[PATCH v5 00/15] Optimize dm-verity and fsverity using multibuffer hashing

[Sami Tolvanen]

Hi Eric,

On Mon, Jun 10, 2024 at 8:49 PM Eric Biggers <ebiggers at kernel.org> wrote:
>
> On many modern CPUs, it is possible to compute the SHA-256 hash of two
> equal-length messages in about the same time as a single message, if all
> the instructions are interleaved.  This is because each SHA-256 (and
> also most other cryptographic hash functions) is inherently serialized
> and therefore can't always take advantage of the CPU's full throughput.
>
> An earlier attempt to support multibuffer hashing in Linux was based
> around the ahash API.  That approach had some major issues, as does the
> alternative ahash-based approach proposed by Herbert (see my response at
> https://lore.kernel.org/linux-crypto/20240610164258.GA3269@sol.localdomain/).
> This patchset instead takes a much simpler approach of just adding a
> synchronous API for hashing equal-length messages.
>
> This works well for dm-verity and fsverity, which use Merkle trees and
> therefore hash large numbers of equal-length messages.

Thank you for continuing to work on this! Improving dm-verity
performance is a high priority for Android, and this patch series
shows very promising results. FWIW, I would like to see this merged
upstream, and any ahash improvements handled in follow-up patches. For
the series:

Reviewed-by: Sami Tolvanen <samitolvanen at google.com>

Sami