IP Library › Granted Patent US 12663981
Granted Patent B1
US 12663981 · App. 18/635,908 · Granted Jun 23, 2026

Secure non-volatile firmware memory configured within a baseboard management controller (BMC) system on a chip (SOC)

Inventors: Satheesh Thomas (Johns Creek, GA); David Wise (Loganville, GA); Balaji Nagalingam Rajendiran (Duluth, GA)
Assignee: AMERICAN MEGATRENDS INTERNATIONAL, LLC
G06F8/65
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12663981
App. No.
18/635,908
Granted
Jun 23, 2026
Kind
B1
Abstract

The technologies described herein provide a system having nonvolatile firmware memory that is configured on the same integrated circuit as a BMC SoC. This design provides the ability to store the system firmware within the SoC to minimize or eliminate the use of complex components or specialized silicon, while minimizing the number of attack points. The disclosed techniques also improve the performance of a system by eliminating the need for a system to perform a validation of contents stored on an external memory device for each boot. Further, the disclosed techniques can allow a storage device that is internal to the SoC to use a local bus of the SoC, and mitigate or eliminate the need for an SPI bus, which is much slower than the local bus of the BMC SoC.

Claims (42)

1 . A baseboard management controller (BMC) system on chip (SoC), comprising:

a BMC processor configured to execute a management functionality to provide support for a host computer; and

a non-volatile memory device configured within an integrated circuit containing the BMC SoC, the non-volatile memory device configured to store a firmware for the BMC SoC, the BMC SoC configured to:

store the firmware received from an external programmer into a first section of the non-volatile memory device;

perform an irreversible lock on the first section of the non-volatile memory device to prevent any changes or updates to the firmware stored on the first section of the non-volatile memory device, wherein the BMC SoC is configured to boot using the firmware stored on the first section of the non-volatile memory device until a firmware update is performed by the BMC SoC;

receive a new firmware providing updated operations executed by the BMC;

store the new firmware to a second section of the non-volatile memory device that is separate from the first section of the non-volatile memory device; and

responsive to storing the new firmware to the second section of the non-volatile memory device, set a flag to cause the BMC to validate the new firmware prior to a next boot of the BMC, wherein a successful validation of the new firmware causes the BMC to clear the flag to allow the BMC to boot using the new firmware without requiring the BMC to perform another validation process for the new firmware.

2 . The BMC SoC of claim 1 , wherein the first section of the non-volatile memory device includes a protected recovery firmware area that is configured to allow the firmware to be received from an external programmer until a locking mechanism applies an irreversible lock to the protected recovery firmware area, wherein the second section of the non-volatile memory device includes a boot firmware area that is configured to exclusively receive the new firmware by an update process performed by the BMC, and wherein the BMC is configured to only allow a boot using the new firmware upon performing a successful validation process of the new firmware using keys associated with the BMC SoC.

3 . The BMC SoC of claim 1 , wherein the BMC SoC is configured to communicate with a RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured to restrict communication with an external serial peripheral interface (SPI) memory device, and wherein the BMC SoC restricts storage of a boot image for the BMC SoC or other firmware for the BMC SoC to the non-volatile memory device.

4 . The BMC SoC of claim 1 , wherein the BMC SoC is configured to communicate with a RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured to communicate with an external serial peripheral interface (SPI) memory device, wherein the BMC SoC restricts storage of a boot image for the BMC SoC to the non-volatile memory device, wherein the BMC SoC restricts storage of any update containing boot functions to the non-volatile memory device, and wherein the BMC enables storage of configuration settings and non-boot firmware functions to the external SPI memory device.

5 . The BMC SoC of claim 1 , wherein the BMC SoC is configured to restrict communication with a RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured to restrict communication with an external serial peripheral interface (SPI) memory device, and wherein the BMC SoC restricts storage of a boot image for the BMC SoC or other firmware for the BMC SoC to the non-volatile memory device configured in a chip containing the BMC SoC.

6 . The BMC SoC of claim 1 , wherein the BMC SoC is configured to communicate with a RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured with a RAM module configured in a chip containing the BMC SoC, wherein the BMC SoC operates using the RAM module configured in the chip containing the BMC SoC and the RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured to restrict communication with an external serial peripheral interface (SPI) memory device, wherein the BMC SoC restricts storage of a boot image for the BMC SoC to the non-volatile memory device, and wherein the BMC SoC restricts storage of any update containing boot functions to the non-volatile memory device.

7 . The BMC SoC of claim 1 , wherein the BMC SoC is configured to communicate with a RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured with a RAM module configured in a chip containing the BMC SoC, wherein the BMC SoC operates using the RAM module configured in the chip containing the BMC SoC and the RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured to communicate with an external serial peripheral interface (SPI) memory device, wherein the BMC SoC restricts storage of a boot image for the BMC SoC to the non-volatile memory device, wherein the BMC SoC restricts storage of any update containing boot functions to the non-volatile memory device, and wherein the BMC enables storage of configuration settings and non-boot firmware functions to the external SPI memory device.

8 . A computer-implemented method, for execution on a baseboard management controller (BMC) system on chip (SoC), wherein the BMC SoC comprises a BMC processor configured to execute a management functionality to provide support for a host computer, the BMC SoC further comprising a non-volatile memory device configured within an integrated circuit containing the BMC SoC, and wherein the non-volatile memory device is configured to store a firmware for the BMC SoC, the computer-implemented method comprising:

storing the firmware received from an external programmer into a first section of the non-volatile memory device;

performing an irreversible lock on the first section of the non-volatile memory device to prevent any changes or updates to the firmware stored on the first section of the non-volatile memory device, wherein the BMC SoC is configured to boot using the firmware stored on the first section of the non-volatile memory device until a firmware update is performed by the BMC SoC;

receiving a new firmware for an update process that is performed by the BMC;

storing the new firmware to a second section of the non-volatile memory device that is separate from the first section of the non-volatile memory device; and

responsive to storing the new firmware to the second section of the non-volatile memory device, setting a flag to cause the BMC to validate the new firmware prior to a next boot of the BMC, wherein a successful validation of the new firmware causes the BMC to clear the flag to allow the BMC to perform a subsequent boot using the new firmware without requiring the BMC to perform another process for validating the new firmware.

9 . The computer-implemented method of claim 8 , wherein the first section of the non-volatile memory device includes a protected recovery firmware area that is configured to allow the firmware to be received from an external programmer until a locking mechanism applies an irreversible lock to the protected recovery firmware area, wherein the second section of the non-volatile memory device includes a boot firmware area that is configured to exclusively receive the new firmware by an update process performed by the BMC, and wherein the BMC is configured to only allow a boot using the new firmware upon performing a successful validation of the new firmware using keys associated with the BMC SoC.

10 . The computer-implemented method of claim 8 , wherein the BMC SoC is configured to communicate with a RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured to restrict communication with an external serial peripheral interface (SPI) memory device, and wherein the BMC SoC restricts storage of a boot image for the BMC SoC or other firmware for the BMC SoC to the non-volatile memory device.

11 . The computer-implemented method of claim 8 , wherein the BMC SoC is configured to communicate with a RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured to communicate with an external serial peripheral interface (SPI) memory device, wherein the BMC SoC restricts storage of a boot image for the BMC SoC to the non-volatile memory device, wherein the BMC SoC restricts storage of any update containing boot functions to the non-volatile memory device, and wherein the BMC enables storage of configuration settings and non-boot firmware functions to the external SPI memory device.

12 . The computer-implemented method of claim 8 , wherein the BMC SoC is configured to restrict communication with a RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured to restrict communication with an external serial peripheral interface (SPI) memory device, and wherein the BMC SoC restricts storage of a boot image for the BMC SoC or other firmware for the BMC SoC to the non-volatile memory device configured in a chip containing the BMC SoC.

13 . The computer-implemented method of claim 8 , wherein the BMC SoC is configured to communicate with a RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured with a RAM module configured in a chip containing the BMC SoC, wherein the BMC SoC operates using the RAM module configured in the chip containing the BMC SoC and the RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured to restrict communication with an external serial peripheral interface (SPI) memory device, wherein the BMC SoC restricts storage of a boot image for the BMC SoC to the non-volatile memory device, and wherein the BMC SoC restricts storage of any update containing boot functions to the non-volatile memory device.

