Device for Deleting Firmware Instructions

Abstract

According to an example, a device may include a processor that may delete a portion of firmware instructions in response to an indication that the portion should be disabled. To facilitate the foregoing, the firmware instructions may be deployed in a segmented architecture stored in corresponding regions of a storage device. The regions may include a metadata region, a main region, and an excludable region. The metadata region may store metadata that describes the structure of the firmware instructions and / or various other regions. The main region may store core firmware instructions that cannot be deleted. Each excludable region may store corresponding excludable firmware instructions. Each excludable firmware instruction may be associated with a flag indicating whether the instruction should be disabled. If so, the corresponding excludable region in the storage device is identified and the content may be removed to permanently disable the excludable firmware instruction stored therein.

Description

Background Art

[0001] Firmware instructions may have enhanced features (such as a stolen device recovery feature) that are necessary for some users but may pose a security risk or increased attack surface for other users. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] The features of the present disclosure may be illustrated by way of example and are not limited to one or more of the following drawings, in which like numerals indicate like elements:

[0003] Figure 1A A block diagram showing an example device that deletes an excludable firmware instruction;

[0004] Figure 1B A block diagram showing an example device that deletes an excludable firmware instruction;

[0005] Figure 2A A block diagram showing an example storage device that includes different regions for storing metadata, core firmware instructions, and excludable instructions;

[0006] Figure 2B A block diagram showing an example storage device that includes a deleted excludable instruction;

[0007] Figure 3 A block diagram showing an example system that supplies firmware instructions, which include core firmware instructions and excludable firmware instructions;

[0008] Figure 4 A flowchart depicting an example method for updating firmware instructions in the presence of deleted excludable firmware instructions; and

[0009] Figure 5 A block diagram depicting an example non - transitory machine - readable storage medium for executing firmware instructions that include core firmware instructions and excludable firmware instructions. DETAILED DESCRIPTION

[0010] Firmware instructions (such as basic input / output system code, Unified Extensible Firmware Interface (UEFI), and / or other instructions) boot up or otherwise initialize a device for operation. Some firmware instructions may have enhanced features (such as a stolen device recovery feature) that are necessary for some users but may pose a security risk or increased attack surface for other users.

[0011] When these enhanced features are not needed, portions of the firmware instructions with these enhanced features may become unwanted or unnecessary instructions. Since firmware instructions may be configured as embedded instructions and may not be easily removable, unwanted or unnecessary instructions may pose security risks. Although multiple versions of the firmware instructions can be developed, one version with the portions of the firmware instructions having the (one or more) enhanced features and one version without such portions of the firmware instructions, this may be technically impractical and infeasible.

[0012] Devices and methods are disclosed herein for disabling unwanted or unnecessary firmware instructions with minimal or no impact on core firmware functionality or security by deleting the unwanted or unnecessary firmware instructions. For example, deleting unwanted or unnecessary firmware instructions may have minimal or no impact on core firmware functionality or security when the core firmware functionality can execute as if the unwanted or unnecessary firmware instructions were not deleted. Generally speaking, as described herein, "firmware instructions" can include instructions for the operation of a device on which the firmware instructions are installed. For example, firmware instructions can be used to interface with the hardware components of the device. Once installed, firmware instructions are typically not deleted or otherwise removed. Examples of firmware instructions include basic input / output system (BIOS) code, unified extensible firmware interface (UEFI), and / or other instructions for the operation of a device on which the instructions are installed. In these examples, the systems disclosed herein can be implemented for BIOS code, UEFI code, and / or other code that is used to boot a device using the excisable portions of the BIOS code, UEFI code, and / or other code. Firmware instructions can be stored on a storage device (also referred to herein as a "firmware storage device"). The firmware storage device can be a dedicated storage space for storing the firmware instructions of a device.

[0013] To facilitate the removal of unwanted or unnecessary firmware instructions, various examples disclosed herein can include a firmware architecture in which the firmware instructions are grouped into: core firmware instructions that cannot be removed (since the core firmware instructions can be used for the operation of a device on which the core firmware instructions are installed), and excisable firmware instructions that can be removed. The firmware storage device can be correspondingly divided into multiple regions to accommodate the firmware architecture. For example, the firmware storage device can include, among other things, a metadata region, a main region, and an excisable region.

