Message-ID: <494b8566-ac09-e3ef-9743-60cdd7f0f63c@oracle.com>
Date:   Mon, 15 Nov 2021 09:25:18 -0600
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.2.0
Subject: Re: [PATCH 05/12] nvme: add definitions for NVMe In-Band
 authentication
Content-Language: en-US
To:     Hannes Reinecke <hare@suse.de>, Sagi Grimberg <sagi@grimberg.me>
Cc:     Christoph Hellwig <hch@lst.de>, Keith Busch <keith.busch@wdc.com>,
        linux-nvme@lists.infradead.org,
        Herbert Xu <herbert@gondor.apana.org.au>,
        David Miller <davem@davemloft.net>,
        linux-crypto@vger.kernel.org
References: <20211112125928.97318-1-hare@suse.de>
 <20211112125928.97318-6-hare@suse.de>
From:   Himanshu Madhani <himanshu.madhani@oracle.com>
Organization: Oracle
In-Reply-To: <20211112125928.97318-6-hare@suse.de>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?ajRVK0FPRGsrOGRYZlh1WmFmZlJha3RpeEFZdFRpci9NK3c3OTU3L3Y2OWZl?=
 =?utf-8?B?Ulluam9aQVFkc1FJajFndWVFU1J3RlR5SmNjTkU3cDFqUjJKSGU2cFpaNHhT?=
 =?utf-8?B?Y0VxRGR0dlRqakJENEFMdW5CK01RNFcwWkxuL2NaRXJmY0Q4U1d2dkh4ZURW?=
 =?utf-8?B?NVM2NWVhYnE5b0ZkVDh3RlpUS0hwY2JEQnBOUnI5eWF4L2dwYi9PdXBwYXdX?=
 =?utf-8?B?Umd0akxiRXlURUhwNjRaSmNCZm1COFZscXROZzAxZTVrSUhXVWNmMlRNVFR2?=
 =?utf-8?B?NjIvZWUrQkhRVm5SL3RGK0x1dFVNSlJXSTliZGtNUDFqZE1TR1pGTUFPZEhF?=
 =?utf-8?B?ZFZpNVFMb1FEU1I0d2UvYWhCa3JiSE1UN2VGV3QrcjdzUmtCT281am1UbmE5?=
 =?utf-8?B?cDNNdzZPU1FFRGpVTTIvdGh5cE5QOU95Mmg5dDNDV1pzc2hnRkp5c0NDeXNq?=
 =?utf-8?B?Uk84T054b2RiZmk5aDB2aEJ0Rlp4Sk5ISXNQRWVVY0hURDJWSUZ5K2dQQU96?=
 =?utf-8?B?UmdLcXphYUg4disrQlZuS2xMTURhS21YVXhEN3hvcXhCMWY0cCsvOExLanVx?=
 =?utf-8?B?ei9IYmhTUWdaSGVyTDAzeEloRE5BMFROWk9KNEY1V2RkVzNHeFp3VGtySTBY?=
 =?utf-8?B?VnVHUTNOOXhrL3RSNEhoTHh2RmNsd3NaYjRUdHpaVW1iVlZsbVV3Uzd1aEg3?=
 =?utf-8?B?RXRHcGtCVEdoazJQWk9vSVdjb2JYSnRwcythYUViRHZ0SzBYNHR3clZNci8w?=
 =?utf-8?B?akRWV0VNUlZucEFqNHNqUUhtVlRoeU14eTJibjhpN0ZhaElhVHJ0R1dqMjhy?=
 =?utf-8?B?RjcxcXhjT1d6Q0REajg5dFE0L2Z4NW9OQVVzajA3ajdlMTdpYnMrdVQ2RGJI?=
 =?utf-8?B?ajZkTGxodi9jZE1qcVNOU09SdUJLdnRWZHVWTDFPd0pUeVNwZ2JrQmlaSGky?=
 =?utf-8?B?di9JTWZSR1VNR2pXdHNQQm41bEVHcWRqR0VleGYxOEJVLzZ2Mm5WL3dvaGJk?=
 =?utf-8?B?ZC9VOXBocktnamVWUlBFc0hPbEZ6T0FSTmlyYUdLdWZDbHRqdS9qNjBDQkNP?=
 =?utf-8?B?SFRKK1NRU1lnRkN6cjRCTi9jamhvajZ1QjBsV05TbURkU2t3NlpxOXdkQ0hO?=
 =?utf-8?B?UXRjV01GcjZuSDc1dWpEanZRMzd4RytBSS9TUVVOaEFEN2dpVmJPMzROZm85?=
 =?utf-8?B?QnZzYkZ0Ym8yOXBoamVTTjlPckNlR2t2UDI2ZzZtNzRKbW9STElxWnM4V1BM?=
 =?utf-8?B?QmZZV3k5ekU4U3c2UHl3SXh5c0JWdE1qdnFnc0VTaWI3Z1dWUGFpRW13czQ0?=
 =?utf-8?B?TUhXakd2Yit4cnVhWkhHUjJNS2hXTThKQjg4bmIweFNOSHVhT1VmWHI2RlNz?=
 =?utf-8?B?bjJNd1gveDBvWE9uNSsxRXRhaTROalMwQ1VZdGxaWThZRUFoQTNzR2V6SlBT?=
 =?utf-8?B?UExqSXFLN29wNW5GQzJ0MlZWeXhzNStHNkJQOXowZXNMV2hQQmpJL0M0RWt4?=
 =?utf-8?B?dHFxWTJNZjVsU24zS0RleXZEUDZlazJ6eFYwMFJJbnFsdHFBUncxV2hlWndO?=
 =?utf-8?B?aXN1SEU3Q3lXQkRoaFk3VGJGRWVwU3I2WjlPYjJ5dWtIN3VKU0JobHdZbU0x?=
 =?utf-8?B?MVZhUXV5blN2VDQvMGNWRFZmbjlpbURVRlc5dGxYSFJ6Qm1Ld1l2TWF0MW5T?=
 =?utf-8?B?VVZPdEJwS3cyMDJHaGVueWhlRk9rbDdET0Jlc3RET2xnbmM3YXhIbDBianhM?=
 =?utf-8?B?akxzMGR6Snc0c0JFc09pMU1TaXFTTklVMmZtRnplQjlpdTJkRlpkNmRxaXFm?=
 =?utf-8?B?SWpmcGxPVXh4dFBTYUxqdDI4aVpiSDVhMTFiN0pCaHlSbENpN2wzSUlGTG9w?=
 =?utf-8?B?RDJSSU81RmgyNjBSbDM4V25qT3RIWGFzcGJHWFJXUDE1UnYyOEt3aHFrcVRY?=
 =?utf-8?B?QTAzek1GMGt6ckd1aFZuR1RTV3EwUTl6MFhJM0dEWklNUUcrUDlUMzJKcXA1?=
 =?utf-8?B?Wm5yOStzS1BjUzhHbFY3Z2ZIY1BIYVZFdnRNTnpVd2l2NXFoOHNwbTFQVk1P?=
 =?utf-8?B?VWNuQXFnbjJQbUFveVNVU1MxSHVIeVVabFNJekRBLzVhOXlIZ0xjcU0rTk10?=
 =?utf-8?B?MXFKT25FNVVGL3dISTEvaFhmTkJiVGlqc2Q4d0RKVnN0Wk5OcWtBUVkrT294?=
 =?utf-8?B?b3NHT3JvNEE4ZjNtUTFmRTZkV05UMU9MS1c5SW5TUzh5VENkdWVHY1dLOUVK?=
 =?utf-8?B?QmJDdFg1RjUxU0F1ejVNcy9qRVd3PT0=?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: a3557fda-2637-44ba-3505-08d9a84c225b
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB2943.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Nov 2021 15:25:19.8268
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 7mtbAEVmz9fdPS4G9vnRbwjPzyqSzQLN8jNytgw3fUuKXKMRu/Ned8lY+hnjGzDrqfpRy5uB5WXX65FrOawIdDZxXICInO+u0IekyJevBXQ=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR10MB2510
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10168 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 bulkscore=0
 adultscore=0 mlxlogscore=999 malwarescore=0 mlxscore=0 suspectscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2111150082
X-Proofpoint-ORIG-GUID: pmCMJOtvtsSH1DxYRQerb1H90iR1WpUk
X-Proofpoint-GUID: pmCMJOtvtsSH1DxYRQerb1H90iR1WpUk
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org


On 11/12/21 06:59, Hannes Reinecke wrote:
> Add new definitions for NVMe In-band authentication as defined in
> the NVMe Base Specification v2.0.
