Hi !
I cross-referenced quite a lot of posts before getting everything right, encountering some troubles along the way, so I thought it would be a good idea to share my findings.
Everything here is merely a compilation of others' work, so cheers to them first and foremost :
@MountainBofh in
this same thread, of course the great
@fohdeesha as usual for
his reference post about ConnectX-3,
@AK360 for
his procedure,
@up3up4 for the
missing piece, and probably some I forgot — sorry.
Feel free to skip to step 7 for a complete script if you're not interested in the detailed version with explanations.
I’ve tried to be as exhaustive as possible.
This was tested on a live version of Ubuntu Server 24.04.1
Step 1: Download and Install the Tools
Some packages are needed :
sudo apt -y install gcc make dkms unzip wget
Find the latest version of
nVidia Firmware Tools (MFT) URL, download and unpack it :
Bash:
wget https://network.nvidia.com/products/adapter-software/firmware-tools
tar xvf mft-4.31.0-149-x86_64-deb.tgz
We need to install the OEM version of MFT on OEM cards to be able to disable flash write protection.
The regular
flint wouldn't allow me to disable it. Thanks
@mach3.2 for
the tip, not sure why it is not in others' procedures, maybe it wasn't necessary before.
Installation is simple; just adapt the path to the version :
sudo ./<mft-xxx_folder>/install.sh --oem
Step 2: Prepare the flash and Backup
All MFT tools address the target hardware device using an mst device name. This name is assigned by running the command
sudo mst start (in Windows, it is not required to run the
mst start command) for PCI and I2C access.
Run
sudo mst status to list the devices and their available aliases, eg.
/dev/mst/mt4117_pciconf0.
Once done, we backup some settings and retrieve the original configuration & firmware for safety, as well as to retrieve data if needed (replace device name with yours) :
Bash:
sudo flint -d /dev/mst/mt4117_pciconf0 query full > flint_query.txt;
sudo flint -d /dev/mst/mt4117_pciconf0 hw query > flint_hwinfo.txt;
sudo flint -d /dev/mst/mt4117_pciconf0 ri orig_firmware.bin;
sudo flint -d /dev/mst/mt4117_pciconf0 dc orig_firmware.ini;
sudo mlxburn -d /dev/mst/mt4117_pciconf0 -vpd > orig_vpd.txt;
Make sure to backup these files in a safe place, especially if you're using a live OS like I am.
Step 3: Download the Latest Firmware
Download the
latest firmware for the MCX4121A-ACAT, and unzip it :
Bash:
wget https://www.mellanox.com/downloads/firmware/fw-ConnectX4Lx-rel-14_32_1900-MCX4121A-ACA_Ax-UEFI-14.25.17-FlexBoot-3.6.502.bin.zip
unzip fw-ConnectX4Lx-rel-14_32_1900-MCX4121A-ACA_Ax-UEFI-14.25.17-FlexBoot-3.6.502.bin.zip
Step 4: Flash the Firmware
First we disable write protection :
sudo flint -d /dev/mst/mt4117_pciconf0 -override_cache_replacement hw set Flash0.WriteProtected=Disabled
Then, choose one of the two flashing options :
1. If you just want to update to the Mellanox firmware, not concerned about some data still showing the HPE origin of the card :
sudo flint -allow_psid_change -d /dev/mst/mt4117_pciconf0 -i fw-ConnectX4Lx-rel-14_32_1900-MCX4121A-ACA_Ax-UEFI-14.25.17-FlexBoot-3.6.502.bin burn
2. If you want to erase any trace of it being an HPE card :
sudo flint -nofs --use_image_ps --ignore_dev_data -allow_psid_change -d /dev/mst/mt4117_pciconf0 -i fw-ConnectX4Lx-rel-14_30_1004-MCX4121A-ACA_Ax-UEFI-14.23.17-FlexBoot-3.6.301.bin burn
Beware in that case, Serial Number, GUID and MAC Address will be erased.
The difference between the two seems to be purely cosmetic, as far as I know.
Step 5: Load the New Firmware
After flashing, you will see an information line with instructions on how to load the new firmware. For example :
-I- To load new FW run mlxfwreset or reboot machine.
In the above case, a simple
sudo mlxfwreset -d /dev/mst/mt4117_pciconf0 reset will do, no reboot needed.
Sometimes, only a reboot will be offered (when doing full erase for instance).
After power cycle, if you used the second command (as I did initially, blindly following a procedure), you can restore GUID and MAC.
