HP Nics - security features preventing cross-flash?

Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.
R

Rand__

Well-Known Member
Mar 6, 2014
6,633
1,767
113
I recently got a few of these SFP28 Nics

Document Display | HPE Support Center

support.hpe.com support.hpe.com

I found the mention of firmware lock in on those
"
  • Security features - Digitally signed firmware components, secure firmware loading, secure firmware update, UEFI secure boot
  • Authentication of digitally signed firmware through true hardward root of trust and chain of trust on the NIC
"
I have not tried but that would prevent crossflashing to non HPE Firmware, wouldnt it (eg if these were Mellanox cards which they are not)?
 
V

vangoose

Active Member
May 21, 2019
326
104
43
Canada
Rand__ said:
I recently got a few of these SFP28 Nics

Document Display | HPE Support Center

support.hpe.com support.hpe.com

I found the mention of firmware lock in on those
"
  • Security features - Digitally signed firmware components, secure firmware loading, secure firmware update, UEFI secure boot
  • Authentication of digitally signed firmware through true hardward root of trust and chain of trust on the NIC
"
I have not tried but that would prevent crossflashing to non HPE Firmware, wouldnt it (eg if these were Mellanox cards which they are not)?
Click to expand...
This is Broadcom BCM57414.

I have a 621sfp28 based on QL41000 chip that can't be cross flashed. Same mention of digital signature.

CX4 based 640sfp28 can be cross flashed.
 
R

Rand__

Well-Known Member
Mar 6, 2014
6,633
1,767
113
Yes I think its not applicable to the MLX cards (yet), but given the HPE hides it FW behind a license wall now its something to keep in mind .
Thanks for the confirmation.
 
R

Rand__

Well-Known Member
Mar 6, 2014
6,633
1,767
113
Anyone ever discovered if the HP nics are cross-flashable ?
Got a pair of CX5's now; thankfully Fw is accessible on HPE page, but crossflash would o/c be nice...

Code: 
c:\Program Files\Mellanox\WinMFT>flint -d mt4119_pciconf0 -i c:\mlx\fw-ConnectX5-rel-16_29_2002-MCX556A-EDA_Ax_Bx-UEFI-14.22.16-FlexBoot-3.6.204.bin -allow_psid_change burn

      Current FW version on flash:   16.27.1016
      New FW version:                      16.29.2002


      You are about to replace current PSID on flash - "HPE0000000009" with a different PSID - "MT_0000000009".
      Note: It is highly recommended not to change the PSID.

  Do you want to continue ? (y/n) [n] : y
-E- Burning FS4 image failed: Changing PSID is unsupported under controlled FW. You can try to run again with the flag "--no_fw_ctrl".

c:\Program Files\Mellanox\WinMFT>flint -d mt4119_pciconf0 -i c:\mlx\fw-ConnectX5-rel-16_29_2002-MCX556A-EDA_Ax_Bx-UEFI-14.22.16-FlexBoot-3.6.204.bin -allow_psid_change --no_fw_ctrl burn
-E- Cannot open Device: mt4119_pciconf0. MFE_NO_FLASH_DETECTED
 
R

Rand__

Well-Known Member
Mar 6, 2014
6,633
1,767
113
Thats only when running with "--no_fw_ctrl", I think the NICs fw does not like that and 'hides' ;)

Else the card was fine, flashing to HPE latest was no issue either
 
I

i386

Well-Known Member
Mar 18, 2016
4,240
1,546
113
34
Germany
Has somebody a link to ebay listings with "Secure firmware update" enabled mellanox nics?
 
You must log in or register to reply here.
Top Bottom