On Mon, Aug 24, 2026 at 04:24:54PM +0100, Alex Bennée wrote: > We have outstanding guest exploitable bugs in the code which is fairly > complex and needs some serious love to clean it up. As off-CPU > cryptography acceleration seems to be waning in popularity lets just > the deprecate the sub-system with a view to removing it in a couple of > cycles. > > We can also remove the backend code at that point as well. > > Link: https://gitlab.com/qemu-project/qemu/-/work_items/3625 > Reviewed-by: Mohamed Mediouni <[email protected]> > Reviewed-by: Thomas Huth <[email protected]> > Signed-off-by: Alex Bennée <[email protected]>
Acked-by: Michael S. Tsirkin <[email protected]> I am assuming it will be merged with the rest of it? > --- > v2 > - mention the backend bits (only used by virtio-crypto) > - use Gonglei's modified version of the text > --- > docs/about/deprecated.rst | 18 ++++++++++++++++++ > 1 file changed, 18 insertions(+) > > diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst > index 0c656a968fc..05e4ce8cf16 100644 > --- a/docs/about/deprecated.rst > +++ b/docs/about/deprecated.rst > @@ -276,6 +276,24 @@ future release. Where no 'dh-params.pem' file is > provided, the DH > parameters will be automatically negotiated in accordance with > RFC7919. > > +Devices > +------- > + > +``virtio-crypto`` and cryptodev backends (since 11.2) > +''''''''''''''''''''''''''''''''''''''''''''''''''''' > + > +The ``virtio-crypto`` device emulation is quite complex code with a > +number of known flaws. It has never been migratable, so it is > +unlikely to be used in any serious virtualization setting. Modern > +ISAs provide on-CPU cryptography instructions (e.g. AES-NI/VAES, > +armv8 crypto extensions), and the Linux kernel deprecated AF_ALG > +and dropped its off-CPU accelerator support in Linux 7.2, removing > +the primary userspace path for off-CPU crypto acceleration. The > +time for this sort of off-load has passed. > + > +As this is the only device that uses the cryptodev backends these will > +be removed at the same time the ``virtio-crypto`` device is. > + > Device options > -------------- > > > -- > 2.47.3
