linux-toradex.git/drivers/nvme/common, branch v6.7

nvme: keyring: fix conditional compilation

2023-11-08T16:07:08+00:00

The keyring and auth functions can be called from both the host and
the target side and are controlled by Kconfig options for each of the
combinations, but the declarations are controlled by #ifdef checks
on the shared Kconfig symbols.

This leads to link failures in combinations where one of the frontends
is built-in and the other one is a module, and the keyring code
ends up in a module that is not reachable from the builtin code:

ld: drivers/nvme/host/core.o: in function `nvme_core_exit':
core.c:(.exit.text+0x4): undefined reference to `nvme_keyring_exit'
ld: drivers/nvme/host/core.o: in function `nvme_core_init':
core.c:(.init.text+0x94): undefined reference to `nvme_keyring_init

ld: drivers/nvme/host/tcp.o: in function `nvme_tcp_setup_ctrl':
tcp.c:(.text+0x4c18): undefined reference to `nvme_tls_psk_default'

Address this by moving nvme_keyring_init()/nvme_keyring_exit() into
module init/exit functions for the keyring module.

Fixes: be8e82caa6859 ("nvme-tcp: enable TLS handshake upcall")
Signed-off-by: Hannes Reinecke 
Cc: Arnd Bergmann 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Keith Busch

nvme: common: make keyring and auth separate modules

2023-11-07T18:05:15+00:00

When only the keyring module is included but auth is not, modpost
complains about the lack of a module license tag:

ERROR: modpost: missing MODULE_LICENSE() in drivers/nvme/common/nvme-common.o

Address this by making both modules buildable standalone,
removing the now unnecessary CONFIG_NVME_COMMON symbol
in the process.

Also, now that NVME_KEYRING config symbol can be either a module or
built-in, the stubs need to check for '#if IS_ENABLED' rather than a
simple '#ifdef'.

Fixes: 9d77eb5277849 ("nvme-keyring: register '.nvme' keyring")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Hannes Reinecke 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Keith Busch

nvme-auth: use crypto_shash_tfm_digest()

2023-11-06T16:05:53+00:00

Simplify nvme_auth_augmented_challenge() by using
crypto_shash_tfm_digest() instead of an alloc+init+update+final
sequence.  This should also improve performance.

Signed-off-by: Eric Biggers 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Keith Busch

nvme-auth: allow mixing of secret and hash lengths

2023-10-17T20:57:55+00:00

We can now use any of the secret transformation hashes with a
secret, regardless of the secret size.
e.g. a 32 byte key with the SHA-512(64 byte) hash.

The example secret from the spec should now be permitted with
any of the following:
DHHC-1:00:ia6zGodOr4SEG0Zzaw398rpY0wqipUWj4jWjUh4HWUz6aQ2n:
DHHC-1:01:ia6zGodOr4SEG0Zzaw398rpY0wqipUWj4jWjUh4HWUz6aQ2n:
DHHC-1:02:ia6zGodOr4SEG0Zzaw398rpY0wqipUWj4jWjUh4HWUz6aQ2n:
DHHC-1:03:ia6zGodOr4SEG0Zzaw398rpY0wqipUWj4jWjUh4HWUz6aQ2n:

Note: Secrets are still restricted to 32,48 or 64 bits.

Co-developed-by: Akash Appaiah 
Signed-off-by: Akash Appaiah 
Signed-off-by: Mark O'Donovan 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Keith Busch

nvme-auth: use transformed key size to create resp

2023-10-17T20:57:54+00:00

This does not change current behaviour as the driver currently
verifies that the secret size is the same size as the length of
the transformation hash.

Co-developed-by: Akash Appaiah 
Signed-off-by: Akash Appaiah 
Signed-off-by: Mark O'Donovan 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Keith Busch

nvme-auth: alloc nvme_dhchap_key as single buffer

2023-10-17T20:57:54+00:00

Co-developed-by: Akash Appaiah 
Signed-off-by: Akash Appaiah 
Signed-off-by: Mark O'Donovan 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Keith Busch

nvme: rework NVME_AUTH Kconfig selection

2023-10-12T15:04:49+00:00

Having a single Kconfig symbol NVME_AUTH conflates the selection
of the authentication functions from nvme/common and nvme/host,
causing kbuild robot to complain when building the nvme target
only. So introduce a Kconfig symbol NVME_HOST_AUTH for the nvme
host bits and use NVME_AUTH for the common functions only.
And move the CRYPTO selection into nvme/common to make it
easier to read.

Reported-by: kernel test robot 
Closes: https://lore.kernel.org/oe-kbuild-all/202310120733.TlPOVeJm-lkp@intel.com/
Signed-off-by: Hannes Reinecke 
Signed-off-by: Keith Busch

nvme-keyring: implement nvme_tls_psk_default()

2023-10-11T17:11:54+00:00

Implement a function to select the preferred PSK for TLS.
A 'retained' PSK should be preferred over a 'generated' PSK,
and SHA-384 should be preferred to SHA-256.

Signed-off-by: Hannes Reinecke 
Reviewed-by: Sagi Grimberg 
Signed-off-by: Keith Busch

nvme-keyring: define a 'psk' keytype

2023-10-11T17:11:54+00:00

Define a 'psk' keytype to hold the NVMe TLS PSKs.

Signed-off-by: Hannes Reinecke 
Reviewed-by: Sagi Grimberg 
Signed-off-by: Keith Busch

nvme-keyring: register '.nvme' keyring

2023-10-11T17:11:54+00:00

Register a '.nvme' keyring to hold keys for TLS and DH-HMAC-CHAP and
add a new config option NVME_KEYRING.
We need a separate keyring for NVMe as the configuration is done
via individual commands (eg for configfs), and the usual per-session
or per-process keyrings can't be used.

Signed-off-by: Hannes Reinecke 
Reviewed-by: Sagi Grimberg 
Signed-off-by: Keith Busch