Update of boot code handlers

Patent metadata

Field	Value
Publication number	US-12008359-B2
Application number	US-202016790488-A
Country	US
Kind code	B2
Filing date	Feb 13, 2020
Priority date	Feb 13, 2020
Publication date	Jun 11, 2024
Grant date	Jun 11, 2024

Abstract

Examples described herein provide a central processing unit (CPU) to reserve a region of memory for use to store both a boot firmware code and a second boot firmware code and to perform the second boot firmware code without reboot. The reserved region of memory can be a region that is not configured for access by an operating system (OS). The reserved region of memory comprises System Management Random Access Memory (SMRAM). If a first interrupt handler is not overwritten after a second boot firmware code is stored, the CPU can roll back to use of the first interrupt handler.

First claim

What is claimed is:

1. An apparatus comprising:
a memory to store both a boot firmware code and a replacement boot firmware code and
a central processing unit (CPU) to perform a portion of the replacement boot firmware code without reboot of the CPU, wherein:
the boot firmware code is associated with a first System Management Interrupt (SMI) handler,
the replacement boot firmware code is associated with a second SMI handler,
the second SMI handler comprises an alternate version of the first SMI handler,
the first SMI handler and the second SMI handler are stored simultaneously in the memory, and
the perform a portion of the replacement boot firmware code without reboot of the CPU comprises execute the second SMI handler.

2. The apparatus of claim 1 , wherein the CPU is to reserve a region of the memory for the both the boot firmware code and the replacement boot firmware code and wherein the reserved region of the memory comprises a region that is not configured for access by an operating system (OS).

3. The apparatus of claim 2 , wherein the reserved region of the memory comprises System Management Random Access Memory (SMRAM).

4. The apparatus of claim 1 , wherein the boot firmware code comprises one or more of: Basic Input/Output System (BIOS), Universal Extensible Firmware Interface (UEFI), a boot loader, or System Management Interrupt (SMI) handler and wherein the replacement boot firmware code comprises one or more of: a BIOS, UEFI, a boot loader, or an SMI handler.

5. The apparatus of claim 1 , comprising a processor to load the replacement boot firmware code from a storage device into the memory.

6. The apparatus of claim 5 , comprising one or more of a bus, interface, fabric, or network, wherein the storage device is locally or remotely connected with the CPU using one or more of the bus, interface, fabric, or network.

7. The apparatus of claim 1 , wherein the CPU is to perform the portion of the replacement boot firmware code based on authentication of the portion of the replacement boot firmware code.

8. The apparatus of claim 1 , comprising a server, data center, or rack, wherein the server, data center, or rack comprises the memory and the CPU.

9. The apparatus of claim 1 , wherein the second SMI handler comprises an updated version of the SMI handler.

10. The apparatus of claim 1 , wherein the replacement boot firmware code comprises a Universal Extensible Firmware Interface (UEFI) capsule.

11. A method comprising:
based on execution of a portion of a first version of boot firmware code by a processor, generating a region in memory of a size to store the first version of boot firmware code and a second version of boot firmware code and
based on a detected indication of an update to boot firmware code, storing a portion of the second version of boot firmware code in the region in the memory, wherein:
the first version of boot firmware code is associated with a first System Management Interrupt (SMI) handler,
the second version of boot firmware code is associated with a second SMI handler,
the second SMI handler comprises an alternate version of the first SMI handler,
the first SMI handler and the second SMI handler are stored simultaneously in the memory; and

performing a portion of the second version of the boot firmware code by executing the second SMI handler.

12. The method of claim 11 , wherein the first version of the boot firmware code comprises one or more of: Basic Input/Output System (BIOS), Universal Extensible Firmware Interface (UEFI), a boot loader, or System Management Interrupt (SMI) handler and wherein the second version of the boot firmware code comprises one or more of: a BIOS, UEFI, a boot loader, or an SMI handler.

13. The method of claim 11 , wherein the region in the memory comprises a region that is not configured for access by an operating system (OS).

14. The method of claim 11 , wherein the region in the memory comprises System Management Random Access Memory (SMRAM).

15. The method of claim 11 , comprising loading the portion of the second version of boot firmware code into the memory from one or more of: a locally connected storage device, a network accessible storage device, or a fabric accessible storage device.

16. The method of claim 11 , wherein the storing the portion of the second version of boot firmware code in the memory comprises authenticating the portion of the second version of boot firmware code prior to storing the portion of the second version of boot firmware code in the memory.

17. At least one non-transitory computer-readable medium, comprising instructions stored thereon, that if executed by one or more processors, cause the one or more processors to:
allocate a region in memory that is hidden from an operating system (OS), wherein the region is to store at least a first version of boot firmware code and a second version of boot firmware code;
based on an indication of a second version of a boot firmware code and authentication of the second version of the boot firmware code, copy a portion of the second version of the boot firmware code into the region, wherein:
the first version of boot firmware code is associated with a first System Management Interrupt (SMI) handler,
the second version of boot firmware code is associated with a second SMI handler,
the second SMI handler comprises an alternate version of the first SMI handler,
the first SMI handler and the second SMI handler are stored simultaneously in the memory; and

perform a portion of the second version of boot firmware code by executing the second SMI handler.

18. The at least one non-transitory computer-readable medium of claim 17 , wherein the second version of boot firmware code comprises one or more of: Basic Input/Output System (BIOS), Universal Extensible Firmware Interface (UEFI), a boot loader, or System Management Interrupt (SMI) handler.

19. The at least one non-transitory computer-readable medium of claim 17 , comprising instructions stored thereon, that if executed by one or more processors, cause the one or more processors to:
attempt to validate the second version of the boot firmware code and
do not permit execution of a portion of the second version of the boot firmware code of the boot firmware code based on failure to validate the second version of the boot firmware code.

20. The at least one non-transitory computer-readable medium of claim 17 , comprising instructions stored thereon, that if executed by one or more processors, cause the one or more processors to:
rollback to execution of a prior version of the boot firmware code stored in the region.

Assignees

• Intel Corp

Inventors

• Jayakumar Sarathy
• Kumar Mohan J
• Nachimuthu Murugasamy K
• Rothman Michael A

Classifications

• G06F9/4401

  Bootstrapping (security arrangements therefor G06F21/57) · CPC title

• G06F21/572 Primary

  Secure firmware programming, e.g. of basic input output system [BIOS] · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F8/656 Primary

  while running · CPC title