Re: [PATCH v4 4/4] nvme: Allow reauth from sysfs

Hannes Reinecke
2025-12-02T15:30:48Z

On 12/2/25 06:17, alistair23@gmail.com wrote:
> From: Alistair Francis <alistair.francis@wdc.com>
>
> Allow userspace to trigger a reauth (REPLACETLSPSK) from sysfs.
> This can be done by writing a zero to the sysfs file.
>
> echo 0 > /sys/devices/virtual/nvme-fabrics/ctl/nvme0/tls_configured_key
>
> In order to use the new keys for the admin queue we call controller
> reset. This isn't ideal, but I can't find a simpler way to reset the
> admin queue TLS connection.
>
> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
> ---
> v4:
> - Forcefully reset the connection
> v3:
> - Only trigger if a 0 is written to `tls_configured_key`
> - Add documentation
> v2:
> - Trigger on any value written to `tls_configured_key`
>
> Documentation/ABI/testing/sysfs-nvme | 13 ++++++++
> drivers/nvme/host/sysfs.c | 44 +++++++++++++++++++++++++++-
> 2 files changed, 56 insertions(+), 1 deletion(-)
> create mode 100644 Documentation/ABI/testing/sysfs-nvme
>
> diff --git a/Documentation/ABI/testing/sysfs-nvme b/Documentation/ABI/testing/sysfs-nvme
> new file mode 100644
> index 000000000000..16aaf0dca9e2
> --- /dev/null
> +++ b/Documentation/ABI/testing/sysfs-nvme
> @@ -0,0 +1,13 @@
> +What: /sys/devices/virtual/nvme-fabrics/ctl/.../tls_configured_key
> +Date: November 2025
> +KernelVersion: 6.19
> +Contact: Linux NVMe mailing list <linux-nvme@lists.infradead.org>
> +Description:
> + The file is avaliable when using a secure concatanation
> + connection to a NVMe taget. Reading the file will return
> + the serial of the currently negotiated key.
> +
> + Writing 0 to the file will trigger a PSK reauthentication
> + (REPLACETLSPSK) with the target. After a reauthentication
> + the value returned by tls_configured_key will be the new
> + serial.
> diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
> index 6d10e12136d0..caf853a0da33 100644
> --- a/drivers/nvme/host/sysfs.c
> +++ b/drivers/nvme/host/sysfs.c
> @@ -806,7 +806,49 @@ static ssize_t tls_configured_key_show(struct device *dev,
>
> return sysfs_emit(buf, "%08x\n", key_serial(key));
> }
> -static DEVICE_ATTR_RO(tls_configured_key);
> +
> +static ssize_t tls_configured_key_store(struct device *dev,
> + struct device_attribute *attr,
> + const char *buf, size_t count)
> +{
> + struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
> + int error, qid;
> +
> + error = kstrtoint(buf, 10, &qid);
> + if (error)
> + return error;
> +
> + /*
> + * We currently only allow userspace to write a `0` indicating
> + * generate a new key.

'indicating generate a new key' is a bit awkward; maybe
'indicating that a new key should be generated'?

Otherwise looks good.

Reviewed-by: Hannes Reinecke <hare@suse.de>

Cheers,

Hannes
--
Dr. Hannes Reinecke Kernel Storage Architect
hare@suse.de +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich