Re: [PATCH v1 00/11] FBE virtualization: inline encryption for virtio-blk guests

[Eric Biggers]

On Thu, Aug 27, 2026 at 09:07:09AM -0700, Linlin Zhang wrote:
> From: linlzhan <linlin.zhang@xxxxxxxxxxxxxxxx>
> 
> Current virtio-blk does not provide a mechanism for a guest to
> program hardware keys or submit encrypted I/O using pre-programmed
> keyslots.  It drops the crypto context when issuing a bio request
> to the virtio-blk queue, preventing inline-encryption-based FBE
> on virtio block devices.
> 
> This series enables File-Based Encryption in guest VMs on Qualcomm
> GVM platforms where the ICE inline encryption hardware is shared
> between the host and guests.  In this environment the guest kernel
> has no access to the ICE hardware directly; it supplies a virtual
> keyslot index and data unit number with each encrypted I/O request
> via VIRTIO_BLK_F_INLINE_ENCRYPTION, and the host must translate the
> virtual slot to a physical ICE keyslot and submit the bio — without
> transferring raw key material across the VM boundary.

This seems to be designed incorrectly by not making virtio-blk itself
support key programming and eviction.  That complicates things
significantly by then having to handle the key programming and eviction
out-of-band using Qualcomm-specific SCM calls.  It also means that
adding other implementations of this would be very difficult.

There are some claims that not transmitting keys across the VM boundary
is desirable.  But that doesn't seem meaningful, given that all the I/O
is transmitted across that boundary in plaintext anyway, and also it
seems that hardware-wrapped keys will be supported too.

Please make virtio-blk support the key programming, eviction, and
HW-wrapped key management operations that are needed for this to work.

- Eric