HP investigating BIOS updates that leave premium laptop users in boot loop limbo HP customers are reporting problems with BIOS updates for the PC maker's premium laptops. Over the past few months, customers have used forums to register complaints over unbootable devices, spikes in fan noise, and Blue Screens of Death following BIOS firmware updates. An example cropped up in April, when a user of a ZBook …
= "We don't believe a word of what you're telling us is true".
In other words, an ECM problem (entrenched corporate mindset).
When I worked in the tech support operation of a now-disappeared PC maker, we wouldn't apply any BIOS updates to our PCs on principle. Too much experience of updates causing problems that required hours, even days, of work to fix. The only way to get 100% availability was to not change anything.
I've updated BIOS multiple times on multiple machines. If an update is offered I take it. In the past I'd even periodically go to the manufacturer's website and check that I was up to date. In forty years I've never had a problem.
Although I do wish that HP's BIOS update didn't insist on using a white background and setting the screen brightness to maximum. I wonder if there's such a thing as 'BIOS update tan'?
UEFI is way better than the old BIOS images, for starters its signed and has boot attestation with a TPM.
Old BIOS based machines didnt even used to have signed images so you could do stupid stuff like patch it to add a SLIC table so you didnt have to pay for windows 7
Or patch the computrace anti theft option rom rom to animate nyan cat pre boot https://www.youtube.com/watch?v=1uQ0qEsXL5c
Even the early signed bios you could bypass by flashing in crisis mode which didnt check the signature.
While UEFI isnt perfect its way better than BIOS.
UEFI in reality has far worse security than BIOS's.
Signatures and boot/remote attestation have nothing to do with security - it's about restricting the user (i.e. restricting what the user can boot and restricting the user from patching antifeatures out of the UEFI).
Giving microsoft more money is an immoral act, so the user being able to patch a SLIC table to remove an antifeature wasn't a bad thing, although running microsoft's software is only slightly less immoral than giving microsoft more money.
While signature checks and attestation almost all of the time does successfully restrict the user, such signing schemes are always implemented wrong - meaning attackers have no problems in practice carrying out exploits - all the signature check does is prevent the user from fixing the vulnerability themselves (there are pages and pages of such articles, but 3 is enough);
https://cybersecuritynews.com/uefi-secure-boot-bypass-vulnerability/
https://en.wikipedia.org/wiki/LogoFAIL?useskin=monobook
https://www.tomshardware.com/pc-components/motherboards/critical-uefi-vulnerabilities-found-in-gigabyte-motherboards-allow-attackers-to-bypass-secure-boot-and-install-firmware-backdoors
While an attacker previously had to tailor a BIOS exploit per BIOS vendor - maybe even per motherboard, how most UEFI's use the same bloated TianoCore EDK II and image rendering libraries, an attacker now can prepare a single cross-architecture exploit image that will successfully exploit almost all UEFI's with custom image support.
Due to the digital handcuffs, the user is dependent on the manufacturer supplying a UEFI update for the bug to be fixed (it seems 90%+ of existing UEFI implementations have not received an update and never will) - the signature check prevents the user from fixing the exploit themselves by a patch that replaces the image loading function call with a NOP instruction - as if the user applies such fix, the UEFI will no longer boot.
If you want security, step number 0 is to remove each and every proprietary program.
GNUboot has way better default security than every last UEFI and BIOS (due to lacking backdoors) and as every last line of source code is available under a free license, any and all bugs are possible to fix.
If you are concerned about an attacker writing to the SPI flash, you shouldn't waste time with signatures - you should instead desolder and lift the write-enable pin on the SPI flash and and wire up a physical switch (GNUboot by design doesn't write to the SPI flash, so it's fine for it to be RO and it doesn't really care about a corrupted NVRAM either).
I've been using, building (yeah, actually soldering stuff to boards) and repairing computers a similar length of time
How would you know it's dangerous if you've "never updated a BIOS"?
You've no experience of the process and can only be relying on anecdotal evidence from others.
In the last five years alone I've updated firmware on *thousands* of machines (our estate is over 15 thousand client PCs in this country alone) bits of hardware like monitors, hubs, networking gear, storage arrays etc etc. and I'm honestly struggling to think of any failures that weren't caused by something like a duff SD card, dodgy cable or doofus error, all totally unrelated to the update,
I genuinely can't think of a single failure that wasn't recoverable and left a piece of hardware "bricked" (alright, some of the really early flash BIOS updates needed the chip pulling and sticking in a programmer but that really is ancient history going back to Pentium MMX or '486 times)
I get the point of "ain't broke, don't fix it" but oftentimes it actually is broken, you just don't realise it.
