System and method for managing update installation lockdown policies for firmware devices and driver-managed devices
A method for managing a resource system includes obtaining, by a hardware resource manager, a firmware update lockdown request for a lockdown for a firmware device of the resource system, in response to the firmware update lockdown request: identifying a firmware protocol corresponding to the firmware device, generating a firmware lockdown command corresponding to the firmware device based on the firmware protocol, and initiating updating of a lockdown policy based on the firmware lockdown command.
1. A method for managing a resource system, the method comprising:
obtaining, by a hardware resource manager, a firmware update lockdown request for a lockdown for a first firmware device and a second firmware device of the resource system, wherein the hardware resource manager operates in a first computing device;
in response to the firmware update lockdown request:
identifying, based on first firmware operating on the first firmware device, a firmware protocol corresponding to the first firmware device, wherein the first firmware device is operatively connected to the computing device;
identifying, based on second firmware operating on the second firmware device, a second firmware protocol corresponding to the second firmware device, wherein the computing device comprises the second firmware device;
in parallel:
generating a first firmware lockdown command corresponding to the first firmware device based on the first firmware protocol; and
generating a second firmware lockdown command corresponding to the second firmware device based on the second firmware protocol;
in parallel:
sending, to the first firmware device, the first firmware lockdown command, wherein the first firmware device operates using a firmware management protocol (FMP), wherein the first firmware lockdown command is an FMP command that specifies updating a firmware lockdown policy of the first firmware device to specify a lockdown mode of a hardware device in the first firmware device, and wherein the first firmware device executes the first firmware lockdown command; and
sending, to the second firmware device, the second firmware lockdown command, wherein the second firmware device operates using a platform-level data model (PLDM) protocol, wherein the second firmware lockdown command is a PLDM command that specifies obtaining firmware parameters of the second firmware device for specifying a lockdown of a hardware device in the second firmware device, and wherein the second firmware device executes the second firmware lockdown command;
initiating updating the lockdown policies, wherein the lockdown policies are updated at the first and second devices based on the first firmware lockdown command and the second firmware lockdown command.
2. The method of claim 1 , further comprising:
obtaining, by the hardware resource manager, a driver update lockdown policy request for a driver-managed device of the resource system; in response to the driver update lockdown policy request:
identifying a set of hardware resources managed by the driver-managed device; and initiating an installation prevention for the set of hardware resources.
3. The method of claim 2 , wherein initiating the installation prevention comprises sending an installation prevention request to a device driver of the driver-managed device.
4. The method of claim 3 , wherein the installation prevention request specifies preventing an operating system of the driver-managed device from automatically updating.
5. A non-transitory computer readable medium comprising computer readable program code, which when executed by a computer processor enables the computer processor to perform a method for managing a resource system, the method comprising:
obtaining, by a hardware resource manager, a firmware update lockdown request for a lockdown for a first firmware device and a second firmware device, wherein the hardware resource manager operates in a first computing device;
in response to the firmware update lockdown request:
identifying, based on first firmware operating on the first firmware device, a firmware protocol corresponding to the first firmware device, wherein the first firmware device is operatively connected to the computing device;
identifying, based on second firmware operating on the second firmware device, a second firmware protocol corresponding to the second firmware device, wherein the computing device comprises the second firmware device;
in parallel:
generating a first firmware lockdown command corresponding to the first firmware device based on the first firmware protocol; and
generating a second firmware lockdown command corresponding to the second firmware device based on the second firmware protocol;
in parallel:
sending, to the first firmware device, the first firmware lockdown command, wherein the first firmware device operates using a firmware management protocol (FMP), wherein the first firmware lockdown command is an FMP command that specifies updating a firmware lockdown policy of the first firmware device to specify a lockdown mode of a hardware device in the first firmware device, and wherein the first firmware device executes the first firmware lockdown command; and
sending, to the second firmware device, the second firmware lockdown command, wherein the second firmware device operates using a platform-level data model (PLDM) protocol, wherein the second firmware lockdown command is a PLDM command that specifies obtaining firmware parameters of the second firmware device for specifying a lockdown of a hardware device in the second firmware device, and wherein the second firmware device executes the second firmware lockdown command;
initiating updating the lockdown policies, wherein the lockdown policies are updated at the first and second devices based on the first firmware lockdown command and the second firmware lockdown command.
6. The non-transitory computer readable medium of claim 5 , the method further comprising:
obtaining, by the hardware resource manager, a driver update lockdown policy request for a driver-managed device;
in response to the driver update lockdown policy request: identifying a set of hardware resources managed by the driver-managed device; and initiating an installation prevention for the set of hardware resources.
7. The non-transitory computer readable medium of claim 6 , wherein initiating the installation prevention comprises sending an installation prevention request to a device driver of the driver-managed device.
8. The non-transitory computer readable medium of claim 7 , wherein the installation prevention request specifies preventing an operating system of the driver-managed device from automatically updating.
9. A system comprising:
a processor; and
memory comprising instructions, which when executed by the processor, perform a method comprising:
obtaining, by a hardware resource manager, a firmware update lockdown request for a lockdown for a first firmware device and a second firmware device, wherein the hardware resource manager operates in a first computing device;
in response to the firmware update lockdown request:
identifying, based on first firmware operating on the first firmware device, a firmware protocol corresponding to the first firmware device, wherein the first firmware device is operatively connected to the computing device;
identifying, based on second firmware operating on the second firmware device, a second firmware protocol corresponding to the second firmware device, wherein the computing device comprises the second firmware device;
in parallel:
generating a first firmware lockdown command corresponding to the first firmware device based on the first firmware protocol; and
generating a second firmware lockdown command corresponding to the second firmware device based on the second firmware protocol;
in parallel:
sending, to the first firmware device, the first firmware lockdown command, wherein the first firmware device operates using a firmware management protocol (FMP), wherein the first firmware lockdown command is an FMP command that specifies updating a firmware lockdown policy of the first firmware device to specify a lockdown mode of a hardware device in the first firmware device, and wherein the first firmware device executes the first firmware lockdown command;
sending, to the second firmware device, the second firmware lockdown command, wherein the second firmware device operates using a platform-level data model (PLDM) protocol, wherein the second firmware lockdown command is a PLDM command that specifies obtaining firmware parameters of the second firmware device for specifying a lockdown of a hardware device in the second firmware device, and wherein the second firmware device executes the second firmware lockdown command;
initiating updating the lockdown policies, wherein the lockdown policies are updated at the first and second devices based on the first firmware lockdown command and the second firmware lockdown command.
10. The system of claim 9 , further comprising:
obtaining, by the hardware resource manager, a driver update lockdown policy request for a driver-managed device;
in response to the driver update lockdown policy request: identifying a set of hardware resources managed by the driver-managed device; and initiating an installation prevention for the set of hardware resources.
11. The system of claim 10 , wherein initiating the installation prevention comprises sending an installation prevention request to a device driver of the driver-managed device.
12. The system of claim 11 , wherein the installation prevention request specifies preventing an operating system of the driver-managed device from automatically updating.