aa/attester: add IBM Secure Execution driver framework #492

huoqifeng · 2024-02-29T14:25:57Z

This is the initial draft to fix: #485 and the draft PR provides the API framework without a real pvattest crate yet.

Try it after adding the new Tee type Tee::Se in https://github.com/virtee/kbs-types/blob/main/src/lib.rs#L24, run:

cd guest-components
TEE_PLATFORM=se KBC=cc_kbc make

Depends on:

Add a new TEE type: SE (IBM Secure Execution) virtee/kbs-types#26

Xynnn007 · 2024-03-01T02:56:59Z

Thanks @huoqifeng for the contribution! I'd love to review this if it is ok : D

huoqifeng · 2024-03-06T03:59:47Z

@Xynnn007 this is not fully ready for review, but I think we can start discuss the potential changes both on guest-components side and on trustee side, trustee change is tracked by confidential-containers/trustee#345.

We want to move the challenge generation from session to attestation-service and introduce a new fn generate_challenge. like in https://github.com/huoqifeng/trustee/blob/s390x-verifier/attestation-service/attestation-service/src/lib.rs#L243, we want use this challenge.extra_params in guest like https://github.com/huoqifeng/guest-components/blob/s390x-attester/attestation-agent/kbs_protocol/src/client/rcar_client.rs#L140, a sub-field in extra_params also works for us.

The reason is: for IBM Secure Execution (SE), attester need an attestation-request to generate the evidence, while the attestation-request should always be created on verifier. CC @BbolroC @steffen-eiden

huoqifeng · 2024-03-15T07:06:28Z

@Xynnn007 @fitzthum I'd like start the review process of the API change to support IBM SE. May you please help on that?

huoqifeng · 2024-05-30T14:37:35Z

@mkulke @Xynnn007 comments addressed, thanks for all of your review! I'm curious why the CI is not health with no failure task?

mkulke · 2024-05-30T14:53:14Z

@mkulke @Xynnn007 comments addressed, thanks for all of your review! I'm curious why the CI is not health with no failure task?

some workflows have been cancelled, seemingly for no reason. I've noticed this problem elsewhere this week, I'll re-schedule the cancelled ones, that worked so far.

mkulke

lgtm

Xynnn007

Some more nits..

attestation-agent/attester/Cargo.toml

attestation-agent/attester/src/se/ibmse.rs

attestation-agent/attester/src/se/mod.rs

attestation-agent/attester/src/se/ibmse.rs

We are encountering an issue on s390x when compiling AS with `all-verifier`. The error message is as follows: ``` error: failed to run custom build command for `tss-esapi-sys v0.5.0` ``` A platform-specific verifier (e.g., `se-verifier`) is used here. (confidential-containers/guest-components#492) Although we can easily configure the verifier using `--features`, this approach lacks flexibility when the crate is selectively called from outside (e.g., kbs) based on `target_arch`. The optimal solution would be to open up room for configuring the verifier at a `dependencies` level rather than a `features` level. This commit aims to remove `all-verifier` from the default feature set and configure it differently for s390x. Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>

huoqifeng · 2024-06-04T01:02:18Z

@Xynnn007 I guess the failure in https://github.com/confidential-containers/guest-components/actions/runs/9358373555/job/25760080271?pr=492 is caused by network connection?

huoqifeng · 2024-06-04T03:15:27Z

@mkulke @Xynnn007 thank you very much for reviewing the PR and gave so many useful suggestions! thanks for your approval.

* aa/attester: add IBM Secure Execution evidence driver framework Signed-off-by: Qi Feng Huo <huoqif@cn.ibm.com> * aa/attester: IBM SE use nonce to pass attestation request Signed-off-by: Qi Feng Huo <huoqif@cn.ibm.com> --------- Signed-off-by: Qi Feng Huo <huoqif@cn.ibm.com>

huoqifeng · 2024-06-04T13:23:24Z

Squashed commits.