[0014] The metadata area can store metadata in the firmware storage device that describes the firmware architecture and the layout of the firmware architecture. For example, the metadata can include pointers to the locations where the main areas in the firmware storage device exist, pointers to the locations where the excludable areas in the firmware storage device exist, and / or other information related to the firmware architecture. The pointers can include the offset and / or length of the areas of the firmware storage device. The metadata can further store user-defined flags or other indications that specify whether the excludable firmware instructions have been disabled. If the flag indicates that the excludable firmware instructions have been disabled, the excludable firmware instructions can be deleted from the excludable area where the excludable firmware instructions are stored. In addition, when updating the firmware instructions, if the flag indicates that the excludable firmware instructions have been disabled, the excludable firmware instructions cannot be updated, thereby preventing the code from being inadvertently re-imaged by the update. The metadata can further store a mapping between the excludable areas and the excludable firmware instructions stored in the excludable areas. In these examples, multiple excludable areas can be provided, and each excludable area stores the corresponding excludable firmware instructions. The mapping can identify the excludable area where the excludable firmware instruction is located.

[0015] The main area can store core firmware instructions. The content of the main area can be digitally signed and authenticated to prevent / detect tampering and verify the integrity of the core firmware instructions. The excludable area can correspond to excludable firmware instructions separated from the core firmware instructions. The content of the excludable area can be digitally signed, hashed, and / or otherwise subjected to security processing for authentication to prevent / detect tampering and verify the integrity of the content independently of the core firmware instructions. The excludable area can include multiple excludable areas, and each excludable area stores the corresponding excludable firmware instructions. The content of each excludable area can be cryptographically signed. In some examples, a hash can be generated and securely stored for the content of each excludable area. In some examples, each hash can be cryptographically signed. In the examples, the signature, hash, and / or other security information can be used for authentication to prevent and detect tampering with the content of each excludable area.

[0016] By digitally signing core firmware instructions and excludable firmware instructions independently of each other and storing the core firmware instructions and the excludable firmware instructions separately in different areas of a firmware storage device, the security of the core firmware instructions can be maintained while allowing a user to remove unwanted excludable firmware instructions. For example, since the core firmware instructions and the excludable firmware instructions are stored separately and digitally signed, the excludable firmware instructions can be removed without compromising the digital signature of the core firmware instructions. For example, this technical improvement facilitates compliance with security or compliance policies seeking to minimize the attack surface, including policies for firmware instructions that an organization may not want or need.

[0017] First refer to Figure 1A and 1B , each of which shows a block diagram of a respective example device 100 for deleting excludable firmware instructions. It should be understood that the example devices 100 depicted in Figure 1A and 1B may include additional features, and some of the features described herein may be removed and / or modified without departing from any scope of the example device 100.

[0018] Figure 1A and 1B The device 100 shown in may be a computing device, a server, etc. As shown in Figure 1A and 1B , the device 100 may include a processor 102 that may control the operation of the device 100. The processor 102 may also be referred to herein as a controller, and the device 100 may be referred to herein as an electronic device. The processor 102 may be a semiconductor-based microprocessor, a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), and / or other suitable hardware device. Although the device 100 has been depicted as including a single processor 102, it should be understood that the device 100 may include multiple processors, multiple cores, etc. without departing from the scope of the device 100 disclosed herein.

[0019] The device 100 may include a memory 110 on which machine-readable instructions (which may also be referred to as computer-readable instructions) 112 - 118 ( Figure 1A ) and / or 120 - 128 ( Figure 1B). The memory 110 can be an electronic, magnetic, optical, or other physical storage device that includes or stores executable instructions. The memory 110 can be, for example, a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), a storage device, an optical disc, etc. The memory 110 can be a non-transitory machine-readable storage medium, where the term "non-transitory" does not cover transitory propagated signals. The device 100 can include a storage device 104, which can be a firmware storage device for storing firmware instructions for the device 100. In some examples, the storage device 104 can include a serial peripheral interface ("SPI") chip, an embedded multimedia card ("eMMC") memory, a hard disk, a solid-state storage device, or other devices. The storage device 104 can include a metadata area 101 and an excludable area 103. Further examples of storage devices are illustrated in Figure 2A and 2B . Although illustrated separately, the memory 110 can include the storage device 104. Additionally, the instructions 112-118 and 120-128 can be part of or separate from the core firmware instructions disclosed herein. Now, attention will turn to the operation for deleting excludable firmware instructions at the processor 102.

