Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4)
Georgi Felix (gfelix)
nxos n9K epldRN 924 Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4)
This document lists the current and past versions of EPLD images and describes how to update them for use with the Cisco Nexus 9000 Series switches.
The following table lists the changes to this document.
Date August 21, 2019
Description Created the Cisco Nexus 9000 Series EPLD release notes for Release 9.2(4).
Cisco Systems, Inc. www.cisco.com
1
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) Introduction
Table of Contents
INTRODUCTION
3
DECIDING WHEN TO UPGRADE EPLDS
3
SWITCH REQUIREMENTS
3
EPLD UPGRADES AVAILABLE FOR NX-OS MODE RELEASES 9.2(1) THROUGH 9.2(4)
5
CISCO SECURE BOOT HARDWARE TAMPERING VULNERABILITY - REMEDIATION STEPS
6
DETERMINING WHETHER TO UPGRADE EPLD IMAGES
13
DOWNLOADING THE EPLD IMAGES
14
INSTALLATION GUIDELINES
15
UPGRADING THE EPLD IMAGES
16
VERIFYING THE EPLD UPGRADES
16
DISPLAYING THE STATUS OF EPLD UPGRADES
16
LIMITATIONS
16
RELATED DOCUMENTATION
16
RELEASE NOTES
17
DOCUMENTATION FEEDBACK
17
OBTAINING DOCUMENTATION AND SUBMITTING A SERVICE REQUEST
17
2
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) Introduction
Introduction
The Cisco Nexus 9000 Series NX-OS mode switches contain several programmable logical devices (PLDs) that provide hardware functionalities in all modules. Cisco provides electronic programmable logic device (EPLD) image upgrades to enhance hardware functionality or to resolve known issues. PLDs include electronic programmable logic devices (EPLDs), field programmable gate arrays (FPGAs), and complex programmable logic devices (CPLDs), but they do not include ASICs. In this document, the term EPLD is used for FPGA and CPLDs.
The advantage of having EPLDs for some module functions is that when you need to upgrade those functions, you just upgrade their software images instead of replacing their hardware.
NOTE: EPLD image upgrades for a line card disrupt the traffic going through the module because the module must power down briefly during the upgrade. The system performs EPLD upgrades on one module at a time, so at any one time the upgrade disrupts only the traffic going through one module.
NOTE: For N9K-C9348GC-FXP, EPLD should be upgraded to minimum 9.2(3) version for 9.2(x) release. Please refer to CSCvm94301 for further details.
NOTE: N9300-EX/N9300-FX/N9200 switches running 703I7(2-5), 9.2(1), or 9.2(2) version of the code, may experience constant high PTP correction (~125/250ms) with no change from the grand master clock. Please refer to CSCvn94487 for further details.
Cisco provides the latest EPLD images with each release. Typically, these images are the same as provided in earlier releases but occasionally some of these images are updated. These EPLD image updates are not mandatory unless otherwise specified. The EPLD image upgrades are independent from the Cisco In Service Software Upgrade (ISSU) process, which upgrades the system image with no impact on the network environment.
When Cisco makes an EPLD image upgrade available, these release notes announce their availability, and you can download the EPLD images from https://software.cisco.com/download/navigator.html.
Deciding When to Upgrade EPLDs
When new EPLD images are available, the upgrades are always recommended if your network environment allows for a maintenance period in which some level of traffic disruption is acceptable. If such a disruption is not acceptable, then consider postponing the upgrade until a better time.
NOTE: The EPLD upgrade operation is a disruptive operation. Execute this operation only at a programmed maintenance time. The system ISSU upgrade is a nondisruptive upgrade.
NOTE: EPLD version is backward compatible.
NOTE: Do not perform an EPLD upgrade during an ISSU system upgrade.
Switch Requirements
The Cisco Nexus 9000 Series switch must be running the Cisco NX-OS operating system and include the following hardware:
Supervisor modules (2) each with at least 800 MB of available boot flash memory (Cisco Nexus 9504, 9508, and 9516 switches)
System controller modules (2) (Cisco Nexus 9504, 9508, and 9516 switches)
Line cards (Cisco Nexus 9504, 9508, and 9516 switches)
3
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) Switch Requirements
-- Cisco Nexus 9504 switch (1 to 4 line cards) -- Cisco Nexus 9508 switch (1 to 8 line cards) -- Cisco Nexus 9516 switch (1 to 16 line cards) Fabric modules (Cisco Nexus 9504, 9508, and 9516 switches) -- Fabric modules for 40-Gigabit line cards on a Cisco Nexus 9504, 9508, or 9516 switch (3-6 modules) -- Fabric modules for 100-Gigabit E line cards on a Cisco Nexus 9504, 9508, or 9516 switch (4 modules) -- Fabric modules for 100-Gigabit S line cards on a Cisco Nexus 9504 or 9508 switch (4 modules) Fan modules -- Cisco Nexus 92304QC, 9272Q, and 93120TX switches (2 modules) -- Cisco Nexus 9336C-FX2, 9364C, 9396PX, 9396TX, and 93128TX switches (3 modules) -- Cisco Nexus 9236C, 92160YC-X, 92300YC, 9332PQ, 9372PX, 9372PX-E, 9372TX, 9372TX-E,