Xynnn007

Looks good. Thanks @huoqifeng .

attestation-agent/attester/src/se/mod.rs

Signed-off-by: Qi Feng Huo <huoqif@cn.ibm.com>

fitzthum

Looks pretty good. A couple minor comments.

attestation-agent/attester/src/se/mod.rs

attestation-agent/kbs_protocol/src/client/rcar_client.rs

steffen-eiden

s390 architecture stuff looks good.
You still have some unnecessary clones.

attestation-agent/attester/src/se/mod.rs

mkulke · 2024-06-07T15:12:36Z

@huoqifeng I noticed the CI will not alert about code that doesn't compile in the se-attester module. I suppose due to the target-toggle. Do you plan to add CI for s390? If not, maybe we should revisit that toggle, otherwise the code will break unnoticed w/ future refactorings.

Signed-off-by: Qi Feng Huo <huoqif@cn.ibm.com>

huoqifeng · 2024-06-07T15:26:21Z

@huoqifeng I noticed the CI will not alert about code that doesn't compile in the se-attester module. I suppose due to the target-toggle. Do you plan to add CI for s390? If not, maybe we should revisit that toggle, otherwise the code will break unnoticed w/ future refactorings.

I know @BbolroC is working on this, maybe, we bring back the change in lib.rs to enable CI for se? I just noticed it also.

fitzthum

LGTM

Some kind of test coverage would be good. Maybe that is a follow-on?

This commit make the existing build/test for attestation agent running on s390x. We will enable `cargo test` after an image for kbs is ready. (confidential-containers/trustee#383) The build option for attestor is not configured here, but a new attester for s390x will be added by confidential-containers#492.

This commit make the existing build/test for attestation agent running on s390x. We will enable `cargo test` after an image for kbs is ready. (confidential-containers/trustee#383) The build option for attestor is not configured here, but a new attester for s390x will be added by confidential-containers#492. Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>

BbolroC · 2024-06-10T20:02:17Z

For reviewers, you can find CI enablement for s390x at #576 . Thanks! 😉

huoqifeng force-pushed the s390x-attester branch 4 times, most recently from c6a4fad to f82d20b Compare March 6, 2024 00:09

huoqifeng changed the title ~~aa/attester: add s390x z16 evidence driver framework~~ aa/attester: add IBM Secure Execution (SE) evidence driver framework Mar 6, 2024

huoqifeng force-pushed the s390x-attester branch from f82d20b to addfe37 Compare March 6, 2024 03:19

huoqifeng mentioned this pull request Mar 6, 2024

Verifier: Add IBM Secure Execution driver framework confidential-containers/trustee#345

Merged

1 task

huoqifeng changed the title ~~aa/attester: add IBM Secure Execution (SE) evidence driver framework~~ aa/attester: add IBM Secure Execution evidence driver framework Mar 6, 2024

huoqifeng changed the title ~~aa/attester: add IBM Secure Execution evidence driver framework~~ [WIP] aa/attester: add IBM Secure Execution evidence driver framework Mar 6, 2024

huoqifeng force-pushed the s390x-attester branch 11 times, most recently from 8cc2716 to 718c63c Compare March 11, 2024 08:44

huoqifeng force-pushed the s390x-attester branch from cca0fcb to 334a0dc Compare March 15, 2024 06:06

huoqifeng changed the title ~~[WIP] aa/attester: add IBM Secure Execution evidence driver framework~~ aa/attester: add IBM Secure Execution evidence driver framework Mar 15, 2024

huoqifeng marked this pull request as ready for review March 21, 2024 01:00

huoqifeng requested review from jialez0 and sameo as code owners March 21, 2024 01:00

huoqifeng changed the title ~~aa/attester: add IBM Secure Execution evidence driver framework~~ aa/attester: add IBM Secure Execution driver framework Mar 21, 2024

huoqifeng mentioned this pull request Mar 21, 2024

Attestation: add extra parameters virtee/kbs-types#38

Closed

mkulke approved these changes May 31, 2024

View reviewed changes

Xynnn007 reviewed Jun 3, 2024

View reviewed changes

huoqifeng force-pushed the s390x-attester branch 2 times, most recently from c7b4d93 to ebfbab8 Compare June 3, 2024 22:56

huoqifeng force-pushed the s390x-attester branch from cdeabd4 to ac1d677 Compare June 4, 2024 13:20

huoqifeng force-pushed the s390x-attester branch from ac1d677 to 2e4b06e Compare June 4, 2024 13:21

Xynnn007 approved these changes Jun 5, 2024

View reviewed changes

attestation-agent/attester/src/se/mod.rs Outdated Show resolved Hide resolved

Xynnn007 reviewed Jun 5, 2024

View reviewed changes

attestation-agent/attester/src/se/mod.rs Outdated Show resolved Hide resolved

Xynnn007 reviewed Jun 5, 2024

View reviewed changes

attestation-agent/attester/src/se/mod.rs Show resolved Hide resolved

aa/attester: IBM Secure Execution driver fix comments

e0af5a2

Signed-off-by: Qi Feng Huo <huoqif@cn.ibm.com>

huoqifeng force-pushed the s390x-attester branch from d56db2a to e0af5a2 Compare June 5, 2024 03:59

fitzthum reviewed Jun 5, 2024

View reviewed changes

attestation-agent/attester/src/se/mod.rs Outdated Show resolved Hide resolved

attestation-agent/attester/src/se/mod.rs Outdated Show resolved Hide resolved

attestation-agent/kbs_protocol/src/client/rcar_client.rs Show resolved Hide resolved

steffen-eiden reviewed Jun 6, 2024

View reviewed changes

huoqifeng force-pushed the s390x-attester branch from 7481ed0 to c6dc4fd Compare June 7, 2024 14:46

aa/attester: IBM Secure Execution driver fix comments

403acd2

Signed-off-by: Qi Feng Huo <huoqif@cn.ibm.com>

huoqifeng force-pushed the s390x-attester branch from 0bf8618 to 403acd2 Compare June 7, 2024 15:25

fitzthum approved these changes Jun 10, 2024

View reviewed changes

Xynnn007 merged commit c543f20 into confidential-containers:main Jun 11, 2024
15 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

aa/attester: add IBM Secure Execution driver framework #492

aa/attester: add IBM Secure Execution driver framework #492

huoqifeng commented Feb 29, 2024 •

edited

Loading

Xynnn007 commented Mar 1, 2024

huoqifeng commented Mar 6, 2024 •

edited

Loading

huoqifeng commented Mar 15, 2024

huoqifeng commented May 30, 2024

mkulke commented May 30, 2024

mkulke left a comment

Xynnn007 left a comment

huoqifeng commented Jun 4, 2024

huoqifeng commented Jun 4, 2024

huoqifeng commented Jun 4, 2024

Xynnn007 left a comment

fitzthum left a comment

steffen-eiden left a comment

mkulke commented Jun 7, 2024

huoqifeng commented Jun 7, 2024 •

edited

Loading

fitzthum left a comment

BbolroC commented Jun 10, 2024

aa/attester: add IBM Secure Execution driver framework #492

aa/attester: add IBM Secure Execution driver framework #492

Conversation

huoqifeng commented Feb 29, 2024 • edited Loading

Xynnn007 commented Mar 1, 2024

huoqifeng commented Mar 6, 2024 • edited Loading

huoqifeng commented Mar 15, 2024

huoqifeng commented May 30, 2024

mkulke commented May 30, 2024

mkulke left a comment

Choose a reason for hiding this comment

Xynnn007 left a comment

Choose a reason for hiding this comment

huoqifeng commented Jun 4, 2024

huoqifeng commented Jun 4, 2024

huoqifeng commented Jun 4, 2024

Xynnn007 left a comment

Choose a reason for hiding this comment

fitzthum left a comment

Choose a reason for hiding this comment

steffen-eiden left a comment

Choose a reason for hiding this comment

mkulke commented Jun 7, 2024

huoqifeng commented Jun 7, 2024 • edited Loading

fitzthum left a comment

Choose a reason for hiding this comment

BbolroC commented Jun 10, 2024

huoqifeng commented Feb 29, 2024 •

edited

Loading

huoqifeng commented Mar 6, 2024 •

edited

Loading

huoqifeng commented Jun 7, 2024 •

edited

Loading