Re: [PATCH 05/12] nvme: add definitions for NVMe In-Band authentication

Himanshu Madhani
2021-11-15T15:25:55Z

On 11/12/21 06:59, Hannes Reinecke wrote:
> Add new definitions for NVMe In-band authentication as defined in
> the NVMe Base Specification v2.0.
>
> Signed-off-by: Hannes Reinecke <hare@suse.de>
> Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
> ---
> include/linux/nvme.h | 186 ++++++++++++++++++++++++++++++++++++++++++-
> 1 file changed, 185 insertions(+), 1 deletion(-)
>
> diff --git a/include/linux/nvme.h b/include/linux/nvme.h
> index 855dd9b3e84b..3e3858d3976f 100644
> --- a/include/linux/nvme.h
> +++ b/include/linux/nvme.h
> @@ -19,6 +19,7 @@
> #define NVMF_TRSVCID_SIZE 32
> #define NVMF_TRADDR_SIZE 256
> #define NVMF_TSAS_SIZE 256
> +#define NVMF_AUTH_HASH_LEN 64
>
> #define NVME_DISC_SUBSYS_NAME "nqn.2014-08.org.nvmexpress.discovery"
>
> @@ -1278,6 +1279,8 @@ enum nvmf_capsule_command {
> nvme_fabrics_type_property_set = 0x00,
> nvme_fabrics_type_connect = 0x01,
> nvme_fabrics_type_property_get = 0x04,
> + nvme_fabrics_type_auth_send = 0x05,
> + nvme_fabrics_type_auth_receive = 0x06,
> };
>
> #define nvme_fabrics_type_name(type) { type, #type }
> @@ -1285,7 +1288,9 @@ enum nvmf_capsule_command {
> __print_symbolic(type, \
> nvme_fabrics_type_name(nvme_fabrics_type_property_set), \
> nvme_fabrics_type_name(nvme_fabrics_type_connect), \
> - nvme_fabrics_type_name(nvme_fabrics_type_property_get))
> + nvme_fabrics_type_name(nvme_fabrics_type_property_get), \
> + nvme_fabrics_type_name(nvme_fabrics_type_auth_send), \
> + nvme_fabrics_type_name(nvme_fabrics_type_auth_receive))
>
> /*
> * If not fabrics command, fctype will be ignored.
> @@ -1415,6 +1420,183 @@ struct nvmf_property_get_command {
> __u8 resv4[16];
> };
>
> +struct nvmf_auth_send_command {
> + __u8 opcode;
> + __u8 resv1;
> + __u16 command_id;
> + __u8 fctype;
> + __u8 resv2[19];
> + union nvme_data_ptr dptr;
> + __u8 resv3;
> + __u8 spsp0;
> + __u8 spsp1;
> + __u8 secp;
> + __le32 tl;
> + __u8 resv4[16];
> +};
> +
> +struct nvmf_auth_receive_command {
> + __u8 opcode;
> + __u8 resv1;
> + __u16 command_id;
> + __u8 fctype;
> + __u8 resv2[19];
> + union nvme_data_ptr dptr;
> + __u8 resv3;
> + __u8 spsp0;
> + __u8 spsp1;
> + __u8 secp;
> + __le32 al;
> + __u8 resv4[16];
> +};
> +
> +/* Value for secp */
> +enum {
> + NVME_AUTH_DHCHAP_PROTOCOL_IDENTIFIER = 0xe9,
> +};
> +
> +/* Defined value for auth_type */
> +enum {
> + NVME_AUTH_COMMON_MESSAGES = 0x00,
> + NVME_AUTH_DHCHAP_MESSAGES = 0x01,
> +};
> +
> +/* Defined messages for auth_id */
> +enum {
> + NVME_AUTH_DHCHAP_MESSAGE_NEGOTIATE = 0x00,
> + NVME_AUTH_DHCHAP_MESSAGE_CHALLENGE = 0x01,
> + NVME_AUTH_DHCHAP_MESSAGE_REPLY = 0x02,
> + NVME_AUTH_DHCHAP_MESSAGE_SUCCESS1 = 0x03,
> + NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2 = 0x04,
> + NVME_AUTH_DHCHAP_MESSAGE_FAILURE2 = 0xf0,
> + NVME_AUTH_DHCHAP_MESSAGE_FAILURE1 = 0xf1,
> +};
> +
> +struct nvmf_auth_dhchap_protocol_descriptor {
> + __u8 authid;
> + __u8 rsvd;
> + __u8 halen;
> + __u8 dhlen;
> + __u8 idlist[60];
> +};
> +
> +enum {
> + NVME_AUTH_DHCHAP_AUTH_ID = 0x01,
> +};
> +