> 
> Signed-off-by: Hannes Reinecke <hare@suse.de>
> Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
> ---
>   include/linux/nvme.h | 186 ++++++++++++++++++++++++++++++++++++++++++-
>   1 file changed, 185 insertions(+), 1 deletion(-)
> 
> diff --git a/include/linux/nvme.h b/include/linux/nvme.h
> index 855dd9b3e84b..3e3858d3976f 100644
> --- a/include/linux/nvme.h
> +++ b/include/linux/nvme.h
> @@ -19,6 +19,7 @@
>   #define NVMF_TRSVCID_SIZE	32
>   #define NVMF_TRADDR_SIZE	256
>   #define NVMF_TSAS_SIZE		256
> +#define NVMF_AUTH_HASH_LEN	64
>   
>   #define NVME_DISC_SUBSYS_NAME	"nqn.2014-08.org.nvmexpress.discovery"
>   
> @@ -1278,6 +1279,8 @@ enum nvmf_capsule_command {
>   	nvme_fabrics_type_property_set	= 0x00,
>   	nvme_fabrics_type_connect	= 0x01,
>   	nvme_fabrics_type_property_get	= 0x04,
> +	nvme_fabrics_type_auth_send	= 0x05,
> +	nvme_fabrics_type_auth_receive	= 0x06,
>   };
>   
>   #define nvme_fabrics_type_name(type)   { type, #type }
> @@ -1285,7 +1288,9 @@ enum nvmf_capsule_command {
>   	__print_symbolic(type,						\
>   		nvme_fabrics_type_name(nvme_fabrics_type_property_set),	\
>   		nvme_fabrics_type_name(nvme_fabrics_type_connect),	\
> -		nvme_fabrics_type_name(nvme_fabrics_type_property_get))
> +		nvme_fabrics_type_name(nvme_fabrics_type_property_get), \
> +		nvme_fabrics_type_name(nvme_fabrics_type_auth_send),	\
> +		nvme_fabrics_type_name(nvme_fabrics_type_auth_receive))
>   
>   /*
>    * If not fabrics command, fctype will be ignored.
> @@ -1415,6 +1420,183 @@ struct nvmf_property_get_command {
>   	__u8		resv4[16];
>   };
>   
> +struct nvmf_auth_send_command {
> +	__u8		opcode;
> +	__u8		resv1;
> +	__u16		command_id;
> +	__u8		fctype;
> +	__u8		resv2[19];
> +	union nvme_data_ptr dptr;
> +	__u8		resv3;
> +	__u8		spsp0;
> +	__u8		spsp1;
> +	__u8		secp;
> +	__le32		tl;
> +	__u8		resv4[16];
> +};
> +
> +struct nvmf_auth_receive_command {
> +	__u8		opcode;
> +	__u8		resv1;
> +	__u16		command_id;
> +	__u8		fctype;
> +	__u8		resv2[19];
> +	union nvme_data_ptr dptr;
> +	__u8		resv3;
> +	__u8		spsp0;
> +	__u8		spsp1;
> +	__u8		secp;
> +	__le32		al;
> +	__u8		resv4[16];
> +};
> +
> +/* Value for secp */
> +enum {
> +	NVME_AUTH_DHCHAP_PROTOCOL_IDENTIFIER	= 0xe9,
> +};
> +
> +/* Defined value for auth_type */
> +enum {
> +	NVME_AUTH_COMMON_MESSAGES	= 0x00,
> +	NVME_AUTH_DHCHAP_MESSAGES	= 0x01,
> +};
> +
> +/* Defined messages for auth_id */
> +enum {
> +	NVME_AUTH_DHCHAP_MESSAGE_NEGOTIATE	= 0x00,
> +	NVME_AUTH_DHCHAP_MESSAGE_CHALLENGE	= 0x01,
> +	NVME_AUTH_DHCHAP_MESSAGE_REPLY		= 0x02,
> +	NVME_AUTH_DHCHAP_MESSAGE_SUCCESS1	= 0x03,
> +	NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2	= 0x04,
> +	NVME_AUTH_DHCHAP_MESSAGE_FAILURE2	= 0xf0,
> +	NVME_AUTH_DHCHAP_MESSAGE_FAILURE1	= 0xf1,
> +};
> +
> +struct nvmf_auth_dhchap_protocol_descriptor {
> +	__u8		authid;
> +	__u8		rsvd;
> +	__u8		halen;
> +	__u8		dhlen;
> +	__u8		idlist[60];
> +};
> +
> +enum {
> +	NVME_AUTH_DHCHAP_AUTH_ID	= 0x01,
> +};
> +
> +/* Defined hash functions for DH-HMAC-CHAP authentication */
> +enum {
> +	NVME_AUTH_DHCHAP_SHA256	= 0x01,
> +	NVME_AUTH_DHCHAP_SHA384	= 0x02,
