Re: [PATCH v2 7/7] nvmet-tcp: Support KeyUpdate
From: Maurizio Lombardi <hidden>
Date: 2025-09-05 13:19:48
Also in:
linux-doc, linux-nfs, linux-nvme, lkml
On Fri Sep 5, 2025 at 4:46 AM CEST, alistair23 wrote:
+#ifdef CONFIG_NVME_TARGET_TCP_TLS
+static int update_tls_keys(struct nvmet_tcp_queue *queue)
+{
+ int ret;
+
+ cancel_work(&queue->io_work);
+ handshake_req_cancel(queue->sock->sk);
+ handshake_sk_destruct_req(queue->sock->sk);
+ queue->state = NVMET_TCP_Q_TLS_HANDSHAKE;
+
+ /* Restore the default callbacks before starting upcall */
+ read_lock_bh(&queue->sock->sk->sk_callback_lock);
+ queue->sock->sk->sk_data_ready = queue->data_ready;
+ queue->sock->sk->sk_state_change = queue->state_change;
+ queue->sock->sk->sk_write_space = queue->write_space;
+ queue->sock->sk->sk_user_data = NULL;
+ read_unlock_bh(&queue->sock->sk->sk_callback_lock);
+
+ nvmet_stop_keep_alive_timer(queue->nvme_sq.ctrl);
+
+ INIT_DELAYED_WORK(&queue->tls_handshake_tmo_work,
+ nvmet_tcp_tls_handshake_timeout);
+
+ ret = nvmet_tcp_tls_handshake(queue, HANDSHAKE_KEY_UPDATE_TYPE_RECEIVED);
+
+ if (ret < 0)
+ return ret;
+
+ ret = wait_for_completion_interruptible_timeout(&queue->tls_complete, 10 * HZ);
+
+ if (ret <= 0) {
+ tls_handshake_cancel(queue->sock->sk);
+ return ret;
+ }
+
+ queue->state = NVMET_TCP_Q_LIVE;
+
+ return ret;
+}
+#endifquoted hunk ↗ jump to hunk
@@ -1408,14 +1474,22 @@ static void nvmet_tcp_io_work(struct work_struct *w) ret = nvmet_tcp_try_recv(queue, NVMET_TCP_RECV_BUDGET, &ops); if (ret > 0) pending = true; - else if (ret < 0) - return; + else if (ret < 0) { + if (ret == -EKEYEXPIRED) + update_tls_keys(queue); + else + return; + }
What happens if CONFIG_NVME_TARGET_TCP_TLS is disabled? I suspect the kernel build will fail with an update_tls_keys implicit declaration error. Maurizio