Re: [PATCH] crypto: pcrypt - Remove pcrypt
From: Thomas Huth <hidden>
Date: 2026-07-13 06:36:35
Also in:
linux-crypto, lkml
On 13/07/2026 05.26, Eric Biggers wrote:
pcrypt was originally intended to improve IPsec performance. However, it's no longer useful for that. Reports from the rare cases that anyone has actually tried to use it over the years indicate that it actually reduces IPsec performance, e.g.: * https://github.com/libreswan/libreswan/wiki/Internals:-Cryptographic-Acceleration#obsoleted-ipsec-accelerations * https://users.strongswan.narkive.com/liqTaTq8/strongswan-problem-with-pcrypt * https://unix.stackexchange.com/questions/594336/ipsec-multithreading-via-pcrypt-worse-than-single-thread It's also undocumented and quite difficult to actually use. Its design is also broken, in that any unprivileged program can enable pcrypt systemwide at any time (by instantiating it using AF_ALG). Meanwhile, pcrypt has been a regular source of bugs, including at least four that have received CVEs. Let's just remove it. No one seems to care about it anymore other than people looking for vulnerabilities. Cc: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Eric Biggers <ebiggers@kernel.org> --- This patch is targeting cryptodev/master Documentation/core-api/padata.rst | 6 +- MAINTAINERS | 7 - arch/loongarch/configs/loongson32_defconfig | 1 - arch/loongarch/configs/loongson64_defconfig | 1 - arch/s390/configs/debug_defconfig | 1 - arch/s390/configs/defconfig | 1 - crypto/Kconfig | 10 - crypto/Makefile | 1 - crypto/pcrypt.c | 394 -------------------- include/crypto/pcrypt.h | 39 -- tools/crypto/tcrypt/tcrypt_speed_compare.py | 7 +- 11 files changed, 5 insertions(+), 463 deletions(-) delete mode 100644 crypto/pcrypt.c delete mode 100644 include/crypto/pcrypt.h
Thanks for the patch, I think it's a good idea!
quoted hunk ↗ jump to hunk
diff --git a/Documentation/core-api/padata.rst b/Documentation/core-api/padata.rst index 05b73c6c105f..b50df9768a5d 100644 --- a/Documentation/core-api/padata.rst +++ b/Documentation/core-api/padata.rst@@ -55,9 +55,9 @@ processors are allowed to be used as the serialization callback processor. cpumask specifies the new cpumask to use. There may be sysfs files for an instance's cpumasks. For example, pcrypt's -live in /sys/kernel/pcrypt/<instance-name>. Within an instance's directory -there are two files, parallel_cpumask and serial_cpumask, and either cpumask -may be changed by echoing a bitmask into the file, for example:: +used to live in /sys/kernel/pcrypt/<instance-name>. Within an instance's +directory there are two files, parallel_cpumask and serial_cpumask, and either +cpumask may be changed by echoing a bitmask into the file, for example:: echo f > /sys/kernel/pcrypt/pencrypt/parallel_cpumask
I'd rather not keep examples for a non-existing sysfs entry around. Could you maybe change it to use e.g. /sys/devices/virtual/workqueue/cpumask instead? Thomas