Re: [PATCH 2/3] AF_ALG: Drop support for off-CPU cryptography

[Eric Biggers]

On Sun, Jul 26, 2026 at 10:10:48PM +0200, Richard Weinberger wrote:
> On Sun, Jul 26, 2026 at 5:52 PM Eric Biggers <ebiggers@xxxxxxxxxx> wrote:
> > Then I would suggest that skcipher_bind() should check if the name is
> > "cbc(paes)", and if so use 0 instead of AF_ALG_CRYPTOAPI_MASK.  Please
> > go ahead and send a patch against mainline (for v7.2-rc6) if you're
> > interested.
> 
> Patch sent.
> 
> > On cryptodev/master (future 7.3) it should get an entry in the new
> > skcipher_allowlist as well: { "cbc(paes)", true }.  That would be a
> > separate patch.
> 
> Do you mind a new field in struct af_alg_allowlist_entry which indicates
> that  AF_ALG_CRYPTOAPI_MASK should get bypassed?
> 
> bool bypass_apimask;?

Let's wait and see if it's needed for another algorithm before
generalizing this.

Note: if it does happen, the list definitions should start using
designated initializers so that it's clear what the bools are.
Alternatively, it could be a flags field with possible values
AF_ALG_UNPRIVILEGED and AF_ALG_ALLOW_OFF_CPU.

- Eric