> On 19. Aug 2026, at 11:22, Alex Bennée <[email protected]> wrote:
>
> We have outstanding guest exploitable bugs in the code which is fairly
> complex and needs some serious love to clean it up. As off-CPU
> cryptography acceleration seems to be waning in popularity lets just
> deprecate the sub-system with a view to removing it in a couple of
> cycles.
Hi,
Still quite powerful compared to on-core acceleration, the kernel
isn’t a great example on how to use them well unfortunately.
Far better experience in production with DPDK and directly passing
through the crypto accelerator to the process that uses it directly.
virtio-crypto with its overhead makes things even worse on that front so…
In practice, the vmexits did cost so much that it was quicker to do it
in software...
>
>
> Link: https://gitlab.com/qemu-project/qemu/-/work_items/3625
> Signed-off-by: Alex Bennée <[email protected]>
> Cc: Gonglei <[email protected]>
Unfortunate but it wasn’t useful as is, so,
Reviewed-by: Mohamed Mediouni <[email protected]>
> ---
> docs/about/deprecated.rst | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
> diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
> index 0c656a968fc..3c22981fc8a 100644
> --- a/docs/about/deprecated.rst
> +++ b/docs/about/deprecated.rst
> @@ -276,6 +276,20 @@ future release. Where no 'dh-params.pem' file is
> provided, the DH
> parameters will be automatically negotiated in accordance with
> RFC7919.
>
> +Devices
> +-------
> +
> +``virtio-crypto`` (since 11.2)
> +''''''''''''''''''''''''''''''
> +
> +The ``virtio-crypto`` device emulation is quite complex code with a
> +number of known flaws. It has never been migratable so is unlikely to
> +be used in any serious virtualization setting. With most modern
> +systems supporting on-CPU cryptography acceleration via their
> +ISAs sets the need for off-CPU acceleration is also reduced. Add to
> +that the kernel has recently removed the ability to use off-CPU
> +acceleration suggests the time for this sort of off-load has passed.
> +
> Device options
> --------------
>
>
> --
> 2.47.3
>
>
