Re: [PATCH v2 3/3] dm: add documentation for dm-inlinecrypt target

[Milan Broz <gmazyland@gmail.com>]

On 4/10/26 3:40 PM, Linlin Zhang wrote:
> This adds the admin-guide documentation for dm-inlinecrypt.
> 
> dm-inlinecrypt.rst is the guide to using dm-inlinecrypt.
> 
> Signed-off-by: Linlin Zhang <linlin.zhang@oss.qualcomm.com>
> ---

...

> +
> +<cipher>
> +    Encryption cipher type.
> +
> +    The cipher specifications format is::
> +
> +       cipher
> +
> +    Examples::
> +
> +       aes-xts-plain64
> +
> +    The cipher type is correspond one-to-one with encryption modes. For

... with encryption modes supported for inline crypto in block layer?

In your patch only BLK_ENCRYPTION_MODE_AES_256_XTS.

> +    instance, the corresponding crypto mode of aes-xts-plain64 is
> +    BLK_ENCRYPTION_MODE_AES_256_XTS.

...

> +iv_large_sectors
> +   IV generators will use sector number counted in <sector_size> units
> +   instead of default 512 bytes sectors.
> +
> +   For example, if <sector_size> is 4096 bytes, plain64 IV for the second
> +   sector will be 8 (without flag) and 1 if iv_large_sectors is present.
> +   The <iv_offset> must be multiple of <sector_size> (in 512 bytes units)
> +   if this flag is specified.

Is it true? I see this comment in the code:

/* dm-inlinecrypt doesn't implement iv_large_sectors=false. */

...

> +Example scripts
> +===============
> +LUKS (Linux Unified Key Setup) is now the preferred way to set up disk
> +encryption with dm-inlinecrypt using the 'cryptsetup' utility, see
> +https://gitlab.com/cryptsetup/cryptsetup

Cryptsetup has no support for inlinecrypt and it is question if it should have.
It would require additional options and maybe LUKS2 metadata flag to make it persistent.

How did you test it? Please remove this cryptsetup example.
It can be added later when userspace get this functionality.

...> +
> +	#!/bin/sh
> +	# Create a inlinecrypt device using cryptsetup and LUKS header with default cipher
> +	cryptsetup luksFormat $1
> +	cryptsetup luksOpen $1 inlinecrypt1

ditto. This example will use dm-crypt, not dm-inlinecrypt.

Milan