> +/* Defined hash functions for DH-HMAC-CHAP authentication */
> +enum {
> + NVME_AUTH_DHCHAP_SHA256 = 0x01,
> + NVME_AUTH_DHCHAP_SHA384 = 0x02,
> + NVME_AUTH_DHCHAP_SHA512 = 0x03,
> +};
> +
> +/* Defined Diffie-Hellman group identifiers for DH-HMAC-CHAP authentication */
> +enum {
> + NVME_AUTH_DHCHAP_DHGROUP_NULL = 0x00,
> + NVME_AUTH_DHCHAP_DHGROUP_2048 = 0x01,
> + NVME_AUTH_DHCHAP_DHGROUP_3072 = 0x02,
> + NVME_AUTH_DHCHAP_DHGROUP_4096 = 0x03,
> + NVME_AUTH_DHCHAP_DHGROUP_6144 = 0x04,
> + NVME_AUTH_DHCHAP_DHGROUP_8192 = 0x05,
> +};
> +
> +union nvmf_auth_protocol {
> + struct nvmf_auth_dhchap_protocol_descriptor dhchap;
> +};
> +
> +struct nvmf_auth_dhchap_negotiate_data {
> + __u8 auth_type;
> + __u8 auth_id;
> + __le16 rsvd;
> + __le16 t_id;
> + __u8 sc_c;
> + __u8 napd;
> + union nvmf_auth_protocol auth_protocol[];
> +};
> +
> +struct nvmf_auth_dhchap_challenge_data {
> + __u8 auth_type;
> + __u8 auth_id;
> + __u16 rsvd1;
> + __le16 t_id;
> + __u8 hl;
> + __u8 rsvd2;
> + __u8 hashid;
> + __u8 dhgid;
> + __le16 dhvlen;
> + __le32 seqnum;
> + /* 'hl' bytes of challenge value */
> + __u8 cval[];
> + /* followed by 'dhvlen' bytes of DH value */
> +};
> +
> +struct nvmf_auth_dhchap_reply_data {
> + __u8 auth_type;
> + __u8 auth_id;
> + __le16 rsvd1;
> + __le16 t_id;
> + __u8 hl;
> + __u8 rsvd2;
> + __u8 cvalid;
> + __u8 rsvd3;
> + __le16 dhvlen;
> + __le32 seqnum;
> + /* 'hl' bytes of response data */
> + __u8 rval[];
> + /* followed by 'hl' bytes of Challenge value */
> + /* followed by 'dhvlen' bytes of DH value */
> +};
> +
> +enum {
> + NVME_AUTH_DHCHAP_RESPONSE_VALID = (1 << 0),
> +};
> +
> +struct nvmf_auth_dhchap_success1_data {
> + __u8 auth_type;
> + __u8 auth_id;
> + __le16 rsvd1;
> + __le16 t_id;
> + __u8 hl;
> + __u8 rsvd2;
> + __u8 rvalid;
> + __u8 rsvd3[7];
> + /* 'hl' bytes of response value if 'rvalid' is set */
> + __u8 rval[];
> +};
> +
> +struct nvmf_auth_dhchap_success2_data {
> + __u8 auth_type;
> + __u8 auth_id;
> + __le16 rsvd1;
> + __le16 t_id;
> + __u8 rsvd2[10];
> +};
> +
> +struct nvmf_auth_dhchap_failure_data {
> + __u8 auth_type;
> + __u8 auth_id;
> + __le16 rsvd1;
> + __le16 t_id;
> + __u8 rescode;
> + __u8 rescode_exp;
> +};
> +
> +enum {
> + NVME_AUTH_DHCHAP_FAILURE_REASON_FAILED = 0x01,
> +};
> +
> +enum {
> + NVME_AUTH_DHCHAP_FAILURE_FAILED = 0x01,
> + NVME_AUTH_DHCHAP_FAILURE_NOT_USABLE = 0x02,
> + NVME_AUTH_DHCHAP_FAILURE_CONCAT_MISMATCH = 0x03,
> + NVME_AUTH_DHCHAP_FAILURE_HASH_UNUSABLE = 0x04,
> + NVME_AUTH_DHCHAP_FAILURE_DHGROUP_UNUSABLE = 0x05,
> + NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD = 0x06,
> + NVME_AUTH_DHCHAP_FAILURE_INCORRECT_MESSAGE = 0x07,
> +};
> +
> +
> struct nvme_dbbuf {
> __u8 opcode;
> __u8 flags;
> @@ -1458,6 +1640,8 @@ struct nvme_command {
> struct nvmf_connect_command connect;
> struct nvmf_property_set_command prop_set;
> struct nvmf_property_get_command prop_get;
> + struct nvmf_auth_send_command auth_send;
> + struct nvmf_auth_receive_command auth_receive;
> struct nvme_dbbuf dbbuf;
> struct nvme_directive_cmd directive;
> };
>

Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>

--
Himanshu Madhani Oracle Linux Engineering