integration for init_tdinfo and servtd_ext

[haitaohuang]

No description provided.

[Copilot]

Pull request overview

This PR integrates init-TDINFO and SERVTD_EXT handling across MigTD’s SPDM migration and rebinding flows, including policy v2 verification and improved propagation of application-layer errors over SPDM. It also refactors shared SPDM handshake/session-driving logic and updates emulation/CI tooling and supporting utilities.

Changes:

• Add TDINFO_STRUCT plumbing (host-provided + local fallback), SERVTD_EXT capability detection, and new policy-v2 verification paths for migration/rebind SPDM VDM exchanges.
• Refactor SPDM requester/responder common handshake/session logic and improve error propagation by encoding MigrationResult into SPDM ERROR responses.
• Improve robustness/diagnostics across event log parsing, logging output, vmcall-raw transport arithmetic, and emulation build/test scripts.

Reviewed changes

Copilot reviewed 52 out of 55 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/std-support/sys_time/src/lib.rs	Enables sys_time unit test (now executes RTC port I/O).
src/std-support/rust-std-stub/src/io/impls.rs	Changes test module gating for io impl tests.
src/std-support/rust-std-stub/src/io/error.rs	Changes test module gating for io error tests.
src/std-support/rust-std-stub/Cargo.toml	Removes std_tests feature definition.
src/policy/src/v2/collaterals.rs	Fixes PEM end-marker search to be relative to the begin marker.
src/migtd/src/spdm/spdm_vdm.rs	Adjusts VDM constants/ops and encodes app error code into SPDM vendor-defined error response.
src/migtd/src/spdm/spdm_rsp.rs	Refactors responder context handling, adds init-TDINFO/SERVTD_EXT parsing/verification, and updates SPDM loop wiring.
src/migtd/src/spdm/spdm_req.rs	Refactors requester MSK transfer flow, adds buffer zeroization, and updates init-TDINFO/SERVTD_EXT send behavior.
src/migtd/src/spdm/spdm_rebind.rs	Refactors SPDM rebind requester/responder to use shared handshake helpers and zeroization.
src/migtd/src/spdm/mod.rs	Adds handshake module and TDREPORT REPORTDATA/TH1 binding verifier.
src/migtd/src/spdm/handshake.rs	New shared SPDM handshake building blocks for requester/responder paths.
src/migtd/src/migration/spdm_session.rs	New helper to run SPDM sessions under timeout and normalize error mapping/shutdown.
src/migtd/src/migration/session.rs	Reworks migration session flow to use SPDM session helper; updates init-TDINFO tracing and vmcall-raw sizing logic.
src/migtd/src/migration/servtd_ext.rs	Adds SERVTD_EXT support detection via TDCS.ATTRIBUTES; changes read/write APIs to handle unsupported targets.
src/migtd/src/migration/pre_session_data.rs	Marks HelloPacketPayload as #[repr(C)] for wire/FFI stability.
src/migtd/src/migration/mod.rs	Removes init_data module, adds TDINFO constants/helpers and init-TDINFO parsing APIs.
src/migtd/src/migration/logging.rs	Adds log message truncation and tests; adjusts debug-console output formatting.
src/migtd/src/migration/init_data.rs	Deletes old init-data envelope parsing/serialization (replaced by raw TDINFO tail).
src/migtd/src/migration/data.rs	Updates request/response types and HOB parsing to drop InitData and use MigtdMigrationInformation only.
src/migtd/src/mig_policy.rs	Adds init-TDINFO cross-check helpers and destination-side migration auth path using init-TDINFO + SERVTD_EXT; uses quote retry helper.
src/migtd/src/event_log.rs	Documents/implements +1 slice workaround; hardens parsing with bounds-safe slicing; adds regression tests.
src/migtd/src/bin/migtd/main.rs	Removes local TdInfo-as-bytes helper; tightens feature gating around own-TDINFO verification.
src/migtd/src/bin/migtd/cvmemu.rs	Renames variable to migration_source for clarity in emu request setup.
src/migtd/Cargo.toml	Adds test-get-quote feature flag.
src/devices/vsock/src/stream.rs	Fixes State variant spelling (Established).
