Unable to update firmware on X710-DA2: "Update not available"

[idata]

Hi,

we bought an X710-DA2 (the bulk version, X710DA2BLK, 933217) a few days ago, and I'm unable to perform a firmware update on the card.

The card came with firmware 4.53 (0x80001e5b, 1.1747.0), and I've tried all available firmware versions now, from 4.42 downgrade over 4.53, 5.02 up to 6.01, both the EFI versions and the Linux versions (with both Archlinux 2017-09 and CentOS 7.4). Without any exception, all available updates either segfault or give me the status "Update not available" for the card. The only thing that I have been able to update is the boot agent.

In case it matters: I've tried to perform the updates using a Dell Optiplex 7020, which has an Intel I217-LM onboard NIC. I have also tried disabling the onboard NIC in the BIOS for some of my update attempts, but that didn't help either.

Not updating the firmware is not an option given the fact that Intel seems have to managed to manufacture a 300€ NIC with a built-in DoS vulnerability:

https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00052&languageid=en-fr https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00052&languageid=en-fr

Bonus: According to the sticker on the PCB, the card was manufactured in December 2017 - this is more than half a year after the above-mentioned security advisory was published on Intel's own website. Why on earth do you even ship NICs with such an outdated firmware with known security vulnerabilites?

So far, of the things that I have tested, the only things that seem to be actually working properly are the update process for the boot agent and the laughable restriction to overprized Intel SFP+ modules.

I'm pretty underwhelmed to say the least.

[idata]

Typo correction: The manufacturing date was of course December 2016, not December 2017.

[idata]

By the way, I've also tried with both the normal stock kernel version of the i40e module, and manually compiling and loading the latest i40e version 2.1.26, that didn't help either.

[idata]

Hi Unhappycustomer,

Thank you for posting in Wired Communities. I am sorry to hear what happen, can you share the serial number of your NIC. (e.g. just one piece) The serial number can be found at the white sticker on the physical NIC (format 16 alphanumeric + 6 alphanumeric + 6 digts -3 digits). Looking forward to your reply to better assist on this.Thanks,Sharon

[idata]

Hi Sharon,

I've just sent you everything thats written on the card's serial number sticker.

Regards

[idata]

I just got the following email notification with my PM to you with the serial number attached as an EML file:

This is the mail system at host mx1-out1.phx1.jivehosted.com.

I'm sorry to have to inform you that your message could not

be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can

delete your own text from the attached returned message.

The mail system

<</span>mailto:intel.corp@intel.com intel.corp@intel.com>: host mga04.intel.com[192.55.52.120] said: 550 # 5.1.0

Address rejected. (in reply to RCPT TO command)

Can you please give me an email address or something similar where I can send you the serial number without having to post it on a public forum?

Regards

Pascal

[idata]

Hi Unhappycustomer,

I sent a private message to you, you may provide the information from there.Regards,Sharon

[idata]

Thanks, I've just sent you the message with the requested data.

[idata]

Hi Unhappycustomer,

Thank you for the information. Just to double check, so what is the current version you have? Have you tried updating the firmware version as below:

1) First update to version 5.05

https://downloadcenter.intel.com/download/27064/Non-Volatile-Memory-NVM-Update-Utility-for-Intel-Ethernet-Converged-Network-Adapter-XL710-and-X710-Series Download Non-Volatile Memory (NVM) Update Utility for Intel® Ethernet Converged Network Adapter XL710 and X710 Series

2) Then download to version 6.01

https://downloadcenter.intel.com/download/24769/Non-Volatile-Memory-NVM-Update-Utility-for-Intel-Ethernet-Converged-Network-Adapter-XL710-and-X710-Series Download Non-Volatile Memory (NVM) Update Utility for Intel® Ethernet Converged Network Adapter XL710 and X710 Series

Please feel free to update me. Thanks.

Regards.

Sharon

[idata]

Hi Unhappycustomer,

Please feel free to update me if you have tried the firmware update steps mentioned. Looking forward to your reply. Thanks,Sharon

[idata]

I'm unable to perform an update to both firmware versions 5.05 and 6.01. The card is recognized correctly and the firmware version is shown as "4.53", but I keep getting the "no update available" status.

My best guess is that the reason is my card having the EEPID 0x80001e5b (as stated in my initial posting), whilst none of the NVM updates that I could find on your site contain that EEPID in their nvmupdate.cfg.

Concerning my card, they contain the following DEVICE blocks:

nvmupdate.cfg of firmware update 5.05:

BEGIN DEVICE DEVICENAME: XL710

VENDOR: 8086

DEVICE: 1572

NVM IMAGE: X710DA2_4p42_CFGID7p2_OEMGEN.bin

SKIP OROM: TRUE

EEPID: 8000191B

REPLACES: 800012EE 80001404 8000143F 800014B4

RESET TYPE: POWER

END DEVICE

BEGIN DEVICE

DEVICENAME: XL710

VENDOR: 8086

DEVICE: 1572

NVM IMAGE: X710DA2_5p05_CFGID7p2_OEMGEN.bin

OROM IMAGE: BootIMG.FLB

EEPID: 80002892

REPLACES: 8000191B 80001920 80001DC0 80001F54 80001FA4 80002282 8000206E 800024C6 8000252E 8000252F 80002530

EEPROM MAP: PF_Alloc_WOL_DIS.txt

RESET TYPE: REBOOT

END DEVICE

nvmupdate.cfg of firmware update 6.01:BEGIN DEVICE DEVICENAME: XL710

VENDOR: 8086

DEVICE: 1572

NVM IMAGE: X710DA2_4p42_CFGID7p2_OEMGEN.bin

SKIP OROM: TRUE

EEPID: 8000191B

REPLACES: 800012EE 80001404 8000143F 800014B4

RESET TYPE: POWER

END DEVICE

BEGIN DEVICE

DEVICENAME: XL710

VENDOR: 8086

DEVICE: 1572

NVM IMAGE: X710DA2_6p01_CFGID7p2_OEMGEN.bin

OROM IMAGE: BootIMG.FLB

EEPID: 80003483

REPLACES: 8000191B 80001920 80001DC0 80001F54 80001FA4 80002282 8000206E 800024C6 8000252E 8000252F 80002530 80002892 80002927

EEPROM MAP: PF_Alloc_WOL_DIS.txt

RESET TYPE: REBOOT

END DEVICE

Note that neither of the files contains my card's EEPID 80001e5b (neither in the EEPID lines nor in the REPLACES lines).Here's the output of the Intel System Support Utility (https://downloadcenter.intel.com/product/91600/Intel-System-Support-Utility https://downloadcenter.intel.com/product/91600/Intel-System-Support-Utility) for all network interfaces on the machine:

# SSU Scan Information

Scan Info:

Version:"1.0.0.0"

Scan Date:"2017/09/16"

Scan Time:"14:06:41"

# Scanned Hardware

Computer:

- Networking

- "Intel Corporation Ethernet Connection I217-LM (rev 04)"

Supports auto-negotiation:"Yes"

Advertised auto-negotiation:"Yes"

Auto-negotiation:"on"

Availability:"eno1: flags=4163 mtu 1500"

Capabilities:"[c8] Power Management version 2"

Capabilities:"[d0] MSI: Enable+ Count=1/1 Maskable- 64bit+"

Capabilities:"[e0] PCI Advanced Features"

Caption:"Not Available"

Default IP Gateway:"XXX.XXX.XXX.XXX"

DHCP Enabled:"Yes"

DHCP Lease Expires:"Not Available"

DHCP Lease Obtained:"Not Available"

DHCP Server:"Not Available"

Driver:"e1000e"

Driver Path:"/lib/modules/4.12.8-2-ARCH/kernel/drivers/net/ethernet/intel/e1000e/e1000e.ko.gz"

Driver Provider:"Intel Corporation, <</span>mailto:linux.nics@intel.com linux.nics@intel.com>"

Driver Version:""

Duplex:"Full"

Firmware Version:"0.13-4"

Interface:"eno1"

I/O Ports:"Not Available"

IP Address:"XXX.XXX.XXX.XXX"

IP Subnet:"XXX.XXX.XXX.XXX"

MAC Address:"64:00:6a:XX:XX:XX"

Location:"00:19.0"

Manufacturer:"Intel Corporation"

Net Connection ID:"Not Available"

Port:"Twisted Pair"

Power Management:"Supports Wake-on: pumbg"

Power Management:"Wake-on: g"

Speed:"1000Mb/s"

Supported link modes:"10baseT/Half 10baseT/Full, 100baseT/Half 100baseT/Full, 1000baseT/Full"

