Message ID | 20230120074306.1326298-3-ajd@linux.ibm.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp65365wrn; Thu, 19 Jan 2023 23:44:12 -0800 (PST) X-Google-Smtp-Source: AMrXdXtGciJg1+uKM3pSpKmFIzLnyfbTiC0O2DDCcv6/mXktH1gbmv88okBNB1gvotDAV9JvxMtL X-Received: by 2002:a05:6a20:ba11:b0:ad:5a4d:95b5 with SMTP id fa17-20020a056a20ba1100b000ad5a4d95b5mr34473901pzb.40.1674200651840; Thu, 19 Jan 2023 23:44:11 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1674200651; cv=none; d=google.com; s=arc-20160816; b=CA/I7ZTCp0iMztpNBJ3BqoMm74R2F6h0IiBxGjwt0rGJqyKGqzc7L86vdDWs6+PeA5 wV7zYWHPVkwPAylJ/gaNVkSMjL5jFSz0bDaVMPt0Z68lhQ+Jau4ESb2VVkbHi8p7q9Q5 2x59bMi0Y+3fGjk0L0v4FAmtF9vv10EW2SEZNtcFksROvvqvFdrc8Zds6JSR7fn5LRgQ TnuZ6q26yMh5oLHn6g7MEgs4V1/X0poJHlJIL44TfuIQQA/dEjpSRYiGlvbjvZT/kTrM Ezxix+brzQHz8R6WxX17t0IVFlMpOfTzCyDA0WgIARu049sqT/CcnHrA8ouvZzoNKgrj QCnw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=grILWy5I/lURrLpjLU3fbP0cTkagwaubXu7uz24+NCo=; b=ThQ8xkmxjgTh7IuHIqPq9b9qeT4YuIyD0MWVsJlnx1IN7ewjepwviCuHPeCqUl07b0 ynNqzHF9yeKkgvHZ+ndBzsT0/oXK1AMeOAsctaxDXkOS5xtmxgH1VxgbMkjoHwzndpMn /31AOBt7cjZSmjae4LSgsHi+CzCaoewMh57JpXFemR0/Oj6qMvkW1anWw+xBau9GvsJQ YCW/vfLA/VZl5D3NdcNHxGLBACuRWjgCzGRW/7oWrC2gBpAM7D7HTAYj335iq+VgNIfP DyRbqhY+5rzzdCxzi4yo6YPMyxnVhCrfvp6yMXO8P04XLbD9dXeJxhX/qBiVjawHcYCi Q7TQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@ibm.com header.s=pp1 header.b=cX7bhehL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=NONE dis=NONE) header.from=ibm.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id p15-20020a056a000a0f00b0057629288720si45268447pfh.176.2023.01.19.23.43.59; Thu, 19 Jan 2023 23:44:11 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@ibm.com header.s=pp1 header.b=cX7bhehL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=NONE dis=NONE) header.from=ibm.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230209AbjATHnw (ORCPT <rfc822;changwoo.m@gmail.com> + 99 others); Fri, 20 Jan 2023 02:43:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44906 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230122AbjATHnt (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Fri, 20 Jan 2023 02:43:49 -0500 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9FDB27D67A; Thu, 19 Jan 2023 23:43:47 -0800 (PST) Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 30K6U1NM017522; Fri, 20 Jan 2023 07:43:37 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=grILWy5I/lURrLpjLU3fbP0cTkagwaubXu7uz24+NCo=; b=cX7bhehLLUc2EsyMGPjP65vHV0sTOQiekZ7X2JfMo3qJs2Geu6+riy3bCh7j2gqs4ojq 9uk1VRqhcBMvPjeNtI6AoXl6SbdNyLTcy6v1mlR5mM9UeMJ8ZC1nDuKH3cvU+o05/pcB wWs4t268MQcAhieEjzCEiuFX8QQ95ldtCG8e1rVfuMNCpIHbtH6M5nptMwZmmzsmVIvk ggOnr28oa7/TsRwcT5QxSdcULSKH+WKnLoLMyt9IHiTDZsMwoeIx9wUB9C1r1MKuWzdD Y8RSMK/Eciw9+jFTVqa5tZDCQj8Psx1J8U76krbiLgcMRsr1h7oNIWFgCGFtg2jP1ozQ DA== Received: from ppma03fra.de.ibm.com (6b.4a.5195.ip4.static.sl-reverse.com [149.81.74.107]) by mx0b-001b2d01.pphosted.com (PPS) with ESMTPS id 3n7nr9hec6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 20 Jan 2023 07:43:37 +0000 Received: from pps.filterd (ppma03fra.de.ibm.com [127.0.0.1]) by ppma03fra.de.