Firmware validation for firmware updates

1 . An apparatus, comprising:

a controller of a memory module coupled to a number of memory devices of the memory module and configured to, in association with a firmware update of the memory module:

determine whether a public key of a manifest of a firmware package is valid using a different public key stored by a non-volatile memory device of the memory module;

determine whether a signature of the manifest of the firmware package is valid using the public key;

determine whether first security information and first customer information of manifest of the firmware package are valid using second security information and second customer information, respectively, stored by the non-volatile memory device of the memory module;

determine whether a first public key of a first image of the firmware package is valid using a second public key of the manifest corresponding to the first image and associated with the first security information and the first customer information; and

determine whether a third public key of a second image of the firmware package is valid using a fourth public key of the manifest corresponding to the second image and associated with the first security information and the first customer information.

2 . The apparatus of claim 1 , wherein the controller is configured to validate a signature of the manifest prior to determining whether the first security information and the first customer information of the manifest are valid.

3 . The apparatus of claim 1 , wherein the controller is further configured to prevent the firmware update in response to a determination that the first security information or the first customer information is invalid.

4 . The apparatus of claim 1 , wherein the controller is further configured to determine whether the first and third public keys are valid in response to a determination that the first security information and the first customer information are valid.

5 . The apparatus of claim 1 , wherein the controller is further configured to prevent the firmware update in response to a determination that the first public key or the third public key is invalid.

6 . The apparatus of claim 1 , wherein the controller is further configured to, in association with a subsequent firmware update of the number of memory devices:

determine whether different first security information and different first customer information of a different manifest of a different firmware package is valid using the second security information and second customer information, respectively;

determine whether a fifth public key of a third image of the different firmware package is valid using a sixth public key of the different manifest corresponding to the third image and associated with the different first security information and the different first customer information; and

determine whether a seventh public key of a fourth image of the different firmware package is valid using an eighth public key corresponding to the fourth image and associated with the different first security information and the different first customer information.

7 . The apparatus of claim 1 , wherein the controller and the number of memory devices are components of a Compute Express Link (CXL) compliant memory system.

8 . The apparatus of claim 1 , wherein the second security information comprises a value of a monotonic counter, and wherein the controller is further configured to update the value of the monotonic counter in response to receiving the firmware package, wherein updating the value of monotonic counter includes blowing eFuses.

9 . A method, comprising:

receiving, by a controller of a memory module coupled to a non-volatile memory device of the memory module, a firmware package comprising a plurality of images;

determining, by the controller, whether a first plurality of public keys of the plurality of images of the firmware package are valid using a second plurality of public keys of a manifest of the firmware package corresponding to the plurality of images, wherein the first plurality of public keys are associated with a Firmware Security Version (FSV) and a Firmware Customer Identification (FCID) of the manifest of the firmware package; and

preventing, by the controller, a firmware update of the memory module using the firmware package in response to determining that at least one public key of the first plurality is invalid.

10 . The method of claim 9 , further comprising:

receiving, by the controller, a different firmware package comprising a different plurality of images;

determining, by the controller, whether a third plurality of public keys of the different plurality of images are valid using a fourth plurality of public keys of a different manifest of the different firmware package corresponding to the different plurality of images, and

wherein the first and second pluralities of public keys are different from the third and fourth pluralities of public keys; and

preventing, by the controller, a different firmware update of the memory module using the different firmware package in response to determining that at least one public key of the third plurality is invalid.

11 . The method of claim 9 , further comprising:

determining, by the controller, whether the FSV and the FCID of the manifest of the firmware package is valid using a Device Security Version (DSV) and a Device Customer Identification (DCID), respectively, stored by the non-volatile memory device; and

preventing, by the controller, the firmware update in response to determining that the FSV and the FCID of the firmware package is invalid.

12 . The method of claim 11 , wherein the first and second pluralities of public keys are associated with the FSV and the FCID.

13 . The method of claim 11 , further comprising:

receiving, by the controller, a different firmware package; and

determining, by the controller, whether a different FSV and a different FCID of a different manifest of the different firmware package is valid using the DSV and the DCID, respectively.

14 . The method of claim 13 , further comprising preventing, by the controller, a different firmware update of the memory module using the different firmware package in response to determining that the different FSV or the different FCID is invalid.

15 . The method of claim 9 , further comprising, prior to determining whether the first plurality of public keys are valid:

determining, by the controller, whether a manifest verification key (MVK) of the manifest is valid; and

responsive to determining that the MVK is valid, using the MVK to determine whether a signature of the manifest is valid.

16 . A non-transitory medium storing instructions executable by a processing device to:

validate respective public keys of a plurality of images of a firmware package using a corresponding plurality of public keys of a manifest of the firmware package, wherein the respective public keys are associated with a Firmware Security Version (FSV) and a Firmware Customer Identification (FCID) of the manifest of the firmware package; and

responsive to at least one of the respective public keys of the plurality of images being valid, performing a firmware update of a memory module using the plurality of images.

17 . The medium of claim 16 , further storing instructions executable to, responsive to at least one of the respective public keys of the plurality of images being invalid, prevent the firmware update using the plurality of images.

18 . The medium of claim 16 , further storing instructions executable to, responsive to receipt of the firmware package by the memory module, validate a manifest verification key (MVK) of the manifest.

19 . The medium of claim 18 , further storing instructions executable to, responsive to the MVK being valid:

validate the FSV of the manifest of the firmware package; and

validate the FCID of the manifest.

20 . The medium of claim 19 , further storing instructions executable to:

responsive to the FSV and the FCID being valid, initiate validation of the respective public keys of the plurality of images; and

responsive to the FSV or the FCID being invalid, prevent performance of the firmware update.