Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

spdk: disable RDSEED RDRAND compile-time flags #153

Closed
epuertat opened this issue Jun 13, 2023 · 1 comment
Closed

spdk: disable RDSEED RDRAND compile-time flags #153

epuertat opened this issue Jun 13, 2023 · 1 comment
Labels
bug Something isn't working security

Comments

@epuertat
Copy link
Member

epuertat commented Jun 13, 2023

These 2 CPU features (RDSEED and RDRAND) cause the spdk container not to work in some Intel Xeon CPUs (3-4 years old):

nvmeof_1        | ERROR: This system does not support "RDSEED".
nvmeof_1        | Please check that RTE_MACHINE is set correctly.
nvmeof_1        | EAL: FATAL: unsupported cpu type.
nvmeof_1        | EAL: unsupported cpu type.
nvmeof_1        | [2023-06-23 23:12:55.662422] init.c: 602:spdk_env_init: *ERROR*: Failed to initialize DPDK
nvmeof_1        | [2023-06-23 23:12:55.662447] app.c: 351:app_setup_env: *ERROR*: Unable to initialize SPDK env

While there's a DPDK proposal to detect this support at runtime, that's unlikely to be merged. Given we aren't strictly relying on those features for FIPS-140 compliant encryption, we could simply disable these by default.

Workaround

Build the spdk and nvmeof container images locally in the environment without RDSEED support:

make build SVC="spdk nvmeof"

Long-term solution

Either:

  • Generate 2 container flavors: with and without RDSEED.
  • Disable RDSEED for all builds, since nvmeof doesn't seem to rely on that.
  • Push to have DPDK's run-time feature flag patch merged.
@epuertat epuertat added bug Something isn't working security labels Jun 13, 2023
@epuertat epuertat added this to NVMe-oF Jun 13, 2023
@github-project-automation github-project-automation bot moved this to 🆕 New in NVMe-oF Jun 13, 2023
@epuertat epuertat moved this from 🆕 New to 🏗 In progress in NVMe-oF Jun 27, 2023
@epuertat epuertat pinned this issue Jun 27, 2023
@sunilkumarn417 sunilkumarn417 unpinned this issue Jun 30, 2023
@caroav caroav moved this from 🏗 In progress to 🆕 New in NVMe-oF Aug 30, 2023
@gbregman
Copy link
Contributor

This was fixed by #261

@github-project-automation github-project-automation bot moved this from 🆕 New to ✅ Done in NVMe-oF Oct 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working security
Projects
Archived in project
Development

No branches or pull requests

2 participants