System Management Mode

From Wikipedia, the free encyclopedia

System Management Mode (SMM) is an operating mode of the Intel 386SL and later microprocessor in which all normal execution (including the operating system) is suspended, and special separate software (usually firmware or a hardware-assisted debugger) is executed in high-privilege mode.

SMM is entered via the SMI (system management interrupt), which is caused by:

  • motherboard hardware signaling via a designated pin of the processor chip. This signal can be an independent event, or triggered by the system software via an I/O read from a location considered special by the motherboard logic (port $B2 is common).
  • an IO write to a location which the firmware has requested that the processor chip act on

Some common uses of SMM are:

  • to emulate motherboard hardware that is unimplemented or buggy.
  • power management operations, such as turning on fans.
  • to emulate a PS/2 mouse or keyboard from a USB one.
  • system safety functions, such as shutdown on high CPU temperature.
  • system configuration, such as on Toshiba and IBM notebook computers

[edit] Problems

  • Since the SMM code (SMI handler) is installed by the system firmware (BIOS), the OS and the SMM code may have expectations about hardware settings that are incompatible, such as different ideas of how the APIC should be set up.
  • Operations in SMM take CPU time away from the OS, since the CPU state must be stored to memory (SMRAM) and any write back caches must be flushed. This can destroy real-time behavior and cause clock ticks to get lost.
  • A digital logic analyser may be required to determine if SMM is occurring.
  • Recovering the SMI handler code to analyze it for bugs, vulnerabilities, and secrets requires a logic analyzer or dissassembly of the system firmware.

[edit] See also

[edit] External links

In other languages