Series for Chelsio Inline TLS driver (chtls)
Use tls ULP infrastructure to register chtls as Inline TLS driver.
Chtls use TCP Sockets to transmit and receive TLS record. TCP proto_ops is extended to offload TLS record.
T6 adapter provides the following features:
-TLS record offload, TLS header, encrypt, digest and transmit
-TLS record receive and decrypt
-TLS keys store
-TCP/IP engine
-TLS engine
-GCM crypto engine [support CBC also]
TLS provides security at the transport layer. It uses TCP to provide reliable end-to-end transport of application data. It relies on TCP for any retransmission. TLS session comprises of three parts:
a. TCP/IP connection
b. TLS handshake
c. Record layer processing
TLS handshake state machine is executed in host (refer standard implementation eg. OpenSSL). Setsockopt [SOL_TCP, TCP_ULP] initialize TCP proto-ops for Chelsio inline tls support. setsockopt(sock, SOL_TCP, TCP_ULP, "tls", sizeof("tls"));
Tx and Rx Keys are decided during handshake and programmed onto the chip after CCS is exchanged.
struct tls12_crypto_info_aes_gcm_128 crypto_info setsockopt(sock, SOL_TLS, TLS_TX, &crypto_info, sizeof(crypto_info)) Finish is the first encrypted/decrypted message tx/rx inline.
On the Tx path TLS engine receive plain text from openssl, insert IV, fetches the tx key, create cipher text records and generate MAC. TLS header is added to cipher text and forward to TCP/IP engine for transport layer processing and transmission on wire.
TX:
Application--openssl--chtls---TLS engine---encrypt/auth---TCP/IP engine---wire.
On the Rx side, data received is PDU aligned at record boundaries. TLS processes only the complete record. If rx key is programmed on CCS receive, data is decrypted and plain text is posted to host.
RX:
Wire--cipher-text--TCP/IP engine [PDU align]---TLS engine--- decrypt/auth---plain-text--chtls--openssl--application
v9: corrected __u8 and similar usage
v8: tls_main.c cleanup comment [Dave Watson]
v7: func name change, use sk->sk_prot where required
v6: modify prot only for FULL_HW
-corrected commit message for patch 11
v5: set TLS_FULL_HW for registered inline tls drivers
-set TLS_FULL_HW prot for offload connection else move
to TLS_SW_TX
-Case handled for interface with same IP [Dave Miller]
-Removed Specific IP and INADDR_ANY handling [v4]
v4: removed chtls ULP type, retained tls ULP
-registered chtls with net tls
-defined struct tls_device to register the Inline drivers
-ethtool interface tls-inline to enable Inline TLS for interface
-prot update to support inline TLS
v3: fixed the kbuild test issues
-made few funtions static
-initialized few variables
v2: fixed the following based on the review comments of Stephan Mueller,
Stefano Brivio and Hannes Frederic
-Added more details in cover letter
-Fixed indentation and formating issues
-Using aes instead of aes-generic
-memset key info after programing the key on chip
-reordered the patch sequence
Atul Gupta (12):
tls: tls_device struct to register TLS drivers
ethtool: enable Inline TLS in HW
tls: support for inline tls
chtls: structure and macro definiton
cxgb4: Inline TLS FW Interface
cxgb4: LLD driver changes to enable TLS
chcr: Key Macro
chtls: Key program
chtls: CPL handler definition
chtls: Inline crypto request Tx/Rx
chtls: Register chtls Inline TLS with net tls
Makefile Kconfig
drivers/crypto/chelsio/Kconfig | 11 +
drivers/crypto/chelsio/Makefile | 1 +
drivers/crypto/chelsio/chcr_algo.h | 42 +
drivers/crypto/chelsio/chcr_core.h | 55 +-
drivers/crypto/chelsio/chtls/Makefile | 4 +
drivers/crypto/chelsio/chtls/chtls.h | 487 ++++++
drivers/crypto/chelsio/chtls/chtls_cm.c | 2041 +++++++++++++++++++++++
drivers/crypto/chelsio/chtls/chtls_cm.h | 202 +++
drivers/crypto/chelsio/chtls/chtls_hw.c | 394 +++++
drivers/crypto/chelsio/chtls/chtls_io.c | 1867 +++++++++++++++++++++
drivers/crypto/chelsio/chtls/chtls_main.c | 600 +++++++
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 32 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h | 7 +
drivers/net/ethernet/chelsio/cxgb4/sge.c | 98 +-
drivers/net/ethernet/chelsio/cxgb4/t4_msg.h | 121 +-
drivers/net/ethernet/chelsio/cxgb4/t4_regs.h | 2 +
drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h | 165 +-
include/linux/netdev_features.h | 2 +
include/net/tls.h | 26 +
include/uapi/linux/tls.h | 1 +
net/core/ethtool.c | 1 +
net/ipv4/tcp_minisocks.c | 1 +
net/tls/tls_main.c | 115 +-
23 files changed, 6248 insertions(+), 27 deletions(-)
create mode 100644 drivers/crypto/chelsio/chtls/Makefile
create mode 100644 drivers/crypto/chelsio/chtls/chtls.h
create mode 100644 drivers/crypto/chelsio/chtls/chtls_cm.c
create mode 100644 drivers/crypto/chelsio/chtls/chtls_cm.h
create mode 100644 drivers/crypto/chelsio/chtls/chtls_hw.c
create mode 100644 drivers/crypto/chelsio/chtls/chtls_io.c
create mode 100644 drivers/crypto/chelsio/chtls/chtls_main.c
--
1.8.3.1
-----Original Message-----
From: linux-crypto-owner@vger.kernel.org [mailto:linux-crypto-
owner@vger.kernel.org] On Behalf Of Atul Gupta
Sent: Tuesday, March 6, 2018 9:05 PM
To: davejwatson@fb.com; davem@davemloft.net;
herbert@gondor.apana.org.au
Cc: linux-crypto@vger.kernel.org; netdev@vger.kernel.org;
ganeshgr@chelsio.com
Subject: [PATCH v9 crypto 00/12] Chelsio Inline TLS
Series for Chelsio Inline TLS driver (chtls)
Use tls ULP infrastructure to register chtls as Inline TLS driver.
Chtls use TCP Sockets to transmit and receive TLS record. TCP proto_ops is
extended to offload TLS record.
T6 adapter provides the following features:
-TLS record offload, TLS header, encrypt, digest and transmit
-TLS record receive and decrypt
-TLS keys store
-TCP/IP engine
-TLS engine
-GCM crypto engine [support CBC also]
TLS provides security at the transport layer. It uses TCP to provide reliable
end-to-end transport of application data. It relies on TCP for any
retransmission. TLS session comprises of three parts:
a. TCP/IP connection
b. TLS handshake
c. Record layer processing
TLS handshake state machine is executed in host (refer standard
implementation eg. OpenSSL). Setsockopt [SOL_TCP, TCP_ULP] initialize TCP
proto-ops for Chelsio inline tls support. setsockopt(sock, SOL_TCP, TCP_ULP,
"tls", sizeof("tls"));
Tx and Rx Keys are decided during handshake and programmed onto the chip
after CCS is exchanged.
struct tls12_crypto_info_aes_gcm_128 crypto_info setsockopt(sock,
SOL_TLS, TLS_TX, &crypto_info, sizeof(crypto_info)) Finish is the first
encrypted/decrypted message tx/rx inline.
On the Tx path TLS engine receive plain text from openssl, insert IV, fetches
the tx key, create cipher text records and generate MAC. TLS header is added
to cipher text and forward to TCP/IP engine for transport layer processing
and transmission on wire.
TX:
Application--openssl--chtls---TLS engine---encrypt/auth---TCP/IP engine---
wire.
On the Rx side, data received is PDU aligned at record boundaries. TLS
processes only the complete record. If rx key is programmed on CCS receive,
data is decrypted and plain text is posted to host.
