open-standards/sandbox/sandbox-rs/crates/sandbox-tee/tests/attested_efficiency_example.rs

//! The `attested_efficiency` example attests and seals what this host's meter
//! read for a task it ran, never a fixed figure under a counter nothing read.
//!
//! The example file is compiled into this test as a module, so what is tested
//! is what `cargo run --example attested_efficiency` runs. The attested counter
//! class must be one of the meter's live probes, over a span that has a
//! hardware reading of the CPU work, and the receipt must seal it `HwShunt`;
//! otherwise the class must be `Estimator` and the receipt `Estimator`. A
//! literal figure attested as RAPL on a host with no RAPL counter, and sealed
//! `ModelBased`, fails both.

#[allow(dead_code)]
#[path = "../examples/attested_efficiency.rs"]
mod example;

use sandbox_tee::energy::{AttestTrust, CounterClass};

/// The probe name a class's reading comes from, for the classes the example
/// can attest a reading under.
fn source_of(class: CounterClass) -> Option<&'static str> {
    match class {
        CounterClass::ProcessEnergy => Some("process-energy"),
        CounterClass::Rapl => Some("rapl-powercap"),
        CounterClass::IoReport => Some("ioreport-energy-model"),
        _ => None,
    }
}

#[test]
fn the_example_attests_and_seals_what_the_meter_read() {
    let r = example::run();
    let counter = r.attested.statement.counter;
    eprintln!(
        "attested_efficiency: sources {:?}; span {:?} from `{}`; attested {} µJ ({}); sealed {} µJ [{}]",
        r.sources,
        r.measurement.devices,
        r.measurement.source,
        r.attested.statement.energy_uj,
        counter.tag(),
        r.receipt.energy_uj,
        r.receipt.provenance
    );

    assert_eq!(r.attested.statement.energy_uj, r.receipt.energy_uj);
    assert!(r.receipt.energy_uj > 0, "a task that ran was billed nothing");
    assert_eq!(r.trust, AttestTrust::IntegrityAttested);
    assert!(r.tamper_rejected);

    match counter {
        CounterClass::Estimator => {
            assert_eq!(r.receipt.provenance, "Estimator", "an estimate sealed as something else");
        }
        reading => {
            let source = source_of(reading)
                .unwrap_or_else(|| panic!("the example attested a reading under `{}`, a class it cannot read", reading.tag()));
            assert!(
                r.sources.contains(&source),
                "attested `{}` but the meter's live probes are {:?}: a counter nothing read",
                reading.tag(),
                r.sources
            );
            assert!(r.measurement.reads_cpu(), "attested a reading of a span with no CPU reading: {:?}", r.measurement);
            assert_eq!(r.receipt.provenance, "HwShunt", "a reading sealed at another grade");
        }
    }
    if r.sources.is_empty() {
        assert_eq!(counter, CounterClass::Estimator, "no live counter, yet a reading was attested");
    }
}

/// A span with no hardware reading of the CPU work is attested as the
/// estimate it is: `Estimator`, no measured figure, and not free. Driven with
/// the machine-wide meter, which on a host with no live machine counter (Apple
/// Silicon whose IOReport CPU rails are not live) has no reading to give.
#[test]
fn a_span_with_no_cpu_reading_is_attested_as_an_estimate() {
    let mut meter = sandbox_meter::PowerMeter::detect();
    let (_, m) = meter.measure(example::task);
    let (class, energy) = example::figure(&meter, &m);
    eprintln!("machine meter: sources {:?}; span {:?}; attested as `{}`: {energy:?}", meter.sources(), m.devices, class.tag());
    if m.reads_cpu() && example::cpu_counter(&meter.sources()).is_some() {
        assert_ne!(class, CounterClass::Estimator);
        assert_eq!(energy.provenance, jcp_schema::Provenance::HwShunt);
    } else {
        assert_eq!(class, CounterClass::Estimator);
        assert_eq!((energy.provenance, energy.measured_uj), (jcp_schema::Provenance::Estimator, None));
    }
    assert!(energy.uj() > 0, "{energy:?}");
}