Re: [PATCH v9 2/6] net/mlx5e: add TLS 1.3 hardware offload support

[Tariq Toukan <tariqt@nvidia.com>]

On 21/03/2026 1:57, Rishikesh Jethwani wrote:
> Enable TLS 1.3 TX/RX hardware offload on ConnectX-6 Dx and newer
> crypto-enabled adapters.
> Key changes:
> - Add TLS 1.3 capability checking and version validation
> - Use MLX5E_STATIC_PARAMS_CONTEXT_TLS_1_3 (0x3) for crypto context
> - Handle TLS 1.3 IV format: full 12-byte IV copied to gcm_iv +
>    implicit_iv (vs TLS 1.2's 4-byte salt only)
> 
> Tested with TLS 1.3 AES-GCM-128 and AES-GCM-256 cipher suites.
> 
> Signed-off-by: Rishikesh Jethwani <rjethwani@purestorage.com>
> ---
>   .../ethernet/mellanox/mlx5/core/en_accel/ktls.h    |  8 +++++++-
>   .../mellanox/mlx5/core/en_accel/ktls_txrx.c        | 14 +++++++++++---
>   2 files changed, 18 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h
> index 07a04a142a2e..0469ca6a0762 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h
> @@ -30,7 +30,9 @@ static inline bool mlx5e_is_ktls_device(struct mlx5_core_dev *mdev)
>   		return false;
>   
>   	return (MLX5_CAP_TLS(mdev, tls_1_2_aes_gcm_128) ||
> -		MLX5_CAP_TLS(mdev, tls_1_2_aes_gcm_256));
> +		MLX5_CAP_TLS(mdev, tls_1_2_aes_gcm_256) ||
> +		MLX5_CAP_TLS(mdev, tls_1_3_aes_gcm_128) ||
> +		MLX5_CAP_TLS(mdev, tls_1_3_aes_gcm_256));
>   }
>   
>   static inline bool mlx5e_ktls_type_check(struct mlx5_core_dev *mdev,
> @@ -40,10 +42,14 @@ static inline bool mlx5e_ktls_type_check(struct mlx5_core_dev *mdev,
>   	case TLS_CIPHER_AES_GCM_128:
>   		if (crypto_info->version == TLS_1_2_VERSION)
>   			return MLX5_CAP_TLS(mdev,  tls_1_2_aes_gcm_128);
> +		else if (crypto_info->version == TLS_1_3_VERSION)
> +			return MLX5_CAP_TLS(mdev,  tls_1_3_aes_gcm_128);
>   		break;
>   	case TLS_CIPHER_AES_GCM_256:
>   		if (crypto_info->version == TLS_1_2_VERSION)
>   			return MLX5_CAP_TLS(mdev,  tls_1_2_aes_gcm_256);
> +		else if (crypto_info->version == TLS_1_3_VERSION)
> +			return MLX5_CAP_TLS(mdev,  tls_1_3_aes_gcm_256);
>   		break;
>   	}
>   
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_txrx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_txrx.c
> index 570a912dd6fa..f3f90ad6c6cf 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_txrx.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_txrx.c
> @@ -6,6 +6,7 @@
>   
>   enum {
>   	MLX5E_STATIC_PARAMS_CONTEXT_TLS_1_2 = 0x2,
> +	MLX5E_STATIC_PARAMS_CONTEXT_TLS_1_3 = 0x3,
>   };
>   
>   enum {
> @@ -15,8 +16,10 @@ enum {
>   #define EXTRACT_INFO_FIELDS do { \
>   	salt    = info->salt;    \
>   	rec_seq = info->rec_seq; \
> +	iv      = info->iv;      \
>   	salt_sz    = sizeof(info->salt);    \
>   	rec_seq_sz = sizeof(info->rec_seq); \
> +	iv_sz      = sizeof(info->iv);      \
>   } while (0)
>   
>   static void
> @@ -25,8 +28,8 @@ fill_static_params(struct mlx5_wqe_tls_static_params_seg *params,
>   		   u32 key_id, u32 resync_tcp_sn)
>   {
>   	char *initial_rn, *gcm_iv;
> -	u16 salt_sz, rec_seq_sz;
> -	char *salt, *rec_seq;
> +	u16 salt_sz, rec_seq_sz, iv_sz;

[1]

> +	char *salt, *rec_seq, *iv;
>   	u8 tls_version;
>   	u8 *ctx;
>   
> @@ -59,7 +62,12 @@ fill_static_params(struct mlx5_wqe_tls_static_params_seg *params,
>   	memcpy(gcm_iv,      salt,    salt_sz);
>   	memcpy(initial_rn,  rec_seq, rec_seq_sz);
>   
> -	tls_version = MLX5E_STATIC_PARAMS_CONTEXT_TLS_1_2;
> +	if (crypto_info->crypto_info.version == TLS_1_3_VERSION) {
> +		memcpy(gcm_iv + salt_sz, iv, iv_sz);
> +		tls_version = MLX5E_STATIC_PARAMS_CONTEXT_TLS_1_3;
> +	} else {
> +		tls_version = MLX5E_STATIC_PARAMS_CONTEXT_TLS_1_2;
> +	}
>   
>   	MLX5_SET(tls_static_params, ctx, tls_version, tls_version);
>   	MLX5_SET(tls_static_params, ctx, const_1, 1);

Thanks for your patch.

Patch LGTM.
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>

In case you have V10 for some other reason, please maintain the reversed 
Christmas tree in [1].