From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id D57F8A0A0C; Thu, 15 Jul 2021 17:10:21 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id F37AA4130E; Thu, 15 Jul 2021 17:09:26 +0200 (CEST) Received: from NAM10-BN7-obe.outbound.protection.outlook.com (mail-bn7nam10on2075.outbound.protection.outlook.com [40.107.92.75]) by mails.dpdk.org (Postfix) with ESMTP id 074FC41233 for ; Thu, 15 Jul 2021 17:09:19 +0200 (CEST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UJsdF9scJ2CIsY5Hso2FAf6YD6Sfy9PFejhkWxCbK32EUfD4iuhCrr+NaUFCyBDKRCae30beqPmeKXixI3PmE2QTqQISz1x09doG8KhQezR8fDhk10n2SgSQh84g9CEE+hxiHTZVZP+tD2P0/aeEmGf0g8GeYkRQ4/WV8+GMmObEFNZ/B3zp8YxBfR2G0YumGGf/SSDcD0gswoQzt9wMjrNe7n0mNmV1I63QiQRVimaBfLQYjL9w7GID7azlW31QvTtMz6Uzu5t9AtGpm/stz0cZewUkKJjkAF9l6DSHo+ipUvvRPxivIAR16h/23/mD3DqUptcM8hsZlalHl2JDQQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hZvn5bJ7Rk2g3jDa4qj0jnYqDhatdzrXjwl3ex3sXeI=; b=MzB2CSU7F1trJdCde8er4fILAithXpl033wA5KlG+o8nN2VNAXs8O60xB8REcws/uwUn4FrYGP+kHh/5sJyThqzFEklfM2IDg9Wm+uUn76Pt3eY3ut++alMEJvpVb+lDNelys63z+0N5hD4NiRnffa1uzIoQoBbLeoUSVEVm9BMLCjjvylKb/A8jqcFzzt1EY2Q4aA+nhMp/bPlndf+pJrD1otDSanV78pRbz9WT7OVWWBVpjzg9PyorrfymaatJJozAoOULg7KXgnSUUY8OnbKQ/JdiJAkEt46XAnhDwE0WeS2KzDH0fKWSeaIQaqVu/7WjPA2xCRo8ru1Hz4v2kg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.112.34) smtp.rcpttodomain=redhat.com smtp.mailfrom=nvidia.com; dmarc=pass (p=quarantine sp=none pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hZvn5bJ7Rk2g3jDa4qj0jnYqDhatdzrXjwl3ex3sXeI=; b=qXnWOAFhvU35YXJWJHM5L2SysjvwBKilwQ8ZiMj4LoXCgfBUOtmX8JzYBNnSda0mlXdMXaRK2eWcoiy6LHcGXjsWr+kF6h54HM1vIUQdNbvlevyablQ+6MLSIcGqPrOspDUxFKwQ1+P1YG+t9zGtRUv0zPq6SsUnVz23M+5ZeIdaNcEBUOz2u5Dh3jqrCP2hkRUwZUEuaQ+3fyhDsS543i7JqNZdaVsXq17ysmANYOo8IKwOcC3uG+OrF15EIcwlw4T48d5raN6+Sps5BZlqzAmBK+/ybNf8j6LDrC4ulmasbURBe60u22M8FRNE/BmuXdOYryEL/5VjnrYskJZbGA== Received: from MW4PR04CA0072.namprd04.prod.outlook.com (2603:10b6:303:6b::17) by BL0PR12MB5012.namprd12.prod.outlook.com (2603:10b6:208:1ca::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.22; Thu, 15 Jul 2021 15:09:17 +0000 Received: from CO1NAM11FT015.eop-nam11.prod.protection.outlook.com (2603:10b6:303:6b:cafe::bb) by MW4PR04CA0072.outlook.office365.com (2603:10b6:303:6b::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4331.23 via Frontend Transport; Thu, 15 Jul 2021 15:09:17 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.112.34) smtp.mailfrom=nvidia.com; redhat.com; dkim=none (message not signed) header.d=none;redhat.com; dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.112.34 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.112.34; helo=mail.nvidia.com; Received: from mail.nvidia.com (216.228.112.34) by CO1NAM11FT015.mail.protection.outlook.com (10.13.175.130) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.4331.21 via Frontend Transport; Thu, 15 Jul 2021 15:09:17 +0000 Received: from nvidia.com (172.20.187.6) by HQMAIL107.nvidia.com (172.20.187.13) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 15 Jul 2021 15:09:15 +0000 From: Shiri Kuzin To: CC: , , , Date: Thu, 15 Jul 2021 18:08:10 +0300 Message-ID: <20210715150817.51485-10-shirik@nvidia.