Commit 288de12a authored by Pawel Baldysiak's avatar Pawel Baldysiak Committed by Tomasz Zawadzki
Browse files

nvmf_tgt: Add passthru support for security send/recv OPC 



Add handler to passthru security send/recv OPC cmds to underlying dev.
It is disabled by default, can be enabled by RPC.
It uses already existing generic passthru handler,
which makes sure that ctrlr-scope admin cmds are passthru
only for subsystem with single namespace.

Change-Id: I889626f822d366ab7b1d82bc5d782df76de0c9fc
Signed-off-by: default avatarPawel Baldysiak <pawel.baldysiak@dell.com>
Reviewed-on: https://review.spdk.io/c/spdk/spdk/+/26460


Reviewed-by: default avatarJim Harris <jim.harris@nvidia.com>
Tested-by: default avatarSPDK Automated Test System <spdkbot@gmail.com>
Community-CI: Mellanox Build Bot
Reviewed-by: default avatarAleksey Marchuk <alexeymar@nvidia.com>
parent 0c8dcbb2

doc/jsonrpc.md.jinja2

+8 −7
Original line number Diff line number Diff line
@@ -8586,11 +8586,12 @@ have been initialized. 
##### admin_cmd_passthru {#spdk_nvmf_admin_passthru_conf}



 Name               | Optional   | Type   | Description

----------------- | ---------- | ------ | --------------------------------------------------------------------------------------------------------------

------------------- | ---------- | ------ | --------------------------------------------------------------------------------------------------------------

 identify_ctrlr     | Optional   | bool   | If true, enables custom identify handler that reports some identify attributes from the underlying NVMe drive

 get_log_page       | Optional   | bool   | If true, enables passthru get log page command handlers for underlying NVMe drive (for non-fabrics related log pages)

 get_set_features   | Optional   | bool   | If true, enables passthru get/set_feature OPC handlers for underlying NVMe drive

 sanitize           | Optional   | bool   | If true, enables passthru sanitize OPC handlers for underlying NVMe drive

 security_send_recv | Optional   | bool   | If true, enables passthru security send/recieve OPC handlers for underlying NVMe drive

 vendor_specific    | Optional   | bool   | If true, enables passthru command handlers for underlying NVMe drive for vendor specific cmds (OPCs: 0xC0-0xFF)



#### Example

module/event/subsystems/nvmf/event_nvmf.h

+1 −0
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ struct spdk_nvmf_admin_passthru_conf { 
	bool get_log_page;

	bool get_set_features;

	bool sanitize;

	bool security_send_recv;

	bool vendor_specific;

};

module/event/subsystems/nvmf/nvmf_rpc.c

+1 −0
Original line number Diff line number Diff line
@@ -49,6 +49,7 @@ static const struct spdk_json_object_decoder admin_passthru_decoder[] = { 
	{"get_log_page", offsetof(struct spdk_nvmf_admin_passthru_conf, get_log_page), spdk_json_decode_bool, true},

	{"get_set_features", offsetof(struct spdk_nvmf_admin_passthru_conf, get_set_features), spdk_json_decode_bool, true},

	{"sanitize", offsetof(struct spdk_nvmf_admin_passthru_conf, sanitize), spdk_json_decode_bool, true},

	{"security_send_recv", offsetof(struct spdk_nvmf_admin_passthru_conf, security_send_recv), spdk_json_decode_bool, true},

	{"vendor_specific", offsetof(struct spdk_nvmf_admin_passthru_conf, vendor_specific), spdk_json_decode_bool, true},

};

module/event/subsystems/nvmf/nvmf_tgt.c

+18 −0
Original line number Diff line number Diff line
@@ -59,6 +59,7 @@ struct spdk_nvmf_tgt_conf g_spdk_nvmf_tgt_conf = { 
	.admin_passthru.get_log_page = false,

	.admin_passthru.get_set_features = false,

	.admin_passthru.sanitize = false,

	.admin_passthru.security_send_recv = false,

	.admin_passthru.vendor_specific = false

};
@@ -419,6 +420,12 @@ fixup_get_cmds_and_effects_log_page(struct spdk_nvmf_request *req) 
		nvmf_log_data.admin_cmds_supported[SPDK_NVME_OPC_SANITIZE] =

			nvme_log_data.admin_cmds_supported[SPDK_NVME_OPC_SANITIZE];

	}

	if (g_spdk_nvmf_tgt_conf.admin_passthru.security_send_recv) {

		nvmf_log_data.admin_cmds_supported[SPDK_NVME_OPC_SECURITY_SEND] =

			nvme_log_data.admin_cmds_supported[SPDK_NVME_OPC_SECURITY_SEND];

		nvmf_log_data.admin_cmds_supported[SPDK_NVME_OPC_SECURITY_RECEIVE] =

			nvme_log_data.admin_cmds_supported[SPDK_NVME_OPC_SECURITY_RECEIVE];

