Systems and methods for minimizing boot time and minimizing unauthorized access and attack surface in basic input/output system
An information handling system may include a processor and a basic input/output system communicatively coupled to the processor and comprising a plurality of firmware volumes embodied in non-transitory computer readable media, each firmware volume comprising executable code for a respective functionality of the basic input/output system, wherein the basic input/output system is configured to, based on the presence or absence of an action or event associated with the basic input/output system, select a boot path for execution from a plurality of boot paths, each of the plurality of boot paths comprising a respective trust chain of a subset of the plurality of firmware volumes and execute the boot path selected.
1. An information handling system comprising:
a processor; and
a basic input/output system communicatively coupled to the processor and comprising a plurality of firmware volumes embodied in non-transitory computer readable media, each firmware volume comprising executable code for a respective functionality of the basic input/output system, wherein the basic input/output system is configured to, based on the presence or absence of an action or event associated with the basic input/output system:
select a boot path for execution from a plurality of boot paths, each of the plurality of boot paths comprising a respective trust chain for a subset of the plurality of firmware volumes wherein each firmware volume prior to a last firmware volume in each subset of the plurality of firmware volumes includes a hash value for verifying a next firmware volume in the respective trust chain; and
execute the boot path selected.
2. The information handling system of claim 1 , wherein the plurality of boot paths comprises an accelerated boot path for booting to an operating system of the information handling system.
3. The information handling system of claim 2 , wherein the accelerated boot path excludes firmware volumes of the plurality of firmware volumes for performing configuration of the basic input/output system.
4. The information handling system of claim 2 , wherein the accelerated boot path excludes firmware volumes of the plurality of firmware volumes for performing diagnostics of the information handling system.
5. The information handling system of claim 1 , wherein the plurality of boot paths comprises an exception boot path for performing configuration of the basic input/output system.
6. The information handling system of claim 1 , wherein the plurality of boot paths comprises an exception boot path for performing diagnostics of the information handling system.
7. The information handling system of claim 1 , wherein the plurality of firmware volumes comprises a base firmware volume configured to, based on the presence or absence of the action or event associated with the basic input/output system, select another firmware volume for execution from a plurality of other firmware volumes and wherein each of the plurality of boot paths includes the base volume within its subset of firmware volumes.
8. A method comprising, in a basic input/output system communicatively coupled to a processor and comprising a plurality of firmware volumes embodied in non-transitory computer readable media, each firmware volume comprising executable code for a respective functionality of the basic input/output system, wherein the basic input/output system is configured to, based on the presence or absence of an action or event associated with the basic input/output system:
selecting a boot path for execution from a plurality of boot paths, each of the plurality of boot paths comprising a respective trust chain of a subset of the plurality of firmware volumes wherein each firmware volume prior to a last firmware volume in each subset of the plurality of firmware volumes includes a hash value for verifying a next firmware volume in the respective trust chain; and
executing the boot path selected.
9. The method of claim 8 , wherein the plurality of boot paths comprises an accelerated boot path for booting to an operating system of an information handling system.
10. The method of claim 9 , wherein the accelerated boot path excludes firmware volumes of the plurality of firmware volumes for performing configuration of the basic input/output system.
11. The method of claim 9 , wherein the accelerated boot path excludes firmware volumes of the plurality of firmware volumes for performing diagnostics of the information handling system.
12. The method of claim 8 , wherein the plurality of boot paths comprises an exception boot path for performing configuration of the basic input/output system.
13. The method of claim 8 , wherein the plurality of boot paths comprises an exception boot path for performing diagnostics of the information handling system.
14. The method of claim 8 , wherein the plurality of firmware volumes comprises a base firmware volume configured to, and the method further comprises, based on the presence or absence of the action or event associated with the basic input/output system, selecting, by the base firmware volume, another firmware volume for execution from a plurality of other firmware volumes and wherein each of the plurality of boot paths includes the base volume within its subset of firmware volumes.
15. An article of manufacture comprising:
a non-transitory computer readable medium; and
computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to, in a basic input/output system communicatively coupled to the processor and comprising a plurality of firmware volumes embodied in non-transitory computer readable media, each firmware volume comprising executable code for a respective functionality of the basic input/output system, wherein the basic input/output system is configured to, based on the presence or absence of an action or event associated with the basic input/output system:
select a boot path for execution from a plurality of boot paths, each of the plurality of boot paths comprising a respective trust chain of a subset of the plurality of firmware volumes wherein each firmware volume prior to a last firmware volume in each subset of the plurality of firmware volumes includes a hash value for verifying a next firmware volume in the respective trust chain; and
execute the boot path selected.
16. The article of claim 15 , wherein the plurality of boot paths comprises an accelerated boot path for booting to an operating system of an information handling system.
17. The article of claim 16 , wherein the accelerated boot path excludes firmware volumes of the plurality of firmware volumes for performing configuration of the basic input/output system.
18. The article of claim 16 , wherein the accelerated boot path excludes firmware volumes of the plurality of firmware volumes for performing diagnostics of the information handling system.
19. The article of claim 15 , wherein the plurality of boot paths comprises an exception boot path for performing configuration of the basic input/output system.
20. The article of claim 15 , wherein the plurality of boot paths comprises an exception boot path for performing diagnostics of the information handling system.
21. The article of claim 15 , wherein the plurality of firmware volumes comprises a base firmware volume configured to, and the instructions further cause the processor to, based on the presence or absence of the action or event associated with the basic input/output system, select, by the base firmware volume, another firmware volume for execution from a plurality of other firmware volumes and wherein each of the plurality of boot paths includes the base volume within its subset of firmware volumes.