attester: add RA_PERF performance measurement logging#4
Open
mmxsrup wants to merge 3 commits into
Open
Conversation
Add timing instrumentation across the attestation stack so that the total attestation time and the duration of each major event (memory hashing, CBOR/COSE encoding, ECDSA/CAAM signing, black-key processing) can be collected for performance evaluation. Every measurement is one machine-parsable line: RA_PERF|<layer>|<event>|<duration_us>|key=<embedded|plain|black|-> PTA (microsecond resolution, ARM generic timer): ocotp_srk, ocotp_lifecycle, instance_id, hash_ta, hash_tee, cbor_encode, sign_key_setup, sign_tbs_hash, sign_ecdsa, sign_verify, cose_sign1, cmd_total, plus keypair_generate / blackkey_encap / convert_total for the black-key provisioning commands. Events are buffered and flushed in one batch after all timestamps are taken, because the secure console is synchronous and printing between measured operations would skew them; the flush reports its own cost as perf_flush. sign_ecdsa is the bracket for the CAAM black-key on/off comparison (sign_verify only runs on the embedded-key path and is reported separately so it cannot bias it). TA (millisecond resolution, TEE_GetSystemTime): pta_invoke, cmd_total. Host (clock_gettime CLOCK_MONOTONIC): teec_init, teec_open_session, veraison_new_session, evidence_get, print_evidence, veraison_post_evidence, total, blackkey_generate, blackkey_convert. New client options: --perf (or RA_PERF=1) enables the host log lines, --loop N repeats the attestation for statistics, --no-server attests a local random nonce without a relying party (useful on devices without network access to a verifier). The firmware side is compiled in only with CFG_REMOTE_ATTESTATION_PERF=y (QEMU: pass it to make check; Yocto: set the variable for optee-os and veraison-attestation in local.conf) and default builds are unaffected. The i.MX bbappend raises CFG_TEE_CORE_LOG_LEVEL to 2 together with the flag because meta-freescale's optee-os-common-fslc-imx.inc forces it to 0, which would compile out all core trace including the RA_PERF lines.
Document the RA_PERF timing logs: log format and clock sources per layer, the full log-point list, how to enable the instrumentation on QEMU and on the i.MX Yocto build, a recommended measurement protocol (repetitions, aggregation script), and how to compare CAAM signing with and without the black key (compare pta|sign_ecdsa only; on i.MX both paths sign on CAAM hardware, the black-key path additionally pays blob decapsulation + CCM key import). Includes the security note that running without the black key leaves the signing key unprotected by the CAAM, so those numbers are for performance comparison only.
Turn the measurement-protocol's "governor/CPU clock" mention into a concrete pin-and-record step (scaling_governor=performance + record scaling_cur_freq), since sub-ms events swing with DVFS and nothing else fixed it. Note that the aggregation one-liner counts all iterations (including the cold first one the protocol says to discard), how to trim it offline, and that teec_init/teec_open_session are measured once before the loop and so are already outside the per-iteration aggregates.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds RA_PERF timing logs across the attestation stack for the performance evaluation: total attestation time, per-event durations (hashing, CBOR/COSE, ECDSA/CAAM signing, black-key processing), and the CAAM black-key on/off comparison.
One machine-parsable line per measurement:
pta(ARM generic timer, µs): hashes, CBOR encode, sign breakdown, OCOTP reads, key generation. Events are buffered and printed in one batch after all timestamps are taken (the synchronous console would otherwise skew them); the flush cost is reported asperf_flush.ta(TEE_GetSystemTime, ~1 ms):pta_invoke,cmd_total.host(CLOCK_MONOTONIC): TEE round trip, HTTP round trips, total. New options:--perf(enable logs),--loop N,--no-server(local nonce; no verifier needed).--key-hex); compare viapta|sign_ecdsa— both paths sign on CAAM, the black-key path adds blob decapsulation + CCM key import. The embedded-path self-verify is reported separately so it cannot bias the comparison.Enable with
CFG_REMOTE_ATTESTATION_PERF=y; default builds are unaffected. The i.MX bbappend also raisesCFG_TEE_CORE_LOG_LEVELto 2 (meta-freescale forces 0, which compiles out all core trace).Full log-point list and measurement protocol: docs/performance-measurement.md (Japanese).
Testing (QEMU E2E)
--no-server --loop 3/ without--perf/--generate-blackkey;ear.status: affirming.sign_*≈cose_sign1; event sum ≈cmd_total).