93108TC-EX, and 93180LC-EX switches (4 modules) -- Cisco Nexus 9332C, and 93240YC-FX2 switch (5 modules) -- Cisco Nexus 9504, 9508, and 9516 switches (3 fan trays) Power supplies -- 500-W AC, 930-W DC, or 1200-W HVAC/HVDC power supplies (2 for the Cisco Nexus 93180LC-EX
switches) -- 650-W AC, 930-W DC, or 1200-W HVAC/HVDC power supplies (2 for the Cisco Nexus 92160YC-X,
92304QC, 9236C, 93108TC-EX, 93180YC-EX, 9332PQ, 9372PX, 9372PX-E, 9372TX, 9372TX-E, 9396PX, and 9396TX switches -- 650-W AC or 1200-W HVAC/HVDC power supplies (2 for Cisco Nexus 92300YC switches) -- 930-W DC power supplies (2 for all Cisco Nexus 9200 and 9300 platform switches (except 92300YC and 9348GC-FXP switches) -- 11000W AC power supplies (2) for the Cisco Nexus 9332C, 9336C and 93240YC switches -- 11000W DC power supplies (2) for the Cisco Nexus 9332C, 9336C and 93240YC switches -- 11000W HVAC/HVDC power supplies (2) for the Cisco Nexus 9336C and 93240YC switches -- 1200-W AC power supplies (2) or 930-W DC power supplies (2) for the Cisco Nexus 9272Q, 93120TX, 93128TX, and 9364C switches -- 1200-W HVAC/HVDC power supplies (2) for all Cisco Nexus 9200 and 9300 platform switches (except the 9348GC-FXP switch) -- 3000-W AC power supplies or 3000-W Universal AC/DC or 3000-W DC power supplies for Cisco Nexus 9500 switches -- 3.15-kW dual input universal AC/DC power for the Cisco Nexus 9500 switches - Cisco Nexus 9504 switch (up to 4)
4
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) EPLD Upgrades Available for NX-OS Mode Releases 9.2(1) through 9.2(4)
- Cisco Nexus 9508 switch (up to 8) - Cisco Nexus 9516 switch (up to 10) Uplink module (Cisco Nexus 93128TX, 9396PX, and 9396TX switches only) -- M4PC-CFP2 -- M6PQ -- M6PQ-E -- M12PQ You must be able to access the switch through a console, SSH, or Telnet (required for setting up a switch running in NX-OS mode). You must have administrator privileges to work with the Cisco Nexus 9000 Series switch.
EPLD Upgrades Available for NX-OS Mode Releases 9.2(1) through 9.2(4)
Each EPLD image that you can download from https://software.cisco.com/download/navigator.html is a bundle of EPLD upgrades. To see the recent updated EPLD versions for the Cisco Nexus 9200, 9300, 9300-EX, 9300-FX, and 9500 platforms, see the following tables. NOTE: All updates to an image are shown in boldface. If more than one release is shown for a column, the boldface applies to the first release listed for the column.
NOTE: The 9.2(4) release of EPLD, addresses the Secure Boot Hardware Tampering vulnerability for the Nexus 3K and Nexus 9000 Series switches. Please refer to Security Advisory at https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190513-secureboot.
Please review the advisory for affected HW-PIDs (see below table) for more details on how to apply the patch. The 9.2(4) release epld requires a specific sequence of upgrade.
Table 1. Vulnerable Products addressed in Security Advisory (cisco-sa-20190513-secureboot)
Nexus 9000 Series Switches
PID N9K-C93180YC-EX N9K-C93108TC-EX N9K-C93180LC-EX N9K-C93180YC-FX N9K-C93108TC-FX N9K-C9348GC-FXP N9K-C92300YC N9K-C93240YC-FX2 N9K-C9336C-FX2
Fixed IO FPGA Version 0x15 0x15 0x20 0x20 0x20 0x10 0x20 0x10 0x10
5
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) Cisco Secure Boot Hardware Tampering Vulnerability - Remediation Steps
N9K-C9364C N9K-C9332C N9K-C92160YC-X N9K-C9272Q N9K-C92304QC N9K-C9236C N9K-C9232C N9K-SUP-A+ N9K-SUP-B+ N9K-C93120TX N9K-SUP-B N9K-SUP-A
Nexus 3000 Series Switches N3K-C36180YC-R N3K-C3636C-R N3K-3232C N3K-C3264Q-S N3K-C31108PC-V N3K-C3164Q-40GE N3K-C31108TC-V N3K-C3132C-Z N3K-C3264C-E
0x6 0x10 0x19 0x17 0x12 0x17 0x8 0x14 0x14 0x13 0x30 0x30
0x8 0x8 0x12 0x12 0x6 0x13 0x6 0x20 0x6
NOTE: N3K-C36180YC-R and N3K-C3636C-R, CPU FPGA will have the fix, so look for CPU FPGA instead of IO.
Cisco Secure Boot Hardware Tampering Vulnerability - Remediation Steps
The following section details updating your EPLD version for affected switches listed in: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190513-secureboot
Nexus 9000 Modular chassis:
IMPORTANT NOTE: It is required to update both Golden and Primary regions of FPGA to address this particular vulnerability. It is by design, that we don't allow updating both primary and golden at the same time (to avoid programming errors, that may cause switch to not boot, hence only one region is allowed to be programmed per reload).
Please do not attempt to upgrade Golden region of FPGA once it is on a fixed version.
1.Copy the EPLD image to bootflash (e.g. used n9000-epld.9.2.4.img).
2.Assuming the active supervisor is in Slot27. Update the Primary FPGA region.
