From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 01A2810F995C for ; Wed, 8 Apr 2026 16:20:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Cc:To:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=bfrU1EBlwLOZtxmQYmbx9mSQ10Bk6/4xv8JDbnFwsZA=; b=GHST2WyBW2NeI7sSFm559auoH+ vT8NMCb8MxnRuEEsCh2HvMDjmNC8kYpx+xZpNjFYLsPtXIRuw7bRywSIFhZe7GXA8Pj1kTxg9qbkA /dEvWrFjrL77hOyOCk+TQAZDxM1Yp9f2KSlymHoFxJ7IE3Yj+v78Nmd9axInANNmw1/1/mWHw6oXQ Z/8oEV67XbPt9vDWW1U6UDpQo1SKPE5iprM2zi5PMqWKHsZ5ALybwXm6bZZVHBwlO1051wQOJjfpE /j/E3iuppJ9ql0CATH2tQhBFvAvF4cBpiMa6mlCCvHQGZTWpwXxjfqVo9n78ZCOXpH6sRikSwzxK+ dqkSGYnA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux)) id 1wAVdK-000000096gM-3lJw; Wed, 08 Apr 2026 16:20:02 +0000 Received: from tor.source.kernel.org ([172.105.4.254]) by bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux)) id 1wAVdJ-000000096fq-1e9r for linux-nvme@lists.infradead.org; Wed, 08 Apr 2026 16:20:01 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by tor.source.kernel.org (Postfix) with ESMTP id 6A39D600CB; Wed, 8 Apr 2026 16:20:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A0266C19421; Wed, 8 Apr 2026 16:19:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1775665200; bh=NzwGjr06o7DnK0+PdngH2ER774q+qcQ8iMjLYndG6mM=; h=From:Date:Subject:To:Cc:From; b=C0jlaLatppaqbzbHgpcSJVcowWVOZmCCEim+zglJFkLk2Uldpudpk9OO3UWIF6O7x /N2LCFYcaoG+oS/JB+VP6NneP4qcNnL8GLKk1+/oQIV63y41oHzXWAjEWTsDR3JTxP wFiiD0u+dJNP0w87nbnNjzI3RpKdwyJqA4ajLbUT5TYdXLK5sokUltVJIywar3NNDA LarPefF3JG4HtPCl8W8/zhyqzZVkpvtCwf0WofWfVzUT1sm3d3u1Iu1JFvbTPGlspk 7em4nCoL4jkLCOKyb+6LKTlRgDkmHV+49AHpIH2qJ+cyS8BaSYmTxR2m+c3Tnirm7O UXimTA9yc6CMg== From: Daniel Wagner Date: Wed, 08 Apr 2026 18:19:56 +0200 Subject: [PATCH v3] nvme: expose TLS mode MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260408-expose-tls-mode-v3-1-b869da028eff@kernel.org> X-B4-Tracking: v=1; b=H4sIAAAAAAAC/3XNQQ6CMBCF4auQrq3ptEXRlfcwLgodoIqUtNhgC He3xY3GuPyTN9/MxKMz6Mkxm4nDYLyxfQyxyUjVqr5BanRswhnfMcmA4jRYj3TsPL1bjRRYrct cy/ygJYlXg8PaTKt4vrzbP8orVmNi0qI1frTuub4MkHb/9QAUqBRCFUKD5qI+3dD12G2ta0jiA /8Eil+ARwD2iudKSZC6+gKWZXkBPUdGvgIBAAA= X-Change-ID: 20260401-expose-tls-mode-10fdb5d459d4 To: Keith Busch , Christoph Hellwig , Sagi Grimberg Cc: Hannes Reinecke , linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org, Daniel Wagner X-Mailer: b4 0.15.1 X-BeenThere: linux-nvme@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "Linux-nvme" Errors-To: linux-nvme-bounces+linux-nvme=archiver.kernel.org@lists.infradead.org It is not possible to determine the active TLS mode from the presence or absence of sysfs attributes like tls_key, tls_configured_key, or dhchap_secret. With the introduction of the concat mode and optional DH-CHAP authentication, different configurations can result in identical sysfs state. This makes user space detection unreliable. Expose the TLS mode explicitly to allow user space to unambiguously identify the active configuration and avoid fragile heuristics in nvme-cli. Signed-off-by: Daniel Wagner --- Fixed visibilty condition, the previous version used opts->tls_key but it should opts->tls. Original cover letter (with fixed example): I am extending the test suite