SMM Global Driver Updates via Runtime Root-of-Trust Without Platform Resets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Updating System Management Mode (SMM) drivers in a fleet of server nodes requires a platform reset, leading to non-monetizable downtime and SLA breaches for Cloud Service Providers.
Innovation Solution
Implement a Root-of-Trust component (SmmRoT) in SMM to securely load and replace SMM drivers at runtime without platform resets, using a mechanism to unload existing drivers, load new ones, and restore the runtime context.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SMM drivers are updated using traditional methods, then driver updates can be performed, but platform reset is required causing downtime
Solution Approach 1:
The patent applies preliminary action by loading and validating the new SMM driver image into a reserved buffer in system memory before actually switching to it. The new driver is prepared in advance in the buffer, authenticated for security, and kept ready so that when the update is triggered, the switch can happen immediately without platform reset. This resolves the contradiction by performing the update preparation work beforehand, enabling seamless updates without downtime.
2Reliability
If platform reset is performed for SMM driver update, then driver can be updated, but Service Level Agreements cannot be maintained
Solution Approach 1:
The new SMM driver image is loaded and validated into a reserved buffer in advance, prepared ready for immediate activation. This preliminary preparation ensures that when an update is needed, the system can switch drivers instantly without platform reset, thereby maintaining SLA compliance while still achieving driver updates.
Solution Approach 2:
The patent introduces an intermediary mechanism - a reserved buffer in system memory and a driver switch mechanism that acts as a mediator between the old and new drivers. This intermediary allows the new driver to be loaded and validated without disrupting the running system, and enables a seamless transition that maintains productivity and SLA compliance.
3Loss of time
If SMM driver update is performed at runtime, then downtime is avoided, but security verification becomes complex
Solution Approach 1:
The patent segments the driver update process into distinct phases: loading the new driver image into a reserved buffer, authenticating/verifying its security, switching to the new driver, and handling rollback if needed. This segmentation allows runtime updates to proceed systematically with proper security verification at each step, managing complexity through structured process division while avoiding downtime.
Solution Approach 2:
The reserved buffer in system memory acts as an intermediary that holds the new driver image during validation and transition. This intermediary structure provides a secure sandbox for verifying the new driver without affecting the running system, simplifying the security verification process while enabling seamless runtime updates.
4Speed
If new SMM driver is loaded without verification, then update speed increases, but system security is compromised
Solution Approach 1:
The new driver image is authenticated and verified for security in advance, before it is activated. This preliminary security verification ensures that only trusted drivers can be loaded, maintaining system security. Because verification happens beforehand, the actual driver switch can proceed quickly without compromising security, resolving the contradiction between update speed and security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and apparatus for seamless SMM (System Management Mode) global driver update base on SMM Root-of-Trust. Mechanisms are provided to load and replace SMM drivers at runtime in a secure manner, without requiring an SMM firmware update and platform reset. SMM code is executed by BIOS during boot in a hidden area of memory called SMRAM space. Seamless update using an SMM Global Driver Update provides a method to load and replace all SMM drivers (including SMM infrastructure) on an already shipped platform production for purposes such as bug fixes. The principles and teachings may also be applied to update other types of secure execution mode code in addition to SMM code.