6
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) Cisco Secure Boot Hardware Tampering Vulnerability - Remediation Steps
install epld bootflash:n9000-epld.9.2.4.img module all
Expected result: Switch will update primary EPLD of the supervisor and will reload the switch automatically. Please don't interrupt, power cycle or reload when EPLD update is happening. Once the supervisor is booted, the 'show version module 27 epld' will continue to show old version. Since we are using the module all command for the upgrade, SCs, FMs, LCs may get upgraded if applicable.
Switch#show version module 27 epld
-------------------------------------------------------------------
Name
InstanceNum
Version Date
-------------------------------------------------------------------
IO FPGA
0
0x27 20160111
BIOS version
v08.35(08/31/2018)
Alternate BIOS version
v08.32(10/18/2016)
This is expected, as the switch would have booted from Golden FPGA which is still not updated. You can verify this from syslog which would say:
%CARDCLIENT-5-MOD_BOOT_GOLDEN: Module 27 IOFPGA booted from Golden
3. Update the Golden (also called backup) FPGA region.
install epld bootflash:n9000-epld.9.2.4.img module all golden
Module 27 : IO FPGA [Programming ] : 100.00% (
Module 27 EPLD upgrade is successful.
Module Type Upgrade-Result
------ ------------------ --------------
27
SUP
Success
64 of
64 total sectors)
Expected result: Switch will update the golden EPLD of the supervisor and will reload the switch module automatically. Please don't interrupt, power cycle or reload when EPLD update is happening. Since we are using the module all command for the upgrade, SCs, FMs, LCs may get upgraded if applicable.
Once this is done, wait for switch to boot up and for modules to come online. W
show version module 27
epld' you will see FPGA version that is >= to the fixed version for the supervisor. Your supervisor has the vulnerability fixed
version of FPGA.
SWITCH# show version module 27 epld
-------------------------------------------------------------------
Name
InstanceNum
Version Date
-------------------------------------------------------------------
IO FPGA
0
0x30 20190625
BIOS version
v08.35(08/31/2018)
Alternate BIOS version
v08.32(10/18/2016)
At the end of the upgrades, switch should boot with primary IOFPGA for the SUP, log below
switch# show logging log | grep -i fpga | grep -i 27 2019 Jul 10 07:55:04 switch %CARDCLIENT-5-MOD_BOOT_PRIMARY: Module 27 IOFPGA booted from Primary
7
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) Cisco Secure Boot Hardware Tampering Vulnerability - Remediation Steps
Note : If you have dual supervisor, the above procedure will also upgrade standby supervisor. Assuming standby supervisor is slot 28, you can check show version module 28 epld'
Nexus 9000 and Nexus 3000 TOR:
IMPORTANT NOTE: It is required to update both Golden and Primary regions of FPGA to address this particular vulnerability. It is by design, that we don't allow updating both primary and golden at the same time (to avoid programming errors, that may cause switch to not boot, hence only one region is allowed to be programmed per reload).
Please do not attempt to upgrade Golden region of FPGA once it is on a fixed version.
1. Copy the EPLD image to bootflash (e.g. used n9000-epld.9.2.4.img). 2. Update the Primary FPGA region.
install epld bootflash:n9000-epld.9.2.4.img module 1
Expected result: Switch will update EPLD and will reload automatically. Please don't interrupt, power cycle or reload when
EPLD update is happening.
show version module 1 epld
Fpga version for IO, due to this. This is expected.
show version module 1 epld
-------------------------------------------------------------------
Name
InstanceNum
Version Date
-------------------------------------------------------------------
IO FPGA
0
0x07 20190607
MI FPGA
0
0x01 20170609
BIOS version
v01.14(06/15/2019)
Alternate BIOS version
v01.12(07/25/2018)
You can verify this from syslog which would say:
%CARDCLIENT-5-MOD_BOOT_GOLDEN: Module 1 IOFPGA booted from Golden %CARDCLIENT-2-FPGA_BOOT_GOLDEN: IOFPGA booted from Golden
3. Update the Golden (also called backup) FPGA region. install epld bootflash:n9000-epld.9.2.4.img module 1 golden
Note: The word
is a hidden word that you will need to type into the command line to execute.
Expected result: Switch will update EPLD and will reload automatically. Please don't interrupt, power cycle or reload when EPLD update is happening.
Once this is done, when you check 'show version module 1 epld' you will see FPGA version that is >= to the fixed version.
show version module 1 epld
-------------------------------------------------------------------
Name
InstanceNum
Version Date
-------------------------------------------------------------------
IO FPGA
0
0x07 20180920
8
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) Cisco Secure Boot Hardware Tampering Vulnerability - Remediation Steps
MI FPGA BIOS version Alternate BIOS version
0
0x01 20170609
v01.14(06/15/2019)
v01.12(07/25/2018)
After uprade is complete, switch should boot up with primary, shown logs below
show logging log | grep -i fpga 2019 Jul 9 19:46:11 switch %CARDCLIENT-2-FPGA_BOOT_PRIMARY: IOFPGA booted from Primary 2019 Jul 9 19:46:11 switch %CARDCLIENT-2-FPGA_BOOT_PRIMARY: MIFPGA booted from Primary 2019 Jul 9 19:46:11 switch %CARDCLIENT-5-MOD_BOOT_PRIMARY: Module 1 IOFPGA booted from Primary 2019 Jul 9 19:46:11 switch %CARDCLIENT-5-MOD_BOOT_PRIMARY: Module 1 MIFPGA booted from Primary
NOTE: For N3K-C36180YC-R and N3K-C3636C-R, CPU FPGA will have the fix, so look for CPU FPGA instead of IO.
