Merge pull request #5579 from oasisprotocol/kostko/stable/23.0.x/back…

…port-multi-3

[BACKPORT/23.0.x] Multiple backports

.changelog/5523.internal.md

@@ -0,0 +1 @@
+runtime: Increase number of processing threads in SGX

.changelog/5578.feature.md

@@ -0,0 +1 @@
+sgx: Support early updates for ECDSA TCB infos

go/common/sgx/pcs/http.go

@@ -88,15 +88,14 @@ func (hc *httpClient) getUrl(p string) *url.URL { // nolint: revive
 	return &u
 }
 
-func (hc *httpClient) GetTCBBundle(ctx context.Context, fmspc []byte) (*TCBBundle, error) {
-	// TODO: Cache based on FMSPC, with TTL that is less than expiration time.
-
+func (hc *httpClient) GetTCBBundle(ctx context.Context, fmspc []byte, update UpdateType) (*TCBBundle, error) {
 	var tcbBundle TCBBundle
 
 	// First fetch TCB info.
 	u := hc.getUrl(pcsAPIGetTCBInfoPath)
 	q := u.Query()
 	q.Set("fmspc", hex.EncodeToString(fmspc))
+	q.Set("update", string(update))
 	u.RawQuery = q.Encode()
 	rsp, err := hc.doPCSRequest(ctx, u, http.MethodGet, "", nil, false)
 	if err != nil {
@@ -120,6 +119,9 @@ func (hc *httpClient) GetTCBBundle(ctx context.Context, fmspc []byte) (*TCBBundl
 
 	// Then fetch QE identity.
 	u = hc.getUrl(pcsAPIGetQEIdentityPath)
+	q = u.Query()
+	q.Set("update", string(update))
+	u.RawQuery = q.Encode()
 	rsp, err = hc.doPCSRequest(ctx, u, http.MethodGet, "", nil, false)
 	if err != nil {
 		return nil, fmt.Errorf("pcs: QE identity request failed: %w", err)

go/common/sgx/pcs/pcs.go

@@ -14,10 +14,22 @@ var (
 	mrSignerBlacklist = make(map[sgx.MrSigner]bool)
 )
 
+// UpdateType is the type of update to TCB info.
+type UpdateType string
+
+const (
+	// UpdateStandard indicates standard access to updated TCB Info provided as part of a TCB
+	// recovery event.
+	UpdateStandard UpdateType = "standard"
+	// UpdateEarly indicates an early access to updated TCB Info provided as part of a TCB recovery
+	// event.
+	UpdateEarly UpdateType = "early"
+)
+
 // Client is an Intel SGX PCS client interface.
 type Client interface {
 	// GetTCBBundle retrieves the signed TCB artifacts needed to verify a quote.
-	GetTCBBundle(ctx context.Context, fmspc []byte) (*TCBBundle, error)
+	GetTCBBundle(ctx context.Context, fmspc []byte, update UpdateType) (*TCBBundle, error)
 
 	// GetPCKCertificateChain retrieves the PCK certificate chain for the given platform data or PPID.
 	//

go/runtime/host/sgx/ecdsa.go

@@ -144,14 +144,15 @@ func (ec *teeStateECDSA) Update(ctx context.Context, sp *sgxProvisioner, conn pr
 	// also do their own verification).
 	// Check bundles in order: fresh first, then cached, then try downloading again if there was
 	// no scheduled refresh this time.
-	tcbBundle, err := func() (*pcs.TCBBundle, error) {
+	getTcbBundle := func(update pcs.UpdateType) (*pcs.TCBBundle, error) {
 		var fresh *pcs.TCBBundle
 
 		cached, refresh := ec.tcbCache.check(pckInfo.FMSPC)
 		if refresh {
-			if fresh, err = sp.pcs.GetTCBBundle(ctx, pckInfo.FMSPC); err != nil {
+			if fresh, err = sp.pcs.GetTCBBundle(ctx, pckInfo.FMSPC, update); err != nil {
 				sp.logger.Warn("error downloading TCB refresh",
 					"err", err,
+					"update", update,
 				)
 			}
 			if err = ec.verifyBundle(quote, quotePolicy, fresh, sp, "fresh"); err == nil {
@@ -160,6 +161,7 @@ func (ec *teeStateECDSA) Update(ctx context.Context, sp *sgxProvisioner, conn pr
 			}
 			sp.logger.Warn("error verifying downloaded TCB refresh",
 				"err", err,
+				"update", update,
 			)
 		}
 