[0020] Referring Figure 1A , the processor 102 can fetch, decode, and execute the instruction 112 to obtain metadata from the metadata area 101. In an example, the metadata can indicate the location of the excludable area 103 in the storage device 104.

[0021] The processor 102 can fetch, decode, and execute the instruction 114 to obtain an indication that the excludable firmware instructions stored in the excludable area 103 will be disabled. In an example, the indication can include a flag in the metadata that has been set to indicate that the excludable firmware instructions will be disabled. In these examples, the processor 102 can obtain the indication by reading the metadata to read the flag. The flag can include a binary (0 / 1; yes / no) setting and / or other values indicating that the excludable firmware instructions will be disabled. In some instances, the flag can be set in response to a request or other indication to disable the excludable firmware instructions. The flag can be stored in different locations. In an example, different flag storage locations provide different security levels. Thus, the flag storage location can be configured according to specific needs depending on the security requirements. This is because, as described herein, the flag can control whether data from the excludable area is deleted and in some examples whether it continues to be deleted.

[0022] In an example, the flag may be stored in a shared SPI, a private SPI, a one-time writable silicon (such as, a one-time password (OTP) storage device), and / or other storage locations. The shared SPI may not be as secure as the private SPI or the OTP because other system components can access the shared SPI electrically. Depending on the system configuration and requirements, the shared SPI may be used to store the flag. The private SPI may be electrically isolated from other system components. Thus, because of the electrical isolation of the private SPI, an external system or malware cannot easily change the state of the private SPI. The OTP may include permanent settings that cannot be changed. Although highly secure, the OTP device may be replaced if the device that employs the flag and the exclusion zone described herein is reprocessed for sale as a refurbished product. On the other hand, the flag stored in the shared SPI or the private SPI may be reconfigured after refurbishment.

[0023] The processor 102 may fetch, decode, and execute the instruction 116 to identify the exclusion zone 103 based on the metadata. For example, the metadata may include a mapping between the exclusion zone and the excluded firmware instructions. The exclusion zone may be identified based on the mapping. In some examples, the mapping may facilitate generating a directory of the excluded instructions that may be selected to be included in or removed from the firmware instructions. Thus, the processor 102 may provide a list of the excluded instructions for selectable inclusion or removal.

[0024] The processor 102 may fetch, decode, and execute the instruction 118 to remove the excluded firmware instructions from the exclusion zone 103. Thus, the excluded firmware instructions may be disabled by removing them from the exclusion zone 103. In an example, the metadata may include the offset and / or length of the exclusion zone. To remove the excluded firmware instructions, the processor 102 may obtain the offset and length of the exclusion zone from the metadata and remove the data corresponding to the offset and length from the storage device 104.

[0025] In an example, the storage device 104 may include a main area that stores core firmware instructions that cannot be removed (as will be described in more detail with respect to Figure 2A and 2B ). In these examples, the processor 102 may further receive an indication to update the core firmware instructions that are stored in the main area. For example, the core firmware instructions may receive an update pushed from a source to the device 100 or pulled by the device 100 from the source.

[0026] In any event, in response to the update, the processor 102 may determine that the flag is set to disable the excludable firmware instructions, and based on the determination that the flag is set to disable the excludable firmware instructions, update the core firmware instructions without updating the excludable firmware instructions. In this way, inadvertently rewriting an updated version of a deleted excludable firmware instruction can be avoided.

[0027] In an example, the processor 102 may implement measures capable of protecting the firmware instructions. For example, the firmware instructions may be digitally signed by the processor 102 or the source of the firmware instructions. Such a digital signature may include a cryptographic or other hashing technique that can uniquely identify the hashed data to detect tampering. Since the excludable firmware instructions can be deleted, separate digital signatures for the core firmware instructions and the excludable firmware instructions can be generated and verified separately. For example, a first digital signature for the core firmware instructions may be generated and used to verify the core firmware instructions separately from the excludable firmware instructions. Similarly, a second digital signature for the excludable firmware instructions may be generated and used to verify the excludable firmware instructions separately from the core firmware instructions.

