[PATCH v3 4/4] nvme: Allow reauth from sysfs

alistair23
2025-11-14T04:59:35Z

From: Alistair Francis <alistair.francis@wdc.com>

Allow userspace to trigger a reauth (REPLACETLSPSK) from sysfs.
This can be done by writing a zero to the sysfs file.

echo 0 > /sys/devices/virtual/nvme-fabrics/ctl/nvme0/tls_configured_key

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
v3:
- Only trigger if a 0 is written to `tls_configured_key`
- Add documentation
v2:
- Trigger on any value written to `tls_configured_key`

Documentation/ABI/testing/sysfs-nvme | 13 +++++++++++
drivers/nvme/host/sysfs.c | 34 +++++++++++++++++++++++++++-
2 files changed, 46 insertions(+), 1 deletion(-)
create mode 100644 Documentation/ABI/testing/sysfs-nvme

diff --git a/Documentation/ABI/testing/sysfs-nvme b/Documentation/ABI/testing/sysfs-nvme
new file mode 100644
index 000000000000..16aaf0dca9e2
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-nvme
@@ -0,0 +1,13 @@
+What: /sys/devices/virtual/nvme-fabrics/ctl/.../tls_configured_key
+Date: November 2025
+KernelVersion: 6.19
+Contact: Linux NVMe mailing list <linux-nvme@lists.infradead.org>
+Description:
+ The file is avaliable when using a secure concatanation
+ connection to a NVMe taget. Reading the file will return
+ the serial of the currently negotiated key.
+
+ Writing 0 to the file will trigger a PSK reauthentication
+ (REPLACETLSPSK) with the target. After a reauthentication
+ the value returned by tls_configured_key will be the new
+ serial.
diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
index 6d10e12136d0..7ff9a5053c3f 100644
--- a/drivers/nvme/host/sysfs.c
+++ b/drivers/nvme/host/sysfs.c
@@ -806,7 +806,39 @@ static ssize_t tls_configured_key_show(struct device *dev,

return sysfs_emit(buf, "%08x\n", key_serial(key));
}
-static DEVICE_ATTR_RO(tls_configured_key);
+
+static ssize_t tls_configured_key_store(struct device *dev,
+ struct device_attribute *attr,
+ const char *buf, size_t count)
+{
+ struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
+ int error, qid;
+
+ error = kstrtoint(buf, 10, &qid);
+ if (error)
+ return error;
+
+ /*
+ * We currently only allow userspace to write a `0` indicating
+ * generate a new key.
+ */
+ if (!qid)
+ return -EINVAL;
+
+ if (!ctrl->opts || !ctrl->opts->concat)
+ return -EOPNOTSUPP;
+
+ error = nvme_auth_negotiate(ctrl, 0);
+ if (error < 0)
+ return error;
+
+ error = nvme_auth_wait(ctrl, 0);
+ if (error < 0)
+ return error;
+
+ return count;
+}
+static DEVICE_ATTR_RW(tls_configured_key);

static ssize_t tls_keyring_show(struct device *dev,
struct device_attribute *attr, char *buf)
--
2.51.1