From: Wilfred Mallawa <wilfred.mallawa@wdc.com>

The NVMe-TCP specification [1] states that if the PSK retained or
generated is not available on the subsystem, the TLS 1.3 handshake shall
be aborted with an unknown_psk_identity alert and the connection be
closed.

Currently, when an unknown_psk_identity alert is sent from an endpoint,
tlshd returns EACCES as the TLS error. On subsequent reconnection
attempts, we fail with the same error because we keep attempting to
connect with a stale key. This may occur if the endpoint experienced a
full reset and lost its PSK.

With support in tlshd to return -EKEYREJECTED when an unknown_psk_identity
alert is received [2], the kernel can now detect this condition and revoke
the current tls_key. This allows the subsequent reconnect to perform
re-authentication via DHCHAP to generate a fresh PSK.

[1] https://nvmexpress.org/wp-content/uploads/NVM-Express-TCP-Transport-Specification-Revision-1.1-2024.08.05-Ratified.pdf
[2] https://github.com/oracle/ktls-utils/pull/149

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
---
V1 -> V2:
	- Typo in commit message
	- Re-worded the comment in code
	- Added reference to ktls-utils PR (merged) for userspace changes
---
 drivers/nvme/host/tcp.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 15d36d6a728e..8e5421d2e8b9 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1767,6 +1767,17 @@ static int nvme_tcp_start_tls(struct nvme_ctrl *nctrl,
 			dev_err(nctrl->device,
 				"queue %d: TLS handshake complete, error %d\n",
 				qid, queue->tls_err);
+
+			/*
+			 * If the key is stale, revoke it such that on a
+			 * subsequent reconnect, we will generate a new PSK.
+			 */
+			if (queue->tls_err == EKEYREJECTED && qid == 0 &&
+			    nctrl->opts->concat && nctrl->opts->tls_key) {
+				nvme_auth_revoke_tls_key(nctrl);
+				dev_warn(nctrl->device,
+					 "qid 0: revoking stale key\n");
+			}
 		} else {
 			dev_dbg(nctrl->device,
 				"queue %d: TLS handshake complete\n", qid);
-- 
2.54.0

Reviewed-by: Sagi Grimberg <sagi@grimberg.me>

On Tue, 2026-05-12 at 09:45 +1000, Wilfred Mallawa wrote:
> From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
> 
> The NVMe-TCP specification [1] states that if the PSK retained or
> generated is not available on the subsystem, the TLS 1.3 handshake
> shall
> be aborted with an unknown_psk_identity alert and the connection be
> closed.
> 
> Currently, when an unknown_psk_identity alert is sent from an
> endpoint,
> tlshd returns EACCES as the TLS error. On subsequent reconnection
> attempts, we fail with the same error because we keep attempting to
> connect with a stale key. This may occur if the endpoint experienced
> a
> full reset and lost its PSK.
> 
> With support in tlshd to return -EKEYREJECTED when an
> unknown_psk_identity
> alert is received [2], the kernel can now detect this condition and
> revoke
> the current tls_key. This allows the subsequent reconnect to perform
> re-authentication via DHCHAP to generate a fresh PSK.
> 
> [1]
> https://nvmexpress.org/wp-content/uploads/NVM-Express-TCP-Transport-Specification-Revision-1.1-2024.08.05-Ratified.pdf
> [2] https://github.com/oracle/ktls-utils/pull/149
> 
> Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
> V1 -> V2:
> 	- Typo in commit message
> 	- Re-worded the comment in code
> 	- Added reference to ktls-utils PR (merged) for userspace
> changes
> ---
>  drivers/nvme/host/tcp.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
> index 15d36d6a728e..8e5421d2e8b9 100644
> --- a/drivers/nvme/host/tcp.c
> +++ b/drivers/nvme/host/tcp.c
> @@ -1767,6 +1767,17 @@ static int nvme_tcp_start_tls(struct nvme_ctrl
> *nctrl,
>  			dev_err(nctrl->device,
>  				"queue %d: TLS handshake complete,
> error %d\n",
>  				qid, queue->tls_err);
> +
> +			/*
> +			 * If the key is stale, revoke it such that
> on a
> +			 * subsequent reconnect, we will generate a
> new PSK.
> +			 */
> +			if (queue->tls_err == EKEYREJECTED && qid ==
> 0 &&
> +			    nctrl->opts->concat && nctrl->opts-
> >tls_key) {
> +				nvme_auth_revoke_tls_key(nctrl);
> +				dev_warn(nctrl->device,
> +					 "qid 0: revoking stale
> key\n");
> +			}
>  		} else {
>  			dev_dbg(nctrl->device,
>  				"queue %d: TLS handshake
> complete\n", qid);