ConnectX-6 and kTLS

Infrastructure & Networking Adapters and Cables Ethernet Adapter Cards
1

I am a bit confused on the ConnectX-6 DX cards. From NVidias home page resources you can see that they mention that the TLS offloading crypto engine is available without differentiating between cards;

NVIDIA ConnectX-6 Dx Network Adapters | NVIDIA “IPsec and TLS in-line crypto and block crypto acceleration”
https://www.nvidia.com/content/dam/en-zz/Solutions/networking/ethernet-adapters/connectX-6-dx-datasheet.pdf “Inline hardware TLS encryption and decryption AES-GCM 128/256-bit key”

However looking at the following resource:
https://docs.nvidia.com/networking/display/connectx6dxen

It would seem like the following models are designated as “No Crypto”;

MCX623105AN-CDAT​
MCX623106AN-CDAT​
MCX623106AS-CDAT​

So… what gives? Which ConnectX-6 DX cards have kTLS support and why is it not clearly presented on the product page?

I bought a ConnectX-6 adapter, running the required kernel versions and software, latest firmware, and getting the following:

tls-hw-tx-offload: off [fixed]
tls-hw-rx-offload: off [fixed]
tls-hw-record: off [fixed]

Bit… disappointing?

08:00.0 Ethernet controller: Mellanox Technologies MT2892 Family [ConnectX-6 Dx]

2

Hello Service_NVIDIA,

Thank you for posting your inquiry on the NVIDIA Developer Forum - Infrastructure and Networking - Section.

Unfortunately only the ConnectX-6 Dx Crypto versions support kTLS offload, as mentioned in the MLNX_OFED UG → Kernel Transport Layer Security (kTLS) Offloads - NVIDIA Docs

The following link provides the information which ConnectX-6 Dx OPNs have crypto functionality → NVIDIA ConnectX-6 Dx Ethernet Adapter Cards User Manual - NVIDIA Docs

Thank you and regards,
~NVIDIA Networking Technical Support

3

Thank you. I have successfully flashed the MCX623106AC-CDA_Ax firmware to the card. The card as far as I can see is identical down to the caps to the hardware I have. Literally identical. I am suspecting there is an EEPROM bit set which explicitly disables this functionality. Would there be any unsupported option which I can try with mlxconfig set_raw on the device to force enable the CRYPTO_ENGINE?

mlxconfig -d /dev/mst/mt4125_pciconf0 set DATA_CRYPTO_ENGINE=ENABLED

Device #1:

Device type: ConnectX6DX
Name: MCX623106AC-CDA_Ax
Description: ConnectX-6 Dx EN adapter card; 100GbE; Dual-port QSFP56; PCIe 4.0 x16; Crypto and Secure Boot
Device: /dev/mst/mt4125_pciconf0

Configurations: Next Boot New
-E- The Device doesn’t support DATA_CRYPTO_ENGINE parameter

Thanks!