A rust version Migration TD.
Migration TD (MigTD) is used to evaluate potential migration sources and targets for adherence to the TD Migration Policy, then securely transfer a Migration Session Key from the source platform to the destination platform to migrate assets of a specific TD.
The specification of MigTD is at Intel TDX Migration TD Design Guide
The full TD Migration architecture and flow is discussed in TD Migration Architecture Specification.
This package is only the sample code to show the concept. It does not have a full validation such as robustness functional test and fuzzing test. It does not meet the production quality yet. Any codes including the API definition, the libary and the drivers are subject to change.
- Rust toolchain
- Install Rust:
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
- Install toolchain and components required by MigTD:
rustup toolchain install nightly-2023-08-28
rustup component add --toolchain nightly-2023-08-28 rust-src
cargo install cargo-xbuild
- Please make sure
clang,llvm-arandnasmare installed and can be found in your PATH
- Ensure that you have the following required operation systems:
- Red Hat Enterprise Linux Server release 8.5 64bits
- CentOS Stream 8 64bit
- Ubuntu* 22.04 LTS Server 64bits
- Use the following commands to install the required tools:
- On Red Hat Enterprise Linux 8.5
sudo yum groupinstall 'Development Tools' sudo yum install ocaml ocaml-ocamlbuild wget rpm-build pkgconf libtool- On CentOS Stream 8
sudo dnf group install 'Development Tools' sudo dnf --enablerepo=powertools install ocaml ocaml-ocamlbuild wget rpm-build pkgconf libtool- On CentOS Stream 9
sudo dnf group install 'Development Tools' sudo dnf install ocaml ocaml-ocamlbuild wget rpm-build pkgconf perl-FindBin libtool- On Ubuntu 22.04
sudo apt-get install build-essential ocaml ocamlbuild wget pkgconf libtool
git clone https://github.com/intel/MigTD.git
git submodule update --init --recursive
./sh_script/preparation.sh
To build a MigTD binary with a default migration policy:
cargo image
By default, MigTD uses the attestation root certificate at config/intel_root_sbx.der and
migration policy at config/policy.json
To specify the root certificate to be enrolled, you can use the --root-ca argument:
cargo image --root-ca /path/to/cert
Note: SGX SBX Root CA can be downloaded at https://sbx-certificates.trustedservices.intel.com/Intel_SGX_Provisioning_Certification_RootCA.cer
To specify the policy file to be enrolled, you can use the --policy argument:
cargo image --policy /path/to/policy
To use virtio-serial instead of virtio-vsock for the guest-host communication:
cargo image --no-default-features --features remote-attestation,stack-guard,virtio-serial
SERVTD_HASH_INFO can be calculated based on a given MigTD image and a TD configuration such as
TD attributes, XFAM etc. An example configuration can be found in config/servtd_info.json. If a
field is masked by VMM, then it should be set to zero in the configuration file.
To generate the SERVTD_HASH_INFO of a MigTD binary with a default TD configuration at config/servtd_info.json:
cargo hash --image /path/to/migtd.bin
You can also specify a custom configuration in the same format with config/servtd_info.json
cargo hash --image /path/to/migtd.bin --servtd-info /path/to/servtd_info.json
The hash value in string will be ouput to stdout. You can also output the binary by specifing
output file through -o.
- Linux Kernel (KVM) and QEMU with with TDX 1.5 support
- qemu-kvm-configuration lists the versions of dependencies that MigTD has been tested on. Also refer to tdx-tools for more information about MVP release.
- TDX Attestation Software Stack
- MigTD depends on
sgx-dcap-pccsandtdx-qgsto do remote attestation. Please refer to linux-sgx for details or follow the tdx-tools wiki to setup the environment.
- Guest-Hypervisor Communication Interface (GHCI) required for remote attestation
- MigTD relies on
TDG.VP.VMCALL<GetQuote>andTDG.VP.VMCALL<SetupEventNotifyInterrupt>interfaces provided by hypervisor to get quote. Please make sure your hypervisor implements these leaves.
- Start two vsock server agent on host:
socat TCP4-LISTEN:9001,reuseaddr VSOCK-LISTEN:1234,fork &
socat TCP4-CONNECT:127.0.0.1:9001,reuseaddr VSOCK-LISTEN:1235,fork &
- Launch source Migration TD:
QEMU=/path/to/qemu-system-x86_64
MIGTD=/path/to/migtd.bin
$QEMU -accel kvm \
-M q35 \
-cpu host,host-phys-bits,-kvm-steal-time,pmu=off \
-smp 1,threads=1,sockets=1 \
-m 32M \
-object tdx-guest,id=tdx0,sept-ve-disable=off,debug=off,quote-generation-service=vsock:1:4050 \
-object memory-backend-memfd-private,id=ram1,size=32M \
-machine q35,memory-backend=ram1,confidential-guest-support=tdx0,kernel_irqchip=split \
-bios ${MIGTD} \
-device vhost-vsock-pci,id=vhost-vsock-pci1,guest-cid=18,disable-legacy=on \
-name migtd-src,process=migtd-src,debug-threads=on \
-no-hpet \
-nographic -vga none -nic none \
-serial mon:stdio
- Launch destination Migration TD:
QEMU=/path/to/qemu-system-x86_64
MIGTD=/path/to/migtd.bin
$QEMU -accel kvm \
-M q35 \
-cpu host,host-phys-bits,-kvm-steal-time,pmu=off \
-smp 1,threads=1,sockets=1 \
-m 32M \
-object tdx-guest,id=tdx0,sept-ve-disable=off,debug=off,quote-generation-service=vsock:1:4050 \
-object memory-backend-memfd-private,id=ram1,size=32M \
-machine q35,memory-backend=ram1,confidential-guest-support=tdx0,kernel_irqchip=split \
-bios ${MIGTD} \
-device vhost-vsock-pci,id=vhost-vsock-pci1,guest-cid=36,disable-legacy=on \
-name migtd-dst,process=migtd-dst,debug-threads=on \
-no-hpet \
-nographic -vga none -nic none \
-serial mon:stdio
- Do pre-migration:
Ask migtd-dst to start pre-migration and wait for migtd-src's connection:
echo "qom-set /objects/tdx0/ vsockport 0" | nc -U /tmp/qmp-sock-dst
Ask migtd-src to start pre-migration:
echo "qom-set /objects/tdx0/ vsockport 0" | nc -U /tmp/qmp-sock-src
Note: user TDs need to be bound to MigTDs before pre-migration.
- Launch destination Migration TD:
QEMU=/path/to/qemu-system-x86_64
MIGTD=/path/to/migtd.bin
$QEMU -accel kvm \
-M q35 \
-cpu host,host-phys-bits,-kvm-steal-time,pmu=off \
-smp 1,threads=1,sockets=1 \
-m 32M \
-object tdx-guest,id=tdx0,sept-ve-disable=off,debug=off,quote-generation-service=vsock:1:4050 \
-object memory-backend-memfd-private,id=ram1,size=32M \
-machine q35,memory-backend=ram1,confidential-guest-support=tdx0,kernel_irqchip=split \
-bios ${MIGTD} \
-device virtio-serial-pci,id=virtio-serial0 \
-chardev socket,host=127.0.0.1,port=1234,server=on,id=foo \
-device virtserialport,chardev=foo,bus=virtio-serial0.0 \
-name migtd-dst,process=migtd-dst,debug-threads=on \
-no-hpet \
-nographic -vga none -nic none \
-serial mon:stdio
- Launch source Migration TD:
QEMU=/path/to/qemu-system-x86_64
MIGTD=/path/to/migtd.bin
$QEMU -accel kvm \
-M q35 \
-cpu host,host-phys-bits,-kvm-steal-time,pmu=off \
-smp 1,threads=1,sockets=1 \
-m 32M \
-object tdx-guest,id=tdx0,sept-ve-disable=off,debug=off,quote-generation-service=vsock:1:4050 \
-object memory-backend-memfd-private,id=ram1,size=32M \
-machine q35,memory-backend=ram1,confidential-guest-support=tdx0,kernel_irqchip=split \
-bios ${MIGTD} \
-device virtio-serial-pci,id=virtio-serial0 \
-chardev socket,host=127.0.0.1,port=1234,server=off,id=foo \
-device virtserialport,chardev=foo,bus=virtio-serial0.0 \
-name migtd-src,process=migtd-src,debug-threads=on \
-no-hpet \
-nographic -vga none -nic none \
-serial mon:stdio
Replace the IP specified by host=127.0.0.1 with the target IP address, if cross host migration is required.
- Do pre-migration:
Here we still set the vsockport as a workaround to trigger the pre-migration.
Ask migtd-dst to start pre-migration and wait for migtd-src's connection:
echo "qom-set /objects/tdx0/ vsockport 0" | nc -U /tmp/qmp-sock-dst
Ask migtd-src to start pre-migration:
echo "qom-set /objects/tdx0/ vsockport 0" | nc -U /tmp/qmp-sock-src
Reproducible build of MigTD binary requires same system user and source code path (see intel#51).
The Dockerfile is provided to build the docker image with the MigTD compilation environment for reproducible build. You can use the docker.sh to build and run the docker container:
./sh_script/docker.sh -f container