Pre-boot software verification
View Patent ↗Methods and systems for implementing pre-boot software verification may involve using an embedded controller (EC) and a basic input/output system (BIOS) to confirm each other's firmware using hash values. The hash values may be generated from certain portions of the firmware, which may overlap and may be specific to a particular firmware version.
1. A method, comprising:
sending, by a basic/input output system (BIOS) firmware included in an information handling system, a first request for a first hash value;
responsive to receiving the first request, computing, by an embedded controller (EC) firmware included in the information handling system, the first hash value;
sending, by the EC firmware, the first hash value to the BIOS firmware;
when the BIOS firmware determines that the first hash value matches a first reference hash value, sending, by the BIOS firmware, a first confirmation to the EC firmware that the first hash value is accepted;
responsive to receiving the first confirmation, sending, by the EC firmware, a second request for a second hash value;
responsive to receiving the second request, computing, by the BIOS firmware, the second hash value;
sending, by the BIOS firmware, the second hash value to the EC firmware; and
when the EC firmware determines that the second hash value matches a second reference hash value, sending, by the EC firmware, a second confirmation to the BIOS firmware that the second hash value is accepted.
2. The method of claim 1 , wherein the first request specifies a first memory range associated with the EC firmware for calculating the first hash value, and wherein the second request specifies a second memory range associated with the BIOS firmware for calculating the second hash value.
3. The method of claim 2 , wherein the first memory range and the second memory range are unique to both a first version of the EC firmware and a second version of the BIOS firmware.
4. The method of claim 2 , further comprising:
repeating sending, by the BIOS firmware, the first request specifying the first memory range, wherein each repeated first request specifies a different value for the first memory range; and
repeating sending, by the EC firmware, the second request specifying the second memory range, wherein each repeated second request specifies a different value for the second memory range.
5. The method of claim 4 , wherein the first memory range specified by a repeated first request overlaps with the first memory range specified by a previous first request, and wherein the second memory range specified by a repeated second request overlaps with the second memory range specified by a previous second request.
6. The method of claim 1 , wherein the first reference hash value is stored in a first file accessible to the BIOS firmware, and wherein the second reference hash value is stored in a second file accessible to the EC firmware.
7. The method of claim 1 , wherein the BIOS firmware is stored in a first non-volatile memory, and wherein the EC firmware is stored in a second non-volatile memory.
8. The method of claim 1 , further comprising:
responsive to receiving the second indication, booting the information handling system.
9. The method of claim 1 , when the BIOS firmware determines that the first hash value does not match the first reference hash value, or when the EC firmware determines that the second hash value does not match the second reference hash value, further comprising:
restricting access to a hardware component included in the information handling system.
10. The method of claim 9 , wherein the hardware component is selected from at least one of:
a network interface controller
a storage controller;
a system bus;
a memory device;
a storage device;
a camera; and
a microphone.
11. An information handling system, comprising:
a processor subsystem having access to a basic/input output system (BIOS) firmware, wherein the BIOS firmware includes first instructions executable by the processor subsystem; and
an embedded controller (EC) including a second processor having access to EC firmware, wherein the EC firmware includes second instructions executable by the second processor, wherein the first instructions and the second instructions are executable to:
send, by the BIOS firmware, a first request for a first hash value;
responsive to receiving the first request, compute, by the EC firmware, the first hash value;
send, by the EC firmware, the first hash value to the BIOS firmware;
when the BIOS firmware determines that the first hash value matches a first reference hash value, send, by the BIOS firmware, a first confirmation to the EC firmware that the first hash value is accepted;
responsive to receiving the first confirmation, send, by the EC firmware, a second request for a second hash value;
responsive to receiving the second request, compute, by the BIOS firmware, the second hash value;
send, by the BIOS firmware, the second hash value to the EC firmware; and
when the EC firmware determines that the second hash value matches a second reference hash value, send, by the EC firmware, a second confirmation to the BIOS firmware that the second hash value is accepted.
12. The information handling system of claim 11 , wherein the first request specifies a first memory range associated with the EC firmware for calculating the first hash value, and wherein the second request specifies a second memory range associated with the BIOS firmware for calculating the second hash value.
13. The information handling system of claim 12 , wherein the first memory range and the second memory range are unique to both a first version of the EC firmware and a second version of the BIOS firmware.
14. The information handling system of claim 12 , wherein the first instructions and the second instructions are further executable to:
repeat sending, by the BIOS firmware, the first request specifying the first memory range, wherein each repeated first request specifies a different value for the first memory range; and
repeat sending, by the EC firmware, the second request specifying the second memory range, wherein each repeated second request specifies a different value for the second memory range.
15. The information handling system of claim 14 , wherein the first memory range specified by a repeated first request overlaps with the first memory range specified by a previous first request, and wherein the second memory range specified by a repeated second request overlaps with the second memory range specified by a previous second request.
16. The information handling system of claim 11 , wherein the first reference hash value is stored in a first file accessible to the BIOS firmware, and wherein the second reference hash value is stored in a second file accessible to the EC firmware.
17. The information handling system of claim 11 , wherein the BIOS firmware is stored in a first non-volatile memory accessible to the processor subsystem, and wherein the EC firmware is stored in a second non-volatile memory accessible to the second processor.
18. The information handling system of claim 11 , further comprising first instructions to:
responsive to receiving the second indication, boot the information handling system.
19. The information handling system of claim 11 , when the BIOS firmware determines that the first hash value does not match the first reference hash value, or when the EC firmware determines that the second hash value does not match the second reference hash value, further comprising first instructions to:
restrict access to a hardware component included in the information handling system.
20. The information handling system of claim 19 , wherein the hardware component is selected from at least one of:
a network interface controller
a storage controller;
a system bus;
a memory device;
a storage device;
a camera; and
a microphone.