Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

TDX: Ensure quote-generation-service is added to the QEMU command line #9497

Closed
fidencio opened this issue Apr 17, 2024 · 0 comments · Fixed by #9653
Closed

TDX: Ensure quote-generation-service is added to the QEMU command line #9497

fidencio opened this issue Apr 17, 2024 · 0 comments · Fixed by #9653
Labels
enhancement Improvement to an existing feature needs-review Needs to be assessed by the team.
Projects
Issue backlog

Comments

@fidencio
Copy link
Member

In order to use QEMU + TDX, and get the quote for the attestation, we need to make sure that QEMU is correctly started using the following command line -object tdx-guest,id=tdx,quote-generation-service=vsock:2:$qgs_port (default qgs_port is 4050).

From a quick look at the code, this is something that should be passed to

kata-containers/src/runtime/virtcontainers/qemu_amd64.go

Lines 278 to 290 in af3b19e

case tdxProtection:
id := q.devLoadersCount
q.devLoadersCount += 1
return append(devices,
govmmQemu.Object{
Driver: govmmQemu.Loader,
Type: govmmQemu.TDXGuest,
ID: "tdx",
DeviceID: fmt.Sprintf("fd%d", id),
Debug: false,
File: firmware,
FirmwareVolume: firmwareVolume,
}), "", nil
, and then https://github.com/kata-containers/kata-containers/blob/main/src/runtime/pkg/govmm/qemu/qemu.go should be adjusted accordingly to be able to build the correct command line for QEMU.

The port, unfortunately, will have to be exposed to the user, and I see this as an user experience problem, as the user deploying Kata Containers may not be the same user who'd set up QGS, but the best we can do is hope for some clear documentation on the CSPs side, to make sure that this information is available.

For this, we'd also need to:

  • Add a new tdx_quote_generation_service_port option as part of the config file, and this should only be used by the qemu-tdx configuration
  • We need to test that passing a quote-generation-service won't break QEMU to start when there's no QGS installed in the host, but rather only the attestation would fail

Jakub will be done working on this, so we may need a few more discussions to happen here before actually seeing a patch.
@fidencio fidencio added enhancement Improvement to an existing feature needs-review Needs to be assessed by the team. labels Apr 17, 2024
JakubLedworowski added a commit to JakubLedworowski/kata-containers that referenced this issue Apr 24, 2024
@JakubLedworowski
runtime: Enable connection to Quote Generation Service (QGS)
efc41cc 
For the TD attestation to work the connection to QGS on the host is needed.
By default QGS runs on vsock port 4050, but can be modified by the host owner.
Format of the qemu object follows the SocketAddress structure, so it needs to be provided in the JSON format, as in the example below:
-object '{"qom-type":"tdx-guest","id":"tdx0","quote-generation-socket":{"type":"vsock","cid":"2","port":"4050"}}'

Fixes: kata-containers#9497

Signed-off-by: Jakub Ledworowski <jakub.ledworowski@intel.com>
JakubLedworowski added a commit to JakubLedworowski/kata-containers that referenced this issue Apr 29, 2024
@JakubLedworowski
runtime: Enable connection to Quote Generation Service (QGS)
842fb2c 
For the TD attestation to work the connection to QGS on the host is needed.
By default QGS runs on vsock port 4050, but can be modified by the host owner.
Format of the qemu object follows the SocketAddress structure, so it needs to be provided in the JSON format, as in the example below:
-object '{"qom-type":"tdx-guest","id":"tdx","quote-generation-socket":{"type":"vsock","cid":"2","port":"4050"}}'

Fixes: kata-containers#9497
Signed-off-by: Jakub Ledworowski <jakub.ledworowski@intel.com>
JakubLedworowski added a commit to JakubLedworowski/kata-containers that referenced this issue May 15, 2024
@JakubLedworowski
runtime: Enable connection to Quote Generation Service (QGS)
4d5b163 
Fix formatting.

Fixes: kata-containers#9497
Signed-off-by: Jakub Ledworowski <jakub.ledworowski@intel.com>
JakubLedworowski added a commit to JakubLedworowski/kata-containers that referenced this issue May 15, 2024
@JakubLedworowski
runtime: Enable connection to Quote Generation Service (QGS)
afc39fa 
Bring back debug option to TdxQomObject.

