Re: [v4 PATCH 00/11] crypto: Add partial block API and hmac to ahash

[Eric Biggers <ebiggers@kernel.org>]

On Sat, May 17, 2025 at 08:45:00AM +0800, Herbert Xu wrote:
> On Fri, May 16, 2025 at 09:43:26AM -0700, Eric Biggers wrote:
> >
> > So how come this hasn't been a problem until now?
> 
> It is the key to getting rid of the ban on memory allocation
> for ahash drivers.  Small memory allocations fail very rarely,
> yet we're banning the use of all drivers doing any memory allocations
> because they may fail.

Does anyone really care?  The fact that dm-crypt hasn't been able to use most of
the hardware drivers for years just further emphasizes that those drivers don't
really even matter.  I remember seeing one complaint and that was it.

> With a consistent export format, we could simply fallback to
> software when the rare OOM strikes, thus getting rid of the
> ban on memory allocations.

There's already a huge quality problem with the drivers.  The last thing they
need is to have special code that runs only when an OOM condition occurs, which
won't be tested.

Can they really not just use mempools?

I'll also note that the whole concept of fallback ciphers is kind of broken, as
was established earlier.  The correct thing to do would be to fall back to
lib/crypto/, not to call into the legacy crypto API recursively.

- Eric