Hi Eric, On Mon, Jun 10, 2024 at 8:49 PM Eric Biggers <ebiggers@xxxxxxxxxx> wrote: > > On many modern CPUs, it is possible to compute the SHA-256 hash of two > equal-length messages in about the same time as a single message, if all > the instructions are interleaved. This is because each SHA-256 (and > also most other cryptographic hash functions) is inherently serialized > and therefore can't always take advantage of the CPU's full throughput. > > An earlier attempt to support multibuffer hashing in Linux was based > around the ahash API. That approach had some major issues, as does the > alternative ahash-based approach proposed by Herbert (see my response at > https://lore.kernel.org/linux-crypto/20240610164258.GA3269@sol.localdomain/). > This patchset instead takes a much simpler approach of just adding a > synchronous API for hashing equal-length messages. > > This works well for dm-verity and fsverity, which use Merkle trees and > therefore hash large numbers of equal-length messages. Thank you for continuing to work on this! Improving dm-verity performance is a high priority for Android, and this patch series shows very promising results. FWIW, I would like to see this merged upstream, and any ahash improvements handled in follow-up patches. For the series: Reviewed-by: Sami Tolvanen <samitolvanen@xxxxxxxxxx> Sami