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20210715150817.51485-1-shirik@nvidia.com> References: <20210708152530.25835-1-shirik@nvidia.com> <20210715150817.51485-1-shirik@nvidia.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Originating-IP: [172.20.187.6] X-ClientProxiedBy: HQMAIL111.nvidia.com (172.20.187.18) To HQMAIL107.nvidia.com (172.20.187.13) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 672146d3-4276-477d-60d0-08d947a283ef X-MS-TrafficTypeDiagnostic: BL0PR12MB5012: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:139; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: et0TIZFUdJsx81gowhvT0IKGIzul9IUN4cjOP1JMJE8n3ZEHmDCYXQnGt185ZxJwjgUrO8po5gxcUXy7UTOJdg9WcRPlKfZg8pChNVOt79pYPIf00N2lbCT8M04kgmYdcXERq4G0b4WQdwKGs7aUgegRa7rCEbMuORxIiImE2zf5HDdKOsJFNprvZEijur44oCjWrzpfTVW6gOQKUdUL5eDD77eNkHKEDFjbTAd53z+RDlH5uwiElDTKqJtEVh6Ja1ornT+2yg7M1ZTiH+lxDsAUDj5ILpJ0IbBXtu7WEDG2IMcjZA0liznbu6djJ5qr37hpAHsFrW4ghi5K/w70HzJM4+cO954fQYPhf1swxVSPOvIpllbuFOcCz9lTVwX6RBn/vHgEV0qWaNa0jgjbYoH1jgTkvx9eb5l/2PSWqzlpylHwEHIWgLwT73jLwMxWus4KqMsf8WVKjmxjVYydnxcuhW8MWOOCBDEUPX9k6oiTkSVbTnDlwCxBUp2dwXLp8pnZDELYFssJ+/D/ZBtunh1cV4uTpHT6BOwQb19MYd8cQZE5b/nnOwsP78IbLFgttTSehHEQ7X8IKBwRsES0hyfAp0nIJ12w8sEzGgvGXZ/ct5AlItdMQ9J05AXgSLzzIAVM1LupClI0/HYljZKhaTPjo2FNkJryZcpGXv4Htsjo7Y78XT8jy35HbAtzlqJnX2/7J5qZs2hnNfDsYUntAkp9SxVXVDYXaZwXqU/veu4= X-Forefront-Antispam-Report: CIP:216.228.112.34; CTRY:US; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:mail.nvidia.com; PTR:schybrid03.nvidia.com; CAT:NONE; SFS:(4636009)(39850400004)(136003)(346002)(396003)(376002)(46966006)(36840700001)(82740400003)(8676002)(7636003)(36860700001)(36906005)(316002)(36756003)(83380400001)(6286002)(34020700004)(2906002)(1076003)(356005)(8936002)(7696005)(54906003)(47076005)(82310400003)(70586007)(6916009)(2616005)(26005)(426003)(55016002)(4326008)(478600001)(186003)(86362001)(70206006)(336012)(6666004)(5660300002)(16526019); DIR:OUT; SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Jul 2021 15:09:17.0954 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 672146d3-4276-477d-60d0-08d947a283ef X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a; Ip=[216.228.112.34]; Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT015.