What happens if rx key is not programmed on CCS receive?
Does the TLS record decryption in Chelsio NIC device gets paused?
RX:
Wire--cipher-text--TCP/IP engine [PDU align]---TLS engine--- decrypt/auth---
plain-text--chtls--openssl--application
v9: corrected __u8 and similar usage
v8: tls_main.c cleanup comment [Dave Watson]
v7: func name change, use sk->sk_prot where required
v6: modify prot only for FULL_HW
-corrected commit message for patch 11
v5: set TLS_FULL_HW for registered inline tls drivers
-set TLS_FULL_HW prot for offload connection else move
to TLS_SW_TX
-Case handled for interface with same IP [Dave Miller]
-Removed Specific IP and INADDR_ANY handling [v4]
v4: removed chtls ULP type, retained tls ULP
-registered chtls with net tls
-defined struct tls_device to register the Inline drivers
-ethtool interface tls-inline to enable Inline TLS for interface
-prot update to support inline TLS
v3: fixed the kbuild test issues
-made few funtions static
-initialized few variables
v2: fixed the following based on the review comments of Stephan Mueller,
Stefano Brivio and Hannes Frederic
-Added more details in cover letter
-Fixed indentation and formating issues
-Using aes instead of aes-generic
-memset key info after programing the key on chip
-reordered the patch sequence
Atul Gupta (12):
tls: tls_device struct to register TLS drivers
ethtool: enable Inline TLS in HW
tls: support for inline tls
chtls: structure and macro definiton
cxgb4: Inline TLS FW Interface
cxgb4: LLD driver changes to enable TLS
chcr: Key Macro
chtls: Key program
chtls: CPL handler definition
chtls: Inline crypto request Tx/Rx
chtls: Register chtls Inline TLS with net tls
Makefile Kconfig
drivers/crypto/chelsio/Kconfig | 11 +
drivers/crypto/chelsio/Makefile | 1 +
drivers/crypto/chelsio/chcr_algo.h | 42 +
drivers/crypto/chelsio/chcr_core.h | 55 +-
drivers/crypto/chelsio/chtls/Makefile | 4 +
drivers/crypto/chelsio/chtls/chtls.h | 487 ++++++
drivers/crypto/chelsio/chtls/chtls_cm.c | 2041
+++++++++++++++++++++++
drivers/crypto/chelsio/chtls/chtls_cm.h | 202 +++
drivers/crypto/chelsio/chtls/chtls_hw.c | 394 +++++
drivers/crypto/chelsio/chtls/chtls_io.c | 1867 +++++++++++++++++++++
drivers/crypto/chelsio/chtls/chtls_main.c | 600 +++++++
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 32 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h | 7 +
drivers/net/ethernet/chelsio/cxgb4/sge.c | 98 +-
drivers/net/ethernet/chelsio/cxgb4/t4_msg.h | 121 +-
drivers/net/ethernet/chelsio/cxgb4/t4_regs.h | 2 +
drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h | 165 +-
include/linux/netdev_features.h | 2 +
include/net/tls.h | 26 +
include/uapi/linux/tls.h | 1 +
net/core/ethtool.c | 1 +
net/ipv4/tcp_minisocks.c | 1 +
net/tls/tls_main.c | 115 +-
23 files changed, 6248 insertions(+), 27 deletions(-) create mode 100644
drivers/crypto/chelsio/chtls/Makefile
create mode 100644 drivers/crypto/chelsio/chtls/chtls.h
create mode 100644 drivers/crypto/chelsio/chtls/chtls_cm.c
create mode 100644 drivers/crypto/chelsio/chtls/chtls_cm.h
create mode 100644 drivers/crypto/chelsio/chtls/chtls_hw.c
create mode 100644 drivers/crypto/chelsio/chtls/chtls_io.c
create mode 100644 drivers/crypto/chelsio/chtls/chtls_main.c
--
1.8.3.1
-----Original Message-----
From: linux-crypto-owner@vger.kernel.org [mailto:linux-crypto-
owner@vger.kernel.org] On Behalf Of Atul Gupta
Sent: Tuesday, March 6, 2018 9:05 PM
To: davejwatson@fb.com; davem@davemloft.net;
herbert@gondor.apana.org.au
Cc: linux-crypto@vger.kernel.org; netdev@vger.kernel.org;
ganeshgr@chelsio.com
Subject: [PATCH v9 crypto 00/12] Chelsio Inline TLS
Series for Chelsio Inline TLS driver (chtls)
Use tls ULP infrastructure to register chtls as Inline TLS driver.
Chtls use TCP Sockets to transmit and receive TLS record. TCP
proto_ops is extended to offload TLS record.
T6 adapter provides the following features:
-TLS record offload, TLS header, encrypt, digest and transmit
-TLS record receive and decrypt
-TLS keys store
-TCP/IP engine
-TLS engine
-GCM crypto engine [support CBC also]
TLS provides security at the transport layer. It uses TCP to provide
reliable end-to-end transport of application data. It relies on TCP
for any retransmission. TLS session comprises of three parts:
a. TCP/IP connection
b. TLS handshake
c. Record layer processing
TLS handshake state machine is executed in host (refer standard
implementation eg. OpenSSL). Setsockopt [SOL_TCP, TCP_ULP] initialize
TCP proto-ops for Chelsio inline tls support. setsockopt(sock,
SOL_TCP, TCP_ULP, "tls", sizeof("tls"));
Tx and Rx Keys are decided during handshake and programmed onto the
chip after CCS is exchanged.
struct tls12_crypto_info_aes_gcm_128 crypto_info setsockopt(sock,
SOL_TLS, TLS_TX, &crypto_info, sizeof(crypto_info)) Finish is the
first encrypted/decrypted message tx/rx inline.
On the Tx path TLS engine receive plain text from openssl, insert IV,
fetches the tx key, create cipher text records and generate MAC. TLS
header is added to cipher text and forward to TCP/IP engine for
transport layer processing and transmission on wire.
TX:
Application--openssl--chtls---TLS engine---encrypt/auth---TCP/IP
engine--- wire.
On the Rx side, data received is PDU aligned at record boundaries. TLS
processes only the complete record. If rx key is programmed on CCS
receive, data is decrypted and plain text is posted to host.
What happens if rx key is not programmed on CCS receive?
Does the TLS record decryption in Chelsio NIC device gets paused?
Yes
RX:
Wire--cipher-text--TCP/IP engine [PDU align]---TLS engine---
decrypt/auth--- plain-text--chtls--openssl--application
v9: corrected __u8 and similar usage
v8: tls_main.c cleanup comment [Dave Watson]
v7: func name change, use sk->sk_prot where required
v6: modify prot only for FULL_HW
-corrected commit message for patch 11
v5: set TLS_FULL_HW for registered inline tls drivers
-set TLS_FULL_HW prot for offload connection else move
to TLS_SW_TX
-Case handled for interface with same IP [Dave Miller]
-Removed Specific IP and INADDR_ANY handling [v4]
v4: removed chtls ULP type, retained tls ULP
-registered chtls with net tls
-defined struct tls_device to register the Inline drivers
-ethtool interface tls-inline to enable Inline TLS for interface
-prot update to support inline TLS
v3: fixed the kbuild test issues
-made few funtions static
-initialized few variables
v2: fixed the following based on the review comments of Stephan Mueller,
Stefano Brivio and Hannes Frederic
-Added more details in cover letter
-Fixed indentation and formating issues
-Using aes instead of aes-generic
-memset key info after programing the key on chip
-reordered the patch sequence
Atul Gupta (12):
tls: tls_device struct to register TLS drivers
ethtool: enable Inline TLS in HW
tls: support for inline tls
chtls: structure and macro definiton
cxgb4: Inline TLS FW Interface
cxgb4: LLD driver changes to enable TLS
chcr: Key Macro
chtls: Key program
chtls: CPL handler definition
chtls: Inline crypto request Tx/Rx
chtls: Register chtls Inline TLS with net tls
