Granted Patent B2

US 12,566,670 · App. 18/086,937 · Granted Mar 3, 2026

Inventors: Anurag Bhatia (Sugar Hill, GA); Winston Thangapandian (Suwanee, GA); Valantina Arumugam (Chennai, IN); Sathiyaseelan Lakshminarayanan (Thiruvarur, IN)

Assignee: AMERICAN MEGATRENDS INTERNATIONAL, LLC

G06F11/1417G06F9/4406

Abstract

Claims (74)

1 . A method of operating a baseboard management controller (BMC), comprising:

validating, by a processing unit of the BMC, a first boot program from an active firmware image by loading at least a portion of the first boot program from the active firmware image into a static random access memory (SRAM) of the BMC;

decrypting the loaded portion of the first boot program from the active firmware image using a public key that is (i) stored in a one-time programmable memory (OTP) integrated within the processing unit of the BMC, and (ii) retrieved by the processing unit from the OTP;

calculating a first hash for the decrypted portion of the first boot program, extracting a second hash stored in the decrypted portion of the first boot program, and comparing the first hash and the second hash to determine if the first boot program from the active firmware image is valid;

in response to determining that the first boot program of the active firmware image is not validated:

(i) validating, by the processing unit of the BMC, a first boot program from a recovery firmware image by loading at least a portion of the first boot program from the recovery firmware image into the SRAM of the BMC;

(ii) decrypting at least a portion of the first boot program from the recovery firmware image using the public key;

(iii) calculating a third hash for the decrypted portion of the first boot program from the recovery firmware image, extracting a fourth hash stored in the decrypted portion of the first boot program from the recovery firmware image, and comparing the third hash and the fourth hash; and

(iv) executing the first boot program from the recovery firmware image, in response to determining the first boot program from the recovery firmware image is validated.

2 . The method of claim 1 , further comprising:

when the first boot program is being executed, loading, by the first boot program, a second boot program from the active firmware image; and

executing the second boot program to boot firmware of the BMC.

3 . The method of claim 2 , further comprising:

determining, based on a first timer at the BMC, that the firmware of the BMC is not booted within a first time period; and

subsequently, starting another booting process at the BMC to load the recovery firmware image of the BMC.

4 . The method of claim 2 , further comprising:

after the firmware of the BMC is booted, validating, at the BMC and based on a hardware component, an active initialization component image of a host; and

when the active initialization component image is validated, directing the host to load the active initialization component image in order to boot an operating system (OS) of the host.

5 . The method of claim 4 , further comprising:

validating a recovery initialization component image based on the hardware component, when the active initialization component image is not validated; and

directing the host to load the recovery initialization component image in order to boot the OS of the host, when the recovery initialization component image is validated.

6 . The method of claim 4 , further comprising:

determining, based on a second hardware timer at the BMC, that the OS of the host is not booted within a second time period; and

subsequently, directing the host to start another booting process to load a recovery initialization component image of the host.

7 . An apparatus, the apparatus being a baseboard management controller (BMC), comprising:

a memory; and

at least one processor coupled to the memory and configured to:

validate, by a processing unit of the BMC, a first boot program from an active firmware image by loading at least a portion of the first boot program from the active firmware image into a static random access memory (SRAM) of the BMC;

decrypt the loaded portion of the first boot program from the active firmware image using a public key that is (i) stored in a one-time programmable memory (OTP) integrated within the processing unit of the BMC, and (ii) retrieved by the processing unit from the OTP;

calculate a first hash for the decrypted portion of the first boot program, extracting a second hash stored in the decrypted portion of the first boot program, and comparing the first hash and the second hash to determine if the first boot program from the active firmware image is valid;

in response to determining that the first boot program of the active firmware image is not validated:

(i) validate, by the processing unit of the BMC, a first boot program from a recovery firmware image by loading at least a portion of the first boot program from the recovery firmware image into the SRAM of the BMC;

(ii) decrypt at least a portion of the first boot program from the recovery firmware image using the public key; and

(iii) calculate a third hash for the decrypted portion of the first boot program from the recovery firmware image, extracting a fourth hash stored in the decrypted portion of the first boot program from the recovery firmware image, and comparing the third hash and the fourth hash; and

(iv) execute the first boot program from the recovery firmware image, in response to determining the first boot program from the recovery firmware image is validated.

