On Wed, 2026-03-11 at 22:39 -0700, Eric Biggers wrote: > IMA computes hashes using the crypto_shash or crypto_ahash API. The > latter is used only when ima.ahash_minsize is set on the command line, > and its purpose is ostensibly to make the hash computation faster. > > However, going off the CPU to a crypto engine and back again is actually > quite slow, especially compared with the acceleration that is built into > modern CPUs and the kernel now enables by default for most algorithms. > Typical performance results for SHA-256 on a modern platform can be > found at https://lore.kernel.org/linux-crypto/20250615184638.GA1480@sol/ > > Partly for this reason, several other kernel subsystems have already > dropped support for the crypto_ahash API.
The performance benefit was the ability of reading and filling a buffer from disk, which was slow, while the other buffer was sent to the crypto engine. I'm all for removing extraneous code. I'll give it a couple of days, before queuing the patch in case there are any objections. thanks, Mimi
