Dell Products Inc.

American Megatrends, Inc.

Baker & Botts, L.l.p.

Anand Prakash Joshi

Shekar Babu Suryanarayana

Balasingh Ponraj Samuel

Ibrahim Sayyed

Juan Francisco Diaz

Ricardo Luis Martinez

Sumanth Vidyadhara

Adolfo Sandor Montero

Richard Martin Tonry

Steven Downum

Samer El Haj Mahmoud

Mukund Purshottam Khatri

Charles D Robison

Wei G Liu

David Konetski

Craig Lawrence Chaiken

Alok Pant

Dirie N Herzi

Douglas Miles Anson

Charles Terrence Perusse, Jr

Frank Howard Molsberry

Michael Wayne Arms

Wai-Ming Richard Chan

Chris Edward Pepper

Jagadish Babu Jonnada

Amit K Tiwari

Samer El-Haj-Mahmoud

Richard Holmberg

Daniel Lawrence Hamlin

Elie Antoun Jreij

Nicholas Diciurcio Grobelny

Nikhil Manohar Vichare

Geroncio Ong Tan

Austin Patrick Bolen

Michael A Brundridge

Vivekanandh Narayanasamy Rajagopalan

Amy Christine Nelson

Christian L Critz

Claude Lano Cox

Rex W Bryan

Mark W Shutt

Bradford Edward Vier

Karun Palicherla Reddy

James T Gillon

Bryan James Thornley

Vinod Makhija

Stephen Cochran

Patrick Oliver Boyd

Abhay Arjun Salunke

Purushothama R Malluru

Alan H Abdelhalim

William Carl Edwards, Iii

Laxmi Lavanya Medicherla

Zhao Hui Yu

Chris C Griffin

Natalie Quach

Justin L Frodsham

Bala Ponraj Samuel

Puri R Malluru

Sudharshana Madhava Rao

Daniel L Smythia

Hemanth Venkatesh Murthy

Phanindra Talasila

Sayyed Ibrahim

An information handling system includes a BMC and a host processing system with a BIOS. The BIOS can provide a indications to the BMC that a session for changing functions of the BIOS has been started, that one or more changes to the functions has occurred, and that the session has been completed. The BMC receives the session start indication, at least one of the change indications, and an event indication that an event has occurred on the information handling system that has interrupted the session before the BIOS sends the session end indication. Subsequent to the event, the BMC provides a session interrupted indication that the session was interrupted and the at least one change indication to the BIOS. The BIOS restarts the session in response to receiving the session interrupted indication and re-executes the change to the function indicated by the at least one change indication.

Managed auto-resume for interrupted bios processes

Disclosed methods include initiating a system basic I/O system (BIOS) and, responsive to detecting an empty drive, accessing evaluating local BIOS telemetry data associated with installation of a new drive. Upon determining that the BIOS telemetry data a specified criteria, a long disk self-test (DST) and a short DST, may be performed. If the DSTs generate no hardware errors, hard drive service data including, for example, call log and service tag history associated with the information handling system, may be retrieved from a cloud backend to authorize an OS installation. Upon approving an OS installation, a service operating system (SOS) image may be retrieved from an OEM backend and a special key operable to cause a startup service of the SOS to boot to an OS installation flow may be accessed from a firmware volume in SPI flash to enable the SOS to initiate an OS installation flow.

BIOS-instrumented firmware state for hard drive repair/replace assurance

An operating system (OS) software service detects an accessibility change event and takes a snapshot of the accessibility settings before sending and receiving memory-mapped input/output (MMIO) commands with an embedded controller (EC) to establish trust using existing security hardening methods. The software service may send an MMIO command that includes the profile as a payload to the EC. The EC extracts the profile payload and saves it to an NVRAM variable before signaling a basic input/output system (BIOS) during early boot of an available accessibility profile. The EC publishes an accessibility profile presence to a BIOS pre-EFI initialization (PEI) layer, which sends a command to the EC to return the response. The BIOS creates a new hand off block (HOB) command indicative of the accessibility profile and passes this to an early Driver Execution Environment (DXE) stage, which reads the HOB data and locates the accessibility layer within a serial peripheral interface (SPI) firmware volume and loads into memory. This extracted profile information is passed onto the accessibility layer, which applies the profile data to user interface (UI) control attributes.

Systems and methods providing seamless accessibility across pre-boot and runtime environments

An information handling system includes a storage and an embedded controller. The storage stores context data associated with a standby mode for the information handling system. The embedded controller receives the context data from a host operating system of the information handling system. The context data includes data associated with a software deepest runtime identification platform state. The embedded controller further stores the context data in the storage. In response to a restart of the information handling system, the embedded controller determines a device driver that prevented the information handling system from exiting the standby mode based on the context data, and provides an identifier of the device driver a software service of the host operating system.

Embedded controller to enhance diagnosis and remediation of power state change failures

An information handling system scans an extensible firmware interface system partition for a file path. If the file path is missing, the system determines information associated with the file path, and adds an entry in an extensible firmware interface system resource table based on the information associated with the file path.

Presenting boot partition as device firmware

An information handling system may include a processor and a management controller electrically coupled to the processor and configured to provide out-of-band management facilities for management of the information handling system, the management controller further configured to in response to one or more heartbeat synchronization signals received from a software service of the information handling system, wherein each of the one or more heartbeat synchronization signals is associated with an item of software stored on the information handling system, determine if any critical software is missing from the information handling system, and for each item of missing critical software, cause a service operating system of the information handling system to stage installation of a restore image of such item.