Advertised link modes:"10baseT/Half 10baseT/Full, 100baseT/Half 100baseT/Full, 1000baseT/Full"

Partner advertised link modes:"Not Available"

- "Intel Corporation Ethernet Controller X710 for 10GbE SFP+ (rev 02)"

Supports auto-negotiation:"No"

Advertised auto-negotiation:"No"

Auto-negotiation:"off"

Availability:"enp1s0f0: flags=4163 mtu 1500"

Capabilities:"[40] Power Management version 3"

Capabilities:"[50] MSI: Enable- Count=1/1 Maskable+ 64bit+"

Capabilities:"[70] MSI-X: Enable+ Count=129 Masked-"

Capabilities:"[a0] Express Endpoint, MSI 00"

Capabilities:"[e0] Vital Product Data"

Capabilities:"[100] Advanced Error Reporting"

Capabilities:"[140] Device Serial Number XX-XX-XX-ff-ff-fe-fd-3c"

Capabilities:"[150] Alternative Routing-ID Interpretation (ARI)"

Capabilities:"[1a0] Transaction Processing Hints"

Capabilities:"[1b0] Access Control Services"

Capabilities:"[1d0] # 19"

Caption:"Not Available"

Default IP Gateway:"Not Available"

DHCP Enabled:"Yes"

DHCP Lease Expires:"Not Available"

DHCP Lease Obtained:"Not Available"

DHCP Server:"Not Available"

Driver:"i40e"...

[idata]

For reference, after another private message from Sharon, I was able to flash the card from firmware version 4.53 to 5.05, and then to 6.01.

Just to be on the safe side: This can brick/destroy your card. When in doubt, first ask Intel's support division before trying the following steps.

Here's how I solved the "Update not available" problem described above:

1. Download the 5.05 firmware update. I've used the EFI version, but the other versions will probably also work (although the Linux versions may seǵfault depending on the distro you are using).

The EFI versions of the updates seem to contain two different version of the update utility (EFIx64 and EFI2x64), I had to use the EFI2x64 version as the other one didn't work on my machine.

2. Find out your card's EtrackID / EEPID. This ID seems to depend on both the exact card version *and* the firmware version that the card is currently running. In my case, the card's EEPID was "80001E5B". You can find out your card's EEPID for example using the Intel System Support Utility (https://downloadcenter.intel.com/product/91600/Intel-System-Support-Utility https://downloadcenter.intel.com/product/91600/Intel-System-Support-Utility) or by using ethtool on Linux ("ethtool -i eth1", the EEPID will be the 8 digit hex number prefixed with "0x" in the "Firmware:" line).

3. In the directory with the firmware update, open the file "nvmupdate.cfg" and search for your card's EtrackID / EEPID. If you don't find it in the file, search for the entry that matches your card and the firmware version that you want to upgrade to. In my case, I had an "X710-DA2" and wanted to upgrade to firmware "5.05", so I looked for the section containing the following line:

NVM IMAGE: X710DA2_5p05_CFGID7p2_OEMGEN.bin

The exact firmware image file name may be different for your card. Obviously, the firmware image does have to match your card or you will probably brick it.

4. Add your card's EtrackID / EEPID to the "REPLACES:" line. I made sure that I added the ID in such a way that the alphabetical order of the IDs in that line was maintained, and made sure that all hex characters were written in upper case, but I'm not sure if this would have been necessary.

5. Run the NVM update tool (nvmupdate64e.efi in my case), with specifying any additional parameters. In my case, I've run the tool from a Tianoboot UEFI shell.

6. The tool will take a while detecting your cards ("inventory"), and then ask you which card you want to update. You will also be asked if you want to backup the existing firmware (which is certainly a good idea to do).

7. During the flashing process, the update tool will error out when "progress bar" reaches around 50%, and tell you that the update failed. In my case, the update had worked nonetheless. This error occured during both the update from firmware 4.53 to 5.05 and from 5.05 to 6.01.

8. After updating to firmware 5.05, you should be able to perform the upgrade to 6.01 without having to edit nvmupdate.cfg. However, the update tool will still error out are 50% (even though it actually works).

Regards

A slightly less unhappy customer.

[idata]

Hi Unhappycustomer,

Thank you for the update and glad you were able to upgrade the firmware. Regards,Sharon