Blocking runtime firmware variable access
Technologies are disclosed herein for blocking access to some firmware variables during runtime. These firmware variables may be disallowed from runtime access (e.g., read/write access), by placing an indication of the firmware variables on a runtime blocklist. Upon completion of booting, runtime firmware services may access the runtime blocklist to determine if a firmware variable is to be accessed during runtime. In some cases, a firmware variable may be disallowed from runtime access by inclusion in the runtime blocklist, even if that firmware variable has an attribute that indicates that it is runtime accessible. The runtime blocklist may be generated based at least in part on indications of the firmware variables to be blocked during runtime. Additionally, runtime accessible firmware variables may be exposed to higher-level software, such as an O/S, if the firmware variables are not included in the runtime blocklist.
1. A computer-implemented method, comprising:
receiving, by one or more processors, a first request to access a first firmware variable during runtime of a computing device, the first request comprising a first firmware variable identifier corresponding to the first firmware variable;
determining, responsive to the first request, whether a table associated with the computing device indicates that access to the firmware variable is permitted during runtime;
responsive to determining that the table associated with the computing device indicates that access to the first firmware variable is permitted during runtime, determining that the first firmware variable identifier is included in a runtime blocklist; and
blocking access to the first firmware variable during runtime, responsive to determining that the first firmware variable identifier is included in the runtime blocklist.
2. The method of claim 1 , wherein the first firmware variable has a corresponding first runtime attribute set.
3. The method of claim 1 , wherein the one or more processors are operating in runtime under control of an operating system.
4. The method of claim 1 , wherein the runtime blocklist is retrieved from a non-volatile memory accessible to the one or more processors.
5. The method of claim 1 , further comprising:
receiving, by the one or more processors, a second request to access a second firmware variable, the second request including a second firmware variable identifier corresponding to the second firmware variable;
determining that the second firmware variable identifier is not included in the runtime blocklist;
determining, based at least in part on the second firmware variable identifier not being included in the runtime blocklist, that the second request is to be performed; and
accessing the second firmware variable responsive to determining that the second request is to be performed.
6. The method of claim 5 , wherein the determining that the second request is to be performed is further based at least in part on determining that the second firmware variable has a second runtime attribute set.
7. The method of claim 1 , further comprising:
receiving, by the one or more processors, a second request to access a second firmware variable; and
accessing the second firmware variable, wherein the one or more processors are operating in a boot-up mode.
8. An apparatus, comprising:
at least one processor; and
a computer-readable storage medium having instructions stored thereupon that are executable by the processor and which, when executed by the processor, cause the apparatus to:
receive a first request to access a first firmware variable during runtime of a computing device, the first request including a first firmware variable identifier corresponding to the first firmware variable;
determine, responsive to the first request, whether a table associated with the computing device indicates that access to the firmware variable is permitted during runtime;
responsive to determining that the table associated with the computing device indicates that access to the first firmware variable is permitted during runtime, determine that the first firmware variable identifier is included in a runtime blocklist; and
block access to the first firmware variable during runtime, responsive to determining that the first firmware variable identifier is in the runtime blocklist.
9. The apparatus of claim 8 , wherein the first firmware variable has a corresponding first runtime attribute set.
10. The apparatus of claim 8 , wherein the apparatus is operating in runtime under control of an operating system.
11. The apparatus of claim 8 , wherein the computer-readable storage medium has further instructions stored thereupon to:
receive a second request to access a second firmware variable, the second request including a second firmware variable identifier corresponding to the second firmware variable;
determine that the second firmware variable identifier is not included in the runtime blocklist;
determine, based at least in part on the second firmware variable identifier not being included in the runtime blocklist, that the second request is to be performed; and
access the second firmware variable responsive to determining that the second request is to be performed.
12. The apparatus of claim 11 , wherein to determine that the second request is to be performed is further based at least in part on determining that the second firmware variable has a second runtime attribute set.
13. The apparatus of claim 8 , wherein the computer-readable storage medium has further instructions stored thereupon to:
receive a second request to access a second firmware variable;
determine that a second runtime attribute corresponding to the second firmware variable is not set; and
block access to the second firmware variable responsive to the second runtime attribute not being set.
14. The apparatus of claim 8 , wherein the computer-readable storage medium has further instructions stored thereupon to:
receive a second request to access a second firmware variable; and
access the second firmware variable, wherein the processor is operating in a boot-up mode.
15. A non-transitory computer-readable storage medium having instructions stored thereupon which, when executed by a processor, cause the processor to:
receive a first request to access a first firmware variable during runtime of a computing device, the first request including a first firmware variable identifier corresponding to the first firmware variable;
determine, responsive to the first request, whether a table associated with the computing device indicates that access to the firmware variable is permitted during runtime;
responsive to determining that the table associated with the computing device indicates that access to the first firmware variable is permitted during runtime, determine that the first firmware variable identifier is not included in a runtime blocklist;
determine, based at least in part on the first firmware variable identifier not being included in the runtime blocklist, that the first firmware variable is accessible while the processor is operating during runtime; and
provide access to the first firmware variable during the runtime.
16. The non-transitory computer-readable storage medium of claim 15 , wherein providing the access to the first firmware variable comprises accessing a value of the first firmware variable.
17. The non-transitory computer-readable storage medium of claim 15 , wherein determining that the first firmware variable is accessible while the processor is operating during runtime further comprises the processor determining that the first firmware variable has a corresponding first runtime attribute set.
18. The non-transitory computer-readable storage medium of claim 15 , having further computer-readable instructions stored thereupon to:
receive a second request to access a second firmware variable, the second request including a second firmware variable identifier corresponding to the second firmware variable;
determine that the second firmware variable identifier is included in the runtime blocklist; and
block access to the second firmware variable responsive to determining that the second firmware variable is included in the runtime blocklist.
19. The non-transitory computer-readable storage medium of claim 18 , wherein the second firmware variable has a corresponding second runtime attribute set.
20. The non-transitory computer-readable storage medium of claim 15 , having further computer-readable instructions stored thereupon to:
receive a second request to access a second firmware variable, the second request including a second firmware variable identifier corresponding to the second firmware variable;
determine that the second firmware variable does not have a corresponding second runtime attribute set; and
block access to the second firmware variable responsive to determining that the second runtime attribute is not set.