You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Add governance action that supports specifying minimum TCB versions in hexstring format. This is intended to be the default format going forward. (#7078)
Copy file name to clipboardExpand all lines: doc/build_apps/migration_5_x_to_6_0.rst
+5Lines changed: 5 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,6 +23,11 @@ This introduced a new table, ``nodes.snp.tcb_versions``, which is the minimum TC
23
23
Old networks which are migrating to 6.0 will need to populate this table manually, using the ``set_snp_minimum_tcb_version`` governance action.
24
24
If they are not populated then new nodes may fail to join the network.
25
25
26
+
.. note::
27
+
In 6.0.9 we introduced ``set_minimum_tcb_version_hex``, a more ergonomic governance action to set the minimum TCB version.
28
+
This action takes a CPUID and the hex-string format of a TCB version, as you would find it in an attestation, and stores the parsed fields of the TCB version in the ``nodes.snp.tcb_versions`` table, alongside the original hex-string.
29
+
We strongly recommend using this action as we can transparently add support for new CPU models which change the TCB version format, such as Turin.
30
+
26
31
For example to set the minimum TCB version on Milan CPUs the following proposal can be submitted:
Copy file name to clipboardExpand all lines: doc/operations/platforms/snp.rst
+87-1Lines changed: 87 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -77,7 +77,93 @@ The following governance proposals can be issued to add/remove these trusted val
77
77
- ``add_snp_host_data``/``remove_snp_host_data``: To add/remove a trusted security policy, e.g. when adding a new trusted container image as part of the code upgrade procedure.
78
78
- ``add_snp_uvm_endorsement``/``add_snp_uvm_endorsement``: To add remove a trusted UVM endorsement (Azure deployment only).
79
79
- ``add_snp_measurement``/``remove_snp_measurement``: To add/remove a trusted measurement.
80
-
- ``set_snp_minimum_tcb_version``/``remove_snp_minimum_tcb_version``: To add/remove a minimum trusted TCB version.
80
+
- ``set_snp_minimum_tcb_version_hex``/``remove_snp_minimum_tcb_version``: To add/remove a minimum trusted TCB version.
81
+
- ``set_snp_minimum_tcb_version`` was deprecated in CCF 6.0.9 and replaced by ``set_snp_minimum_tcb_version_hex``.
82
+
83
+
Setting the minimum TCB Version using ``set_snp_minimum_tcb_version_hex``
The `set_snp_minimum_tcb_version_hex` governance action was introduced in CCF 6.0.9 to simplify the process of setting the minimum TCB version for a specific CPU model. This action allows you to specify the CPUID and the TCB version as hex-strings, which are then parsed and stored in the :ref:`audit/builtin_maps:``nodes.snp.tcb_versions``` table.
87
+
To set the minimum TCB version for a specific CPU model, you can use the following governance action:
88
+
.. code-block:: json
89
+
90
+
{
91
+
"actions": [
92
+
{
93
+
"name": "set_snp_minimum_tcb_version_hex",
94
+
"args": {
95
+
"cpuid": "00a00f11",
96
+
"tcb_version": "d315000000000004"
97
+
}
98
+
}
99
+
]
100
+
}
101
+
102
+
The parsed TCB version mapped to that cpuid in the :ref:`audit/builtin_maps:``nodes.snp.tcb_versions``` table, which is used to validate the TCB version of joining nodes.
103
+
104
+
.. note::
105
+
The CPUID and TCB version must be input as lower-case hex-strings. The values in the above example are for Milan CPUs, and can be expanded as follows:
106
+
107
+
+-----------------+------------+
108
+
|| Value |
109
+
| CPUID Field +-----+------+
110
+
|| dec | hex |
111
+
+=================+=====+======+
112
+
| Reserved | 0 | 0x0 |
113
+
+-----------------+-----+------+
114
+
| Extended Family | 10 | 0x0a |
115
+
+-----------------+-----+------+
116
+
| Extended Model | 0 | 0x0 |
117
+
+-----------------+-----+------+
118
+
| Reserved | 0 | 0x0 |
119
+
+-----------------+-----+------+
120
+
| Base Family | 15 | 0xf |
121
+
+-----------------+-----+------+
122
+
| Base Model | 1 | 0x1 |
123
+
+-----------------+-----+------+
124
+
| Stepping | 1 | 0x1 |
125
+
+-----------------+-----+------+
126
+
127
+
SNP attestation structures contain the combined Family (``Extended Family + Base Family``) and Model (``Extended Model : Base Model``) values, so 25 (0x19) and 1 (0x01) respectively for the above Milan example.
128
+
129
+
The above TCB version ``d315000000000004`` is for a Milan CPU.
130
+
It, and also TCB versions for Genoa CPUs, can be expanded as follows:
131
+
132
+
+-------------------+------------------+
133
+
|| Value |
134
+
| TCB Version Field +-----+------------+
135
+
|| dec | hex |
136
+
+===================+=====+============+
137
+
| Microcode | 211 | 0xd3 |
138
+
+-------------------+-----+------------+
139
+
| SNP | 21 | 0x15 |
140
+
+-------------------+-----+------------+
141
+
| Reserved | 0 | 0x00000000 |
142
+
+-------------------+-----+------------+
143
+
| TEE | 0 | 0x00 |
144
+
+-------------------+-----+------------+
145
+
| Boot Loader | 4 | 0x04 |
146
+
+-------------------+-----+------------+
147
+
148
+
The TCB version for Turin CPUs have a different format with, for example, ``1100000022334455`` having the following expanded fields:
0 commit comments