"... a BIOS update, flagged as critical, and pushed through Windows Update."
That alone would be more than enough to expect a dicey outcome.
A critical BIOS update pushed through via Windows Update?
Just what were the responsible parties at HP thinking?
"... some success using the network BIOS downgrade functionality, but only with an HP USB-C to Ethernet dongle."
Nice ...
The let's add insult to injury fix.
If this is what you get when you puchase HP's premium hardware, I wonder what the lower spec stuff has to offer.
.
"... a BIOS update, flagged as critical, and pushed through Windows Update."
'That alone would be more than enough to expect a dicey outcome.'
Why? Is it going to be better when served through LVFS?
Behind the scenes Windows Update pushes the same update package HP offers thru their website, just without the update wizard, copying the update files to EFI partition. BIOS sees the new files in EFI/HP directory and applies the update. Pretty standard stuff with many manufacturers these days.
Interestingly, BIOS 01.04.03 update is categorised as routine, and would/should be shown as an optional update in WU as well, and not prechecked in the WU list of updates.
HP has been really sloppy with BIOS updates last few years, and their customer support has been appalling for much longer - try searching their website for support numbers for example. There's zero way to give feedback or alert the company for faulty drivers. And let's not forget their grand idea of 15 minute mandatory waiting time for all support calls.
I was in HP retail/service business since before the Compaq merger. It was great back then but slowly HP has been racing to the bottom. I like the hardware - mostly - and it's not all roses and champagne with the other manufacturers either. I think my next laptop is going to be Lenovo - they still have physical mouse buttons between touchpad and kb.
> I was in HP retail/service business since before the Compaq merger. It was great back then but slowly HP has been racing to the bottom.
So it is the same as McDonnell Douglas and Boeing merger... The name of the bigger company, but actually the "smaller" dictates the direction.
>Behind the scenes Windows Update pushes the same update package HP offers thru their website,
Not necessarily. My HP z4 G4 and z8 G4 workstations have both received BIOS updates via Windows update which weren't available through the HP website on at least two occasions.
"... same update package HP offers thru their website, just without the update wizard..."
Wait. You're updating your BIOS with a... update wizard?
"BIOS sees the new files in EFI/HP directory and applies the update."
I'd like to wedge in an entire different topic but I'll just state my opinion of that a BIOS update should _NEVER_ happen auto-magically based on a filename, header, signature or anything akin to those. Keep AUTORUN.INI out of system procedures (holding down SHIFT doesn't count).
> Behind the scenes Windows Update pushes the same update package HP offers thru their website, just without the update wizard, copying the update files to EFI partition. BIOS sees the new files in EFI/HP directory and applies the update. Pretty standard stuff with many manufacturers these days ..
Got that, a Windows update breaks the BIOS with no reliable way of restoring to the last good BIOS.
I admit that at an old company, if I had a message to call a user I would wait 15 minutes and then call them back. What would happen is that they get bored, read the manual find the information they needed. (Most of my phone calls were literally reading out info from the manual!) And if they did have a genuine problem, then 15 minutes wasn't that long to wait!
----- "If this is what you get when you puchase HP's premium hardware, I wonder what the lower spec stuff has to offer."
My observation is that they don't play sp many silly games with the $499 products. (untested) Updates are for the $1,999 products cuz they are so proud of their cleverness.
"If this is what you get when you purchase HP's premium hardware, I wonder what the lower spec stuff has to offer."
Uh.... just weight???!!!
Seriously though, BIOS updates should be optional. Windows Update should flag it for you, or your Admin to investigate, but certainly not install by default.
In my 35+ years in IT, BIOS updates have been restricted to:
- Serious security issue addressed.
- New auxiliary/peripheral hardware recognition (as a requirement by you or your organisation).
- Serious bug fix.
- New CPU hardware recognition.
Otherwise, if everything is going okay at boot - leave the BIOS alone. I've seen too many bricked servers and PCs due to dodgy BIOS and firmware updates to think any different.
Once your machine is booted the BIOS is mostly moot anyway. Long gone are the days where the BIOS actually handled the I/O subsystem (in "PC compatibles" and derivatives I mean).
I've never had a major issue so far** with my HPs, and pushing it through Windows Update is probably better than relying on the other random utilities especially for important updates like for Secure Boot. And it's not like the bit doing the actual applying is Windows Update.
But It does show the limits to the recovery mechanisms if it goes wrong. It should never be possible to brick a device, ever.
** That said I did get slightly concerned a couple of days back with a properly expensive ZBook crashing to nice random coloured patterns halfway through a bios update - that's never a healthy sign. Luckily it recovered after a restart.
My over seven year old HP ProBook occasionally locks up coming out of standby then shuts down. And it sometimes takes a long time or fails completely to reconnect to my WIFI. But it does neither of these very often and given it's age I can just tut, sigh and forgive it.
It's a bit like me - getting a little tired and ragged around the edges but still willing and able :)
Less Hewlett-Packard, more like Horrible Products. Pushing BIOS updates via Windows update is just asking for things to go wrong, and frequently does. Workplace has a shelf of dead Dell and HP machines that decided to force BIOS updates without warning via Win update, and ran out of battery partway through the flashing process thanks to users that didn't know what was happening beyond "It said it needed to update so I restarted it, a weird screen came up and now it doesn't work".
It's nothing to do with WU though. All WU is doing is downloading an image and setting a flag to tell the BIOS that on next boot up it should perform a firmware update using that image. It's the same if you use HP's Support Assistant application. It downloads something then asks you to reboot.
In both cases on rebooting I get the normal blinding white screen while the firmware is updated.
Now if HP doesn't check the battery status before starting that process that's bad..but it's on HP. You can't blame Windows for that - it's just the delivery mechanism.
I dunno, every laptop bios update I've seen from HP, no matter how it's applied, will refuse to install unless the battery has charge or is plugged in, I suspect the failures I see are, despite the warning that it will, a result of people panicking then pressing and holding power when the screen blanks for a couple of minutes.
You're doubtless right about people panicking.
My Dell Latitute however certainly isn't smart enough to figure out that BIOS updates are best postponed if the battery charge state is low. Employer is mostly an HP house and it's rather notable how the fifty or so Dells they bought have mostly fallen by the wayside...
Can we stop calling these things "BIOS" and instead call them Firmware (if you want to be universal), or UEFI (if we want to save space).
ElReg is a technology site. Technology changes over time. UEFI was introduced in 2005, 21 year ago. And yet, ElReg has not updated their style manual? COME ON!
Not sure.
BIOS updates have always been done after a reboot with warnings about having a power supply connected and NEVER interrupt it.
Firmware is frankly loaded to a vast number of external devices that you think just work, and in practice do nothing until a blob gets loaded into them.
I've seen Bios options to enable windows bios update, and it defaults to IN. Why???
Turn that off and choose to do an actual bios firmware update on purpose.
All gone to ***p now though with "secure boot" which depends on certificates.
God help you if the machine looses the date and thinks it 1970 again.
"BIOS updates have always been done after a reboot with warnings about having a power supply connected and NEVER interrupt it."
Uh, no. The current habit to update after reboot started only when UEFI started to be prevalent. Perhaps 10 years ago or so.
Before that BIOS updates were done either in Windows or DOS. Way before that (think 486 and earlier) you needed specific tools to reprogram the EPROM.
"I've seen Bios options to enable windows bios update, and it defaults to IN. Why??? Turn that off and choose to do an actual bios firmware update on purpose."
Probably because most people wouldn't ever patch for Spectre and the many other vulnerabilities in BIOSes. Most people are not aware of "BIOS" or "firmware" and would never update anything. Even the original IBM PC received BIOS updates - not that BIOS security was on anyone's radar until recent times.
"All gone to ***p now though with "secure boot" which depends on certificates.
Didn't it all go to crap long ago first with ACPI, then Winmodems, UEFI, TPM, etc?
"God help you if the machine looses (sic) the date and thinks it 1970 again."
==> OS boots up normally. Troll harder.
Yes, technically the Basic Input/Output System (BIOS) was originally a proprietary product. It was reverse-engineered by competitors and the meaning of BIOS morphed into a standard specification. It was eventually replaced by the UEFI specification, which remains current. However we mere mortals love to play merry shit with out mother tongue, and that term, the basic input/output system, has by popular mandate morphed once more, into a description of the general class of firmware exemplified by these specifications.
Moral: don't get aerated, but don't let your beer go flat either. Cheers!
Back around 2006, I purchased an HP desktop. It worked decently, but being the dutiful person I am, I installed a BIOS update that was offered. After that, the mainboard-controlled fans always ran at high speed. HP would not provide a BIOS downgrade, but did offer to look at it if I sent it in under warranty. I did so. It came back just as it was before I sent it, and after that, the person assigned to my case seemed charged with telling me "no" in every way possible.
I ended up installing manual fan controls that varied the voltage with physical knobs.
Other than the crappy HP inkjet printer that was bundled with an iMac purchased in 2008, I haven't purchased any more HP-branded products.
At the computer help drop-in sessions I help out with, I recommend clients DO NOT BUY AN HP PRINTER UNDER ANY CIRCUMSTANCE.