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 30JN7s6u006911; Fri, 20 Jan 2023 07:43:34 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma03fra.de.ibm.com (PPS) with ESMTPS id 3n3m16njxb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 20 Jan 2023 07:43:34 +0000 Received: from smtpav06.fra02v.mail.ibm.com (smtpav06.fra02v.mail.ibm.com [10.20.54.105]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 30K7hWUi42664202 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 20 Jan 2023 07:43:32 GMT Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 62B8B2004B; Fri, 20 Jan 2023 07:43:32 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DAB9420043; Fri, 20 Jan 2023 07:43:31 +0000 (GMT) Received: from ozlabs.au.ibm.com (unknown [9.192.253.14]) by smtpav06.fra02v.mail.ibm.com (Postfix) with ESMTP; Fri, 20 Jan 2023 07:43:31 +0000 (GMT) Received: from jarvis-ozlabs-ibm-com.ozlabs.ibm.com (haven.au.ibm.com [9.192.254.114]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.au.ibm.com (Postfix) with ESMTPSA id AF984605A6; Fri, 20 Jan 2023 18:43:29 +1100 (AEDT) From: Andrew Donnellan <ajd@linux.ibm.com> To: linuxppc-dev@lists.ozlabs.org, linux-integrity@vger.kernel.org Cc: gregkh@linuxfoundation.org, gcwilson@linux.ibm.com, linux-kernel@vger.kernel.org, nayna@linux.ibm.com, ruscur@russell.cc, zohar@linux.ibm.com, mpe@ellerman.id.au, gjoyce@linux.ibm.com, sudhakar@linux.ibm.com, bgray@linux.ibm.com, erichte@linux.ibm.com, joel@jms.id.au Subject: [PATCH v4 02/24] powerpc/pseries: Fix alignment of PLPKS structures and buffers Date: Fri, 20 Jan 2023 18:42:44 +1100 Message-Id: <20230120074306.1326298-3-ajd@linux.ibm.com> X-Mailer: git-send-email 2.39.0 In-Reply-To: <20230120074306.1326298-1-ajd@linux.ibm.com> References: <20230120074306.1326298-1-ajd@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: RiAFX32W7Ai_p8cphOkPG0zBkvP5Fs4e X-Proofpoint-GUID: RiAFX32W7Ai_p8cphOkPG0zBkvP5Fs4e X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.930,Hydra:6.0.562,FMLib:17.11.122.1 definitions=2023-01-20_04,2023-01-19_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 spamscore=0 malwarescore=0 bulkscore=0 priorityscore=1501 adultscore=0 lowpriorityscore=0 mlxlogscore=999 mlxscore=0 clxscore=1015 suspectscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2301200070 X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1755526622830149243?= X-GMAIL-MSGID: =?utf-8?q?1755526622830149243?= |
Series |
pSeries dynamic secure boot secvar interface + platform keyring loading
|
|
Commit Message
Andrew Donnellan
Jan. 20, 2023, 7:42 a.m. UTC
A number of structures and buffers passed to PKS hcalls have alignment requirements, which could on occasion cause problems: - Authorisation structures must be 16-byte aligned and must not cross a page boundary - Label structures must not cross page boundaries - Password output buffers must not cross page boundaries Round up the allocations of these structures/buffers to the next power of 2 to make sure this happens. Reported-by: Benjamin Gray <bgray@linux.ibm.com> Fixes: 2454a7af0f2a ("powerpc/pseries: define driver for Platform KeyStore") Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com> Reviewed-by: Russell Currey <ruscur@russell.cc> Signed-off-by: Russell Currey <ruscur@russell.cc> --- v3: Merge plpks fixes and signed update series with secvar series v4: Fix typo in commit message Move up in series (npiggin) --- arch/powerpc/platforms/pseries/plpks.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
Comments
Andrew Donnellan <ajd@linux.ibm.com> writes: > A number of structures and buffers passed to PKS hcalls have alignment > requirements, which could on occasion cause problems: > > - Authorisation structures must be 16-byte aligned and must not cross a > page boundary > > - Label structures must not cross page boundaries > > - Password output buffers must not cross page boundaries > > Round up the allocations of these structures/buffers to the next power of > 2 to make sure this happens. It's not the *next* power of 2, it's the *nearest* power of 2, including the initial value