2016-05-03 09:00:23

by Richard W.M. Jones

Subject: [PATCH v3] crypto: Add a flag allowing the self-tests to be disabled at runtime.

v2 -> v3:

- Ignore the flag if FIPS mode is enabled.

v1 -> v2:

- Use printk_once. Because the serial console is so slow, printing
the message multiple times actually consumed about 6ms extra later
on during the boot.

- - -

I'm trying to reduce the time taken in the kernel in initcalls, with
my aim being to reduce the current ~700ms spent in initcalls before
userspace, down to something like 100ms. All times on my Broadwell-U
laptop, under virtualization. The purpose of this is to be able to
launch VMs around containers with minimal overhead, like Intel Clear
Containers, but using standard distro kernels and qemu.

Currently the kernel spends 28ms (on my laptop) running crypto
algorithm self-tests. Although it's possibe to disable these at
compile time, Fedora kernel maintainers want to maintain a single
kernel image for all uses.

So this commit adds a runtime flag which callers can set to skip the
self-tests in the fast container/virtualization case.

Rich.

2016-05-03 09:00:17

by Richard W.M. Jones

Subject: [PATCH v3] crypto: Add a flag allowing the self-tests to be disabled at runtime.

Running self-tests for a short-lived KVM VM takes 28ms on my laptop.
This commit adds a flag 'cryptomgr.notests' which allows them to be
disabled.

However if fips=1 as well, we ignore this flag as FIPS mode mandates
that the self-tests are run.

Signed-off-by: Richard W.M. Jones <[email protected]>
---
Documentation/kernel-parameters.txt | 3 +++
crypto/testmgr.c | 9 +++++++++
2 files changed, 12 insertions(+)

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 0b3de80..d4d5fb7 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -826,6 +826,9 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
It will be ignored when crashkernel=X,high is not used
or memory reserved is below 4G.

+ cryptomgr.notests
+ [KNL] Disable crypto self-tests
+
cs89x0_dma= [HW,NET]
Format: <dma>

diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index b86883a..fcd89fe 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -35,6 +35,10 @@

#include "internal.h"

+static bool notests;
+module_param(notests, bool, 0644);
+MODULE_PARM_DESC(notests, "disable crypto self-tests");
+
#ifdef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS

/* a perfect nop */
@@ -3868,6 +3872,11 @@ int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
int j;
int rc;

+ if (!fips_enabled && notests) {
+ printk_once(KERN_INFO "alg: self-tests disabled\n");
+ return 0;
+ }
+
alg_test_descs_check_order();

if ((type & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_CIPHER) {
--
2.7.4

2016-05-05 06:46:00

by Herbert Xu

Subject: Re: [PATCH v3] crypto: Add a flag allowing the self-tests to be disabled at runtime.

On Tue, May 03, 2016 at 10:00:17AM +0100, Richard W.M. Jones wrote:
> Running self-tests for a short-lived KVM VM takes 28ms on my laptop.
> This commit adds a flag 'cryptomgr.notests' which allows them to be
> disabled.
>
> However if fips=1 as well, we ignore this flag as FIPS mode mandates
> that the self-tests are run.
>
> Signed-off-by: Richard W.M. Jones <[email protected]>

Applied.
--
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt