Abstract: An information handling system may include a processor and a basic input/output system communicatively coupled to the processor and embodied by executable instructions embodied in non-transitory computer readable media, the instructions configured to, when executed by the processor: extract from a boot manifest a list of files associated with operating system applications of the information handling system and respective signatures for each of the files; locate the files listed in the boot manifest on a partition of a storage resource accessible to the processor; attempt to verify signatures for each of the files as stored on the storage resource against their respective signatures set forth in the boot manifest; enable execution of a boot loader for the operating system and the operating system applications in response to successful verification of the signatures; and abort a boot process of the information handling system in response to unsuccessful verification of the signatures.

Abstract: An information handling system may include a processor, a basic input/output system (BIOS) comprising a program of instructions executable by the processor and configured to cause the processor to initialize components of the information handling system; and a management controller communicatively coupled to the processor and configured to, during a pre-Extensible Firmware Interface Initialization (PEI) phase of the BIOS, operate as a network proxy for the BIOS to allow the BIOS to communicate data via an out-of-band network interface of the management controller.

Abstract: A method may include determining a configuration of one or more basic input/output system (BIOS) settings identified as influencing security at an information handling system. The method may further include determining a security risk score based on the configuration, and generating a security gauge image that provides a visual indication of the security risk score. The security gauge image may be displayed during BIOS initialization at the information handling system.

Abstract: An information handling system may include at least one processor, and a memory coupled to the at least one processor. The information handling system may be configured to: detect a problem during a boot of the information handling system; transmit telemetry data associated with the problem to at least one remote telemetry server, wherein the at least one remote telemetry server is configured to analyze the telemetry data and other telemetry data from other information handling systems; receive resolution instructions from the at least one remote telemetry server; and implement a resolution of the detected problem based on the resolution instructions.

Abstract: An information handling system may include a processor, non-transitory computer readable media communicatively coupled to the processor and having stored thereon a primary operating system of the information handling system and a secondary operating system of the information handling system, and a basic input/output system communicatively coupled to the processor and having provisioned thereon a signed signature of the secondary operating system signed with a private key of a public-private key pair and a public key of the public-private key pair. The basic input/output system is configured to, responsive to a determination to boot to the secondary operating system in lieu of booting to the primary operating system of the information handling system verify the secondary operating system using the signed signature of the secondary operating system and the public key and responsive to verifying the secondary operating system, allow the information handling system to boot to the secondary operating system.

Abstract: An information handling system may include at least one processor, a memory coupled to the at least one processor, and an information handling resource including a firmware. The information handling system may be configured to: boot into an operating system stored on the memory; after booting into the operating system, receive, from at least one remote server, information regarding a vulnerability associated with the firmware; based on a security policy, determine a resolution for mitigation of the vulnerability; and store information regarding the resolution in a storage location accessible to a preboot environment of the information handling system, wherein the preboot environment is configured to apply the resolution upon a subsequent boot of the information handling system.

Abstract: A method for configuring resources at an information handling system may include determining, during initialization, a wide area network (WAN) Internet Protocol (IP) address associated with the information handling system, and retrieving a list of trusted IP addresses from a storage location at the information handling system. The method may further include configuring a first resource at the information handling system to operate in a first state in response to determining that the WAN IP address is included at the list of trusted IP addresses, and configuring the first resource at the information handling system to operate in a second state in response to determining that the WAN IP address is not included at the list of trusted IP addresses.

Abstract: An information handling system includes power inputs, a battery, a BMC, a memory, and a processor. The BMC determines which of the power inputs are coupled to associated power sources, and a first duration of time that the battery can provide power to the information handling system. The memory stores a firmware element. The processor receives a firmware that includes a second indication as to which of the power inputs are to be coupled to their associated power source as a condition for saving the firmware update, and that includes a second duration of time that it is expected to take to save the firmware update. The information handling system saves the firmware update to the memory when the first indication matches the second indication and when the first duration of time is greater than the second duration of time.

Abstract: Information handling systems (IHS) and methods are provided to automatically synchronize operating system (OS) and boot firmware languages. In one embodiment, a method may detect a change in an active OS language from a first language pack to a second language pack, notify the boot firmware that the active OS language was changed, and provide an identity of the second language pack to the boot firmware during OS runtime. When the IHS is subsequently rebooted, the active boot firmware language may be synchronized to the active OS language. In another embodiment, the method may detect a change in an active boot firmware language from a first language pack to a second language pack, notify the OS that the active boot firmware language was changed, and provide an identity of the second language pack to the OS during a pre-boot phase. When the OS is subsequently booted, the active OS language may be synchronized to the active boot firmware language.

Abstract: An information handling system may include a processor, an external port communicatively coupled to the processor and configured to receive an external information handling resource and couple the external information handling resource to the processor, and a basic input/output system comprising a program of instructions executable by the processor.

