Hewlett-packard Development Company, L.p.

Compaq Computer Corporation, Inc.

Compaq Information Technologies Group, L.p.

Christopher H Stewart

Baraneedharan Anbazhagan

Darrell J Starnes

Svilen B Pronev

Valiuddin Y Ali

Lan Wang

Alex Xin Zhang

Terence Patrick Kelly

Nazih H Hage

Jeffrey Kevin Jeansonne

Richard A Bramley, Jr

Rosilet Retnamoni Braduke

Dallas M Barlow

Stanley Hyojun Park

Mason Andrew Gunyuzlu

Jeffrey R Gabler

Scott B Marcak

Jon P Styskal

Amgad M Elwahab

Steven C Giap

Rupali M Kothari

Sharad Singhal

Xiaoyun Zhu

Zhikui Wang

Xue Liu

Richard Bramley

Jennifer E Rios

Maugan Villatel

Guoxing Yang

Patrick L Gibbons

Jayne E Scott

Venkatesh Yarraguntla

Richard A Bramley Jr

An example apparatus may include a hardware component, a memory, and a processor. The processor may retrieve a firmware for the hardware component subsequent to the firmware being loaded on the hardware component. The processor may determine that a firmware signature associated with the firmware is stored in the memory. In some examples, in response to a determination that the firmware signature associated with the firmware is stored in the memory, the processor may initiate authentication of the firmware.

Authentication of hardware component firmware

According to examples, an apparatus may include a processor that may delete portions of firmware instructions responsive to an indication that the portions should be disabled. To facilitate the foregoing, the firmware instructions may be deployed in a segmented architecture stored in respective regions of a storage device. The regions may include a metadata region, a main region, and excludable regions. The metadata region may store metadata that describes the structure of the firmware instructions and/or the various other regions. The main region may store core firmware instructions that may not be deleted. Each excludable region may store respective excludable firmware instructions. Each excludable firmware instructions may be associated with a flag that indicates whether or not the instructions should be disabled. If so, the corresponding excludable region in the storage device is identified and the contents may be removed, permanently disabling the excludable firmware instructions that were stored there.

Deletion of firmware instructions

An example storage medium includes instructions that, when executed, cause a processor of a computing device to read, during start-up of the computing device, first configuration data from a first storage device of the computing device; read second configuration data from a second storage device of the computing device; determine that there is an inconsistency between the first configuration data and the second configuration data; check a tamper status of the computing device; based on the tamper status and the determination that there is an inconsistency between the first configuration data and the second configuration data: (i) clear a secure storage location of the computing device, the secure storage location storing data to access protected data; or (ii) replace the first configuration data on the first storage device of the computing device based on second data and continue the start-up of the computing device.

Configuration data deletion based on tamper status

A computer system includes an independent compute core; and an isolated secure data storage device to store data accessible only to the independent compute core. The independent compute core is to open an Application Program Interface (API) during runtime of the computer system in response to receiving a verified message containing secure data to be written to the secure data storage device.

Securely writing data to a secure data storage device during runtime

In some examples, a device includes a memory, a processor, and a controller separate from the processor to derive a security credential based on information comprising a key accessible by the controller. The controller communicates the derived security credential in a secure manner to a program code executable on the processor, and uses the derived security credential to protect data stored in the memory against unauthorized access.

Security credential derivation

The update progress of a basic input/output system (BIOS) is displayed on a display screen. A first chipset lock is applied to a first region of a shared serial peripheral interface (SPI) chip of the BIOS of a computer system containing a first program of instructions. A system management memory mode lock is applied to a second and a third region of the shared SPI chip containing a second and third programs of instructions respectively. The second program of instructions is updated, and control of the BIOS is transferred to the updated second program of instructions. The updated second program of instructions updates the first program of instructions. The BIOS update progress visual is displayed on the display screen of the computer system while updating the first program of instructions.

Displaying a BIOS update progress

In an example implementation according to aspects of the present disclosure, a method may include receiving by a controller a BIOS image, extracting a current manufacturing programming mode state corresponding to a computer system. A BIOS personality of the BIOS image is evaluated, wherein the BIOS personality is based on a differentiation of hardware and software functionality. Based on the current manufacturing programming state and the BIOS personality, a compatibility with the computer system is determined. Based on the compatibility, the BIOS image is written to non-volatile memory.

BIOS personalities

Examples associated with boot data validity are described. One example includes determining whether NVRAM boot data structure is valid. When the NVRAM boot data structure is valid, a NVRAM boot data structure validity flag is set to indicate the boot data structure is invalid. The validity flag is set to indicate the NVRAM boot data structure is valid once a point in a startup process is reached that indicates the startup process will complete successfully. When the NVRAM boot data structure is invalid, errors identified in the NVRAM boot data structure are repaired, and the startup process is restarted.

Boot data validity

Examples herein disclose a command to control a use of a test key for installation of a test basic input output system (BIOS). The examples validate a command and replace at least a portion of a production BIOS with the test BIOS based on an allowance of the test key.

Allowing use of a test key for a BIOS installation

A build indicator is set in a build environment to a set value for building a program code, the set value selected from a first value indicating that a feature of the program code is enabled, and a second value indicating that the feature is disabled. In response to the set value of the build indicator being the first value, a variable is set to a value indicating that the feature is enabled. The program code is built using the value of the variable.

Setting a build indicator to enable or disable a feature

A second physical-address-dependent code is generated from a first physical-address-dependent code using differential data, where the generating comprises converting a first physical address in a region of the first physical-address-dependent code to a second, different physical address for inclusion in a corresponding region of the second physical-address-dependent code.

Generating a second code from a first code

According to one example for verifying firmware module execution privilege, a firmware is booted on a processor. At least one firmware module in the firmware marked as a test module is identified, and verification with a production public key of metadata associated with the firmware is attempted. In an example, in the event that the metadata verifies successfully with the production public key, the firmware boot is halted when the processor determines that access to a video interface is available, and a user is alerted that a test module has attempted execution in a production firmware.

Firmware module execution privilege

It is determined whether an updated first boot phase code is present. The updated first boot phase code is validated. In response to the validating, a current version of the first boot phase code is updated using the updated first boot phase code.

Updating boot code

Example embodiments disclosed herein relate to distributing information. A set of information about components of a computing device is retrieved from a low-level system of the computing device. Programs are determined to be sent data based on the set of information.

Growing community of inventors

Houston, TX, United States of America

Christopher H Stewart