if it's already a power of 2. That in conjunction with slab's guarantee that power of 2 sized objects are naturally aligned, and that the relevant structs are smaller than a page, is what makes this actually work. So I think the patch is fine, but the change log and comments probably need to be a bit clearer. cheers > Reported-by: Benjamin Gray <bgray@linux.ibm.com> > Fixes: 2454a7af0f2a ("powerpc/pseries: define driver for Platform KeyStore") > Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com> > Reviewed-by: Russell Currey <ruscur@russell.cc> > Signed-off-by: Russell Currey <ruscur@russell.cc> > > --- > > v3: Merge plpks fixes and signed update series with secvar series > > v4: Fix typo in commit message > > Move up in series (npiggin) > --- > arch/powerpc/platforms/pseries/plpks.c | 10 +++++++--- > 1 file changed, 7 insertions(+), 3 deletions(-) > > diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c > index 9e85b6d85b0b..a01cf2ff140a 100644 > --- a/arch/powerpc/platforms/pseries/plpks.c > +++ b/arch/powerpc/platforms/pseries/plpks.c > @@ -126,7 +126,8 @@ static int plpks_gen_password(void) > u8 *password, consumer = PKS_OS_OWNER; > int rc; > > - password = kzalloc(maxpwsize, GFP_KERNEL); > + // The password must not cross a page boundary, so we align to the next power of 2 > + password = kzalloc(roundup_pow_of_two(maxpwsize), GFP_KERNEL); > if (!password) > return -ENOMEM; > > @@ -162,7 +163,9 @@ static struct plpks_auth *construct_auth(u8 consumer) > if (consumer > PKS_OS_OWNER) > return ERR_PTR(-EINVAL); > > - auth = kzalloc(struct_size(auth, password, maxpwsize), GFP_KERNEL); > + // The auth structure must not cross a page boundary and must be > + // 16 byte aligned. We align to the next largest power of 2 > + auth = kzalloc(roundup_pow_of_two(struct_size(auth, password, maxpwsize)), GFP_KERNEL); > if (!auth) > return ERR_PTR(-ENOMEM); > > @@ -196,7 +199,8 @@ static struct label *construct_label(char *component, u8 varos, u8 *name, > if (component && slen > sizeof(label->attr.prefix)) > return ERR_PTR(-EINVAL); > > - label = kzalloc(sizeof(*label), GFP_KERNEL); > + // The label structure must not cross a page boundary, so we align to the next power of 2 > + label = kzalloc(roundup_pow_of_two(sizeof(*label)), GFP_KERNEL); > if (!label) > return ERR_PTR(-ENOMEM); > > -- > 2.39.0
On Thu, Jan 26, 2023 at 12:09:53AM +1100, Michael Ellerman wrote: > Andrew Donnellan <ajd@linux.ibm.com> writes: > > A number of structures and buffers passed to PKS hcalls have alignment > > requirements, which could on occasion cause problems: > > > > - Authorisation structures must be 16-byte aligned and must not cross a > > page boundary > > > > - Label structures must not cross page boundaries > > > > - Password output buffers must not cross page boundaries > > > > Round up the allocations of these structures/buffers to the next power of > > 2 to make sure this happens. > > It's not the *next* power of 2, it's the *nearest* power of 2, including > the initial value if it's already a power of 2. It's not the nearest either, the nearest power of two to 65 is 64. You could say "but, round up" to which I would say "round?" :-P "Adjust the allocation size to be the smallest power of two greater than or equal to the given size." "Pad to a power of two" in shorthand. "Padded to a power of two if necessary" if you want to emphasise it can be a no-op. Segher