> +	NVME_AUTH_DHCHAP_SHA512	= 0x03,
> +};
> +
> +/* Defined Diffie-Hellman group identifiers for DH-HMAC-CHAP authentication */
> +enum {
> +	NVME_AUTH_DHCHAP_DHGROUP_NULL	= 0x00,
> +	NVME_AUTH_DHCHAP_DHGROUP_2048	= 0x01,
> +	NVME_AUTH_DHCHAP_DHGROUP_3072	= 0x02,
> +	NVME_AUTH_DHCHAP_DHGROUP_4096	= 0x03,
> +	NVME_AUTH_DHCHAP_DHGROUP_6144	= 0x04,
> +	NVME_AUTH_DHCHAP_DHGROUP_8192	= 0x05,
> +};
> +
> +union nvmf_auth_protocol {
> +	struct nvmf_auth_dhchap_protocol_descriptor dhchap;
> +};
> +
> +struct nvmf_auth_dhchap_negotiate_data {
> +	__u8		auth_type;
> +	__u8		auth_id;
> +	__le16		rsvd;
> +	__le16		t_id;
> +	__u8		sc_c;
> +	__u8		napd;
> +	union nvmf_auth_protocol auth_protocol[];
> +};
> +
> +struct nvmf_auth_dhchap_challenge_data {
> +	__u8		auth_type;
> +	__u8		auth_id;
> +	__u16		rsvd1;
> +	__le16		t_id;
> +	__u8		hl;
> +	__u8		rsvd2;
> +	__u8		hashid;
> +	__u8		dhgid;
> +	__le16		dhvlen;
> +	__le32		seqnum;
> +	/* 'hl' bytes of challenge value */
> +	__u8		cval[];
> +	/* followed by 'dhvlen' bytes of DH value */
> +};
> +
> +struct nvmf_auth_dhchap_reply_data {
> +	__u8		auth_type;
> +	__u8		auth_id;
> +	__le16		rsvd1;
> +	__le16		t_id;
> +	__u8		hl;
> +	__u8		rsvd2;
> +	__u8		cvalid;
> +	__u8		rsvd3;
> +	__le16		dhvlen;
> +	__le32		seqnum;
> +	/* 'hl' bytes of response data */
> +	__u8		rval[];
> +	/* followed by 'hl' bytes of Challenge value */
> +	/* followed by 'dhvlen' bytes of DH value */
> +};
> +
> +enum {
> +	NVME_AUTH_DHCHAP_RESPONSE_VALID	= (1 << 0),
> +};
> +
> +struct nvmf_auth_dhchap_success1_data {
> +	__u8		auth_type;
> +	__u8		auth_id;
> +	__le16		rsvd1;
> +	__le16		t_id;
> +	__u8		hl;
> +	__u8		rsvd2;
> +	__u8		rvalid;
> +	__u8		rsvd3[7];
> +	/* 'hl' bytes of response value if 'rvalid' is set */
> +	__u8		rval[];
> +};
> +
> +struct nvmf_auth_dhchap_success2_data {
> +	__u8		auth_type;
> +	__u8		auth_id;
> +	__le16		rsvd1;
> +	__le16		t_id;
> +	__u8		rsvd2[10];
> +};
> +
> +struct nvmf_auth_dhchap_failure_data {
> +	__u8		auth_type;
> +	__u8		auth_id;
> +	__le16		rsvd1;
> +	__le16		t_id;
> +	__u8		rescode;
> +	__u8		rescode_exp;
> +};
> +
> +enum {
> +	NVME_AUTH_DHCHAP_FAILURE_REASON_FAILED	= 0x01,
> +};
> +
> +enum {
> +	NVME_AUTH_DHCHAP_FAILURE_FAILED			= 0x01,
> +	NVME_AUTH_DHCHAP_FAILURE_NOT_USABLE		= 0x02,
> +	NVME_AUTH_DHCHAP_FAILURE_CONCAT_MISMATCH	= 0x03,
> +	NVME_AUTH_DHCHAP_FAILURE_HASH_UNUSABLE		= 0x04,
> +	NVME_AUTH_DHCHAP_FAILURE_DHGROUP_UNUSABLE	= 0x05,
> +	NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD	= 0x06,
> +	NVME_AUTH_DHCHAP_FAILURE_INCORRECT_MESSAGE	= 0x07,
> +};
> +
> +
>   struct nvme_dbbuf {
>   	__u8			opcode;
>   	__u8			flags;
> @@ -1458,6 +1640,8 @@ struct nvme_command {
>   		struct nvmf_connect_command connect;
>   		struct nvmf_property_set_command prop_set;
>   		struct nvmf_property_get_command prop_get;
> +		struct nvmf_auth_send_command auth_send;
> +		struct nvmf_auth_receive_command auth_receive;
>   		struct nvme_dbbuf dbbuf;
>   		struct nvme_directive_cmd directive;
>   	};
> 

Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>

-- 
Himanshu Madhani                                Oracle Linux Engineering