Firmware

Embedded Systems; Software Engineering; System-Level Programming

Firmware occupies a position in between hardware, which is fixed and physically unchanging, and software, which has no physical form apart from the media it is stored on. Firmware is stored in nonvolatile memory in a computer or device so that it is always available when the device is powered on. An example can be seen in the firmware of a digital watch, which remains in place even when the battery is removed and later replaced.

Many consumer devices have become so complex that they need a basic computer to operate them. However, they do not need a fully featured computer with an operating system (OS) and specially designed software. The answer to this need is to use embedded systems. These systems are installed on microchips inside devices as simple as children's toys and as complex as medical devices such as digital thermometers. The term “embedded” is used because the chips containing firmware are ordinarily not directly accessible to consumers. They are installed within the device or system and expected to work throughout its lifespan.

Computers also use firmware, which is called the “basic input/output system,” or BIOS. Even though the computer has its own OS installed and numerous programs to accomplish more specific tasks, there is still a need for firmware. This is because, when the computer is powered on, some part of it must be immediately able to tell the system what to do in order to set itself up. The computer must be told to check the part of the hard drive that contains the start-up sequence, then to load the OS, and so on. The firmware serves this purpose because, as soon as electric current flows into the system, the information stored in the computer's nonvolatile memory is loaded and its instructions are executed. Firmware is usually unaffected even when a different OS is installed. However, the user can also configure the BIOS to some extent and can boot the computer into the BIOS to make changes when necessary. For example, a computer that is configured to boot from the CD-ROM drive first could have this changed in the BIOS so that it would first attempt to read information from an attached USB drive.

Sophisticated users of technology sometimes find that the firmware installed by a manufacturer does not meet all of their needs. When this occurs, it is possible to update the BIOS through a process known as flashing. When the firmware is flashed, it is replaced by a new version, usually with new capabilities. In some cases, the firmware is flashed because the device manufacturer has updated it with a new version. This is rarely done, as firmware functionality is so basic to the operation of the device that it is thoroughly tested prior to release. From time to time, however, security vulnerabilities or other software bugs are found in firmware. Manufacturers helping customers with troubleshooting often recommend using the latest firmware to rule out such defects.

One of the market segments that has become increasingly reliant on firmware is automobile manufacturing. More and more functions in cars are now controlled by firmware. Not only are the speedometer and fuel gauge computer displays driven by firmware, but cars come with firmware applications for music players, real-time navigation and map display, and interfaces with passengers' cell phones.

Although firmware is not very visible to users, it has still been a topic of concern for computer security professionals. With homebrew firmware distributed over the Internet, the concern is that the firmware may contain “backdoors.” A backdoor is a secret means of conveying the user's personal information to unauthorized parties. Even with firmware from official sources, some worry that it would be possible for the government or the device manufacturer to include security vulnerabilities, whether deliberate or inadvertent.

—Scott Zimmer, JD