Available EPLD Images for the Cisco Nexus 9200, 9300, 9300-EX, and 9300-FX Platform Switches
Switch or Uplink Module
Cisco Nexus 92160YC-X (N9K-C92160YC-X)
EPLD Device IOFPGA
MIFPGA
Release 9.2(1) 0x17 (0.023)
0x5 (0.005)
Release 9.2(2) 0x17 (0.023)
0x5 (0.005)
Release 9.2(3) 0x18 (0.024)
0x5 (0.005)
Cisco Nexus 92300YC (N9K-C92300YC)
IOFPGA 0x19 (0.025) 0x19 (0.025) 0x19 (0.025) MIFPGA0 0x7 (0.007) 0x7 (0.007) 0x7 (0.007)
MIFPGA1 0x2 (0.002) 0x2 (0.002) 0x2 (0.002)
Cisco Nexus 92304QC (N9K-C92304QC)
IOFPGA 0x10 (0.016) 0x10 (0.016) 0x10 (0.016) MIFPGA0 0x1 (0.001) 0x1 (0.001) 0x1 (0.001)
MIFPGA1 0x1 (0.001) 0x1 (0.001) 0x1 (0.001)
Cisco Nexus 9236C (N9K-C9236C)
IOFPGA 0x15 (0.021) 0x15 (0.021) 0x15 (0.021) MIFPGA 0x9 (0.009) 0x9 (0.009) 0x9 (0.009)
Cisco Nexus 9272Q (N9K-C9272Q)
IOFPGA 0x16 (0.022) 0x16 (0.022) 0x16 (0.022) MIFPGA0 0x4 (0.004) 0x4 (0.004) 0x4 (0.004)
MIFPGA1 0x7 (0.007) 0x7 (0.007) 0x7 (0.007)
Cisco Nexus 93108TC-EX (N9K-C93108TC-EX)
IOFPGA 0x10 (0.016) 0x12 (0.018) 0x13 (0.019) MIFPGA 0x2 (0.002) 0x2 (0.002) 0x2 (0.002)
Cisco Nexus 93108TC-FX (N9K-C93108TC-FX)
Cisco Nexus 93120TX (N9K-C93120TX)
IOFPGA MIFPGA IOFPGA MIFPGA1
0x19 (0.025) 0x3 (0.003) 0x8 (0.008) 0x10 (0.016)
0x19 (0.025) 0x3 (0.003) 0x8 (0.008) 0x10 (0.016)
0x19 (0.025) 0x3 (0.003) 0x8 (0.008) 0x10 (0.016)
MIFPGA2 0x9 (0.009) 0x9 (0.009) 0x9 (0.009)
Cisco Nexus 93128TX (N9K-C93128TX)
IOFPGA 0x11 (0.017) 0x11 (0.017) 0x11 (0.017) MIFPGA 0x9 (0.009) 0x9 (0.009) 0x9 (0.009)
Cisco Nexus 93180LC-EX (N9K-C93180LC-EX)
IOFPGA 0x19 (0.025) 0x19 (0.025) 0x19 (0.025) MIFPGA 0x15 (0.021) 0x15 (0.021) 0x15 (0.021)
Cisco Nexus 93180YC-EX
IOFPGA 0x9 (0.009) 0x9 (0.009) 0x14 (0.020)
Release 9.2(4) 0x19 (0.025) 0x5 (0.005) 0x20 (0.032) 0x7 (0.007) 0x2 (0.002) 0x11 (0.017) 0x12 (0.018) 0x1 (0.001) 0x17 (0.023) 0x9 (0.009) 0x17 (0.023) 0x4 (0.004) 0x7 (0.007) 0x15 (0.021) 0x2 (0.002) 0x20 (0.032) 0x3 (0.003) 0x13 (0.019) 0x10 (0.016) 0x9 (0.009) 0x11 (0.017) 0x9 (0.009) 0x20 (0.032) 0x15 (0.021)
0x15 (0.021)
9
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) Cisco Secure Boot Hardware Tampering Vulnerability - Remediation Steps
Switch or Uplink Module
(N9K-C93180YC-EX) Cisco Nexus 93180YC-FX (N9K-C93180YC-FX) Cisco Nexus 93240YC-FX2 (N9K-C93240YC-FX2)
Cisco Nexus 9332C (N9K-C9332C)
Cisco Nexus 9332PQ (N9K-C9332PQ)
Cisco Nexus 9336C-FX2 (N9K-C9336C-FX2) Cisco Nexus 9348GC-FXP (N9K-C9348GC-FXP) Cisco Nexus 9364C (N9K-C9364C)
Cisco Nexus 9372PX (N9K-C9372PX)
Cisco Nexus 9372PX-E (N9K-C9372PX-E) Cisco Nexus 9372TX (N9K-C9372TX)
Cisco Nexus 9372TX-E (N9K-C9372TX-E) Cisco Nexus 9396PX (N9K-C9396PX)
Cisco Nexus 9396TX (N9K-C9396TX) 4-port 100-Gigabit optical uplink module(N9K-M4PC-CFP2) 6-port 40-Gigabit optical uplink module (N9K-M6PQ or N9K-M6PQ-E) 12-port optical uplink module (N9K-M12PQ)
