Refactored Docker files to eliminate redundant code and redundant definitions of Docker image versions.

Author: danieltrick

.github/workflows/cargo-workflow.yaml

@@ -128,7 +128,7 @@ jobs:
     needs: [format, checks]
     strategy:
       matrix:
-        branch: ["stable", "unstable", "snapshot"]
+        branch: ["stable", "unstable", "bleeding-edge"]
     runs-on: ubuntu-${{ inputs.OS_VERS_MAX }}
     steps:
       - uses: actions/checkout@v7
@@ -137,7 +137,7 @@ jobs:
           toolchain: ${{ matrix.rust }}
           cache: false
       - run: |
-          make docker.tests TSSFAPI_TEST_BRANCH=${{ matrix.branch }}
+          make docker.tests RSTSS_BRANCH=${{ matrix.branch }}
 
   # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   # Benchmarks

Cargo.lock

@@ -26,13 +26,14 @@ regex = "1.12.4"
 
 [dev-dependencies]
 const-random = "0.1.18"
+constcat = "0.6.1"
 criterion = "=0.7.0"
 digest = "0.11.3"
 env_logger = "0.11.10"
 function_name = "0.3.0"
 hex = "0.4.3"
 memory-stats = "1.2.0"
-p256 = "=0.14.0-rc.12"
+p256 = "=0.14.0-rc.13"
 rand = "0.10.1"
 rand_chacha = "0.10.0"
 regex = "1.12.4"

Cargo.toml

@@ -4,136 +4,158 @@
  * All rights reserved.
  **********************************************************************************************/
 
+use constcat::concat;
 use criterion::{Criterion, criterion_group, criterion_main};
 use std::{
     hint::black_box,
+    num::NonZeroUsize,
     sync::atomic::{AtomicUsize, Ordering},
     time::Duration,
 };
 use tss2_fapi_rs::{BaseErrorCode, ErrorCode, FapiContext, KeyFlags};
 
-const BASE_KEY_PATH: &str = "HS/SRK/bench";
-const SIGN_KEY_PATH: &str = "HS/SRK/sign_key";
-
 // ==========================================================================
-// Bench #1: Create key
+// Benchmarks
 // ==========================================================================
 
-fn bench_create_key(c: &mut Criterion) {
+const BASE_KEY_PATH: &str = "HS/SRK/my_bench";
+const SIGN_KEY_PATH: &str = concat!(BASE_KEY_PATH, "/sign_key");
+
+/// Benchmark #1: Get random
+/// ------------------------
+/// This benchmark measures the performance of the [`FapiContext::get_random()`] function.
+fn bench_get_random(c: &mut Criterion) {
     // Create a new FAPI context
     let mut context = FapiContext::new().expect("Failed to create context!");
 
-    // Perform the provisioning, if it has not been done yet
-    match context.provision(None, None, None) {
-        Ok(_) => (),
-        Err(ErrorCode::FapiError(BaseErrorCode::AlreadyProvisioned)) => (),
-        Err(error) => panic!("Provisioning has failed: {:?}", error),
-    }
+    // Initialize TPM
+    let manager = TpmManager::new(&mut context);
 
-    // Delete existing storage key
-    match context.delete(BASE_KEY_PATH) {
-        Ok(_) => (),
-        Err(ErrorCode::FapiError(BaseErrorCode::BadPath)) => (),
-        Err(ErrorCode::FapiError(BaseErrorCode::PathNotFound)) => (),
-        Err(error) => panic!("Failed to delete: {:?}", error),
-    }
+    // Measurement!
+    let counter: AtomicUsize = AtomicUsize::new(0usize);
+    c.bench_function("get_random", |b| b.iter(|| _get_random(manager.0, black_box(counter.fetch_add(1usize, Ordering::Relaxed)))));
+}
+
+fn _get_random(context: &mut FapiContext, _n: usize) {
+    let length = unsafe { NonZeroUsize::new(32usize).unwrap_unchecked() };
+    let _buffer = black_box(context.get_random(length).expect("Failed to get random data!"));
+}
+
+/// Benchmark #2: Create key
+/// ------------------------
+/// This benchmark measures the performance of the [`FapiContext::create_key()`] function.
+fn bench_create_key(c: &mut Criterion) {
+    // Create a new FAPI context
+    let mut context = FapiContext::new().expect("Failed to create context!");
 
-    // Create storage key
-    context.create_key(BASE_KEY_PATH, Some(&[KeyFlags::Decrypt, KeyFlags::Restricted, KeyFlags::NoDA]), None, None).expect("Failed to create parent key!");
+    // Initialize TPM
+    let manager = TpmManager::new(&mut context);
 
