Platform Firmware Resiliency (PFR)

The Protection principle ensures that all updatable firmware and critical data are secured against unauthorized modification. This is achieved through cryptographic signature verification anchored in a Hardware Root of Trust (HRoT).

• Secure Boot: Each firmware stage validates the next before execution.
• Write Protection: Critical regions of SPI flash are locked via hardware mechanisms.
• Access Control: Only authenticated entities can initiate firmware updates. This establishes an immutable initial state that is inherently trusted.

The Detection principle mandates the ability to identify when platform firmware or critical data has been corrupted. This is not a one-time boot check but a continuous runtime monitoring process.

• Cryptographic Hashing: Firmware volumes are hashed and compared against known-good golden measurements stored in protected storage.
• Runtime Scanning: The PFR microcontroller periodically re-verifies the integrity of the SPI flash content while the system is operational.
• Alerting: Any detected mismatch immediately triggers a security policy violation alert to the baseboard management controller (BMC) or a central logging system.

The Recovery principle requires the platform to restore corrupted firmware to a known-good state without requiring manual intervention. This is the core of 'resiliency'.

• Golden Image Storage: A known-good, signed firmware image is kept in a protected, isolated flash region.
• Automatic Rollback: Upon detecting corruption, the PFR controller autonomously overwrites the compromised region with the golden image.
• Anti-Rollback Enforcement: Hardware fuses ensure the system cannot be recovered to an older, vulnerable firmware version, preventing downgrade attacks. This process ensures platform survivability even under active attack.

PFR relies on a Hardware Root of Trust (HRoT), which is fundamentally more secure than a firmware-based alternative.

• Hardware HRoT: An immutable, physically isolated microcontroller (e.g., a dedicated security processor) that executes its own ROM code. It is immune to host firmware corruption.
• Firmware RoT: A boot ROM in the main CPU. It is a single point of failure; if the CPU's initial boot code is compromised, the entire chain of trust collapses.
• PFR Implementation: A true PFR design uses an external HRoT to validate the main CPU's firmware before releasing the CPU from reset, providing a hardware-enforced trust boundary.

PFR directly addresses supply chain attacks where firmware is tampered with during manufacturing, transit, or provisioning.

• Secure Provisioning: The HRoT's unique device identity and initial firmware are injected in a cryptographically secure environment.
• Platform Certificate: A digital birth certificate, signed by the manufacturer, binds the platform identity to its components, enabling verification of provenance.
• Field Verification: An IT administrator can cryptographically verify that the platform's firmware matches the original, untampered bill of materials before deployment. This closes the gap between the silicon fab and the data center rack.

The latest PFR 2.0 specification expands the scope of protection beyond the CPU firmware to encompass the entire platform.

• Root of Trust Hub: A centralized security controller that manages attestation and recovery for multiple components, including the BMC, network interface cards (NICs), and storage backplanes.
• SPI Bus Monitoring: The HRoT actively filters and monitors traffic on the SPI bus to block unauthorized access to any managed flash component.
• Multi-Component Recovery: If a NIC's option ROM is corrupted, the PFR 2.0 hub can autonomously re-flash it from its protected golden image, ensuring holistic platform integrity.