Understand the ApplyTime policy and boot actions in system firmware management

Firmware is a low-level software that enables hardware to start up and operate properly. A single system may use several firmware components and keeping them updated is important to avoid security risks and system issues. If updates are handled incorrectly, they can interrupt operations or even cause failures.

This article explains how ApplyTime settings and boot actions determine the timing of firmware updates. It guides administrators in choosing the right options, understanding their impact, and managing updates safely and smoothly.

What is an ApplyTime policy?

An ApplyTime policy defines when a firmware change should be applied to the system. Not all updates can be activated immediately, especially those involving low-level components such as hardware-related firmware. ApplyTime policies ensure that changes are implemented at the most appropriate and safe time.

Common ApplyTime options include:

• Immediate – The change is applied as soon as it is received.
• OnReset – The change takes effect the next time the system undergoes a reset.

Each policy enables administrators to balance system availability with the need for timely firmware updates.

Boot action: OnReset

The boot action OnReset instructs the system to apply pending firmware settings or updates during the next system reset. This ensures that modifications take place in a controlled manner without interrupting ongoing operations.

Why use OnReset?

The OnReset boot action offers the following advantages that make it suitable for environments where stability and continuity are critical:

• Prevents disruption by deferring changes until a reboot naturally occurs.
• Maintains continuity in production environments.
• Applies firmware adjustments safely during system initialization.

Redfish ApplyTime values with OnReset

To configure the OnReset policy using Redfish, you can query the UpdateService resource to verify the ApplyTime setting. The following example shows how the ApplyTime value is specified as OnReset in the Redfish response:

Apply the OnReset policy

The following Redfish API call applies the OnReset policy:

curl -k -H "Content-Type: application/json" -H "X-Auth-Token: $bmc_token" -X PATCH -d '{ "HttpPushUriOptions": { "HttpPushUriApplyTime":{ "ApplyTime":"OnReset"}}}' https://${bmc_ip}/redfish/v1/UpdateService

Validate the OnReset policy

The following Redfish API call verifies that the OnReset policy is applied:

bash-4.4$ curl -k -H "X-Auth-Token: $bmc_token" -X GET https://${bmc_ip}/redfish/v1/UpdateService
{
  "@odata.id": "/redfish/v1/UpdateService",
  "@odata.type": "#UpdateService.v1_11_1.UpdateService",
  "Actions": {
    "Oem": {
      "#OemUpdateService.v1_0_0.ConcurrentUpdate": {
        "target": "/redfish/v1/UpdateService/Actions/Oem/OemUpdateService.ConcurrentUpdate"
      }
    }
  },
  "Description": "Service for Software Update",
  "FirmwareInventory": {
    "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory"
  },
  "HttpPushUri": "/redfish/v1/UpdateService/update",
  "HttpPushUriOptions": {
    "HttpPushUriApplyTime": {
      "ApplyTime": "OnReset"
    }
  },
  "Id": "UpdateService",
  "MaxImageSizeBytes": 419430400,
  "MultipartHttpPushUri": "/redfish/v1/UpdateService/update",
  "Name": "Update Service",
  "ServiceEnabled": true
}bash-4.4$

Figure 1: Redfish firmware update procedure with OnReset policy

Figure 1 illustrates the Redfish firmware update procedure when the OnReset policy is applied.

Boot action: Immediate

The Immediate boot action tells the system to apply firmware updates or configuration changes right away, without waiting for a future reboot. In many cases, the system may automatically restart to complete the update. This ensures that the new firmware becomes active as soon as possible.

Why use Immediate?

The Immediate boot action is designed for situations where updates must take effect without delay. It is particularly useful when addressing critical vulnerabilities or urgent fixes. The following points highlight its key advantages:

• Applies changes instantly ensuring updates take effect without delay.
• Addresses urgent or critical updates such as security fixes that cannot wait.

Redfish ApplyTime values with Immediate

To configure the Immediate policy using Redfish, you can query the UpdateService resource to confirm that the ApplyTime setting is set to Immediate. The following example shows the curl command and the corresponding Redfish response:

Apply the Immediate policy

The following Redfish API call applies the Immediate policy.

curl -k -H "Content-Type: application/json" -H "X-Auth-Token: $bmc\_token" -X PATCH -d '{ "HttpPushUriOptions": { "HttpPushUriApplyTime":{ "ApplyTime":"Immediate"}}}' https://${bmc\_ip}/redfish/v1/UpdateService

Validate the Immediate policy

The following Redfish API call verifies that the Immediate policy is applied:

bash-4.4$ curl -k -H "X-Auth-Token: $bmc_token" -X GET https://${bmc_ip}/redfish/v1/UpdateService
{
  "@odata.id": "/redfish/v1/UpdateService",
  "@odata.type": "#UpdateService.v1_11_1.UpdateService",
  "Actions": {
    "Oem": {
      "#OemUpdateService.v1_0_0.ConcurrentUpdate": {
        "target": "/redfish/v1/UpdateService/Actions/Oem/OemUpdateService.ConcurrentUpdate"
      }
    }
  },
  "Description": "Service for Software Update",
  "FirmwareInventory": {
    "@odata.id": "/redfish/v1/UpdateService/FirmwareInventory"
  },
  "HttpPushUri": "/redfish/v1/UpdateService/update",
  "HttpPushUriOptions": {
    "HttpPushUriApplyTime": {
      "ApplyTime": "Immediate"
    }
  },
  "Id": "UpdateService",
  "MaxImageSizeBytes": 419430400,
  "MultipartHttpPushUri": "/redfish/v1/UpdateService/update",
  "Name": "Update Service",
  "ServiceEnabled": true
}bash-4.4$

Figure 2: Redfish firmware update procedure with Immediate policy

Figure 2 shows the Redfish firmware update procedure when the Immediate policy is applied.

Best practices for firmware update policies

To ensure smooth updates and minimize risk, consider the following guidelines:

• Plan updates during maintenance windows: Schedule updates during planned downtime to avoid unexpected disruptions.
• Validate firmware compatibility: Always confirm that the new firmware is compatible with your hardware and software stack before applying.
• Use OnReset for production stability: In environments where uptime is critical, defer changes until the next reboot using the OnReset policy.
• Use Immediate for urgent security fixes: Apply updates immediately when addressing vulnerabilities or critical bugs that cannot wait.
• Monitor post-update behavior: After applying updates, verify system health and functionality before resuming full operations.

Use cases

Different environments have varying requirements for uptime and flexibility. Choosing the right ApplyTime policy depends on these operational needs. The following use cases illustrate when each policy is most appropriate:

OnReset policy

• Ideal for production servers running mission-critical workloads.
• Suitable for updates that do not require immediate activation.

Immediate policy

• Best for emergency patches or security updates.
• Useful in development or test environments where downtime is acceptable.

Conclusion

ApplyTime policies and boot actions work together to define when firmware changes are applied and how the system behaves afterward. This orchestration ensures that firmware updates are safe, predictable, and efficient, supporting both uptime requirements and the need for secure, up-to-date system configurations.

The key characteristics of each ApplyTime policy and its practical benefits include:

• OnReset policy ensures stability by deferring changes until the next reboot—perfect for production environments.
• Immediate policy applies updates instantly, making it the right choice for urgent fixes.

For most production systems, use the OnReset policy to maintain uptime and predictability. Reserve the Immediate policy for critical updates that cannot wait. By following these best practices, administrators can achieve secure, efficient, and disruption-free firmware management.