1 Not available in this release.
EPLD Device MIFPGA
IOFPGA MIFPGA IOFPGA MIFPGA1 MIFPGA2 IOFPGA MIFPGA IOFPGA MIFPGA IOFPGA MIFPGA IOFPGA MIFPGA IOFPGA MIFPGA MIFPGA1 IOFPGA MIFPGA IOFPGA MIFPGA IOFPGA MIFPGA IOFPGA MIFPGA IOFPGA MIFPGA IOFPGA MIFPGA
Release 9.2(1) 0x4 (0.004)
0x19 (0.025)
0x10 (0.016) 0x8 (0.008) 0x12 (0.018) 0x7 (0.007)
N.A.1 N.A.1 0x12 (0.018) 0x17 (0.023) 0x8 (0.008) 0x4 (0.004) 0x7 (0.007)
0x9 (0.009)
0x5 (0.005)
0x8 (0.008)
0x3 (0.003) 0x8 (0.008) 0x15 (0.021) 0x8 (0.008) 0x15 (0.021) 0x6 (0.006) 0x15 (0.021) 0x6 (0.006) 0x3 (0.003) 0x16 (0.022) 0x15 (0.021) 0x9 (0.009) 0x11 (0.017)
MIFPGA 0x10 (0.016)
MIFPGA 0x20 (0.032)
Release 9.2(2) 0x4 (0.004) 0x19 (0.025) 0x10 (0.016) 0x9 (0.009) 0x12 (0.018) 0x7 (0.007) N.A.1 N.A.1 0x12 (0.018) 0x17 (0.023) 0x9 (0.009) 0x4 (0.004) 0x8 (0.008) 0x9 (0.009) 0x5 (0.005) 0x8 (0.008) 0x3 (0.003) 0x8 (0.008) 0x15 (0.021) 0x8 (0.008) 0x15 (0.021) 0x6 (0.006) 0x15 (0.021) 0x6 (0.006) 0x3 (0.003) 0x16 (0.022) 0x15 (0.021) 0x9 (0.009) 0x11 (0.017)
0x10 (0.016)
0x20 (0.032)
Release 9.2(3) 0x4 (0.004) 0x19 (0.025) 0x10 (0.016) 0x9 (0.009) 0x12 (0.018) 0x7 (0.007) 0x9 (0.009) 0x3 (0.003) 0x12 (0.018) 0x17 (0.023) 0x9 (0.009) 0x5 (0.005) 0x8 (0.008) 0x10 (0.016) 0x5 (0.005) 0x10 (0.016) 0x3 (0.003) 0x8 (0.008) 0x15 (0.021) 0x8 (0.008) 0x15 (0.021) 0x6 (0.006) 0x15 (0.021) 0x6 (0.006) 0x3 (0.003) 0x16 (0.022) 0x15 (0.021) 0x9 (0.009) 0x11 (0.017)
0x10 (0.016)
0x20 (0.032)
Release 9.2(4) 0x4 (0.004) 0x20 (0.032) 0x10 (0.016) 0x10 (0.016) 0x8 (0.008) 0x12 (0.018) 0x8 (0.008) 0x2 (0.002) 0x12 (0.018) 0x17 (0.023) 0x10 (0.016) 0x5 (0.005) 0x10 (0.016) 0x10 (0.016) 0x6 (0.006) 0x11 (0.017) 0x4 (0.004) 0x8 (0.008) 0x15 (0.021) 0x8 (0.008) 0x15 (0.021) 0x6 (0.006) 0x15 (0.021) 0x6 (0.006) 0x3 (0.003) 0x16 (0.022) 0x15 (0.021) 0x9 (0.009) 0x11 (0.017)
0x10 (0.016)
0x20 (0.032)
10
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) Cisco Secure Boot Hardware Tampering Vulnerability - Remediation Steps
Available EPLD Images for the Cisco Nexus 9500 Platform Switches
Component Supervisor A (N9K-SUP-A)
EPLD Device IOFPGA
Release 9.2(1) 0x27 (0.039)
Supervisor A+ (N9K-SUP-A+)
IOFPGA 0x9 (0.009)
Supervisor B (N9K-SUP-B)
IOFPGA 0x27 (0.039)
Supervisor B+ (N9K-SUP-B+)
IOFPGA 0x9 (0.009)
System Controller (N9K-SC-A)
IOFPGA 0x20 (0.032)
8-port 100-Gigabit CFP2 line card (N9K-X9408)
IOFPGA 0x5 (0.005) MIFPGA 0x9 (0.009)
32-port 100-Gigabit QSFP28 line card (N9K-X9432C-S)
IOFPGA 0x14 (0.020) MIFPGA 0x4 (0.004)
32-port 40-Gigabit QSFP+ line card (N9K-X9432PQ)
IOFPGA 0x16 (0.022) MIFPGA 0x13 (0.019)
32-port 100-Gigabit QSFP28 line card
IOFPGA 0x12 (0.018)
(N9K-X9732C-EX) (for E fabric modules) MIFPGA 0x8 (0.008)
36-port 100-Gigabit QSFP28 line card (N9K-X9732C-FX)
IOFPGA 0x5 (0.005) MIFPGA 0x1 (0.001)
36-port 40-Gigabit QSFP+ line card (N9K-X9636PQ)
IOFPGA 0x16 (0.022) MIFPGA 0x13 (0.019)
36-port 40-Gigabit QSFP+ line card (N9K-X9536PQ)
IOFPGA 0x10 (0.016) MIFPGA 0x7 (0.007)
36-port 100-Gigabit QSFP28 line card (N9K-X9736C-EX)
IOFPGA 0x11 (0.017) MIFPGA 0x7 (0.007)
