Commit d20ae7ff authored by Alexey Marchuk's avatar Alexey Marchuk Committed by Jim Harris
Browse files

accel/dpdk_cryptodev: Update mlx5_pci key config 



Wrapped cyrpto credentilas mode is not longer supported.
When NIC is in this mode, xts keys are 48 and 80
bytes for 128b and 256b keys.
Plain text mode uses standard keys of 32 and 64 bytes.
Nvidia NIC must be re-configured to work in plain text
mode if it was in the wrapped crypto credentails mode.
Wrong key size 512b was used, mlx5_pci supports only
128b or 256b. Now key and key2 length must be equal.
blockdev.sh scripts was updated accordingly.

Signed-off-by: default avatarAlexey Marchuk <alexeymar@nvidia.com>
Change-Id: I9f67e0074acb5219ee3f53840e158a011b233cdd
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/18175


Reviewed-by: default avatarKonrad Sztyber <konrad.sztyber@intel.com>
Community-CI: Mellanox Build Bot
Reviewed-by: default avatarJim Harris <james.r.harris@intel.com>
Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
parent c8c1050e

CHANGELOG.md

+4 −0
Original line number Diff line number Diff line
@@ -6,6 +6,10 @@ 


Added API `spdk_accel_submit_xor` to perform XOR.



Configuration of `mlx5_pci` driver of accel_dpdk_cryptodev module was changed. Now key and key2 should have equal

length and key size in hexlified form can be either 32 bytes for 128b XTS key or 64 bytes for 256b XTS key.

Support of the wrapped crypto credentials mode for this driver is dropped, only plain text mode is supported.



### bdev



A new API `spdk_bdev_module_claim_bdev_desc` was added. Unlike `spdk_bdev_module_claim_bdev`, this

module/accel/dpdk_cryptodev/accel_dpdk_cryptodev.c

+8 −12
Original line number Diff line number Diff line
@@ -81,9 +81,6 @@ 
#define ACCEL_DPDK_CRYPTODEV_AES_CBC_KEY_LENGTH			16

#define ACCEL_DPDK_CRYPTODEV_AES_XTS_128_BLOCK_KEY_LENGTH	16 /* AES-XTS-128 block key size. */

#define ACCEL_DPDK_CRYPTODEV_AES_XTS_256_BLOCK_KEY_LENGTH	32 /* AES-XTS-256 block key size. */

#define ACCEL_DPDK_CRYPTODEV_AES_XTS_512_BLOCK_KEY_LENGTH	64 /* AES-XTS-512 block key size. */



#define ACCEL_DPDK_CRYPTODEV_AES_XTS_TWEAK_KEY_LENGTH		16 /* XTS part key size is always 128 bit. */



/* Limit of the max memory len attached to mbuf - rte_pktmbuf_attach_extbuf has uint16_t `buf_len`

 * parameter, we use closes aligned value 32768 for better performance */
@@ -1422,15 +1419,19 @@ accel_dpdk_cryptodev_validate_parameters(enum accel_dpdk_cryptodev_driver_type d 
		}

		break;

	case ACCEL_DPDK_CRYPTODEV_CIPHER_AES_XTS:

		if (key->key_size != key->key2_size) {

			SPDK_ERRLOG("Cipher %s requires equal key and key2 sizes\n", g_cipher_names[driver]);

			return -1;

		}

		switch (driver) {

		case ACCEL_DPDK_CRYPTODEV_DRIVER_MLX5_PCI:

			if (key->key_size != ACCEL_DPDK_CRYPTODEV_AES_XTS_256_BLOCK_KEY_LENGTH &&

			    key->key_size != ACCEL_DPDK_CRYPTODEV_AES_XTS_512_BLOCK_KEY_LENGTH) {

			if (key->key_size != ACCEL_DPDK_CRYPTODEV_AES_XTS_128_BLOCK_KEY_LENGTH &&

			    key->key_size != ACCEL_DPDK_CRYPTODEV_AES_XTS_256_BLOCK_KEY_LENGTH) {

				SPDK_ERRLOG("Invalid key size %zu for driver %s, cipher %s, supported %d or %d\n",

					    key->key_size, g_driver_names[ACCEL_DPDK_CRYPTODEV_DRIVER_MLX5_PCI],

					    g_cipher_names[ACCEL_DPDK_CRYPTODEV_CIPHER_AES_XTS],

					    ACCEL_DPDK_CRYPTODEV_AES_XTS_256_BLOCK_KEY_LENGTH,

					    ACCEL_DPDK_CRYPTODEV_AES_XTS_512_BLOCK_KEY_LENGTH);

