Re: [PATCH v2 00/20] AP bus/zcrypt/pkey/paes no-mem-alloc patches

[Holger Dengler <dengler@linux.ibm.com>]

On 04/03/2025 18:20, Harald Freudenberger wrote:
> This series of patches has the goal to open up a do-not-allocate
> memory path from the callers of the pkey in-kernel api down to
> the crypto cards and back.
> 
> The asynch in-kernel cipher implementations (and the s390 PAES
> cipher implementations are one of them) may be called in a
> context where memory allocations which trigger IO is not acceptable.
> 
> So this patch series reworks the AP bus code, the zcrypt layer,
> the pkey layer and the pkey handlers to respect this situation
> by processing a new parameter xflags (execution hints flags).
> There is a flag PKEY_XFLAG_NOMEMALLOC which tells the code to
> not allocate memory which may lead to IO operations.
> 
> To reach this goal, the actual code changes have been differed.
> The zcrypt misc functions which need memory for cprb build
> use a pre allocated memory pool for this purpose. The findcard()
> functions have one temp memory area preallocated and protected
> with a mutex. Some smaller data is not allocated any more but went
> to the stack instead. The AP bus also uses a pre-allocated
> memory pool for building AP message requests.

Please check in all affected modules: the parameter for the minimal number of element in all meempools of the module should be configurable with the same module parameter. Please also use the same module parameter name (e.g. mempool_threshold) in all modules. This makes it easier for users to syncronize the mempool thresholds accross modules.

> 
> Note that the PAES implementation still needs to get reworked
> to run the protected key derivation in a real asynchronous way.
> However, this rework of AP bus, zcrypt and pkey is the base work
> required before reconsidering the PAES implementation.
> 
> The patch series starts bottom (AP bus) and goes up the call
> chain (PKEY). At any time in the patch stack it should compile.
> For easier review I tried to have one logic code change by
> each patch and thus keep the patches "small". For the upstream
> version I intend to fold them together into only a few commits.
> 
> Changelog:
> v1: initial version
> v2: - Rework on patch 0001 and 0002 based on feedback from Holger.
>       Also there was one place in zcrypt_msgtype50.c where still
>       an ap msg buffer was alloacated.
>     - Rework on patch 0003 - fixed feedback from Holger. Also the
>       min poolitems is now a module parameter and defaults to 8.
>     - Rework on patch 0004 - as suggested by Holger the "userspace"
>       parameter is now included into the ap msg flags.
>     - Rework on patch 0005 - nr of cca cprbs in the mempool is now
>       a module parameter.
>     - Rework on patch 0006 - nr of ep11 cprbs in the mempool is now
>       a module parameter.
>     - Rework on patch 0007 - as suggested by Holger instead of
>       implementing a copy-and-pasted new function
>       zcrypt_device_status_mask_ext2() use and extend the existing
>       the existing function to avoid code duplication.
>     - The rest of the patch series needed adaptions but there is
>       no functional change compared to v1.

Please pick my R-b tags of this review for v3.

-- 
Mit freundlichen Grüßen / Kind regards
Holger Dengler
--
IBM Systems, Linux on IBM Z Development
dengler@linux.ibm.com