Secure Host

Secure host is the general term for the capability of a device to protect itself and the subnet from malicious software through mechanisms such as blocking access of untrusted entities to the device configuration registers, directly (through pci_cr or pci_conf) and indirectly (through MADs).

Secure Host feature is supported for all NVIDIA® network adapters (listed in Group 1 and group 2). For group 1 network adapters, the user is required to generate and burn a firmware image that supports the feature (see “Generating/Burning a Firmware Supporting Secure Host” below).

For Group 2 network adapters, the feature is supported on firmware version 1x.22.1002 or newer.

Generating/Burning a Firmware Supporting Secure Host

1. Make sure you have INI and mlx files suitable for the device.

   1. Add cr_protection_en=true under [HCA] section in the INI file.

   2. Generate an image using mlxburn, for example run:

      Copy

      Copied!

                  
      
                  
      # mlxburn -fw ./fw-4099-rel.mlx -conf ./secure_host.ini -wrimage fw-4099.secure.bin
              

2. Burn the image on the device using flint:

   Copy

   Copied!

               
   
               
   # flint -d /dev/mst/mt4099_pci_cr0 -i fw-4099.secure.bin b 
           

3. For changes to take effect, reboot is required.

Setting the Secure Host Key

To set the key, run:

            

            
# flint -d /dev/mst/mt4099_pci_cr0 set_key 22062011
Setting the HW Key - OK
Restoring signature - OK
        

1. Access the hardware while hardware access is disabled:

   Copy

   Copied!

               
   
               
   # flint -d /dev/mst/mt4099_pci_cr0 q
   E- Cannot open /dev/mst/mt4099_pci_cr0: HW access is disabled on the device.
   E- Run "flint -d /dev/mst/mt4099_pci_cr0 hw_access enable" in order to enable HW access.
           

2. Enable hardware access:

   Copy

   Copied!

               
   
               
   # flint -d /dev/mst/mt4099_pci_cr0 hw_access enable
   Enter Key: ********
           

3. Disable hardware access:

   Copy

   Copied!

               
   
               
   # flint -d /dev/mst/mt4099_pci_cr0 hw_access disable
           

To remove the secure host feature:

1. Make sure you have INI and MLX file suitable for the device.

   1. Remove cr_protection_en=true from the INI (if present)

   2. Generate the image using mlxburn, for example run:

      Copy

      Copied!

                  
      
                  
      # mlxburn -fw ./fw-4099-rel.mlx -conf ./unsecure_host.ini -wrimage fw-4099.unsecure.bin
              

2. Burn the firmware on the device (make sure hardware access is enabled prior to burning):

   Copy

   Copied!

               
   
               
   # flint -d /dev/mst/mt4099_pci_cr0 -i fw-4099.unsecure.bin b
           

3. Execute a driver restart in order to load the unsecure firmware:

   Copy

   Copied!

               
   
               
   # service openibd restart
           

If a key is lost, there is no way to recover it using the tool. The only way to recover is to:

1. Connect the flash-not-present jumper on the card.

2. Reboot the machine.

3. Re-burn firmware(for Group 2 network adapters re-burn the firmware following the process in Burning a New Device.)

4. Remove the flash-not-present jumper.

5. Reboot the machine

6. Re-set the hardware access key