mlx5dv_crypto_lo...dv_crypto_logout(3)

okay bestie, welcome to the mlx5dv_crypto_login(3) manual page — home of the crypto login session trio: mlx5dv_crypto_login, mlx5dv_crypto_login_query_state, and mlx5dv_crypto_logout. All three are invited to the group chat. ✨

💖 NAME 💖

• mlx5dv_crypto_login — creates a crypto login session.
• mlx5dv_crypto_login_query_state — queries the state of the current crypto login session.
• mlx5dv_crypto_logout — logs out from the current crypto login session.

🦋 SYNOPSIS 🦋

#include <infiniband/mlx5dv.h>

int mlx5dv_crypto_login(struct ibv_context *context,
            struct mlx5dv_crypto_login_attr *login_attr);

int mlx5dv_crypto_login_query_state(struct ibv_context *context,
                        enum mlx5dv_crypto_login_state *state);

int mlx5dv_crypto_logout(struct ibv_context *context);

💖 DESCRIPTION 💖

So here’s the vibe: when you’re using a crypto engine that is in wrapped import method, an active crypto login session must be present in order to create and query Data Encryption Keys (DEKs). No login session, no DEK business — periodt.

mlx5dv_crypto_login() creates a crypto login session with the credential given in login_attr and associates it with context. Important: only one active crypto login session can be associated per device context. One session, one context, that’s the rule 💅

mlx5dv_crypto_login_query_state() queries the state of the crypto login session associated with context and returns the state in state, which indicates whether it is valid, invalid or doesn’t exist. A valid crypto login session can become invalid if the credential or the import KEK used in the crypto login session were deleted during the login session (for example by a crypto officer). In this case, mlx5dv_crypto_logout() should be called to destroy the current invalid crypto login session and if still necessary, mlx5dv_crypto_login() should be called to create a new crypto login session with valid credential and import KEK. Basically: clean up the expired session, then re-login like the main character you are.

mlx5dv_crypto_logout() logs out from the current crypto login session associated with context.

Existing DEKs that were previously loaded to the device during a crypto login session don’t need an active crypto login session in order to be used (in MKey or during traffic). <butterfly>🦋</butterfly> So the already-loaded DEKs can still do their thing.

🎀 ARGUMENTS 🎀

🫶 context

The device context to associate the crypto login session with.

💅 login_attr

Crypto login attributes specify the credential to login with and the import KEK to be used for secured communications during the crypto login session.

struct mlx5dv_crypto_login_attr {
    uint32_t credential_id;
    uint32_t import_kek_id;
    char credential[48];
    uint64_t comp_mask;
};

🌸 credential_id

An ID of a credential, from the credentials stored on the device, that indicates the credential that should be validated against the credential provided in credential.

🔑 import_kek_id

An ID of an import KEK, from the import KEKs stored on the device, that indicates the import KEK that will be used for unwrapping the credential provided in credential and also for all other secured communications during the crypto login session.

🎀 credential

The credential to login with. Must be provided wrapped by the AES key wrap algorithm using the import KEK indicated by import_kek_id.

🧚 comp_mask

Reserved for future extension — must be 0 now. Like, actually 0, bestie.

⭐ state

Indicates the state of the current crypto login session. Can be one of MLX5DV_CRYPTO_LOGIN_STATE_VALID, MLX5DV_CRYPTO_LOGIN_STATE_NO_LOGIN and MLX5DV_CRYPTO_LOGIN_STATE_INVALID.

🔥 RETURN VALUE 🔥

• mlx5dv_crypto_login() returns 0 on success and errno value on error.
• mlx5dv_crypto_login_query_state() returns 0 on success and updates state with the queried state. On error, errno value is returned.
• mlx5dv_crypto_logout() returns 0 on success and errno value on error.

💀 ERRORS 💀

• EEXIST — A crypto login session already exists.
• EINVAL — Invalid attributes were provided, or one or more of credential, credential_id and import_kek_id are invalid.
• ENOENT — No crypto login session exists.

👑 AUTHORS 👑

Avihai Horon <avihaih@nvidia.com>

---

That’s the whole page, bestie 💜 — the footer on this copy is the truncated mlx5dv_crypto_lo...dv_crypto_logout(3) title, and no separate source/version or date line showed up in the provided footer, so consider this your cute sign-off. mwah 🫶