMSEG 602 for use by STM processes. The STM is able to setup a page table to map a V-EMSEG (e.g., “1” , “2” or “3” ) page to a P-EMSEG page. The S-EMSEG are the storage pages (e.g., a page swap file) for memory pages of the EMSEG 602. The S-EMSEG storage pages data are stored in external storage 606. The S-EMSEG (e.g., swap file) should match the size of V-EMSEG virtual pages.

As noted above, the EMSEG 602 provides a virtual memory to support the STM. From the point of view of the STM application, only the virtual address pages of V-EMSEG are visible and the STM uses these addresses. The STM application does not need to know the P-EMSEG and S-EMSEG addresses since the STM core will handle the virtual memory mapping for V-EMSEG to the P-EMSEG and S-EMSEG addresses.

FIG. 8 is a flow diagram illustrating a method for initializing the EMSEG and allocating a page swap file in the external storage, according to certain embodiments. At operation 802, the STM core records the range of EMSEG 602 based on the EMSEG base address and the EMSEG size. At operation 804, the STM sets up paging (e.g., empty page table) for the virtual pages (e.g., V-EMSEG) of the EMSEG 602. At operation 806, the STM core sets up the page swap file “PageFile. bin” in the external storage 606.

FIG. 9 is a flow diagram illustrating a method 900 for allocating pages of V-EMSEG to an STM process, according to certain embodiments. At operation 902, the STM process calls function VirtAllocatePages () to access the EMSEG 602. At operation 904, the STM core attempts to find a free virtual page in of the V-EMSEG virtual pages of EMSEG 602. If there are no free pages of V-EMSEG then, at operation 906, the STM core returns a null (e.g., no free EMSEG memory) result. If there is a free page of V-EMSEG then, at operation 908, the STM core returns the address in V-EMSEG to the STM process. During the allocation stage there is no need to enable mapping from V-EMSEG to P-MSEG. The mapping may be performed when the STM process attempts to access V-EMSEG.

FIG. 10 is a flow diagram illustrating a method 1000 for extending the memory available for use by the STM, according to certain embodiments. At operation 1002, the STM application attempts to access an allocated virtual memory page in V-EMSEG. At operation 1004, if a page table with mappings between the V-EMSEG and the P-MSEG specifies a corresponding P-EMSEG page for the accessed V-EMSEG page, then at operation 1022 the STM application may access the V-EMSEG page at the address of the corresponding P-MSEG page in the MSEG 502. If the page table does not specify a corresponding P-EMSEG page for the accessed V-EMSEG page (e.g., page fault) then, at operation 1006, the STM core attempts to find a free page available in the P-MSEG. If the STM core does find a free page in the P-MSEG then, at operation 1014, the STM core specifies the address of the free page in the P-MSEG for the V-EMSEG page in the page table. If the STM core does not find a free page in the P-MSEG then, at operation 1008, the STM core selects a page in the P-MSEG for replacement according to a page replacement policy. For example, the page replacement policy could specify that a page in the P-MSEG is selected based on a time period since the page has been accessed being greater than a threshold value or greater than the time period since being accessed of all other pages in the P-MSEG. Alternatively or additionally the page replacement policy could specify that a page in the P-MSEG is selected based on a time period since the page has been in the P-MSEG being greater than a threshold value or greater than the time period since being in the P-MSEG of all other pages in the P-MSEG.

At operation 1010, the STM core encrypts the selected page in the P-MSEG. For example, the STM core may generate a code to encrypt the page, the code comprising a key generated using a random number generator. Furthermore, the STM core may store the code in a region of the MSEG 502 that stores data that maynot be moved to the external storage 606. At operation 1012, the STM core may move the encrypted selected page from the P-MSEG to the S-EMSEG, so that the method may proceed to operation 1014 where the STM core specifies the address of the selected page in the P-MSEG for the V-EMSEG page in the page table.

At operation 1016, the STM core determines if the page table specifies a corresponding encrypted page in the S-EMSEG for the V-EMSEG page. If the page table does not specify a page then, at operation 1022 the STM application may access the V-EMSEG page at the specified address of the available page in the P-MSEG or of the selected page in the P-MSEG depending on whether the method has progressed from operation 1006 to 1014 or from operation 1012 to 1014. If the page table does specify a corresponding encrypted page in the S-EMSEG for the V-EMSEG page then, at operation 1018, the STM core copies the corresponding encrypted page from the S-EMSEG to the address of the available page in the P-MSEG or of the selected page in the P-MSEG depending on whether the method has progressed from operation 1006 to 1014 or from operation 1012 to 1014. At operation 1020, the STM core decrypts the corresponding encrypted page in the P-MSEG (e.g., using the key described above) and proceeds to operation 1022 so that the STM application may access the V-EMSEG page at the specified address of the available page in the P-MSEG or of the selected page in the P-MSEG depending on whether the method has progressed from operation 1006 to 1014 or from operation 1012 to 1014.

FIG. 11 is a flow diagram illustrating a method 1100 for reclaiming the set of virtual memory pages allocated to the STM, according to certain embodiments. When STM wants to tear down the EMSEG 602, STM Core broadcasts teardown message at operation 1102. Then, at operation 1104, the STM application teardown callback function stored in the V-EMSEG will disappear, and the STM application may do the final clear up work in the V-EMSEG. Then, at operation 1106, the STM core deletes the page swap file “PageFile. bin” in the external storage device 606. The STM core may also delete the encryption key/code stored in the MSEG 502 at operation 1106.

FIG. 12 is a block diagram illustrating the P-MSEG page in MSEG 502, V-EMSEG pages in EMSEG 602, S-EMSEG pages in external storage 606 and a communication buffer 1202 between the MSEG 502 and the external storage 606, according to certain embodiments. As noted above, the STM may have dedicated storage for firmware usage, for example, an NVMe partition. Current UEFI BIOS supports non-SPI boot path, and all data/code/variable are stored in different NVMe partition. Alternatively, the STM may work with a VMM to setup an isolation policy for an NVMe partition. If the STM may leverage VMM capabilities, especially if the VMM and STM are both products of a same manufacturer.

As shown, a communication buffer 1202 may be used to transfer data 1204 between the STM (e.g., MSEG 502) and the external storage device 606. As noted above, this may be accomplished with the help of a VMM as explained with regard to FIG. 13 below. The P-MSEG and S-EMSEG pages may be moved from one physical memory to the other as encrypted data with the VMM having to know any key/code being used to secure the pages.

FIG. 13 is a flow diagram illustrating a method 1300 for extending the memory available for use by an STM with the aid of a VMM, according to certain embodiments. When the STM need to access external storage 606, at operation 1302, the STM creates a SetJump point (e.g., saving the state of the STM application) and, at operation 1304, sends a request to the pre-allocated communication buffer 1202 between STM/VMM. The request may include a page of P-MSEG that is to be moved to the S-EMSEG of external storage 606. At

operations

1306 and 1308, the STM signals a system control interrupt (SCI) and ResumeGuest to VMM so that the VMM will check the communication buffer 1202. At operation 1310, the VMM will receive the SCI and an SCI handler of the VMM will check communication buffer (e.g., and retrieve any pages in the buffer) . At operation, 1314 the VMM will access the S-EMSEG and obtain any data (e.g., pages) requested by the STM (or copy pages retrieved from the buffer to the S-EMSEG) . The VMM knows that the request is from STM because of the SCI, therefore the VMM may safely copy data from S-EMSEG to communication buffer. Importantly, the VMM only does copying of the data to and from the buffer, the VMM does not do any encryption/decryption because the VMM does not know have access to the key/code generated for encrypting/decrypting. The data in communication buffer 1202 is still cypher text, not plain text until it is received in the MSEG 502.

At operation 1318, the VMM uses VMCALL to signal the STM regarding data copied by the VMM into or out of the communication buffer 1202. At operation 1320, the STM will find a FarJump point and start executing the STM application based on the state information saves at the earlier SetJump point. At operation 1322, the STM copies data (e.g., pages) from communication buffer 1202 to P-EMSEG. Then STM decrypts the data at the MSEG 502 as explained above.

EXAMPLES

Example 1 is a system comprising a processor and a memory coupled to the processor, the memory including instructions which, when executed by the processor, cause the system to: in response to receiving a request from a system management mode (SMM) process to access a virtual memory page allocated to the SMM process in a page table: based on a determination that a page is available in the first memory, specify an address of the available page in the first memory for the virtual memory page in the page table； and based on a determination that a page is not available in the first memory: select a page in the first memory according to a page replacement policy； encrypt the selected page in the first memory； move the encrypted selected page from the first memory to a second memory； and specify an address of the selected page in the first memory for the virtual memory page in the page table.

In Example 2, the subject matter of Example 1 optionally includes instructions which, when executed by the processor, cause the system to: based on the page table specifying the address of the available page in the first memory and an address of an encrypted page in the second memory for the virtual memory page: move the specified encrypted page from the second memory to the address of the available page in the first memory； and decrypt the specified encrypted page in the first memory； and based on the page table specifying the address of the selected page in the first memory and the address of an encrypted page in the second memory for the virtual memory page: move the specified encrypted page from the second memory to the address of the selected page in the first memory； and decrypt the specified encrypted page in the first memory.

In Example 3, the subject matter of any one or more of Examples 1–2 optionally include wherein the SMM process comprises a system management mode transfer monitor (STM) and the first memory comprises a monitor segment (MSEG) portion of system management ram (SMRAM) reserved for the STM.

In Example 4, the subject matter of Example 3 optionally includes wherein: the virtual memory page comprises an extended MSEG reserved for the STM； the second memory comprises a page swap file in a physical storage device； and the page swap file is of a size equal to the size of the extended MSEG.

In Example 5, the subject matter of Example 4 optionally includes instructions which, when executed by the processor, cause the system to: reclaim the extended MSEG reserved for the STM； and delete the page swap file in the physical storage device.

In Example 6, the subject matter of any one or more of Examples 1–5 optionally include wherein the page replacement policy specifies that a page in the first memory is selected based on a time period since the page has been accessed being greater than a threshold value.

In Example 7, the subject matter of any one or more of Examples 1–6 optionally include wherein the page replacement policy specifies that a page in the first memory is selected based on a time period since the page has been in the first memory being greater than a threshold value.

In Example 8, the subject matter of any one or more of Examples 4–7 optionally include instructions which, when executed by the processor, cause the system to generate a code to encrypt and decrypt the pages, the code comprising a key generated using a random number generator.

In Example 9, the subject matter of Example 8 optionally includes instructions which, when executed by the processor, cause the system to store the code in a region of the first memory that stores data that cannot be moved to the second memory.

In Example 10, the subject matter of Example 9 optionally includes instructions which, when executed by the processor, cause the system to: reclaim the extended MSEG reserved for the STM； and delete the code stored in the first memory.

In Example 11, the subject matter of any one or more of Examples 1–10 optionally include instructions which, when executed by the processor, cause the system to: in order to move the encrypted selected page from the first memory to the second memory: create a jump point in the SMM process； move the encrypted selected page from the first memory to a communication buffer between the SMM process and a virtual machine monitor (VMM) ； send a system control interrupt (SCI) to the VMM indicating that the SMM process has placed the encrypted selected page in the communication buffer； cause the VMM to move the encrypted selected page from the communication buffer to the second memory； and resume the SMM process from the jump point in the SMM process.

In Example 12, the subject matter of any one or more of Examples 2–11 optionally include instructions which, when executed by the processor, cause the system to: in order to move the specified encrypted page from the second memory to the first memory: create a jump point in the SMM process； send a request for the specified encrypted page to a communication buffer between the SMM process and a virtual machine monitor (VMM) ； send a system control interrupt (SCI) to the VMM indicating that the SMM process has placed the request in the communication buffer； cause the VMM to move the specified encrypted page from the second memory to the communication buffer； move the specified encrypted page from the communication buffer to the first memory； decrypt the specified encrypted page in the first memory； and resume the SMM process from the jump point in the SMM process.

Example 13 is a method for extending memory available to a system management mode (SMM) process, the method comprising: in response to receiving a request from an SMM process to access a virtual memory page allocated to the SMM process in a page table: based on a determination that a page is available in the first memory, specifying an address of the available page in the first memory for the virtual memory page in the page table； and based on a determination that a page is not available in the first memory: selecting a page in the first memory according to a page replacement policy； encrypting the selected page in the first memory； moving the encrypted selected page from the first memory to a second memory； and specifying an address of the selected page in the first memory for the virtual memory page in the page table.

In Example 14, the subject matter of Example 13 optionally includes based on the page table specifying the address of the available page in the first memory and an address of an encrypted page in the second memory for the virtual memory page: moving the specified encrypted page from the second memory to the address of the available page in the first memory； and decrypting the specified encrypted page in the first memory； and based on the page table specifying the address of the selected page in the first memory and the address of an encrypted page in the second memory for the virtual memory page: moving the specified encrypted page from the second memory to the address of the selected page in the first memory； and decrypting the specified encrypted page in the first memory.

In Example 15, the subject matter of any one or more of Examples 13–14 optionally include wherein the SMM process comprises a system management mode transfer monitor (STM) and the first memory comprises a monitor segment (MSEG) portion of system management ram (SMRAM) reserved for the STM.

In Example 16, the subject matter of Example 15 optionally includes wherein: the virtual memory page comprises an extended MSEG reserved for the STM； the second memory comprises a page swap file in a physical storage device； and the page swap file is of a size equal to the size of the extended MSEG.

In Example 17, the subject matter of Example 16 optionally includes reclaiming the extended MSEG reserved for the STM； and deleting the page swap file in the physical storage device.

In Example 18, the subject matter of any one or more of Examples 13–17 optionally include wherein the page replacement policy specifies that a page in the first memory is selected based on a time period since the page has been accessed being greater than a threshold value.

In Example 19, the subject matter of any one or more of Examples 13–18 optionally include wherein the page replacement policy specifies that a page in the first memory is selected based on a time period since the page has been in the first memory being greater than a threshold value.

In Example 20, the subject matter of any one or more of Examples 16–19 optionally include generating a code to encrypt and decrypt the pages, the code comprising a key generated using a random number generator.

In Example 21, the subject matter of Example 20 optionally includes storing the code in a region of the first memory that stores data that cannot be moved to the second memory.

In Example 22, the subject matter of Example 21 optionally includes reclaiming the extended MSEG reserved for the STM； and deleting the code stored in the first memory.

In Example 23, the subject matter of any one or more of Examples 13–22 optionally include in order to move the encrypted selected page from the first memory to the second memory: creating a jump point in the SMM process； moving the encrypted selected page from the first memory to a communication buffer between the SMM process and a virtual machine monitor (VMM) ； sending a system control interrupt (SCI) to the VMM indicating that the SMM process has placed the encrypted selected page in the communication buffer； causing the VMM to move the encrypted selected page from the communication buffer to the second memory； and resuming the SMM process from the jump point in the SMM process.

In Example 24, the subject matter of any one or more of Examples 14–23 optionally include in order to move the specified encrypted page from the second memory to the first memory: creating a jump point in the SMM process； sending a request for the specified encrypted page to a communication buffer between the SMM process and a virtual machine monitor (VMM) ； sending a system control interrupt (SCI) to the VMM indicating that the SMM process has placed the request in the communication buffer； causing the VMM to move the specified encrypted page from the second memory to the communication buffer； moving the specified encrypted page from the communication buffer to the first memory； decrypting the specified encrypted page in the first memory； and resuming the SMM process from the jump point in the SMM process.

Example 25 is at least one computer-readable storage medium having instructions stored thereon, which when executed by a processor of a machine, cause the machine to: in response to receiving a request from a system management mode (SMM) process to access a virtual memory page allocated to the SMM process in a page table: based on a determination that a page is available in the first memory, specify an address of the available page in the first memory for the virtual memory page in the page table； and based on a determination that a page is not available in the first memory: select a page in the first memory according to a page replacement policy； encrypt the selected page in the first memory； move the encrypted selected page from the first memory to a second memory； and specify an address of the selected page in the first memory for the virtual memory page in the page table.

In Example 26, the subject matter of Example 25 optionally includes instructions stored thereon which, when executed by the processor, cause the machine to: based on the page table specifying the address of the available page in the first memory and an address of an encrypted page in the second memory for the virtual memory page: move the specified encrypted page from the second memory to the address of the available page in the first memory； and decrypt the specified encrypted page in the first memory； and based on the page table specifying the address of the selected page in the first memory and the address of an encrypted page in the second memory for the virtual memory page: move the specified encrypted page from the second memory to the address of the selected page in the first memory； and decrypt the specified encrypted page in the first memory.

In Example 27, the subject matter of any one or more of Examples 25–26 optionally include wherein the SMM process comprises a system management mode transfer monitor (STM) and the first memory comprises a monitor segment (MSEG) portion of system management ram (SMRAM) reserved for the STM.

In Example 28, the subject matter of any one or more of Examples 25–27 optionally include wherein: the virtual memory page comprises an extended MSEG reserved for the STM； the second memory comprises a page swap file in a physical storage device； and the page swap file is of a size equal to the size of the extended MSEG.

In Example 29, the subject matter of Example 28 optionally includes instructions stored thereon which, when executed by the processor, cause the machine to: reclaim the extended MSEG reserved for the STM； and delete the page swap file in the physical storage device.

In Example 30, the subject matter of any one or more of Examples 23–29 optionally include wherein the page replacement policy specifies that a page in the first memory is selected based on a time period since the page has been accessed being greater than a threshold value.

In Example 31, the subject matter of any one or more of Examples 23–30 optionally include wherein the page replacement policy specifies that a page in the first memory is selected based on a time period since the page has been in the first memory being greater than a threshold value.

In Example 32, the subject matter of any one or more of Examples 26–31 optionally include instructions which, when executed by the processor, cause the machine to generate a code to encrypt and decrypt the pages, the code comprising a key generated using a random number generator.

In Example 33, the subject matter of Example 32 optionally includes instructions which, when executed by the processor, cause the machine to store the code in a region of the first memory that stores data that cannot be moved to the second memory.

In Example 34, the subject matter of Example 33 optionally includes instructions which, when executed by the processor, cause the machine to: reclaim the extended MSEG reserved for the STM； and delete the code stored in the first memory.

In Example 35, the subject matter of any one or more of Examples 23–34 optionally include instructions which, when executed by the processor, cause the machine to: in order to move the encrypted selected page from the first memory to the second memory: create a jump point in the SMM process； move the encrypted selected page from the first memory to a communication buffer between the SMM process and a virtual machine monitor (VMM) ； send a system control interrupt (SCI) to the VMM indicating that the SMM process has placed the encrypted selected page in the communication buffer； cause the VMM to move the encrypted selected page from the communication buffer to the second memory； and resume the SMM process from the jump point in the SMM process.

In Example 36, the subject matter of any one or more of Examples 24–35 optionally include instructions which, when executed by the processor, cause the system to: in order to move the specified encrypted page from the second memory to the first memory: create a jump point in the SMM process； send a request for the specified encrypted page to a communication buffer between the SMM process and a virtual machine monitor (VMM) ； send a system control interrupt (SCI) to the VMM indicating that the SMM process has placed the request in the communication buffer； cause the VMM to move the specified encrypted page from the second memory to the communication buffer； move the specified encrypted page from the communication buffer to the first memory； decrypt the specified encrypted page in the first memory； and resume the SMM process from the jump point in the SMM process..

Example 37 is at least one machine-readable medium including instructions, which when executed by a machine, cause the machine to perform operations of any of the methods of Examples 13-24.

Example 38 is an apparatus comprising means for performing any of the methods of Examples 13-24.

Example 39 is an apparatus for extending memory available to a system management mode (SMM) process, the apparatus comprising: means for responding to a request from an SMM process to access a virtual memory page allocated to the SMM process in a page table, the means comprising: means for, based on a determination that a page is available in the first memory, specifying an address of the available page in the first memory for the virtual memory page in the page table； and means for, based on a determination that a page is not available in the first memory, using: means for selecting a page in the first memory according to a page replacement policy； means for encrypting the selected page in the first memory； means for moving the encrypted selected page from the first memory to a second memory； and means for specifying an address of the selected page in the first memory for the virtual memory page in the page table.

In Example 40, the subject matter of Example 39 optionally includes means for, based on the page table specifying the address of the available page in the first memory and an address of an encrypted page in the second memory for the virtual memory page, using: means for moving the specified encrypted page from the second memory to the address of the available page in the first memory； and means for decrypting the specified encrypted page in the first memory； and means for, based on the page table specifying the address of the selected page in the first memory and the address of an encrypted page in the second memory for the virtual memory page, using: means for moving the specified encrypted page from the second memory to the address of the selected page in the first memory； and means for decrypting the specified encrypted page in the first memory.

In Example 41, the subject matter of any one or more of Examples 39–40 optionally include wherein the SMM process comprises a system management mode transfer monitor (STM) and the first memory comprises a monitor segment (MSEG) portion of system management ram (SMRAM) reserved for the STM .

In Example 42, the subject matter of Example 41 optionally includes wherein: the virtual memory page comprises an extended MSEG reserved for the STM； the second memory comprises a page swap file in a physical storage device； and the page swap file is of a size equal to the size of the extended MSEG.

In Example 43, the subject matter of Example 42 optionally includes means for reclaiming the extended MSEG reserved for the STM； and means for deleting the page swap file in the physical storage device.

In Example 44, the subject matter of any one or more of Examples 39–43 optionally include wherein the page replacement policy specifies that a page in the first memory is selected based on a time period since the page has been accessed being greater than a threshold value.

In Example 45, the subject matter of any one or more of Examples 39–44 optionally include wherein the page replacement policy specifies that a page in the first memory is selected based on a time period since the page has been in the first memory being greater than a threshold value.

In Example 46, the subject matter of any one or more of Examples 42–45 optionally include means for generating a code to encrypt and decrypt the pages, the code comprising a key generated using a random number generator.

In Example 47, the subject matter of Example 46 optionally includes means for storing the code in a region of the first memory that stores data that cannot be moved to the second memory.

In Example 48, the subject matter of Example 47 optionally includes reclaiming the extended MSEG reserved for the STM； and deleting the code stored in the first memory.

In Example 49, the subject matter of any one or more of Examples 39–48 optionally include means for moving the encrypted selected page from the first memory to the second memory, the means comprising: means for creating a jump point in the SMM process； means for moving the encrypted selected page from the first memory to a communication buffer between the SMM process and a virtual machine monitor (VMM) ； means for sending a system control interrupt (SCI) to the VMM indicating that the SMM process has placed the encrypted selected page in the communication buffer； means for causing the VMM to move the encrypted selected page from the communication buffer to the second memory； and means for resuming the SMM process from the jump point in the SMM process.

