microsoft/MigTD

microsoft/MigTD

Language: Rust

License: NOASSERTION

Stars: 4

Forks: 4

Open issues: 12

Created: 2025-08-25T22:31:05Z

Pushed: 2026-07-17T23:55:22Z

Default branch: main

Fork: yes

Parent repository: intel/MigTD

Archived: no

README:

rust-migtd

A rust version of Migration TD.

Migration TD (MigTD) is used to evaluate potential migration sources and targets for adherence to the TD Migration Policy, then securely transfer a Migration Session Key from the source platform to the destination platform to migrate assets of a specific TD.


The specification of MigTD is at Intel TDX Migration TD Design Guide

The full TD Migration architecture and flow is discussed in TD Migration Architecture Specification.

This package is the sample code to show the concept of Migration TD in TDX Migration Architecture. It also includes unit tests and fuzzing tests.

How to build

Prerequisites

1. Rust toolchain

• Install Rust:

curl https://sh.rustup.rs -sSf | sh -s -- -y --default-toolchain 1.88.0

• Add Rust target required by MigTD:

rustup target add x86_64-unknown-none

2. clang

3. NASM

• Please make sure clang, llvm-ar and nasm are installed and can be found in your PATH

4. Attestation Library Prerequisites

• Ensure that you have the following required operation systems:
• Red Hat Enterprise Linux Server release 8.5 64bits
• CentOS Stream 8 64bit
• Ubuntu* 22.04 LTS Server 64bits
• Use the following commands to install the required tools:
• On Red Hat Enterprise Linux 8.5

sudo yum groupinstall 'Development Tools'
sudo yum install ocaml ocaml-ocamlbuild wget rpm-build pkgconf libtool

• On CentOS Stream 8

sudo dnf group install 'Development Tools'
sudo dnf --enablerepo=powertools install ocaml ocaml-ocamlbuild wget rpm-build pkgconf libtool

• On CentOS Stream 9

sudo dnf group install 'Development Tools'
sudo dnf install ocaml ocaml-ocamlbuild wget rpm-build pkgconf perl-FindBin libtool

• On Ubuntu 22.04

sudo apt-get install build-essential ocaml ocamlbuild wget pkgconf libtool

Download Source Code

git clone https://github.com/intel/MigTD.git
git submodule update --init --recursive

Before build

./sh_script/preparation.sh

Build Migration TD

To build a MigTD binary with a default production migration policy:

cargo image

To specify the root certificate to be enrolled, you can use the --root-ca argument:

cargo image --root-ca /path/to/cert

To specify the policy file to be enrolled, you can use the --policy argument:

cargo image --policy /path/to/policy

The production attestation policy is:

• Root certificate at config/Intel_SGX_Provisioning_Certification_RootCA.cer.
• It can be downloaded from https://certificates.trustedservices.intel.com/Intel_SGX_Provisioning_Certification_RootCA.cer.
• Migration policy at config/policy_production_fmspc.json.
• The fmspc list is from https://api.trustedservices.intel.com/sgx/certification/v4/fmspcs with platform E5.
• The TCB level can be get via curl -v -X GET "https://api.trustedservices.intel.com/tdx/certification/v4/tcb?fmspc={}".
• Reference: https://api.portal.trustedservices.intel.com/content/documentation.html#pcs-tcb-info-tdx-v4.
• See tools/migtd-policy-generator/readme.md on how to generate the policy file.

To build a MigTD binary with a pre-production migration policy:

cargo image --root-ca config/Intel_SGX_Provisioning_Certification_RootCA_preproduction.cer --policy config/policy_pre_production_fmspc.json

Note: The pre-migration between MigTD built with pre-production certificate and MigTD built with production certificate is not suppported.

The pre-production attestation policy is:

• Root certificate at config/Intel_SGX_Provisioning_Certification_RootCA_preproduction.cer.
• It can be downloaded from https://sbx-certificates.trustedservices.intel.com/Intel_SGX_Provisioning_Certification_RootCA.cer.
• Migration policy at config/policy_pre_production_fmspc.json.
• The fmspc list is from https://sbx.api.trustedservices.intel.com/sgx/certification/v4/fmspcs with platform E5.
• The TCB level can be get via curl -v -X GET "https://sbx.api.trustedservices.intel.com/tdx/certification/v4/tcb?fmspc={}".

To use virtio-serial instead of virtio-vsock for the guest-host communication:

cargo image --no-default-features --features stack-guard,virtio-serial

To use vmcall-raw for the guest-host communication:

cargo image --no-default-features --features stack-guard,vmcall-raw

To generate IGVM format using vmcall-raw for the guest-host communication with logging enabled and support APIC oneshot timer if TSC deadline is unavailable:

cargo image --no-default-features --features vmcall-raw,stack-guard,main,test_disable_ra_and_accept_all,vmcall-interrupt,oneshot-apic --log-level info --image-format igvm

Policy V2

Please refer to [policy_v2.md](doc/policy_v2.md) for policy v2 generation and image setup.

Issuer chains for the policy, TCB mapping, and TD identity support only X.509 v3 certificates signed with ECDSA-P384 with SHA384 algorithm.

Build for Azure CVM Emulation (AzCVMEmu)

To build MigTD as a standard Rust app that can run in Azure TDX CVM environment, for development and testing purpose:

cargo build --no-default-features --features AzCVMEmu

The detailed AzCVMEmu mode instructions can be found in doc/AzCVMEmu.md.

Generate SERVTD_INFO_HASH

SERVTD_HASH_INFO can be calculated based on a given MigTD image and a TD configuration such as TD attributes, XFAM etc. An example configuration can be found in config/servtd_info.json.

To generate the SERVTD_HASH_INFO of a MigTD binary with a default TD configuration at config/servtd_info.json:

cargo hash --image /path/to/migtd.bin

And for IGVM format, update --image path like shown below

cargo hash --image /path/to/migtd.igvm

You can also specify a custom configuration in the same format with config/servtd_info.json

cargo hash --image /path/to/migtd.bin --servtd-info...