Skip to content

Revert "fix(migtd/migration): restrict GetTDReport to emulation builds" - #1004

Merged
jyao1 merged 2 commits into
intel:mainfrom
sgrams:revert_disable_td_report
Aug 20, 2026
Merged

Revert "fix(migtd/migration): restrict GetTDReport to emulation builds"#1004
jyao1 merged 2 commits into
intel:mainfrom
sgrams:revert_disable_td_report

Conversation

@sgrams

@sgrams sgrams commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

This reverts commit 7b98d80.

@sgrams
sgrams requested a review from jyao1 as a code owner August 12, 2026 07:07
@jyao1

jyao1 commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

For 7b98d80, I think we should NOT blindly disable the interface and block the VMM get a fresh TDReport for further evaluation.
I feel the fix could to change the final REPORTDATA_final = Math (NONCE_vmm_input), e.g. REPORTDATA_final = "VmmInputToMigTd" || SHA384("VmmInputToMigTdForHash" || NONCE_input), to make sure the VMM cannot input arbitrary REPORTDATA, while VMM can still input something to verify the freshness.
@haitaohuang , please let us know if the direction is OK.

@haitaohuang

Copy link
Copy Markdown
Contributor

Thanks @jyao1 that should work for us. Please ensure the final fix also address the original security issue triggered the disabling.

@jyao1

jyao1 commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

It seems there is no requirement to have a VMM input NONCE.
As such, the simple fix is to just use a fixed string as REPORTDATA = "HostRequestedMigTDReport".

@haitaohuang , please confirm if that is OK.

@haitaohuang

Copy link
Copy Markdown
Contributor

@jyao1 Yes, confirmed no requirement for VMM to input Nonce. Thanks

@sgrams

sgrams commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

I'll prepare a follow up commit

psidor99 and others added 2 commits August 19, 2026 14:42
This reverts commit 7b98d80.

Signed-off-by: Stanislaw Grams <stanislaw.grams@intel.com>
Signed-off-by: Stanislaw Grams <stanislaw.grams@intel.com>
@sgrams
sgrams force-pushed the revert_disable_td_report branch from 29de6e2 to 5e7fbc8 Compare August 19, 2026 12:43
@sgrams

sgrams commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

@jyao1, @haitaohuang please see and review the follow-up fix commit

@haitaohuang

Copy link
Copy Markdown
Contributor

LGTM
Thanks

@jyao1
jyao1 merged commit 06d9cab into intel:main Aug 20, 2026
61 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants