linux-kernel - Re: [PATCH 0/4] tpm: lazy flush for the session null key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <D4727YOJY8KZ.L6RKMRBKRCSN@kernel.org>
Date: Sun, 15 Sep 2024 21:12:49 +0300
From: "Jarkko Sakkinen" <jarkko@...nel.org>
To: "Jarkko Sakkinen" <jarkko@...nel.org>, <linux-integrity@...r.kernel.org>
Cc: <James.Bottomley@...senPartnership.com>, <roberto.sassu@...wei.com>,
 <mapengyu@...il.com>, "Peter Huewe" <peterhuewe@....de>, "Jason Gunthorpe"
 <jgg@...pe.ca>, "open list" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 0/4] tpm: lazy flush for the session null key

On Sun Sep 15, 2024 at 9:04 PM EEST, Jarkko Sakkinen wrote:
> There is no load and flush the null key for every transaction. It only
> needs to be flushed when user space accesses TPM. This postpones the
> flush up to that point.
>
> The goal is to take the first step addressing [1]. Other performance
> improvements are needed too but this is the most obvious one and
> easiest to address.
>
> [1] https://bugzilla.kernel.org/show_bug.cgi?id=219229
>
> Jarkko Sakkinen (4):
>   tpm: remove file header documentation from tpm2-sessions.c
>   tpm: address tpm2_create_null_primary() return value
>   tpm: address tpm2_create_primary() failure
>   tpm: flush the session null key only when required
>
>  drivers/char/tpm/tpm-chip.c       |  13 ++++
>  drivers/char/tpm/tpm-dev-common.c |   7 ++
>  drivers/char/tpm/tpm-interface.c  |   9 ++-
>  drivers/char/tpm/tpm2-cmd.c       |   3 +
>  drivers/char/tpm/tpm2-sessions.c  | 115 ++++++++++--------------------
>  include/linux/tpm.h               |   2 +
>  6 files changed, 68 insertions(+), 81 deletions(-)

I did not take any benchmarks yet but I did run this through
run-tests.sh in [1] to make sure that it does not break anything.

Looking at pseude-code of ContextSave from [2] fixing this is
orthogonal from any possible context gap issues as null key
is just plain transient object.

I would fix the obvious first and then look what can be done
to sessions (e.g. global LRU tracking of sessions or similar
approach). I don't expect over the top performance improvement
with this patch set.

[1] https://codeberg.org/jarkko/linux-tpmdd-test
[2] https://trustedcomputinggroup.org/wp-content/uploads/TPM-2.0-1.83-Part-3-Commands-Code.pdf

BR, Jarkko