Updating firmware on managed devices

From the Lenovo XClarity Administrator web interface, you can download, install, and manage firmware updates for managed devices, including chassis, servers, storage systems, and switches. You can assign firmware-compliance policies to the managed devices to ensure that firmware on those devices remains compliant. You can also create and edit firmware-compliance policies when validated firmware levels do not match the suggested predefined policies.

Procedure

The following figure illustrates the workflow for updating firmware on managed devices.

1. Manage the firmware-updates repository

   The firmware-updates repository contains a catalog of available updates and the update packages that can be applied to the managed devices.

   The catalog contains information about firmware updates that are currently available for all devices that XClarity Administrator supports. The catalog organizes the firmware updates by device type. When you refresh the catalog, XClarity Administrator retrieves information about the latest available firmware updates from the Lenovo website (including the metadata .xml or .json and readme .txt files) and stores the information in the firmware-updates repository. The payload file (.exe) is not downloaded. For more information about refreshing the catalog, see Refreshing the product catalog.

   If new firmware updates are available, you must first download the update packages before you can update that firmware on the managed devices. Refreshing the catalog does not automatically download update packages. The Product Catalog table on the Firmware Updates Repository page identifies which update packages are downloaded and which are available for download.

   You can download firmware updates in a several different ways.

   • Firmware-update repository packs

     Firmware-update repository packs are collections of the latest firmware that is available at the same time as the XClarity Administrator release for most supported devices and a refreshed default firmware-compliance policy. These repository packs are imported and then applied from the Update Management Server page. When you apply a firmware-update repository pack, each update package in the pack is added to the firmware-updates repository, and a default firmware-compliance policy is automatically created for all manageable devices. You can copy this predefined policy, but you cannot change it.

     The following repository packs are available.

     • lnvgy_sw_lxca_cmmswitchrepox-x.x.x_anyos_noarch. Contains firmware updates for all CMMs and Flex System switches.
     • lnvgy_sw_lxca_storagerackswitchrepox-x.x.x_anyos_noarch. Contains firmware updates for all RackSwitch switches and Lenovo Storage devices.
     • lnvgy_sw_lxca_systemxrepox-x.x.x_anyos_noarch. Contains firmware updates for all Converged HX Series, Flex System, NeXtScale, and System x servers.
     • lnvgy_sw_thinksystemrepox-x.x.x_anyos_noarch. Contains firmware updates for all ThinkAgile and ThinkSystem servers.
     • lnvgy_sw_lxca_thinksystemv2repox-x.x.x_anyos_noarch. Contains firmware updates for all ThinkAgile and ThinkSystem V2 servers.
     • lnvgy_sw_lxca_thinksystemv3repox-x.x.x_anyos_noarch. Contains firmware updates for all ThinkAgile and ThinkSystem V3 servers.
   • UpdateXpress System Packs (UXSPs)
     UXSPs contains the latest available firmware and device driver updates, organized by operating system. When you download UXSPs, XClarity Administrator downloads the UXSP, based on the version that is listed in the catalog, and stores the update packages in the firmware-updates repository. When you download a UXSP, each firmware update in the UXSP is added to the firmware-updates repository and listed on the Individual Updates tab, and a default firmware-compliance policy is automatically created for all manageable devices using the following names. You can copy this predefined policy, but you cannot change it.

     • {uxsp-version}-{date}-{server-short-name}-UXSP (for example, v1.50-2017-11-22- SD530-UXSP)
     Firmware Updates: Repository

     When you download or import UXSPs from the page, only firmware updates are downloaded and stored in the repository. Device driver updates are discarded. For information about downloading or importing Windows device driver updates using UXSPs, see Managing the OS device-drivers repository.

     When you manually import UXSPs into XClarity Administrator, you must include the following required files: payload (*.zip), metadata (.xml), change history (.chg or .html), and readme (.txt).

   • System Firmware Bundles

     For ThinkSystem V3 servers (with XCC2), firmware updates packs are referred to as system firmware bundles.

     When you download a system firmware bundle form XClarity Administrator, each firmware update in the bundle is added to the firmware-updates repository and listed on the Individual Updates tab, and a default firmware-compliance policy is automatically created for all manageable devices using the following names. You can copy this predefined policy, but you cannot change it.

     • {bundle-version}-{server-short-name}-bundle (for example, 22a.0-kaj92va-SR650V3-bundle)

     When you manually import system firmware bundles into XClarity Administrator, only the bundle payload (.zip) is required. This file contains the payload, metadata, change history, and readme for each update.

   • Individual firmware updates

     You can download individual firmware-update packages, at one time. When you download firmware-update packages, XClarity Administrator downloads the update, based on the version that is listed in the catalog, and stores the update packages in the firmware-updates repository. You can then create firmware-compliance policies using those update packages for each of your managed devices.

     Note

     The core firmware updates (such as management controller, UEFI, and pDSA) are operating-system independent. Firmware-update packages for the RHEL 6 or SLES 11 operating systems are used to update compute nodes and rack servers. For more information about which firmware-update packages to use for your managed servers, see Downloading firmware updates.

     When you manually import firmware updates into XClarity Administrator, you must include the following required files: payload (image), metadata (.xml or .json), change history (.chg), and readme (.txt). Note that for ThinkSystem V3 servers, the metadata file is included in the payload file and is not imported separately.

   You can determine whether specific firmware updates are stored in the firmware-updates repository from the Download Status column on the Individual Updates tab on the Firmware Updates: Repository page. This column contains the following values.

   • Downloaded. The entire update package or the individual firmware update is stored in the repository.
   • x of y Downloaded. Some but not all firmware updates in the update package are stored in the repository. The numbers in parentheses indicate the number of available updates and the number of stored updates, or there are no updates for the specific device type.
   • Not Downloaded. The entire update package or the individual firmware update is available but not stored in the repository.

   XClarity Administrator must be connected to the Internet to refresh the catalog and download firmware updates. If it is not connected to the Internet, you can manually download the files to a workstation that has network access to the XClarity Administrator host using a web browser and then import the files into the firmware-updates repository.
   
   

   Note

   For certain ThinkSystem DM storage devices, when you download firmware updates, the Written Offer PDF file for the ONTAP operating system is also downloaded. You can optionally select the ONTAP Written Offer PDF (if applicable) when you manually import firmware updates for these devices as well. To view the file in the web interface, click the icon in the Release Notes column to display the Release Notes dialog, and then click the ONTAP Written Offer tab.

   Attention

   • Only import these required files. Do not import other files that might be found on the firmware download websites.
   • If you do not include the metadata (.xml or .json) file in the update package, the update is not imported.
   • If you do not include all required files that are associated with the update, the repository shows that the update is not downloaded, which means that it is partially imported. You can then import the missing files by selecting and importing them.
   • The core firmware updates (such as management controller, UEFI, and pDSA) are operating-system independent. Firmware-update packages for the RHEL 6 or SLES 11 operating systems are used to update compute nodes and rack servers.

   For more information about the firmware updates, see Managing the firmware-updates repository.

2. (Optional) Create and assigning firmware-compliance policies

   Firmware-compliance policies ensure that the firmware on certain managed devices is at the current or specific level by flagging the devices that need attention. Each firmware-compliance policy identifies which devices are monitored and which firmware level must be installed to keep the devices in compliance. You can set compliance at the device or firmware component level. XClarity Administrator then uses these policies to check the status of managed devices and to identify devices that are out of compliance.

   When you create a firmware-compliance policy, you can choose to have XClarity Administrator flag a device when:

   • The firmware on the device is down level
   • The firmware on the device does not exactly match the compliance target version

   XClarity Administrator comes with a predefined firmware-compliance policy named Latest firmware in repository. When new firmware is downloaded or imported into the repository, this policy is updated to include latest available versions of firmware in the repository.

   After a firmware-compliance policy is assigned to a device, XClarity Administrator checks the compliance status of each device when the device inventory changes or firmware-updates repository changes. When the firmware on a device is not compliant with the assigned policy, XClarity Administrator identifies that device as not compliant on the Firmware Updates: Apply / Activate page, based on the rule that you specified in the firmware-compliance policy
   
   

   For example, you can create a firmware-compliance policy that defines the baseline level for firmware that is installed in all ThinkSystem SR850 devices and then assign that firmware-compliance policy to all managed ThinkSystem SR850 devices. When the firmware-updates repository is refreshed and a new firmware update is added, those compute nodes might become out of compliance. When that happens, XClarity Administrator updates the Firmware Updates: Apply / Activate page to show that the devices are not compliant and generates an alert.

   Note

   You can choose to show or hide alerts for devices that do not meet the requirements of their assigned firmware-compliance policies (see Configuring global firmware-update settings). Alerts are hidden by default.

   For more information about the firmware-compliance policies, see Creating and assigning firmware-compliance policies.

3. Applying and activating updates

   XClarity Administrator does not automatically apply firmware updates to managed devices. To update firmware, you must manually apply and active the update on selected devices. You can apply the firmware in one of the following ways.

   • Apply bundled firmware updates using compliance policies

     You can apply firmware updates to all components in the selected devices according to the assigned firmware-compliance policy using a bundle image that contain the applicable firmware update packages.

     The bundled-update process first updates the baseboard management controller and UEFI out of band. When these updates are complete, the process creates a bundled image of remaining firmware in the compliance policy based on the machine type. Then, the process mounts the image to the selected device and restarts the device to boot the image. The image automatically runs to perform the remaining updates.

     Attention

     Selected devices are powered off before starting the update process. Ensure that any running workloads have either been stopped or, if you are working in a virtualized environment, moved to a different server. If jobs are running, the update job is queued until all other jobs have completed. To see a list of active jobs, click Monitoring > Jobs.
     Note

     • Applying bundled firmware updates is supported only for ThinkSystem SR635 and SR655 servers.

     • Applying bundled firmware updates is supported only for IPv4 address. IPv6 addresses are not supported.

     • Ensure that each target device was booted to the OS at least once to retrieve the full inventory information.

     • Baseboard management controller firmware v2.94 or later is required to use the bundled-update function.

     • Only firmware updates from repository packs or individual firmware updates are used. UpdateXpress System Packs (UXSPs) are not supported.

     • Only downloaded firmware updates are applied. Refresh the product catalog, and download the appropriate firmware updates (see Refreshing the product catalog and Downloading firmware updates).

       Note

       When XClarity Administrator is initially installed, the product catalog and the repository are empty.

     • Compliance check is supported only for the baseboard management controller and UEFI in ThinkSystem SR635 and SR655 servers; however, XClarity Administrator attempts to apply firmware updates to all available hardware components.

     • Updates are applied according to the assigned firmware-compliance policy. You cannot choose to update a subset of components.

     • XClarity Administrator v3.2 or later is required to apply firmware updates for Lenovo XClarity Provisioning Manager (LXPM), LXPM windows drivers, or LXPM Linux drivers to ThinkSystem SR635 and SR655 servers.

     • The baseboard management controller and UEFI updates are skipped if the currently installed version is higher than the assigned compliance policy.

     • Firmware-compliance policies must be created and assigned to the devices on which you intend to apply firmware updates. For more information, see Creating and assigning firmware-compliance policies.

     • The selected devices are powered off before starting the update process. Ensure that any running workloads have either been stopped or, if you are working in a virtualized environment, moved to a different server.

   • Apply selected firmware updates with or without compliance policies

     You can apply firmware updates on selected components and devices according to the assigned firmware-compliance policy using applicable firmware-update packages. You can also choose to apply firmware updates that are later than the currently installed firmware on selected components and devices without using compliance policies.

