[PATCH v1 1/1] dm-inlinecrypt: initialize blk-crypto key as HW-wrapped key

[Linlin Zhang]

dm-inlinecrypt currently initializes the blk-crypto key using
BLK_CRYPTO_KEY_TYPE_RAW, which implies that the provided key material
is a plaintext software key owned by the block layer.

However, on platforms where dm-inlinecrypt is used together with a
hardware-backed key source (e.g. TrustZone/TEE or other secure key
wrapping mechanisms), the key material passed down is already wrapped
and must be treated as opaque by the block layer.

Initialize the blk-crypto key using BLK_CRYPTO_KEY_TYPE_HW_WRAPPED
instead, so that dm-inlinecrypt correctly models hardware-wrapped keys
and avoids incorrect assumptions about key ownership and visibility.

Signed-off-by: Linlin Zhang <linlin.zhang@xxxxxxxxxxxxxxxx>
---
 drivers/md/dm-inlinecrypt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/dm-inlinecrypt.c b/drivers/md/dm-inlinecrypt.c
index bd8e58a028c5..bcbf363c533a 100644
--- a/drivers/md/dm-inlinecrypt.c
+++ b/drivers/md/dm-inlinecrypt.c
@@ -386,7 +386,7 @@ static int inlinecrypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	dun_bytes = DIV_ROUND_UP(fls64(ctx->max_dun), 8);
 
 	err = blk_crypto_init_key(&ctx->key, raw_key, ctx->key_size,
-				  BLK_CRYPTO_KEY_TYPE_RAW,
+				  BLK_CRYPTO_KEY_TYPE_HW_WRAPPED,
 				  cipher->mode_num, dun_bytes,
 				  ctx->sector_size);
 	if (err) {
-- 
2.34.1