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR12MB5012 Subject: [dpdk-dev] [PATCH v7 09/16] crypto/mlx5: add keytag devarg X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" From: Suanming Mou A keytag is a piece of data encrypted together with a DEK. When a DEK is referenced by an MKEY.bsf through its index, the keytag is also supplied in the BSF as plaintext. The HW will decrypt the DEK (and the attached keytag) and will fail the operation if the keytags don't match. This commit adds the configuration of the keytag with devargs. Signed-off-by: Suanming Mou Signed-off-by: Matan Azrad --- doc/guides/cryptodevs/mlx5.rst | 7 +++++ drivers/crypto/mlx5/mlx5_crypto.c | 50 +++++++++++++++++-------------- drivers/crypto/mlx5/mlx5_crypto.h | 3 +- 3 files changed, 37 insertions(+), 23 deletions(-) diff --git a/doc/guides/cryptodevs/mlx5.rst b/doc/guides/cryptodevs/mlx5.rst index 6cae5affbd..c3632484a5 100644 --- a/doc/guides/cryptodevs/mlx5.rst +++ b/doc/guides/cryptodevs/mlx5.rst @@ -52,6 +52,9 @@ wrapping. The credential and the AES-XTS keys should be provided to the hardware, as ciphertext encrypted by the KEK. +A keytag (64 bits) should be appended to the AES-XTS keys (before wrapping), +and will be validated when the hardware attempts to access it. + When crypto engines are defined to work in wrapped import method, they come out of the factory in Commissioning mode, and thus, cannot be used for crypto operations yet. A dedicated tool is used for changing the mode from Commissioning to @@ -113,6 +116,10 @@ Driver options The identifier of the credential, default value is 0 represents the operational register credential. +- ``keytag`` parameter [int] + + The plaintext of the keytag appanded to the AES-XTS keys, default value is 0. + Supported NICs -------------- diff --git a/drivers/crypto/mlx5/mlx5_crypto.c b/drivers/crypto/mlx5/mlx5_crypto.c index cbaa2e52ff..0f786ac4ca 100644 --- a/drivers/crypto/mlx5/mlx5_crypto.c +++ b/drivers/crypto/mlx5/mlx5_crypto.c @@ -500,56 +500,52 @@ mlx5_crypto_args_check_handler(const char *key, const char *val, void *opaque) attr->session_import_kek_ptr = (uint32_t)tmp; else if (strcmp(key, "credential_id") == 0) attr->credential_pointer = (uint32_t)tmp; + else if (strcmp(key, "keytag") == 0) + devarg_prms->keytag = tmp; else DRV_LOG(WARNING, "Invalid key %s.", key); return 0; } -static struct mlx5_devx_obj * -mlx5_crypto_config_login(struct rte_devargs *devargs, - struct ibv_context *ctx) +static int +mlx5_crypto_parse_devargs(struct rte_devargs *devargs, + struct mlx5_crypto_devarg_params *devarg_prms) { - /* - * Set credential pointer and session import KEK pointer to a default - * value of 0. - */ - struct mlx5_crypto_devarg_params login = { - .login_devarg = false, - .login_attr = { - .credential_pointer = 0, - .session_import_kek_ptr = 0, - } - }; + struct mlx5_devx_crypto_login_attr *attr = &devarg_prms->login_attr; struct rte_kvargs *kvlist; + /* Default values. */ + attr->credential_pointer = 0; + attr->session_import_kek_ptr = 0; + devarg_prms->keytag = 0; if (devargs == NULL) { DRV_LOG(ERR, "No login devargs in order to enable crypto operations in the device."); rte_errno = EINVAL; - return NULL; + return -1; } kvlist = rte_kvargs_parse(devargs->args, NULL); if (kvlist == NULL) { DRV_LOG(ERR, "Failed to parse devargs."); rte_errno = EINVAL; - return NULL; + return -1; } if (rte_kvargs_process(kvlist, NULL, mlx5_crypto_args_check_handler, - &login) != 0) { + devarg_prms) != 0) { DRV_LOG(ERR, "Devargs handler function Failed."); rte_kvargs_free(kvlist); rte_errno = EINVAL; - return NULL; + return -1; } rte_kvargs_free(kvlist); - if (login.login_devarg == false) { + if (devarg_prms->login_devarg == false) { DRV_LOG(ERR, "No login credential devarg in order to enable crypto operations " "in the device."); rte_errno = EINVAL; - return NULL; + return -1; } - return mlx5_devx_cmd_create_crypto_login_obj(ctx, &login.login_attr); + return 0; } /** @@ -609,6 +605,7 @@ mlx5_crypto_pci_probe(struct rte_pci_driver *pci_drv, struct ibv_context *ctx; struct mlx5_devx_obj *login; struct mlx5_crypto_priv *priv; + struct mlx5_crypto_devarg_params devarg_prms = { 0 }; struct mlx5_hca_attr attr = { 0 }; struct rte_cryptodev_pmd_init_params init_params = { .name = "", @@ -617,6 +614,8 @@ mlx5_crypto_pci_probe(struct rte_pci_driver *pci_drv, .max_nb_queue_pairs = RTE_CRYPTODEV_PMD_DEFAULT_MAX_NB_QUEUE_PAIRS, }; + int ret; + RTE_SET_USED(pci_drv); if (rte_eal_process_type() != RTE_PROC_PRIMARY) { DRV_LOG(ERR, "Non-primary process type is not supported."); @@ -646,7 +645,13 @@ mlx5_crypto_pci_probe(struct rte_pci_driver *pci_drv, rte_errno = ENOTSUP; return -ENOTSUP; } - login = mlx5_crypto_config_login(pci_dev->device.devargs, ctx); + ret = mlx5_crypto_parse_devargs(pci_dev->device.devargs, &devarg_prms); + if (ret) { + DRV_LOG(ERR, "Failed to parse devargs."); + return -rte_errno; + } + login = mlx5_devx_cmd_create_crypto_login_obj(ctx, + &devarg_prms.login_attr); if (login == NULL) { DRV_LOG(ERR, "Failed to configure login."); return -rte_errno; @@ -686,6 +691,7 @@ mlx5_crypto_pci_probe(struct rte_pci_driver *pci_drv, } priv->mr_scache.reg_mr_cb = mlx5_common_verbs_reg_mr; priv->mr_scache.dereg_mr_cb = mlx5_common_verbs_dereg_mr; + priv->keytag = rte_cpu_to_be_64(devarg_prms.keytag); /* Register callback function for global shared MR cache management. */ if (TAILQ_EMPTY(&mlx5_crypto_priv_list)) rte_mem_event_callback_register("MLX5_MEM_EVENT_CB", diff --git a/drivers/crypto/mlx5/mlx5_crypto.h b/drivers/crypto/mlx5/mlx5_crypto.h index b98c621c23..d374d3c4e9 100644 --- a/drivers/crypto/mlx5/mlx5_crypto.h +++ b/drivers/crypto/mlx5/mlx5_crypto.h @@ -30,6 +30,7 @@ struct mlx5_crypto_priv { struct rte_cryptodev_config dev_config; struct mlx5_mr_share_cache mr_scache; /* Global shared MR cache. */ struct mlx5_devx_obj *login_obj; + uint64_t keytag; }; struct mlx5_crypto_qp { @@ -49,10 +50,10 @@ struct mlx5_crypto_dek { bool size_is_48; /* Whether the key\data size is 48 bytes or not. */ } __rte_cache_aligned; - struct mlx5_crypto_devarg_params { bool login_devarg; struct mlx5_devx_crypto_login_attr login_attr; + uint64_t keytag; }; int -- 2.27.0