Re: [RFC nvme-keyring nvme-cli] Should NVMe/TLS PSKs support the request_key API?

Daniel Wagner
2026-04-23T17:15:44Z

On Thu, Apr 23, 2026 at 02:05:45PM +0200, Hannes Reinecke wrote:
> > Biggest problem I see, requiring explicit loading of nvme_tcp before it
> > can be used with TLS:
> >
> > - The async uevent handling loses the race against the kernel when the
> > transport kmod is requested on demand.
> >
> > ┌────────┐ ┌──────────┐ ┌──────────┐ ┌──────┐
> > │ kernel │ │ nvme-cli │ │ modprobe │ │ udev │
> > └────┬───┘ └─────┬────┘ └─────┬────┘ └───┬──┘
> > │ │ │ │
> > │ connect │ │ │
> > │◄──────────────┤ │ │
> > │ │ │ │
> > │ request kmod │ │ │
> > ├───────────────────────────────►│ │
> > │ │ │ │
> > │ load kmod │ │ │
> > │◄───────────────────────────────┤ │
> > │ │ │ │
> > │ uevent kmod │ │ │
> > ├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌►│
> > │ │ │ │
> > │ check keyring for PSK ❌ │ │
> > ├──┐ │ │ │
> > │ │ │ │ │
> > │◄─┘ │ │ │
> > │ │ │ │
> > │ connect failed ❌ │ │
> > ├──────────────►│ │ │
> > │ │ │ │
> > │ │ nvme tls --import --keyfile │
> > │ │◄──────────────────────────────┤
> > │ │ │ │
> > │ populate .nvme keyring │ │
> > │◄──────────────┤ │ │
> > │ │ │ │

Maurizio just added

load_nvme_fabrics_module();

to the connect command. So we could make the connect call wait for the
udev event, load the keys into the kernel and then write to
/dev/nvme-fabrics.

I see the /etc/nvme/tls-keys file is merely a stopgap solution. There is
certainly better ways to do this.