The following changes since commit 6fe4e4b8259e1330945b5f3c9476e08473b8e0e8:
fscrypt: Avoid dynamic allocation in fscrypt_get_devices() (2026-07-20 10:39:24 -0700) are available in the Git repository at: https://git.kernel.org/pub/scm/fs/fscrypt/linux.git tags/fscrypt-for-linus for you to fetch changes up to 7dd38d9dd7a05329825fe2324d4d8e27ad4b3cec: blk-crypto: Update docs for blk-crypto-fallback motivation (2026-07-20 10:39:26 -0700) ---------------------------------------------------------------- The main change this cycle is a significant simplification that's been overdue for a while now: standardizing on a single file contents encryption implementation in ext4 and f2fs, instead of having two. Specifically, the original filesystem-layer file contents encryption implementation is removed, and the blk-crypto implementation is now used unconditionally. blk-crypto delegates either to inline crypto hardware or to the CPU via blk-crypto-fallback. The latter is functionally equivalent to the original filesystem-layer code. The blk-crypto implementation already existed, but previously it was used only when the filesystem was mounted with "-o inlinecrypt". Now, "-o inlinecrypt" just selects whether inline crypto hardware is used. To allow maintaining that user control over hardware use, the blk-crypto API is extended with a new flag BLK_CRYPTO_CFG_ALLOW_HW. Overall, this removes quite a bit of redundant code from ext4, f2fs, and fs/crypto/. It should make things easier for ongoing filesystem efforts such as iomap support, large folios, and btrfs encryption. (btrfs had already been planning to use blk-crypto exclusively.) There are two small behavior changes of note: - Direct I/O now works on encrypted files even without "-o inlinecrypt", rather than falling back to buffered I/O. This is effectively a bugfix, though I'll continue to keep an eye out for any user that may have been depending on the buffered I/O fallback. - IV_INO_LBLK_32 policies are no longer supported in certain cases that didn't make sense and have no known uses. This has been in linux-next since July 22 with no reported issues. All encryption xfstests pass on ext4 and f2fs. As usual I've also been using it on a system with an fscrypt-encrypted home directory. Of course, the blk-crypto code paths also aren't new and were already being used on many systems via the inlinecrypt mount option. In addition to the main change described above, there are a few other cleanups such as using lock guards for mutexes, improving documentation, and removing a workaround for outdated gcc versions. ---------------------------------------------------------------- Eric Biggers (29): fscrypt: Use lock guards for mutexes fscrypt: Remove FSCRYPT_MODE_MAX fscrypt: Simplify handling of errors during initcall fscrypt: Remove workaround for bug in gcc 7 and earlier blk-crypto: Simplify check for fallback support blk-crypto: Fold __blk_crypto_cfg_supported() into its caller blk-crypto: Allow control over whether hardware is used fscrypt: Fully disallow IV_INO_LBLK_32 with s_blocksize != PAGE_SIZE fscrypt: Always use blk-crypto for contents on block-based filesystems Documentation: fscrypt: Update docs for inlinecrypt ext4: Remove fs-layer file contents en/decryption code ext4: Make ext4_bio_write_folio() return void ext4: Further de-generalize the bio postprocessing code f2fs: Remove fs-layer file contents en/decryption code fs/buffer: Remove fs-layer decryption code fscrypt: Replace calls to fscrypt_inode_uses_inline_crypto() fscrypt: Remove fscrypt_dio_supported() fscrypt: Remove fs-layer zeroout code fscrypt: Remove unused functions and workqueue fscrypt: Merge bio.c and inline_crypt.c into block.c fscrypt: Add safety checks to non-block-based en/decryption fscrypt: Replace some variable-size memsets with fixed-size fscrypt: Update encryption policy version docs fs: Update outdated comment for SB_INLINECRYPT f2fs: Update outdated comment in f2fs_write_begin() fscrypt: Remove unused function fscrypt_finalize_bounce_page() fscrypt: Update docs for data path blk-crypto: Remove unused function blk_crypto_config_supported() blk-crypto: Update docs for blk-crypto-fallback motivation Documentation/admin-guide/ext4.rst | 8 +- Documentation/block/inline-encryption.rst | 43 ++--- Documentation/filesystems/f2fs.rst | 10 +- Documentation/filesystems/fscrypt.rst | 154 +++++++-------- arch/loongarch/configs/loongson32_defconfig | 1 - arch/loongarch/configs/loongson64_defconfig | 1 - block/blk-crypto-fallback.c | 3 +- block/blk-crypto-internal.h | 3 - block/blk-crypto-profile.c | 22 --- block/blk-crypto.c | 46 +++-- drivers/md/dm-inlinecrypt.c | 3 +- fs/buffer.c | 45 +---- fs/crypto/Kconfig | 8 +- fs/crypto/Makefile | 3 +- fs/crypto/bio.c | 216 --------------------- fs/crypto/{inline_crypt.c => block.c} | 279 ++++++++++++++-------------- fs/crypto/crypto.c | 180 ++++++------------ fs/crypto/fscrypt_private.h | 33 +--- fs/crypto/keyring.c | 21 +-- fs/crypto/keysetup.c | 63 ++----- fs/crypto/keysetup_v1.c | 2 +- fs/crypto/policy.c | 34 ++-- fs/ext4/crypto.c | 2 +- fs/ext4/ext4.h | 6 +- fs/ext4/inode.c | 71 ++----- fs/ext4/page-io.c | 74 +------- fs/ext4/readpage.c | 139 ++++---------- fs/ext4/super.c | 6 +- fs/f2fs/compress.c | 31 +--- fs/f2fs/data.c | 95 +--------- fs/f2fs/f2fs.h | 2 - fs/f2fs/file.c | 6 +- fs/f2fs/segment.c | 2 - fs/f2fs/super.c | 2 +- include/linux/blk-crypto.h | 15 +- include/linux/fs/super_types.h | 2 +- include/linux/fscrypt.h | 107 ++--------- include/uapi/linux/fscrypt.h | 1 - tools/include/uapi/linux/fscrypt.h | 1 - 39 files changed, 494 insertions(+), 1246 deletions(-) delete mode 100644 fs/crypto/bio.c rename fs/crypto/{inline_crypt.c => block.c} (61%)