for nvme-cli to cover the use case of nvme connect --tls/--concat. Currently, nvme-cli uses heuristics to determine whether --tls was used to initiate the connection. With the introduction of --concat, these heuristics are no longer reliable. By exposing the TLS mode explicitly, nvme config can now generate a configuration based on the currently active connection. $ nvme connect --transport tcp --traddr 192.168.30.30 --trsvcid 4420 \ --hostnqn nqn.2014-08.org.nvmexpress:uuid:befdec4c-2234-11b2-a85c-ca77c773af36 \ --nqn nqn.io-1 --concat \ --dhchap-secret=DHHC-1:01:1+pb0VSbn3cBrOhwP5SHa6gwlbPikdZ0mmBKKXC74Sm0s0pb: \ --dump-config --output-format json [ { "hostnqn":"nqn.2014-08.org.nvmexpress:uuid:befdec4c-2234-11b2-a85c-ca77c773af36", "hostid":"befdec4c-2234-11b2-a85c-ca77c773af36", "dhchap_key":"DHHC-1:01:1+pb0VSbn3cBrOhwP5SHa6gwlbPikdZ0mmBKKXC74Sm0s0pb:", "subsystems":[ { "nqn":"nqn.io-1", "ports":[ { "transport":"tcp", "traddr":"192.168.30.30", "trsvcid":"4420", "dhchap_key":"DHHC-1:01:1+pb0VSbn3cBrOhwP5SHa6gwlbPikdZ0mmBKKXC74Sm0s0pb:", "concat":true } ] } ] } ] $ nvme config --scan --dump --output-format json /dev/nvme1 [ { "hostnqn":"nqn.2014-08.org.nvmexpress:uuid:befdec4c-2234-11b2-a85c-ca77c773af36", "hostid":"befdec4c-2234-11b2-a85c-ca77c773af36", "dhchap_key":"DHHC-1:01:1+pb0VSbn3cBrOhwP5SHa6gwlbPikdZ0mmBKKXC74Sm0s0pb:", "subsystems":[ { "nqn":"nqn.io-1", "ports":[ { "transport":"tcp", "traddr":"192.168.30.30", "trsvcid":"4420", "dhchap_key":"DHHC-1:01:1+pb0VSbn3cBrOhwP5SHa6gwlbPikdZ0mmBKKXC74Sm0s0pb:", "concat":true } ] } ] } ] $ cat /sys/class/nvme-fabrics/ctl/nvme1/tls_mode concat --- Changes in v3: - Fixed visibilty conditions to opts->tls instead of opts->tls_key - Link to v2: https://patch.msgid.link/20260408-expose-tls-mode-v2-1-17a25aa414dc@kernel.org Changes in v2: - fixed the example output - tls_mode only visible when either tls or concat is enabled. avoids 'none' - Link to v1: https://patch.msgid.link/20260401-expose-tls-mode-v1-1-433a83d1d23f@kernel.org --- drivers/nvme/host/sysfs.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c index 16c6fea4b2db..df25c8fef063 100644 --- a/drivers/nvme/host/sysfs.c +++ b/drivers/nvme/host/sysfs.c @@ -841,10 +841,26 @@ static ssize_t tls_keyring_show(struct device *dev, } static DEVICE_ATTR_RO(tls_keyring); +static ssize_t tls_mode_show(struct device *dev, + struct device_attribute *attr, char *buf) +{ + struct nvme_ctrl *ctrl = dev_get_drvdata(dev); + const char *mode; + + if (ctrl->opts->tls) + mode = "tls"; + else + mode = "concat"; + + return sysfs_emit(buf, "%s\n", mode); +} +static DEVICE_ATTR_RO(tls_mode); + static struct attribute *nvme_tls_attrs[] = { &dev_attr_tls_key.attr, &dev_attr_tls_configured_key.attr, &dev_attr_tls_keyring.attr, + &dev_attr_tls_mode.attr, NULL, }; @@ -866,6 +882,9 @@ static umode_t nvme_tls_attrs_are_visible(struct kobject *kobj, if (a == &dev_attr_tls_keyring.attr && !ctrl->opts->keyring) return 0; + if (a == &dev_attr_tls_mode.attr && + !ctrl->opts->tls && !ctrl->opts->concat) + return 0; return a->mode; } --- base-commit: 7aaa8047eafd0bd628065b15757d9b48c5f9c07d change-id: 20260401-expose-tls-mode-10fdb5d459d4 Best regards, -- Daniel Wagner