[PATCH] vhost: make cryptodev support optional

[PATCH] vhost: make cryptodev support optional

[David Marchand]

The vhost crypto part has seen CVEs in the past and is getting a lot of
eyes those days.

Contrary to the vhost async datapath code, the cryptodev code seems to
have active contributors, so dropping this code does not seem a good
thing.

This change here allows to keep this support, yet disable it for
uninterested parties.

Signed-off-by: David Marchand <david.marchand@redhat.com>
---
 lib/vhost/meson.build | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/lib/vhost/meson.build b/lib/vhost/meson.build
index 6a24981d10..93366a9609 100644
--- a/lib/vhost/meson.build
+++ b/lib/vhost/meson.build
@@ -30,7 +30,6 @@ sources = files(
         'vdpa.c',
         'vduse.c',
         'vhost.c',
-        'vhost_crypto.c',
         'vhost_user.c',
         'virtio_net.c',
         'virtio_net_ctrl.c',
@@ -39,9 +38,14 @@ headers = files(
         'rte_vdpa.h',
         'rte_vhost.h',
         'rte_vhost_async.h',
-        'rte_vhost_crypto.h',
 )
 driver_sdk_headers = files(
         'vdpa_driver.h',
 )
-deps += ['ethdev', 'cryptodev', 'hash', 'pci', 'dmadev']
+deps += ['ethdev', 'pci', 'dmadev']
+
+if dpdk_conf.has('RTE_LIB_CRYPTODEV')
+    sources += files('vhost_crypto.c')
+    headers += files('rte_vhost_crypto.h')
+    deps += ['cryptodev', 'hash']
+endif
-- 
2.54.0

Re: [PATCH] vhost: make cryptodev support optional

[Bruce Richardson]

On Wed, Oct 14, 2026 at 06:31:38PM +0200, David Marchand wrote:
> The vhost crypto part has seen CVEs in the past and is getting a lot of
> eyes those days.
> 
> Contrary to the vhost async datapath code, the cryptodev code seems to
> have active contributors, so dropping this code does not seem a good
> thing.
> 
> This change here allows to keep this support, yet disable it for
> uninterested parties.
> 
> Signed-off-by: David Marchand <david.marchand@redhat.com>
> ---
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

RE: [EXTERNAL] [PATCH] vhost: make cryptodev support optional

[Akhil Goyal]

> The vhost crypto part has seen CVEs in the past and is getting a lot of
> eyes those days.
> 
> Contrary to the vhost async datapath code, the cryptodev code seems to
> have active contributors, so dropping this code does not seem a good
> thing.
> 
> This change here allows to keep this support, yet disable it for
> uninterested parties.
> 
> Signed-off-by: David Marchand <david.marchand@redhat.com>
Acked-by: Akhil Goyal <gakhil@marvell.com>

Re: [PATCH] vhost: make cryptodev support optional

[Maxime Coquelin]

On 10/14/26 6:31 PM, David Marchand wrote:
> The vhost crypto part has seen CVEs in the past and is getting a lot of
> eyes those days.
>
> Contrary to the vhost async datapath code, the cryptodev code seems to
> have active contributors, so dropping this code does not seem a good
> thing.
>
> This change here allows to keep this support, yet disable it for
> uninterested parties.
>
> Signed-off-by: David Marchand <david.marchand@redhat.com>
> ---
>   lib/vhost/meson.build | 10 +++++++---
>   1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/lib/vhost/meson.build b/lib/vhost/meson.build
> index 6a24981d10..93366a9609 100644
> --- a/lib/vhost/meson.build
> +++ b/lib/vhost/meson.build
> @@ -30,7 +30,6 @@ sources = files(
>           'vdpa.c',
>           'vduse.c',
>           'vhost.c',
> -        'vhost_crypto.c',
>           'vhost_user.c',
>           'virtio_net.c',
>           'virtio_net_ctrl.c',
> @@ -39,9 +38,14 @@ headers = files(
>           'rte_vdpa.h',
>           'rte_vhost.h',
>           'rte_vhost_async.h',
> -        'rte_vhost_crypto.h',
>   )
>   driver_sdk_headers = files(
>           'vdpa_driver.h',
>   )
> -deps += ['ethdev', 'cryptodev', 'hash', 'pci', 'dmadev']
> +deps += ['ethdev', 'pci', 'dmadev']
> +
> +if dpdk_conf.has('RTE_LIB_CRYPTODEV')
> +    sources += files('vhost_crypto.c')
> +    headers += files('rte_vhost_crypto.h')
> +    deps += ['cryptodev', 'hash']
> +endif

Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>

Thanks,

Maxime

Re: [PATCH] vhost: make cryptodev support optional

[Maxime Coquelin]

On 10/14/26 6:31 PM, David Marchand wrote:
> The vhost crypto part has seen CVEs in the past and is getting a lot of
> eyes those days.
>
> Contrary to the vhost async datapath code, the cryptodev code seems to
> have active contributors, so dropping this code does not seem a good
> thing.
>
> This change here allows to keep this support, yet disable it for
> uninterested parties.
>
> Signed-off-by: David Marchand<david.marchand@redhat.com>
> ---
>   lib/vhost/meson.build | 10 +++++++---
>   1 file changed, 7 insertions(+), 3 deletions(-)

Applied to next-virtio/for-next-net.

Thanks,

Maxime