Secure Firmware Update

Note

Secure Firmware Update is supported only on ConnectX-4 onwards adapter cards.

A “Secure firmware update” is the ability of a device to verify digital signatures of new firmware binaries, in order to assure that only officially approved versions can be installed from the host, the network[1] or a Board Management Controller (BMC).

The firmware of devices with “secure firmware up date” functionality (secure FW), restricts access to specific commands and registers that can be used to modify the firmware binary image on the flash, as well as commands that can jeopardize security in general. Most notably, the commands and registers for random flash access are disabled.

Secure FW verifies new binaries before activating them, compared to legacy devices where this task is done by the update tool using direct flash access commands. In addition to signature verification, secure FW also checks that the binary is designated to the same device model, that the new firmware is also secured, and that the new FW version is not included in a forbidden versions blacklist. The firmware rejects binaries that do not match the verification criteria.

Secure FW utilizes the same ‘fail safe’ upgrade procedures, so events like power failure during update should not leave the device in an unstable state. The table below lists the impact of secure FW update on MFT tools.

Tool	Flow	Secure FW	With CS Token	Blocked Commands
flint / mlxburn	Burn FW	Working with controlled fw update	Working with controlled fw update
	Query	Working with controlled fw update	Working with controlled fw update
	Set GUIDs	Working with controlled fw update	Working with controlled fw update
	Verify	Working partially (BOOT image)	Working partially (BOOT image)
	Set DV INFO: SET MFG, SET VSD, VPD	Not supported in Secure FW	Not supported in Secure FW	MFBA
	ROM OPS: BROM, DROM	Not supported, BOOT image modification is not supported (MFBA)	Not supported, BOOT image modification is not supported (MFBA)	MFBA
	"-ocr" override cache replacement (Direct flash GW access)	Not supported in Secure FW	Not supported in Secure FW	Flash GW is blocked
	HW SET (Set flash parameters)	Flash GW is blocked	Flash GW is blocked	Flash GW is blocked
	"--no_fw_ctrl" (Legacy Flow)	Not supported in Secure FW	Not supported in Secure FW	MFBA
mlxfwmanager / mlxup	Burn FW	Working with controlled fw update	Working with controlled fw update
mlxfwmanager	with --no_fw_ctrl	Not supported in Secure FW	Not supported in Secure FW	MFBA
mlxdump	fsdump	Blocked icmds	Working	gcif_get_ft_info, gcif_get_ft_list, gcif_get_fg, gcif_get_fg_list, gcif_get_fte, gcif_get_fte_list
	phyUc	Blocked icmds	working	gcif_phy_uc_get_array_prop_px, gcif_phy_uc_set_get_data, gcif_phy_uc_get_array_prop_EDR, gcif_phy_uc_get_array_prop_HDR
	rxdump	CR-Space is locked & Blocked icmds	working	gcif_read_rx_slice_desc, gcif_read_rx_slice_packet
	sxdump	CR-Space is locked & Blocked icmds	working	gcif_read_wq_buf fer
wqdump	Dump QP contexts	Blocked icmds	working	gcif_read_context
	Dump WQs	Blocked icmds	working	gcif_read_host_m em, gcif_read_q_en- try, gcif_qp_get_pi_ci
	ICM	Blocked icmds	working	gcif_read_icm
	WRITE QP (Devmon)		working	gcif_write_context
mget_temp	hw_access	Read Only CR- Space	working	Read Only CR- Space
mcra	Read	working	working	working
mcra	Write	Read Only CR- Space	working	Read Only CR- Space
mstdump	Read	working	working	working
mlxtrace / fwtrace	MEM & FIFO	Only fwtrace is supported and only in Linux	working	Read Only CR- Space
pckt_drop	uses write to CR- Space to work	Read Only CR- Space	working	Read Only CR- Space
mlxlink	working	working	working	working
mlxreg	working	working	working	working
mlxcables	working	working	working	working
mlxconfig	working	working	working	working
mlxfwreset	working	working	working	working
i2c/mlxi2c	Not relevant when not in livefish
i2c/mlxi2c	With Force flag (ENV VAR)	Read Only CR- Space	working	Read Only CR- Space

Secure Firmware Implications on Burning Tools

When Secure Firmware is enabled, the flint output slightly changes due to the differences in the underlying NIC accessing methods. Some functionalities may be restricted according to the device security level.

flint query under secure mode:

Copy
Copied!

            
            # flint -d /dev/mst/mt4115_pciconf0 q
Image type:      FS3
FW Version:      12.19.2278
FW Release Date: 7.6.2017
Description:     UID                GuidsNumber
Base GUID:       7cfe90030029205e   4
Base MAC:        00007cfe9029205e   4
Image VSD:
Device VSD:
PSID:            MT_2190110032
Security Attributes: secure-fw, dev

Note

Unavailable information is reported as N/A.