From: Segher Boessenkool > Sent: 26 January 2023 17:19 > > On Thu, Jan 26, 2023 at 12:09:53AM +1100, Michael Ellerman wrote: > > Andrew Donnellan <ajd@linux.ibm.com> writes: > > > A number of structures and buffers passed to PKS hcalls have alignment > > > requirements, which could on occasion cause problems: > > > > > > - Authorisation structures must be 16-byte aligned and must not cross a > > > page boundary > > > > > > - Label structures must not cross page boundaries > > > > > > - Password output buffers must not cross page boundaries > > > > > > Round up the allocations of these structures/buffers to the next power of > > > 2 to make sure this happens. > > > > It's not the *next* power of 2, it's the *nearest* power of 2, including > > the initial value if it's already a power of 2. > > It's not the nearest either, the nearest power of two to 65 is 64. You > could say "but, round up" to which I would say "round?" :-P > > "Adjust the allocation size to be the smallest power of two greater than > or equal to the given size." > > "Pad to a power of two" in shorthand. "Padded to a power of two if > necessary" if you want to emphasise it can be a no-op. Changing the size to kzalloc() doesn't help. The alignment depends on the allocator and is only required to have a relatively small alignment (ARCH_MINALIGN?) regardless of the size. IIRC one of the allocators adds a small header to every item. It won't return 16 byte aligned items at all. David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
On Thu, 2023-01-26 at 17:31 +0000, David Laight wrote: > Changing the size to kzalloc() doesn't help. > The alignment depends on the allocator and is only required to have > a relatively small alignment (ARCH_MINALIGN?) regardless of the size. > > IIRC one of the allocators adds a small header to every item. > It won't return 16 byte aligned items at all. I'm relying on the behaviour described in Documentation/core- api/memory-allocation.rst: The address of a chunk allocated with kmalloc is aligned to at least ARCH_KMALLOC_MINALIGN bytes. For sizes which are a power of two, the alignment is also guaranteed to be at least the respective size. Is this wrong? Andrew
From: Andrew Donnellan > Sent: 27 January 2023 03:21 > > On Thu, 2023-01-26 at 17:31 +0000, David Laight wrote: > > Changing the size to kzalloc() doesn't help. > > The alignment depends on the allocator and is only required to have > > a relatively small alignment (ARCH_MINALIGN?) regardless of the size. > > > > IIRC one of the allocators adds a small header to every item. > > It won't return 16 byte aligned items at all. > > I'm relying on the behaviour described in Documentation/core- > api/memory-allocation.rst: > > The address of a chunk allocated with kmalloc is aligned to at > least ARCH_KMALLOC_MINALIGN bytes. For sizes which are a power of > two, the alignment is also guaranteed to be at least the respective > size. > > Is this wrong? The alignment for power of two doesn't match what I've inferred from reading comments on other patches. It is true for dma_malloc_coherent() - that does guarantee that a 16k allocate will be aligned on a 16k physical address boundary. David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
Segher Boessenkool <segher@kernel.crashing.org> writes: > On Thu, Jan 26, 2023 at 12:09:53AM +1100, Michael Ellerman wrote: >> Andrew Donnellan <ajd@linux.ibm.com> writes: >> > A number of structures and buffers passed to PKS hcalls have alignment >> > requirements, which could on occasion cause problems: >> > >> > - Authorisation structures must be 16-byte aligned and must not cross a >> > page boundary >> > >> > - Label structures must not cross page boundaries >> > >> > - Password output buffers must not cross page boundaries >> > >> > Round up the allocations of these