On 9/2/2026 3:48 AM, Stefan Hajnoczi wrote:
> On Thu, Aug 27, 2026 at 09:07:10AM -0700, Linlin Zhang wrote:
>> From: linlzhan <[email protected]>
>>
>> Negotiate VIRTIO_BLK_F_INLINE_ENCRYPTION with the host and wire it into
>> the block layer's inline-crypto framework to enable inline encryption
>> on virtio block device.
>>
>> When the feature is present, the driver reads crypto characteristics from
>> virtio config space (key-slot count, DUN size, supported key types) and
>> issues VIRTIO_BLK_T_GET_CRYPTO_MODES to discover supported cipher and
>> data-unit-size combinations. Encrypted requests use new request types
>> VIRTIO_BLK_T_CRYPTO_IN/OUT, which append a virtio_blk_crypto_msg
>> (keyslot index, DUN, data-unit-size-bits) to the standard outhdr.
>>
>> A new virtio block crypto extension driver (virtio_blk_crypto_ext),
>> owns the blk_crypto_profile singleton and the blk_crypto_ll_ops dispatch
>> table. Actual key operations are forwarded to a platform-specific
>> backend registered via virtblk_set_crypto_ops(); without one,
>> VIRTIO_BLK_F_INLINE_ENCRYPTION is still negotiated and the
>> profile is registered, but every keyslot operation returns -EOPNOTSUPP.
>>
>> The shared profile is a singleton as per blk_crypto_profile is
>> corresponding to one ICE hardware: the first device to negotiate the
>> feature initializes it; subsequent devices reuse it only when their
>> negotiated capabilities (slot count, DUN size, key types) match exactly.
>>
>> Signed-off-by: linlzhan <[email protected]>
>> ---
>> drivers/block/Kconfig | 13 ++
>> drivers/block/Makefile | 2 +
>> drivers/block/virtio_blk.c | 199 ++++++++++++++++--
>> drivers/block/virtio_blk_crypto_ext.c | 283 ++++++++++++++++++++++++++
>> include/linux/virtio_blk_crypto_ext.h | 78 +++++++
>> include/uapi/linux/virtio_blk.h | 62 ++++++
>> 6 files changed, 623 insertions(+), 14 deletions(-)
>> create mode 100644 drivers/block/virtio_blk_crypto_ext.c
>> create mode 100644 include/linux/virtio_blk_crypto_ext.h
>
> Thanks for sending this as we discuss the VIRTIO spec changes.
>
> Although it's nice to have all the Linux patches together, there are two
> separate parts: 1. the virtio_blk.ko guest driver changes and 2. the
> hypervisor blk-crypto uapi. I suggest splitting this into two patch
> series to avoid confusion between these parts. It may also make review
> and merging easier if we stay focussed on just the guest or just the
> host parts.
Thanks for the comments!
I can separate them as 2 patch series in next patch.
>
> Stefan
