BIOS Protection Guidelines - Recommendations of the National Institute of Standards and Technology

BIOS PROTECTION GUIDELINES
Figure 1: Conventional BIOS Boot Process
1
Next, the system BIOS searches for other peripherals and microcontrollers, and executes any Option
ROMs on these components necessary to initialize them. Option ROMs execute very early in the boot
process and can add a variety of features to the boot process. For example, the Option ROM on a network
adapter could load the Preboot Execution Environment (PXE), which allows a computer to boot over the
network.
Next, the system BIOS scans the computer system for storage devices that have been identified as boot
devices. In a typical case, the BIOS attempts to boot from the first boot device it finds that has a valid
master boot record (MBR). The MBR points to a boot loader stored on the hard drive, which in turn
starts the process of loading the operating system.
During the boot process the system BIOS loads SMI handlers and initializes ACPI tables and code. SMI
handlers run in a special high-privilege mode on the CPU known as System Management Mode, a 32-bit
mode that is capable of bypassing many of the hardware security mechanisms of protected mode, such as
memory segmentation and page protections.
1
This figure is based on information and a diagram found at [Duarte08].
2-3