@@ -169,13 +171,18 @@ func (ec *teeStateECDSA) Update(ctx context.Context, sp *sgxProvisioner, conn pr
 
 		// If downloaded already, don't try again but just return the last error.
 		if refresh {
+			sp.logger.Warn("error verifying cached TCB",
+				"err", err,
+				"update", update,
+			)
 			return nil, fmt.Errorf("both fresh and cached TCB bundles failed verification, cached error: %w", err)
 		}
 
 		// If not downloaded yet this time round, try forcing. Any errors are fatal.
-		if fresh, err = sp.pcs.GetTCBBundle(ctx, pckInfo.FMSPC); err != nil {
+		if fresh, err = sp.pcs.GetTCBBundle(ctx, pckInfo.FMSPC, update); err != nil {
 			sp.logger.Warn("error downloading TCB",
 				"err", err,
+				"update", update,
 			)
 			return nil, err
 		}
@@ -184,7 +191,13 @@ func (ec *teeStateECDSA) Update(ctx context.Context, sp *sgxProvisioner, conn pr
 		}
 		ec.tcbCache.cache(fresh, pckInfo.FMSPC)
 		return fresh, nil
-	}()
+	}
+	var tcbBundle *pcs.TCBBundle
+	for _, update := range []pcs.UpdateType{pcs.UpdateStandard, pcs.UpdateEarly} {
+		if tcbBundle, err = getTcbBundle(update); err == nil {
+			break
+		}
+	}
 	if err != nil {
 		return nil, err
 	}

runtime/Cargo.toml

@@ -25,7 +25,7 @@ dcap-ql = { version = "0.3.4", default-features = false, features = ["verify"] }
 mbedtls = "0.8.1"
 yasna = { version = "0.5.0", features = ["num-bigint"] }
 bincode = "1.3.3"
-snow = "0.9.3"
+snow = "0.9.6"
 percent-encoding = "2.2.0"
 chrono = "0.4.19"
 base64 = "0.13.0"

runtime/THREADS.md

@@ -1,12 +1,12 @@
 # Threads
 
-The following **8 threads** are used by the runtime:
+The following **26 threads** are used by the runtime:
 
 * 2 runtime host protocol I/O threads.
 * 1 consensus verifier thread.
 * 1 dispatcher main loop thread.
-* 2 dispatcher worker threads.
-* 2 dispatcher processing threads.
+* 6 dispatcher worker threads.
+* 16 dispatcher processing threads.
 
 This must be taken into account when building the runtime for SGX as all the
 thread control structures (TCS) must be defined in advance.

runtime/src/future.rs

@@ -8,8 +8,8 @@ pub fn new_tokio_runtime() -> tokio::runtime::Runtime {
     //
     // Make sure to update THREADS.md if you change any of the thread-related settings.
     tokio::runtime::Builder::new_multi_thread()
-        .worker_threads(2)
-        .max_blocking_threads(2)
+        .worker_threads(6)
+        .max_blocking_threads(16)
         .thread_keep_alive(std::time::Duration::MAX)
         .build()
         .unwrap()

tests/runtimes/simple-keymanager/Cargo.toml

@@ -15,9 +15,9 @@ doc = false
 path = "src/upgraded.rs"
 
 [package.metadata.fortanix-sgx]
-heap-size = 134217728
+heap-size = 536870912 # 512 MiB
 stack-size = 2097152
-threads = 8
+threads = 26
 
 [dependencies]
 oasis-core-runtime = { path = "../../../runtime" }

tests/runtimes/simple-keyvalue/Cargo.toml

@@ -15,9 +15,9 @@ doc = false
 path = "src/upgraded.rs"
 
 [package.metadata.fortanix-sgx]
-heap-size = 134217728
+heap-size = 536870912 # 512 MiB
 stack-size = 2097152
-threads = 8
+threads = 26
 
 [dependencies]
 cbor = { version = "0.5.1", package = "oasis-cbor" }