Firmware security patch deployment
Technologies for receiving and using alternate firmware files of a computer are described herein. In some examples, firmware files to be used instead of currently used firmware files are stored in a firmware volume, which is stored in a UEFI partition. A flag is set indicating the presence of a firmware volume containing the alternate firmware files. At boot time, if it is determined that the flag has been set, the computer will utilize files stored in the firmware volume stored in the UEFI partition rather than corresponding files in a firmware.
1. A computer-implemented method, comprising:
at a boot time of a computer, determining if a flag has been set indicating that the computer has received one or more volume of files comprising at least one update file for replacing at least one firmware file of a firmware volume of installed computer firmware; and
in response to determining that the flag has been set,
copying, the volume of files, to a computer memory;
copying the installed computer firmware to the computer memory; and
booting the computer from the computer memory using the volume of files and the installed computer firmware, wherein the booting utilizes the at least one update file instead of the at least one firmware file.
2. The computer-implemented method of claim 1 , further comprising:
prior to booting the computer, receiving the volume of files;
storing the volume of files in a Unified Extensible Firmware Interface (UEFI) partition; and
setting the flag indicating that the computer has received the volume of files, wherein the flag further indicates that the volume of files has been stored in the UEFI partition.
3. The computer-implemented method of claim 2 , further comprising, in response to determining that the flag has been set, marking the at least one firmware file corresponding to the at least one update file as deleted.
4. The computer-implemented method of claim 1 , further comprising
providing a selectable list of the at least one update file to be utilized by the computer; and
receiving a selection indicative of the at least one update file; and
booting the computer based on the selection indicative of the at least one update file.
5. The computer-implemented method of claim 1 , further comprising receiving the volume of files from a service through a push operation from the service.
6. The computer-implemented method of claim 1 , further comprising receiving the volume of files from a service through a pull operation responsive to a request generated by the computer.
7. The computer-implemented method of claim 1 , further comprising receiving an input to override the flag to deselect a file of the volume of files received.
8. A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a computer, cause the computer to:
at a boot time of a computer, determine if a flag has been set indicating that the computer has received one or more volume of files comprising at least one update file for replacing at least one firmware file of a firmware volume of installed computer firmware; and
in response to determining that the flag has been set,
copy the volume of files to a computer memory, wherein the volume of files comprises at least one update file configured to update at least one firmware file of the installed computer firmware;
copy, to the computer memory, the installed computer firmware; and
boot the computer from the computer memory using the volume of files and the installed computer firmware, wherein the booting utilizes the at least one update file instead of the at least one firmware file.
9. The computer-readable storage medium of claim 8 , comprising further computer-executable instructions to:
receive the volume of files;
store the volume of files in a Unified Extensible Firmware Interface (UEFI) partition; and
set the flag indicating that the computer has received the volume of files, wherein the flag further indicates that the volume of files has been stored in the UEFI partition.
10. The computer-readable storage medium of claim 9 , comprising further computer-executable instructions to, in response to determining that the flag has been set, marking the at least one firmware file corresponding to the at least one update file as deleted.
11. The computer-readable storage medium of claim 8 , comprising further computer-executable instructions to:
provide a selectable list of the at least one update file to be utilized by the computer; and
receive a selection indicative of the at least one update file from the at least one firmware update file, and booting the computer based on the selection of the at least one update file.
12. The computer-readable storage medium of claim 8 , comprising further computer-executable instructions to:
receive the volume of files from a service through a push operation from the service.
13. The computer-readable storage medium of claim 8 , comprising further computer-executable instructions to:
receive the volume of files from a service through a pull operation initiated in response to a request generated by the computer.
14. The computer-readable storage medium of claim 8 , comprising further computer-executable instructions to:
receive an input to override the flag to deselect a file of the volume of files received.
15. A computer, comprising:
a processor; and
a computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by the processor, cause the apparatus to:
receive one or more volume of files comprising at least one update file for replacing at least one firmware file of a firmware volume of installed computer firmware
store the volume of files in a Unified Extensible Firmware Interface (UEFI) partition;
set a flag indicating the volume of files has been stored in a UEFI partition;
at a boot time of the computer,
determine if the flag has been set;
in response to determining that the flag has been set, copying the volume of files to a computer memory;
copying the installed computer firmware to the computer memory; and
booting the computer from the computer memory using the volume of files and the installed computer firmware instead of the at least one firmware file.
16. The computer of claim 15 , wherein the computer-readable storage medium comprises further computer-executable instructions to, in response to determining that the flag has been set, mark the at least one firmware file corresponding to the at least one update file as deleted.
17. The computer of claim 15 , wherein the computer-readable storage medium comprises further computer-executable instructions to:
provide a selectable list of the firmware update files to be used by the firmware; and
receive a selection indicative of the at least one update file, and boot the computer based on the selection of the at least one update file.
18. The computer of claim 15 , wherein the computer-readable storage medium comprises further computer-executable instructions to receive the volume of files from a service through a push operation from the service.
19. The computer of claim 15 , wherein the computer-readable storage medium comprises further comprising computer-executable instructions to receive the volume of files from a service through a pull operation initiated in response to a request generated the computer.
20. The computer of claim 15 , wherein the computer-readable storage medium comprises further computer-executable instructions to receive an input to boot the computer utilizing the at least one firmware file and not the at least one update file based on the input to override the flag.