Hybrid firmware code protection

A firmware protection module implements a hybrid firmware protection scheme on a computing device. The firmware protection module intercepts a message from a processor to a memory of the computing device. The message includes a command and an address in the memory corresponding to a firmware module stored in the module. The firmware protection module determines whether the command in the message is prohibited and whether the address in the message is protected. Responsive to a determination that the command is prohibited and the address is protected, the firmware protection module prevents at least a portion of the message from reaching the memory.

TECHNICAL FIELD

The present disclosure relates to secure deployment of firmware code modules for computing devices.

BACKGROUND

Computing devices typically store one or more copies of firmware in non-volatile memory to initialize hardware after powering on the device. For instance, a computing device may store Basic Input/Output System (BIOS) firmware in a boot flash memory to enable the processor to boot an operating system for the computer. In some instances, a computing device may store more than one version of the firmware to provide a backup copy of firmware to prevent the operating system from inadvertently corrupting the BIOS firmware. A maliciously compromised operating system may directly overwrite the boot flash memory, wiping out all versions of the firmware, and rendering the computing device useless.

BIOS firmware may be secured against compromised operating systems by implementing a secure BIOS update process. In a typical BIOS update process the operating system writes an update package to computer readable media other than the boot flash, and, on the next reset of the computing device, the BIOS fetches the update package, verifies the update package is authentic, and installs the package. The operating system is otherwise prevented from accessing the BIOS region in the boot flash, for example, with protected range registers provided by the processor architecture.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Overview

The techniques presented herein provide for a computing-device-implemented method for a hybrid firmware protection scheme. The method comprises intercepting a message from a processor to a memory. The memory includes a command and an address in the memory corresponding to a firmware module stored in the module. The method further includes determining whether the command in the message is prohibited and determining whether the address in the message is protected. Responsive to a determination that the command is prohibited and the address is protected, the method further includes preventing at least a portion of the message from reaching the memory.

Example Embodiments

The typical secure update of BIOS firmware requires extended downtime during the power cycle to allow the BIOS to load, fetch the update package, verify the package, install the update, and then reload the updated BIOS. Running the update process while the operating system is not running secures the update process, but may lengthen the downtime of the computing device by an unacceptable amount. The techniques presented herein mitigate the boot time impact of updating firmware modules that are loaded at boot time by implementing a hybrid scheme in which the operating system directly updates the primary firmware (e.g., the BIOS module used to boot the operating system), while maintaining a backup version of the firmware that is updated indirectly (e.g., via the secure update package).

Referring now toFIG.1, a simplified block diagram of a computing device100configured to implement the hybrid firmware protection scheme is shown. The computing device includes a communications bus110that couples a processor120to a firmware protection module130, and a firmware memory140. The processor120may include one or more processing units that are configured to load firmware (e.g., BIOS firmware) from the memory140. The memory140may include read only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical, or other physical/tangible memory storage devices. Thus, in general, the memory140may include one or more tangible (non-transitory) computer readable storage media (e.g., a memory device) encoded with firmware comprising computer executable instructions and when the firmware is executed (by the processor120) it is able to perform the operations described herein.

The firmware protection module130includes bus control logic132configured to drive communications over the bus110. The firmware protection module130also includes a command detection logic134configured to detect commands on the bus110and a restricted command/address storage136configured to store commands and memory addresses that are protected. The memory140stores firmware modules142and144, which may include instructions to enable the processor120to boot some version of an operating system.

In one example, the bus control logic132reads the bus110until the command detection logic134detects a message with a command and an indicator to a memory address that is noted as protected in the storage136. Once the command detection logic134detects a restricted command, the bus control logic132interrupts the command on the bus110, such that the restricted command does not reach the memory140.

In another example, the firmware module142may be a primary version of the firmware, which may be loaded during normal operations, and the firmware module144may be a backup version of the firmware. The primary firmware module142may be updated by the operating system while the operating system is running, but the backup firmware module144is stored at a protected address, and the operating system does not have the capability to access the backup firmware module144. For instance, the backup firmware module144may be write restricted to prevent overwriting all BIOS firmware in the computing device100. In this instance, the firmware protection module130prevents any prohibited write operations from being received by the protected address of the backup firmware module144.

