Install the firmware and RoT security module

Follow instructions in this section to install the ThinkSystem V3 Firmware and Root of Trust Security Module (firmware and RoT security module).

About this task

Important

This task must be operated by trained technicians that are certified by Lenovo Service. Do no attempt to remove or install it without proper training and qualification.

(Lenovo trained technician only) After replacing the firmware and RoT security module, update the UEFI firmware to the specific version supported by the server. For detailed information on how to update the firmware, see Tip for replacing a firmware and RoT security module.

Attention

• Read Installation Guidelines and Safety inspection checklist to ensure that you work safely.

• Power off the server and peripheral devices and disconnect the power cords and all external cables. See Power off the server.

• Prevent exposure to static electricity, which might lead to system halt and loss of data, by keeping static-sensitive components in their static-protective packages until installation, and handling these devices with an electrostatic-discharge wrist strap or other grounding system.

Firmware and driver download: You might need to update the firmware or driver after replacing a component.

• Go to Drivers and Software download website for ThinkSystem SR645 V3 to see the latest firmware and driver updates for your server.

• Go to Update the firmware for more information on firmware updating tools.

Watch the procedure

• A video of this procedure is available at YouTube.

Procedure

1. Touch the static-protective package that contains the firmware and RoT security module to any unpainted surface on the outside of the server. Then, take the firmware and RoT security module out of the package and place it on a static-protective surface.
2. Install the firmware and RoT security module to the server.
   Figure 1. Installing the firmware and RoT security module
   
   
   1. Lower the firmware and RoT security module onto the system I/O board and ensure that the connector on the module is correctly inserted into the slot on the system I/O board.
   2. Tighten the two screws to secure the firmware and RoT security module in place.

After you finish

1. Properly route and secure the cables in the server. Refer to detailed cable routing information for each component in Internal cable routing.

2. Install the riser assemblies if you have removed them. See Riser card replacement.

3. Install the top cover. See Install the top cover.

4. Update the UEFI firmware to the specific version supported by the server. See Tip for replacing a firmware and RoT security module.

5. If there is a software (SW) key, for example, XCC FoD key, installed in the system, inject the key again to ensure that the key functions properly. See Using Lenovo Features on Demand.

   Note

   If you need to replace the processor board together with the firmware and RoT security module, update the VPD before injecting the key. See Update the Vital Product Data (VPD).
6. Optionally, do the following if needed:

   • Hide TPM. See Hide TPM.

   • Update the TPM firmware. See Update the TPM firmware.

   • Enable UEFI Secure Boot. See Enable UEFI Secure Boot.

• Set the TPM policy
  The TPM policy is enabled by default to encrypt data transfer for system operation. Optionally, you can disable the TPM policy using Lenovo XClarity Essentials OneCLI.
• Set the TPM version
  Optionally, you can set the TPM version using Lenovo XClarity Essentials OneCLI.
• Hide TPM
  TPM is enabled by default to encrypt data transfer for system operation. Optionally, you can disable TPM using Lenovo XClarity Essentials OneCLI.
• Update the TPM firmware
  Optionally, you can update the TPM firmware using Lenovo XClarity Essentials OneCLI.
• Enable UEFI Secure Boot
  Optionally, you can enable UEFI Secure Boot.