8 . The apparatus of claim 7 , wherein the at least one processor is further configured to:

when the first boot program is being executed, load, by the first boot program, a second boot program from the active firmware image; and

execute the second boot program to boot firmware of the BMC.

9 . The apparatus of claim 8 , wherein the at least one processor is further configured to:

determine, based on a first timer at the BMC, that the firmware of the BMC is not booted within a first time period; and

subsequently, start another booting process at the BMC to load the recovery firmware image of the BMC.

10 . The apparatus of claim 8 , wherein the at least one processor is further configured to:

after the firmware of the BMC is booted, validate, at the BMC and based on a hardware component, an active initialization component image of a host; and

when the active initialization component image is validated, direct the host to load the active initialization component image in order to boot an operating system (OS) of the host.

11 . The apparatus of claim 10 , wherein the at least one processor is further configured to:

validate a recovery initialization component image based on the hardware component, when the active initialization component image is not validated; and

direct the host to load the recovery initialization component image in order to boot the OS of the host, when the recovery initialization component image is validated.

12 . The apparatus of claim 10 , wherein the at least one processor is further configured to:

determining, based on a second hardware timer at the BMC, that the OS of the host is not booted within a second time period; and

subsequently, direct the host to start another booting process to load a recovery initialization component image of the host.

13 . A non-transitory computer-readable medium storing computer executable code for operating a baseboard management controller (BMC), comprising code to:

validate, by a processing unit of the BMC, a first boot program from an active firmware image by loading at least a portion of the first boot program from the active firmware image into a static random access memory (SRAM) of the BMC;

decrypt the loaded portion of the first boot program from the active firmware image using a public key that is (i) stored in a one-time programmable memory (OTP) integrated within the processing unit of the BMC, and (ii) retrieved by the processing unit from the OTP;

calculate a first hash for the decrypted portion of the first boot program, extracting a second hash stored in the decrypted portion of the first boot program, and comparing the first hash and the second hash to determine if the first boot program from the active firmware image is valid;

in response to determining that the first boot program of the active firmware image is not validated:

(i) validate, by the processing unit of the BMC, a first boot program from a recovery firmware image by loading at least a portion of the first boot program from the recovery firmware image into the SRAM of the BMC;

(ii) decrypt at least a portion of the first boot program from the recovery firmware image using the public key;

(iii) calculate a third hash for the decrypted portion of the first boot program from the recovery firmware image, extracting a fourth hash stored in the decrypted portion of the first boot program from the recovery firmware image, and comparing the third hash and the fourth hash; and

(iv) execute the first boot program from the recovery firmware image, in response to determining the first boot program from the recovery firmware image is validated.

14 . The non-transitory computer-readable medium of claim 13 , wherein the code is further configured to:

when the first boot program is being executed, load, by the first boot program, a second boot program from the active firmware image; and

execute the second boot program to boot firmware of the BMC.

15 . The non-transitory computer-readable medium of claim 14 , wherein the code is further configured to:

determine, based on a first timer at the BMC, that the firmware of the BMC is not booted within a first time period; and

subsequently, start another booting process at the BMC to load the recovery firmware image of the BMC.

16 . The non-transitory computer-readable medium of claim 14 , wherein the code is further configured to:

after the firmware of the BMC is booted, validate, at the BMC and based on a hardware component, an active initialization component image of a host; and

when the active initialization component image is validated, direct the host to load the active initialization component image in order to boot an operating system (OS) of the host.

17 . The non-transitory computer-readable medium of claim 16 , wherein the code is further configured to:

validate a recovery initialization component image based on the hardware component, when the active initialization component image is not validated; and

direct the host to load the recovery initialization component image in order to boot the OS of the host, when the recovery initialization component image is validated.

18 . The non-transitory computer-readable medium of claim 16 , wherein the code is further configured to:

determining, based on a second hardware timer at the BMC, that the OS of the host is not booted within a second time period; and

subsequently, direct the host to start another booting process to load a recovery initialization component image of the host.

Assignments (4)

Continuity (1)

References Cited (15)