					    ACCEL_DPDK_CRYPTODEV_AES_XTS_128_BLOCK_KEY_LENGTH,

					    ACCEL_DPDK_CRYPTODEV_AES_XTS_256_BLOCK_KEY_LENGTH);

				return -1;

			}

			break;
@@ -1447,11 +1448,6 @@ accel_dpdk_cryptodev_validate_parameters(enum accel_dpdk_cryptodev_driver_type d 
			assert(0);

			return -1;

		}

		if (key->key2_size != ACCEL_DPDK_CRYPTODEV_AES_XTS_TWEAK_KEY_LENGTH) {

			SPDK_ERRLOG("Cipher %s requires key2 size %d\n",

				    g_cipher_names[ACCEL_DPDK_CRYPTODEV_CIPHER_AES_CBC], ACCEL_DPDK_CRYPTODEV_AES_XTS_TWEAK_KEY_LENGTH);

			return -1;

		}

		break;

	}

test/bdev/blockdev.sh

+11 −26
Original line number Diff line number Diff line
@@ -230,23 +230,17 @@ function setup_crypto_mlx5_conf() { 
	local key=$1

	local block_key

	local tweak_key

	if [ ${#key} == 96 ]; then

		# 96 bytes is 64 + 32 - AES_XTS_256 in hexlified format

		# Copy first 64 chars into the 'key'. This gives 32 in the

		# binary or 256 bit.

	if [ ${#key} == 64 ]; then

		# 64 bytes is 32 + 32 - AES_XTS_128 in hexlified format

		block_key=${key:0:32}

		tweak_key=${key:32:32}

	elif [ ${#key} == 128 ]; then

		# 128 bytes is 64 + 64 - AES_XTS_256 in hexlified format

		block_key=${key:0:64}

		# Copy the the rest of the key and pass it as the 'key2'.

		tweak_key=${key:64:32}

	elif [ ${#key} == 160 ]; then

		# 160 bytes is 128 + 32 - AES_XTS_512 in hexlified format

		# Copy first 128 chars into the 'key'. This gives 64 in the

		# binary or 512 bit.

		block_key=${key:0:128}

		# Copy the the rest of the key and pass it as the 'key2'.

		tweak_key=${key:128:32}

		tweak_key=${key:64:64}

	else

		echo "ERROR: Invalid DEK size for MLX5 crypto setup: ${#key}"

		echo "ERROR: Supported key sizes for MLX5: 96 bytes (AES_XTS_256) and 160 bytes (AES_XTS_512)."

		echo "ERROR: Supported key sizes for MLX5: 64 bytes (AES_XTS_128) and 128 bytes (AES_XTS_256)."

		return 1

	fi
@@ -653,20 +647,11 @@ fi 


test_type=${1:-bdev}

crypto_device=$2

wcs_file=$3

dek=$4

dek=$3

env_ctx=""

wait_for_rpc=""

if [ -n "$crypto_device" ] && [ -n "$wcs_file" ]; then

	# We need full path here since fio perf test does 'pushd' to the test dir

	# and crypto login of fio plugin test can fail.

	wcs_file=$(readlink -f $wcs_file)

	if [ -f $wcs_file ]; then

		env_ctx="--env-context=--allow=$crypto_device,class=crypto,wcs_file=$wcs_file"

	else

		echo "ERROR: Credentials file $3 is not found!"

		exit 1

	fi

if [ -n "$crypto_device" ]; then

	env_ctx="--env-context=--allow=$crypto_device,class=crypto"

fi

if [[ $test_type == crypto_* ]]; then

	wait_for_rpc="--wait-for-rpc"