[0028] In an example, the processor 102 may generate a hash of the firmware instructions (such as for the core firmware instructions and / or each excludable firmware instruction), and then may sign the hash. For example, the hash of each excludable code region may be stored in metadata, which may then be signed. At runtime, the processor 102 may verify the firmware instructions by verifying the metadata signature, extracting the hash, then hashing the content of each appropriate region (such as the main region or the excludable region), and comparing the hashed content with the extracted hash. A mismatch may indicate tampering. If the excludable firmware instructions are disabled, the processor 102 may skip such hashing and merely ensure that the corresponding excludable region is actually excluded (such as by avoiding using the corresponding excludable firmware instructions and / or deleting the corresponding excludable region).

[0029] In this way, the excludable firmware instructions can be deleted with a minimal or no impact on the security and validation of the core firmware instructions (and / or other excludable firmware instructions that have not been deleted).

[0030] In an example, the processor 102 can implement measures capable of protecting the excludable regions. For example, the processor 102 can determine that data has been added to an excludable region after the excludable firmware instructions have been deleted. The processor 102 can then delete the data from the excludable region. In some instances, the processor 102 can consult metadata periodically, on demand, upon firmware update, and / or at other times to identify excludable regions in the storage device that are associated with the disabled (deleted) excludable firmware instructions, and delete data from those regions. Thus, the processor 102 can periodically purge the excludable regions that should not have data in those excludable regions.

[0031] In an example, the excludable region 103 includes multiple excludable regions. Each excludable region can store corresponding excludable firmware instructions, and each excludable region can be individually disabled by deleting the excludable firmware instructions from the storage device 104. For example, the processor 102 can obtain an indication that a second excludable firmware instruction is to be disabled, identify a second excludable region corresponding to the second excludable firmware instruction, and delete the second excludable firmware instruction from the second excludable region. Each excludable region can be identified based on the corresponding offset and / or location of the excludable region. Refer to FIG2A and 2B for other details regarding the layout of the excludable regions.

[0032] Operations related to receiving a selection of excludable firmware instructions to be disabled will now be referred to. Refer to Figure 1B , the processor 102 can fetch, decode, and execute the instruction 120 to obtain metadata from the metadata region, where the metadata indicates a first location of a first excludable region in the storage device and a second location of a second excludable region in the storage device.

[0033] The processor 102 can fetch, decode, and execute the instruction 122 to generate a list of the first excludable firmware instruction and the second excludable firmware instruction.

[0034] The processor 102 can fetch, decode, and execute the instruction 124 to receive a selection of the first excludable firmware instruction, where the selection indicates that the first excludable firmware instruction is to be disabled.

[0035] The processor 102 can fetch, decode, and execute the instruction 126 to set a first flag to indicate that the first excludable firmware instruction is to be disabled in response to the selection.

[0036] The processor 102 may fetch, decode, and execute the instruction 128 to delete the first excluded firmware instruction based on the first flag. In an example, the first excluded firmware instruction and the second excluded firmware instruction may be pre-installed at the storage device 104. The first flag may be set to indicate that the first excluded firmware instruction is enabled until it is disabled, and the second flag is set to indicate that the second excluded firmware instruction is enabled until it is disabled.

[0037] A more detailed view of the storage device 104 for storing firmware instructions will now be referred to. Figure 2A A block diagram of an example storage device 104 is shown. The storage device 104 includes different regions (101, 210, 103A-N) for storing metadata 201, core firmware instructions 212, and excluded instructions 220A-N. The storage device 104 may include a metadata region 101, a main region 210, and a plurality of excluded regions 103A-N. The metadata region 101 may store the metadata 201. The main region 210 may store the core firmware instructions 212. Each of the excluded regions 103A-N may store a corresponding excluded firmware instruction 220-N. The core firmware instructions 212 and the excluded firmware instructions 220-N together form the firmware instructions 208. The firmware instructions 208 may be used to boot or otherwise initialize a device such as the device 100. In the context of BIOS, UEFI, and / or other boot firmware instructions, in some examples, the main region 210 and the excluded regions 103 may correspond to the driver execution environment (DXE) locations on the storage device 104. The architecture of the DXE locations in the storage device 104 may be separated into different regions, such as the main region 210 and the excluded regions 103A-N.

