attester: add TSM REPORT module and move TDX to use it #434

mythi · 2024-01-16T11:20:30Z

No description provided.

mythi · 2024-01-16T15:13:15Z

The CI error does not seem to be related to this PR (I can see it locally with main as well)

Xynnn007

Is TSM report module already supported in kernel 6.7-rc1? I suggest that we add some comments inside the code. Also, if we want to leverage the ability, the payload builder side of kata-containers would also make some change. Do you have a plan for this?

attestation-agent/attester/Cargo.toml

attestation-agent/attester/src/tsm_report/mod.rs

attestation-agent/attester/src/tdx/mod.rs

mythi · 2024-01-18T08:34:24Z

s TSM report module already supported in kernel 6.7-rc1? I suggest that we add some comments inside the code. Also, if we want to leverage the ability, the payload builder side of kata-containers would also make some change. Do you have a plan for this?

Linux 6.7 is available so TSM reports exist. I updated the commit message with the link to the ABI spec. There's no immediate additional changes needed on the Kata side other than just to get 6.7 used. I'm collaborating with @fidencio on that.

fitzthum · 2024-01-18T16:16:51Z

Upstream CI issue is fixed btw. Please rebase at some point.

mythi · 2024-01-18T17:10:11Z

Upstream CI issue is fixed btw. Please rebase at some point.

done.

Xynnn007

Let's disscuss more

attestation-agent/attester/Cargo.toml

attestation-agent/attester/src/tdx/mod.rs

attestation-agent/attester/src/tsm_report/mod.rs

mythi · 2024-01-19T07:11:16Z

(rebased to trigger CI but no code changes at this time)

fitzthum

Thanks. I'm hoping we can use TSM for SNP as well.

I left a few comments. I think you can probably simplify a lot how the features are used.

attestation-agent/attester/src/tsm_report/mod.rs

attestation-agent/attester/Cargo.toml

attestation-agent/attester/src/tdx/mod.rs

attestation-agent/attester/src/tsm_report/mod.rs

portersrc

lgtm

attestation-agent/attester/src/tsm_report/mod.rs

attestation-agent/attester/src/tdx/mod.rs

fitzthum · 2024-02-02T21:40:37Z

This is looking good @mythi. I left a couple more comments.

mythi · 2024-02-05T11:30:25Z

This is looking good @mythi. I left a couple more comments.

@fitzthum great comments, thanks!

fitzthum

LGTM. Let's make sure @Xynnn007 has another look at it

attestation-agent/attester/src/tdx/mod.rs

attestation-agent/attester/src/tsm_report/mod.rs

attestation-agent/attester/src/tdx/mod.rs

mythi · 2024-02-07T06:55:35Z

LGTM. Let's make sure @Xynnn007 has another look at it

@Xynnn007 there was one minor lint error after my updates yesterday but this should be good to go now.

arronwy

Thanks @mythi LGTM!

Xynnn007

Overall, lgtm. Some coding things to think about

Xynnn007 · 2024-02-08T03:48:39Z

attestation-agent/attester/src/tdx/mod.rs

+                    .with_context(|| format!("TDX Attester: get_quote_ioctl() fallback failed after a TSM report error ({notsm})"))
+            },
+            |tsm| {
+                tsm.attestation_report(TsmReportData::Tdx(report_data.clone()))


Do we need .clone() here?

the short answer is 'yes' but I'm open to brainstorm how this gets passed to attestation_report()

attestation-agent/attester/src/tdx/mod.rs

attestation-agent/attester/src/tsm_report/mod.rs

attestation-agent/attester/src/tdx/mod.rs

mythi · 2024-02-08T11:41:53Z

Added some tests too.

attestation-agent/attester/src/tsm_report/mod.rs

mythi · 2024-02-12T15:44:17Z

@fitzthum FYI, this has all review comments addressed and approvals from @arronwy and @Xynnn007

Linux 6.7 added a common ABI for CVMs to provide their attestation reports. It's based on configfs and the quotes can be generated using the 'TSM reports'. Documentation: https://www.kernel.org/doc/Documentation/ABI/testing/configfs-tsm Add a tsm_report module that CoCo attesters can use to generate quotes to be included in their attestation evidence. Signed-off-by: Mikko Ylinen <[email protected]>

Move tdx attester to primarily use TSM reports to get the quotes generated. The ioctl() based get-quote mechanisms have never been upstreamed so they can be considered 'deprecated'. However, a feature switch is added to keep the old functionality available for now. Signed-off-by: Mikko Ylinen <[email protected]>

mythi · 2024-02-15T19:11:53Z

rebased to get CI green

fitzthum · 2024-02-15T20:13:22Z

Ok, sorry for the delays on this. Took a while since it touches some important things. We may need some follow-up work (for other platforms, for instance), but this seems like a good start.

Thanks @mythi

mythi · 2024-02-16T05:15:58Z

We may need some follow-up work (for other platforms, for instance), but this seems like a good start.

