[PATCH for 11.1] crypto: deprecate the AF_ALG crypto backend

[PATCH for 11.1] crypto: deprecate the AF_ALG crypto backend

[Daniel P. Berrangé]

Linux 7.1 has deprecated the AF_ALG crypto backend:

  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a67afb1884ba815079bd43d5c998e155e03b08b6

And has documented it to be always slower than userspace crypto:

  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5624ea54f3ba5c83d2e5503411a31a8be0278c1e

as a result of dropping support for zero-copy and hardware
accelerators:

  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7524070f26d8d347c26787dc297fb844baa26abf
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ffdd2bc378953b525aca61902534e753f1f8e734

The main use case for the AF_ALG impl was to improve the performance
of virtio-crypto with the cryptodev-backend-builtin driver. In
practice this did not matter since 'cryptodev-backend-lkcf' can do
offload to the kernel via the keyctl syscall, and 'cryptodev-vhost-user'
can offload to an external process which can optionally integrate with
hardware accelerators without kernel assistance.

The AF_ALG backend has no user visible configuration options at runtime,
it is unconditionally tried with any use of the cipher APIs. So it does
not strictly have to go through the deprecation process, however, it is
left available initially in case there was an unexpected use case that
relies on it which may be faster with old kernels before the above Linux
commits.

Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 docs/about/deprecated.rst | 21 +++++++++++++++++++++
 meson.build               |  6 ++++++
 2 files changed, 27 insertions(+)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 0c656a968f..54b2662752 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -416,6 +416,27 @@ ABI is long-obsolete. We are therefore deprecating both OABI support
 and NWFPE emulation, and they will be removed in a future QEMU
 release.
 
+Build features
+--------------
+
+Crypto AF_ALG backend
+---------------------
+
+The use of the AF_ALG backend for cryptography has been deprecated
+with no replacement.
+
+The AF_ALG interface is deprecated by Linux 7.1 and all support
+for hardware accelerators has been removed. It will thus always be
+slower than userspace crypto due to the overhead of copying data
+to kernel space. The GNUTLS, Nettle and GCrypt libraries supported
+by QEMU all include a variety of hardware optimized crypto
+implementations which should suffice for typical needs.
+
+For the virtio-crypto device, the 'cryptodev-backend-lkcf' backend
+can offload some operations to the kernel via the keyctl syscall,
+and the 'cryptodev-vhost-user' backend can offload the device
+backend to an external process which can integrate with crypto
+accelerators.
 
 Backwards compatibility
 -----------------------
diff --git a/meson.build b/meson.build
index 164328ded8..02cbe6445a 100644
--- a/meson.build
+++ b/meson.build
@@ -5053,3 +5053,9 @@ if not actually_reloc and (host_os == 'windows' or get_option('relocatable'))
   message('QEMU will have to be installed under ' + get_option('prefix') + '.')
   message('Use --disable-relocatable to remove this warning.')
 endif
+
+if get_option('crypto_afalg').enabled()
+    warning('Use of the AF_ALG crypto backend is deprecated, ' +
+            'since Linux 7.1 has deprecated the AF_ALG interface ' +
+            'and removed its ability to use hardware accelerators.')
+endif
-- 
2.55.0

Re: [PATCH for 11.1] crypto: deprecate the AF_ALG crypto backend

[Philippe Mathieu-Daudé]

On 22/7/26 13:57, Daniel P. Berrangé wrote:
> Linux 7.1 has deprecated the AF_ALG crypto backend:
> 
>    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a67afb1884ba815079bd43d5c998e155e03b08b6
> 
> And has documented it to be always slower than userspace crypto:
> 
>    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5624ea54f3ba5c83d2e5503411a31a8be0278c1e
> 
> as a result of dropping support for zero-copy and hardware
> accelerators:
> 
>    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7524070f26d8d347c26787dc297fb844baa26abf
>    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ffdd2bc378953b525aca61902534e753f1f8e734
> 
> The main use case for the AF_ALG impl was to improve the performance
> of virtio-crypto with the cryptodev-backend-builtin driver. In
> practice this did not matter since 'cryptodev-backend-lkcf' can do
> offload to the kernel via the keyctl syscall, and 'cryptodev-vhost-user'
> can offload to an external process which can optionally integrate with
> hardware accelerators without kernel assistance.
> 
> The AF_ALG backend has no user visible configuration options at runtime,
> it is unconditionally tried with any use of the cipher APIs. So it does
> not strictly have to go through the deprecation process, however, it is
> left available initially in case there was an unexpected use case that
> relies on it which may be faster with old kernels before the above Linux
> commits.
> 
> Suggested-by: Thomas Huth <thuth@redhat.com>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>   docs/about/deprecated.rst | 21 +++++++++++++++++++++
>   meson.build               |  6 ++++++
>   2 files changed, 27 insertions(+)

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

Re: [PATCH for 11.1] crypto: deprecate the AF_ALG crypto backend

[Cédric Le Goater]

On 7/22/26 13:57, Daniel P. Berrangé via Devel wrote:
> Linux 7.1 has deprecated the AF_ALG crypto backend:
> 
>    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a67afb1884ba815079bd43d5c998e155e03b08b6
> 
> And has documented it to be always slower than userspace crypto:
> 
>    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5624ea54f3ba5c83d2e5503411a31a8be0278c1e
> 
> as a result of dropping support for zero-copy and hardware
> accelerators:
> 
>    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7524070f26d8d347c26787dc297fb844baa26abf
>    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ffdd2bc378953b525aca61902534e753f1f8e734
> 
> The main use case for the AF_ALG impl was to improve the performance
> of virtio-crypto with the cryptodev-backend-builtin driver. In
> practice this did not matter since 'cryptodev-backend-lkcf' can do
> offload to the kernel via the keyctl syscall, and 'cryptodev-vhost-user'
> can offload to an external process which can optionally integrate with
> hardware accelerators without kernel assistance.
> 
> The AF_ALG backend has no user visible configuration options at runtime,
> it is unconditionally tried with any use of the cipher APIs. So it does
> not strictly have to go through the deprecation process, however, it is
> left available initially in case there was an unexpected use case that
> relies on it which may be faster with old kernels before the above Linux
> commits.
> 
> Suggested-by: Thomas Huth <thuth@redhat.com>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>   docs/about/deprecated.rst | 21 +++++++++++++++++++++
>   meson.build               |  6 ++++++
>   2 files changed, 27 insertions(+)
> 
> diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
> index 0c656a968f..54b2662752 100644
> --- a/docs/about/deprecated.rst
> +++ b/docs/about/deprecated.rst
> @@ -416,6 +416,27 @@ ABI is long-obsolete. We are therefore deprecating both OABI support
>   and NWFPE emulation, and they will be removed in a future QEMU
>   release.
>   
> +Build features
> +--------------
> +
> +Crypto AF_ALG backend
> +---------------------


   Crypto AF_ALG backend (since 11.1)
   ''''''''''''''''''''''''''''''''''

?

With that,

Reviewed-by: Cédric Le Goater <clg@redhat.com>

Thanks,

C.


> +
> +The use of the AF_ALG backend for cryptography has been deprecated
> +with no replacement.
> +
> +The AF_ALG interface is deprecated by Linux 7.1 and all support
> +for hardware accelerators has been removed. It will thus always be
> +slower than userspace crypto due to the overhead of copying data
> +to kernel space. The GNUTLS, Nettle and GCrypt libraries supported
> +by QEMU all include a variety of hardware optimized crypto
> +implementations which should suffice for typical needs.
> +
> +For the virtio-crypto device, the 'cryptodev-backend-lkcf' backend
> +can offload some operations to the kernel via the keyctl syscall,
> +and the 'cryptodev-vhost-user' backend can offload the device
> +backend to an external process which can integrate with crypto
> +accelerators.
>   
>   Backwards compatibility
>   -----------------------
> diff --git a/meson.build b/meson.build
> index 164328ded8..02cbe6445a 100644
> --- a/meson.build
> +++ b/meson.build
> @@ -5053,3 +5053,9 @@ if not actually_reloc and (host_os == 'windows' or get_option('relocatable'))
>     message('QEMU will have to be installed under ' + get_option('prefix') + '.')
>     message('Use --disable-relocatable to remove this warning.')
>   endif
> +
> +if get_option('crypto_afalg').enabled()
> +    warning('Use of the AF_ALG crypto backend is deprecated, ' +
> +            'since Linux 7.1 has deprecated the AF_ALG interface ' +
> +            'and removed its ability to use hardware accelerators.')
> +endif

Re: [PATCH for 11.1] crypto: deprecate the AF_ALG crypto backend

[Daniel P. Berrangé]

On Wed, Jul 22, 2026 at 03:03:16PM +0200, Cédric Le Goater wrote:
> On 7/22/26 13:57, Daniel P. Berrangé via Devel wrote:
> > Linux 7.1 has deprecated the AF_ALG crypto backend:
> > 
> >    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a67afb1884ba815079bd43d5c998e155e03b08b6
> > 
> > And has documented it to be always slower than userspace crypto:
> > 
> >    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5624ea54f3ba5c83d2e5503411a31a8be0278c1e
> > 
> > as a result of dropping support for zero-copy and hardware
> > accelerators:
> > 
> >    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7524070f26d8d347c26787dc297fb844baa26abf
> >    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ffdd2bc378953b525aca61902534e753f1f8e734
> > 
> > The main use case for the AF_ALG impl was to improve the performance
> > of virtio-crypto with the cryptodev-backend-builtin driver. In
> > practice this did not matter since 'cryptodev-backend-lkcf' can do
> > offload to the kernel via the keyctl syscall, and 'cryptodev-vhost-user'
> > can offload to an external process which can optionally integrate with
> > hardware accelerators without kernel assistance.
> > 
> > The AF_ALG backend has no user visible configuration options at runtime,
> > it is unconditionally tried with any use of the cipher APIs. So it does
> > not strictly have to go through the deprecation process, however, it is
> > left available initially in case there was an unexpected use case that
> > relies on it which may be faster with old kernels before the above Linux
> > commits.
> > 
> > Suggested-by: Thomas Huth <thuth@redhat.com>
> > Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> > ---
> >   docs/about/deprecated.rst | 21 +++++++++++++++++++++
> >   meson.build               |  6 ++++++
> >   2 files changed, 27 insertions(+)
> > 
> > diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
> > index 0c656a968f..54b2662752 100644
> > --- a/docs/about/deprecated.rst
> > +++ b/docs/about/deprecated.rst
> > @@ -416,6 +416,27 @@ ABI is long-obsolete. We are therefore deprecating both OABI support
> >   and NWFPE emulation, and they will be removed in a future QEMU
> >   release.
> > +Build features
> > +--------------
> > +
> > +Crypto AF_ALG backend
> > +---------------------
> 
> 
>   Crypto AF_ALG backend (since 11.1)
>   ''''''''''''''''''''''''''''''''''
> 
> ?

