Securing the boot process

Abstract

The boot sequence for a machine typically starts with the BMC (baseboard management controller) or PCH (platform controller hub). In the case of an Intel CPU, the Intel Management Engine runs in the PCH and starts before the CPU. After configuring the machine's hardware, the BMC (or PCH, depending on the system) allows the CPU to come out of reset. The CPU then loads the boot firmware (or UEFI, unified extensible firmware interface) from the boot firmware SPI (Serial Peripheral Interface) flash. The boot firmware then accesses the boot sector on the machine's persistent storage and loads the bootloader into the system memory. It then passes execution control to the bootloader, which loads the initial operating system image from storage into system memory and passes execution control to the operating system. For example, in popular Linux distros, GRUB (Grand Unified Bootloader) acts as the bootloader and loads the operating system image for the machine.