Processsor integral technologies for BIOS flash attack protection and notification
A system and method for BIOS flash attack protection and notification. A processor initialization module, including initialization firmware verification module may be configured to execute first in response to a power on and/or reset and to verify initialization firmware stored in non-volatile memory in a processor package. The initialization firmware is configured to verify the BIOS. If the verification of the initialization firmware and/or the BIOS fails, the system is configured to select at least one of a plurality of responses including, but not limited to, preventing the BIOS from executing, initiating recovery, reporting the verification failure, halting, shutting down and/or allowing the BIOS to execute and an operating system (OS) to boot in a limited functionality mode.
1. A method for verifying a basic input/output system (BIOS) of a computing platform, the method comprising:
executing a processor initialization module in response to a reset, wherein the processor initialization module is included in a processor in the computing platform and the processor initialization module comprises an initialization firmware verification module;
attempting to verify initialization firmware stored in non-volatile memory in a processor package in the computing platform using the initialization firmware verification module;
attempting to verify the BIOS using the initialization firmware wherein the BIOS is included in a reprogrammable non-volatile memory; and
initiating at least one response if at least one of the initialization firmware and the BIOS fails to verify.
2. The method of claim 1 , further comprising passing control of the computing platform to the BIOS, wherein the at least one response comprises configuring the computing platform for operation in quarantine mode with limited platform functionality.
3. The method of claim 1 , wherein the at least one response is selected from a plurality of responses comprising preventing the initialization firmware from executing, preventing the BIOS from executing, initiating recovery, reporting the verification failure using a model-specific register, halting the processor, shutting down the computing platform and configuring the computing platform for operation in quarantine mode with limited platform functionality.
4. The method of claim 1 , further comprising updating the initialization firmware in response to a verification failure of the initialization firmware.
5. The method of claim 1 , wherein the at least one response comprises updating the BIOS over a network using out-of-band communication via a microprocessor subsystem of the computing platform.
6. The method of claim 1 , further comprising triggering execution of the initialization firmware verification module and the initialization firmware in response to writing a candidate BIOS firmware update to a model-specific register.
7. A computing platform comprising:
a processor package comprising:
a processor comprising processor initialization module wherein the processor initialization module comprises an initialization firmware verification module, and
an off-die non-volatile memory having initialization firmware stored therein; and
a reprogrammable non-volatile memory having basic input/output system (BIOS) firmware stored therein;
the processor configured to:
execute the processor initialization module in response to a reset of the computing platform,
attempt to verify the initialization firmware using the initialization firmware verification module,
attempt to verify the BIOS firmware using the initialization firmware and
initiate at least one response if at least one of the initialization firmware and the BIOS firmware fails verification.
8. The computing platform of claim 7 , wherein the processor is further configured to pass control of the computing platform to the BIOS and the at least one response comprises configuring the computing platform for operation in quarantine mode with limited platform functionality.
9. The computing platform of claim 7 , wherein the at least one response is selected from a plurality of responses comprising preventing the initialization firmware from executing, preventing the BIOS from executing, initiating recovery, reporting the verification failure using a model-specific register, halting the processor, shutting down the computing platform and configuring the computing platform for operation in quarantine mode with limited platform functionality.
10. The computing platform of claim 7 , wherein the processor is further configured to update the initialization firmware in response to a verification failure of the initialization firmware.
11. The computing platform of claim 7 , further comprising a microprocessor subsystem configured to update the BIOS firmware over a network using out-of-band communication.
12. The computing platform of claim 7 , further comprising a model-specific register wherein the processor is configured to execute the initialization firmware verification module and the initialization firmware in response to a candidate BIOS firmware being written to the model-specific register.
13. A non-transitory computer-readable medium including instructions stored thereon which, when executed by one or more processors, cause the one or more processors to perform operations comprising:
executing processor initialization module in response to a reset, wherein the processor initialization module is included in a processor in a computing platform and the processor initialization module comprises an initialization firmware verification module;
attempting to verify, using the initialization firmware verification module, initialization firmware configured to be stored in non-volatile memory in a processor package in the computing platform;
attempting to verify the BIOS using the initialization firmware wherein the BIOS is configured to be included in a reprogrammable non-volatile memory; and
initiating at least one response if at least one of the initialization firmware and the BIOS fails to verify.
14. The computer readable medium of claim 13 , wherein the operations further comprise passing control of the computing platform to the BIOS, wherein the at least one response comprises configuring the computing platform for operation in quarantine mode with limited platform functionality.
15. The computer readable medium of claim 13 , wherein the at least one response is selected from a plurality of responses comprising preventing the initialization firmware from executing, preventing the BIOS from executing, initiating recovery, reporting the verification failure using a model-specific register, halting the processor, shutting down the computing platform and configuring the computing platform for operation in quarantine mode with limited platform functionality.
16. The computer readable medium of claim 13 , wherein the operations further comprise updating the initialization firmware in response to a verification failure of the initialization firmware.
17. The computer readable medium of claim 13 , wherein said at least one response comprises updating the BIOS over a network using out-of-band communication via a microprocessor subsystem of the computing platform.
18. The computer readable medium of claim 13 , wherein the operations further comprise triggering execution of the initialization firmware verification module and the initialization firmware in response to writing a candidate BIOS firmware update to a model-specific register.