Secure option ROM firmware updates

1. An information handling system comprising:

a processor operable to execute instructions;

memory interfaced with the processor and operable to store the instructions;

a chipset operable to store and execute firmware;

a Basic Input or Output System (BIOS) stored in the chipset and operable to execute on the chipset;

an auxiliary subsystem separate from the chipset and interfaced with the BIOS, the auxiliary subsystem performing an auxiliary function with option Read Only Memory (ROM) firmware instructions stored on the auxiliary subsystem;

a write protect module stored on the auxiliary subsystem and selectively locking and unlocking a write protect of the option ROM firmware instructions; and

an option ROM updater stored in the chipset and interfaced with the BIOS, the option ROM updater detecting an option ROM update bit set at the BIOS and in response to detecting the option ROM update bit to unlocking the write protect and to load an option ROM update from a predetermined location to the auxiliary subsystem to write updated option ROM firmware instructions on the auxiliary subsystem;

wherein the option ROM updater is further operable to detect completion of the writing of the option ROM firmware instructions and in response to detecting completion to lock the write protect of the option ROM firmware instructions; and

wherein the predetermined location comprises a network location stored in the auxiliary subsystem and wherein the option ROM updater retrieves the network location from the auxiliary subsystem upon detection of the option ROM update bit.

2. The information handling system of claim 1 wherein the auxiliary subsystem comprises a graphics subsystem operable to process information into visual information for presenting images at a display.

3. The information handling system of claim 1 wherein the auxiliary subsystem comprises a storage controller operable to coordinate communication with one or more storage devices.

4. The information handling system of claim 1 wherein the predetermined location comprises a defined memory location in a hard disk drive incorporated in the information handling system.

5. The information handling system of claim 1 further comprising a systems management interface executing on the chipset and operable to accept user inputs through the BIOS to set one or more option ROM update bits.

6. The information handling system of claim 1 further comprising a security module operable to analyze the option ROM update for authenticity before loading the option ROM update to the auxiliary subsystem.

7. A method for updating an option Read Only Memory (ROM) of an information handling system, the method comprising:

setting an option ROM update bit in initialization firmware executing on a chipset;

executing the initialization firmware;

detecting the option ROM update bit with the initialization firmware;

in response to detecting, copying an option ROM update from a predetermined location to the initialization firmware, the predetermined location comprising a network location stored in the auxiliary subsystem, the option ROM update retrieved from the network location;

updating the option ROM at an option ROM device with the option ROM update, the option ROM device separate from the chipset; and

completing executing the initialization firmware to bring the information handling system to an operational state with the update installed on the option ROM.

8. The method of claim 7 further comprising authenticating the option ROM update before updating the option ROM.

9. The method of claim 8 wherein authenticating the option ROM update further comprises:

performing a hash of the option ROM with the initialization firmware; and

comparing the hash with a secure hash stored in the option ROM update.

10. The method of claim 7 wherein the initialization firmware comprises a BIOS and setting an option ROM update bit further comprises communicating the option ROM update bit to the BIOS through a secure system management interface.

11. The method of claim 7 wherein the predetermined location comprises a network location having an address, the address stored in the option ROM.

12. The method of claim 7 wherein the predetermined location comprises a predefined location in memory of the information handling system.

13. The method of claim 7 further comprising:

write protecting the option ROM;

in response to detecting, removing the write protect from the option ROM with the initialization firmware; and

in response to the updating the option ROM, re-establishing the write protect with the initialization firmware.

14. The method of claim 7 wherein the option ROM comprises a storage controller operable to establish communications with storage devices during initialization of the information handling system.

15. A system for updating an option Read Only Memory (ROM) that manages an information handling system auxiliary subsystem, the system comprising:

an auxiliary subsystem processor disposed in the auxiliary subsystem and operable to lock and unlock a write protect of an option ROM integrated in the auxiliary subsystem; and

an option ROM updater stored within initialization firmware to run on an initialization processor separate from the auxiliary subsystem processor, the option ROM updater interfaced with the auxiliary subsystem processor, the option ROM updater detecting an option ROM update bit set in initialization firmware instructions and in response to detecting the option ROM update bit unlocking the write protect and to load an option ROM update from a predetermined location to the auxiliary subsystem, the option ROM update having updated option ROM firmware instructions for execution on the auxiliary subsystem processor;

wherein the predetermined location comprises a network location stored in the auxiliary subsystem and wherein the option ROM updater retrieves the network location from the auxiliary subsystem upon detection of the option ROM update bit.

16. The system of claim 15 wherein the option ROM updater is further operable to lock the option ROM write protect upon completing the write of updated option ROM firmware instructions to the auxiliary subsystem.

17. The system of claim 16 wherein the predetermined location comprises a defined location in memory of the information handling system.