Secure hardware initialization

Patent metadata

Field	Value
Publication number	US-11119947-B2
Application number	US-201716606955-A
Country	US
Kind code	B2
Filing date	Oct 30, 2017
Priority date	Oct 30, 2017
Publication date	Sep 14, 2021
Grant date	Sep 14, 2021

Abstract

A method for secure hardware initialization during a start-up process comprises activating a protected portion of a physical memory, allocating a part of the protected portion of the physical memory for use by direct memory access, DMA, drivers and non-DMA related hardware initialization instructions, and using a memory management tool, allocating a first part of the physical memory, accessible by a device via the memory management tool, for use by data.

First claim

The invention claimed is:

1. A method for secure hardware initialization during a start-up process of a system, the method comprising:
activating a protected portion of a physical memory, wherein the physical memory is writable by devices in the system, and the protected portion contains basic input/output system (BIOS) code, and wherein activating the protected portion protects the BIOS code against direct memory access (DMA) during execution of the BIOS code;
allocating a first part of the physical memory for use by a DMA driver; and
allocating, using a memory management tool, a second part of the physical memory, wherein data in the second part of the physical memory is accessible by a DMA device via the memory management tool.

2. The method of claim 1 , further comprising:
copying or moving the data located in the second part of the physical memory into the protected portion.

3. The method of claim 1 , further comprising:
authenticating the data in the second part of the physical memory prior to use of the data.

4. A system comprising:
a physical memory;
a processor to:
activate a protected portion of the physical memory during a system start-up process, the physical memory writable by devices in the system, and the protected portion to contain basic input/output system (BIOS) code, wherein activating the protected portion protects the BIOS code against direct memory access (DMA) during execution of the BIOS code, and
assign a first part of the physical memory for use by a DMA driver;

a memory management tool executable to:
allocate a second part of the physical memory, wherein the second part is accessible by a DMA device via the memory management tool.

5. A non-transitory machine-readable storage medium comprising instructions that upon execution cause a system to:
activate a protected portion of a physical memory during a start-up of the system, the physical memory writable by devices in the system, and the protected portion containing basic input/output system (BIOS) code, wherein activating the protected portion protects the BIOS code against direct memory access (DMA) during execution of the BIOS code; and
allocate, using a memory management tool, a first part of the physical memory, wherein the first part is accessible by a DMA device via the memory management tool.

6. The method of claim 1 , wherein the activating of the protected portion of the physical memory comprises activating a register that defines a memory range of the protected portion.

7. The method of claim 6 , further comprising:
subsequent to activating the register:
setting up a mapping that defines a first memory region of the physical memory accessible by the DMA device, wherein a second memory region different from the first memory region is protected against DMA access, and wherein the second memory region is different from the protected portion, and
storing the BIOS code in the second memory region.

8. The method of claim 7 , further comprising:
after setting up the mapping, deactivating the register to deactivate the protected portion.

9. The method of claim 7 , wherein the setting up of the mapping is performed by an operating system.

10. The method of claim 9 , wherein the activating of the protected portion occurs prior to starting the operating system.

11. The system of claim 4 , wherein the activating of the protected portion of the physical memory is based on an activation of a register that defines a memory range of the protected portion.

12. The system of claim 11 , wherein the processor is to:
subsequent to the activation of the register:
set up a mapping that defines a first memory region of the physical memory accessible by the DMA device, wherein a second memory region different from the first memory region is protected against DMA access, and wherein the second memory region is different from the protected portion, and
store the BIOS code in the second memory region.

13. The system of claim 12 , wherein the processor is to:
after setting up the mapping, deactivate the register to deactivate the protected portion.

14. The system of claim 12 , further comprising an operating system to set up the mapping.

15. The system of claim 14 , wherein the processor is to activate the protected portion prior to starting the operating system.

16. The non-transitory machine-readable storage medium of claim 5 , wherein the activating of the protected portion of the physical memory is based on an activation of a register that defines a memory range of the protected portion.

17. The non-transitory machine-readable storage medium of claim 16 , wherein the instructions upon execution cause the system to:
subsequent to the activation of the register:
set up a mapping that defines a first memory region of the physical memory accessible by the DMA device, wherein a second memory region different from the first memory region is protected against DMA access, and wherein the second memory region is different from the protected portion, and
store the BIOS code in the second memory region.

18. The non-transitory machine-readable storage medium of claim 17 , wherein the instructions upon execution cause the system to:
after setting up the mapping, deactivate the register to deactivate the protected portion.

19. The non-transitory machine-readable storage medium of claim 17 , wherein the instructions upon execution cause the system to:
set up the mapping using an operating system.

20. The non-transitory machine-readable storage medium of claim 19 , wherein the instructions upon execution cause the system to:
activate the protected portion prior to starting the operating system.

Assignees

• Hewlett Packard Development Co

Inventors

• Villatel Maugan
• Dalton Chris
• Huscroft Carey

Classifications

• G06F13/28

  using burst mode transfer, e.g. direct memory access {DMA}, cycle steal (G06F13/32 takes precedence) · CPC title

• G06F2212/1052

  Security improvement · CPC title

• G06F21/575 Primary

  Secure boot · CPC title

• G06F12/1441 Primary

  for a range · CPC title

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title