Live system updates
Various embodiments provide for the live updating of system software or firmware, such as BIOS information, without the need for a reboot. A payload containing BIOS update information can be generated and signed with an encryption key. The information in the payload is able to be updated through a live update, and can be selected in part based on the configuration and BIOS version of the computing device to be updated. Upon an update being triggered, a target device is placed into a management mode wherein normal work is suspended and the device is isolated. The payload is verified and decrypted, and appropriate functions called in order to update the relevant BIOS information. After the update is verified, the device exits management mode and resumes a typical workflow. If the update is not successful, or unable to be performed via live update, a conventional update can be performed that includes a reboot.
1. A method of performing a live update of a computing device, comprising:
determining a basic input/output system (BIOS) update to be performed for the computing device, the update involving data stored to unlocked registers on the computing device;
determining that the BIOS update involves data stored to unlocked registers on the computing device, based at least in part on whether the BIOS update requires a reboot or restart
of the computing device before the update can take effect;
generating a payload including the information for performing the BIOS update based upon state information for the computing device;
receiving a trigger to perform the update on the computing device;
analyzing the information to determine that the live update will not reauire altering data stored in a locked register on the computing device, based at least in part on whether the live update requires a reboot or restart of the computing device;
causing the computing device to enter a management mode wherein processing of user data is suspended and external access is restricted;
verifying the payload;
causing a function to be executed on the computing device in order to update corresponding BIOS data stored to the unlocked registers;
verifying accuracy and completeness of the update to the BIOS of the computing device; and
causing the computing device to exit the management mode and resume the processing of user data, whereby the BIOS update is performed on the computing device without requiring a reboot or restart of the computing device before the update can take effect.
2. The method of claim 1 , wherein the management mode is a System Management Mode (SMM).
3. The method of claim 1 , further comprising:
determining the state information for the computing device, the state information including operating system version, firmware version, computing device configuration, or BIOS version to be updated.
4. The method of claim 1 , further comprising:
utilizing a microemulator device as a root of trust for purposes of encrypting the payload, storing the encrypted payload to system memory, or generating the trigger to perform the BIOS update on the computing device.
5. The method of claim 1 , further comprising:
determining the function to be executed on the computing device in order to update the corresponding BIOS data, the function including a function for updating microcode, a function for overriding one or more I/O registers, a function for obtaining an initial version of the BIOS live update data, or a function for obtaining a chained hash of installed BIOS updates.
6. A computer-implemented method, comprising:
receiving an instruction to perform a live update of firmware for a computing device;
obtaining a payload including information for the live update to be performed with respect to the firmware;
analyzing the information to determine that the live update will not require altering data stored in a locked register on the computing device, based at least in part on whether the live update requires a reboot or restart of the computing device;
causing the computing device to enter a management mode in which at least some functionality is disabled;
verifying the information for the live update;
performing the live update of the firmware using the information of the payload; and
causing the computing device to exit the management mode and resume operation with updated firmware and without requiring a reboot or restart of the computing device.
7. The computer-implemented method of claim 6 , further comprising:
generating the instruction to perform the live update of the firmware.
8. The computer-implemented method of claim 6 , further comprising:
receiving information about a second update to be performed with respect to the firmware;
analyzing the second information to determine that the second update will alter data stored in a locked register on the computing device; and
causing the second update to be performed using an update process that involves a restart or reboot of the computing device.
9. The computer-implemented method of claim 6 , further comprising:
determining a scope for the live update;
determining state information for the computing device; and
generating the payload, wherein the information for the payload is determined in part using the scope and the state information for the computing device.
10. The computer-implemented method of claim 9 , further comprising:
determining the state information for the computing device, the state information including operating system version, firmware version, computing device configuration, or BIOS version to be updated.
11. The computer-implemented method of claim 6 , further comprising:
determining a current encryption key for a security management component; and
decrypting the payload using a current encryption key, or verifying a digital signature on the payload, before performing the live update.
12. The computer-implemented method of claim 6 , further comprising:
utilizing a microemulator device as a root of trust for purposes of encrypting the payload, storing the encrypted payload to system memory, and generating a trigger to perform the live update on the computing device.
13. The computer-implemented method of claim 6 , further comprising:
determining a function to be executed on the computing device in order to update the firmware via the live update, the function including a function for updating microcode, a function for overriding one or more I/O registers, a function for obtaining an initial version of the firmware live update data, or a function for obtaining a chained hash of installed firmware updates.
14. The computer-implemented method of claim 6 , wherein the firmware to be updated comprises BIOS data.
15. The computer-implemented method of claim 6 , further comprising:
restricting external access to the computing device while in the management mode.
16. A system, comprising:
at least one processor; and
memory including instructions that, when executed by the at least one processor, cause the system to:
receive an instruction to perform a live update of firmware for a computing device;
obtain a payload including information for the live update to be performed with respect to the firmware;
analyze the information to determine that the live update will not require altering data stored in a locked register on the computing device, based at least in part on whether the live update requires a reboot or restart of the computing device;
cause the computing device to enter a management mode in which at least some functionality is disabled;
verify the information for the live update;
perform the live update of the firmware according to the information of the payload; and
cause the computing device to exit the management mode and resume operation with updated firmware and without requiring a reboot or restart of the computing device.
17. The system of claim 16 , wherein the instructions when executed further cause the system to:
generate the instruction to perform the live update of the firmware.
18. The system of claim 16 , wherein the instructions when executed further cause the system to:
receive information about a second update to be performed with respect to the firmware;
analyze the second information to determine that the second update will alter data stored in a locked register on the computing device; and
cause the second update to be performed using an update process that involves a restart or reboot of the computing device.
19. The system of claim 16 , wherein the instructions when executed further cause the system to:
determine a scope for the live update;
determine state information for the computing device; and
generate the payload, wherein the information for the payload is determined in part using the scope and state information for the computing device, and wherein the state information includes of an operating system version, firmware version, computing device configuration, or BIOS version to be updated.
20. The system of claim 16 , wherein the instructions when executed further cause the system to:
decrypt the payload using a current encryption key or verify a digital signature on the payload before performing the live update.