Systems and methods for restoring critical software using management controller

Systems and methods are provided to perform BIOS recovery for a first information handling system that is in a no-boot state, i.e., in which the original equipment manufacturer (OEM) boot block (OBB) on the first information handling system is corrupted or damaged and thus does not properly execute. OBB BIOS recovery may be achieved using logic executing on a second and different information handling system that is wirelessly communicating with initial boot block (IBB) BIOS firmware that is executing on the first information handling system. The logic executing on the second information handling system may select and download (e.g., from a remote server) a correct uncorrupted and undamaged copy of the BIOS recovery firmware version for the first information handling system, and then wirelessly transfer the downloaded new copy of the OBB BIOS firmware version to the first information handling system via an established secure wireless connection.

Systems and methods for over the air (OTA) recovery of basic input/output system (BIOS) firmware

A virtual BIOS engine may be configured to, during runtime of an operating system, in response to an operating system event for updating firmware, load onto an isolated compute domain of the processor to emulate firmware update processes of a non-transitory computer-readable media with a virtual non-transitory computer-readable media and emulate the firmware update processes of the cryptoprocessor with a virtual cryptoprocessor, extract a firmware payload to the virtual non-transitory computer-readable media, and execute a virtual trust chain to measure the firmware payload in the virtual non-transitory computer-readable media.

Pre-authorized virtualization engine for dynamic firmware measurement

SPI firmware updates can be performed at runtime. A secure SPI flash access domain can be created during pre-boot and used at runtime to deliver and write a SPI firmware update to SPI flash. The secure SPI flash access domain can ensure that only a trusted component running on a trusted CPU core can access a SPI memory layout used to deploy the SPI firmware update to the SPI flash. Once the SPI firmware update is written to the SPI flash, a reboot can be triggered so that the updated SPI firmware is loaded to perform the boot process.

Enabling SPI firmware updates at runtime

A method for deploying an information handling system (platform) determines whether a hardware key coupled to the platform constitutes a deployment key by validating a GUID of the key against a deployment key signature, generated by a trusted server and stored on the key. If the key is validated, a trust factor evaluation is performed by validating the deployment key against a second key, which is bound to a nonvolatile storage component containing a second key signature, generated by the trusted server based on a GUID of the nonvolatile storage component. Upon validating the trust factor, the platform boots into an unattended deployment mode loaded from the deployment key and validates an unattended deployment binary stored in the deployment key against the second key signature to establish a trusted execution session for loading unattended deployment modules from the deployment key and deploying the platform by executing the unattended deployment modules.

Unattended deployment of information handling systems

Systems and methods are provided for supporting use of system BIOS components (e.g., such as BIOS debug messages, debugger firmware, UEFI drivers, etc.) that are stored separately from the remainder of system BIOS firmware for an information handling system. The system BIOS components may represent only a portion of the total BIOS firmware, and may be selectively retrieved and loaded from the separate storage into system memory when needed by the system BIOS for operating purposes (e.g., such as debugging operations).

Systems and methods for separate storage and use of system BIOS components

An information handling system stores a hash values for firmware components for the information handling system. A processor receives an off-host image verification request from a second information handling system. In response to the off-host image verification request, the processor reads first metadata for a next firmware component, provides the first metadata to the second information handling system, and receives a golden hash value from the second information handling system. In response to the first hash value not matching the golden hash value, the processor applies a mitigation policy. In response to the first hash value matching the golden hash value, the processor provides a device verification signal.

System and method for firmware image integrity verification

An information handling system may include at least one processor, a memory coupled to the at least one processor, and an information handling resource including a firmware. The information handling system may be configured to: boot into an operating system stored on the memory; after booting into the operating system, receive, from at least one remote server, information regarding a vulnerability associated with the firmware; based on a security policy, determine a resolution for mitigation of the vulnerability; and store information regarding the resolution in a storage location accessible to a preboot environment of the information handling system, wherein the preboot environment is configured to apply the resolution upon a subsequent boot of the information handling system.

Bios method to block compromised preboot features

An information handling system may include a processor, an external port communicatively coupled to the processor and configured to receive an external information handling resource and couple the external information handling resource to the processor, and a basic input/output system comprising a program of instructions executable by the processor. The program of instructions may be configured to cause the processor to: (i) determine if the external information handling resource coupled via the external port has a signed payload manifest stored thereon, the signed payload manifest comprising information regarding files of a bootable payload stored on the external information handling resource; (ii) if the external information handling resource has a signed payload manifest stored thereon, attempt to authenticate the signed payload manifest; (iii) if the signed payload manifest is authenticated, attempt to verify the files of the bootable payload based on the information with the signed payload manifest regarding files of the bootable payload; (iv) if the files of the bootable payload are verified, attempt to verify a bootable image of the bootable payload; and (v) if the bootable image is verified, cause the information handling system to boot from the bootable payload.

Systems and methods for automatic boot to authenticated external device

An information handling system may include a processor and a basic input/output system communicatively coupled to the processor and comprising a plurality of firmware volumes embodied in non-transitory computer readable media, each firmware volume comprising executable code for a respective functionality of the basic input/output system, wherein the basic input/output system is configured to, based on the presence or absence of an action or event associated with the basic input/output system, select a boot path for execution from a plurality of boot paths, each of the plurality of boot paths comprising a respective trust chain of a subset of the plurality of firmware volumes and execute the boot path selected.

Systems and methods for minimizing boot time and minimizing unauthorized access and attack surface in basic input/output system

Growing community of inventors

Round Rock, TX, United States of America

Anand Prakash Joshi