mlxprivhost - NIC Configuration by the Host Restriction Tool

NVIDIA ConnectX-5 Adapter Cards Firmware Release Notes v16.35.3502 LTS

mlxprivhost enables the user to restrict the hosts from managing the device.

Warning

mlxprivhost is supported in Linux only.

Warning

mlxprivhost is not supported in ESXi 7.0.

Warning

This utility is supported in BlueField devices only.

Copy
Copied!
            

mlxprivhost [OPTIONS] <command> [parameters…]

  • Restrict configuration takes effect immediately, but with disabling/enabling RShim, it requires reboot

  • The host cannot restrict itself, it only restricts other external hosts

  • A restricted host will not be able to perform operations as the below that can compromise the DPU:

    • Port ownership – the host cannot assign itself as port owner

    • Hardware counters – the host does not have access to hardware counters

    • Tracer functionality is blocked

    • RShim interface is blocked

    • FW flash is restricted

    • For Multi-host system, the tool is compatible with firmware version starting from xx.31.10xx and later

    where:

    -h, --help

    Shows this help message and exit

    -v, --version

    Shows program's version number and exit

    --device DEVICE, -d DEVICE

    Device to work with.

    --disable_rshim

    When TRUE, the host does not have an RSHIM function to access the embedded CPU registers.

    Reboot is required for changes to take effect.

    --disable_tracer

    When TRUE, the host will not be allowed to own the Tracer

    --disable_counter_rd

    When TRUE, the host will not be allowed to read Physical port counters

    --disable_port_owner

    When TRUE, the host will not be allowed to be Port Owner

    r,restrict

    Set all external hosts restricted except the one that called the command

    p,privilege

    Set all external hosts privileged except the one that called the command

    q,query

    From external host: query the status of the host

    From Embedded Arm CPU: query if all external hosts are restricted

    Example of mlxprivhost:

    • Enabling Full Host Restriction:

      Copy
      Copied!
                  

      mlxprivhost –d /dev/mst/mt41682_pciconf0 r --disable_rshim --disable_tracer --disable_counter_rd --disable_port_owner

    • Disabling Host Restriction:

      Copy
      Copied!
                  

      mlxprivhost -d

    • Query the status of host:

      Copy
      Copied!
                  

      mlxprivhost -d

    © Copyright 2023, NVIDIA. Last updated on May 23, 2023.