HPE ProLiant: firmware updates with SPP

Maintaining current firmware on HPE ProLiant servers is critical for security, stability, and optimal performance. The Service Pack for ProLiant (SPP) is…

Maintaining current firmware on HPE ProLiant servers is critical for security, stability, and optimal performance. The Service Pack for ProLiant (SPP) is HPE's primary tool for delivering firmware, drivers, and agent updates in a unified, test-validated package. This article details the process of using SPP for firmware updates, covering various deployment methods suitable for single servers up to large data center environments.

Understanding the Service Pack for ProLiant (SPP)

The SPP is a comprehensive collection of firmware, drivers, and tools specifically designed for HPE ProLiant servers and their associated options (e.g., Smart Array controllers, network adapters, Fibre Channel HBAs). Each SPP release undergoes extensive testing by HPE to ensure compatibility and stability across supported ProLiant generations. The SPP is typically released as an ISO image, which can be booted directly or used as a repository for online updates.

Key characteristics of SPP:

Bundled Updates: Contains firmware, drivers, and agents in a single package.
Validated State: HPE certifies the compatibility of all components within a specific SPP version.
Offline & Online Modes: Can be used to boot the server directly (offline) or to update a running OS (online).
Component-based Updates: Updates individual components like BIOS/UEFI, iLO, Smart Array controllers, NICs, and storage devices.
Version Control: Each SPP has a unique version number (e.g., SPP 2023.09.00.00) indicating its release year, month, and minor revisions.

Downloading the SPP

Accessing the SPP usually requires an active HPE warranty or support contract. The download portal is HPE Support Center.

Navigate to HPE Support Center - SPP (or search for "Service Pack for ProLiant" on the HPE support site).
Log in with your HPE Passport account linked to your support contract.
Locate the desired SPP version (e.g., "HPE SPP Gen10 2023.09.00.00" for Gen10/Gen10 Plus servers) and download the ISO image. The file size is typically between 6-10 GB.
Verify the downloaded ISO's integrity using the provided checksum (SHA256 is common).

Offline Firmware Update: Booting from SPP ISO

This is the most common and recommended method for updating a single server or a small number of servers. It ensures that all components are updated in a controlled environment without an operating system running.

Preparation Steps

Backup Critical Data: Always back up configuration files or any critical data before performing firmware updates.
Download SPP ISO: As described above.
Mount or Burn ISO:
- iLO Virtual Media: For servers with iLO, mount the ISO as a virtual CD/DVD via the iLO web interface. This is the simplest method for remote updates.
- USB Bootable Drive: Use tools like Rufus (Windows) or dd (Linux) to create a bootable USB drive from the ISO.
- Physical DVD: Burn the ISO to a dual-layer DVD (if your server has an optical drive, less common now).
Plan Downtime: Firmware updates require server reboots and can take significant time (30-90 minutes or more per server, including reboots).

Update Procedure

Boot Server: Boot the ProLiant server from the SPP media (iLO virtual media, USB, or DVD). Ensure the boot order is set correctly in BIOS/UEFI.
SPP Boot Menu: You'll be presented with an SPP boot menu. Choose the default option, "Automatic Firmware Update," or similar (wording might slightly vary between SPP versions). For example, it may appear as:
```
HPE Service Pack for ProLiant
--------------------------------------
1. Automatic Firmware Update
2. Interactive Firmware Update
3. Generate Report Only
4. Exit
        
```
Selecting "Automatic Firmware Update" will scan the server, identify outdated components, and apply all necessary updates without further interaction.
Wait for Scan and Update: The SPP environment will load, scan the server's hardware, and compare installed firmware versions with those in the SPP. This process can take 5-20 minutes depending on server complexity. Firmware updates will then proceed automatically. You'll see progress indicators for each component.
Review Report: After the update process completes, a summary report will be displayed. Review it for any failed updates or warnings. It's often recommended to save this report if possible (e.g., to a USB drive if present, or by taking screenshots via iLO).
Reboot: The SPP will typically prompt you to reboot the server. Ensure the virtual media is unmounted or the USB drive is removed before the reboot to prevent accidentally booting back into SPP.
Verify Updates: Once the server reboots into its operating system, you can verify the new firmware versions through iLO, HPE OneView, or operating system utilities like HPE SUM (Smart Update Manager) or lshw on Linux.

Online Firmware Update: Using HPE Smart Update Manager (SUM)

For updating a running operating system (Windows or Linux), HPE SUM (Smart Update Manager) is used. SUM is included within the SPP ISO and can also be downloaded separately. This method is suitable for reducing downtime by applying updates without a full server reboot for each component (though a final reboot is often required).

