AMI Firmware Utility (AFU), a Secure Update Utility for Aptio V UEFI BIOS Firmware
AMI Firmware Utility (AFU) is a versatile firmware update utility. It initiates firmware update requests that are processed by system firmware, therefore, robustness of the firmware update process, to a large degree, is defined by the properties of the underlying firmware. Coupled with a modern system firmware (a.k.a. BIOS), AFU delivers robust firmware update experience. Modern system firmware is a firmware that has up-to-date security improvements and is in compliance with the relevant industry specifications like UEFI and ACPI. While AFU still supports updating legacy BIOSes, AFU does not use the legacy update method for updating modern BIOSes but instead enforces firmware update security employing best practices defined by the UEFI specifications.
AMI supports multiple firmware update mechanisms including firmware update via operating system (OS)-based services such as Microsoft® Windows® UEFI firmware update platform and Linux® Vendor Firmware Service. The OS-based firmware update services are built on top of interfaces defined by the UEFI specification. Specifically, they use EFI System Resource Table and UpdateCapsule runtime service, which are fully supported by AMI.
Historically flash utility has provided many more features to OEMs and ODMs in respect to what a basic UpdateCapsule service can do.
AMI has also implemented these same features through the UpdateCapsule methodology.
AMI is continuing to support the requirements of hardware vendors to provide BIOS update tools and it has hardened such tools and SMI handlers in order to avoid misuse of SW SMI calls.
Aptio provides support for strict limitations of the physical memory accessible to user mode applications and kernel drivers for System Management Mode (SMM) communication. This ensures that the memory used by AFU is limited to memory allocated by the BIOS. BIOS SMI handlers themselves have been hardened and prohibit the use of any other memory locations for communication to the SMM, making it impossible to either tamper with OS managed memory or SMRAM. For this reason, it is impossible to inject any executable code into SMM once SMRAM has been locked before booting to the OS. Therefore, making it impossible for an OS application to implant rogue code into SMM.
This methodology requires the usage of a modern BIOS, which is properly updated to make use of such SMM techniques.
AFU still supports older SMM methodologies for older systems, but such methodologies cannot be used when the platform is equipped with modern BIOSes.
Therefore, through the usage of such driver and modern SMI handlers, it is blocking any writes into SMRAM, Serial Peripheral Interface (SPI) chip, or anywhere outside of the SMM communication buffer as well as any exploitation of BIOS services to otherwise tamper the memory of the platform.
In addition, Aptio provides Secure Flash, which uses cryptographically signed data to ensure that only valid BIOS images for such platform may be flashed onto the SPI chip.
Thanks for reading today’s Tech Blog! We would love to hear your thoughts in the comments section below, as well as suggestions on any other AMI products you would like us to spotlight in future blog posts!