Re: [PATCH v3 0/2] virtio-blk: Add inline encryption support

["Michael S. Tsirkin" <mst@redhat.com>]

First, this needs to be reposed to virtio-comment.

On Sun, Sep 13, 2026 at 09:16:13AM -0700, Linlin Zhang wrote:
> From: linlzhan <linlin.zhang@oss.qualcomm.com>
> 
> This series adds virtio-blk inline encryption support for devices backed
> by storage hardware with an inline crypto engine.
> 
> The protocol exposes device capabilities such as keyslot count, maximum
> DUN size, and supported key types. Encrypted requests identify a
> provisioned keyslot and carry a 256-bit DUN. Key management and crypto
> capability discovery use the block device control virtqueue.
> 
> The control virtqueue is defined as a generic framework so that its
> buffer layout and queue placement are independent of any particular
> control command. Inline encryption then builds on this framework with
> explicit crypto command formats, capability validation, and keyslot
> state semantics.
> 
> All key related operatios are handled in the control virtqueue, and
> the crypto I/O request is handled in the request queue.
> 
> For background on inline encryption in UFS and eMMC storage, see:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/block/inline-encryption.rst


What I worry about, is that after all the effort, virtio
crypto is being deprecated upstream.

So please tell us:
- how do we know this will be different?
- what was the response in upstream linux?
- what are some plans for use of this?

I also feel this needs a security section, given how
security sensitive this can be. E.g. is this safe to
enable for confidential computing guests?

Thanks!

> changes in v3:
>  - Add a control virtqueue
>  - Move key program/evict/derive_sw_secret/generate/prepare/import to
>    the control virtqueue
>  - Add the driver and device requirements for the request in the control
>    virtqueue
>  - Extend DUN in crypto message to a fixed four-element array of 64-bit
>    fields 
> 
> changes in v2:
>  - Revmove virtualization-specific terminology
>  - Move MUST sentence to the device/driver normative section
>  - Add explicit rejection for CRYPTO request if IE feature bit
>    isn't negociated
>  - Modify the support list of crypto modes and the definition of
>    the size of the crypto modes buffer
> ---
> 
> linlzhan (2):
>   virtio-blk: Add the control virtqueue
>   virtio-blk: Add inline encryption support
> 
>  device-types/blk/description.tex | 457 +++++++++++++++++++++++++++++--
>  1 file changed, 441 insertions(+), 16 deletions(-)
> 
> -- 
> 2.34.1
>