Abstract: A basic input/output system may be configured to, during a boot of the information handling system and responsive to a condition for launching the secondary operating system: initialize a network driver for communicating with a network via a network interface, download from a secure, verified network location within the network a security manifest file for a most recent version of the secondary operating system, the security manifest file comprising metadata regarding a file system layout for the most recent version of the secondary operating system, based on the file system layout of the security manifest file and an actual file system layout of the secondary operating system as stored within an information handling system, determine one or more portions of the secondary operating system requiring update, and download the one or more portions of the secondary operating system and apply the one or more portions to the secondary operating system as stored within the information handling system.

Abstract: An information handling system may include a processor and a basic input/output system communicatively coupled to the processor and embodied by executable instructions embodied in non-transitory computer readable media, the instructions configured to, when executed by the processor: extract from a boot manifest a list of files associated with operating system applications of the information handling system and respective signatures for each of the files; locate the files listed in the boot manifest on a partition of a storage resource accessible to the processor; attempt to verify signatures for each of the files as stored on the storage resource against their respective signatures set forth in the boot manifest; enable execution of a boot loader for the operating system and the operating system applications in response to successful verification of the signatures; and abort a boot process of the information handling system in response to unsuccessful verification of the signatures.

Abstract: An information handling system may include a processor and a basic input/output system communicatively coupled to the processor and embodied by executable instructions embodied in non-transitory computer readable media, the instructions configured to, when executed by the processor: identify, for a firmware image, a secure boot certificate; identify, for the secure boot certificate, a certificate use policy; determine whether the certificate use policy permits verification of the firmware image using the secure boot certificate; and allow the firmware image to be verified with the secure boot certificate if the certificate use policy permits verification of the firmware image using the secure boot certificate.

Abstract: An information handling system includes a non-volatile memory and a processor configured to determine whether a previous boot of the information handling system was successful while booting the information handling system. If the previous boot of the information handling system was successful, then the processor determines whether current configuration settings of the information handling system match most recent known good configuration settings. If the current configuration settings of the information handling system do not match the most recent known good configuration settings, then the current configuration settings are stored as a most recent restore point in the memory.

Abstract: A method may include, during a boot of an information handling system: determining, based on settings stored in non-volatile memory of the information handling system, whether to perform pre-commit execution of a firmware update image prior to committing the firmware update image to a motherboard of the information handling system, and responsive to determining to perform pre-commit execution, load the firmware update image from a basic input/output system partition of a storage resource of the information handling system and execute the firmware update image in lieu of a firmware image stored on the motherboard.

Abstract: An information handling system includes power inputs, a battery, a BMC, a memory, and a processor. The BMC determines which of the power inputs are coupled to associated power sources, and a first duration of time that the battery can provide power to the information handling system. The memory stores a firmware element. The processor receives a firmware that includes a second indication as to which of the power inputs are to be coupled to their associated power source as a condition for saving the firmware update, and that includes a second duration of time that it is expected to take to save the firmware update. The information handling system saves the firmware update to the memory when the first indication matches the second indication and when the first duration of time is greater than the second duration of time.

Abstract: A method for configuring resources at an information handling system may include determining, during initialization, a wide area network (WAN) Internet Protocol (IP) address associated with the information handling system, and retrieving a list of trusted IP addresses from a storage location at the information handling system. The method may further include configuring a first resource at the information handling system to operate in a first state in response to determining that the WAN IP address is included at the list of trusted IP addresses, and configuring the first resource at the information handling system to operate in a second state in response to determining that the WAN IP address is not included at the list of trusted IP addresses.

Abstract: An information handling system may include a processor, a basic input/output system (BIOS) communicatively coupled to the processor and configured to maintain a first variable indicative of whether auto-provisioning is enabled for the information handling system, maintain a second variable indicative of whether auto-provisioning has been completed for the information handling system, and upon boot of the information handling system, perform auto-provisioning of a host operating system image to the information handling system if the first variable indicates that auto-provisioning is enabled for the information handling system and the second variable indicates that auto-provisioning of the information handling system is incomplete.

Abstract: Systems and methods that may be implemented in a Unified Extensible Firmware Interface (UEFI) pre-boot environment time to dynamically locate and load bootable images stored in one or more operating system (OS) partitions on a system storage device/s (e.g., HDD, SSD) that is formatted with an advanced filesystem (e.g., such as NTFS, EXT3, etc.). An OS-based filesystem-independent method may be provided to access OS filesystem data during UEFI pre-boot time. Individual selected boot images stored across multiple OS filesystem partitions may be located and loaded to boot from UEFI pre-boot.

Abstract: Embodiments of information handling systems (IHS) and computer implemented methods are disclosed herein to proactively restore missing firmware components to a computer readable storage device of an IHS. In one embodiment, a method may execute a first set of program instructions, before an operating system (OS) is loaded into a system memory of the IHS, to determine if one or more firmware components previously stored within the computer readable storage device is/are missing. If the first set of program instructions determines at least one firmware component is missing, the method may execute additional program instructions to retrieve a copy of the missing firmware component(s) from a remotely located system, and store the retrieved copy of the missing firmware component(s) within the computer readable storage device. The additional program instructions can be executed before the OS is loaded in some embodiments, and after the OS is loaded in other embodiments.