Makefile Kconfig
drivers/crypto/chelsio/Kconfig | 11 +
drivers/crypto/chelsio/Makefile | 1 +
drivers/crypto/chelsio/chcr_algo.h | 42 +
drivers/crypto/chelsio/chcr_core.h | 55 +-
drivers/crypto/chelsio/chtls/Makefile | 4 +
drivers/crypto/chelsio/chtls/chtls.h | 487 ++++++
drivers/crypto/chelsio/chtls/chtls_cm.c | 2041
+++++++++++++++++++++++
drivers/crypto/chelsio/chtls/chtls_cm.h | 202 +++
drivers/crypto/chelsio/chtls/chtls_hw.c | 394 +++++
drivers/crypto/chelsio/chtls/chtls_io.c | 1867 +++++++++++++++++++++
drivers/crypto/chelsio/chtls/chtls_main.c | 600 +++++++
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 32 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h | 7 +
drivers/net/ethernet/chelsio/cxgb4/sge.c | 98 +-
drivers/net/ethernet/chelsio/cxgb4/t4_msg.h | 121 +-
drivers/net/ethernet/chelsio/cxgb4/t4_regs.h | 2 +
drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h | 165 +-
include/linux/netdev_features.h | 2 +
include/net/tls.h | 26 +
include/uapi/linux/tls.h | 1 +
net/core/ethtool.c | 1 +
net/ipv4/tcp_minisocks.c | 1 +
net/tls/tls_main.c | 115 +-
23 files changed, 6248 insertions(+), 27 deletions(-) create mode
100644 drivers/crypto/chelsio/chtls/Makefile
create mode 100644 drivers/crypto/chelsio/chtls/chtls.h
create mode 100644 drivers/crypto/chelsio/chtls/chtls_cm.c
create mode 100644 drivers/crypto/chelsio/chtls/chtls_cm.h
create mode 100644 drivers/crypto/chelsio/chtls/chtls_hw.c
create mode 100644 drivers/crypto/chelsio/chtls/chtls_io.c
create mode 100644 drivers/crypto/chelsio/chtls/chtls_main.c
--
1.8.3.1
Series for Chelsio Inline TLS driver (chtls)
Use tls ULP infrastructure to register chtls as Inline TLS driver.
Chtls use TCP Sockets to transmit and receive TLS record. TCP proto_ops is extended to offload TLS record.
T6 adapter provides the following features:
-TLS record offload, TLS header, encrypt, digest and transmit
-TLS record receive and decrypt
-TLS keys store
-TCP/IP engine
-TLS engine
-GCM crypto engine [support CBC also]
TLS provides security at the transport layer. It uses TCP to provide reliable end-to-end transport of application data. It relies on TCP for any retransmission. TLS session comprises of three parts:
Please wrap long lines.
[snip]
v9: corrected __u8 and similar usage
That's not the only changes since v8, actually. There's also some new
code in patch 3.
--
Sabrina
Series for Chelsio Inline TLS driver (chtls)
Use tls ULP infrastructure to register chtls as Inline TLS driver.
Chtls use TCP Sockets to transmit and receive TLS record. TCP proto_ops is extended to offload TLS record.
T6 adapter provides the following features:
-TLS record offload, TLS header, encrypt, digest and transmit
-TLS record receive and decrypt
-TLS keys store
-TCP/IP engine
-TLS engine
-GCM crypto engine [support CBC also]
TLS provides security at the transport layer. It uses TCP to provide reliable end-to-end transport of application data. It relies on TCP for any retransmission. TLS session comprises of three parts:
Please wrap long lines.
will edit in next ver
[snip]
quoted
v9: corrected __u8 and similar usage
That's not the only changes since v8, actually. There's also some new
code in patch 3.
tls_hw_prot is done before sk_state != TCP_ESTABLISHED, this check was introduced in net-next
and pulled in crypto tree later.