-    // Create the siging keys
+    // Measurement!
     let counter: AtomicUsize = AtomicUsize::new(0usize);
-    c.bench_function("create_key", |b| b.iter(|| _create_key(&mut context, black_box(counter.fetch_add(1usize, Ordering::Relaxed)))));
+    c.bench_function("create_key", |b| b.iter(|| _create_key(manager.0, black_box(counter.fetch_add(1usize, Ordering::Relaxed)))));
 }
 
 fn _create_key(context: &mut FapiContext, n: usize) {
     const MY_KEYFLAG: &[KeyFlags] = &[KeyFlags::Sign, KeyFlags::NoDA];
     context.create_key(&format!("{}/key_{}", BASE_KEY_PATH, n), Some(MY_KEYFLAG), None, None).expect("Failed to create key!")
 }
 
-// ==========================================================================
-// Bench #2: Sign
-// ==========================================================================
-
+/// Benchmark #3: Sign
+/// ------------------
+/// This benchmark measures the performance of the [`FapiContext::sign()`] function.
 fn bench_sign(c: &mut Criterion) {
     // Create a new FAPI context
     let mut context = FapiContext::new().expect("Failed to create context!");
 
-    // Perform the provisioning, if it has not been done yet
-    match context.provision(None, None, None) {
-        Ok(_) => (),
-        Err(ErrorCode::FapiError(BaseErrorCode::AlreadyProvisioned)) => (),
-        Err(error) => panic!("Provisioning has failed: {:?}", error),
-    }
-
-    // Delete existing key
-    match context.delete(SIGN_KEY_PATH) {
-        Ok(_) => (),
-        Err(ErrorCode::FapiError(BaseErrorCode::BadPath)) => (),
-        Err(ErrorCode::FapiError(BaseErrorCode::PathNotFound)) => (),
-        Err(error) => panic!("Failed to delete: {:?}", error),
-    }
+    // Initialize TPM
+    let manager = TpmManager::new(&mut context);
 
     // Create siging key
-    context.create_key(SIGN_KEY_PATH, Some(&[KeyFlags::Sign, KeyFlags::NoDA]), None, None).expect("Failed to create sign key!");
+    manager.0.create_key(SIGN_KEY_PATH, Some(&[KeyFlags::Sign, KeyFlags::NoDA]), None, None).expect("Failed to create sign key!");
 
-    // Sign message
+    // Measurement!
     let counter: AtomicUsize = AtomicUsize::new(0usize);
-    c.bench_function("sign", |b| b.iter(|| _sign(&mut context, black_box(counter.fetch_add(1usize, Ordering::Relaxed)))));
+    c.bench_function("sign", |b| b.iter(|| _sign(manager.0, black_box(counter.fetch_add(1usize, Ordering::Relaxed)))));
 }
 
 fn _sign(context: &mut FapiContext, n: usize) {
     let mut digest = [0u8; 32usize];
     digest[..size_of::<usize>()].copy_from_slice(&n.to_be_bytes());
-    let _signature = context.sign(SIGN_KEY_PATH, None, &digest, false, false).expect("Failed to sign message!");
+    let _signature = black_box(context.sign(SIGN_KEY_PATH, None, &digest, false, false).expect("Failed to sign message!"));
 }
 
-// ==========================================================================
-// Bench #3: Verify
-// ==========================================================================
-
+/// Benchmark #4: Verify signature
+/// ------------------------------
+/// This benchmark measures the performance of the [`FapiContext::verify_signature()`] function.
 fn bench_verify_signature(c: &mut Criterion) {
     // Create a new FAPI context
     let mut context = FapiContext::new().expect("Failed to create context!");
 
-    // Perform the provisioning, if it has not been done yet
-    match context.provision(None, None, None) {
-        Ok(_) => (),
-        Err(ErrorCode::FapiError(BaseErrorCode::AlreadyProvisioned)) => (),
-        Err(error) => panic!("Provisioning has failed: {:?}", error),
-    }
-
-    // Delete existing key
-    match context.delete(SIGN_KEY_PATH) {
-        Ok(_) => (),
-        Err(ErrorCode::FapiError(BaseErrorCode::BadPath)) => (),
-        Err(ErrorCode::FapiError(BaseErrorCode::PathNotFound)) => (),
-        Err(error) => panic!("Failed to delete: {:?}", error),
-    }
+    // Initialize TPM
+    let manager = TpmManager::new(&mut context);
 
     // Create siging key
-    context.create_key(SIGN_KEY_PATH, Some(&[KeyFlags::Sign, KeyFlags::NoDA]), None, None).expect("Failed to create sign key!");
+    manager.0.create_key(SIGN_KEY_PATH, Some(&[KeyFlags::Sign, KeyFlags::NoDA]), None, None).expect("Failed to create sign key!");
 
     // Sign message
     let digest = [0u8; 32usize];
-    let signature = context.sign(SIGN_KEY_PATH, None, &digest, false, false).expect("Failed to sign message!");
+    let signature = manager.0.sign(SIGN_KEY_PATH, None, &digest, false, false).expect("Failed to sign message!");
 
-    // Verify signature
-    c.bench_function("verify_signature", |b| b.iter(|| _verify_signature(&mut context, black_box(&digest), &black_box(&signature).sign_value)));
+    // Measurement!
+    c.bench_function("verify_signature", |b| b.iter(|| _verify_signature(manager.0, black_box(&digest), &black_box(&signature).sign_value)));
 }
 
 fn _verify_signature(context: &mut FapiContext, digest: &[u8], signature: &[u8]) {
-    let result = context.verify_signature(SIGN_KEY_PATH, digest, signature).expect("Failed to verify signature!");
+    let result = black_box(context.verify_signature(SIGN_KEY_PATH, digest, signature).expect("Failed to verify signature!"));
     assert!(result);
 }
 
+// ==========================================================================
+// Utility functions
+// ==========================================================================
+
+struct TpmManager<'a>(pub &'a mut FapiContext);
+
+impl<'a> TpmManager<'a> {
+    pub fn new(context: &'a mut FapiContext) -> Self {
+        // Perform the provisioning, if it has not been done yet
+        match context.provision(None, None, None) {
+            Ok(_) => (),
+            Err(ErrorCode::FapiError(BaseErrorCode::AlreadyProvisioned)) => (),
+            Err(error) => panic!("Provisioning has failed: {:?}", error),
+        }
+
+        // Delete existing storage key, if it already exists
+        Self::clean_up(context).expect("Failed to delete the existing key!");
+
+        // Create our storage key
+        context.create_key(BASE_KEY_PATH, Some(&[KeyFlags::Decrypt, KeyFlags::Restricted, KeyFlags::NoDA]), None, None).expect("Failed to create parent key!");
+        Self(context)
+    }
+
+    fn clean_up(context: &mut FapiContext) -> Result<(), ErrorCode> {
+        match context.delete(BASE_KEY_PATH) {
+            Ok(_) => Ok(()),
+            Err(ErrorCode::FapiError(BaseErrorCode::BadPath | BaseErrorCode::PathNotFound | BaseErrorCode::KeyNotFound)) => Ok(()),
+            Err(error) => Err(error),
+        }
+    }
+}
+
+impl<'a> Drop for TpmManager<'a> {
+    fn drop(&mut self) {
+        _ = Self::clean_up(self.0);
+    }
+}
+
 // ==========================================================================
 // Main
 // ==========================================================================
 
 fn create_config() -> Criterion {
-    Criterion::default().warm_up_time(Duration::from_secs(15)).measurement_time(Duration::from_secs(30)).noise_threshold(0.1).without_plots()
+    Criterion::default().warm_up_time(Duration::from_secs(25)).measurement_time(Duration::from_secs(120)).noise_threshold(0.1).without_plots()
 }
 
-criterion_group!(name = benches; config = create_config(); targets = bench_create_key, bench_sign, bench_verify_signature);
+criterion_group!(name = benches; config = create_config(); targets = bench_get_random, bench_create_key, bench_sign, bench_verify_signature);
 criterion_main!(benches);

benches/fapi_benchmark.rs

@@ -1,3 +1,5 @@
+include rstss.mk
+
 .PHONY: all run down
 
 all: down run

tools/docker/build/Makefile

@@ -4,9 +4,9 @@ services:
   build:
     build:
       context: ./
-      dockerfile: build.Dockerfile
+      dockerfile: rstss.Dockerfile
       args:
-        BASE_VERSION: r29@sha256:c33d92b8bd58a5397cf6ca7af960a68658256209a3f05c7be89bd55fdf007b45
+        IMAGE_VERSION_RSTSS: ${IMAGE_VERSION_RSTSS:?}
     volumes:
       - ../../../:/var/opt/rust/src:ro
       - out:/var/tmp/rust:rw

tools/docker/build/build.Dockerfile

@@ -0,0 +1,8 @@
+# Define default Rust-TSS2 base image version
+ARG IMAGE_VERSION_RSTSS=UNDEFINED
+
+# Docker file for build-env
+FROM danieltrick/rust-tss2-docker@${IMAGE_VERSION_RSTSS}
+
+# Default command
+CMD ["rebuild", "--release"]

tools/docker/build/docker-compose.yml

@@ -0,0 +1,9 @@
+ifeq ($(filter-out stable,$(RSTSS_BRANCH)),)
+  export IMAGE_VERSION_RSTSS := sha256:c33d92b8bd58a5397cf6ca7af960a68658256209a3f05c7be89bd55fdf007b45
+else ifeq ($(RSTSS_BRANCH),unstable)
+  export IMAGE_VERSION_RSTSS := sha256:6e7f3de9c3b0298192a4db108d955cd203b360fd1fb40b5f6940c9e3ecf7cc0b
+else ifeq ($(RSTSS_BRANCH),bleeding-edge)
+  export IMAGE_VERSION_RSTSS := sha256:5e02daff85e7678c6715db7b9c07e96d3117bf04e8ec7eaba4a8958181035017
+else
+  $(error Unsupport RSTSS_BRANCH branch "$(RSTSS_BRANCH)" specified!)
+endif

tools/docker/build/rstss.Dockerfile

@@ -1,3 +1,5 @@
+include swtpm.mk
+
 .PHONY: all up down
 
 all: down up