On Wed, Jul 22, 2026 at 03:03:16PM +0200, Cédric Le Goater wrote:
On 7/22/26 13:57, Daniel P. Berrangé via Devel wrote:
Linux 7.1 has deprecated the AF_ALG crypto backend:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
And has documented it to be always slower than userspace crypto:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
as a result of dropping support for zero-copy and hardware accelerators:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
The main use case for the AF_ALG impl was to improve the performance of virtio-crypto with the cryptodev-backend-builtin driver. In practice this did not matter since 'cryptodev-backend-lkcf' can do offload to the kernel via the keyctl syscall, and 'cryptodev-vhost-user' can offload to an external process which can optionally integrate with hardware accelerators without kernel assistance.
The AF_ALG backend has no user visible configuration options at runtime, it is unconditionally tried with any use of the cipher APIs. So it does not strictly have to go through the deprecation process, however, it is left available initially in case there was an unexpected use case that relies on it which may be faster with old kernels before the above Linux commits.
Suggested-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> --- docs/about/deprecated.rst | 21 +++++++++++++++++++++ meson.build | 6 ++++++ 2 files changed, 27 insertions(+)
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 0c656a968f..54b2662752 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -416,6 +416,27 @@ ABI is long-obsolete. We are therefore deprecating both OABI support and NWFPE emulation, and they will be removed in a future QEMU release. +Build features +-------------- + +Crypto AF_ALG backend +---------------------
Crypto AF_ALG backend (since 11.1) ''''''''''''''''''''''''''''''''''
?
Oppps, yes, of course it needs a version :-)
With that,
Reviewed-by: Cédric Le Goater <clg@redhat.com>
With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|