On 5/14/2026 1:22 AM, Eric Biggers wrote:
> On Tue, May 12, 2026 at 06:53:35PM +0000, Eric Biggers wrote:
>> On Tue, May 12, 2026 at 02:52:03AM -0700, Linlin Zhang wrote:
>>> dm-inlinecrypt currently initializes the blk-crypto key using
>>> BLK_CRYPTO_KEY_TYPE_RAW, which implies that the provided key material
>>> is a plaintext software key owned by the block layer.
>>>
>>> However, on platforms where dm-inlinecrypt is used together with a
>>> hardware-backed key source (e.g. TrustZone/TEE or other secure key
>>> wrapping mechanisms), the key material passed down is already wrapped
>>> and must be treated as opaque by the block layer.
>>>
>>> Initialize the blk-crypto key using BLK_CRYPTO_KEY_TYPE_HW_WRAPPED
>>> instead, so that dm-inlinecrypt correctly models hardware-wrapped keys
>>> and avoids incorrect assumptions about key ownership and visibility.
>>>
>>> Signed-off-by: Linlin Zhang <[email protected]>
>>> ---
>>> drivers/md/dm-inlinecrypt.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/md/dm-inlinecrypt.c b/drivers/md/dm-inlinecrypt.c
>>> index bd8e58a028c5..bcbf363c533a 100644
>>> --- a/drivers/md/dm-inlinecrypt.c
>>> +++ b/drivers/md/dm-inlinecrypt.c
>>> @@ -386,7 +386,7 @@ static int inlinecrypt_ctr(struct dm_target *ti,
>>> unsigned int argc, char **argv)
>>> dun_bytes = DIV_ROUND_UP(fls64(ctx->max_dun), 8);
>>>
>>> err = blk_crypto_init_key(&ctx->key, raw_key, ctx->key_size,
>>> - BLK_CRYPTO_KEY_TYPE_RAW,
>>> + BLK_CRYPTO_KEY_TYPE_HW_WRAPPED,
>>> cipher->mode_num, dun_bytes,
>>> ctx->sector_size);
>>
>> The raw key support is useful too, and it should be the default.
>> I recommend adding a "wrappedkey" optional argument that enables
>> BLK_CRYPTO_KEY_TYPE_HW_WRAPPED.
>
> This patch also makes the variable called "raw_key" contain a key that
> isn't a raw key, which is confusing. "key_bytes" would make more sense
> for a byte array that can contain either type of key. See e.g.
> blk_crypto_init_key() which uses that naming convention.
Thanks for your comment!
ACK.
Previously BLK_CRYPTO_KEY_TYPE_HW_WRAPPED was set for blk-crypto-profile entity
by default, a raw key won't never passed down to ICE driver, so I replaced raw
key type with wrapped key type directly.
Now I see it already changed to query the supported type from ice. There isn't
above concern. I'll update a new patch with both wrappedkey and raw key support
and adding "wrappedkey" optional argument.
replace "raw_key" with "key_bytes" as well.
>
> - Eric
