Information handling systems and method to provide secure shared memory access at OS runtime
The present disclosure provides an information handling system (IHS) and related methods that provide secure shared memory access (SMA) to shared memory locations within a Peripheral Component Interconnect (PCI) device of an IHS. The IHS and methods disclosed herein provide secure SMA to one or more operating system (OS) applications that are granted access to the shared memory. According to one embodiment, the disclosed method provides secure SMA to one or more OS applications by receiving a secure runtime request from at least one OS application to access shared memory locations within a PCI device, authenticating the secure runtime request received from the OS application, creating a secure session for communicating with the OS application, and providing the OS application secure runtime access to the shared memory locations within the PCI device.
1. An information handling system (IHS), comprising:
a non-transitory computer readable storage medium storing an operating system (OS) and at least one OS application;
a baseboard management controller (BMC) comprising non-volatile memory configured to store BMC firmware, and a processor configured to execute the BMC Firmware during OS runtime to:
receive a secure runtime request from the at least one OS application to access shared memory locations within the non-volatile memory, wherein access to the shared memory locations is disabled prior to the received secure runtime request;
authenticate the secure runtime request received from the at least one OS application, wherein the received secure runtime request is authenticated upon receiving a secure runtime authenticated handshake;
create a secure session for communicating with the at least one OS application after the secure runtime request is authenticated; and
provide the at least one OS application secure runtime access to the shared memory locations within the non-volatile memory.
2. The information handling system as recited in claim 1 , further comprising a non-transitory computer readable memory storing boot firmware and Advanced Configuration and Power Interface (ACPI) firmware, wherein the boot firmware includes boot services and runtime services, and wherein the ACPI firmware includes ACPI runtime services and ACPI tables.
3. The information handling system as recited in claim 2 , further comprising a host processing device coupled to the non-transitory computer readable storage medium and to the non-transitory computer readable memory, wherein during a pre-boot phase of the boot firmware, the host processing device executes one or more boot services of the boot firmware to configure Peripheral Component Interconnect (PCI) configuration registers contained within the BMC and store configuration space information within an ACPI table of the ACPI firmware.
4. The information handling system as recited in claim 3 , wherein during the pre-boot phase of the boot firmware, the host processing device executes one or more additional boot services to disable the PCI configuration registers contained within the BMC to disable access to the shared memory locations.
5. The information handling system as recited in claim 3 , wherein during OS runtime, a first ACPI runtime service is executed by the host processing device to receive the secure runtime request from the at least one OS application and communicate the secure runtime request to the BMC.
6. The information handling system as recited in claim 3 , wherein during OS runtime, a second ACPI runtime service is executed by the host processing device to provide the secure runtime authenticated handshake to the BMC, and wherein the BMC firmware is executed by the processor to authenticate the secure runtime request upon receiving the secure runtime authenticated handshake.
7. The information handling system as recited in claim 3 , wherein during OS runtime, a third ACPI runtime service is executed by the host processing device to access the configuration space information stored within the ACPI table and use the configuration space information to locate a device path access service, which points to runtime services of the boot firmware.
8. The information handling system as recited in claim 7 , wherein during OS runtime, the third ACPI runtime service is further executed by the host processing device to call the runtime services of the boot firmware, wherein the runtime services include methods to open a shared memory access (SMA) channel to the shared memory locations and begin communication over the SMA channel.
9. The information handling system as recited in claim 8 , further comprising an SMA service table that includes entries for mapping the methods included within the runtime services of the boot firmware to a BMC access service, and wherein the BMC access service includes methods to directly call functions that are executable to access the shared memory locations within the non-volatile memory.
10. The information handling system as recited in claim 9 , wherein the first ACPI runtime service, the second ACPI runtime service, the third ACPI runtime service, the device path access service, the SMA service table and the BMC access service are constructed and stored within a boot table of the boot firmware during the pre-boot phase of the boot firmware.
11. A method to provide an operating system (OS) application, during OS runtime, with secure shared memory access (SMA) to shared memory locations within a Peripheral Component Interconnect (PCI) device, the method comprising, during the OS runtime:
receiving a secure runtime request from the OS application to access shared memory locations within a PCI device, wherein access to the shared memory locations is disabled prior to the step of receiving;
authenticating the secure runtime request received from the OS application, wherein the received secure runtime request is authenticated upon receiving a secure runtime authenticated handshake;
creating a secure session for communicating with the OS application after the secure runtime request is authenticated; and
providing the OS application secure runtime access to the shared memory locations within the PCI device.
12. The method as recited in claim 11 , wherein the step of receiving comprising receiving the secure runtime request from the OS application via a first Advanced Configuration and Power Interface (ACPI) runtime service.
13. The method as recited in claim 11 , wherein the step of authenticating comprises authenticating the secure runtime request upon receiving the secure runtime authenticated handshake from a second Advanced Configuration and Power Interface (ACPI) runtime service.
14. The method as recited in claim 11 , wherein prior to the step of receiving, the method comprises configuring PCI configuration registers of the PCI device and storing configuration space information within an Advanced Configuration and Power Interface (ACPI) table.
15. The method as recited in claim 14 , wherein prior to the step of receiving, the method comprises disabling the PCI configuration registers of the PCI device to disable access to the shared memory locations.
16. The method as recited in claim 14 , wherein the step of providing comprises accessing the configuration space information stored within the ACPI table and using the configuration space information to locate the shared memory locations within the non-volatile memory.
17. The method as recited in claim 14 , wherein the step of providing comprises executing a third ACPI runtime service to call boot firmware runtime services.
18. The method as recited in claim 17 , further comprising executing methods within the boot firmware runtime services to open an SMA channel to the shared memory locations and begin communication over the SMA channel.
19. The method as recited in claim 18 , further comprising mapping the methods within the boot firmware runtime services to an access service comprising methods to directly call functions, which are executable to access the shared memory locations.