ROM Firmware Patching Hardware for First-Boot Instruction Redirection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for patching read-only memory (ROM) firmware are limited in their ability to efficiently update or replace instructions, often leaving certain areas un-patchable and affecting the entire boot sequence, especially when defects or vulnerabilities arise.
Innovation Solution
A computing system is configured to store patch metadata and code in one-time-programmable (OTP) memory, which programs patch hardware before reset, copies the patch code into RAM, and identifies bad instructions in ROM, redirecting access attempts to the patch code in RAM to effectively patch the ROM firmware from the first instruction onwards, allowing complex patches without limitations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing methods are used to patch ROM firmware, then some patching capability is provided, but certain areas remain un-patchable and the entire boot sequence is affected
Solution Approach 1:
The patent applies preliminary action by copying patch code from OTP memory to RAM memory before the processor is released from reset. This ensures that patch code is prepared in advance and available immediately when needed, enabling complete patch coverage from the first instruction of the boot sequence without affecting subsequent operations.
Solution Approach 2:
The patent uses RAM memory as an intermediary between OTP memory and ROM. The patch code is stored in OTP memory (which cannot be modified after manufacturing), copied to RAM memory (which can be freely accessed and modified), and then used to patch ROM firmware during execution. This intermediary approach enables flexible patching while maintaining the integrity of the original ROM and OTP structures.
2Ease of manufacture
If patch code is copied after processor reset, then processor initialization is simpler, but patching cannot cover the initial boot instructions
Solution Approach 1:
The patent performs the critical action of copying patch code from OTP to RAM memory before the processor is released from reset. This preliminary action ensures that the patch code is ready in RAM before the processor starts executing instructions, enabling patch coverage from the very first instruction of the boot sequence while maintaining simple processor initialization logic.
3Productivity
If simple patch code is used, then patching is faster, but complex patches cannot be applied
Solution Approach 1:
The patent uses copying to transfer the complete patch code from OTP memory to RAM memory before execution. This allows the full complexity of the patch to be preserved in RAM, where it can be executed at high speed without the constraints of ROM's read-only nature or OTP's one-time programming limitation. The copying mechanism enables both speed and complexity requirements to be satisfied.
Data Source
AI summary
Various aspects of the present disclosure generally relates to a computing system. In some aspects, the computing system may store patch metadata and patch code in an OTP memory. The computing system may program, before a processor of the computing system is released from a reset, the patch metadata into a patch hardware. The computing system may copy, before the processor is released from the reset, the patch code from the OTP memory into a RAM. The computing system may identify, based on the patch metadata, an access attempt issued by the processor to a bad instruction in a ROM, wherein the bad instruction is associated with ROM firmware. The computing system may direct the access attempt to the patch code stored in the RAM, wherein the ROM firmware is patched based at least in part on the patch code. Numerous other aspects are described.