On Thu, Aug 27, 2026 at 09:07:10AM -0700, Linlin Zhang wrote: > From: linlzhan <[email protected]> > > Negotiate VIRTIO_BLK_F_INLINE_ENCRYPTION with the host and wire it into > the block layer's inline-crypto framework to enable inline encryption > on virtio block device. > > When the feature is present, the driver reads crypto characteristics from > virtio config space (key-slot count, DUN size, supported key types) and > issues VIRTIO_BLK_T_GET_CRYPTO_MODES to discover supported cipher and > data-unit-size combinations. Encrypted requests use new request types > VIRTIO_BLK_T_CRYPTO_IN/OUT, which append a virtio_blk_crypto_msg > (keyslot index, DUN, data-unit-size-bits) to the standard outhdr. > > A new virtio block crypto extension driver (virtio_blk_crypto_ext), > owns the blk_crypto_profile singleton and the blk_crypto_ll_ops dispatch > table. Actual key operations are forwarded to a platform-specific > backend registered via virtblk_set_crypto_ops(); without one, > VIRTIO_BLK_F_INLINE_ENCRYPTION is still negotiated and the > profile is registered, but every keyslot operation returns -EOPNOTSUPP. > > The shared profile is a singleton as per blk_crypto_profile is > corresponding to one ICE hardware: the first device to negotiate the > feature initializes it; subsequent devices reuse it only when their > negotiated capabilities (slot count, DUN size, key types) match exactly. > > Signed-off-by: linlzhan <[email protected]> > --- > drivers/block/Kconfig | 13 ++ > drivers/block/Makefile | 2 + > drivers/block/virtio_blk.c | 199 ++++++++++++++++-- > drivers/block/virtio_blk_crypto_ext.c | 283 ++++++++++++++++++++++++++ > include/linux/virtio_blk_crypto_ext.h | 78 +++++++ > include/uapi/linux/virtio_blk.h | 62 ++++++ > 6 files changed, 623 insertions(+), 14 deletions(-) > create mode 100644 drivers/block/virtio_blk_crypto_ext.c > create mode 100644 include/linux/virtio_blk_crypto_ext.h
Thanks for sending this as we discuss the VIRTIO spec changes. Although it's nice to have all the Linux patches together, there are two separate parts: 1. the virtio_blk.ko guest driver changes and 2. the hypervisor blk-crypto uapi. I suggest splitting this into two patch series to avoid confusion between these parts. It may also make review and merging easier if we stay focussed on just the guest or just the host parts. Stefan
signature.asc
Description: PGP signature
