[PATCH] kexec: Allow to skip digest calculation for speed

[PATCH] kexec: Allow to skip digest calculation for speed

[Jan H. Schönherr]

Give the administrator the ability to trade kexec safety for kexec speed
by disabling the digest calculation/verification for regular kexecs.

The behavior of kexec-on-crash is not touched.

Signed-off-by: Jan H. Schönherr <jschoenh@amazon.de>
---
 arch/x86/Kconfig               | 12 ++++++++++++
 arch/x86/purgatory/purgatory.c |  9 +++++++++
 kernel/kexec_file.c            |  5 +++++
 3 files changed, 26 insertions(+)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 20da391b5f32..7b257f655327 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1984,6 +1984,18 @@ config KEXEC_BZIMAGE_VERIFY_SIG
 	---help---
 	  Enable bzImage signature verification support.
 
+config KEXEC_SKIP_NONCRASH_DIGEST
+	bool "Disable digest calculation for regular kexec"
+	depends on KEXEC
+	---help---
+	  Disable the calculation and verification of the SHA digest before
+	  and during a regular kexec. This speeds up kexec a bit at the cost
+	  of a bit of safety.
+
+	  Note, that the digest calculation is still done for a kexec-on-crash.
+
+	  If unsure, say N.
+
 config CRASH_DUMP
 	bool "kernel crash dumps"
 	depends on X86_64 || (X86_32 && HIGHMEM)
diff --git a/arch/x86/purgatory/purgatory.c b/arch/x86/purgatory/purgatory.c
index 470edad96bb9..2b5189b851b3 100644
--- a/arch/x86/purgatory/purgatory.c
+++ b/arch/x86/purgatory/purgatory.c
@@ -44,6 +44,15 @@ static int verify_sha256_digest(void)
 	u8 digest[SHA256_DIGEST_SIZE];
 	struct sha256_state sctx;
 
+#ifdef CONFIG_KEXEC_SKIP_NONCRASH_DIGEST
+	/*
+	 * Skip digest verification for non-crash kernels, we trust the
+	 * mechanism enough to trade-off the digest for a quicker kexec
+	 */
+	if (!purgatory_backup_dest)
+		return 0;
+#endif
+
 	sha256_init(&sctx);
 	end = purgatory_sha_regions + ARRAY_SIZE(purgatory_sha_regions);
 
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index e5bcd94c1efb..ac01b34a7f87 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -532,6 +532,11 @@ static int kexec_calculate_store_digests(struct kimage *image)
 	struct kexec_sha_region *sha_regions;
 	struct purgatory_info *pi = &image->purgatory_info;
 
+#ifdef CONFIG_KEXEC_SKIP_NONCRASH_DIGEST
+	if (image->type != KEXEC_TYPE_CRASH)
+		return 0;
+#endif
+
 	zero_buf = __va(page_to_pfn(ZERO_PAGE(0)) << PAGE_SHIFT);
 	zero_buf_sz = PAGE_SIZE;
 
-- 
2.9.3.1.gcba166c.dirty


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

Re: [PATCH] kexec: Allow to skip digest calculation for speed

[Eric W. Biederman]

Jan H. Schönherr <jschoenh@amazon.de> writes:

> Give the administrator the ability to trade kexec safety for kexec speed
> by disabling the digest calculation/verification for regular kexecs.
>
> The behavior of kexec-on-crash is not touched.

The performance of the digest caculation is acceptable on 386s.  Or it
was years ago when I tested it on a 386.  What is the problem you are
having.

Is there something silly like a cache disable in your configuration?

Eric

> Signed-off-by: Jan H. Schönherr <jschoenh@amazon.de>
> ---
>  arch/x86/Kconfig               | 12 ++++++++++++
>  arch/x86/purgatory/purgatory.c |  9 +++++++++
>  kernel/kexec_file.c            |  5 +++++
>  3 files changed, 26 insertions(+)
>
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index 20da391b5f32..7b257f655327 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -1984,6 +1984,18 @@ config KEXEC_BZIMAGE_VERIFY_SIG
>  	---help---
>  	  Enable bzImage signature verification support.
>  
> +config KEXEC_SKIP_NONCRASH_DIGEST
> +	bool "Disable digest calculation for regular kexec"
> +	depends on KEXEC
> +	---help---
> +	  Disable the calculation and verification of the SHA digest before
> +	  and during a regular kexec. This speeds up kexec a bit at the cost
> +	  of a bit of safety.
> +
> +	  Note, that the digest calculation is still done for a kexec-on-crash.
> +
> +	  If unsure, say N.
> +
>  config CRASH_DUMP
>  	bool "kernel crash dumps"
>  	depends on X86_64 || (X86_32 && HIGHMEM)
> diff --git a/arch/x86/purgatory/purgatory.c b/arch/x86/purgatory/purgatory.c
> index 470edad96bb9..2b5189b851b3 100644
> --- a/arch/x86/purgatory/purgatory.c
> +++ b/arch/x86/purgatory/purgatory.c
> @@ -44,6 +44,15 @@ static int verify_sha256_digest(void)
>  	u8 digest[SHA256_DIGEST_SIZE];
>  	struct sha256_state sctx;
>  
> +#ifdef CONFIG_KEXEC_SKIP_NONCRASH_DIGEST
> +	/*
> +	 * Skip digest verification for non-crash kernels, we trust the
> +	 * mechanism enough to trade-off the digest for a quicker kexec
> +	 */
> +	if (!purgatory_backup_dest)
> +		return 0;
> +#endif
> +
>  	sha256_init(&sctx);
>  	end = purgatory_sha_regions + ARRAY_SIZE(purgatory_sha_regions);
>  
> diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> index e5bcd94c1efb..ac01b34a7f87 100644
> --- a/kernel/kexec_file.c
> +++ b/kernel/kexec_file.c
> @@ -532,6 +532,11 @@ static int kexec_calculate_store_digests(struct kimage *image)
>  	struct kexec_sha_region *sha_regions;
>  	struct purgatory_info *pi = &image->purgatory_info;
>  
> +#ifdef CONFIG_KEXEC_SKIP_NONCRASH_DIGEST
> +	if (image->type != KEXEC_TYPE_CRASH)
> +		return 0;
> +#endif
> +
>  	zero_buf = __va(page_to_pfn(ZERO_PAGE(0)) << PAGE_SHIFT);
>  	zero_buf_sz = PAGE_SIZE;

_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

Re: [PATCH] kexec: Allow to skip digest calculation for speed

[Jan H. Schönherr]

On 02/02/2018 02:42 AM, Eric W. Biederman wrote:
> Jan H. Schönherr <jschoenh@amazon.de> writes:
> 
>> Give the administrator the ability to trade kexec safety for kexec speed
>> by disabling the digest calculation/verification for regular kexecs.
>>
>> The behavior of kexec-on-crash is not touched.
> 
> The performance of the digest caculation is acceptable on 386s.  Or it
> was years ago when I tested it on a 386.  What is the problem you are
> having.
> 
> Is there something silly like a cache disable in your configuration?

Last time I measured, this patch reduced the time until the system is responsive
again after a kexec by about 50 ms to 100 ms in my setups. That seems to be about
the right time for enabled caches, judging from a quick sha256sum on the command
line and the kernel sizes I'm working with.

These 50 ms to 100 ms are a noticeable fraction of the total kexec time and they
are easy to avoid -- compared to some other time sinks in the Linux boot process.

Regards
Jan


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

Re: [PATCH] kexec: Allow to skip digest calculation for speed

[Eric W. Biederman]

"Jan H. Schönherr" <jschoenh@amazon.de> writes:

> On 02/02/2018 02:42 AM, Eric W. Biederman wrote:
>> Jan H. Schönherr <jschoenh@amazon.de> writes:
>> 
>>> Give the administrator the ability to trade kexec safety for kexec speed
>>> by disabling the digest calculation/verification for regular kexecs.
>>>
>>> The behavior of kexec-on-crash is not touched.
>> 
>> The performance of the digest caculation is acceptable on 386s.  Or it
>> was years ago when I tested it on a 386.  What is the problem you are
>> having.
>> 
>> Is there something silly like a cache disable in your configuration?
>
> Last time I measured, this patch reduced the time until the system is responsive
> again after a kexec by about 50 ms to 100 ms in my setups. That seems to be about
> the right time for enabled caches, judging from a quick sha256sum on the command
> line and the kernel sizes I'm working with.
>
> These 50 ms to 100 ms are a noticeable fraction of the total kexec time and they
> are easy to avoid -- compared to some other time sinks in the Linux
> boot process.

So just optimization for optimization sake.  It fixes no problems and
solves no challenges.

On a human time scale I don't believe 50ms to 100ms is at all noticable.

The option is already there if you don't use the kexec_file syscall.

The kexec_file syscall exists because people have setups where
signatures are needed on kernels and so can not afford the full
generality of the original kexec system call.  The use of kexec_file
already tells us people of given up full generality for safety.

If there is a compelling use case we can talk about this, but right now
I don't see what could possibly be compelling about saving a tenth of a
second, on a comparatively rare operation.

Eric


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec