feat: use complete TDINFO hash for TCB mappings

[haitaohuang]

Summary

Implement the one-hash TCB mapping design proposed in #908:

• use SHA384(TDINFO) over the complete unmasked TDINFO as the mapping key;
• break the RTMR2 circular dependency by measuring canonical policyData with only servtdTcbMapping redacted;
• verify the signed mapping with the RTMR1-bound policy issuer chain;
• authenticate migration and rebinding continuity through SERVTD_EXT rather than host-supplied Init_TDINFO;
• resolve source initial/current hashes through the authenticated source JSON mapping and reject lookup misses, SVN rollback, and nonzero SERVTD_ATTR;
• preserve cumulative mapping history in migtd-hash, including multiple release hashes assigned to the same SVN.

The legacy outer policy signature is ignored because policy integrity is established by RTMR2. The existing wire Init_TDINFO field remains for framing compatibility but is no longer used as authorization evidence.

Related to #908.

Validation

• format, cargo check, clippy, cargo-deny, library build, and library tests;
• all 32 firmware build combinations and all six standalone tool builds;
• all 14 emulation workflow scenarios;
• all five workflows triggered on the fork branch: Format and Clippy, Library Crates, Fuzzing Test, main, and Integration (Emulation Mode).

Future changes

Potential follow-up work, intentionally excluded from this focused series:

• replace raw policy-chain measurement with a stable RTMR1 trust anchor based on a root certificate and signer-purpose EKU;
• support direct trust-anchor enrollment and signer revocation through CRLs;
• support CoRIM TCB endorsements, including policies that use CoRIM without JSON servTD collateral;
• make servTD identity collateral optional where SVN-only evaluation is sufficient;
• add release tooling and coverage for independent policy, mapping, and identity signer rotation;
• strengthen two-phase measurement generation and hash-stability checks across release workflows.

[jyao1]

@haitaohuang , is any Microsoft people can review and approve as well?

[Copilot]

🟡 Changes recommended

Unresolved critical issuer-chain binding and TDINFO hashing issues block approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR adopts complete TDINFO-hash TCB mappings, canonical RTMR2 policy measurement, and authenticated migration continuity through SERVTD_EXT.

Changes:

• Updates policy verification, migration/rebinding, SPDM, and RA-TLS flows.
• Updates cumulative mapping and collateral-generation tools.
• Refreshes fixtures, templates, and build workflows.

File summaries

File	Summary
tools/servtd-collateral-generator/src/main.rs	Updated collateral-generator CLI flow.
tools/servtd-collateral-generator/src/build.rs	nit, 2 votes: documentation still passes the removed --mapping-chain option.
tools/servtd-collateral-generator/readme.md	Updated generator usage documentation.
tools/migtd-hash/src/main.rs	moderate, 2 votes: invalid option combinations can panic instead of returning a validation error.
tools/migtd-hash/src/lib.rs	moderate, 2 votes: accept both tdinfo_hash and tdinfoHash; reject conflicting duplicate hash/SVN assignments instead of overwriting.
tools/migtd-hash/Cargo.toml	Updated hash-tool package metadata.
src/policy/test/policy_v2/tcb_mapping.json	Updated TCB mapping fixture.
src/policy/test/policy_v2/servtd_collateral.json	Updated collateral fixture.
src/policy/test/policy_v2/cert_chain/policy_issuer_chain.pem	Updated policy issuer-chain fixture.
src/policy/src/v2/servtd_collateral.rs	critical, 1 vote: the 48-byte servtd_hash is omitted from TDINFO hashing, allowing mismatches or collisions.
src/policy/src/v2/policy.rs	critical, 2 votes: the supplied issuer chain is not bound to the RTMR1-measured signer event. nit, 1 vote: documentation still describes the ignored outer signature as authoritative.
src/policy/src/v2/mod.rs	Exports policy-v2 measurement helpers.
src/policy/src/v2/measurement.rs	Adds canonical redacted policy measurement.
src/policy/src/lib.rs	Integrates policy measurement support.
src/migtd/src/spdm/spdm_rsp.rs	Updates SPDM attestation response handling.
src/migtd/src/ratls/server_client.rs	Updates policy and SERVTD_EXT binding.
src/migtd/src/migration/session.rs	Adds migration attribute validation.
src/migtd/src/migration/rebinding.rs	Updates rebinding continuity handling.
src/migtd/src/migration/mod.rs	Preserves Init_TDINFO framing compatibility.
src/migtd/src/mig_policy.rs	Updates mapping lookup and continuity validation.
src/migtd/src/lib.rs	Updates policy helper exports.
src/migtd/src/event_log.rs	Updates policy measurement event handling.
src/migtd/src/bin/migtd/main.rs	Updates runtime policy measurements.
sh_script/build_policy_v2.sh	nit, 1 vote: documented invocation lacks the required cumulative mapping argument.
sh_script/build_AzCVMEmu_policy_and_test.sh	Updates emulation policy generation.
sh_script/Azure/build_azure_mock_test.sh	moderate, 1 vote: migtd-hash build failures can be masked and omitted from binary verification.
deps/td-shim-AzCVMEmu/tdx-tdcall/src/tdx_emu.rs	Adds emulated SERVTD_EXT fields.
config/templates/td_identity.json	Updated TD identity template.
config/templates/td_identity_signed.json	Updated signed TD identity template.
config/templates/tcb_mapping.json	Updated TCB mapping template.
config/templates/tcb_mapping_signed.json	Updated signed mapping template.
config/templates/servtd_collateral.json	Updated collateral template.
config/templates/policy_issuer_chain.pem	Updated issuer-chain template.
config/AzCVMEmu/tcb_mapping.json	Updated emulation mapping fixture.
Cargo.lock	Updated dependency lockfile.

Review details

Suppressed comments (3)

sh_script/Azure/build_azure_mock_test.sh:379

• This new build is piped through grep ... || true, but migtd-hash is omitted from the existence check below. A compiler failure can therefore be reported as “All tools built successfully” and only surface later when the missing binary is invoked at line 464. Make this build fail fast or include the binary in the verification loop.

cargo build --release -p migtd-hash 2>&1 | grep -E "(Compiling|Finished|error)" || true

sh_script/build_policy_v2.sh:8

• The new required mapping argument makes the documented command in doc/policy_v2.md:126 fail with the usage error because it still passes only the environment. Update that guide (and any downstream invocation) to pass the cumulative mapping path rather than leaving the release workflow unusable as documented.

tcb_mapping_file="${2:-}"

src/policy/src/v2/policy.rs:213

• This change makes the outer policy signature legacy and ignored, but doc/policy_v2.md:63-70 still instructs users to sign policyData and says the output contains an authoritative signature. That guide now describes the wrong trust model and release artifact; update it to document RTMR2's canonical measurement and the policy-issuer-signed TCB mapping instead.

    /// Legacy outer signature, ignored because policyData integrity is
    /// established by the RTMR2 measurement.
    #[serde(default)]
    pub signature: Option<String>,

• Files reviewed: 34/39 changed files
• Comments generated: 6
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[haitaohuang]

@haitaohuang , is any Microsoft people can review and approve as well?

@mingweishih

[ksayid]

just wondering, is the servtdIdentity signature part of the RTMR2 measurement? If so, could re-signing it here affect the tdinfo_hash we recorded earlier?