[0038] In an example, the metadata 201 may store a pointer 204 to the main region 210. The pointer 204 may indicate the location of the main region 210 in the storage device 104. The pointer 204 may include the offset and / or length of the main region 210. Thereby, the core firmware instructions 212 stored in the main region 210 may be obtained, such as to be booted during the startup of a device such as the device 100.

[0039] In an example, the metadata 201 may store a pointer 206 to the excluded region 103A. The pointer 206 may include the offset and / or length of the excluded region 103A. Thereby, the excluded firmware instruction 220A stored in the excluded region 103A may be obtained, such as to be booted during the startup of a device such as the device 100. Additionally, the excluded firmware instruction 220A stored in the excluded region 103A may be deleted from the storage device 104 based on the pointer 206.

[0040] In an example, a previous excludable region can continuously point to a subsequent excludable region 103 (such as excludable regions 103B-N). For example, excludable region 103A can include a pointer 222A that includes information for locating the next excludable region 103 (in this case, excludable region 103B). For example, pointer 222A can indicate the offset, length, and / or other location indicators of the next excludable region 103. Alternatively or additionally, pointer 222A can include the length of the current excludable region 103 such that the offset of the next excludable region can be calculated. Thus, excludable regions 103 can be serially laid out one after another on storage device 104. Similarly, excludable regions 103B, N can each include a pointer 222B, 222N that includes information for locating the next excludable region 103. For example, pointers 222B, 222N can each indicate the offset, length, and / or other location indicators of the next excludable region 103, and so on. In this way, a linked array of excludable regions can be laid out on storage device 104. Alternatively or additionally, metadata 201 can separately store each of pointers 222A-N (as well as pointers 204 and 206).

[0041] Figure 2B A block diagram of an example storage device 104 including deleted excludable instructions is shown. For example, referring back to Figure 2A , excludable firmware instruction 220A has been disabled and thus deleted from storage device 104, as illustrated by the cross-hatching. Specifically, excludable firmware instruction 220A has been deleted from excludable region 103A. However, pointer 222A has been maintained such that the next excludable region 103 (excludable region 103B) can be located.

[0042] It should be noted that Figure 2A and 2B similar reference numerals between (and throughout the figure) indicate similar elements. It should be noted that Figure 2A and 2B the specific number of excludable firmware instructions and excludable regions shown in Figure 2A and 2B are for illustrative purposes. Other numbers can also be used where appropriate. Additionally,

[0043] Figure 3FIG. 0 is a block diagram showing an example system 300 that supplies firmware instructions, which include core firmware instructions and excludable firmware instructions. A firmware vendor 302 may provide firmware instructions 208. Various components of the system 300 may be coupled to each other via a computer network, such as, for example, a local area network (LAN), a virtual LAN (VLAN), a wireless local area network (WLAN), a virtual private network (VPN), the Internet, etc., or a combination thereof. In an example, the firmware instructions 208 may be part of a device 100 provided by the firmware vendor 302. Various third parties may provide firmware add-ons 304. Each of these firmware add-ons 304 may be incorporated into the firmware instructions 208. In an example, the firmware add-ons 304 may be incorporated by the firmware vendor 302 into the firmware instructions 208 as excludable firmware instructions 220.

[0044] The firmware vendor 302 may provide the firmware instructions 208 for consumption within a computer infrastructure 310. Multiple computer infrastructures 310A-N are shown, but for convenience only one (computer infrastructure 310A) is shown in detail. The computer infrastructure 310 may include a provisioning server 320 for deploying the device 100 based on provisioning rules 322. The provisioning rules 322 may include compliance policies, security policies, and / or other policies that specify the configuration, security, or other operational characteristics of the device 100.

[0045] An entity may operate each computer infrastructure 310. Thus, each entity may control whether the firmware instructions are executed on a given device 100 within the computer infrastructure 310 and which firmware instructions are executed on a given device 100 within the computer infrastructure 310 based on the provisioning rules 322. In some examples, the provisioning server 320 may facilitate the updating of the firmware instructions for the devices 100 within the computer infrastructure 310. Thus, the provisioning server 320 may facilitate the updating of the firmware instructions disclosed herein. It should be noted that the provisioning server 320 (although not shown) may include a processor (such as, for example, processor 102), which may perform some or all of the operations of the device 100 to remove excludable firmware instructions from a device.