In a further example, the firmware protection module130may implement a read restriction by allowing a restricted read command to reach the memory140at a protected address, but the returning data may be intercepted and prevented from reaching the source of the read command. For instance, the firmware protection module may prevent an operation system from reading secret key information that is only available to the bootloader.

Referring now toFIG.2, a simplified block diagram of a computing device200configured to implement a hybrid BIOS protection scheme is shown. The computing device200includes a Serial Peripheral Interface (SPI) bus210comprising a Master Output/Slave Input (MOSI) line212, a Master Input/Slave Output (MISO) line214, a clock line216, and a Chip Select (CS) line218. The SPI bus210is coupled to a Central Processor Unit (CPU)220comprising one or more processors configured to execute computer readable instructions. The CPU220includes a reset/power control module225configured to control the power cycle of the computing device200.

The SPI bus210is also coupled to a system control Field Programming Gate Array (FPGA)230that is configured to implement the hybrid BIOS protection scheme described herein. The SPI bus210is coupled to a primary boot flash memory240and a backup boot flash memory245through a multiplexer250. The multiplexer250is controlled by the system control FPGA230through a signal line252. The system control FPGA230includes boot control logic254configured to select which boot flash the multiplexer250connects to the SPI bus210. In other words, the boot control logic254in the system control FPGA230can control which version of the boot flash is connected to the CPU220by directing the multiplexer250to connect either the primary boot flash memory240or the backup boot flash memory245to the SPI bus210.

The system control FPGA230includes SPI frame decode logic260configured to read and decode SPI frames on the SPI bus210. The SPI frames may include a command and an indicator of a selected memory for the multiplexer250. The SPI frame decode logic260passes the decoded SPI frames from the SPI bus210to a command detection logic270, which compares detected commands to a set of blocked operations275to determine if the detected command may be prohibited. If the command detected by the command detection logic270is a blocked operation, the early frame termination logic280determines if the blocked command is directed to a protected address285. If a blocked operation275is directed to a protected address285, then the early frame termination logic280interrupts the CS line218of the SPI bus210, which prevents the remainder of the SPI frame from reaching the boot flash. Alternatively, the FPGA230may control the entire SPI bus210, allowing the FPGA to intercept the entire SPI frame before the frame reaches the multiplexer250.

The FPGA230monitors the clock, data, primary/backup select logic of the SPI bus210to be able to override the SPI CS line218. In one example, the FPGA230essentially commandeers the SPI CS multiplexer250, prohibiting the operating system from changing the CS line218to CS0, i.e., the address of the backup boot flash245. Alternatively, the FPGA230may control the entire SPI bus210and intercept the entire message. During normal operation, the computing device200boots the BIOS stored in the primary boot flash memory240and SPI CS1(i.e., the address of the primary boot flash memory240) is active on the multiplexer250. The operating system can directly write to the primary boot flash memory240unimpeded, which allows the BIOS to be updated without affecting the boot time. If a compromised operating system corrupts the BIOS stored in the primary boot flash memory240, then the backup boot flash will be active on the next power cycle.

In another example, the FPGA230protects the firmware in the backup boot flash245based on a configuration provided by the firmware. The FPGA230may also include a status register to indicate that the firmware protection scheme is supported, as well as which Application Programming Interface (API) version is supported. Additionally, the FPGA230may include a number of flash address range protection registers, e.g., five registers to match the number and format of a typical SPI architecture. The FPGA230may store a list of restricted SPI flash opcodes, as well as a write-once lock bit to enable firmware protection. Further, the FPGA230may store the address of the last blocked address and a count of the number of blocked accesses.

In a further example, the primary boot flash memory240and the backup boot flash245may be implemented as different address ranges in a single memory device. In this example, the FPGA230no longer needs to monitor the CS line218to selectively enforce certain sectors for write protection. Alternatively, the primary boot flash memory240and backup boot flash245may be implemented in parallel flash memories, e.g., with address/data multiplexers. In this alternative, the FPGA230may work with a latched address to interrupt the CS line218from reaching the boot flash memories. If the FPGA230has visibility into all address lines of the parallel memories, the FPGA230may interrupt the SPI CS line218in time to prevent rogue access to certain regions of the parallel memories. In order to detect erase/program commands, the FPGA230may monitor cycles of the data bus.

