To update the BIOS/UEFI firmware requires HP-specific files in the EFI System Partition, also referred to as ESP.
On a Linux system, the ESP is typically mounted on /boot/efi or /efi. Whithin you should also find a EFI directory, e.g. /boot/efi/EFI or /efi/EFI. This article assumes that the ESP is mounted on /efi and that the /efi/EFI directory exists. You can replace that with the mount point your system uses.
The HP-specific files are located in /efi/EFI/HP or /efi/EFI/Hewlet-Packard. These files typically come preinstalled in HP Windows PCs. If you have these files you could skip Install HP-specific files.
We can obtain the HP-specific files using HP's HP PC Hardware Diagnostics 4-IN-1 USB KEY installer. This installer contains the needed files. We can simply extract this installer and copy the needed files to the ESP
HP's installer only runs on Windows, but it is possible to extract it by running the self-extracting executable on Wine. You cannot simply extract the executable using 7-zip because the executable needs to do some file generation.
Download the executable. You can get the URL to the latest executable from HP's website.
$ wget https://ftp.hp.com/pub/softpaq/sp112501-113000/sp112853.exe
Run the executable using wine. This will extract its contents to ./sp112853.
$ wine sp112853.exe /s /e /f sp112853
Copy the HP-specific files to the the ESP.
# cp -r sp142721/field/{Hewlett-Packard,HP} /efi/EFI/
According to HP, this works for most hardware. For some cases you may need additional files. I have tired this with an HP Pavilion 13-an0008ne Laptop only, which required no additional steps.
You'll need to find you updated BIOS image. You can find one by going to HP's Software and Drivers page, and input your serial number. Make sure you select Windows as your Operating System, otherwise it may not show the updates.
These drivers often also come in Windows executables, you should run them in wine. The executable will first fail to install automatically. Then it will display different options on how to procede. Select the Copy option and select a directory where the BIOS image and the key file should be copied to.
$ wget https://ftp.hp.com/pub/softpaq/sp112501-113000/sp112516.exe
$ wine sp112516.exe /s /f sp112516 # extract and execute
There should be a .bin and an .s12 file. Copy these files to the ESP to the directory /efi/EFI/Hewlett-Packard/BIOS/New and /efi/EFI/HP/BIOS/New. Here I am using 084C5 as an example.
# mkdir /efi/EFI/Hewlett-Packard/BIOS/New
# cp sp112516/084C5{.bin,.s12} /efi/EFI/Hewlett-Packard/BIOS/New
# mkdir /efi/EFI/HP/BIOS/New
# cp sp112516/084C5{.bin,.s12} /efi/EFI/HP/BIOS/New
At this point you should have the needed HP-specific files and the BIOS update installed in the ESP. Now, you can actually complete the update.
Boot into firmware settings and press F2 to enter HP Hardware Diagnostics. You should be presented a menu and there should a menu entry named BIOS Management. Navigate to BIOS Management > Update BIOS. Your BIOS should start updating.
If you have enabled Secure Boot with custom keys, you will first need to sign the HP-specific .efi files.
Sometimes the previous method does not work, and the BIOS Management option does not show up. You can alternatively copy the .bin and .s12 file to /efi/EFI/Hewlett-Packard/BIOS/Current or /efi/EFI/HP/BIOS/Current, and press Win-B while the PC is booting up. This key combination should cause a BIOS firmware recovery using the files you copied.
Also note that updating will re-enable Secure Boot if had it disabled. If so, you might want to disable it again. Your custom Secure Boot keys will be preserved.
Might help some people:
The extracted Bios image contained 3 version of .bin and .s12 files. None of them was exactly matching, the closest one was a 0820D, my bios contained a 825D reference... So I copied all of them in Bios/New.
The HP Hardware Diagnostics menu did not contain a BIOS Management > Update BIOS. But there was a menu at boot to select an efi file to boot from. So I selected biosmgmt.efi somewhere in the EFI/HP/ directory.
It worked, but after the update I got a "Boot device not found" (03F0) error. I had to use a use a Debian Live usb drive to rebuild the /boot/efi. Look for GrubEFIReinstall in Debian's wiki.