Process Overview

Extract SPP: Download the SPP ISO and extract its contents to a local directory on your server (e.g., C:\SPP on Windows, /tmp/spp on Linux).
Install/Launch SUM: Navigate to the extracted SPP directory and locate the hpsum executable.
- Windows: Run hpsum.exe
- Linux: Run ./hpsum from the extracted directory. Ensure execute permissions (chmod +x hpsum) are set.
SUM will launch a web-based interface (typically on port 63001). Access it via a web browser (e.g., https://localhost:63001).
Add Targets: For local updates, the server itself will be automatically added as a target. For remote updates (e.g., updating multiple servers from a central SUM instance), you would add target servers by IP address/hostname, providing OS credentials or iLO credentials.
Baseline Selection: SUM will prompt you to select a baseline. This is usually the SPP directory you extracted.
Inventory and Analyze: SUM will inventory the target server(s) and compare current firmware/driver versions against the selected SPP baseline. This analysis identifies what needs to be updated.
Select Updates: Review the recommended updates. You can deselect specific components if necessary, but it's generally best to apply all recommended updates from a validated SPP.
Deploy Updates: Initiate the deployment. SUM will apply the updates. Some updates may require a reboot during the process, while others are applied "hot." SUM will indicate if a final reboot is necessary.
Review Report: After deployment, SUM provides a detailed report on the success or failure of each update.
Reboot (if required): Perform a final reboot if prompted by SUM.


# Example of launching hpsum on Linux after extracting SPP ISO
# Assuming ISO is mounted at /mnt/spp and contents copied to /tmp/spp
cd /tmp/spp
chmod +x hpsum
./hpsum

Access the SUM web interface at https://localhost:63001 from the server's browser or https://<server_ip>:63001 from a remote machine (ensure firewall rules allow access).

Centralized Management with HPE OneView and iLO Amplifier Pack

For larger deployments, manual SPP application becomes impractical. HPE provides tools for centralized management:

HPE OneView

OneView is HPE's infrastructure automation platform. It integrates with SPP to manage firmware baselines and deploy updates across a large fleet of servers, enclosures, and storage.

Import SPP: Upload the SPP ISO to OneView as a firmware baseline.
Server Profiles: Create or modify server profiles to reference the desired SPP firmware baseline.
Deployment: OneView can then deploy these profiles, automatically applying firmware updates to servers under its management. This often involves orchestrating reboots and maintaining a consistent firmware state.
Compliance Reporting: OneView continuously monitors server compliance against its defined firmware baselines.

HPE iLO Amplifier Pack

The iLO Amplifier Pack is a free, virtual appliance-based solution designed for inventory, firmware, and driver updates for HPE ProLiant Gen8, Gen9, Gen10, and Gen10 Plus servers at scale. It leverages iLO for agentless management.

Deploy Appliance: Deploy the iLO Amplifier Pack OVA on a hypervisor.
Discover Servers: Discover ProLiant servers using their iLO IP ranges.
Upload SPP: Upload the SPP ISO to the iLO Amplifier Pack.
Create Baselines: Define firmware baselines using the uploaded SPP.
Schedule Updates: Create update jobs, selecting target servers and the desired baseline. The Amplifier Pack uses HPE SUM under the hood to perform the updates remotely via iLO.

Common Pitfalls and Troubleshooting

Corrupted SPP Download: Always verify the checksum of the downloaded ISO. A corrupted ISO can lead to boot failures or incomplete updates.
Incorrect Boot Order: Ensure the server is configured to boot from the SPP media (iLO virtual media, USB) before its internal drives.
Insufficient Downtime: Firmware updates are not quick. Allocate ample time and inform stakeholders. Rushing can lead to problems.
Server Generation Mismatch: While a single SPP often supports multiple generations (e.g., Gen10 and Gen10 Plus), older SPP versions might not support newer server generations, and vice-versa for very old servers. Always check the SPP release notes for supported platforms.
Power Interruption: Never interrupt power during a firmware update. This can brick components. Ensure stable power during the entire process.
iLO Firmware First: If you are updating a large number of components, it's often a good practice to update the iLO firmware first, especially if it's significantly outdated. Newer iLO firmware often improves the reliability of subsequent component updates.
Stuck Updates: If an update appears stuck for an unreasonably long time (e.g., 30+ minutes on a single component), try a graceful restart of the SPP process. If that fails, a hard power cycle might be necessary, but this carries risk. Consult HPE support if repeated attempts fail.
Component Not Detected: Sometimes, the SPP or SUM might not detect an installed component. Ensure the component is properly seated and powered. Check server logs for hardware errors.