Secure firmware management with hierarchical boot sequence using last known good firmware

A method in a computing system, the method comprising:

• storing in one or more memory devices of the computing system (i) a first version of a multi-stage bootstrap program for bootstrapping the computer system, the bootstrap program comprising a self-test program that tests the bootstrap program, and (ii) a second version of the bootstrap program that is known to be trustworthy;
• storing, in non-resettable memory elements of the computing system, non-resettable indicators that are retained regardless of resetting of the computer system, the non-resettable indicators comprising at least (i) a self-test-request indicator that requests running of the self-test program, and (ii) a self-test-passed indicator indicative of whether the self-test program passed or failed;
• and
• using a processor of the computing system, retrieving the first version of the bootstrap program, and, if the first version is at least as recent as the trustworthy second version, bootstrapping the computer system securely using the first version and the non-resettable indicators.

A computer software product, the product comprising a tangible non-transitory computer-readable medium in which program instructions are stored, which instructions, when read by a processor in a computing system, cause the processor to:

• store in one or more memory devices of the computing system (i) a first version of a multi-stage bootstrap program for bootstrapping the computer system, the bootstrap program comprising a self-test program that tests the bootstrap program, and (ii) a second version of the bootstrap program that is known to be trustworthy;
• store, in non-resettable memory elements of the computing system, non-resettable indicators that are retained regardless of resetting of the computer system, the non-resettable indicators comprising at least (i) a self-test-request indicator that requests running of the self-test program, and (ii) a self-test-passed indicator indicative of whether the self-test program passed or failed;
• and
• retrieve the first version of the bootstrap program, and, if the first version is at least as recent as the trustworthy second version, bootstrap the computer system securely using the first version and the non-resettable indicators.