UEFI pre-boot guidelines and Microsoft® Windows® 8 UEFI Secure Boot for HP Business PCs PPS business notebooks, desktop, and workstations - Technical White Paper

ManualsBrandsHP ManualsDesktopsHP EliteBook 2570p Notebook PC (ENERGY STAR)

Technical white paper

UEFI pre-boot guidelines and

Microsoft® Windows® 8 UEFI

Secure Boot for HP Business PCs

PPS business notebooks, desktop, and workstations

Table of contents

UEFI pre-boot guidelines ...................................................................................................................................................... 3

Supported models ............................................................................................................................................................ 3

HP_TOOLS for HP UEFI and pre-boot applications ....................................................................................................... 3

UEFI and custom imaging ................................................................................................................................................ 4

UEFI architecture ............................................................................................................................................................... 4

How BIOS launches UEFI applications ............................................................................................................................ 6

Creating or restoring an HP_TOOLS partition on the hard drive ................................................................................. 7

Errors when launching the pre-boot applications (notebooks only).......................................................................... 7

Pre-boot security requirements (notebooks only) ....................................................................................................... 7

Secure Boot overview ........................................................................................................................................................... 8

Firmware policies .................................................................................................................................................................. 8

Firmware policies for notebooks .................................................................................................................................... 8

Firmware boot policy for desktops and workstations ................................................................................................. 9

Secure Boot Key management for notebooks ........................................................................................................... 10

Secure Boot Key management for desktops and workstations .............................................................................. 11

If Secure Boot verification fails ..................................................................................................................................... 12

The BIOS Signing Key ..................................................................................................................................................... 12

TPM and measured boot ............................................................................................................................................... 12

POST ................................................................................................................................................................................ 13

Windows 8 Hybrid Boot and flash ................................................................................................................................ 13

BitLocker ......................................................................................................................................................................... 14

Boot order ....................................................................................................................................................................... 14

OA3................................................................................................................................................................................... 17

Computrace .................................................................................................................................................................... 18

F10 Restore Default Behavior ...................................................................................................................................... 18

Appendix .............................................................................................................................................................................. 22

General UEFI requirements ........................................................................................................................................... 22

PCR boot measurements for notebook products ...................................................................................................... 22

For more information ........................................................................................................................................................ 23

Click here to verify the latest version of this document

Summary of content (23 pages)