     You can choose to apply updates for all components in a specific device. You can also choose to update only a subset of components in the selected devices, such as the baseboard management controller or UEFI.

     To activate the firmware updates, the devices must be restarted. (Note that restarting a device is disruptive.) You can choose to restart the devices as part of the update process (called immediate activation), or wait until a maintenance window is available to restart the devices (called delayed activation). In this case, you must manually restart the device for the update to take effect.

     When you choose to update the firmware for a managed device, the following steps occur.

     1. XClarity Administrator sends the firmware updates (for example, for the management controller, UEFI, and DSA) to the device.
     2. When the device is restarted, the firmware updates are activated on the device.
     3. For servers, XClarity Administrator sends updates for optional devices, such as network adapter and hard drive updates. XClarity Administrator applies these updates, and the server is restarted
     4. When you restart the device or choose immediate activation, the updates for the optional devices are activated.
     Note

     • When applying updates using compliance policies, a firmware-compliance policy must be created and assigned to each target devices. For more information, see Creating and assigning firmware-compliance policies.
     • If you choose to install a firmware-update package that contains updates for multiple components, all components to which the update package applies are updated.
     • Updates to CMMs and Flex switches are always activated immediately, even if you select delayed activation.

   When you perform updates on a set of devices, XClarity Administrator performs the updates in the following order.

   • Chassis CMM
   • RackSwitch and Flex System switches
   • Flex compute nodes, and rack and tower servers
   • Lenovo Storage devices

   Attention

   Before you attempt to apply firmware updates on managed devices, ensure that you have completed the following actions.

   • Read the firmware-update considerations before you attempt to update firmware on your managed devices (see Firmware-update considerations).
   • Initially, devices that are not supported for updates are hidden from the view. Devices that are not supported cannot be selected for updates.
   • By default, all detected components are listed as available for applying updates; however, down-level firmware might prevent a component from appearing in inventory or reporting full-version information. To list all policy-based packages that are available for you to apply updates, click All Actions > Global Settings, and selecting Enhanced Support for Down-Level Devices. When this option is selected, Other Available Software is listed in the Installed Version column for undetected devices. For more information, see Configuring global firmware-update settings.
     Note

     • The global settings cannot be changed when updates to managed devices are in progress.
     • It takes a few minutes to generate the additional options. After a few moments, you might need to click the Refresh icon () to refresh the table.
   • Ensure that no jobs are currently running on the target server. If jobs are running, the update job is queued until all other jobs have completed. To see a list of active jobs, click Monitoring > Jobs.
   • When enabled, the Wake-on-LAN boot option can interfere with XClarity Administrator operations that power off the server, including firmware updates if there is a Wake-on-LAN client in your network that issues Wake on Magic Packet commands.
   • Ensure that power-on password and setup password are both disabled. If these passwords are enable and the servers are restarted automatically, the firmware update will fail during the readiness check.

   • Ensure that the firmware-updates repository contains the firmware packages that you intend to deploy. If not, refresh the product catalog, and download the appropriate firmware updates (see Refreshing the product catalog and Downloading firmware updates).
     Note

     When XClarity Administrator is initially installed, the product catalog and the repository are empty.
     Attention

     If you intend to install prerequisite firmware, ensure that the correct version of the prerequisite firmware is downloaded in the repository. The prerequisite firmware versions are available in the package metadata (xml) and change history (chg) files.

     In some cases, multiple versions might be needed to update firmware, and all versions would need to be downloaded to the repository. For example, to upgrade the IBM FC5022 SAN scalable switch from v7.4.0a to v8.2.0a, you must first install v8.0.1-pha, then v8.1.1, and then v8.2.0a. All three versions must be in repository to update the switch to v8.2.0a.

   • Typically, devices must be restarted to activate the firmware update. If you choose to restart the device during the update process (immediate activation), ensure that any running workloads have either been stopped or, if you are working in a virtualized environment, moved to a different server.

   For more information about installing updates, see Applying and activating firmware updates.