blk-crypto: show supported key types in sysfs

Add sysfs files that indicate which type(s) of keys are supported by the
inline encryption hardware associated with a particular request queue:

	/sys/block/$disk/queue/crypto/hw_wrapped_keys
	/sys/block/$disk/queue/crypto/raw_keys

Userspace can use the presence or absence of these files to decide what
encyption settings to use.

Don't use a single key_type file, as devices might support both key
types at the same time.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Tested-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> # sm8650
Link: https://lore.kernel.org/r/20250204060041.409950-3-ebiggers@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/Documentation/ABI/stable/sysfs-block b/Documentation/ABI/stable/sysfs-block
index 0cceb2badc836b8cbdade543deff71edef0e3da1..890cde28bf90d92f4f86f6f260397b1d5e1f59f1 100644 (file)
--- a/Documentation/ABI/stable/sysfs-block
+++ b/Documentation/ABI/stable/sysfs-block
@@ -229,6 +229,17 @@ Description:
                encryption, refer to Documentation/block/inline-encryption.rst.
 
 
+What:          /sys/block/<disk>/queue/crypto/hw_wrapped_keys
+Date:          February 2025
+Contact:       linux-block@vger.kernel.org
+Description:
+               [RO] The presence of this file indicates that the device
+               supports hardware-wrapped inline encryption keys, i.e. key blobs
+               that can only be unwrapped and used by dedicated hardware.  For
+               more information about hardware-wrapped inline encryption keys,
+               see Documentation/block/inline-encryption.rst.
+
+
 What:          /sys/block/<disk>/queue/crypto/max_dun_bits
 Date:          February 2022
 Contact:       linux-block@vger.kernel.org
@@ -267,6 +278,15 @@ Description:
                use with inline encryption.
 
 
+What:          /sys/block/<disk>/queue/crypto/raw_keys
+Date:          February 2025
+Contact:       linux-block@vger.kernel.org
+Description:
+               [RO] The presence of this file indicates that the device
+               supports raw inline encryption keys, i.e. keys that are managed
+               in raw, plaintext form in software.
+
+
 What:          /sys/block/<disk>/queue/dax
 Date:          June 2016
 Contact:       linux-block@vger.kernel.org

diff --git a/block/blk-crypto-sysfs.c b/block/blk-crypto-sysfs.c
index a304434489bacf05550c5c2f9c6f0f27b335323d..e832f403f20024bff92468a107cf30468dc79715 100644 (file)
--- a/block/blk-crypto-sysfs.c
+++ b/block/blk-crypto-sysfs.c
@@ -31,6 +31,13 @@ static struct blk_crypto_attr *attr_to_crypto_attr(struct attribute *attr)
        return container_of(attr, struct blk_crypto_attr, attr);
 }
 
+static ssize_t hw_wrapped_keys_show(struct blk_crypto_profile *profile,
+                                   struct blk_crypto_attr *attr, char *page)
+{
+       /* Always show supported, since the file doesn't exist otherwise. */
+       return sysfs_emit(page, "supported\n");
+}
+
 static ssize_t max_dun_bits_show(struct blk_crypto_profile *profile,
                                 struct blk_crypto_attr *attr, char *page)
 {
@@ -43,20 +50,48 @@ static ssize_t num_keyslots_show(struct blk_crypto_profile *profile,
        return sysfs_emit(page, "%u\n", profile->num_slots);
 }
 
+static ssize_t raw_keys_show(struct blk_crypto_profile *profile,
+                            struct blk_crypto_attr *attr, char *page)
+{
+       /* Always show supported, since the file doesn't exist otherwise. */
+       return sysfs_emit(page, "supported\n");
+}
+
 #define BLK_CRYPTO_RO_ATTR(_name) \
        static struct blk_crypto_attr _name##_attr = __ATTR_RO(_name)
 
+BLK_CRYPTO_RO_ATTR(hw_wrapped_keys);
 BLK_CRYPTO_RO_ATTR(max_dun_bits);
 BLK_CRYPTO_RO_ATTR(num_keyslots);
+BLK_CRYPTO_RO_ATTR(raw_keys);
+
+static umode_t blk_crypto_is_visible(struct kobject *kobj,
+                                    struct attribute *attr, int n)
+{
+       struct blk_crypto_profile *profile = kobj_to_crypto_profile(kobj);
+       struct blk_crypto_attr *a = attr_to_crypto_attr(attr);
+
+       if (a == &hw_wrapped_keys_attr &&
+           !(profile->key_types_supported & BLK_CRYPTO_KEY_TYPE_HW_WRAPPED))
+               return 0;
+       if (a == &raw_keys_attr &&
+           !(profile->key_types_supported & BLK_CRYPTO_KEY_TYPE_RAW))
+               return 0;
+
+       return 0444;
+}
 
 static struct attribute *blk_crypto_attrs[] = {
+       &hw_wrapped_keys_attr.attr,
        &max_dun_bits_attr.attr,
        &num_keyslots_attr.attr,
+       &raw_keys_attr.attr,
        NULL,
 };
 
 static const struct attribute_group blk_crypto_attr_group = {
        .attrs = blk_crypto_attrs,
+       .is_visible = blk_crypto_is_visible,
 };
 
 /*