14 . The computer-implemented method of claim 8 , wherein the BMC SoC is configured to communicate with a RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured with a RAM module configured in a chip containing the BMC SoC, wherein the BMC SoC operates using the RAM module configured in the chip containing the BMC SoC and the RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured to communicate with an external serial peripheral interface (SPI) memory device, wherein the BMC SoC restricts storage of a boot image for the BMC SoC to the non-volatile memory device, wherein the BMC SoC restricts storage of any update containing boot functions to the non-volatile memory device, and wherein the BMC enables storage of configuration settings and non-boot firmware functions to the external SPI memory device.

15 . A host computing system, comprising:

a host processor;

a host bus; and

a baseboard management controller (BMC) system on chip (SoC) that is in communication with the host bus, wherein the BMC SoC comprises:

a BMC processor configured to execute a management functionality to provide support for a host computer; and

a non-volatile memory device configured within an integrated circuit containing the BMC SoC, the non-volatile memory device configured to store a firmware for the BMC SoC, the BMC SoC configured to:

store the firmware received from an external programmer into a first section of the non-volatile memory device;

perform an irreversible lock on the first section of the non-volatile memory device to prevent any changes or updates to the firmware stored on the first section of the non-volatile memory device, wherein the BMC SoC is configured to boot using the firmware stored on the first section of the non-volatile memory device until a firmware update is performed by the BMC SoC;

receive a new firmware providing updated operations executed by the BMC;

store the new firmware to a second section of the non-volatile memory device that is separate from the first section of the non-volatile memory device; and

responsive to storing the new firmware to the second section of the non-volatile memory device, set a flag to cause the BMC to validate the new firmware prior to a next boot of the BMC, wherein a successful validation of the new firmware causes the BMC to clear the flag to allow the BMC to boot using the new firmware without requiring the BMC to perform another validation process for the new firmware.

16 . The host computing system of claim 15 , wherein the first section of the non-volatile memory device includes a protected recovery firmware area that is configured to allow the firmware to be received from an external programmer until a locking mechanism applies an irreversible lock to the protected recovery firmware area, wherein the second section of the non-volatile memory device includes a boot firmware area that is configured to exclusively receive the new firmware by an update process performed by the BMC, and wherein the BMC is configured to only allow a boot using the new firmware upon performing a successful validation process of the new firmware using keys associated with the BMC SoC.

17 . The host computing system of claim 15 , wherein the BMC SoC is configured to communicate with a RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured to restrict communication with an external serial peripheral interface (SPI) memory device, and wherein the BMC SoC restricts storage of a boot image for the BMC SoC or other firmware for the BMC SoC to the non-volatile memory device.

18 . The host computing system of claim 15 , wherein the BMC SoC is configured to communicate with a RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured to communicate with an external serial peripheral interface (SPI) memory device, wherein the BMC SoC restricts storage of a boot image for the BMC SoC to the non-volatile memory device, wherein the BMC SoC restricts storage of any update containing boot functions to the non-volatile memory device, and wherein the BMC enables storage of configuration settings and non-boot firmware functions to the external SPI memory device.

19 . The host computing system of claim 15 , wherein the BMC SoC is configured to restrict communication with a RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured to restrict communication with an external serial peripheral interface (SPI) memory device, and wherein the BMC SoC restricts storage of a boot image for the BMC SoC or other firmware for the BMC SoC to the non-volatile memory device configured in a chip containing the BMC SoC.

20 . The host computing system of claim 15 , wherein the BMC SoC is configured to communicate with a RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured with a RAM module configured in a chip containing the BMC SoC, wherein the BMC SoC operates using the RAM module configured in the chip containing the BMC SoC and the RAM memory device that is external to the BMC SoC, wherein the BMC SoC is configured to restrict communication with an external serial peripheral interface (SPI) memory device, wherein the BMC SoC restricts storage of a boot image for the BMC SoC to the non-volatile memory device, and wherein the BMC SoC restricts storage of any update containing boot functions to the non-volatile memory device.