The boot block is flashed only if the firmware flash is performed while the iLO Security Override
jumper is set (disabled). For maximum security, the flash should not be performed while the iLO
security jumper is set unless the specific intent is to update the boot block. It is not anticipated that the
boot block will require updating; however, this mechanism is provided in case an update should
become needed.
As shown in Figure 1, the management ROM can connect through a “back door” to the PCI bus on
the server. Under normal circumstances, the host server CPU executes the iLO option ROM. After the
host CPU locates iLO and transfers the option ROM code to the host memory, the iLO firmware closes
the connection to the host PCI bus. Therefore, under normal operating circumstances, there is no
chance for the server to flash the management ROM without permission. The host PCI connection
remains open only if the user brings up the iLO device in safe mode (by setting the iLO Security
Override jumper) or if the iLO firmware does not execute properly. This allows the host server to
directly flash the management ROM through the host PCI bus if the iLO ROM is corrupted.
Firewall logic
The iLO management processor includes a host firewall and bridge logic (Figure 1) that enables iLO
to control the flow of information between the host server and the management console. The firewall
logic protects against unauthorized access through the host system PCI bus and therefore shields
sensitive keys and data that are stored in memory and firmware.
Memory
The iLO management processor contains three classes of memory registers:
•
General registers, which the host server can access through the PCI bus. These PCI registers contain
only non-sensitive information. The iLO processor does not secure or try to hide these registers from
the host server.
•
Protected registers, in which the iLO device can lock the write access. These registers restrict
unwanted behavior, such as flashing rogue firmware, but they do not restrict information. These
registers are unlocked in safe mode. Once iLO locks these registers, the host server cannot regain
control through the PCI bus.
•
Secure registers, which secure sensitive information such as the configuration data and user
passwords. No host application on the PCI bus can write to these registers, regardless of the state
of the host server.
The host server can only read the areas of iLO memory that iLO exposes to the server. Applications on
the PCI bus can only access the memory that iLO permits, such as the general registers and the
protected registers under certain conditions. Applications running on the PCI bus cannot change the
configuration of any shared memory region.
NVRAM—non-volatile data storage
The host server and applications running on the system PCI bus can only read the exposed areas of
NVRAM: the integrated management log and host configuration information. There is also no chance
for an application on the PCI bus to change the iLO configuration by means of the exposed NVRAM.
Network and management ports
Because of the host firewall and bridge logic within iLO, there is no connection between the iLO
management port and the host server Ethernet port (Figure 1). Even when using the shared network
port (SNP), it is impossible for the iLO processor to bridge traffic between the two network interface
controllers (NICs) so that data flows from the management NIC to the host server NIC. An iLO device
7