Fixes: kata-containers#9497
Signed-off-by: Jakub Ledworowski <jakub.ledworowski@intel.com>
JakubLedworowski added a commit to JakubLedworowski/kata-containers that referenced this issue May 17, 2024
@JakubLedworowski
runtime: Enable connection to Quote Generation Service (QGS)
7de53c6 
For the TD attestation to work the connection to QGS on the host is needed.
By default QGS runs on vsock port 4050, but can be modified by the host owner.
Format of the qemu object follows the SocketAddress structure, so it needs to be provided in the JSON format, as in the example below:
-object '{"qom-type":"tdx-guest","id":"tdx","quote-generation-socket":{"type":"vsock","cid":"2","port":"4050"}}'

Fixes: kata-containers#9497
Signed-off-by: Jakub Ledworowski <jakub.ledworowski@intel.com>
This was referenced May 17, 2024
Closed
Merged
@katacontainersbot katacontainersbot moved this from To do to In progress in Issue backlog May 17, 2024
JakubLedworowski added a commit to JakubLedworowski/kata-containers that referenced this issue May 20, 2024
@JakubLedworowski
runtime: Enable connection to Quote Generation Service (QGS)
b4f5a6a 
For the TD attestation to work the connection to QGS on the host is needed.
By default QGS runs on vsock port 4050, but can be modified by the host owner.
Format of the qemu object follows the SocketAddress structure, so it needs to be provided in the JSON format, as in the example below:
-object '{"qom-type":"tdx-guest","id":"tdx","quote-generation-socket":{"type":"vsock","cid":"2","port":"4050"}}'

Fixes: kata-containers#9497
Signed-off-by: Jakub Ledworowski <jakub.ledworowski@intel.com>
JakubLedworowski added a commit to JakubLedworowski/kata-containers that referenced this issue May 20, 2024
@JakubLedworowski
runtime: Enable connection to Quote Generation Service (QGS)
f544438 
For the TD attestation to work the connection to QGS on the host is needed.
By default QGS runs on vsock port 4050, but can be modified by the host owner.
Format of the qemu object follows the SocketAddress structure, so it needs to be provided in the JSON format, as in the example below:
-object '{"qom-type":"tdx-guest","id":"tdx","quote-generation-socket":{"type":"vsock","cid":"2","port":"4050"}}'

Fixes: kata-containers#9497
Signed-off-by: Jakub Ledworowski <jakub.ledworowski@intel.com>
fidencio pushed a commit to GabyCT/kata-containers that referenced this issue May 21, 2024
@JakubLedworowski @fidencio
runtime: Enable connection to Quote Generation Service (QGS)
45c0b9d 
For the TD attestation to work the connection to QGS on the host is needed.
By default QGS runs on vsock port 4050, but can be modified by the host owner.
Format of the qemu object follows the SocketAddress structure, so it needs to be provided in the JSON format, as in the example below:
-object '{"qom-type":"tdx-guest","id":"tdx","quote-generation-socket":{"type":"vsock","cid":"2","port":"4050"}}'

Fixes: kata-containers#9497
Signed-off-by: Jakub Ledworowski <jakub.ledworowski@intel.com>
JakubLedworowski added a commit to JakubLedworowski/kata-containers that referenced this issue May 22, 2024
@JakubLedworowski
runtime: Enable connection to Quote Generation Service (QGS)
fc68013 
For the TD attestation to work the connection to QGS on the host is needed.
By default QGS runs on vsock port 4050, but can be modified by the host owner.
Format of the qemu object follows the SocketAddress structure, so it needs to be provided in the JSON format, as in the example below:
-object '{"qom-type":"tdx-guest","id":"tdx","quote-generation-socket":{"type":"vsock","cid":"2","port":"4050"}}'

Fixes: kata-containers#9497
Signed-off-by: Jakub Ledworowski <jakub.ledworowski@intel.com>
fidencio pushed a commit to GabyCT/kata-containers that referenced this issue May 22, 2024
@JakubLedworowski @fidencio
runtime: Enable connection to Quote Generation Service (QGS)
cb0e321 
For the TD attestation to work the connection to QGS on the host is needed.
By default QGS runs on vsock port 4050, but can be modified by the host owner.
Format of the qemu object follows the SocketAddress structure, so it needs to be provided in the JSON format, as in the example below:
-object '{"qom-type":"tdx-guest","id":"tdx","quote-generation-socket":{"type":"vsock","cid":"2","port":"4050"}}'

Fixes: kata-containers#9497
Signed-off-by: Jakub Ledworowski <jakub.ledworowski@intel.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement Improvement to an existing feature needs-review Needs to be assessed by the team.
Projects
Issue backlog
  
In progress
Milestone
No milestone
1 participant
@fidencio