structures/buffers to the next power of >> > 2 to make sure this happens. >> >> It's not the *next* power of 2, it's the *nearest* power of 2, including >> the initial value if it's already a power of 2. > > It's not the nearest either, the nearest power of two to 65 is 64. You > could say "but, round up" to which I would say "round?" :-P OK you got me there :) The function name makes it pretty clear that it will round *up* to the nearest power of 2 but you're right the comment should also make that clear. > "Adjust the allocation size to be the smallest power of two greater than > or equal to the given size." > > "Pad to a power of two" in shorthand. "Padded to a power of two if > necessary" if you want to emphasise it can be a no-op. The initial wording implied that it would always over-allocate so yes I think it's important to make it clear that it doesn't round up if it doesn't need to. cheers
Andrew Donnellan <ajd@linux.ibm.com> writes: > On Thu, 2023-01-26 at 17:31 +0000, David Laight wrote: >> Changing the size to kzalloc() doesn't help. >> The alignment depends on the allocator and is only required to have >> a relatively small alignment (ARCH_MINALIGN?) regardless of the size. >> >> IIRC one of the allocators adds a small header to every item. >> It won't return 16 byte aligned items at all. > > I'm relying on the behaviour described in Documentation/core- > api/memory-allocation.rst: > > The address of a chunk allocated with kmalloc is aligned to at > least ARCH_KMALLOC_MINALIGN bytes. For sizes which are a power of > two, the alignment is also guaranteed to be at least the respective > size. > > Is this wrong? I believe it's correct. For SLAB and SLUB it boils down to: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/mm/slab_common.c?commit=830b3c68c1fb1e9176028d02ef86f3cf76aa2476#n640 That's where the kmalloc slabs are created (see create_kmalloc_cache()) just below. If you create your own slab (with kmem_cache_create()) then the alignment is up to you, so that's why there's no power-of-2 logic in calculate_alignment(). And SLOB (which we don't use) does something similar: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/mm/slob.c?commit=830b3c68c1fb1e9176028d02ef86f3cf76aa2476#n493 cheers
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c index 9e85b6d85b0b..a01cf2ff140a 100644 --- a/arch/powerpc/platforms/pseries/plpks.c +++ b/arch/powerpc/platforms/pseries/plpks.c @@ -126,7 +126,8 @@ static int plpks_gen_password(void) u8 *password, consumer = PKS_OS_OWNER; int rc; - password = kzalloc(maxpwsize, GFP_KERNEL); + // The password must not cross a page boundary, so we align to the next power of 2 + password = kzalloc(roundup_pow_of_two(maxpwsize), GFP_KERNEL); if (!password) return -ENOMEM; @@ -162,7 +163,9 @@ static struct plpks_auth *construct_auth(u8 consumer) if (consumer > PKS_OS_OWNER) return ERR_PTR(-EINVAL); - auth = kzalloc(struct_size(auth, password, maxpwsize), GFP_KERNEL); + // The auth structure must not cross a page boundary and must be + // 16 byte aligned. We align to the next largest power of 2 + auth = kzalloc(roundup_pow_of_two(struct_size(auth, password, maxpwsize)), GFP_KERNEL); if (!auth) return ERR_PTR(-ENOMEM); @@ -196,7 +199,8 @@ static struct label *construct_label(char *component, u8 varos, u8 *name, if (component && slen > sizeof(label->attr.prefix)) return ERR_PTR(-EINVAL); - label = kzalloc(sizeof(*label), GFP_KERNEL); + // The label structure must not cross a page boundary, so we align to the next power of 2 + label = kzalloc(roundup_pow_of_two(sizeof(*label)), GFP_KERNEL); if (!label) return ERR_PTR(-ENOMEM);