Also wonder why it is necessary to turn OFF "Fast Start" in Windows on HP laptops if you want them to boot properly?
Absolutely nothing can go wrong here. I'm sure everything's been comprehensively tested including updates from several different old BIOS versions and different BIOS configurations.
And if it does go wrong, well, that means another computer sold.
"I think I missed a decade. What has windows got to do with BIOS? What business does Windows have with BIOS?"
Computer manufacturers such as HP are submitting their BIOS updates to Windows Update, just like they submit driver updates. WU identifies the hardware on your computer and offers updated firmware and drivers when available.
Similarly Linux has LVFS, for which the manufacturers provide firmware packages.
What business does Windows have with BIOS?
Answer is depends from where you look at it.
For a few decades now, motherboard manufacturers had had their BIOS firmware written to appease the MS gods so as to guarantee that the boxes they were shipped in got the "Designed for Microsoft Windows" [whatever] label.
Being a MS OS loaded on 99.99% of all desktops/laptops shipped, internal and external peripheral OEMs rushed to do the same and that was it.
ie: as long as it worked under the MS OS shipped with the box, everyone was happy.
With the exception of users that did not have any intention of using a MS OS ...
Problem with this is evident: if the BIOS (and now the UEFI whatever) only complies with what MS wants/needs, what you get are millions of BIOS/UEFI whatever written by cut/paste dickheads with no proper quality control.
Save passing the low bar MS demands from them.
.
What business does Windows have with BIOS?
Very little beyond what's needed to bootstrap itself.
But that's misunderstanding what's going on here. Windows isn't updating the firmware. It's just downloading an image and setting a flag that means 'update firmware on reboot' the update is being performed by the firmware exactly the same as if you went via HPs own software.
All that WU is doing is automating the process of going to HP and downloading the latest image. Now you could argue that that will result in more people updating their firmware than would otherwise be the case but I don't think that means you can blame Windows if the update screws things up.
Had my Dell craptop's Dell Update decide it needed to do firmware updates, did so, it hung on some stupid sensor firmware update screen. Closed it, put it in my backpack hoping it would just fry itself and went to the office. Opened it and it had indeed depleted the battery in under an hour like it has since new. Alas, I plugged it in and it still worked, booting to a lovely blue screen telling me it couldn't find it's storage device and offering recovery options. IT support immediately jumped up and said Bitlocker error. I was not keen on following their usual recovery attempts and them declaring it needed to be re-imaged. Jumped into UEFI settings to see if it actually had a drive problem. It did not. The Dell update changed storage from AHCI to RAID. I flipped the bit and carried on normally. I notified the regional IT team and several of them said that my observation saved them a bunch of headaches. I wonder how may of the HPs are actually this issue?
I have developed a perfectly rational hatred of Dell laptops in the past decade. Are they actually the crappiest non-standard sized keyboard out there these days or is it my imagination?
My Zbook G1a has been fine since the Feb firmware update 01.04.05, previously it was a bit crashy, felt like something to do with power management todo with idle states as it transistioned.
Currently I'm running on the 01.05.07 update which has a date of 05/05/2026 and haven't seen any issues.Maybe I've been lucky.
whether some genius thought that incorporating a little AI secret sauce in the HP borkfirmware was "a good idea.™ "
The whole brand is best avoided. The only HP thing I possess is an old, presumably pre·borkage Xeon Z series workstation that is pretty solid in both senses — the last firmware update was well before COVID.
(see what I did there?)
Jokes aside, BIOS is, well, finicky.
I've done literally 10's of thousands of updates without issues. But... and here's the finicky part, it must be done correctly.
I've not seen a BIOS problem in 20 years on any PC, until just recently, and it was my fault. The cause? I need a new CMOS battery. I thankfully recovered after faffing around for about about an hour.
And that is the THE number one issue with BIOS fails that I've seen over the last 20 years. Old CMOS batteries. Or faulty batteries, both CMOS or laptop, on newish PCs that no one suspects.
Second is not backing up your BIOS. Many PCs these days come with BIOS backup. You have to search for it sometimes, but it's there. Well, most of the time. But you often have to activate it MANUALLY. Most of the time. But not always.
Third is power. BIOS requires that steady power on state. Interrupt the BIOS update for any reason and you may not even be able to pull from the backup and yer bricked and borked. Done and dusted.
But another poster above has already posted the biggest cause of failure: failure to update and research those updates before applying. I once made a lot of beer money just updating PCs. And that is ALWAYS my first go to when trouble shooting a PC. IS IT UP TO DATE? 9.5 times out of ten, nope. And that almost always fixes most things.
Caveats? Of course. Too numerous to mention. But you only get there if all the above has failed.