[0046] Regarding Figure 4 more detailed discussion of the various ways in which the device 100 may operate to update the firmware instructions is provided with respect to the method 400 depicted in Figure 1A-3 The description of the method 400 is made with reference to the features depicted in

[0047] Figure 4 FIG. 132 is a flowchart depicting an example method for updating firmware instructions in the presence of deleted excluded firmware instructions.

[0048] As shown in Figure 4 FIG. 135, at block 402, the processor 102 may receive an indication to update a firmware instruction (such as, firmware instruction 208). An updater or installer (such as, a BIOS or UEFI updater or installer) may facilitate the update. In some examples, the update may include an update to core firmware instructions and excluded firmware instructions.

[0049] At block 404, the processor 102 may update the core firmware instructions.

[0050] At block 406, the processor 102 may identify excluded firmware instructions. For example, the processor 102 may access metadata that specifies the excluded firmware instructions.

[0051] At block 408, the processor 102 may determine whether the excluded firmware instruction is disabled. For example, the processor 102 may consult a flag for the excluded firmware instruction that indicates whether the excluded firmware instruction has been disabled. If the excluded firmware instruction is disabled, the processor 102 may skip to block 412, where a determination is made as to whether there are more excluded firmware instructions available. In this way, if the update includes an excluded firmware instruction that has been disabled (deleted at a device such as device 100), the update for that excluded firmware instruction may be skipped. In some examples, the processor 102 may delete data from the excluded region corresponding to the disabled excluded firmware instruction to ensure removal of malware or other data that should not be present. Thus, even if the update includes an update to a disabled excluded firmware instruction, each device may only update the excluded firmware instructions that have not been disabled. This can make global updates more efficient, as the update may include updates to all firmware instructions, regardless of whether a particular device has disabled the excluded firmware instructions.

[0052] At block 410, in response to a determination that the excluded firmware instruction is not disabled, the processor 102 may update the excluded firmware instruction. For example, the processor 102 may identify the excluded firmware instruction to be updated, identify the location (such as, the excluded region 103) on the firmware storage device (such as, storage device 104) where the excluded firmware instruction is stored, and write the update file to the appropriate location. In some instances, a signature for the updated excluded firmware instruction may be obtained and stored for later verification.

[0053] At block 412, the processor 102 may determine whether there are more firmware instructions to be excluded available. If so, the processor 102 may return to block 406, where the next firmware instruction to be excluded is identified.

[0054] At block 414, in response to determining that there are no more firmware instructions to be excluded available, the processor 102 may complete the firmware update.

[0055] Some or all of the operations set forth in method 400 may be included as a utility, program, or subprogram in any desired computer-accessible medium. Additionally, method 400 may be embodied by a computer program, which may exist in various forms. For example, some operations of method 400 may exist as machine-readable instructions, including source code, object code, executable code, or other formats. Any of the foregoing may be embodied on a non-transitory computer-readable storage medium. Examples of non-transitory computer-readable storage media include computer system RAM, ROM, EPROM, EEPROM, and magnetic or optical disks or tapes. Thus, it is to be understood that any electronic device capable of performing the above functions can perform those functions enumerated above.

[0056] Figure 5 A block diagram of an example non-transitory computer-readable medium 500 for executing firmware instructions including core firmware instructions and firmware instructions to be excluded is depicted. The non-transitory computer-readable medium 500 may be an electronic, magnetic, optical, or other physical storage device that includes or stores executable instructions. The non-transitory computer-readable medium 500 may be, for example, a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), a storage device, an optical disc, etc. Machine-readable instructions 502-508 that may be executed by a processor (such as processor 102) may be stored thereon.

[0057] In various examples, the non-transitory machine-readable medium 500 may be used to boot a device such as device 100 using core firmware instructions and firmware instructions to be excluded that have not been disabled. In these examples, the machine-readable instructions 502-508 may operate to obtain and execute the core firmware instructions and the firmware instructions to be excluded to boot the device. Other example uses of the machine-readable instructions 502-508 may also be implemented.

[0058] The machine-readable instruction 502 may cause the processor to obtain metadata from a storage device (such as storage device 104).

[0059] The machine-readable instruction 504 may cause the processor to obtain a first flag and a second flag. The first flag and / or the second flag may be stored in a secure location of the storage device.

