Symptoms
Dell EMC PowerEdge servers with the Integrated Dell Remote Access Controller 9 (iDRAC9) that shipped with iDRAC9 firmware version 4.40.40.00 (or newer) require a two-step downgrade path to install older versions of iDRAC9 firmware. When attempting to downgrade the iDRAC9 firmware to firmware versions pre-February 2021, the firmware update fails. In the Lifecycle Log, an Informational RAC0181 event is recorded during iDRAC reboot.
Lifecycle Log RAC0181 example:
2021-07-29 13:04:38 65 SUP1901 Firmware update initializing.
2021-07-29 13:04:38 66 SUP1911 Firmware update initialization complete.
2021-07-29 13:04:38 67 SUP1904 Firmware update checksumming image.
2021-07-29 13:04:38 68 SUP1903 Firmware update verify image headers.
2021-07-29 13:04:49 69 SUP1905 Firmware update programming flash.
2021-07-29 13:05:23 70 SUP1906 Firmware update successful.
2021-07-29 13:08:20 72 RAC0182 The iDRAC firmware was rebooted with the following reason: user initiated.
2021-07-29 13:08:23 75 RAC0181 The iDRAC recovered from a firmware boot loader error with the following reason : Boot-time failover.
Repeated failed downgrade attempts result in a SUP0517 error event to be recorded also in the Lifecycle Log.
Lifecycle Log SUP0517 example:
2021-07-30 03:36:12 315 SUP0517 Unable to update the Integrated Dell Remote Access Controller firmware to version 4.22.00.53 because the operation is not supported or the device is in a locked state.
This downgrade issue is encountered under the following common use case scenarios:
New server orders where deployment includes downgrading iDRAC9 firmware to an older baseline.System board replacements for warranty service calls
Note: Lifecycle Controller automated 'PartFirmwareUpdate' feature fails on system boards that are installed with iDRAC9 4.40.40.00 and try to downgrade to older iDRAC9 firmware versions.
Cause
Dell Technologies PowerEdge 14th generation servers introduced a hardware root of trust security feature that requires firmware images to validate with certificate embedded into the system board. Starting with iDRAC9 4.40.40.00, a new hardware certificate has to be validated in the firmware image in order to apply to iDRAC. Older iDRAC firmware images do not contain the latest hardware certificate image.
Resolution
In order to downgrade the iDRAC9 to pre-February 2021 firmware versions, the iDRAC will require a downgrade to iDRAC9 firmware version 4.40.10.00. This firmware version supports the legacy hardware root of trust certificate and allow downgrades to earlier versions.
