Server BIOS UEFI and Firmware Update Best Practices

# Server BIOS, UEFI and Firmware Update Best Practices

Introduction

BIOS/UEFI firmware is the foundational software that initializes hardware and boots the operating system. Keeping firmware current and properly configured is essential for server stability, security, and performance. This guide covers BIOS/UEFI configuration best practices, firmware update procedures, and rollback strategies for enterprise servers.

You will learn:

• BIOS vs UEFI differences and when to use each
• Critical BIOS/UEFI settings for server workloads
• Firmware update planning and execution
• Rollback and recovery procedures
• Vendor-specific tools (HPE SPP, Dell Lifecycle Controller, Lenovo UpdateXpress)
• Pre-update and post-update verification checklists

Technical Background

BIOS vs UEFI

| Feature | BIOS (Legacy) | UEFI | |---------|--------------|------| | Introduction | 1970s-1980s | 2000s+ | | Boot Process | MBR, 16-bit | GPT, 32/64-bit | | Max Partition Size | 2 TB | 9.4 ZB | | Boot Speed | Slower | Faster | | Secure Boot | No | Yes | | Network Boot | Limited | Native PXE/HTTP | | Mouse Support | No | Yes | | Modern OS Support | Limited | Full | | CSM (Compatibility) | N/A | Available (legacy mode) |

**Recommendation:** Use UEFI for all new deployments. BIOS/Legacy mode only for legacy OS or hardware compatibility.

UEFI Secure Boot

Secure Boot ensures only signed bootloaders and drivers can execute:

• Prevents rootkits and bootkit malware
• Requires OS bootloader to be signed by trusted CA
• May prevent unsigned drivers from loading
• Can be disabled for troubleshooting or custom OS

Firmware Components in Servers

| Component | Description | Update Method | |-----------|-------------|---------------| | System ROM / BIOS | Main system firmware | Vendor update utility | | iLO/iDRAC/BMC | Management processor | Vendor update utility | | Storage Controller | RAID/HBA firmware | Vendor update utility | | NIC | Network adapter firmware | Vendor update utility | | CPLD / FPGA | Board-level logic | Vendor update utility | | Power Supply | PSU firmware | Vendor update utility | | Drive Firmware | SSD/HDD firmware | Vendor update utility |

Update Methods by Vendor

| Vendor | Tool | Delivery Method | |--------|------|-----------------| | HPE | Service Pack for ProLiant (SPP) | ISO, OneView, SUM (Smart Update Manager) | | Dell | Lifecycle Controller (LC) | iDRAC, LCD, Update Package | | Lenovo | UpdateXpress System Pack (UXSP) | XClarity, UpdateXpress | | Supermicro | BMC Update | Web UI, SUM | | Generic | fwupd / LVFS | Linux Vendor Firmware Service |

Prerequisites

Hardware Requirements

• Server with accessible management interface (iLO/iDRAC/BMC)
• UPS or redundant power (firmware updates must not be interrupted)
• Physical access as backup (for recovery if needed)

Software Requirements

• Latest Service Pack / Update Pack from vendor
• Management utility (SSA, SUM, iDRAC, XClarity)
• Bootable USB or virtual media capability

Knowledge Requirements

• Understanding of server hardware and firmware
• Familiarity with vendor-specific update tools
• Knowledge of rollback and recovery procedures

Step-by-Step Implementation

Step 1: Pre-Update Planning

**Purpose:** Plan the firmware update to minimize risk and downtime.

1. **Inventory current firmware:**

   # HPE - Check current firmware
   ssacli ctrl slot=0 show detail
   
   # General - Check BIOS version
   dmidecode -t bios | grep -E "(Version|Release Date)"
   
   # Check iLO/iDRAC
   # Via web interface dashboard

2. **Review vendor release notes:**

• Check for bug fixes relevant to your environment
• Identify known issues with the new firmware
• Verify compatibility with your hardware configuration

3. **Schedule maintenance window:**

• Firmware updates require server reboots
• Estimate 30-60 minutes per server
• Schedule during low-usage periods

4. **Prepare rollback plan:**

• Document current firmware versions
• Download previous firmware version as backup
• Test update procedure on non-production server first

**Verification:** Plan documented, maintenance window scheduled, rollback prepared.

Step 2: Backup Current Configuration

**Purpose:** Ensure you can restore settings if update causes issues.

1. **Export BIOS/UEFI settings:**

• Most vendors allow export of configuration
• HPE: Use ROM-Based Setup Utility (RBSU) or Intelligent Provisioning
• Dell: Use Lifecycle Controller or RAID config utility

2. **Document critical settings:**

• Boot order
• Virtualization settings (VT-x, AMD-V)
• SR-IOV settings
• Power management settings
• Memory settings (mirroring, sparing)
• Secure Boot state

3. **Backup data:**

• Firmware updates don't typically affect data
• But backup before any hardware-level change as best practice

**Verification:** Configuration exported and documented.

Step 3: Download Firmware

**Purpose:** Obtain correct firmware for your server model.

**HPE — Service Pack for Proliant (SPP):** 1. Visit HPE Support Center 2. Search for your server model 3. Download latest SPP ISO 4. Verify checksum (SHA-256)

**Dell — Lifecycle Controller:** 1. Visit Dell Support 2. Enter Service Tag 3. Download Drivers & Firmware 4. Create bootable USB or use iDRAC virtual media

**Lenovo — UpdateXpress:** 1. Visit Lenovo Support 2. Enter serial number 3. Download UpdateXpress System Pack (UXSP)

**Verification:** Firmware downloaded, checksums verified.

Step 4: Pre-Update Verification

**Purpose:** Confirm server is healthy before updating.

1. **Check hardware health:**

• All components OK in management interface
• No failed drives, power supplies, or fans
• Temperature within normal range

2. **Verify backups:**

• Configuration exported
• Critical data backed up

3. **Notify stakeholders:**

• Send maintenance notification
• Document expected downtime

**Verification:** Server healthy, backups complete, stakeholders notified.

Step 5: Apply Firmware Update

**Purpose:** Install firmware updates safely.

**Method 1: HPE Smart Update Manager (SUM) via ISO**

1. Mount SPP ISO via iLO virtual media 2. Boot from virtual media 3. SUM loads automatically 4. Select components to update:

5. Click "Install" 6. Wait for completion (10-30 minutes) 7. Server reboots automatically

• iLO (update first)
• System ROM
• Storage controller
• NIC and other devices

**Method 2: HPE ssacli / hp-firmware (Online)**

# Install HPE management tools
# RHEL/CentOS:
yum install hp-snmp-agents hp-snmp-agents hponcfg
# Debian/Ubuntu:
apt install hp-health hpacucli hponcfg

# Update iLO
hpiloCFG -R

# Update system firmware via SUM (offline method preferred for system ROM)

**Method 3: Dell iDRAC Virtual Media**

1. Download Dell Update Package (DUP) 2. Mount via iDRAC virtual media 3. Run update utility 4. Or use iDRAC Lifecycle Controller online update

**Method 4: Lenovo XClarity**

1. Upload UXSP to XClarity 2. Create update job 3. Schedule and execute

**Expected Output:** All components updated successfully, server reboots.

**Verification:** New firmware versions confirmed.

Step 6: Post-Update Verification

**Purpose:** Confirm update successful and server functioning.

1. **Check firmware versions:**

   # Verify new versions
   dmidecode -t bios | grep -i version
   ssacli ctrl slot=0 show detail | grep -i firmware

2. **Check hardware health:**

• All components OK
• No error messages in event log

3. **Test critical functions:**

• Server boots normally
• Storage arrays accessible
• Network connectivity working
• Management interface accessible

4. **Run application tests:**

• Verify applications start correctly
• Check database connectivity
• Verify virtualization hosts see all resources

**Verification:** All checks pass, server operational.

Step 7: Rollback (If Issues Occur)

**Purpose:** Revert to previous firmware if update causes problems.

**Rollback Triggers:**

• Server won't boot after update
• Hardware components not detected
• Performance regression
• Application incompatibility

**Rollback Procedure:**

**HPE — Firmware Rollback:** 1. Boot into Intelligent Provisioning (F10) 2. Select Firmware Update 3. Choose "Rollback" option 4. Select previous firmware version 5. Apply rollback

**Manual Rollback:** 1. Download previous firmware version 2. Create bootable media with previous version 3. Boot from media and apply previous firmware 4. Verify server functionality

**Emergency Recovery:** 1. If server won't boot, use vendor recovery procedure 2. HPE: Use iLO recovery or system board recovery jumper 3. Dell: Use iDRAC recovery or LFC (Laptop Flash Controller) 4. Lenovo: Use XClarity recovery or BIOS recovery

**Verification:** Server operational with previous firmware.

Configuration Examples

BIOS/UEFI Settings for Virtualization Host

Security:
  Secure Boot: Enabled
  TPM: Enabled

Processor:
  Virtualization Technology (VT-x): Enabled
  VT-d (Directed I/O): Enabled
  SR-IOV: Enabled (if using passthrough)
  Hyper-Threading: Enabled

Memory:
  Memory Mode: Independent Channel
  Demand Scrub: Enabled
  Patrol Scrub: Enabled

Power:
  Power Regulator: OS Control Mode (or Static High Performance for latency-sensitive)
  Processor Power Management: OS Control Mode

Boot:
  Boot Mode: UEFI
  Boot Order: 1. Internal HDD, 2. Virtual Media, 3. PXE
  Network Boot: IPv4 (or IPv6)

Security:
  Admin Password: Set
  Secure Boot: Enabled (if OS supports)

BIOS/UEFI Settings for Database Server

Processor:
  Virtualization Technology: Disabled (unless running VMs)
  Processor Power Management: Maximum Performance
  Energy Performance Balanced: Performance

Memory:
  Memory Mode: Independent Channel
  Demand Scrub: Enabled

Power:
  Power Regulator: Static High Performance
  Processor Power Management: Maximum Performance

Boot:
  Boot Mode: UEFI
  Fast Boot: Disabled (for troubleshooting visibility)

HPE SPP Update Command Sequence

# 1. Check current firmware
ssacli ctrl slot=0 show detail | grep -i fw
dmidecode -t bios | grep -i version

# 2. Download SPP ISO
wget https://downloads.hpe.com/pub/softlib2/software/patches/spp/...

# 3. Mount via iLO virtual media
# (via iLO web interface)

# 4. Boot from virtual media and run SUM

# 5. Verify after reboot
ssacli ctrl slot=0 show detail | grep -i fw
dmidecode -t bios | grep -i version

Dell Firmware Update via iDRAC

# Create bootable USB with Dell Update Package
# Mount via iDRAC virtual media
# Boot from USB
# Run Dell Lifecycle Controller update
# Or use racadm:
racadm updatemode -t
racadmu -u <user> -p <pass> -f <update-package.exe>

Verification

Firmware Version Verification

# BIOS/UEFI version
dmidecode -t bios | grep -E "(Version|Release Date)"

# iLO version (HPE)
# Via web interface dashboard

# Storage controller firmware
ssacli ctrl slot=0 show detail | grep -i fw

# NIC firmware (varies by vendor)
ethtool -i eth0 | grep firmware

Health Check Verification

# Check for hardware errors
dmesg | grep -i -E "(error|fail|machine check)"

# Check storage controller
ssacli ctrl slot=0 show status

# Check memory
dmidecode -t memory | grep -i error

# Check iLO event log
# Via web interface

Boot Verification

• [ ] Server completes POST without errors
• [ ] All drives detected
• [ ] Network interfaces operational
• [ ] Management interface accessible
• [ ] Operating system boots normally
• [ ] Applications start correctly

Troubleshooting

| Scenario | Symptom | Possible Cause | Diagnostic | Corrective Action | Verification | |----------|---------|----------------|------------|-------------------|--------------| | Server won't boot after update | No POST, black screen | Incompatible firmware, corrupted update | POST error codes, beep codes | Rollback firmware, use recovery procedure | Server boots successfully | | Component not detected | Drive/NIC missing after update | Driver incompatibility, firmware mismatch | Device Manager, `lspci`, `ssacli` | Update driver, rollback component firmware | Component detected | | Performance degradation | Slower after update | Power settings changed, microcode update | Benchmark before/after | Adjust power settings, rollback if needed | Performance restored | | Secure Boot fails | OS won't boot | Unsigned bootloader, wrong keys | Boot error message | Disable Secure Boot, enroll keys, or use compatible OS | Server boots with Secure Boot | | Firmware update stuck | Progress bar not moving | Power issue, corrupted update file | Update log, iLO event log | Restart update, verify file integrity | Update completes | | iLO inaccessible after update | Can't reach management interface | iLO firmware issue, network change | `ping <ilo-ip>`, iLO physical status | Reset iLO, reconfigure network | iLO accessible | | Boot order changed | Booting from wrong device | Update reset boot order | BIOS boot order settings | Reconfigure boot order | Server boots from correct device | | Virtualization features missing | VT-x not available | Disabled in BIOS, processor doesn't support | BIOS settings, processor spec | Enable in BIOS, verify processor support | VT-x available | | TPM not detected | TPM missing in OS | TPM disabled in BIOS | BIOS security settings | Enable TPM in BIOS | TPM detected in OS | | Rollback fails | Cannot revert firmware | No previous version available, locked | Error message during rollback | Contact vendor support, use emergency recovery | Previous firmware restored |

Best Practices

1. **Update iLO first** — iLO provides remote access during updates of other components.

2. **Test in non-production first** — Validate firmware updates on a non-critical server.

3. **Maintain firmware consistency** — All servers of the same model should run the same firmware version.

4. **Have rollback media ready** — Download previous firmware version before updating.

5. **Use UPS or redundant power** — Power loss during firmware update can brick components.

6. **Read release notes** — Check for known issues and special instructions.

7. **Update during maintenance windows** — Firmware updates require reboots.

8. **Document all changes** — Record firmware versions before and after updates.

9. **Don't skip versions unnecessarily** — Jumping multiple versions increases risk; follow vendor recommendations.

10. **Verify after reboot** — Always confirm server functionality after firmware update.

Conclusion

BIOS/UEFI and firmware management is a critical aspect of server lifecycle management. Proper configuration ensures optimal performance and security, while regular updates address bugs, security vulnerabilities, and hardware compatibility issues.

Key principles:

• Use UEFI mode for modern deployments
• Enable Secure Boot for security
• Plan updates with rollback procedures
• Test in non-production first
• Verify after every update

References

• UEFI Forum Specifications: https://uefi.org/specs
• HPE Service Pack for ProLiant (SPP): https://www.hpe.com/info/spp
• Dell Lifecycle Controller: https://www.dell.com/support/lifecycle-controller
• Lenovo UpdateXpress: https://www.lenovo.com/updatexpress
• Linux Vendor Firmware Service (LVFS): https://lvfs.org/
• NIST Firmware Security Guidelines: https://csrc.nist.gov/publications