Run EFI files/scripts from [boot, virtual media] ISO

Question

Most vendors recently provide servers firmware updates only as set of EFI files (example). But their servers internal (also as any external) IP-KVM can connect only ISO images as boot virtual media. With that virtual media remote firmware flash is impossible.

The servers are remote most of time and nobody can physically access it to insert USB stick to flash firmware updates. Firmware updates shall be remote only also for speed-up whole process. The question is how I can launch EFI files like these from bootable ISO to flash firmware updates?

Most probably, ready solution is not exist. So I would like to build by myself. But I didn't found anything in google for start. Need point to some manual for start or something like. May be there is a way to arrange in ISO this files somehow to EFI shell will able to access and start it?

I'd like Linux solution for build ISO.

Answer 1

The below solution is implemented on Linux Mint 19 64 in Virtual Machine.

Tools needed

GParted – GUI tool to manage partitions. This is generally available in Live Linux CD/DVD. If you do not have some free space at the end of your disk, you will have to resize and create a small FAT partition. If existing partitions are in use you may need to invoke GParted from Live Linux CD/DVD for it to work on your partition.

genisoimage - command line tool to manage ISO’s. If this is not available just install it. This was readily available in Linux Mint 19 64bit

sudo apt-get install genisoimage

Step 1 – Using GParted (Preferably booted off Live Linux CD/DVD, in this case I have used Live Linux Mint 19 64bit) create a small FAT16 formatted partition at the end of your disk. For this particular case just 100MB is more than enough. Ensure that for such a small size the format is FAT16 rather than FAT32

Step 2- Unzip and copy the required files to this FAT formatted partition. You can simply use the default GUI file explorer in Linux. No separate gzip command needed

Step 3 – Create an Image of this partition. The command here is

dd if=/dev/sda3 of=/home/test/efi/fat.img

In above example /dev/sda3 is the FAT formatted partition holding the files and /home/test/efi/fat.img is the image file generated.

Step 4 - Now we shall create an EFI Bootable ISO. The files themselves may not necessarily be bootable here.

genisoimage -v -J -r -V "TEST" \
  -o /home/test/myiso.iso \
  -eltorito-alt-boot \
  -e fat.img \
  -no-emul-boot \
  /home/test/efi

In the above command, we are omitting the BIOS bootloader and just sticking to the EFI bootloader, the alternate one. /home/test/myiso.iso is the new ISO file being created, /home/test/efi is the location of source files. As such there’s nothing except the bootloader image therein.

Now the ISO is created on Linux Box. Mount the ISO as CD Drive and boot your UEFI System into EFI Shell. Now the bootloader section shall map to a drive in EFI Shell and the image therein holding the folder along with its contents shall be accessible thru EFI Shell.

Answer 2

Based on what I best understand your question, I suggest a solution using following tools on Windows 64 Bit Operating System.

1. imdisk_toolkit_64_bit Virtual Disk Emulator. Download & install from here
2. Power ISO (Trial version should do as the file in question is less than 300MB)

Steps

Download and install above softwares on your Windows OS.

First using imdisk_toolkit create a virtual disk and Mount it to a drive letter. Format the disk to FAT file system. A disk of about 50 -60 MB is more than sufficient for your needs as the file size is hardly < 40MB

Copy the contents of your files including EFI files, flash files and the scripts on to that virtual drive.

From within the same app, now create and save an .img file of the virtual drive.

Dismount the virtual drive. This part of the job is done.

Now open Power ISO and create a new blank ISO container.

Go to Menu Action --> Boot --> Add Boot Information

and select the .IMG file that we created earlier.

Now your ISO file is virtually bootable (It creates a FAT container as boot file, though in reality it's not going to boot because your files themselves are not boot loaders)

Save the File as .ISO and burn it to a CD/DVD.

This bootloader FAT container shall be accessible in EFI Shell and shall mount itself as an accessible drive in EFI Shell.

I have tested this on a Virtual Machine. Hope this works as expected on real hardware.

Answer 3

Perhaps you could build the firmware updates as PXE boot images (although care would need to be taken not to end up in a reflash loop). Most servers with EFI are also able to fallback to PXE BIOS boot if needed.

If your IP-KVM device allows you to attach USB disks you may find you can simply boot your "image" by attaching it such a thing.

A better way might be to flash the server from a real fully booted OS (and some manufacturers provide OS specific utilities to do this).

Finally, some server vendors will charge you a SUM of extra money to let you flash the server's BIOS over the network (e.g. via IPMI) - you might be in that scenario...

Answer 4

There are other solutions than bootable ISO, although they require some work to construct. The solution to choose depends much on the nature of the remote computers as regarding manufacturer and operating systems.

For computers that are all from the same manufacturer, most large manufacturers supply products aimed at managing datacenters, which are mostly free. If that is your case, here are some links :

• Dell OpenManage Essentials
• HP Client Management Solutions
• Lenovo PC Cloud Manager
• Windows Server Update Services (WSUS) with for example Local Update Publisher for pushing packages including BIOS.

On Windows, one may use PowerShell to update the BIOS. The necessary files must first be pushed to the remote computer. Examples of such scripts are :

• Dell BIOS Updates with PowerShell
• Deploying BIOS updates with the PowerShell App Deployment Toolkit that describes using the Deploy-Application.ps1 script
• Dynamically Update BIOS on Think Products with SCCM uses Microsoft's SCCM to push Lenovo's BIOS updates.
• Invoke-DellBIOSUpdate.ps1 is a PowerShell script for BIOS update on Dell.
• Invoke-LenovoBIOSUpdate.ps1 is an adaptation of the same script for Lenovo.

Each and every solution requires study and testing, none of them are easy or absolutely guaranteed.