Oppps, yes, of course it needs a version :-)

> 
> With that,
> 
> Reviewed-by: Cédric Le Goater <clg@redhat.com>
> 

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|

Re: [PATCH for 11.1] crypto: deprecate the AF_ALG crypto backend

[Daniel P. Berrangé]

On Wed, Jul 22, 2026 at 12:57:00PM +0100, Daniel P. Berrangé wrote:
> Linux 7.1 has deprecated the AF_ALG crypto backend:

^^^^ should say 7.2

and likewise later in the patch

> 
>   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a67afb1884ba815079bd43d5c998e155e03b08b6
> 
> And has documented it to be always slower than userspace crypto:
> 
>   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5624ea54f3ba5c83d2e5503411a31a8be0278c1e
> 
> as a result of dropping support for zero-copy and hardware
> accelerators:
> 
>   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7524070f26d8d347c26787dc297fb844baa26abf
>   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ffdd2bc378953b525aca61902534e753f1f8e734
> 
> The main use case for the AF_ALG impl was to improve the performance
> of virtio-crypto with the cryptodev-backend-builtin driver. In
> practice this did not matter since 'cryptodev-backend-lkcf' can do
> offload to the kernel via the keyctl syscall, and 'cryptodev-vhost-user'
> can offload to an external process which can optionally integrate with
> hardware accelerators without kernel assistance.
> 
> The AF_ALG backend has no user visible configuration options at runtime,
> it is unconditionally tried with any use of the cipher APIs. So it does
> not strictly have to go through the deprecation process, however, it is
> left available initially in case there was an unexpected use case that
> relies on it which may be faster with old kernels before the above Linux
> commits.
> 
> Suggested-by: Thomas Huth <thuth@redhat.com>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  docs/about/deprecated.rst | 21 +++++++++++++++++++++
>  meson.build               |  6 ++++++
>  2 files changed, 27 insertions(+)
> 
> diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
> index 0c656a968f..54b2662752 100644
> --- a/docs/about/deprecated.rst
> +++ b/docs/about/deprecated.rst
> @@ -416,6 +416,27 @@ ABI is long-obsolete. We are therefore deprecating both OABI support
>  and NWFPE emulation, and they will be removed in a future QEMU
>  release.
>  
> +Build features
> +--------------
> +
> +Crypto AF_ALG backend
> +---------------------
> +
> +The use of the AF_ALG backend for cryptography has been deprecated
> +with no replacement.
> +
> +The AF_ALG interface is deprecated by Linux 7.1 and all support
> +for hardware accelerators has been removed. It will thus always be
> +slower than userspace crypto due to the overhead of copying data
> +to kernel space. The GNUTLS, Nettle and GCrypt libraries supported
> +by QEMU all include a variety of hardware optimized crypto
> +implementations which should suffice for typical needs.
> +
> +For the virtio-crypto device, the 'cryptodev-backend-lkcf' backend
> +can offload some operations to the kernel via the keyctl syscall,
> +and the 'cryptodev-vhost-user' backend can offload the device
> +backend to an external process which can integrate with crypto
> +accelerators.
>  
>  Backwards compatibility
>  -----------------------
> diff --git a/meson.build b/meson.build
> index 164328ded8..02cbe6445a 100644
> --- a/meson.build
> +++ b/meson.build
> @@ -5053,3 +5053,9 @@ if not actually_reloc and (host_os == 'windows' or get_option('relocatable'))
>    message('QEMU will have to be installed under ' + get_option('prefix') + '.')
>    message('Use --disable-relocatable to remove this warning.')
>  endif
> +
> +if get_option('crypto_afalg').enabled()
> +    warning('Use of the AF_ALG crypto backend is deprecated, ' +
> +            'since Linux 7.1 has deprecated the AF_ALG interface ' +
> +            'and removed its ability to use hardware accelerators.')
> +endif
> -- 
> 2.55.0
> 

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|