Firmware updates during limited time period
When providing a user with native access to at least a portion of device hardware, the user can be prevented from modifying firmware and other configuration information by controlling the mechanisms used to update that information. In some embodiments, an asymmetric keying approach can be used to encrypt or sign the firmware. In other cases access can be controlled by enabling firmware updates only through a channel or port that is not exposed to the customer, or by mapping only those portions of the hardware that are to be accessible to the user. In other embodiments, the user can be prevented from modifying firmware by only provisioning the user on a machine after an initial mutability period wherein firmware can be modified, such that the user never has access to a device when firmware can be updated. Combinations and variations of the above also can be used.
1. A computer-implemented method, comprising: under control of one or more computer systems configured with executable instructions,
providing a period of mutability for a host machine, wherein the length of the period of mutability is variable;
modifying the configuration information for the at least one device during the period of mutability;
providing non-virtualized direct memory access via a guest operating system on the host machine after the period of mutability; and
blocking the guest operating system from modifying configuration information for at least one device of the host machine after the period of mutability.
2. The computer-implemented method of claim 1 , further comprising:
triggering a secure clock configured to determine the period of mutability.
3. The computer-implemented method of claim 1 , further comprising:
utilizing a discovery protocol for the at least one device to determine a length of the period of mutability.
4. The computer-implemented method of claim 1 , further comprising:
applying at least one policy defining a length of the period of mutability.
5. The computer-implemented method of claim 1 , further comprising:
extending a network booting protocol to include tags specifying a length of the period of mutability.
6. The computer-implemented method of claim 1 , further comprising:
triggering the period of mutability through a secure channel.
7. The computer-implemented method of claim 1 , wherein blocking the guest operating system includes triggering a hardware-based access control to prevent access to a configuration subsystem.
8. A system, comprising:
a processor; and
non-transitory memory including instructions that, upon being executed by the processor, cause the system to:
provide a period of mutability for a host machine, wherein the length of the period of mutability is variable;
modify configuration information for at least one device during the period of mutability;
provide non-virtualized direct memory access via a guest operating system on the host machine after the period of mutability; and
block the guest operating system from modifying the configuration information for the at least one device after the period of mutability.
9. The system of claim 8 , wherein a length of the period of mutability is specified in hardware on the host machine.
10. The system of claim 8 , wherein a length of the period of mutability is configurable by an external source.
11. The system of claim 8 , wherein the period of mutability can vary between multiple hardware devices on the host machine.
12. The system of claim 8 , wherein the configuration information comprises firmware for the at least one device.
13. The system of claim 8 , wherein the instructions, upon being executed, further cause the system to:
suspend a clock for determining the period of mutability via a physical switch on the at least one device.
14. A non-transitory computer readable storage medium storing instructions that, upon being executed by a processor, cause the processor to: provide a period of mutability for a host machine, wherein the length of the period of mutability is variable;
modify configuration information for at least one device during the period of mutability;
provide non-virtualized direct memory access via a guest operating system on the host machine after the period of mutability; and
block the guest operating system from modifying the configuration information for the at least one device after the period of mutability.
15. The non-transitory computer readable storage medium of claim 14 , wherein the instructions, upon being executed, further cause the processor to:
trigger a secure clock configured to determine the period of mutability.
16. The non-transitory computer readable storage medium of claim 14 , wherein the instructions, upon being executed, further cause the processor to perform at least one of:
utilizing a discovery protocol for the at least one device to determine a length of the period of mutability;
applying at least one policy defining the length of the period of mutability; or
extending a network booting protocol to include tags specifying the length of the period of mutability.
17. The non-transitory computer readable storage medium of claim 14 , wherein a length of the period of mutability is specified in hardware on the host machine or configurable by an external source.
18. The non-transitory computer readable storage medium of claim 14 , wherein the instructions, upon being executed, further cause the processor to:
trigger the period of mutability through a secure channel.
19. The non-transitory computer readable storage medium of claim 18 , wherein the secure channel comprises a physical switch on the at least one device.