by Christoph Hellwig

[permalink] [raw]

Subject: Re: [PATCH v9 01/11] block: Keyslot Manager for Inline Encryption

On Wed, Mar 25, 2020 at 11:22:13PM -0700, Eric Biggers wrote:
> > +#ifdef CONFIG_BLK_INLINE_ENCRYPTION
> > + /* Inline crypto capabilities */
> > + struct blk_keyslot_manager *ksm;
> > +#endif
>
> I do still wonder whether the concept of inline crypto support should be more
> separated from keyslot management, to be better prepared for device-mapper
> passthrough support and for hardware that accepts keys directly. (Such hardware
> exists, though I'm not sure support for it will be upstreamed.) For example,
> the crypto capabilities could be stored in a 'struct blk_crypto_capabilities'
> rather than in 'struct blk_keyslot_manager', and the latter could be optional.
>
> What you have now is fine for the functionality in the current patchset though,
> so I'm not really complaining. Just something to think about.

I'd rather keep things simple (aka as-is) for now. If needed we can
change it. I doubt we'll even have a handful drivers with inline
crypto in the next years..

2020-03-27 17:06:15

by Christoph Hellwig

[permalink] [raw]

Subject: Re: [PATCH v9 02/11] block: Inline encryption support for blk-mq

On Thu, Mar 26, 2020 at 01:05:11PM -0700, Eric Biggers wrote:
> > +{
> > + int i = 0;
> > + unsigned int inc = bytes >> bc->bc_key->data_unit_size_bits;
> > +
> > + while (i < BLK_CRYPTO_DUN_ARRAY_SIZE) {
> > + if (bc->bc_dun[i] + inc != next_dun[i])
> > + return false;
> > + /*
> > + * If addition of inc to the current entry caused an overflow,
> > + * then we have to carry "1" for the next entry - so inc
> > + * needs to be "1" for the next loop iteration). Otherwise,
> > + * we need inc to be 0 for the next loop iteration. Since
> > + * overflow can be determined by (bc->bc_dun[i] + inc) < inc
> > + * we can do the following.
> > + */
> > + inc = ((bc->bc_dun[i] + inc) < inc);
> > + i++;
> > + }
>
> This comment is verbose but doesn't really explain what's going on.
> I think it would be much more useful to add comments like:

Also the code is still weird. Odd double whitespaces, expression that
evaluate to bool.

>
> /*
> * If the addition in this limb overflowed, then the carry bit
> * into the next limb is 1. Else the carry bit is 0.
> */
> inc = ((bc->bc_dun[i] + inc) < inc);

if (bc->bc_dun[i] + carry < carry)
carry = 1;
else
carry = 0;

>
> > +blk_status_t __blk_crypto_init_request(struct request *rq,
> > + const struct blk_crypto_key *key)
> > +{
> > + return blk_ksm_get_slot_for_key(rq->q->ksm, key, &rq->crypt_keyslot);
> > +}
>
> The comment of this function seems outdated. All it does it get a keyslot, but
> the comment talks about initializing "crypto fields" (plural).

This is a classic case where I think the top of the function comment
is entirely useless. If there is a single caller in core code and the
function is completely trivial, there really is no point in a multi-line
comment. Comment should explain something unexpected or non-trivial,
while much of the comments in this series are just boilerplate making
the code harder to read.

> > blk_queue_bounce(q, &bio);
> > __blk_queue_split(q, &bio, &nr_segs);
> > @@ -2002,6 +2006,14 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
> >
> > cookie = request_to_qc_t(data.hctx, rq);
> >
> > + ret = blk_crypto_init_request(rq, bio_crypt_key(bio));
> > + if (ret != BLK_STS_OK) {
> > + bio->bi_status = ret;
> > + bio_endio(bio);
> > + blk_mq_free_request(rq);
> > + return BLK_QC_T_NONE;
> > + }
> > +
> > blk_mq_bio_to_request(rq, bio, nr_segs);
>
> Wouldn't it make a lot more sense to do blk_crypto_init_request() after
> blk_mq_bio_to_request() rather than before?
>
> I.e., initialize request::crypt_ctx first, *then* get the keyslot. Not the
> other way around.
>
> That would allow removing the second argument to blk_crypto_init_request() and
> removing bio_crypt_key(). blk_crypto_init_request() would only need to take in
> the struct request.

And we can fail just the request on an error, so yes this doesn't
seem too bad.