Automated modular and secure boot firmware update
A method, apparatus, system, and computer program product for an automated modular and secure boot firmware update. An updated boot firmware code module is received in a secure partition of a system, the updated boot firmware code module to replace one original boot firmware code module for the system. Only the one original boot firmware code module is automatically replaced with the updated boot firmware code module. The updated boot firmware code module is automatically executed with the plurality of boot firmware code modules for the system and without user intervention when the system is next booted. The updated boot firmware code module may be written to an update partition of a firmware volume, wherein the update partition of the firmware volume is read along with another partition of the firmware volume containing the plurality of boot firmware code modules when the system is booted.
1. A computer-implemented method comprising:
sending an updated boot firmware code module to a secure partition implemented in a microprocessor of a system, the secure partition being isolated from a host operating system of the system, the updated boot firmware code module to automatically replace one original boot firmware code module of a plurality of boot firmware code modules stored in a different partition of the system, wherein only the one original boot firmware code module is replaced with the updated boot firmware code module and wherein the updated boot firmware code module is executed with the plurality of boot firmware code modules of the system when the system is next booted;
receiving a status from the secure partition of the system, the status indicating whether the system was successfully booted using the updated boot firmware code module; and
sending another version of the updated boot firmware code module to the secure partition of the system when the status indicates that the system was not successfully booted using the updated boot firmware code module.
2. The method of claim 1 , wherein the sending the updated boot firmware code module to the secure partition comprises sending the updated boot firmware code module in an encrypted signed manifest.
3. A computer program product comprising:
a non-transitory computer-readable storage medium; and
instructions in the computer-readable storage medium, wherein the instructions, when executed in a processing system, cause the processing system to perform operations comprising:
sending an updated boot firmware code module to a secure partition of the system, the secure partition being isolated from a host operating system of the system, the updated boot firmware code module to automatically replace one original boot firmware code module of a plurality of boot firmware code modules stored in a different partition of the system, wherein only the one original boot firmware code module is replaced with the updated boot firmware code module and wherein the updated boot firmware code module is executed with the plurality of boot firmware code modules of the system when the system is next booted;
receiving a status from the secure partition of the system, the status indicating whether the system was successfully booted using the updated boot firmware code module; and
sending another version of the updated boot firmware code module to the secure partition of the system when the status indicates that the system was not successfully booted using the updated boot firmware code module.
4. The computer program product of claim 3 , wherein the sending the updated boot firmware code module to the secure partition comprises sending the updated boot firmware code module in an encrypted signed manifest.
5. An enterprise service platform comprising:
at least one processor to execute an enterprise service; and
an update service partition coupled to the at least one processor, the update service partition to send an updated boot firmware code module to a secure partition of a system, the secure partition being isolated from a host operating system of the system, the updated boot firmware code module to automatically replace one original boot firmware code module of a plurality of boot firmware code modules stored in a different partition of the system, wherein only the one original boot firmware code module is to be replaced with the updated boot firmware code module and wherein the updated boot firmware code module is to be executed with the plurality of boot firmware code modules of the system when the system is next booted, the update service partition to receive a status from the secure partition of the system, the status indicating whether the system was successfully booted using the updated boot firmware code module, and
wherein the update service partition is to send another version of the updated boot firmware code module to the secure partition of the system when the status indicates that the system was not successfully booted using the updated boot firmware code module.
6. The platform of claim 5 , wherein send the updated boot firmware code module to the secure partition comprises sending the updated boot firmware code module in an encrypted signed manifest.