HP Sure Start Gen3 Available on HP Elite products equipped with 7th generation Intel® Core™ processors - White Paper

Available on HP Elite products equipped with

7th generation Intel® Core™ processors

January, 2017

HP Sure Start Gen3

1 HP Sure Start Gen3 4

Note that even in the case of HP Sure Start with Dynamic Protection, the focus is on monitoring the BIOS code in the system

flash that is executed by the host CPU at boot.

This is an important distinction from BIOS code that remains resident in the

main (DRAM) memory to provide power management and other critical services after the system has booted to OS. Next,

we explore that distinction in greater detail.

Figure 1 Baseline HP Sure Start overview (applies to HP Elite products equipped with 6th generation Intel

Core

™

processors and higher)

1.3.2 Runtime BIOS code versus startup BIOS code

On each boot, the CPU starts execution of BIOS code from the flash memory at a fixed address. This BIOS code then

initializes the hardware including the DRAM memory and copies all routines from flash into volatile (DRAM) memory. A large

portion of that BIOS code is used to provide “Pre-OS” capabilities that are needed before the OS is started. Examples of

“Pre-OS” BIOS support include video drivers, PXE boot support, keyboard and mouse drivers, pre-boot authentication, and

unlocking of mass storage encryption, to name a few. Most of these routines are no longer needed once the OS is running,

since the capabilities are either only relevant before handoff to the OS, or the OS has its own drivers.

However, there is a portion of BIOS that remains in DRAM that is needed to provide advanced power-management

features, OS services, and other OS-independent functions while the OS is running. This BIOS code, referred to as System

Management Mode (SMM) code, resides in a special area within the DRAM that is hidden from the OS.

We also refer to this

code as “Runtime” BIOS code in the context of HP Sure Start Runtime Intrusion Detection.

The integrity of SMM code is critical to the client device security posture. The baseline HP Sure Start implementation

provides assurance that all code is Genuine HP BIOS each time the system starts, including the SMM code that is present in

DRAM when the OS starts.