Dell Products Inc.

Dell Procucts L.p.

Karunakar Poosapalli

Shekar Babu Suryanarayana

Sumanth Vidyadhara

Ibrahim Sayyed

Adolfo Sandor Montero

James L Walker

Gowtham Moorthy

Piyush Dhamdhere

Bibby Yeh

Tsung-Lin Chuang

Thirupathi Komatireddy

Alankritha T V

Mohammad Younas Khan Pathan

Te-Lung Lin

Naresh Dhiman

Harish Barigi

Annappa Kumar M N

Hung V Ho

Shivani Dwivedi

Chia-Hao Chang

Systems and methods for security for a split-boot architecture are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include: a printed circuit board; a processor coupled to the printed circuit board; and a memory coupled to the processor, wherein the memory comprises program instructions stored thereon that, upon execution by the processor, cause the IHS to: obtain one or more cryptographic keys associated with firmware onboard the printed circuit board; and verify extended firmware using the cryptographic keys.

Security for a split boot architecture

Systems and methods for telemetry driven platform restoration for a split-boot architecture are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) comprises a printed circuit board (PCB); a processor coupled to the PCB; and a memory coupled to the processor, wherein the memory comprises program instructions stored thereon that cause the IHS to: obtain, in a split boot architecture, telemetry data from firmware onboard the PCB, and from extended firmware; and detect one or more boot failure events using the obtained telemetry data. In another embodiment, a method comprises obtaining first telemetry data associated with a first firmware executed, during a boot process, by a first hardware component of an IHS; obtaining second telemetry data associated with a second firmware executed, during the boot process, by a same or different hardware component; and detecting a boot failure event using the first and second telemetry data.

Telemetry driven platform restoration for a split boot architecture

An information handling system includes first and second storages, a basic input/output system (BIOS), and an embedded controller. The first storage stores telemetry data associated with the information handling system. The second storage includes a boot partition. The BIOS stores the telemetry data in the first storage. The embedded controller receives the telemetry data stored in the first storage from the BIOS. The embedded controller provides the telemetry data to the boot partition of the second storage over an out-of-band communication channel.

Embedded controller to save system telemetry data during system failures

In an information handling system that includes one or more PCIe devices, responsive to enumerating a PCIe device and adding the PCIe device to a configuration space of the platform, a mapping entry is added to a device handler mapping table to associate a device handler for the PCIe device with information for accessing the PCIe device. If the PCIe device fails to enumerate in a boot path, a virtual pseudo PCIe (VPP) node corresponding to the PCIe device may be created and enumerated to enable the boot to complete. Upon subsequently detecting and enumerating the actual, physical PCIe device, the VPP node and the PCIe device may be connected to enable the full functionality of the PCIe device without re-booting the platform.

Virtual pseudo PCIe (VVP) device nodes for fast reliable OS and virtual memory (VM) boot

An information handling system includes a hardware processor, a memory device operatively coupled to a serial peripheral interface (SPI) chip and the hardware processor. The SPI chip interfaces the hardware processor executing plural stages of boot modules during a boot process of the information handling system with allocated, reserved portions of the memory device for each stage of boot module executed in pre-boot, boot, and runtime via a virtual memory interface generated by execution of an original equipment manufacturer (OEM)-defined agnostic memory allocation module. The hardware processor executes the OEM defined agnostic memory allocation firmware to redefine the virtual memory interface for each allocated reserved portion of the memory device at each of the plural stages of the boot modules that are executed from pre-boot, through boot, and to runtime to provide adjustments to allocated, reserved portions of memory for later stages of executed plural stages of the boot modules.

Method and apparatus for an original equipment manufacturer defined scalable and safe memory layout firmware

An information handling system includes a memory and a processor. The memory stores a current basic input/output system (BIOS) firmware image. During a regular boot mode of the information handling, the processor creates a first set of tables associated with the current BIOS firmware image, stores the first tables to the memory, and receives a BIOS firmware update image. During a BIOS update boot mode of the information handling system, the processor creates a second plurality of tables associated with the BIOS firmware update image, and compares the first and second tables. In response to a difference being determined between the first and second tables, the processor aborts the BIOS update boot mode and generate an error log.

Information handling system with a dynamic basic input/output system configuration map

An information handling system may determine an allocated space in an option read-only memory (ROM), and store a firmware module in the allocated space in the option ROM. The system may load basic input/output system firmware from a serial peripheral interface flash memory with the firmware module from the allocated space in the option ROM.

Option read-only memory firmware-based remediation

An information handling system may include a processor and a basic input/output system communicatively coupled to the processor and comprising a program of executable instructions configured to determine a context associated with a current boot session of the information handling system and based on user boot history stored during one or more previous boot sessions of the information handling system and the context, load one or more network drivers necessary to boot the information handling system in accordance with the context.

Context-aware thin-network stack to provide rich network features in split boot architecture

An information handling system may include a processor and first non-transitory computer-readable media communicatively coupled to the processor and having stored thereon a basic input/output system (BIOS) core comprising BIOS core firmware sufficient to execute features of a BIOS of the information handling system to a particular portion of BIOS execution and an extension agent configured to identify and enumerate a firmware volume of a second non-transitory computer-readable media communicatively coupled to the processor and having stored thereon a BIOS extension comprising BIOS extension firmware for executing completion of BIOS execution from the particular portion of BIOS execution.

System on a chip-agnostic dynamic firmware volumes for basic input/output extension

A disclosed method installs an I/O trap protocol to provide an authentication callback function for handling I/O trap events. I/O trap events may include write operations accessing any of one or more identified I/O addresses. An I/O trap event may be registered with the authentication callback function for each of one or more identified I/O addresses. Original values of data may be stored in a memory resource. Any occurrences of an I/O trap event triggers the authentication callback function to perform I/O trap operations. The I/O trap operations may include determining whether the I/O trap event is associated with an approved driver and, if not, restoring data stored at the identified I/O address to an original value. Installing the I/O trap protocol may include installing the I/O trap protocol during a system management mode (SMM) phase of a UEFI boot sequence.

Secured communication protocol layer for authenticated hardware data access

Systems and methods for providing a storage extension system and method for secure and seamless access by various boot architectures are described. In some embodiments, an Information Handling System (IHS) may include a processor and a BIOS coupled to the processor, the BIOS having program instructions that, upon execution, cause the IHS to receive a request to access a bios storage region of the IHS from a driver, determine whether the device associated with the driver is a platform boot device such that when the boot device is a platform boot device, facilitate access to a native bios storage region of the bios storage region by the driver, and when the boot device is not a platform boot device, facilitate access to an extended bios storage region of the bios storage region by the driver.

BIOS NVRAM storage extension system and method for secure and seamless access for various boot architectures

An information handling system determines a difference between a first set of initialization information and a second set of initialization information during a pre-extensible firmware interface initialization phase of a boot process that is based on a first basic input/output system (BIOS), wherein the first set of initialization information is associated with the first BIOS and the second set of initialization information is associated with a second BIOS. The system also creates and publishes a hand-off block that includes an entry which describes the difference between the first set of initialization information and the second set of initialization information. The system parses the hand-off block during a driver execution environment phase to determine the difference between the first set of initialization information and the second set of initialization information, wherein the hand-off block is passed from the pre-extensible firmware interface initialization phase of the boot process. The system then updates the first set of initialization information based on the difference during the driver execution environment phase before continuing the boot process with the second BIOS using updated initialization information.

Dynamic operation code based agnostic analysis of initialization information

An information handling system may include a processor and first non-transitory computer-readable media communicatively coupled to the processor and having stored thereon a basic input/output system (BIOS) core comprising BIOS core firmware sufficient to execute features of a BIOS of the information handling system to a particular portion of BIOS execution and an extension agent. The extension agent may be configured to identify and enumerate a firmware volume of a second non-transitory computer-readable media communicatively coupled to the processor and having stored thereon a BIOS extension comprising BIOS extension firmware for executing completion of BIOS execution from the particular portion of BIOS execution and in response to unavailability of the firmware volume of the second non-transitory computer-readable media, failover to and recover the BIOS extension from extended firmware information stored on a networked storage resource communicatively coupled to the information handling system.

Storage failover protocol for secure and seamless extended firmware load

An information handling system may detect an exception, create a hand-off block in an NVMe boot partition in an NVMe device during a pre-extensible firmware interface phase of a boot process, and update the hand-off block with information associated with the exception. The system may also load an exception table to the NVMe boot partition, wherein the exception table includes an index associated with the exception that is mapped to a vector associated with an exception handler, and load the exception handler to the NVMe boot partition, wherein the exception handler resolves the exception.

Fault tolerance and debug analysis during a boot process

A system for controlling a processor, comprising a processor configured to load one or more instructions into a register for execution, a non-volatile memory coupled to the processor and configured to store data in a format that can be read by the processor and a description file stored in the non-volatile memory, the description file further comprising a plurality of information files, wherein each information file includes two or more types of predetermined data.

Growing community of inventors

Telangana, India

Karunakar Poosapalli