Zero-Trust Mode Checking

Here's a step-by-step procedure to check the Zero-Trust Mode on your NVIDIA BlueField DPU from the host server, including the installation of the Mellanox Firmware Tools (MFT).

1. Navigate to the NVIDIA Downloads Site: Open your web browser and go to the official NVIDIA Mellanox software downloads page.

2. Select the Latest Version for your OS:

   

3. Transfer and Extract MFT Tools on the Worker 1 BareMetal Host.

   First Pod Console

   Collapse Source

   Copy

   Copied!

               
   
               
   root@worker1:~# tar -xvzf /tmp/mft-4.32.0-120-x86_64-deb.tgz
           

4. Navigate into the Extracted Directory.

   First Pod Console

   Collapse Source

   Copy

   Copied!

               
   
               
   root@worker1:~# cd mft-4.32.0-120-x86_64-deb/
           

5. Run the Installation Script.

   First Pod Console

   Collapse Source

   Copy

   Copied!

               
   
               
   root@worker1:~# ./install.sh
           

6. Start MST (Mellanox Software Tools) Service and Identify DPU Device Name.

   First Pod Console

   Collapse Source

   Copy

   Copied!

               
   
               
   root@worker1:~# mst start
   root@worker1:~# mst status
   MST modules:
   ------------
       MST PCI module is not loaded
       MST PCI configuration module is not loaded
    
   PCI Devices:
   ------------
    
   2b:00.0
   # 2b:00.0 - NVIDIA BlueField-3 VPI FHHL Adapter
           

7. Perform Zero-Trust Checking.

   First Pod Console

   Collapse Source

   Copy

   Copied!

               
   
               
   root@worker1:~# mlxprivhost -d 2b:00.0 q
   Host configurations
   -------------------
   level                         : RESTRICTED
    
   Port functions status:
   -----------------------
   disable_rshim                 : TRUE
   disable_tracer                : TRUE
   disable_port_owner            : TRUE
   disable_counter_rd            : TRUE
    
   #Expected Zero-Trust Output.
           

   This is the most definitive confirmation. level : RESTRICTED means the host is in Zero-Trust Mode, and the TRUE flags confirm individual security restrictions are active.

8. Check Firmware Access with mlxfwmanager:

   First Pod Console

   Collapse Source

   Copy

   Copied!

               
   
               
   root@worker1:~# mlxfwmanager -d 2b:00.0 --query
   Querying Mellanox devices firmware ...
    
   Device #1:
   ----------
    
     Device Type:      BlueField3
     Part Number:      --
     Description:
     PSID:
     PCI Device Name:  2b:00.0
     Base MAC:         N/A
     Versions:         Current        Available
        FW             --
    
     Status:           Failed to open device      # Expected Zero-Trust Output
           

   "Failed to open device" indicates the host is blocked from accessing the DPU for firmware operations, a key aspect of Zero-Trust.

9. Check Device Configuration with mlxconfig:

   First Pod Console

   Collapse Source

   Copy

   Copied!

               
   
               
   mlxconfig -d 2b:00.0 q
    
   Device #1:
   ----------
    
   Device type:        BlueField3
   Name:               900-9D3B6-00CV-A_Ax
   Description:        NVIDIA BlueField-3 B3220 P-Series FHHL DPU; 200GbE (default mode) / NDR200 IB; Dual-port QSFP112; PCIe Gen5.0 x16 with x16 PCIe extension option; 16 Arm cores; 32GB on-board DDR; integrated BMC; Crypto Enabled
   Device:             2b:00.0
    
   Configurations:                                          Next Boot
    RO     MODULE_SPLIT_M0                             Array[0..15]
    RO     MODULE_SPLIT_M1                             Array[0..15]
   ...
           PORT_OWNER                                  True(1)   # No RO, but restricted by mlxprivhost
           ALLOW_RD_COUNTERS                           True(1)   # No RO, but restricted by mlxprivhost
           TRACER_ENABLE                               True(1)   # No RO, but restricted by mlxprivhost
           

   Most configuration parameters will be prefixed with RO (Read-Only). Parameters related to direct host control, like PORT_OWNER, ALLOW_RD_COUNTERS, TRACER_ENABLE, even if shown as True(1) for the DPU's internal capability, will be unenforcible by the host due to the mlxprivhost restrictions. The widespread RO status shows that the host cannot modify these configurations, reinforcing the DPU's autonomous and secure state. The few parameters without RO are still overridden by the mlxprivhost security policy.

10. Check Low-Level Hardware Access with ethtool:

    First Pod Console

    Collapse Source

    Copy

    Copied!

                
    
                
    root@worker1:~# ethtool -d ens1f0np0
    Cannot get register dump: Operation not supported
            

    This confirms the DPU is preventing deep, low-level hardware access from the host, aligning with Zero-Trust's isolation goals.

Conclusion

The command outputs of mlxprivhost, mlxfwmanager, mlxconfig (showing RO flags), and ethtool (showing "Operation not supported"), then your NVIDIA BlueField DPU is indeed operating in Zero-Trust Mode.

This means the host has significantly restricted privileges and cannot perform sensitive operations on the DPU, ensuring its security and isolation.