Tags: intel/MigTD
Tags
fix(config): restore valid policy_v2 template and re-sign collaterals The "regenerate policy_v2 collaterals" change overwrote the base policy_v2.json template with generator output: it dropped the required `version` and `policySvn` fields and replaced the v2 `global` policy rule with v1-style `fmspc`/`Platform`/`TcbInfo` entries. Since PolicyData requires those fields (non-Option) and a `PolicyTypes::Global`/`Servtd` enum, deserialization failed and verification returned InvalidPolicy even though the signature was valid. Restore the correct v2 template (re-add `version`/`policySvn` and the `global` policy rule), re-sign policy_v2, servtd collateral, tcb mapping and td_identity with the current issuer key, and refresh the bundled policy_issuer_chain.pem so the signed artifacts and the issuer chain are consistent again. Signed-off-by: Michal Tarnacki <michal.tarnacki@intel.com> Co-authored-by: GitHub Copilot <noreply@github.com>
fix(config): restore valid policy_v2 template and re-sign collaterals The "regenerate policy_v2 collaterals" change overwrote the base policy_v2.json template with generator output: it dropped the required `version` and `policySvn` fields and replaced the v2 `global` policy rule with v1-style `fmspc`/`Platform`/`TcbInfo` entries. Since PolicyData requires those fields (non-Option) and a `PolicyTypes::Global`/`Servtd` enum, deserialization failed and verification returned InvalidPolicy even though the signature was valid. Restore the correct v2 template (re-add `version`/`policySvn` and the `global` policy rule), re-sign policy_v2, servtd collateral, tcb mapping and td_identity with the current issuer key, and refresh the bundled policy_issuer_chain.pem so the signed artifacts and the issuer chain are consistent again. Signed-off-by: Michal Tarnacki <michal.tarnacki@intel.com> Co-authored-by: GitHub Copilot <noreply@github.com>
fix(config): restore valid policy_v2 template and re-sign collaterals The "regenerate policy_v2 collaterals" change overwrote the base policy_v2.json template with generator output: it dropped the required `version` and `policySvn` fields and replaced the v2 `global` policy rule with v1-style `fmspc`/`Platform`/`TcbInfo` entries. Since PolicyData requires those fields (non-Option) and a `PolicyTypes::Global`/`Servtd` enum, deserialization failed and verification returned InvalidPolicy even though the signature was valid. Restore the correct v2 template (re-add `version`/`policySvn` and the `global` policy rule), re-sign policy_v2, servtd collateral, tcb mapping and td_identity with the current issuer key, and refresh the bundled policy_issuer_chain.pem so the signed artifacts and the issuer chain are consistent again. Signed-off-by: Michal Tarnacki <michal.tarnacki@intel.com> Co-authored-by: GitHub Copilot <noreply@github.com>
fix(vmcall_raw): chunk send to honor VMCALL buffer MTU A single TDG.VP.VMCALL<Service.MigTD.Send> can only carry up to the same MTU the receive side advertises (MAX_VMCALL_RAW_STREAM_MTU, 64KB). With policy_v2's peer-data blob now carrying the signed policy plus issuer chain (~180KB in practice), the rebinding pre-session body send fails with TdVmcallError::Other right after hello and the 8-byte data header succeed. Chunk on the send path so any single VMCALL payload stays at MAX_VMCALL_RAW_STREAM_MTU - 12 bytes (room for the GHCI 1.5 status+length header prepended by vmcall_raw_transport_enqueue). Loop inside VmcallRaw::send and keep returning buf.len(); this keeps the AsyncWrite contract intact for callers that don't loop on partial writes (rustls SecureChannel, SpdmDeviceIo). The wire framing is unchanged — the peer's receive loop already reassembles multiple packets in VmcallRaw::recv. Promote MAX_VMCALL_RAW_STREAM_MTU to pub(crate) and add explicit VMCALL_RAW_GHCI_HEADER_LEN / VMCALL_RAW_SEND_PAYLOAD_MTU consts so the overhead arithmetic is named at one site. Signed-off-by: Stanislaw Grams <stanislaw.grams@intel.com>
build(deps): bump env_logger Bumps [env_logger](https://github.com/rust-cli/env_logger) from 0.11.10 to 0.11.11. - [Release notes](https://github.com/rust-cli/env_logger/releases) - [Changelog](https://github.com/rust-cli/env_logger/blob/main/CHANGELOG.md) - [Commits](rust-cli/env_logger@v0.11.10...v0.11.11) --- updated-dependencies: - dependency-name: env_logger dependency-version: 0.11.11 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
fix(migtd): resolve compiler warnings across crates Fix all warnings emitted during a default feature build: - attestation: replace `use super::*` with a cfg-gated `use super::QveCollateral` in attest_lib_binding, since QveCollateral is only referenced under the attest-lib-ext feature. - migtd/servtd_ext: add missing `#[cfg(test)]` attribute to the `mod test` block, consistent with every other test module in the codebase, silencing the unused-import lint on `ServtdExt`. - migtd/session: gate the `log_request_error!` macro definition behind `#[cfg(feature = "vmcall-raw")]` since all call-sites live inside vmcall-raw-only functions; remove spurious `mut` from the `transport` binding (value is consumed by-move, never reassigned). - migtd/transport: prefix both `mig_request_id` parameters with `_` (`_mig_request_id`) in `setup_transport` and `shutdown_transport`; the parameter is only read inside cfg-gated blocks so it appears unused when those features are disabled. - migtd/main: rename `data` / `mut data` to `mut _data` and update all references; the buffer is only passed into vmcall-raw and policy_v2 code paths, making it appear unused in other configurations. Signed-off-by: Stanislaw Grams <stanislaw.grams@intel.com>
build(migtd): bump version to 0.7.0 Bump migtd crate version from 0.6.0 to 0.7.0 for the upcoming release. Signed-off-by: Stanislaw Grams <stanislaw.grams@intel.com>
MigTD v0.6.0 Release Release content: • Update V1 pre-production & production policy • Add Policy V2 support • Add SPDM support • GHCI 1.5 changes support • Log enhancement Known issues: • No known issue For detailed changes please refer to https://github.com/intel/MigTD/issues?q=is%3Aissue+is%3Aclosed
config/Azure: Add policy Add raw policy for Azure. Signed-off-by: Haitao Huang <haitaohuang@microsoft.com>
PreviousNext