Re: [PATCH v2 08/17] net: psp: add socket security association code
From: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Date: 2025-06-26 02:12:03
Daniel Zahka wrote:
From: Jakub Kicinski <kuba@kernel.org> Add the ability to install PSP Rx and Tx crypto keys on TCP connections. Netlink ops are provided for both operations. Rx side combines allocating a new Rx key and installing it on the socket. Theoretically these are separate actions, but in practice they will always be used one after the other. We can add distinct "alloc" and "install" ops later. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com> Co-developed-by: Daniel Zahka <daniel.zahka@gmail.com>
quoted hunk ↗ jump to hunk
/** * struct psp_dev_ops - netdev driver facing PSP callbacks */@@ -109,6 +145,28 @@ struct psp_dev_ops { * @key_rotate: rotate the device key */ int (*key_rotate)(struct psp_dev *psd, struct netlink_ext_ack *extack); + + /** + * @rx_spi_alloc: allocate an Rx SPI+key pair + * Allocate an Rx SPI and resulting derived key. + * This key should remain valid until key rotation. + */ + int (*rx_spi_alloc)(struct psp_dev *psd, u32 version, + struct psp_key_parsed *assoc, + struct netlink_ext_ack *extack); + + /** + * @tx_key_add: add a Tx key to the device + * Install an association in the device. Core will allocate space + * for the driver to use at drv_data. + */ + int (*tx_key_add)(struct psp_dev *psd, struct psp_assoc *pas, + struct netlink_ext_ack *extack); + /** + * @tx_key_del: remove a Tx key from the device + * Remove an association from the device. + */ + void (*tx_key_del)(struct psp_dev *psd, struct psp_assoc *pas); };
This Tx driver API is necessary for devices that store keys in an on-device key database. The preferred device model for PSP is keys-in-descriptor, in line with the protocol design goal of O(1) device state. In that case, can the driver leave these callbacks NULL? And, in the driver tx datapath, access the tx key from psp_sk_assoc().