From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5DE383C3C1B for ; Mon, 11 May 2026 23:48:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778543322; cv=none; b=jsUU+7754x4hZQBk/8K8pJ67mSNPD9GJST3U0GYkPCbgy0s6Np4Wxe6iZuhAUlgm5ElSoGoR2WaXMSRexJ8aoelI+OfDWCBE5PeS5by4a862ItncByaDrZvTsBz2eYb/VXVdgtUF5Hk2GaCaaS81qu7KjsGRsAVUgcMMxB99Ah8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778543322; c=relaxed/simple; bh=QA6fS0A7FncAGUjWqzbbFZ2c7wa5OyNL5Zly2gy+9gs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=helKB37CCCvHxB4gCX8MvwDgUfQWvN+pQpVne1/XwPshTnXxR/keN026P0fbrFD/2Hq895CtX9TOpxcvVl9cjXApbvaGZ1tLxdwvYLNvZ9D4SDQeOmUWagFkcGg6aMexMhrecPGu2XrhObpbH9RjPthfZ42C4tAk0i4XVSgSuzo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Jnp2hfQc; arc=none smtp.client-ip=209.85.215.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Jnp2hfQc" Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-c8016d642b2so2727950a12.0 for ; Mon, 11 May 2026 16:48:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778543318; x=1779148118; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=TG+H+8qFC3dm8ucOx8pPoSNzGyrnN/mGIjQnEFRQdw8=; b=Jnp2hfQck2e6OjkuO22tJJYcABTKLqxY1tw8j1QB+nmdAVkWcBWEIEgWMljSeXAV9f wSXjVlFXGpgvBGw9PXELvoVei8AoP3QGvKP4wHmb/6AdZZnHm7ZSIlzIo3IL8zqJLRbO ohnvcMNJKOm9FwJxrz+i4y/jeN/Olo/sh627oSmtaeydqGn2XJqvDp1Yfh6+sYHF/0hU Xq7MXCvCvu9CahK8YqPjTsJQRJybHBzdxB1q3dfLTMmltv//aPAEe3SLialZq45c8rBg MWL5zmOO4I+6fgIXeqF/TN1Q425ajYzhX3oFq0tYTp+RC2nXSj6LZdrcEmQQAyqwa8Km +USw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778543318; x=1779148118; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=TG+H+8qFC3dm8ucOx8pPoSNzGyrnN/mGIjQnEFRQdw8=; b=M7YHklOmoEVV9Ebg1e13P35FX+sCxU9LZPNslWkhYUfHqvxmlyY1xI9oVfmdlHJ+6U VYo5mCYm0uFdU/h0y6N4k3LUFTtxNDgPLNvFltgb/AGkTGUyUNMKdWqqPh+5LbiAG4iR hsIwe0SMb+zSUTz94Ea6yLaQclexoSk5SItGnf8Ea8IxLPYQ/EjCdpOA2k6eipDORMwh n4ynmPi4h76X0k2WHp67F4iBK2AU70OdhKEupMy4ieAWAg/xU6+Mfg63uRNu0j8OtS/V cF9in8MFSStBQPDtsnfPQoNGnsCrwRTuRQLozKXM0d66eeh/oMeGpoRFr1Soq2KYhSy/ TFuA== X-Forwarded-Encrypted: i=1; AFNElJ/Oq7aArHkPDxKcZTduKpgV1UcJGRkeA52EmFBt76XbZhp6wfktpF/BztLI7hVL4ToOPkkplpwWGYhfyi8=@vger.kernel.org X-Gm-Message-State: AOJu0YxMfUmxlSzlqN0E0L35x1K+1voRZjSMCW01KKCYjxEKjZN04J1C vJN1+2e+X/cFAtHCCGX191x9bJRnAyi/KWfgJh9xaRX5MVJun/uY4ZG2 X-Gm-Gg: Acq92OFDiUD1mE+my+l7yKP5iluzXM4HAMi6UXpE+yzLutzkXCPNhM/n4JmajbM73Pg i9jkV3aXuCelX/PtjQXG4qahSjeZZZBqrcqkbTBAdjKUJkUR/OUijABW38P30+xcQAtZMGAY6Ev FrWH0e2YPQD+oXiq9qI0AaQJocY2IxTqODp2e/VJoMOWbSapVPuWa0/+A9HxLe0LRhyl8ux6fjl XXG16asGegKLTSNhPAQGrklFGeY/twz7xv0NxaStbUiHR1WbNMB71Me9CH0lx1FQWKW8VrO1eeX eIZJvCmpHY4BZ1jrz/xdInJz5CrOVNAPiyR1hkPCYj5mZsfwXYMVEEUHOhHiGMUBvgeWMP/fjJl 3AMLfCvjv7W42gOJD4g5FfgcU0urRTitMZbV24iB8y0eOwa5MyO6a8/49ijNLDO39voJUGVLprS Ny+gvTfW9AsQuTo6qwtTH9kKVLOPztZCnpXxp5XvI= X-Received: by 2002:a05:6a20:c88d:b0:3a3:adea:83b4 with SMTP id adf61e73a8af0-3acd446d7a1mr1454179637.21.1778543318226; Mon, 11 May 2026 16:48:38 -0700 (PDT) Received: from zenbook ([159.196.5.243]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c8267697d5asm9849101a12.14.2026.05.11.16.48.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 11 May 2026 16:48:37 -0700 (PDT) From: Wilfred Mallawa To: Keith Busch , Jens Axboe , Christoph Hellwig , Sagi Grimberg Cc: linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org, alistair.francis@wdc.com, Wilfred Mallawa Subject: [PATCH v2] nvme/tcp: handle rejected keys for secure concatenation Date: Tue, 12 May 2026 09:45:53 +1000 Message-ID: <20260511234551.2925326-3-wilfred.opensource@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Wilfred Mallawa The NVMe-TCP specification [1] states that if the PSK retained or generated is not available on the subsystem, the TLS 1.3 handshake shall be aborted with an unknown_psk_identity alert and the connection be closed. Currently, when an unknown_psk_identity alert is sent from an endpoint, tlshd returns EACCES as the TLS error. On subsequent reconnection attempts, we fail with the same error because we keep attempting to connect with a stale key. This may occur if the endpoint experienced a full reset and lost its PSK. With support in tlshd to return -EKEYREJECTED when an unknown_psk_identity alert is received [2], the kernel can now detect this condition and revoke the current tls_key. This allows the subsequent reconnect to perform re-authentication via DHCHAP to generate a fresh PSK. [1] https://nvmexpress.org/wp-content/uploads/NVM-Express-TCP-Transport-Specification-Revision-1.1-2024.08.05-Ratified.pdf [2] https://github.com/oracle/ktls-utils/pull/149 Signed-off-by: Wilfred Mallawa --- V1 -> V2: - Typo in commit message - Re-worded the comment in code - Added reference to ktls-utils PR (merged) for userspace changes --- drivers/nvme/host/tcp.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index 15d36d6a728e..8e5421d2e8b9 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -1767,6 +1767,17 @@ static int nvme_tcp_start_tls(struct nvme_ctrl *nctrl, dev_err(nctrl->device, "queue %d: TLS handshake complete, error %d\n", qid, queue->tls_err); + + /* + * If the key is stale, revoke it such that on a + * subsequent reconnect, we will generate a new PSK. + */ + if (queue->tls_err == EKEYREJECTED && qid == 0 && + nctrl->opts->concat && nctrl->opts->tls_key) { + nvme_auth_revoke_tls_key(nctrl); + dev_warn(nctrl->device, + "qid 0: revoking stale key\n"); + } } else { dev_dbg(nctrl->device, "queue %d: TLS handshake complete\n", qid); -- 2.54.0