Hi Sagi,
On 1/23/2023 1:27 PM, Sagi Grimberg wrote:
From Israel,
The purpose of this patchset is to add support for inline
encryption/decryption of the data at storage protocols like nvmf over
RDMA (at a similar way like integrity is used via unique mkey).
This patchset adds support for plaintext keys. The patches were tested
on BF-3 HW with fscrypt tool to test this feature, which showed reduce
in CPU utilization when comparing at 64k or more IO size. The CPU
utilization
was improved by more than 50% comparing to the SW only solution at
this case.
How to configure fscrypt to enable plaintext keys:
# mkfs.ext4 -O encrypt /dev/nvme0n1
# mount /dev/nvme0n1 /mnt/crypto -o inlinecrypt
# head -c 64 /dev/urandom > /tmp/master_key
# fscryptctl add_key /mnt/crypto/ < /tmp/master_key
# mkdir /mnt/crypto/test1
# fscryptctl set_policy 152c41b2ea39fa3d90ea06448456e7fb
/mnt/crypto/test1
** “152c41b2ea39fa3d90ea06448456e7fb” is the output of the
“fscryptctl add_key” command.
# echo foo > /mnt/crypto/test1/foo
Notes:
- At plaintext mode only, the user set a master key and the fscrypt
driver derived from it the DEK and the key identifier.
- 152c41b2ea39fa3d90ea06448456e7fb is the derived key identifier
- Only on the first IO, nvme-rdma gets a callback to load the
derived DEK.
There is no special configuration to support crypto at nvme modules.
Hey, this looks sane to me in a very first glance.
Few high level questions:
- what happens with multipathing? when if not all devices are
capable. SW fallback?
SW fallback happens every time the device doesn't support the specific
crypto request (which include data-unit-size, mode and dun_bytes).
So with multipathing, one path uses the HW crypto offload and the other
one uses the SW fallback.
- Does the crypt stuff stay intact when bio is requeued?
Yes, the crypto ctx is copied when cloning the bio.
I'm assuming you tested this with multipathing? This is not very
useful if it is incompatible with it.
Yes, sure.
You can see the call to blk_crypto_reprogram_all_keys(), which is
called when the controller was reconnected after port toggling.
- Israel