Agree that follow-up work is needed. Do you think it would be good to have an issue about it? I'm counting at least 4 future work items depending on how they land upstream: SEV, SEV SVSM, RTMR writes, maybe TDX get-report and ioctl deprecation.

mythi requested review from jialez0 and sameo as code owners January 16, 2024 11:20

mythi force-pushed the tsm_report branch from 8cddd57 to 3b9c981 Compare January 16, 2024 12:49

mythi force-pushed the tsm_report branch from 3b9c981 to 82ee017 Compare January 17, 2024 09:18

Xynnn007 mentioned this pull request Jan 18, 2024

AA/kbs_protocol: fix the RCAR handshake unit test #438

Merged

Xynnn007 reviewed Jan 18, 2024

View reviewed changes

mythi force-pushed the tsm_report branch from 30f8bef to 38c23e6 Compare January 18, 2024 08:30

mythi force-pushed the tsm_report branch from 38c23e6 to 48e31bc Compare January 18, 2024 11:14

mythi force-pushed the tsm_report branch from 48e31bc to da97958 Compare January 18, 2024 17:09

mythi force-pushed the tsm_report branch from da97958 to d59985f Compare January 18, 2024 18:31

Xynnn007 reviewed Jan 19, 2024

View reviewed changes

mythi force-pushed the tsm_report branch from d59985f to 91472b0 Compare January 19, 2024 07:10

mythi force-pushed the tsm_report branch 2 times, most recently from b4e3780 to 4e190ae Compare January 19, 2024 18:37

fitzthum reviewed Jan 19, 2024

View reviewed changes

mythi force-pushed the tsm_report branch 5 times, most recently from daa4d92 to 0c9a88c Compare January 24, 2024 06:42

mythi mentioned this pull request Jan 24, 2024

RFC: attester: tdx: try not to error on broken report_data #452

Merged

mythi force-pushed the tsm_report branch 3 times, most recently from c03ac3c to df22dfc Compare January 28, 2024 16:49

mythi force-pushed the tsm_report branch from df22dfc to 0578271 Compare February 2, 2024 07:42

portersrc approved these changes Feb 2, 2024

View reviewed changes

fitzthum reviewed Feb 2, 2024

View reviewed changes

attestation-agent/attester/src/tsm_report/mod.rs Outdated Show resolved Hide resolved

fitzthum reviewed Feb 2, 2024

View reviewed changes

attestation-agent/attester/src/tdx/mod.rs Outdated Show resolved Hide resolved

fitzthum reviewed Feb 2, 2024

View reviewed changes

attestation-agent/attester/src/tdx/mod.rs Outdated Show resolved Hide resolved

mythi force-pushed the tsm_report branch from 0578271 to 41f5fc4 Compare February 5, 2024 11:20

fitzthum approved these changes Feb 5, 2024

View reviewed changes

Lu-Biao reviewed Feb 6, 2024

View reviewed changes

attestation-agent/attester/src/tdx/mod.rs Outdated Show resolved Hide resolved

attestation-agent/attester/src/tsm_report/mod.rs Outdated Show resolved Hide resolved

attestation-agent/attester/src/tdx/mod.rs Outdated Show resolved Hide resolved

mythi force-pushed the tsm_report branch 2 times, most recently from 72530e3 to 1bf0fcf Compare February 7, 2024 06:45

arronwy approved these changes Feb 7, 2024

View reviewed changes

Xynnn007 approved these changes Feb 8, 2024

View reviewed changes

mythi force-pushed the tsm_report branch 2 times, most recently from 8874143 to e93788a Compare February 8, 2024 11:41

Xynnn007 reviewed Feb 8, 2024

View reviewed changes

attestation-agent/attester/src/tsm_report/mod.rs Outdated Show resolved Hide resolved

mythi force-pushed the tsm_report branch from e93788a to 00d0787 Compare February 9, 2024 09:30

mythi added 2 commits February 15, 2024 21:10

mythi force-pushed the tsm_report branch from 00d0787 to 22b1708 Compare February 15, 2024 19:11

fitzthum merged commit f629e9e into confidential-containers:main Feb 15, 2024
12 checks passed

mythi mentioned this pull request Jun 4, 2024

tdx-attester: make DCAP libs optional #572

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

attester: add TSM REPORT module and move TDX to use it #434

attester: add TSM REPORT module and move TDX to use it #434

mythi commented Jan 16, 2024 •

edited

Loading

mythi commented Jan 16, 2024

Xynnn007 left a comment

mythi commented Jan 18, 2024

fitzthum commented Jan 18, 2024

mythi commented Jan 18, 2024

Xynnn007 left a comment

mythi commented Jan 19, 2024

fitzthum left a comment

portersrc left a comment

fitzthum commented Feb 2, 2024

mythi commented Feb 5, 2024

fitzthum left a comment

mythi commented Feb 7, 2024

arronwy left a comment

Xynnn007 left a comment

Xynnn007 Feb 8, 2024

mythi Feb 8, 2024

mythi commented Feb 8, 2024

mythi commented Feb 12, 2024

mythi commented Feb 15, 2024

fitzthum commented Feb 15, 2024 •

edited

Loading

mythi commented Feb 16, 2024

attester: add TSM REPORT module and move TDX to use it #434

attester: add TSM REPORT module and move TDX to use it #434

Conversation

mythi commented Jan 16, 2024 • edited Loading

mythi commented Jan 16, 2024

Xynnn007 left a comment

Choose a reason for hiding this comment

mythi commented Jan 18, 2024

fitzthum commented Jan 18, 2024

mythi commented Jan 18, 2024

Xynnn007 left a comment

Choose a reason for hiding this comment

mythi commented Jan 19, 2024

fitzthum left a comment

Choose a reason for hiding this comment

portersrc left a comment

Choose a reason for hiding this comment

fitzthum commented Feb 2, 2024

mythi commented Feb 5, 2024

fitzthum left a comment

Choose a reason for hiding this comment

mythi commented Feb 7, 2024

arronwy left a comment

Choose a reason for hiding this comment

Xynnn007 left a comment

Choose a reason for hiding this comment

Xynnn007 Feb 8, 2024

Choose a reason for hiding this comment

mythi Feb 8, 2024

Choose a reason for hiding this comment

mythi commented Feb 8, 2024

mythi commented Feb 12, 2024

mythi commented Feb 15, 2024

fitzthum commented Feb 15, 2024 • edited Loading

mythi commented Feb 16, 2024

mythi commented Jan 16, 2024 •

edited

Loading

fitzthum commented Feb 15, 2024 •

edited

Loading