tpm/
ak_cert.rs

1// Copyright (c) Microsoft Corporation.
2// Licensed under the MIT License.
3
4//! Helper traits for TPM Attestation Key Certificate (AK cert).
5
6use std::sync::Arc;
7use tpm_resources::RequestAkCertKind;
8use vm_resource::CanResolveTo;
9
10/// Type of TPM AK cert.
11pub enum TpmAkCertType {
12    /// No Ak cert.
13    None,
14    /// Authorized AK cert that is not hardware-attested.
15    /// Used by TVM
16    Trusted(Arc<dyn RequestAkCert>),
17    /// Authorized and hardware-attested AK cert (backed by
18    /// a TEE attestation report).
19    /// Used by CVM
20    HwAttested(Arc<dyn RequestAkCert>),
21}
22
23impl TpmAkCertType {
24    /// Get the `RequestAkCert` from the enum
25    pub fn get_ak_cert_helper(&self) -> Option<&Arc<dyn RequestAkCert>> {
26        match self {
27            TpmAkCertType::HwAttested(helper) => Some(helper),
28            TpmAkCertType::Trusted(helper) => Some(helper),
29            TpmAkCertType::None => None,
30        }
31    }
32}
33
34impl CanResolveTo<ResolvedRequestAkCert> for RequestAkCertKind {
35    // Workaround for async_trait not supporting GATs with missing lifetimes.
36    type Input<'a> = &'a ();
37}
38
39/// A resolved request AK cert helper resource.
40pub struct ResolvedRequestAkCert(pub Arc<dyn RequestAkCert>);
41
42impl<T: 'static + RequestAkCert> From<T> for ResolvedRequestAkCert {
43    fn from(value: T) -> Self {
44        Self(Arc::new(value))
45    }
46}
47
48/// A trait for requesting an AK cert.
49#[async_trait::async_trait]
50pub trait RequestAkCert: Send + Sync {
51    /// Helper function to create the request needed by `request_ak_cert`.
52    fn create_ak_cert_request(
53        &self,
54        ak_pub_modulus: &[u8],
55        ak_pub_exponent: &[u8],
56        ek_pub_modulus: &[u8],
57        ek_pub_exponent: &[u8],
58        guest_input: &[u8],
59    ) -> Result<Vec<u8>, Box<dyn std::error::Error + Send + Sync>>;
60
61    /// Helper function to request an AK cert.
62    async fn request_ak_cert(
63        &self,
64        request: Vec<u8>,
65    ) -> Result<Vec<u8>, Box<dyn std::error::Error + Send + Sync + 'static>>;
66}
tpm/ak_cert.rs

tpm/
ak_cert.rs