36-port 100-Gigabit QSFP28 line card (N9K-X9736C-FX)
IOFPGA 0x5 (0.005) MIFPGA 0x6 (0.006)
48-port 1-/10-Gigabit SFP+ and 4-port 40-Gigabit QSFP+ line card (N9K-X9464PX) 48-port 1/10GBASE-T and 4-port 40-Gigabit QSFP+ line card (N9K-X9464TX) 48-port 1/10GBASE-T and 4-port 40-Gigabit QSFP+ line card (N9K-X9464TX2) 48-port 1/10GBASE-T and 4-port 40-Gigabit QSFP+ line card (N9K-X9564TX) 48-port 1-/10-Gigabit SFP+ and 4-port 40-Gigabit QSFP+ line card (N9K-X9564PX) 48-port 1-/10-/25-Gigabit SFP28 and
IOFPGA 0x11 (0.017) MIFPGA 0x10 (0.016)
IOFPGA MIFPGA
0x9 (0.009) 0x8 (0.008)
IOFPGA MIFPGA
0x9 (0.009) 0x3 (0.003)
IOFPGA MIFPGA
0x9 (0.009) 0x8 (0.008)
IOFPGA 0x10 (0.016) MIFPGA 0x10 (0.016)
IOFPGA 0x8 (0.008)
Release 9.2(2) 0x27 (0.039) 0x9 (0.009) 0x27 (0.039) 0x9 (0.009) 0x20 (0.032) 0x5 (0.005) 0x9 (0.009) 0x14 (0.020) 0x4 (0.004) 0x16 (0.022) 0x13 (0.019) 0x12 (0.018) 0x8 (0.008) 0x5 (0.005) 0x1 (0.001) 0x17 (0.023) 0x13 (0.019) 0x11 (0.017) 0x7 (0.007) 0x12 (0.018) 0x8 (0.008) 0x6 (0.006) 0x6 (0.006) 0x11 (0.017) 0x10 (0.016)
0x9 (0.009) 0x8 (0.008)
0x9 (0.009) 0x3 (0.003)
0x10 (0.010) 0x8 (0.008)
0x11 (0.017) 0x10 (0.016)
0x11 (0.017)
Release 9.2(3) 0x27 (0.039) 0x9 (0.009) 0x27 (0.039) 0x9 (0.009) 0x20 (0.032) 0x5 (0.005) 0x9 (0.009) 0x14 (0.020) 0x4 (0.004) 0x16 (0.022) 0x13 (0.019) 0x12 (0.018) 0x8 (0.008) 0x5 (0.005) 0x1 (0.001) 0x17 (0.023) 0x13 (0.019) 0x11 (0.017) 0x7 (0.007) 0x12 (0.018) 0x8 (0.008) 0x6 (0.006) 0x6 (0.006) 0x11 (0.017) 0x10 (0.016)
0x9 (0.009) 0x8 (0.008)
0x9 (0.009) 0x3 (0.003)
0x10 (0.010) 0x8 (0.008)
0x11 (0.017) 0x10 (0.016)
0x11 (0.017)
Release 9.2(4) 0x30 (0.049) 0x14 (0.020) 0x30 (0.049) 0x14 (0.020) 0x20 (0.032) 0x5 (0.005) 0x9 (0.009) 0x14 (0.020) 0x4 (0.004) 0x16 (0.022) 0x13 (0.019) 0x12 (0.018) 0x8 (0.008) 0x5 (0.005) 0x1 (0.001) 0x17 (0.023) 0x13 (0.019) 0x11 (0.017) 0x7 (0.007) 0x12 (0.018) 0x8 (0.008) 0x6 (0.006) 0x6 (0.006) 0x11 (0.017) 0x10 (0.016)
0x9 (0.009) 0x8 (0.008)
0x9 (0.009) 0x3 (0.003)
0x10 (0.010) 0x8 (0.008)
0x11 (0.017) 0x10 (0.016)
0x11 (0.017)
11
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) Cisco Secure Boot Hardware Tampering Vulnerability - Remediation Steps
Component
4-port 40-/100-Gigabit QSFP28 line card (N9K-X97160YC-EX) 48-port 10-Gigabit SFP+ and 4-port 100-Gigabit QSFP28 line card (N9K-X9788TC-FX) Fabric module for Cisco Nexus 9504 40-Gigabit line cards (N9K-C9504-FM) Fabric module for Cisco Nexus 9504 100-Gigabit EX line (N9K-C9504-FM-E) Fabric module for Cisco Nexus 9504 100-Gigabit S line cards (N9K-C9504-FM-S) Fabric module for Cisco Nexus 9508 40-Gigabit line cards (N9K-C9508-FM) Fabric module for Cisco Nexus 9508 100-Gigabit EX line cards (N9K-C9508-FM-E) Fabric module for Cisco Nexus 9508 100-Gigabit EX line (N9K-C9508-FM-E2) Fabric module for Cisco Nexus 9508 100-Gigabit S line (N9K-C9508-FM-S) Fabric module for Cisco Nexus 9516 40-Gigabit line cards (N9K-C9516-FM)
Fabric module for Cisco Nexus 9516 100-Gigabit EX line cards (N9K-C9516-FM-E) Fabric module for Cisco Nexus 9516 100-Gigabit -EX and -FX line cards (N9K-C9516-FM-E2)