PAGE 1
Technical white paper UEFI pre-boot guidelines and Microsoft® Windows® 8 UEFI Secure Boot for HP Business PCs PPS business notebooks, desktop, and workstations Table of contents UEFI pre-boot guidelines ......................................................................................................................................................3 Supported models ..........................................................................................................................................
PAGE 2
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations 2
PAGE 3
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations UEFI pre-boot guidelines As computer technology has advanced, the BIOS has expanded to handle new components, larger and more complex chipsets, add-in cards, and other enhancements. This expansion has made the BIOS increasingly intricate. Development of the Unified Extensible Firmware Interface (UEFI ) is the computer industry’s solution to BIOS limitations.
PAGE 4
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations The HP UEFI applications and pre-boot applications provide extensive pre-boot functions to the system BIOS residing in the flash ROM. You can find information for GUID Partition Table (GPT) formatted disks in the Disk layouts section of this document. On notebooks, UEFI applications are available through the F9 boot menu.
PAGE 5
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations Directories and descriptions The HP_TOOLS UEFI partition file and folder structure are similar to the Windows file and folder structure. During the installation of an UEFI application, the HP UEFI Application SoftPaqs unbundle into the C:\swsetup directory.
PAGE 6
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations ESP partition for HP UEFI and Pre-boot applications for GPT formatted disks When a native UEFI-aware operating system is installed, the ESP partition is automatically created. One of the elements the ESP contains is the boot loader image for the operating system. The ESP is an enumerable Fat32 partition and does not have a drive letter assigned.
PAGE 7
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations Creating or restoring an HP_TOOLS partition on the hard drive Use the following steps to create an HP_TOOLS partition and install related SofPaqs onto the partition: 1. Use Partition Magic to create a partition on a local hard drive that has a System partition with the following characteristics. • Partition type: FAT32 • Partition size: 2 GB • Volume name: HP_TOOLS 2. 3.
PAGE 8
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations Secure Boot overview Secure Boot is a feature to ensure that only authenticated code can start on a platform. The firmware is responsible for preventing launch of an untrusted OS by verifying the publisher of the OS loader based on policy, and is designed to mitigate root kit attacks. Figure 4. UEFI Secure Boot flow. Verified OS loader (e.g.
PAGE 9
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations The Preinstall should set the Secure Boot/Boot Mode policy to Enable and Legacy, and to Disable for Windows 8 64/32. Table 3.
PAGE 10
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations To complete the process, you are required to type in a random four-digit verification code that is displayed in the message generated by the BIOS. Operating System Boot Mode Change A change to the operating system Secure Boot mode is pending. Please enter the pass code displayed below to complete the change. If you did not initiate this request, press the ESC key to continue without accepting the pending change.
PAGE 11
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations Figure 7. BIOS Setup User Mode selection for notebooks. Note If the user tries to import the HP PK again when the selection is the Customer Keys, the BIOS will reject the PK. Secure Boot Key management for desktops and workstations Figure 8.
PAGE 12
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations If Secure Boot verification fails The operating system’s boot loader file is signed in accordance with the Windows Authenticated Portable Executable Signature Format specification. The paths of the boot loader files are as follows: • ESP\Microsoft\boot\bootmgfw.efi • ESP\EFI\boot\Bootx64.efi If the file is modified in any way without a corresponding signature update, the boot loader authentication will fail.
PAGE 13
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations 法规及政策，并已获得所需的一切事先批准及许可（如适用）。若因您未获得相应的操作/使用许可而发生的合规问题，皆由您自行承担全部责任，与惠普无涉。确认启用TPM, 按 “+”。取消，按 “-“. NoPPIProvision Flag in F10 The default for the NoPPIProvision flag is based on the factory setting. TPM auto-provisioning Windows 8 will automatically take TPM ownership to ease the deployment scenario. On an out of box setup, the OS will automatically prepare the TPM for use.
PAGE 14
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations BitLocker Systems which support TPM and wired LAN networking must support the UEFI_DHCP4_protocol, the UEFI_DHCP4_SERVICE_BINDING_PROTOCOL, the UEFI_DHCP6_protocol, and the UEFI_DHCP6_SERVICE_BINDING_PROTOCOL for wired LAN as defined in UEFI 2.3.1.
PAGE 15
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations Delete Add Legacy Boot Order Notebook Upgrade Bay Notebook Hard Drive USB Floppy USB CD-ROM USB Hard Drive When delete is selected, only those entries added by OS/User can be deleted. i.e. OS Boot Manager, Customized Boot.
PAGE 16
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations Boot order for desktops and workstations On desktops and workstations, the Boot Order menu displays all of the available boot sources in a categorized hierarchy. Each available boot source is presented (as shown below in Figure 11) for one of two primary categories: UEFI Boot Sources or Legacy Boot Sources.
PAGE 17
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations OA3 Windows 8 features a new version of the OEM activation mechanism, the OEM Activation 3.0 (OA 3.0). This is supported by all HP business PCs certified for Windows 8. If a customer orders an HP business PC with Windows 8, the unit is shipped with Windows 8 pre-activated—the customer does not need to activate the operating system.
PAGE 18
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations Physical Presence Check To prevent malicious software attacks, a Physical Presence Check must be performed to inject a “new” key or “clear” a key. During the next reboot after a new key is written to Public WMI, the following message will be displayed to the user: Microsoft Windows Product Activation Key Change A change to the Microsoft Windows Product Activation Key is pending.
PAGE 19
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations Embedded Security Device State No TPM Reset to Factory Defaults No Power-On Authentication Support No Reset Authentication Credential No OS Management of TPM No Reset TPM from OS No Utilities Asset Tracking Number No Ownership Tag No Ownership Tag 2 No Language No System Configuration: Boot Options Startup Menu Delay Yes Mutiboot Express Popup Delay Yes Audio alerts during boot Yes Custo
PAGE 20
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations Fan Always on while AC Power Yes Data Execution Prevention Yes Max SATA Speed Yes SATA Device Mode No Wake on USB Yes Secondary Battery Fast Charge Yes Virtualization Technology (VTx) Yes Virtualization Technology for Directed I/O (VTd) Yes Trusted Execution Technology (TXT) Yes HP Hypervisor Yes Multi Core CPU N/A Intel HT Technology N/A NumLock on at boot Yes Express Card Link Speed Ye
PAGE 21
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations Parallel Port Yes Flash media reader Yes USB Port Yes 1394 Port Yes Express Card Slot Yes eSATA Port Yes AMT Options USB Key Provisioning Support Yes Unconfigure AMT on next boot Yes SOL Terminal Emulation Mode Yes Firmware Progress Event Support Yes Initiate Intel CIRA Yes BIOS Power-On Sunday Yes Monday Yes Tuesday Yes Wednesday Yes Thursday Yes Friday Yes Saturday Yes BIOS Po
PAGE 22
Technical white paper | UEFI Secure Boot on HP business notebooks, desktops, and workstations Appendix General UEFI requirements The BIOS incorporated in the HP business notebooks, desktops, and workstations supporting Windows 8 conforms to the following sections of the UEFI 2.3.1 Class 2 specification: 2.3, 3.1, 4.3, 6.1 ~ 6.5, 7.1~7.5, 8.1, 8.2, 9.1, 9.5, 11.2 ~ 11.4, 11.8, 11.9, 12.4, 12.7, 12.8, 12.9, 18.5, 21.1, 21.3, 21.5, 27.1~27.8.
PAGE 23
For more information Visit the websites listed below if you need additional information. Resource description Web address UEFI Specification Version 2.3.1 http://www.UEFI.org/specs/download Windows Compatibility Support Module Opt-Out Mechanism for Legacy Free OSs v1.1 by Microsoft http://msdn.microsoft.com/en-us/windows/hardware/gg463180 Windows Authenticated Portable Executable Signature Format specification PC Client Work Group Platform Reset Attack Mitigation Specification, Version 1.