src/devices/vsock/src/lib.rs	Fixes State variant spelling (Established).
src/devices/vmcall_raw/src/transport/vmcall.rs	Hardens size arithmetic and receive validation; adjusts send completion return handling.
src/devices/vmcall_raw/src/lib.rs	Makes align_up overflow-safe (returns Option) and adds tests; fixes State variant spelling.
src/crypto/src/lib.rs	Adds PEM test chains for peer cert-chain validation tests.
src/attestation/src/igvmattest.rs	Avoids expensive full-quote debug formatting; logs a preview instead.
src/attestation/src/attest.rs	Increases private attestation heap size with rationale.
sh_script/build_AzCVMEmu_policy_and_test.sh	Conditionally updates identity dates based on policy reference.
sh_script/Azure/Makefile	Restructures IGVM build targets; adds reject test and mock/get-quote variants.
sh_script/Azure/build_azure_mock_test.sh	Adds reject-policy mode and conditional identity date updates.
deps/td-shim-AzCVMEmu/tdx-tdcall/src/tdx_emu.rs	Populates ServTD fields in emulation; ignores vm_write mask arg.
deps/td-shim-AzCVMEmu/tdx-tdcall/src/lib.rs	Adjusts crate-level no_std gating; ignores tdcall_verify_report arg.
deps/td-shim-AzCVMEmu/tdx-tdcall/Cargo.toml	Bumps az-tdx-vtpm dependency version.
deps/td-shim-AzCVMEmu/azcvm-extract-report/Cargo.toml	Bumps az-tdx-vtpm dependency version.
config/Azure/policy_reject_data_raw.json	Adds a policy-v2 “reject” policy input (bad FMSPC).
config/AzCVMEmu/policy_issuer_chain.pem	Removes tracked AzCVMEmu issuer chain PEM (now generated).
.gitignore	Ignores review tooling dirs and auto-generated policy artifacts.
.github/workflows/integration-emu.yml	Ensures jq/policy generation for scenarios that need generated policy artifacts.
.agents/skills/migtd-upstream/SKILL.md	Adds upstreaming workflow documentation (agent skill).
.agents/skills/migtd-review/SKILL.md	Adds MigTD review workflow documentation (agent skill).
.agents/skills/migtd-review/scripts/run-ci-gauntlet.sh	Adds local CI gauntlet runner script.
.agents/skills/migtd-review/scripts/list_open_findings.sh	Adds helper to list open clawpatch findings.
.agents/skills/migtd-review/scripts/create_review_issues.sh	Adds template for creating/closing review issues.
.agents/skills/migtd-review/references/triage-justifications.md	Adds boilerplate triage text for findings.
.agents/skills/migtd-review/references/build-features.md	Adds build feature mapping reference.
.agents/init-tdinfo-servtd-ext-summary.md	Adds a narrative summary of init-TDINFO/SERVTD_EXT usage.
.agents/AGENT_NOTES.md	Adds agent workflow notes and repository conventions.

Comments suppressed due to low confidence (1)

src/devices/vmcall_raw/src/transport/vmcall.rs:145

• vmcall_service_migtd_send now returns Ok(0) on success. Even though the current VmcallRaw::send wrapper ignores this value and returns buf.len(), the transport API signature is Result<usize, _> and other callers could reasonably interpret the return value as “bytes sent”. Returning 0 on success is a footgun and can break write loops if reused. Prefer returning the original buf.len() (or data_length from the header you set) to reflect successful progress.

async fn vmcall_service_migtd_send(
    mig_request_id: u64,
    data_buffer: &mut [u8],
) -> Result<usize, VmcallRawError> {
    tdx::tdvmcall_migtd_send(mig_request_id, data_buffer, VMCALL_VECTOR)
        .map_err(|_e| VmcallRawError::TdVmcallErr)?;

    // Discard `data_length`: not a meaningful VMM-reported value on send.
    poll_fn(
        |_cx| match poll_vmcall_completion(mig_request_id, data_buffer) {
            Poll::Pending => Poll::Pending,
            Poll::Ready(Err(e)) => Poll::Ready(Err(e)),
            Poll::Ready(Ok((_payload, _data_length))) => Poll::Ready(Ok(0usize)),
        },
    )
    .await
}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.