Updating the HP firmware

This guide updates the X89 system firmware on saruman, an HP ZBook Ultra G1a, from NixOS with Lanzaboote and Secure Boot enabled.

Check the current version

Connect the charger, then check the installed BIOS and the fwupd device:

cat /sys/class/dmi/id/bios_version
fwupdmgr get-devices

The system-firmware GUID should be 6b887c32-2e1f-462a-a1bc-2d08ce9ffac5.

Download and inspect the update

Use the official ftp.hp.com SoftPaq URL from the GitHub issue. Work in a new directory so an older firmware image cannot be selected accidentally:

softpaq_url='paste-the-softpaq-url-from-the-issue-here'
update_directory="$HOME/Downloads/hp-bios-update"

mkdir "$update_directory"
cd "$update_directory"
curl --fail --location --remote-name "$softpaq_url"
nix shell nixpkgs#p7zip -c 7z x "${softpaq_url##*/}"

Read the values that will be passed to fwupd:

rg 'FirmwareId|FirmwareVersion|FirmwareFilename' X89_*.inf

Confirm that FirmwareId matches the GUID above. Convert the hexadecimal FirmwareVersion from the INF file to decimal; for example, version 0x01060200 becomes 17170944:

printf '%d\n' "$((0x01060200))"

Sign the fwupd boot helper

NixOS supplies the EFI helper, but Secure Boot requires a copy signed with the same db key used by Lanzaboote:

sudo systemd-tmpfiles --create --prefix=/run/fwupd-efi

sbsign="$(nix build --no-link --print-out-paths nixpkgs#sbsigntool)/bin/sbsign"
sudo "$sbsign" \
  --key /etc/secureboot/keys/db/db.key \
  --cert /etc/secureboot/keys/db/db.pem \
  --output /run/fwupd-efi/fwupdx64.efi.signed \
  /run/fwupd-efi/fwupdx64.efi

This signs the fwupd EFI helper, not HP’s firmware .bin file. Do not reboot between this step and staging the update because /run is temporary.

Install and verify

Set the filename and hexadecimal version to the values from the new INF file:

firmware_bin='X89_replace_with_the_INF_value.bin'
firmware_version=0x_replace_with_the_INF_value

sudo fwupdtool install-blob \
  "$firmware_bin" \
  6b887c32-2e1f-462a-a1bc-2d08ce9ffac5 \
  "$((firmware_version))"

Reboot when prompted, keep the charger connected, and do not interrupt the firmware update. After NixOS starts again, verify the result:

cat /sys/class/dmi/id/bios_version
fwupdmgr get-devices

The System Firmware entry should show the new version and Update State: Success.

Remove a stale updater boot entry

Normally fwupd cleans up its temporary boot entry. If the computer instead keeps booting EFI/nixos/fwupdx64.efi, inspect the entries and find the number named Linux Firmware Updater:

efibootmgr_bin="$(nix build --no-link --print-out-paths nixpkgs#efibootmgr)/bin/efibootmgr"
sudo "$efibootmgr_bin" -v

Only after confirming that the firmware update succeeded, replace XXXX with that entry’s number and remove it before deleting the helper:

sudo "$efibootmgr_bin" -b XXXX -B
sudo rm -- /boot/EFI/nixos/fwupdx64.efi
sudo "$efibootmgr_bin" -v

Do not delete any other file under /boot/EFI/nixos/.