Repository navigation
deps: bump dcap-qvl to 0.7.0 - #1498
Merged
Merged
Conversation
dcap-qvl 0.5.3 compared all 16 bytes of TEE_TCB_SVN against the platform TCB levels. With a non-zero TDX module version (TEE_TCB_SVN[1]), Intel's QVL matches the platform on TEE_TCB_SVN[2..] and appraises the module SVN through tdxModuleIdentities instead, so 0.5.3 refused quotes from hosts whose module SVN is below the levels' byte 0 with "No matching TCB level found". 0.7.0 evaluates them as Intel's QVL does. 0.7.0 reworked TDAttributes, so the local key provider now checks the raw TD_ATTRIBUTES against the same allowed bits as before (SEPT_VE_DISABLE, PKS, KL, PERFMON). validate_tcb handles the new TD 1.5ex report body like TD 1.5, as dcap-qvl does. Fixes #1462 Signed-off-by: Kevin Wang <wy721@qq.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1462.
dcap-qvl 0.5.3 compares all 16 bytes of
TEE_TCB_SVNagainst the platform TCB levels, so hosts whose TDX module SVN is below the levels' byte 0 (e.g. Granite Rapids with an older TDX module 2.0) fail withNo matching TCB level found. 0.7.0 matches the platform onTEE_TCB_SVN[2..]and appraises the module throughtdxModuleIdentities, like Intel's QVL.Code changes:
local-key-provider:TDAttributeswas reworked in 0.7.0;require_production_tdnow checks the rawTD_ATTRIBUTESagainst the same allowed bits as before (SEPT_VE_DISABLE, PKS, KL, PERFMON). The policy is unchanged.dstack-attest::validate_tcb: handle the newReport::TD15Ex(quote v5 body type 4) like TD 1.5, as dcap-qvl does.Behavior changes from dcap-qvl (0.5.3..0.7.0), all aligning with Intel's QVL:
OutOfDateorRevoked(e.g. a QE atConfigurationNeededno longer downgrades anUpToDateplatform).TEE_TCB_SVN2is now appraised too; a TD launched out of date but running an up-to-date TCB reportsTDRelaunchAdvisedinstead ofOutOfDate.UpToDate-only allowlists (the KMS contracts, auth-simple default) are unaffected.TDX_XXmodule identity.Collateral and
VerifiedReportformats are unchanged. Upgrading changes the local key provider enclave's MRENCLAVE.Tested:
cargo test --all-features --workspace, clippy; a quote from a Granite Rapids B200 host (FMSPC00A06D080000) verifiesUpToDatewith both 0.5.3 and 0.7.0.