Differential Attestation reports generation #3
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR performs the following:
ProcessMasurements
structure in theProcessContext
. It currently includes the init (pal) measurement, the manifest measurement and the libos measurement that are calculated when aZygote
is loaded and inherited by the derivedTrustlets
.parent_id
field in the Trusted Process so that we know from whichZygote
eachTrustlet
is derived.measure
function takes a starting address and a size and returns the digest of this memory regionmonitor_report
generates, stores and returns the SNP reportzygote_report
retrieves theZygote
measurements based on thezygote_id
and returns the SNP report and the zygote measurement fields in a guest provided buffertrustlet_report
retrieves theTrustlet
measurements based on thetrustlet_id
and returns the SNP report and the trustlet measurement fields in a guest provided bufferfunction_report
deserializes the struct with thetrustlet id
, functioninput
andoutput
provided from the guest, retrieves theTrustlet
measurements and measures theinput
andoutput
. Then, it returns the SNP report and the trustlet measurement fields as well as the function data measurements in a guest provided bufferdiff_attestation
determines which function to be called for each attestation type. It is mostly there for convenience as the user should call only the function attestation eventually.SnpReportResponse
structmonitor_init()
stepTest
To test it, you need to use the update
t.c
test provided in theWallet-VMPL
repo.Versions:
Wallet-VMPL
: Branch:dimstav23/update_test_with_attestation
, commit:78f073bf832eea9939362e7595da9665fbcb156d
gramine-svsm
: Branch:dev
commit:66b537682590c96d1e0f923e6dfadadd6197ac2d
Steps:
cd module && make vmpl.ko && make reload && make t
./test 10
This will do the following:
init
the monitor and retrieve its reportZygote
and get its reportTrustlet
and get its reportfunction
withinput
andoutput
data and get its reportmodule
directory with descriptive names and structure for better readabilityNote: