Intel X550-T1 - Can't flash NVM - Card stucked in "non-secure" mode

[Tokiwalki]

Hi,

I've a 10Gtek X550-T1 card which has a very old VNM version (v2.10) and I'd like to flash it with the latest firmware v3.60. I already contacted 10Gtek support who unfortunately doesn't provide any specific nvm flash package. Therefore I'm relying on the one provided by Intel.

So far I had no issue to update my 10Gtek X550-T1 UEFI driver via the official Intel BootUtil tool. That's said when it's about to flash the nvm it's another story, it doesn't work as my card seems to be in "non-secure" mode.

When running full inventory via nvmupdate64e.efi -u -l -o results.xml -b -c nvmupdate.cfg I obtain the following:

[00:007:00:00]: Intel(R) Ethernet Controller X550-T1
Flash inventory started.
Shadow RAM inventory started.
Shadow RAM inventory finished.
Flash inventory finished.
OROM inventory started.
OROM inventory finished.
Update
[00:007:00:00]: Intel(R) Ethernet Controller X550-T1
Flash: The device is running in non-secure mode - skipping update. Update security revisions
[00:007:00:00]: Intel(R) Ethernet Controller X550-T1
Skipping update minimum security revisions.
Update VPD with VPD template
[00:007:00:00]: Intel(R) Ethernet Controller X550-T1
Skipping VPD update with VPD template.
Checking update availability for next tool run.
Post update inventory
[00:007:00:00]: Intel(R) Ethernet Controller X550-T1
No Flash update taken - skipping inventory.
No OROM update taken - skipping inventory.

Note that the same warning "non-secure" mode message also appears in the ProSET console when I perform a "Hardware check".

Question: is above “Flash: The device is running in non-secure mode - skipping update. Update security revisions” the source of the problem?

So I investigated the "Security revision" topic. From Intel doc “Minimum Security Revision Control for Intel® Ethernet Products”:

• Firmware updates for Intel Ethernet devices have a Security Revision number (SRev). The SRev might be updated as part this NVM release…

• …The NVM update process blocks the update if the supplied NVM has a lower SRev than the MinSRev value of the NVM currently loaded on the device…"

• …Once the MinSRev is increased, this is irreversible. NVM downgrades attempting to install a lower SRev than the current MinSRev will be rejected by the device. Although not recommended, leaving the MinSRev field unmodified allows firmware downgrades from any version to any version.

Instructions from same Intel doc:

Download and extract the NVM Update Package for your device. Use the command line to update your device’s MinSRev. On Windows: nvmupdatew64e -u -optinminsrev -l update.log -o update.xml -c nvmupdate.cfg

I tried with no success, the command isn't taken into account, and the update.log file shows the same message "Error: card in non-secure mode". According to the inventory (see above) I need to move from away "non-secure" mode to a probable "secure" mode. I searched the web but coun't find any info on "non-secure" mode and how to rid of it.

Questions:

• Does "non-secure" mode mean that my nvm currently has no specified Minsrev parameter yet?
• Is there a specific command to deactivate "non-secure" mode?
• Does "non-secure" mode have something to do with "secure boot" or not?

PS: I already know that for OEM Intel NCIs based on Intel chip it's necessary to customize the nvmupdate.cfg file to be able to flash the nvm with an official Intel .bin file and to add my EEPID to the file so that my 10Gtek card is recognized. I know all this already but so that I can flash the nvm looks I need to solve first this "non-secure" stuff.

I already spent days to try to find a solution. Hoping someone could help. Thanks!

[Sreelakshmi1]

Hello Tokiwalki,

Thank you for posting in Intel community.

We appreciate you reaching out to us regarding the reported issue. As the product was purchased from 10Gtek, we kindly advise you to contact the OEM's support team for assistance. Since you have already mentioned receiving errors, we would like to inform you that the Intel BootUtil tool only supports Intel Ethernet adapters.

They will be best equipped to provide support and address any concerns related to the product's warranty/technical coverage.

Unfortunately we are unable to extend support for this product, as it falls outside of our support boundaries.

Feel free to reply to this email if you have any further questions or need assistance. We're here to help.

Regards,
Sreelakshmi

[Tokiwalki]

Hi,

Issue solved via radical solution: just bought a 100% Intel X550-T2 and I’ve been able to update the NVM straightaway (from v1.86 to v3.60) at first attempt with no problem. Same for the UEFI/PXE firmware.

It was definitely a limitation from the 10Gtek card. Just lost 179€…Lesson learned!