Firmware updates
Firmware updates fix real problems and occasionally create spectacular ones. The rule is to have a reason.
Reasons worth updating for
- A security advisory that applies to your hardware — BMC vulnerabilities in particular, see IPMI and the BMC.
- CPU microcode, which ships with the operating system as well and is usually easier to take that way — see CPU mitigations.
- A bug you are actually hitting: a NIC that drops under load, a controller that resets, drives that disappear.
- Drive firmware with a known data-loss bug. These exist, they are published, and they are worth checking once.
“It is a newer version” is not a reason. Firmware is not application software and there is no changelog culture to speak of.
What can go wrong
A failed BIOS flash can leave a machine that does not post. A BMC update that goes wrong takes your remote console with it — which is exactly what you would use to fix it. Drive firmware updates occasionally reset the drive to an unformatted state.
So: take a backup first, do it in a window, and have a way in that does not depend on the thing you are updating.
Checking what you have
dmidecode -s bios-version and -s bios-release-date
ipmitool mc info — BMC firmware revision
nvme list — drive model and firmware
ethtool -i eno1 — NIC driver and firmware
Write these down somewhere. When a vendor publishes an advisory, you want to answer “does this apply to us” in a minute, not an afternoon.
Microcode the easy way
apt install intel-microcode or amd64-microcode, then
reboot. The kernel loads it at boot, so you get the fix without touching the BIOS at
all. Check it took:
grep microcode /proc/cpuinfo | head -1
On hardware we provide
Machines ship with current firmware and microcode. If an advisory affects hardware we run, we deal with it — and where that needs a reboot of your machine it is scheduled with you rather than sprung on you. See maintenance and notice.
If you want a specific version for a reason of your own, ask. We would rather do it with a console open and a plan than have you flash a BIOS over SSH and hope.
On colocated hardware
It is yours, and the BMC in particular is yours to keep patched. Do the firmware before the machine ships — it is far easier on a desk than in a rack. See shipping hardware to us and colocation or a dedicated server.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base