Referring now toFIG.3, with continued reference to elements fromFIG.2, a timing diagram300illustrates the signals on the SPI bus210when the system control FPGA230intercepts a prohibited operation to a protected address. The timing diagram300shows the four channels of the SPI bus210: MOSI line212sending data from the processor to the memory device, MISO line214sending data from the memory device to the processor, the clock line (CLK)216synchronizing the data signals between the processor and the memory device, and the CS line218which is normally high, but pulled low to perform an enable function connecting the processor and the memory device. For simplicity, the multiplexer250is not considered in this example.

Initially, the CS line218is driven low to enable communication between the processor and the memory device, and the clock signal216begins. During the initial segment, the processor sends a command310on the MOSI line212and the memory device sends a blank signal on the MISO line214. In one example, the command310may be a write command (e.g., opcode 0x06) that is prohibited for a certain range of addresses. In this example, the command310is followed by a three byte address320from the processor on the MOSI line212, and the memory device continues to send blank signals322,324, and326on the MISO line214. In one example, the address320(e.g., 0x208000) is a protected address.

Since the FPGA230is monitoring the SPI bus210for prohibited commands to protected addresses, the FPGA230interrupts the CS line218at330, sending the CS line218high and disabling the connection between the processor and the memory device. This prevents the rest of the message (e.g., starting with byte340) from reaching the memory device. The clock signal216continues until the bus master detects the fault (i.e., the clock signal216is running while the CS line218is high) and resets the bus210. Subsequently, the processor may drive the CS line218low again and begin sending command350to the memory device and receiving blank signal355from the memory device.

Referring now toFIG.4, a flowchart is shown depicting operations performed by a computing device (e.g., computing device100) in a process400to provide firmware protection. At410, a firmware protection module in the computing device intercepts a message from a processor to a memory. The message includes a command and an address corresponding to a firmware module stored in the memory. In one example, the address is an address of a sector in the memory device. Alternatively, the address may a selection of a particular memory device. At420, the firmware protection module determines whether the command is prohibited. In one example, the firmware protection device may be programmed to detect write and/or erase commands as prohibited for certain addresses.

At430, the firmware protection module determines whether the address in the intercepted message is a protected address. In one example, the firmware protection module may be programmed with a range of addresses (e.g., corresponding to the location of a backup version of a firmware module) that are protected from write and erase commands. At440, the firmware protection module prevents at least a portion of the message from reaching the memory, responsive to a determination that the command is prohibited and the address is protected. In one example, the firmware protection module may prevent the message from reaching the memory by interrupting an address line of the communications link (e.g., a SPI bus) between the processor and the memory device. Alternatively, the firmware protection module may interrupt the entire communications link, intercepting and preventing the entire message from reaching the memory

Referring now toFIG.5, a flowchart illustrates operations performed at a computing device to securely update a firmware module protected by the hybrid firmware protection scheme described herein. At510, the computing device receives an update for a firmware module. In one example, the update may include an updated image of the firmware code modules. At520, the computing device determines whether the update is directed toward a primary firmware module, and allows any updates that are directed to the primary firmware module at525. In one example, the primary firmware module may enable the computing device to boot into an operating system in normal operation.

Having determined that the update is not directed to the primary firmware module, i.e., it is directed to a backup firmware module, the computing device determines whether the backup memory storing the backup firmware module is protected at530. If the backup memory is write protected, then the computing device initiates a signed capsule update process at535. In one example, the signed update process comprises rebooting with the backup firmware, fetching the update as a signed update capsule, verifying the signature of the capsule, installing the update in the capsule to the backup firmware memory, and rebooting the computing device. Alternatively, if the computing device determines that the backup memory is not write protected, then the computing device allows the update to be directly written into the backup firmware memory at540. In one example, the backup firmware memory may be unprotected from write/erase commands if the backup firmware memory is a legacy memory device that does not support the capsule update process.

In summary, the hybrid firmware protection techniques described herein enable strict control of updates to a backup firmware module, without increasing boot time during updates to the primary firmware module. The backup firmware protection allows the backup firmware to be relatively infrequently updated to address extreme risks (e.g., Spectre/Meltdown exploits) while maintaining minimal impact for the relatively more frequent updates of the primary firmware under which a computing device typically operates. The techniques describe herein are processor agnostic, and do not rely on specific processor architecture features (e.g., x86 chipset protections) to provide firmware protection.

In particular examples, the hybrid firmware protection techniques described herein enable BIOS upgrades that provide the speed of direct BIOS updates while allowing the increased security of signed BIOS capsules. The use of inline logic (e.g., system control FPGA230) with a flexible policy to implement protection of SPI flash devices in a processor agnostic manner provides firmware protection for a wide range of CPUs, Baseboard Management Controllers (BMCs), and/or Advanced Reduced Instruction Set Computing (RISC) Machine (ARM)-based System-on-Chip (SoC) devices.

In one form, a method is provided for a computing device to implement a hybrid firmware protection scheme. The method comprises intercepting a message from a processor to a memory. The message includes a command and an address in the memory corresponding to a firmware module stored in the module. The method further includes determining whether the command in the message is prohibited and determining whether the address in the message is protected. Responsive to a determination that the command is prohibited and the address is protected, the method further includes preventing at least a portion of the message from reaching the memory.

In one form, the preventing operation comprises interrupting an address line between the processor and the memory, so as to prevent the address corresponding to the firmware module from reaching the memory. The message may be an SPI frame, and the preventing at least a portion of the message from reaching the memory may comprise interrupting a SPI Chip Select line of a SPI bus between the processor and the memory.

The firmware module may include one or more code modules enabling the processor to boot an operating system. In this case, the method may further include: updating the firmware module to generate an updated firmware module; and rebooting the operating system from the updated firmware module. Furthermore, the method may further include: responsive to a determination that the updated firmware module corrupted the operating system, rebooting the operating system from a backup firmware module stored at a protected address in the memory.

In one form, the method may further comprising: storing a backup firmware module at a protected address in the memory; and upgrading the backup firmware module based on a validated upgrade capsule.

In another form, an apparatus comprising a memory, a processor, and a firmware protection module is provided. The memory is configured to store a plurality of firmware modules. The processor is configured to access one or more of the plurality of firmware modules by sending a message to the memory. The message comprises a command and an address in the memory corresponding to a firmware module of the plurality of firmware modules. The firmware protection module is configured to intercept the message from the processor to the memory, determine whether the command is prohibited, and determine whether the address is protected. Responsive to a determination that the command is prohibited and the address is protected, the firmware protection module is configured to prevent at least a portion of the message from reaching the memory.

The firmware protection module may be configured to prevent at least a portion of the message from reaching the memory by interrupting an address line between the processor and the memory, so as to prevent the address corresponding to the firmware module from reaching the memory.

The processor may be further configured to: store a backup firmware module at a protected address in the memory; and upgrade the backup firmware module based on a validated upgrade capsule. The processor may be further configured to boot an operating system from one or more code modules in the firmware module. Furthermore, the processor may be further configured to: update the firmware module to generate an updated firmware module; and reboot the operating system from the updated firmware module.

The processor may be further configured to, responsive to a determination that the updated firmware module corrupted the operating system, reboot the operating system from a backup firmware module stored at a protected address in the memory.

In yet another form, an apparatus comprising a first memory, a second memory, a processor, a communications bus, and a firmware protection module is provided. The first memory is configured to store a primary firmware module. The second memory is configured to store a backup firmware module. The processor is configured to selectively access the primary firmware module or the backup firmware module. The communications bus is configured to communicatively couple the processor to the first memory and the second memory. The firmware protection module is configured to intercept the message from the processor to the memory. The message comprises a command and an indicator of a selected memory. The firmware protection module is also configured to determine whether the command is prohibited at the selected memory. Responsive to a determination that the command is prohibited at the selected memory, the firmware protection module is configured to interrupt the indicator to prevent at least a portion of the message from reaching the selected memory.

The processor may be further configured to upgrade the backup firmware module based on a validated upgrade capsule. The processor may be configured to boot an operating system from the primary firmware module in the first memory.

The above description is intended by way of example only. In particular, the techniques described herein have been described with respect to particular protocols (e.g., SPI), but may be applied to any inter-component communication system (e.g., Inter-Integrated Circuit (I2C)) for a computing device.