2 Not available in this release.
EPLD Device MIFPGA IOFPGA MIFPGA IOFPGA IOFPGA IOFPGA
IOFPGA IOFPGA
IOFPGA IOFPGA IOFPGA
IOFPGA MIFPGA IOFPGA MIFPGA
Release 9.2(1) 0x4 (0.004)
Release 9.2(2) 0x4 (0.004)
Release 9.2(3) 0x4 (0.004)
Release 9.2(4) 0x4 (0.004)
0x2 (0.002) 0x5 (0.005) 0x19 (0.025)
0x3 (0.003) 0x5 (0.005) 0x19 (0.025)
0x3 (0.003) 0x5 (0.005) 0x19 (0.025)
0x3 (0.003) 0x5 (0.005) 0x19 (0.025)
0x13 (0.019) 0x14 (0.020) 0x14 (0.020) 0x14 (0.020)
0x11 (0.017) 0x11 (0.017) 0x11 (0.017) 0x11 (0.017)
0x19 (0.025) 0x19 (0.025) 0x19 (0.025) 0x19 (0.025) 0x13 (0.019) 0x13 (0.019) 0x13 (0.019) 0x13 (0.019)
0x8 (0.008) 0x8 (0.008) 0x8 (0.008) 0x8 (0.008) 0x11 (0.017) 0x11 (0.017) 0x11 (0.017) 0x11 (0.017) 0x13 (0.019) 0x13 (0.019) 0x13 (0.019) 0x13 (0.019)
0x7 (0.007) 0x5 (0.005) 0x9 (0.009) 0x7 (0.007)
0x7 (0.007) 0x7 (0.007)
0x7 (0.007) 0x7 (0.007)
0x11 (0.011) 0x11 (0.011) 0x7 (0.007) 0x7 (0.007)
0x7 (0.007) 0x7 (0.007) 0x11 (0.011) 0x7 (0.007)
Available EPLD Images for the Cisco Nexus 9500 Platform Switches with R Line Cards
Component
36-port 100-Gigabit QSFP28 line card (N9K-X9636C-RX)
EPLD Device IOFPGA
MIFPGA
Release 9.2(1) 0x15 (0.021)
0x3 (0.003)
Release 9.2(2) 0x15 (0.021)
0x3 (0.003)
Release 9.2(3) 0x15 (0.021)
0x3 (0.003)
36-port 100-Gigabit QSFP28 line card (N9K-X9636C-R)
IOFPGA MIFPGA
0xF 0x9 (0.009)
0xF 0x9 (0.009)
0xF 0x9 (0.009)
36-port 100-Gigabit QSF+ line card (N9K- IOFPGA 0x16 (0.022) 0x16 (0.022) 0x16 (0.022)
X9636Q-R)
MIFPGA 0x3 (0.003) 0x3 (0.003) 0x3 (0.003)
52-port 100-Gigabit R line cards (N9K- IOFPGA
0xF
0xF
0xF
Release 9.2(4) 0x17 (0.023) 0x3 (0.003) 0x11 (0.017) 0x9 (0.009) 0x18 (0.024) 0x3 (0.003)
0xF
12
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) Determining Whether to Upgrade EPLD Images
Component
X96136YC-R)
Fabric module for Cisco Nexus 9504 100-Gigabit R line cards (N9K-C9504-FM-R) Fabric module for Cisco Nexus 9508 100-Gigabit R line cards (N9K-C9508FM-R)
3 Not available in this release.
EPLD Device MIFPGA
DBFPGA
IOFPGA
Release 9.2(1) 0xA
0xE
0x7 (0.007)
Release 9.2(2) 0xA
0xE
0x7 (0.007)
Release 9.2(3) 0xA
0xE
0x7 (0.007)
Release 9.2(4) 0xA
0xE
0x7 (0.007)
IOFPGA 0x10 (0.016) 0x10 (0.016) 0x10 (0.016) 0x10 (0.016)
Determining Whether to Upgrade EPLD Images
EPLD image number, you can skip the upgrade.
To determine the EPLD upgrades needed for a Cisco Nexus 3000 Series switch, use the show install impact epld bootflash: command on that switch and indicate the n9000-epld.9.2.4 image. In the following example, the MIFPGA, and IOFPGA EPLD images do not need to be upgraded.
switch# show install all impact epld n9000-epld.9.2.4.img
Compatibility check:
Module
Type
Upgradable
Impact Reason
------ ----------------- ---------- ---------- ------
1
SUP
Yes
disruptive Module Upgradable
Retrieving EPLD versions... Please wait.
Images will be upgraded according to following table:
Module Type EPLD
Running-Version New-Version
------ ---- -------------
--------------- -----------
1 SUP MI FPGA
0x23
0x23
1 SUP IO FPGA
0x06
0x06
1 SUP MI FPGA2
0x23
0x23
Upg-Required ------------
No No No
13
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) Downloading the EPLD Images
Downloading the EPLD Images
Before you can prepare the EPLD images for installation, you must download them to the FTP or management server.
1 From a browser, go to https://software.cisco.com/download/navigator.html.
The browser displays the Cisco website.
2 Choose Switches.
A list of switch types displays on the right.
3 Select Data Center Switches.
The right side lists the Data Center Switch product series.
4 Select Cisco Nexus 9000.
The right side lists the switches in the series that you selected.
