Re: [PATCH v2 7/8] docs: deprecate virtio-crypto

["Michael S. Tsirkin" <mst@redhat.com>]

On Mon, Aug 24, 2026 at 04:24:54PM +0100, Alex Bennée wrote:
> We have outstanding guest exploitable bugs in the code which is fairly
> complex and needs some serious love to clean it up. As off-CPU
> cryptography acceleration seems to be waning in popularity lets just
> the deprecate the sub-system with a view to removing it in a couple of
> cycles.
> 
> We can also remove the backend code at that point as well.
> 
> Link: https://gitlab.com/qemu-project/qemu/-/work_items/3625
> Reviewed-by: Mohamed Mediouni <mohamed@unpredictable.fr>
> Reviewed-by: Thomas Huth <thuth@redhat.com>
> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>

Acked-by: Michael S. Tsirkin <mst@redhat.com>

I am assuming it will be merged with the rest of it?

> ---
> v2
>   - mention the backend bits (only used by virtio-crypto)
>   - use Gonglei's modified version of the text
> ---
>  docs/about/deprecated.rst | 18 ++++++++++++++++++
>  1 file changed, 18 insertions(+)
> 
> diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
> index 0c656a968fc..05e4ce8cf16 100644
> --- a/docs/about/deprecated.rst
> +++ b/docs/about/deprecated.rst
> @@ -276,6 +276,24 @@ future release. Where no 'dh-params.pem' file is provided, the DH
>  parameters will be automatically negotiated in accordance with
>  RFC7919.
>  
> +Devices
> +-------
> +
> +``virtio-crypto`` and cryptodev backends (since 11.2)
> +'''''''''''''''''''''''''''''''''''''''''''''''''''''
> +
> +The ``virtio-crypto`` device emulation is quite complex code with a
> +number of known flaws. It has never been migratable, so it is
> +unlikely to be used in any serious virtualization setting. Modern
> +ISAs provide on-CPU cryptography instructions (e.g. AES-NI/VAES,
> +armv8 crypto extensions), and the Linux kernel deprecated AF_ALG
> +and dropped its off-CPU accelerator support in Linux 7.2, removing
> +the primary userspace path for off-CPU crypto acceleration. The
> +time for this sort of off-load has passed.
> +
> +As this is the only device that uses the cryptodev backends these will
> +be removed at the same time the ``virtio-crypto`` device is.
> +
>  Device options
>  --------------
>  
> 
> -- 
> 2.47.3