On Tue May 21, 2024 at 10:03 AM EEST, Vitor Soares wrote: > Hi Jarkko, > > On Mon, 2024-05-20 at 02:51 +0300, Jarkko Sakkinen wrote: > > Causes performance drop in initialization so needs to be opt-in. > > Distributors are capable of opt-in enabling this. Could be also handled by > > kernel-command line in the future. > > > > Reported-by: Vitor Soares <ivitro@xxxxxxxxx> > > Closes: > > https://lore.kernel.org/linux-integrity/bf67346ef623ff3c452c4f968b7d900911e250c3.camel@xxxxxxxxx/#t > > Fixes: d2add27cf2b8 ("tpm: Add NULL primary creation") > > Signed-off-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx> > > --- > > drivers/char/tpm/Kconfig | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig > > index e63a6a17793c..db41301e63f2 100644 > > --- a/drivers/char/tpm/Kconfig > > +++ b/drivers/char/tpm/Kconfig > > @@ -29,7 +29,7 @@ if TCG_TPM > > > > config TCG_TPM2_HMAC > > bool "Use HMAC and encrypted transactions on the TPM bus" > > - default y > > + default n > > select CRYPTO_ECDH > > select CRYPTO_LIB_AESCFB > > select CRYPTO_LIB_SHA256 > > I did the test on my side, and with TCG_TPM2_HMAC set to "n" the time to probe > tpm_tis_spi driver has reduced to: > real 0m2.009s > user 0m0.001s > sys 0m0.019s > > Thanks for your help. > > Best regards, > Vitor Soares Yeah, well overall benefits still weight a lot. Primary keys are obviously essential for any use of TPM, so better idea might then just disable the whole TPM if this does not scale. But as James pointed out in some other response it is not objectively clear where performance hit is. I guess it would make sense to analyze how much hmac vs w/o hmac in the pipe costs for TPM commands. This benchmark could be done in user space using /dev/tpm0. Anyway, I did not include this to my PR, which I already sent to Linus. If anyone wants to make kernel command-line option for hmac, I'm willing to review that (no bandwidth to do it myself). BR, Jarkko