[0060] The machine-readable instructions 506 may cause the processor to obtain an execution order from the metadata, the execution order indicating the order in which the core firmware instructions, the first excludable firmware instruction, and the second excludable firmware instruction are to be executed.

[0061] The machine-readable instructions 508 may cause the processor to execute, based on the execution order, the following: the core firmware instructions, the first excludable firmware instruction when the first flag indicates that the first excludable firmware instruction is enabled, and the second excludable firmware instruction code when the second flag indicates that the second excludable firmware instruction is enabled. It should be noted that when the first flag and / or the second flag indicate that the corresponding excludable firmware instruction is disabled, the corresponding excludable firmware instruction has been or will be deleted at startup, update, and / or other times.

[0062] In some examples, security information (such as a known good signature) may be used to individually verify the firmware instructions before execution. For example, a known good signature for the core firmware instructions may be stored and matched with the current signature of the core firmware instructions to verify that the core firmware instructions have not been tampered with. Similarly, a known good signature for each excludable firmware instruction may be stored and matched with the current signature of each excludable firmware instruction to verify that each of the excludable firmware instructions has also not been tampered with. As previously noted, separate signature verification may allow for the deletion of a given excludable firmware instruction. Other types of security information may also be used, such as a hash corresponding to the content of the primary region or excludable region included in the signed metadata, a hash of the content of the primary region or excludable region, and / or other data.

[0063] The systems, methods, and computer-readable media described herein may facilitate various uses and models for distributing firmware instructions (such as firmware instructions 208). For example, a vendor (such as firmware vendor 302) that may produce a device 100 embedded with or otherwise including firmware instructions may provide different functions encoded by excludable firmware instructions (such as excludable firmware instructions 220). A consumer, such as an entity operating a computer infrastructure 310, may select some or all of these functions, in which case the corresponding excludable firmware instructions may be provided to them. Otherwise, the vendor may remove the corresponding excludable firmware instructions before providing the firmware instructions. This may make the distribution of firmware instructions easier and facilitate different models of such distribution.

[0064] In other examples, if a consumer has paid for or otherwise obtained the service or function provided by an excludable firmware instruction but no longer needs or wants such a function, the systems, methods, and computer-readable media described herein may be used to remove the corresponding excludable firmware instruction.

[0065] Although described specifically throughout this disclosure, representative examples of the disclosure have utility in a wide variety of applications, and the foregoing discussion is not intended and should not be construed as limiting, but is provided as an illustrative discussion of aspects of the disclosure. For example, although described in the context of boot level initialization, the features and functions described herein can be used in other contexts.

[0066] For simplicity and illustrative purposes, the disclosure may be described primarily with reference to examples. In the foregoing description, numerous specific details are set forth in order to provide a thorough understanding of the disclosure. However, it will be apparent that the disclosure may be practiced without limitation to these specific details. In other instances, some methods and structures have not been described in detail so as not to unnecessarily obscure the disclosure.

[0067] Throughout this disclosure, the terms "a" and "an" may be intended to mean at least one particular element. As used herein, the term "comprising" means including but not limited to, and the term "including" means including but not limited to. The term "based on" means at least partially based on.

[0068] Described and illustrated herein are examples of the disclosure along with some variations thereof. The terms, descriptions, and figures used herein are set forth by way of illustration only and are not meant to be limiting. Many variations are possible within the spirit and scope of the disclosure, which is intended to be defined by the following claims and their equivalents, where all terms are meant in their broadest reasonable sense unless otherwise indicated.

Claims

1. An apparatus, comprising: a storage device including a metadata area, a main area, and an excludable area, wherein the main area stores core firmware instructions; and a processor for: obtaining metadata from the metadata area, wherein the metadata indicates a location of the excludable area in the storage device; obtaining an indication that excludable firmware instructions stored in the excludable area are to be disabled; identifying the excludable area based on the metadata; and deleting the excludable firmware instructions from the excludable area.

2. The apparatus according to claim 1, wherein the metadata includes a flag indicating whether to disable the excludable firmware instructions, and wherein the processor is further for: receiving an indication to disable the excludable firmware instructions; and setting the flag to indicate that the excludable firmware instructions are to be disabled, wherein the indication that the excludable firmware instructions are to be disabled is based on the flag.

3. The apparatus according to claim 2, wherein the processor is further for: receiving an indication to update the core firmware instructions; determining that the flag is set to disable the excludable firmware instructions; and updating the core firmware instructions without updating the excludable firmware instructions, wherein the update of the core firmware instructions is based on the determination that the flag is set to disable the excludable firmware instructions.

4. The apparatus according to claim 2, the processor is further for: determining that data has been added to the excludable area after the excludable firmware instructions have been deleted; and deleting the data from the excludable area.

5. The apparatus according to claim 1, the processor is further for: generating a first digital signature for the core firmware instructions, wherein the first digital signature is used to verify the integrity of the core firmware instructions; and generating a second digital signature for the excludable firmware instructions, wherein the second digital signature is used to verify the integrity of the excludable firmware instructions independently of the integrity of the core firmware instructions.

6. The apparatus according to claim 1, wherein the metadata includes an offset and a length of the excludable area, and wherein, to delete the excludable firmware instructions, the processor is for: obtaining the offset and the length of the excludable area; and deleting data corresponding to the offset and the length from the storage device.

7. The apparatus according to claim 6, wherein the storage device includes a second excludable area storing second excludable firmware instructions, and the processor is further for: obtaining an indication that the second excludable firmware instructions are to be disabled; identifying the second excludable area corresponding to the second excludable firmware instructions; and deleting the second excludable firmware instructions from the second excludable area.

8. The apparatus according to claim 7, wherein, to identify the second excludable area, the processor is for: identifying a second offset of the storage device corresponding to the second excludable area of the second excludable firmware instructions based on the metadata.

9. The apparatus according to claim 7, wherein, in order to identify the second excludable area, the processor is further configured to: determine that the second excludable area is after the excludable area on the storage device, wherein the second excludable area is identified based on an offset and a length of the excludable area.

10. The apparatus according to claim 1, wherein the metadata includes a mapping between the excludable area and the excludable firmware instructions, and wherein the excludable area is identified based on the mapping.

11. An apparatus, comprising: a storage device including a metadata area, a main area storing core firmware instructions, a first excludable area storing first excludable firmware instructions, and a second excludable area storing second excludable firmware instructions; and a processor configured to: obtain metadata from the metadata area, wherein the metadata indicates a first position of a first excludable area in the storage device and a second position of a second excludable area in the storage device; generate a list of the first excludable firmware instructions and the second excludable firmware instructions; receive a selection of the first excludable firmware instruction, the selection indicating that the first excludable firmware instruction is to be disabled; set a first flag to indicate that the first excludable firmware instruction is to be disabled in response to the selection; and delete the first excludable firmware instruction based on the first flag.

12. The apparatus according to claim 11, wherein the first excludable firmware instruction and the second excludable firmware instruction are pre-installed at the storage device, the first flag is set to indicate that the first excludable firmware instruction is enabled until it is disabled, and a second flag is set to indicate that the second excludable firmware instruction is enabled until it is disabled.

13. The apparatus according to claim 11, wherein the processor is further configured to: receive an indication to update the core firmware instructions; determine that the first flag is set to disable the first excludable firmware instruction; and update the core firmware instructions without updating the first excludable firmware instruction, wherein the update of the core firmware instructions is based on the determination that the first flag is set to disable the first excludable firmware instruction.

14. A non-transitory computer-readable medium including machine-readable instructions that, when executed by a controller of an electronic device, cause the controller to: obtain metadata from a storage device, wherein the storage device includes a metadata area storing metadata, a main area storing core firmware instructions, a first excludable area storing first excludable firmware instructions, and a second excludable area storing second excludable firmware instructions; obtain a first flag and a second flag; obtain an execution order from the metadata, the execution order indicating an order in which the core firmware instructions, the first excludable firmware instructions, and the second excludable firmware instructions are to be executed; perform the following based on the execution order: the core firmware instructions; the first excludable firmware instructions when the first flag indicates that the first excludable firmware instructions are enabled; and the second excludable firmware instructions when the second flag indicates that the second excludable firmware instructions are enabled.

15. The non-transitory computer-readable medium according to claim 14, wherein the instructions are further configured to cause the controller to: When a first flag indicates that a first excludable firmware instruction is disabled, delete the first excludable firmware instruction from a first excludable area of the storage device; and When a second flag indicates that a second excludable firmware instruction is disabled, delete the second excludable firmware instruction from a second excludable area of the storage device.

Images