	}



	/* Copy the fixed SPDK struct to the request */

	spdk_nvmf_request_copy_from_buf(req, (uint8_t *) &nvmf_log_data + offset, datalen);
@@ -550,6 +557,9 @@ fixup_identify_ctrlr(struct spdk_nvmf_request *req) 
	if (g_spdk_nvmf_tgt_conf.admin_passthru.sanitize) {

		nvmf_cdata.sanicap = nvme_cdata.sanicap;

	}

	if (g_spdk_nvmf_tgt_conf.admin_passthru.security_send_recv) {

		nvmf_cdata.oacs.security = nvme_cdata.oacs.security;

	}



	/* Copy the fixed up data back to the response */

	spdk_nvmf_request_copy_from_buf(req, &nvmf_cdata, datalen);
@@ -702,6 +712,12 @@ nvmf_tgt_advance_state(void) 
				SPDK_NOTICELOG("Custom sanitize command handlers enabled\n");

				spdk_nvmf_set_custom_admin_cmd_hdlr(SPDK_NVME_OPC_SANITIZE, nvmf_custom_admin_no_cb_hdlr);

			}

			if (g_spdk_nvmf_tgt_conf.admin_passthru.security_send_recv) {

				SPDK_NOTICELOG("Custom security send/recv commands handlers enabled\n");

				SPDK_WARNLOG("Warning: Passing Opal keys openly is not secure. Make sure to use transport encryption like nvme/tls or ipsec.\n");

				spdk_nvmf_set_custom_admin_cmd_hdlr(SPDK_NVME_OPC_SECURITY_SEND, nvmf_custom_admin_no_cb_hdlr);

				spdk_nvmf_set_custom_admin_cmd_hdlr(SPDK_NVME_OPC_SECURITY_RECEIVE, nvmf_custom_admin_no_cb_hdlr);

			}

			if (g_spdk_nvmf_tgt_conf.admin_passthru.vendor_specific) {

				int i;

				SPDK_NOTICELOG("Custom vendor specific commands handlers enabled\n");
@@ -828,6 +844,8 @@ nvmf_subsystem_write_config_json(struct spdk_json_write_ctx *w) 
				   g_spdk_nvmf_tgt_conf.admin_passthru.get_set_features);

	spdk_json_write_named_bool(w, "sanitize",

				   g_spdk_nvmf_tgt_conf.admin_passthru.sanitize);

	spdk_json_write_named_bool(w, "security_send_recv",

				   g_spdk_nvmf_tgt_conf.admin_passthru.security_send_recv);

	spdk_json_write_named_bool(w, "vendor_specific",

				   g_spdk_nvmf_tgt_conf.admin_passthru.vendor_specific);

	spdk_json_write_object_end(w);

python/spdk/cli/nvmf.py

+3 −2
Original line number Diff line number Diff line
@@ -26,7 +26,7 @@ def add_parser(subparsers): 
            print('WARNING: -i|--passthru-identify-ctrlr is deprecated, please use -p|--passthru-admin-cmds identify_ctrlr.',

                  file=sys.stderr)

            admin_cmd_passthru.append('identify_ctrlr')

        all_admin_cmd_passthru = ('identify_ctrlr', 'get_log_page', 'get_set_features', 'sanitize', 'vendor_specific')

        all_admin_cmd_passthru = ('identify_ctrlr', 'get_log_page', 'get_set_features', 'sanitize', 'security_send_recv', 'vendor_specific')

        if 'all' in admin_cmd_passthru:

            admin_cmd_passthru = {cmd: True for cmd in all_admin_cmd_passthru}

        else:
@@ -42,7 +42,8 @@ def add_parser(subparsers): 
    when the controller has a single namespace that is an NVMe bdev (deprecated)""", action='store_true')

    p.add_argument('-p', '--passthru-admin-cmds', help="""Comma-separated list of admin commands to be passthru

                   when the controller has a single namespace that is an NVMe bdev.

                   Available options are: all, identify_ctrlr, get_log_page, get_set_features, sanitize, vendor_specific""",

                   Available options are: all, identify_ctrlr, get_log_page, get_set_features, sanitize, security_send_recv,

                   vendor_specific""",

                   type=lambda d: d.split(','))

    p.add_argument('-m', '--poll-groups-mask', help='Set cpumask for NVMf poll groups (optional)', type=str)

    p.add_argument('-d', '--discovery-filter', help="""Set discovery filter (optional), possible values are: `match_any` (default) or