In Example 50, the subject matter of any one or more of Examples 40–49 optionally include means for moving the encrypted selected page from the first memory to the second memory, the means comprising: means for creating a jump point in the SMM process； means for sending a request for the specified encrypted page to a communication buffer between the SMM process and a virtual machine monitor (VMM) ； means for sending a system control interrupt (SCI) to the VMM indicating that the SMM process has placed the request in the communication buffer； means for causing the VMM to move the specified encrypted page from the second memory to the communication buffer； means for moving the specified encrypted page from the communication buffer to the first memory； means for decrypting the specified encrypted page in the first memory； and resuming the SMM process from the jump point in the SMM process.

Example 51 is a system for extending memory available to a system management mode (SMM) process, the system comprising: a SMM memory module configured to respond to a request from the SMM process to access a virtual memory page allocated to the SMM process in a page table, by using: a page table module configured to, based on a determination that a page is available in the first memory, specify an address of the available page in the first memory for the virtual memory page in the page table； and a page selection module configured to, based on a determination that a page is not available in the first memory, select a page in the first memory according to a page replacement policy and use； an encryption module configured to encrypt the selected page in the first memory； a page transfer module configured to move the encrypted selected page from the first memory to a second memory； and the page table module configured to specify an address of the selected page in the first memory for the virtual memory page in the page table.

In Example 52, the subject matter of Example 51 optionally includes the SMM memory module further configured to respond to the request from the SMM process by: based on the page table specifying the address of the available page in the first memory and an address of an encrypted page in the second memory for the virtual memory page, causing: the page transfer module to move the specified encrypted page from the second memory to the address of the available page in the first memory； the encryption module to decrypt the specified encrypted page in the first memory； and based on the page table specifying the address of the selected page in the first memory and the address of an encrypted page in the second memory for the virtual memory page, causing: the page transfer module to move the specified encrypted page from the second memory to the address of the selected page in the first memory； the encryption module to decrypt the specified encrypted page in the first memory.

In Example 53, the subject matter of any one or more of Examples 51–52 optionally include wherein the SMM process comprises a system management mode transfer monitor (STM) and the first memory comprises a monitor segment (MSEG) portion of system management ram (SMRAM) reserved for the STM.

In Example 54, the subject matter of any one or more of Examples 51–53 optionally include wherein: the virtual memory page comprises an extended MSEG reserved for the STM； the second memory comprises a page swap file in a physical storage device； and the page swap file is of a size equal to the size of the extended MSEG.

In Example 55, the subject matter of Example 54 optionally includes a teardown module configured to: reclaim the extended MSEG reserved for the STM； and delete the page swap file in the physical storage device.

In Example 56, the subject matter of any one or more of Examples 51–55 optionally include wherein the page replacement policy specifies that a page in the first memory is selected based on a time period since the page has been accessed being greater than a threshold value.

In Example 57, the subject matter of any one or more of Examples 51–56 optionally include wherein the page replacement policy specifies that a page in the first memory is selected based on a time period since the page has been in the first memory being greater than a threshold value.

In Example 58, the subject matter of any one or more of Examples 52–57 optionally include the encryption module further configured to generate a code to encrypt and decrypt the pages, the code comprising a key generated using a random number generator.

In Example 59, the subject matter of Example 58 optionally includes the encryption module further configured to store the code in a region of the first memory that stores data that cannot be moved to the second memory.

In Example 60, the subject matter of Example 59 optionally includes a teardown module configured to: reclaim the extended MSEG reserved for the STM； and delete the code stored in the first memory.

In Example 61, the subject matter of any one or more of Examples 51–60 optionally include the SMM memory module further configured to move the encrypted selected page from the first memory to the second memory by: creating a jump point in the SMM process； causing the page transfer module to move the encrypted selected page from the first memory to a communication buffer between the SMM process and a virtual machine monitor (VMM) ； sending a system control interrupt (SCI) to the VMM indicating that the SMM process has placed the encrypted selected page in the communication buffer； causing the VMM to move the encrypted selected page from the communication buffer to the second memory； and resuming the SMM process from the jump point in the SMM process.

In Example 62, the subject matter of any one or more of Examples 52–61 optionally include the SMM memory module further configured to move the corresponding encrypted page from the second memory to the first memory by: creating a jump point in the SMM process； sending a request for the corresponding encrypted page to a communication buffer between the SMM process and a virtual machine monitor (VMM) ； sending a system control interrupt (SCI) to the VMM indicating that the SMM process has placed the request in the communication buffer； causing the VMM to move the corresponding encrypted page from the second memory to the communication buffer； causing the page transfer module to move the corresponding encrypted page from the communication buffer to the first memory； causing the encryption module to decrypt the corresponding encrypted page in the first memory； and resuming the SMM process from the jump point in the SMM process.

