Merge intel changes

[haitaohuang]

No description provided.

[Copilot]

Pull request overview

This PR merges updates around GHCI 1.5 MigTD/rebinding data handling, SERVTD attribute validation, attestation reliability, DMA read bounds, and dependency/workflow refreshes.

Changes:

• Reworks init MigTD data handling to use raw TDINFO bytes and removes init event log propagation in rebind/RATLS/SPDM paths.
• Adds policy/SERVTD binding checks, crash-report error codes, attestation/logging adjustments, and safer DMA length handling.
• Refreshes selected dependencies, container base image, and pinned GitHub Actions.

Reviewed changes

Copilot reviewed 39 out of 41 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/policy/src/v2/policy.rs	Adds policy SVN accessor.
src/migtd/src/spdm/spdm_vdm.rs	Updates rebind attest element count.
src/migtd/src/spdm/spdm_rsp.rs	Adjusts rebind info type, removes init event log parsing, adds SERVTD attr verification.
src/migtd/src/spdm/spdm_req.rs	Sends raw TDINFO for migration/rebinding and removes init event log element.
src/migtd/src/spdm/spdm_rebind.rs	Uses MigtdMigrationInformation for rebind SPDM flows.
src/migtd/src/ratls/server_client.rs	Removes init event log extension/verification in rebinding certificates.
src/migtd/src/migration/session.rs	Parses unified migration info, returns raw TDINFO for GetMigtdData, adds binding checks.
src/migtd/src/migration/servtd_ext.rs	Adds SERVTD attr validation helper and stricter read validation.
src/migtd/src/migration/rebinding.rs	Removes custom rebind/init data structs and uses raw TDINFO from migration info.
src/migtd/src/migration/mod.rs	Adds TDINFO helpers, extends migration info layout, and adds initialization result code.
src/migtd/src/migration/event.rs	Uses initialization result code for callback registration failure.
src/migtd/src/migration/data.rs	Updates rebind response type and migration info field initialization.
src/migtd/src/mig_policy.rs	Generates local TCB info on demand and adds TDINFO policy binding checks.
src/migtd/src/driver/vmcall_raw.rs	Marks crash-report panic helper as diverging.
src/migtd/src/driver/timer.rs	Reports initialization failures through crash-report helper.
src/migtd/src/bin/migtd/main.rs	Converts startup panics to crash reports and verifies own TDINFO policy binding.
src/migtd/src/bin/migtd/cvmemu.rs	Uses crash-report helper and renames rebind source variable.
src/devices/vsock/src/transport/virtio_pci.rs	Bounds DMA data reads by tracked allocation size.
src/devices/vmcall_raw/src/transport/vmcall.rs	Clarifies send completion length and rejects zero-length receive success.
src/devices/virtio_serial/src/lib.rs	Bounds virtio-serial DMA reads by tracked allocation size.
src/crypto/src/lib.rs	Adds policy signer public-key hash helper.
src/attestation/src/igvmattest.rs	Reduces quote debug logging volume.
src/attestation/src/binding.rs	Changes attestation FFI return types to i32.
src/attestation/src/attest.rs	Updates attestation result handling and increases private heap size.
deps/td-shim-AzCVMEmu/azcvm-extract-report/Cargo.lock	Updates Tokio lockfile entry.
container/Dockerfile	Updates Ubuntu base image.
Cargo.lock	Updates selected Rust dependencies.
.github/workflows/weekly-collateral-update.yml	Updates harden-runner pin.
.github/workflows/weekly-cargo-update.yml	Updates harden-runner pin.
.github/workflows/trivy.yml	Updates harden-runner and upload-sarif pins.
.github/workflows/scorecard.yml	Updates harden-runner and upload-sarif pins.
.github/workflows/oss-fuzz.yml	Updates harden-runner and upload-sarif pins.
.github/workflows/main.yml	Updates harden-runner pin.
.github/workflows/library.yml	Updates harden-runner pin.
.github/workflows/integration-tdx.yml	Updates harden-runner pins.
.github/workflows/integration-emu.yml	Updates harden-runner pin.
.github/workflows/fuzz.yml	Updates harden-runner pin.
.github/workflows/format.yml	Updates harden-runner and upload-sarif pins.
.github/workflows/dependency-review.yml	Updates harden-runner and dependency-review action pins.
.github/workflows/deny.yml	Updates harden-runner and cargo-deny action pins.
.github/workflows/codeql.yml	Updates harden-runner and CodeQL action pins.

Comments suppressed due to low confidence (1)

src/migtd/src/migration/rebinding.rs:243

• This uses VMM-provided init_td_info for rebinding without applying the policy-binding check added for normal migration (verify_init_migtd_data_policy_binding). That means a rebinding flow can proceed with an initial TDINFO whose MROWNER/MROWNERCONFIG do not match the local policy signer/SVN, even though the migration path rejects that input before exchanging keys.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 45 out of 47 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

src/devices/virtio_serial/src/lib.rs:786

• If dma_allocation has no record for buffer.addr, this now silently skips the buffer but still returns Ok(()), leaving remaining unchanged and effectively dropping data while the caller thinks it was consumed. Return an error (e.g., InvalidParameter) when the DMA record is missing, or otherwise ensure remaining is accounted for and the buffer is safely handled/freed.

            if let Some(record) = self.dma_allocation.get(&buffer.addr) {
                let safe_len = core::cmp::min(buffer.len as usize, record.dma_size);
                let dma_buf = unsafe { from_raw_parts(buffer.addr as *const u8, safe_len) };

                let mut data_buf = Vec::new();
                let used_len = core::cmp::min(core::cmp::min(len, buffer.len) as usize, safe_len);
                data_buf.extend_from_slice(&dma_buf[..used_len]);
                remaining = remaining
                    .checked_sub(used_len as u32)
                    .ok_or(VirtioSerialError::InvalidParameter)?;
                Self::port_queue_push(port_id, data_buf)?;

                self.free_dma_memory(buffer.addr)
                    .ok_or(VirtioSerialError::OutOfResource)?;
            }
        }

[haitaohuang]

Bypass rules to merge all intel changes. issues reported and tracked in intel repo issues and #183
Build will be fixed later in integration branch. Need merge this to move forward