RFC series for Chelsio Inline TLS driver (chtls.ko)
Driver use the ULP infrastructure to register chtls as Inline TLS ULP.
Chtls use TCP Sockets to transmit and receive TLS record. TCP proto_ops
is extended to offload TLS record.
T6 adapter provides the following features:
-TLS record offload, TLS header, encrypt, digest and transmit
-TLS record receive and decrypt
-TLS keys store
-TCP/IP engine
-TLS engine
-GCM crypto engine [support CBC also]
TLS provides security at the transport layer. It uses TCP to provide
reliable end-to-end transport of application data. It relies on TCP
for any retransmission. TLS session comprises of three parts:
a. TCP/IP connection
b. TLS handshake
c. Record layer processing
TLS handshake state machine is executed in host (refer standard
implementation eg. OpenSSL). Setsockopt [SOL_TCP, TCP_ULP] initialize
TCP proto-ops for Chelsio inline tls support. setsockopt(sock, SOL_TCP,
TCP_ULP, "chtls", sizeof("chtls"));
Tx and Rx Keys are decided during handshake and programmed onto the chip
after CCS is exchanged.
struct tls12_crypto_info_aes_gcm_128 crypto_info
setsockopt(sock, SOL_TLS, TLS_TX, &crypto_info, sizeof(crypto_info))
Finish is the first encrypted/decrypted message tx/rx inline.
On the Tx path TLS engine receive plain text from openssl, insert IV,
fetches the tx key, create cipher text records and generate MAC. TLS
header is added to cipher text and forward to TCP/IP engine for transport
layer processing and transmission on wire.
TX:
Application--openssl--chtls---TLS engine---encrypt/auth---TCP/IP
engine---wire.
On the Rx side, data received is PDU aligned at record
boundaries. TLS processes only the complete record. If rx key is programmed
on CCS receive, data is decrypted and plain text is posted to host.
RX:
Wire--cipher-text--TCP/IP engine [PDU align]---TLS engine---
decrypt/auth---plain-text--chtls--openssl--application
v3: fixed the kbuild test issues
-made few funtions static
-initialized few variables
v2: fixed the following based on the review comments of Stephan Mueller,
Stefano Brivio and Hannes Frederic
-Added more details in cover letter
-Fixed indentation and formating issues
-Using aes instead of aes-generic
-memset key info after programing the key on chip
-reordered the patch sequence
Atul Gupta (9):
chtls: structure and macro definiton
cxgb4: Inline TLS FW Interface
cxgb4: LLD driver changes to enable TLS
chcr: Key Macro
chtls: Key program
chtls: CPL handler definition
chtls: Inline crypto request Tx/Rx
chtls: Register the ULP
Makefile Kconfig
drivers/crypto/chelsio/Kconfig | 10 +
drivers/crypto/chelsio/Makefile | 1 +
drivers/crypto/chelsio/chcr_algo.h | 42 +
drivers/crypto/chelsio/chcr_core.h | 55 +-
drivers/crypto/chelsio/chtls/Makefile | 4 +
drivers/crypto/chelsio/chtls/chtls.h | 480 +++++
drivers/crypto/chelsio/chtls/chtls_cm.c | 2045 ++++++++++++++++++++
drivers/crypto/chelsio/chtls/chtls_cm.h | 203 ++
drivers/crypto/chelsio/chtls/chtls_hw.c | 394 ++++
drivers/crypto/chelsio/chtls/chtls_io.c | 1867 ++++++++++++++++++
drivers/crypto/chelsio/chtls/chtls_main.c | 584 ++++++
drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 18 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 32 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h | 7 +
drivers/net/ethernet/chelsio/cxgb4/sge.c | 98 +-
drivers/net/ethernet/chelsio/cxgb4/t4_msg.h | 121 +-
drivers/net/ethernet/chelsio/cxgb4/t4_regs.h | 2 +
drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h | 165 +-
include/uapi/linux/tls.h | 1 +
net/ipv4/tcp_minisocks.c | 1 +
20 files changed, 6111 insertions(+), 19 deletions(-)
create mode 100644 drivers/crypto/chelsio/chtls/Makefile
create mode 100644 drivers/crypto/chelsio/chtls/chtls.h
create mode 100644 drivers/crypto/chelsio/chtls/chtls_cm.c
create mode 100644 drivers/crypto/chelsio/chtls/chtls_cm.h
create mode 100644 drivers/crypto/chelsio/chtls/chtls_hw.c
create mode 100644 drivers/crypto/chelsio/chtls/chtls_io.c
create mode 100644 drivers/crypto/chelsio/chtls/chtls_main.c
--
1.8.3.1
Addressed the review comments in v2 and v3, please suggest if there is
any other comment and step to proceed?
Thanks
Atul Gupta
On Wednesday 20 December 2017 05:03 PM, Atul Gupta wrote:
> RFC series for Chelsio Inline TLS driver (chtls.ko)
>
> Driver use the ULP infrastructure to register chtls as Inline TLS ULP.
> Chtls use TCP Sockets to transmit and receive TLS record. TCP proto_ops
> is extended to offload TLS record.
>
> T6 adapter provides the following features:
> -TLS record offload, TLS header, encrypt, digest and transmit
> -TLS record receive and decrypt
> -TLS keys store
> -TCP/IP engine
> -TLS engine
> -GCM crypto engine [support CBC also]
>
> TLS provides security at the transport layer. It uses TCP to provide
> reliable end-to-end transport of application data. It relies on TCP
> for any retransmission. TLS session comprises of three parts:
> a. TCP/IP connection
> b. TLS handshake
> c. Record layer processing
>
> TLS handshake state machine is executed in host (refer standard
> implementation eg. OpenSSL). Setsockopt [SOL_TCP, TCP_ULP] initialize
> TCP proto-ops for Chelsio inline tls support. setsockopt(sock, SOL_TCP,
> TCP_ULP, "chtls", sizeof("chtls"));
>
> Tx and Rx Keys are decided during handshake and programmed onto the chip
> after CCS is exchanged.
> struct tls12_crypto_info_aes_gcm_128 crypto_info
> setsockopt(sock, SOL_TLS, TLS_TX, &crypto_info, sizeof(crypto_info))
> Finish is the first encrypted/decrypted message tx/rx inline.
>
> On the Tx path TLS engine receive plain text from openssl, insert IV,
> fetches the tx key, create cipher text records and generate MAC. TLS
> header is added to cipher text and forward to TCP/IP engine for transport
> layer processing and transmission on wire.
> TX:
> Application--openssl--chtls---TLS engine---encrypt/auth---TCP/IP
> engine---wire.
>
> On the Rx side, data received is PDU aligned at record
> boundaries. TLS processes only the complete record. If rx key is programmed
> on CCS receive, data is decrypted and plain text is posted to host.
> RX:
> Wire--cipher-text--TCP/IP engine [PDU align]---TLS engine---
> decrypt/auth---plain-text--chtls--openssl--application
>
> v3: fixed the kbuild test issues
> -made few funtions static
> -initialized few variables
>
> v2: fixed the following based on the review comments of Stephan Mueller,
> Stefano Brivio and Hannes Frederic
> -Added more details in cover letter
> -Fixed indentation and formating issues
> -Using aes instead of aes-generic
> -memset key info after programing the key on chip
> -reordered the patch sequence
>
> Atul Gupta (9):
> chtls: structure and macro definiton
> cxgb4: Inline TLS FW Interface
> cxgb4: LLD driver changes to enable TLS
> chcr: Key Macro
> chtls: Key program
> chtls: CPL handler definition
> chtls: Inline crypto request Tx/Rx
> chtls: Register the ULP
> Makefile Kconfig
>
> drivers/crypto/chelsio/Kconfig | 10 +
> drivers/crypto/chelsio/Makefile | 1 +
> drivers/crypto/chelsio/chcr_algo.h | 42 +
> drivers/crypto/chelsio/chcr_core.h | 55 +-
> drivers/crypto/chelsio/chtls/Makefile | 4 +
> drivers/crypto/chelsio/chtls/chtls.h | 480 +++++
> drivers/crypto/chelsio/chtls/chtls_cm.c | 2045 ++++++++++++++++++++
> drivers/crypto/chelsio/chtls/chtls_cm.h | 203 ++
> drivers/crypto/chelsio/chtls/chtls_hw.c | 394 ++++
> drivers/crypto/chelsio/chtls/chtls_io.c | 1867 ++++++++++++++++++
> drivers/crypto/chelsio/chtls/chtls_main.c | 584 ++++++
> drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 18 +-
> drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 32 +-
> drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h | 7 +
> drivers/net/ethernet/chelsio/cxgb4/sge.c | 98 +-
> drivers/net/ethernet/chelsio/cxgb4/t4_msg.h | 121 +-
> drivers/net/ethernet/chelsio/cxgb4/t4_regs.h | 2 +
> drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h | 165 +-
> include/uapi/linux/tls.h | 1 +
> net/ipv4/tcp_minisocks.c | 1 +
> 20 files changed, 6111 insertions(+), 19 deletions(-)
> create mode 100644 drivers/crypto/chelsio/chtls/Makefile
> create mode 100644 drivers/crypto/chelsio/chtls/chtls.h
> create mode 100644 drivers/crypto/chelsio/chtls/chtls_cm.c
> create mode 100644 drivers/crypto/chelsio/chtls/chtls_cm.h
> create mode 100644 drivers/crypto/chelsio/chtls/chtls_hw.c
> create mode 100644 drivers/crypto/chelsio/chtls/chtls_io.c
> create mode 100644 drivers/crypto/chelsio/chtls/chtls_main.c
>
Would truly appreciate your feedback and make progress.
Thanks and Regards
Atul
-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Atul Gupta
Sent: Wednesday, January 3, 2018 12:36 PM
To: [email protected]; [email protected]; Ganesh GR <[email protected]>
Cc: [email protected]; [email protected]; [email protected]; [email protected]; Stefano Brivio <[email protected]>; [email protected]
Subject: Re: [RFC crypto v3 0/9] Chelsio Inline TLS
Addressed the review comments in v2 and v3, please suggest if there is any other comment and step to proceed?
Thanks
Atul Gupta
On Wednesday 20 December 2017 05:03 PM, Atul Gupta wrote:
> RFC series for Chelsio Inline TLS driver (chtls.ko)
>
> Driver use the ULP infrastructure to register chtls as Inline TLS ULP.
> Chtls use TCP Sockets to transmit and receive TLS record. TCP
> proto_ops is extended to offload TLS record.
>
> T6 adapter provides the following features:
> -TLS record offload, TLS header, encrypt, digest and transmit
> -TLS record receive and decrypt
> -TLS keys store
> -TCP/IP engine
> -TLS engine
> -GCM crypto engine [support CBC also]
>
> TLS provides security at the transport layer. It uses TCP to provide
> reliable end-to-end transport of application data. It relies on TCP
> for any retransmission. TLS session comprises of three parts:
> a. TCP/IP connection
> b. TLS handshake
> c. Record layer processing
>
> TLS handshake state machine is executed in host (refer standard
> implementation eg. OpenSSL). Setsockopt [SOL_TCP, TCP_ULP] initialize
> TCP proto-ops for Chelsio inline tls support. setsockopt(sock,
> SOL_TCP, TCP_ULP, "chtls", sizeof("chtls"));
>
> Tx and Rx Keys are decided during handshake and programmed onto the
> chip after CCS is exchanged.
> struct tls12_crypto_info_aes_gcm_128 crypto_info setsockopt(sock,
> SOL_TLS, TLS_TX, &crypto_info, sizeof(crypto_info)) Finish is the
> first encrypted/decrypted message tx/rx inline.
>
> On the Tx path TLS engine receive plain text from openssl, insert IV,
> fetches the tx key, create cipher text records and generate MAC. TLS
> header is added to cipher text and forward to TCP/IP engine for
> transport layer processing and transmission on wire.
> TX:
> Application--openssl--chtls---TLS engine---encrypt/auth---TCP/IP
> engine---wire.
>
> On the Rx side, data received is PDU aligned at record boundaries. TLS
> processes only the complete record. If rx key is programmed on CCS
> receive, data is decrypted and plain text is posted to host.
> RX:
> Wire--cipher-text--TCP/IP engine [PDU align]---TLS engine---
> decrypt/auth---plain-text--chtls--openssl--application
>
> v3: fixed the kbuild test issues
> -made few funtions static
> -initialized few variables
>
> v2: fixed the following based on the review comments of Stephan Mueller,
> Stefano Brivio and Hannes Frederic
> -Added more details in cover letter
> -Fixed indentation and formating issues
> -Using aes instead of aes-generic
> -memset key info after programing the key on chip
> -reordered the patch sequence
>
> Atul Gupta (9):
> chtls: structure and macro definiton
> cxgb4: Inline TLS FW Interface
> cxgb4: LLD driver changes to enable TLS
> chcr: Key Macro
> chtls: Key program
> chtls: CPL handler definition
> chtls: Inline crypto request Tx/Rx
> chtls: Register the ULP
> Makefile Kconfig
>
> drivers/crypto/chelsio/Kconfig | 10 +
> drivers/crypto/chelsio/Makefile | 1 +
> drivers/crypto/chelsio/chcr_algo.h | 42 +
> drivers/crypto/chelsio/chcr_core.h | 55 +-
> drivers/crypto/chelsio/chtls/Makefile | 4 +
> drivers/crypto/chelsio/chtls/chtls.h | 480 +++++
> drivers/crypto/chelsio/chtls/chtls_cm.c | 2045 ++++++++++++++++++++
> drivers/crypto/chelsio/chtls/chtls_cm.h | 203 ++
> drivers/crypto/chelsio/chtls/chtls_hw.c | 394 ++++
> drivers/crypto/chelsio/chtls/chtls_io.c | 1867 ++++++++++++++++++
> drivers/crypto/chelsio/chtls/chtls_main.c | 584 ++++++
> drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 18 +-
> drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 32 +-
> drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h | 7 +
> drivers/net/ethernet/chelsio/cxgb4/sge.c | 98 +-
> drivers/net/ethernet/chelsio/cxgb4/t4_msg.h | 121 +-
> drivers/net/ethernet/chelsio/cxgb4/t4_regs.h | 2 +
> drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h | 165 +-
> include/uapi/linux/tls.h | 1 +
> net/ipv4/tcp_minisocks.c | 1 +
> 20 files changed, 6111 insertions(+), 19 deletions(-)
> create mode 100644 drivers/crypto/chelsio/chtls/Makefile
> create mode 100644 drivers/crypto/chelsio/chtls/chtls.h
> create mode 100644 drivers/crypto/chelsio/chtls/chtls_cm.c
> create mode 100644 drivers/crypto/chelsio/chtls/chtls_cm.h
> create mode 100644 drivers/crypto/chelsio/chtls/chtls_hw.c
> create mode 100644 drivers/crypto/chelsio/chtls/chtls_io.c
> create mode 100644 drivers/crypto/chelsio/chtls/chtls_main.c
>
2017-12-20, 17:03:02 +0530, Atul Gupta wrote:
> RFC series for Chelsio Inline TLS driver (chtls.ko)
>
> Driver use the ULP infrastructure to register chtls as Inline TLS ULP.
I don't think drivers should be registering their own ULP. TLS
offloading should be transparent to userspace, whatever HW ends up
being used. If each driver implements its own ULP, the application has
to be aware of what HW and what driver it's running on.
I think this offload should rely on a generic infrastructure, not
build its own private interface. Look at the current kTLS code, the
proposal for an offload infrastructure [0] from Mellanox, and see how
you can fit your driver into that, and extend what's missing.
[0] https://patchwork.ozlabs.org/patch/849984/
[...]
> Atul Gupta (9):
> chtls: structure and macro definiton
> cxgb4: Inline TLS FW Interface
> cxgb4: LLD driver changes to enable TLS
> chcr: Key Macro
> chtls: Key program
> chtls: CPL handler definition
> chtls: Inline crypto request Tx/Rx
> chtls: Register the ULP
> Makefile Kconfig
That patchset is split so that each patch touches a separate set of
files, and the description of the contents of each patch is very
limited. Can you try to group your changes by feature instead? That
should help you come up with descriptive commit messages as well.
Thanks,
--
Sabrina
On Monday 22 January 2018 03:46 AM, Sabrina Dubroca wrote:
> 2017-12-20, 17:03:02 +0530, Atul Gupta wrote:
>> RFC series for Chelsio Inline TLS driver (chtls.ko)
>>
>> Driver use the ULP infrastructure to register chtls as Inline TLS ULP.
> I don't think drivers should be registering their own ULP. TLS
> offloading should be transparent to userspace, whatever HW ends up
> being used. If each driver implements its own ULP, the application has
> to be aware of what HW and what driver it's running on.
using different ULP is derived from
https://patchwork.kernel.org/patch/9746381/
> I think this offload should rely on a generic infrastructure, not
> build its own private interface. Look at the current kTLS code, the
> proposal for an offload infrastructure [0] from Mellanox, and see how
> you can fit your driver into that, and extend what's missing.
>
> [0] https://patchwork.ozlabs.org/patch/849984/
The driver indeed used the proposed offload infrastructure and extended
for Inline Rx/Tx
>
>
> [...]
>> Atul Gupta (9):
>> chtls: structure and macro definiton
>> cxgb4: Inline TLS FW Interface
>> cxgb4: LLD driver changes to enable TLS
>> chcr: Key Macro
>> chtls: Key program
>> chtls: CPL handler definition
>> chtls: Inline crypto request Tx/Rx
>> chtls: Register the ULP
>> Makefile Kconfig
> That patchset is split so that each patch touches a separate set of
> files, and the description of the contents of each patch is very
> limited. Can you try to group your changes by feature instead? That
> should help you come up with descriptive commit messages as well.
Made all attempts to group the contents based on functionality, the set
is broken into
driver registration, I/O with crypto Inline request, key handling and
messages exchanged with
hardware.
>
> Thanks,
>