5 Select the switch that you are updating EPLD images for.
The Downloads page opens and lists what you can download for the switch that you selected.
6 Select NX-OS EPLD Updates.
The Download Software page lists the available EPLD images for the switch.
7 If you see a new EPLD image for the NX-OS software installed on the switch, click the Download button.
CAUTION: When you are trying to upgrade EPLD, it is recommended to use the same version of EPLD as that of installed software. However, if the installed version of EPLD is already later than the software you are installing, it is not required to downgrade the EPLD.
8 Click the link for the file.
The Downloads page displays a Download button and lists information for the file.
9 Click Download.
The Supporting Documents page opens to display the rules for downloading the software.
10 Read the rules and click Agree.
A File Download dialog box opens to ask if you want to open or save the images file.
11 Click Save.
The Save As dialog box appears.
12 Indicate where to save the file and click Save.
The file saves to the location that you specified.
14
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) Installation Guidelines
Installation Guidelines
To upgrade the EPLD images using CLI commands, follow these guidelines: Before you upgrade any EPLD images, be sure that you have updated the Cisco NX-OS operating system to the level required for the images. Also be sure that you have an EPLD image file. CAUTION: When you are trying to upgrade EPLD, it is recommended to use the same version of EPLD as that of installed software. However, if the installed version of EPLD is already later than the software you are installing, it is not required to downgrade the EPLD. You can execute an upgrade from the active supervisor module only. This upgrade is for one or all of the modules as follows: -- You can upgrade a module individually. -- You can upgrade all modules sequentially. -- You can update the images for online modules only. On a Cisco Nexus 9500 platform switch that has two supervisor modules, upgrade the EPLDs for the standby supervisor and then switch the active supervisor to the standby mode to upgrade its EPLDs. The supervisor switchover is not disruptive to traffic on Cisco Nexus 9500 platform switches. On a switch that has only one supervisor module, you can upgrade the active supervisor, but this will disrupt its operations during the upgrade. If you interrupt an upgrade, you must reapply the upgrade to the module that was being upgraded during the interruption. The upgrade process disrupts traffic on the targeted module. Do not insert or remove any modules while an EPLD upgrade is in progress.
1 Copy the EPLD image file to bootflash. 2 To determine if you need to upgrade the BIOS for the image, use the show install all impact
command and see the Upgrade Required (Upg-Required) field for the BIOS row in the command output.
3 If you do not need to upgrade the BIOS, set the boot variable using the boot nxos bootflash:n9000-
dk9.9.2.4.bin command.
4 Enter the copy running-config startup-config command to set the startup boot variables to the NX-
OS image.
5 If you need to upgrade the BIOS, enter the install all nxos bootflash:n9000-dk9.9.2.4.bin command. 6 Enter the install epld bootflash:n9000-epld.9.2.34.img module all command.
The switch automatically reboots.
15
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) Upgrading the EPLD Images
Upgrading the EPLD Images
CAUTION: When you are trying to upgrade EPLD, it is recommended to use the same version of EPLD as that of installed software. However, if the installed version of EPLD is already later than the software you are installing, it is not required to downgrade the EPLD.
Verifying the EPLD Upgrades
To verify the EPLD upgrades for a switch or its modules, use the show version module slot-number epld command as follows:
To verify updates for a module on a modular switch (Cisco Nexus 9500 platform switches), indicate the chassis slot number for slot-number. switch# show version module 22 epld
To verify updates for a top-of-rack switch (Cisco Nexus 9200, 9300, and 9300-EX platforms), use 1 for slotnumber. switch# show version module 1 epld
Displaying the Status of EPLD Upgrades
To display the status of EPLD upgrades on the switch, use the show install epld status command.
Limitations
When EPLDs are upgraded, the following guidelines and observations apply: If a module is not online, you cannot upgrade its EPLD images. If there are two supervisors that are installed in the switch (Cisco Nexus 9504, 9508, and 9516 switches only), you can either upgrade only the standby or upgrade all modules (including both supervisor modules) by using the following commands: -- install epld bootflash: image module standby-supervisor-slot-number (upgrades only the standby supervisor module) NOTE: After you use this command, you can switchover the active and standby supervisor modules and then upgrade the other supervisor. -- install epld bootflash: image module all (upgrades all of the modules) If there is only one supervisor that are installed in the switch, your upgrading or downgrading of EPLD images is disruptive.
Related Documentation
The entire Cisco NX-OS 9000 Series documentation set is available at the following URL: https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/tsd-products-support-series-home.html
16
Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes, Release 9.2(4) Related Documentation
Release Notes
The release notes are available at the following URL: https://www.cisco.com/en/US/products/ps13386/prod_release_notes_list.html
Documentation Feedback
To provide technical feedback on this document, or to report an error or omission, please send your comments to nexus9kdocfeedback@cisco.com. We appreciate your feedback.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information, see What's New in Cisco Product Documentation, at: https://www.cisco.com/c/en/us/td/docs/general/whatsnew/whatsnew.html. Subscribe to What's New in Cisco Product Documentation. It lists all new and revised Cisco technical documentation as an RSS feed and delivers content directly to your desktop using a reader application. The RSS feeds are a free service.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R) Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. © 2019 Cisco Systems, Inc. All rights reserved.
17
Microsoft Word 2010 䵩捲潳潦璮⁗潲搠㈰㬠浯摩晩敤⁵獩湧呥硴′⸱⸷礠ㅔ㍘