Step 6: Restore GUID and MAC (Optional)
Many posts and docs reference that command, with the
-ocr parameter to restore the GUID and MAC :
sudo flint -d /dev/mst/mt4117_pciconfx 0x<your guid> -mac 0x<your mac> sg
then
sudo mlxfwreset -d /dev/mst/mt4117_pciconf0 reset to reset the card.
The command itself works with no error, but it does nothing — the GUID and MAC are still shown as N/A.
In
this thread the command is used without the
-ocr parameter, and it works but I get :
Code:
Description: UID GuidsNumber
Base GUID: xxxxxxxxxxxxxxxx 4
Orig Base GUID: N/A 4
Base MAC: yyyyyyyyyyyy 4
Orig Base MAC: N/A
The thing is, with HPE firmware, there was no
Orig Base GUID or
Orig Base MAC.
Then I found
this post with the same command, but with the
smg command instead of the
sg one, with comment stating "Set device manufacture GUIDs and MACs".
This seems to be the secret sauce :
sudo flint -d <device> -ocr -guid 0x<your guid> -mac 0x<your mac> smg, then the reset command, and I get something identical to the original HPE :
Code:
Description: UID GuidsNumber
Base GUID: xxxxxxxxxxxxxxxx 4
Base MAC: yyyyyyyyyyyy 4
No more
Orig Base GUID and
Orig Base MAC.
Step 7: Full Script
Finally, I wanted to script most of it, so based on
this post from reddit and tweaking it a bit, I got this :
Bash:
#!/bin/bash
# Paste latest MFT download URL here :
mft_url='https://www.mellanox.com/downloads/MFT/mft-4.31.0-149-x86_64-deb.tgz'
# Paste latest firmware URL here :
fw_url='https://www.mellanox.com/downloads/firmware/fw-ConnectX4Lx-rel-14_32_1900-MCX4121A-ACA_Ax-UEFI-14.25.17-FlexBoot-3.6.502.bin.zip'
---
sudo apt update
sudo apt -y install gcc make dkms unzip wget
mft=$(basename "${mft_url}" .tgz)
fw=$(basename "${fw_url}" .zip)
# Download Mellanox Firmware Tools (MFT)
wget $mft_url
if [ ! -f "$mft.tgz" ]; then
echo "MFT file download error"
exit 1
fi
tar xvf $mft.tgz
sudo ./$mft/install.sh --oem
if ! command -v mst &> /dev/null; then
echo "mst command not found"
exit 1
fi
# Download Firmware
wget $fw_url
if [ ! -f "$fw.zip" ]; then
echo "Firmware file download error"
exit 1
fi
unzip $fw.zip
# Start MST service
sudo mst start
sudo mst status
# Get device path & serial :
device=$(sudo mst status | awk '/\/dev\/mst\// {print $1}')
serial=$(sudo mlxburn -d $device -vpd | awk '$1 == "SN" {print $NF}')
bck_folder="./mlx_bck/Serial_${serial}"
# Backup
mkdir -p $bck_folder
sudo flint -d $device query full | tee $bck_folder/flint_query.txt
sudo flint -d $device hw query | tee $bck_folder/flint_hwinfo.txt
echo 'Please wait, backing up original firmware.'
sudo flint -d $device ri $bck_folder/orig_firmware.bin
sudo flint -d $device dc $bck_folder/orig_firmware.ini
sudo mlxburn -d $device -vpd | tee $bck_folder/orig_vpd.txt
# Get MAC && GUID
sudo flint -d $device query | grep MAC
sudo flint -d $device query | grep GUID
# Disable write protection
sudo flint -d $device -ocr hw set Flash0.WriteProtected=Disabled
# Flash firmware
sudo flint -allow_psid_change -d $device -i $fw burn
Really simple, nothing world-changing here, but proceed with caution though.
All you need is retrieve and paste the
latest MFT tools and
latest firmware download URLs in the quotes of the first 2 variables, and you’re good to go.
All backup files are stored in the ./mlx_bck/Serial_<serial_number> folder, so make sure to copy them to a safe location.
You’ll need to confirm the flash at the end, as I didn’t want to force it without confirmation.
Of course this is with flash option 1, so nothing about GUID and MAC — which require manual steps anyway.
After the flash, a simple
sudo mlxfwreset -d $device reset should do if the
mlxfwreset option is offered. Otherwise make sure to reboot.
Hope it helps.
Regards.