The foregoing description of one or more implementations provide illustration and description, but is not intended to be exhaustive or to limit the scope of the embodiments disclosed herein to the precise form disclosed. Modifications and variations are possible in light of the above teachings or may be acquired from practice of various implementations of the embodiments disclosed herein.

Language

Throughout this specification, plural instances may implement components, operations, or structures described as a single instance. Although individual operations of one or more methods are illustrated and described as separate operations, one or more of the individual operations may be performed concurrently, and nothing requires that the operations be performed in the order illustrated. Structures and functionality presented as separate components in example configurations may be implemented as a combined structure or component. Similarly, structures and functionality presented as a single component may be implemented as separate components. These and other variations, modifications, additions, and improvements fall within the scope of the subject matter herein.

Although an overview of the inventive subject matter has been described with reference to specific example embodiments, various modifications and changes may be made to these embodiments without departing from the broader scope of embodiments of the present disclosure. Such embodiments of the inventive subject matter may be referred to herein, individually or collectively, by the term “invention” merely for convenience and without intending to voluntarily limit the scope of this application to any single disclosure or inventive concept if more than one is, in fact, disclosed.

The embodiments illustrated herein are described in sufficient detail to enable those skilled in the art to practice the teachings disclosed. Other embodiments may be used and derived therefrom, such that structural and logical substitutions and changes may be made without departing from the scope of this disclosure. The Detailed Description, therefore, is not to be taken in a limiting sense, and the scope of various embodiments is defined only by the appended claims, along with the full range of equivalents to which such claims are entitled.

As used herein, the term “or” may be construed in either an inclusive or exclusive sense. Moreover, plural instances may be provided for resources, operations, or structures described herein as a single instance. Additionally, boundaries between various resources, operations, modules, engines, and data stores are somewhat arbitrary, and particular operations are illustrated in a context of specific illustrative configurations. Other allocations of functionality are envisioned and may fall within a scope of various embodiments of the present disclosure. In general, structures and functionality presented as separate resources in the example configurations may be implemented as a combined structure or resource. Similarly, structures and functionality presented as a single resource may be implemented as separate resources. These and other variations, modifications, additions, and improvements fall within a scope of embodiments of the present disclosure as represented by the appended claims. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.

Claims

A system comprising a processor and a memory coupled to the processor, the memory comprising instructions which, when executed by the processor, cause the system to:

in response to receiving a request from a system management mode (SMM) process to access a virtual memory page allocated to the SMM process in a page table:

based on a determination that a page is available in the first memory, specify an address of the available page in the first memory for the virtual memory page in the page table； and

based on a determination that a page is not available in the first memory:

select a page in the first memory according to a page replacement policy；

encrypt the selected page in the first memory；

move the encrypted selected page from the first memory to a second memory； and

specify an address of the selected page in the first memory for the virtual memory page in the page table.
The system of claim 1, further comprising instructions which, when executed by the processor, cause the system to:

based on the page table specifying the address of the available page in the first memory and an address of an encrypted page in the second memory for the virtual memory page:

move the specified encrypted page from the second memory to the address of the available page in the first memory； and

decrypt the specified encrypted page in the first memory； and

based on the page table specifying the address of the selected page in the first memory and the address of an encrypted page in the second memory for the virtual memory page:

move the specified encrypted page from the second memory to the address of the selected page in the first memory； and

decrypt the specified encrypted page in the first memory.
The system of claim 1, wherein the SMM process comprises a system management mode transfer monitor (STM) and the first memory comprises a monitor segment (MSEG) portion of system management ram (SMRAM) reserved for the STM.
The system of claim 3, wherein:

the virtual memory page comprises an extended MSEG reserved for the STM；

the second memory comprises a page swap file in a physical storage device； and

the page swap file is of a size equal to the size of the extended MSEG.
The system of claim 4, further comprising instructions which, when executed by the processor, cause the system to:

reclaim the extended MSEG reserved for the STM； and

delete the page swap file in the physical storage device.
The system of claim 1, wherein the page replacement policy specifies that a page in the first memory is selected based on a time period since the page has been accessed being greater than a threshold value.
The system of claim 1, wherein the page replacement policy specifies that a page in the first memory is selected based on a time period since the page has been in the first memory being greater than a threshold value.
The system of claim 4, further comprising instructions which, when executed by the processor, cause the system to generate a code to encrypt and decrypt the pages, the code comprising a key generated using a random number generator.
The system of claim 8, further comprising instructions which, when executed by the processor, cause the system to store the code in a region of the first memory that stores data that cannot be moved to the second memory.
The system of claim 9, further comprising instructions which, when executed by the processor, cause the system to:

reclaim the extended MSEG reserved for the STM； and

delete the code stored in the first memory.
The system of claim 1, further comprising instructions which, when executed by the processor, cause the system to:

in order to move the encrypted selected page from the first memory to the second memory:

create a jump point in the SMM process；

move the encrypted selected page from first memory to a communication buffer between the SMM process and a virtual machine monitor (VMM) ；

send a system control interrupt (SCI) to the VMM indicating that the SMM process has placed the encrypted selected page in the communication buffer；

cause the VMM to move the encrypted selected page from the communication buffer to the second memory； and

resume the SMM process from the jump point in the SMM process.
The system of claim 2, further comprising instructions which, when executed by the processor, cause the system to:

in order to move the specified encrypted page from the second memory to the first memory:

create a jump point in the SMM process；

send a request for the specified encrypted page to a communication buffer between the SMM process and a virtual machine monitor (VMM) ；

send a system control interrupt (SCI) to the VMM indicating that the SMM process has placed the request in the communication buffer；

cause the VMM to move the specified encrypted page from the second memory to the communication buffer；

move the specified encrypted page from the communication buffer to the first memory；

decrypt the specified encrypted page in the first memory； and

resume the SMM process from the jump point in the SMM process.
A method for extending memory available to a system management mode (SMM) process, the method comprising:

in response to receiving a request from an SMM process to access a virtual memory page allocated to the SMM process in a page table:

based on a determination that a page is available in the first memory, specifying an address of the available page in the first memory for the virtual memory page in the page table； and

based on a determination that a page is not available in the first memory:

selecting a page in the first memory according to a page replacement policy；

encrypting the selected page in the first memory；

moving the encrypted selected page from the first memory to a second memory； and

specifying an address of the selected page in the first memory for the virtual memory page in the page table.
The method of claim 13, further comprising:

based on the page table specifying the address of the available page in the first memory and an address of an encrypted page in the second memory for the virtual memory page:

moving the specified encrypted page from the second memory to the address of the available page in the first memory； and

decrypting the specified encrypted page in the first memory； and

based on the page table specifying the address of the selected page in the first memory and the address of an encrypted page in the second memory for the virtual memory page:

moving the specified encrypted page from the second memory to the address of the selected page in the first memory； and

decrypting the specified encrypted page in the first memory.
The method of claim 13, wherein the SMM process comprises a system management mode transfer monitor (STM) and the first memory comprises a monitor segment (MSEG) portion of system management ram (SMRAM) reserved for the STM.
The method of claim 15, wherein:

the virtual memory page comprises an extended MSEG reserved for the STM；

the second memory comprises a page swap file in a physical storage device； and

the page swap file is of a size equal to the size of the extended MSEG.
The method of claim 16, further comprising:

reclaiming the extended MSEG reserved for the STM； and

deleting the page swap file in the physical storage device.
The method of claim 13, wherein the page replacement policy specifies:

that a page in the first memory is selected based on a time period since the page has been accessed being greater than a threshold value； or

that a page in the first memory is selected based on a time period since the page has been in the first memory being greater than a threshold value.
The method of claim 16, further comprising generating a code to encrypt and decrypt the pages, the code comprising a key generated using a random number generator.
The method of claim 19, further comprising storing the code in a region of the first memory that stores data that cannot be moved to the second memory.
The method of claim 20, further comprising:

reclaiming the extended MSEG reserved for the STM； and

deleting the code stored in the first memory.
The method of claim 13, further comprising:

in order to move the encrypted selected page from the first memory to the second memory:

creating a jump point in the SMM process；

moving the encrypted selected page from first memory to a communication buffer between the SMM process and a virtual machine monitor (VMM) ；

sending a system control interrupt (SCI) to the VMM indicating that the SMM process has placed the encrypted selected page in the communication buffer；

causing the VMM to move the encrypted selected page from the communication buffer to the second memory； and

resuming the SMM process from the jump point in the SMM process.
The method of claim 14, further comprising:

in order to move the specified encrypted page from the second memory to the first memory:

creating a jump point in the SMM process；

sending a request for the specified encrypted page to a communication buffer between the SMM process and a virtual machine monitor (VMM) ；

sending a system control interrupt (SCI) to the VMM indicating that the SMM process has placed the request in the communication buffer；

causing the VMM to move the specified encrypted page from the second memory to the communication buffer；

moving the specified encrypted page from the communication buffer to the first memory；

decrypting the specified encrypted page in the first memory； and

resuming the SMM process from the jump point in the SMM process.
At least one machine-readable medium comprising instructions, which when executed by a machine, cause the machine to perform operations of any of the methods of claims 13-23.
An apparatus comprising means for performing any of the methods of claims 13-23.