dm-inlinecrypt currently initializes the blk-crypto key using BLK_CRYPTO_KEY_TYPE_RAW, which implies that the provided key material is a plaintext software key owned by the block layer.
This was requested as the first version in the link (https://lore.kernel.org/all/20260312070110.GD2359@sol/) to have a a easy way validating the patch. However, now support for wrapped keys is already upstream and on platforms where dm-inlinecrypt is used together with a hardware-backed key source (e.g. TrustZone/TEE or other secure key wrapping mechanisms), the key material passed down is already wrapped and must be treated as opaque by the block layer. Switching the blk-crypto key initialization to BLK_CRYPTO_KEY_TYPE_HW_WRAPPED aligns dm-inlinecrypt with hardware-backed key usage models and avoids incorrect assumptions about key ownership and visibility. Linlin Zhang (1): dm-inlinecrypt: initialize blk-crypto key as HW-wrapped key drivers/md/dm-inlinecrypt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1
