From owner-svn-src-all@freebsd.org Thu Dec 3 21:49:21 2020 Return-Path: Delivered-To: svn-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 2DB3B4B066A; Thu, 3 Dec 2020 21:49:21 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Cn8cd0rYlz4nYk; Thu, 3 Dec 2020 21:49:21 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 0FD1220703; Thu, 3 Dec 2020 21:49:21 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 0B3LnKvE084390; Thu, 3 Dec 2020 21:49:20 GMT (envelope-from jhb@FreeBSD.org) Received: (from jhb@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 0B3LnKs0084388; Thu, 3 Dec 2020 21:49:20 GMT (envelope-from jhb@FreeBSD.org) Message-Id: <202012032149.0B3LnKs0084388@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: jhb set sender to jhb@FreeBSD.org using -f From: John Baldwin Date: Thu, 3 Dec 2020 21:49:20 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r368311 - in head/sys/dev/cxgbe: . tom X-SVN-Group: head X-SVN-Commit-Author: jhb X-SVN-Commit-Paths: in head/sys/dev/cxgbe: . tom X-SVN-Commit-Revision: 368311 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Dec 2020 21:49:21 -0000 Author: jhb Date: Thu Dec 3 21:49:20 2020 New Revision: 368311 URL: https://svnweb.freebsd.org/changeset/base/368311 Log: Fix downgrading of TOE TLS sockets to plain TOE. If a TOE TLS socket ends up using an unsupported TLS version or ciphersuite, it must be downgraded to a "plain" TOE socket with TLS encryption/decryption performed on the host. The previous implementation of this fallback was incomplete and resulted in hung connections. Reviewed by: np MFC after: 2 weeks Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D27467 Modified: head/sys/dev/cxgbe/t4_main.c head/sys/dev/cxgbe/tom/t4_tls.c Modified: head/sys/dev/cxgbe/t4_main.c ============================================================================== --- head/sys/dev/cxgbe/t4_main.c Thu Dec 3 21:38:00 2020 (r368310) +++ head/sys/dev/cxgbe/t4_main.c Thu Dec 3 21:49:20 2020 (r368311) @@ -4917,9 +4917,22 @@ set_params__post_init(struct adapter *sc) #endif #ifdef KERN_TLS - if (t4_kern_tls != 0 && sc->cryptocaps & FW_CAPS_CONFIG_TLSKEYS && - sc->toecaps & FW_CAPS_CONFIG_TOE) - t4_enable_kern_tls(sc); + if (sc->cryptocaps & FW_CAPS_CONFIG_TLSKEYS && + sc->toecaps & FW_CAPS_CONFIG_TOE) { + if (t4_kern_tls != 0) + t4_enable_kern_tls(sc); + else { + /* + * Limit TOE connections to 2 reassembly + * "islands". This is required for TOE TLS + * connections to downgrade to plain TOE + * connections if an unsupported TLS version + * or ciphersuite is used. + */ + t4_tp_wr_bits_indirect(sc, A_TP_FRAG_CONFIG, + V_PASSMODE(M_PASSMODE), V_PASSMODE(2)); + } + } #endif return (0); } Modified: head/sys/dev/cxgbe/tom/t4_tls.c ============================================================================== --- head/sys/dev/cxgbe/tom/t4_tls.c Thu Dec 3 21:38:00 2020 (r368310) +++ head/sys/dev/cxgbe/tom/t4_tls.c Thu Dec 3 21:49:20 2020 (r368311) @@ -138,11 +138,19 @@ tls_clr_ofld_mode(struct toepcb *toep) tls_stop_handshake_timer(toep); - /* Operate in PDU extraction mode only. */ + KASSERT(toep->tls.rx_key_addr == -1, + ("%s: tid %d has RX key", __func__, toep->tid)); + + /* Switch to plain TOE mode. */ t4_set_tls_tcb_field(toep, W_TCB_ULP_RAW, - V_TCB_ULP_RAW(M_TCB_ULP_RAW), - V_TCB_ULP_RAW(V_TF_TLS_ENABLE(1))); + V_TCB_ULP_RAW(V_TF_TLS_ENABLE(1)), + V_TCB_ULP_RAW(V_TF_TLS_ENABLE(0))); + t4_set_tls_tcb_field(toep, W_TCB_ULP_TYPE, + V_TCB_ULP_TYPE(M_TCB_ULP_TYPE), V_TCB_ULP_TYPE(ULP_MODE_NONE)); t4_clear_rx_quiesce(toep); + + toep->flags &= ~TPF_FORCE_CREDITS; + toep->params.ulp_mode = ULP_MODE_NONE; } static void