sandbox: the proof and microvm oracles read RAPL MSRs where powercap lists none; sandbox-tee attests rapl-msr as RAPL #651

Merged

dcharlot merged 1 commit from sandbox/proof-tee-msr into main 2026-11-06 02:40:02 -05:00

Conversation 0 Commits 1 Files changed 5 +407 -58

2026-11-05

Transaction Science

sandbox: RAPL read through the MSRs is attested as RAPL, and the hardware tests' oracles read the MSRs where powercap lists no package ...

Since sandbox-meter's RAPL probe falls back to the energy-status MSRs where
powercap lists no package zone, everything built on it reads such a host:
PowerMeter (`rapl-msr`), and sandbox-exec-microvm's RaplMeter, which is that
probe and which sandbox-proof's S5 proof meters with. Three places still
assumed powercap.

- sandbox-tee's attested_efficiency example named only `rapl-powercap` as a
  CPU counter, so on an MSR host it attested the reading as `Estimator`. Both
  probes are the same hardware counter: `rapl-msr` now attests as
  CounterClass::Rapl and seals HwShunt, as `rapl-powercap` does. Its test
  accepts either probe for the class, and a new test pins every probe name to
  its class.
- sandbox-proof's accelerator test read its oracle from powercap only, so
  where the meter read the MSRs the oracle had no package and the test
  panicked. The oracle (oracle_package_uj_at, independent of the crate) now
  reads the powercap package zones where any is listed (package-<n>, or
  package-<n>-die-<m>), and otherwise each RAPL domain's energy-status MSR on
  its first CPU: a die of a package on Intel, a package on AMD and Hygon, its
  32-bit count at its own unit, wrapping at 2^32 counts. A new test drives it
  over fake files: two dies of one Intel package, an AMD package whose CPUs
  list several die_ids, a zero unit, and a powercap die zone preferred.
- sandbox-exec-microvm's rapl_hardware oracle watched only powercap, so where
  RaplMeter opened on the MSRs the oracle called the host Unreadable; and the
  MSR meter's test bracketed its figure with powercap zones a host without
  powercap does not have. The oracle now watches and brackets with its own MSR
  reads there, scoped the same way, and accepts die zones as packages.
  RaplMeter's docs say what it reads.

On two bare-metal servers with no powercap zone (a one-socket Xeon E-2278G,
two Xeon Silver 4215R sockets), as root: the accelerator span read rapl-msr
at a ratio of 1.000 and 0.999 to the oracle around the call; both microvm
hardware tests sat inside the oracle's MSR bracket (RaplMeter 8.9 J and
23.5 J over a 300 ms burn); the example attested `rapl` and sealed HwShunt.
As an unprivileged user every counter is Unavailable, the figures are
estimates, and every test passes; as that user with the msr group and
CAP_SYS_RAWIO (systemd-run), the results match root's.

Linux x86_64: sandbox-proof, sandbox-tee (default and amd-kds,intel-pcs)
and sandbox-exec-microvm tests pass, `cargo check --workspace --all-targets`
is clean, clippy -D warnings is clean for the three crates. macOS: the CI
step for sandbox-proof passes with its grep, sandbox-tee passes, clippy is
clean for sandbox-meter, sandbox-proof, sandbox-tee and sandbox-exec-microvm.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

96bd3eb836

• View at this point in history

2026-11-05 10:23:03 -05:00