Secure option ROM firmware updates
AssigneeDell Products L.P.
InventorsDavid Konetski, Frank Molsberry, Ricardo L. Martinez
Life of this patent
Estimating the term…
Abstract
Option ROM updates are performed in a secure manner with centralized control through system initialization firmware, such as the system BIOS. An option ROM updater manages copying an option ROM update to an auxiliary subsystem if an update bit is set, such as by a secure system management interface with the BIOS. Upon detection of an update bit, the option ROM updater unlocks a write protect at the auxiliary subsystem firmware and copies an option ROM update to the auxiliary subsystem to update the option ROM. After completing the option ROM update, the option ROM updater locks write protection of the option ROM to maintain system security.
Claims17
An information handling system comprising:
- a processor operable to execute instructions;
- memory interfaced with the processor and operable to store the instructions;
- a chipset operable to store and execute firmware;
- a Basic Input or Output System (BIOS) stored in the chipset and operable to execute on the chipset;
- an auxiliary subsystem separate from the chipset and interfaced with the BIOS, the auxiliary subsystem performing an auxiliary function with option Read Only Memory (ROM) firmware instructions stored on the auxiliary subsystem;
- a write protect module stored on the auxiliary subsystem and selectively locking and unlocking a write protect of the option ROM firmware instructions;
- and
- an option ROM updater stored in the chipset and interfaced with the BIOS, the option ROM updater detecting an option ROM update bit set at the BIOS and in response to detecting the option ROM update bit to unlocking the write protect and to load an option ROM update from a predetermined location to the auxiliary subsystem to write updated option ROM firmware instructions on the auxiliary subsystem;
- wherein the option ROM updater is further operable to detect completion of the writing of the option ROM firmware instructions and in response to detecting completion to lock the write protect of the option ROM firmware instructions;
- and
- wherein the predetermined location comprises a network location stored in the auxiliary subsystem and wherein the option ROM updater retrieves the network location from the auxiliary subsystem upon detection of the option ROM update bit.
A method for updating an option Read Only Memory (ROM) of an information handling system, the method comprising:
- setting an option ROM update bit in initialization firmware executing on a chipset;
- executing the initialization firmware;
- detecting the option ROM update bit with the initialization firmware;
- in response to detecting, copying an option ROM update from a predetermined location to the initialization firmware, the predetermined location comprising a network location stored in the auxiliary subsystem, the option ROM update retrieved from the network location;
- updating the option ROM at an option ROM device with the option ROM update, the option ROM device separate from the chipset;
- and
- completing executing the initialization firmware to bring the information handling system to an operational state with the update installed on the option ROM.
A system for updating an option Read Only Memory (ROM) that manages an information handling system auxiliary subsystem, the system comprising:
- an auxiliary subsystem processor disposed in the auxiliary subsystem and operable to lock and unlock a write protect of an option ROM integrated in the auxiliary subsystem;
- and
- an option ROM updater stored within initialization firmware to run on an initialization processor separate from the auxiliary subsystem processor, the option ROM updater interfaced with the auxiliary subsystem processor, the option ROM updater detecting an option ROM update bit set in initialization firmware instructions and in response to detecting the option ROM update bit unlocking the write protect and to load an option ROM update from a predetermined location to the auxiliary subsystem, the option ROM update having updated option ROM firmware instructions for execution on the auxiliary subsystem processor;
- wherein the predetermined location comprises a network location stored in the auxiliary subsystem and wherein the option ROM updater retrieves the network location from the auxiliary subsystem upon detection of the option ROM update bit.
Dependencies are inferred from the claim text.