(
&self,
boottime_mr: bool,
mr_key_provider: &[u8],
tdx_quote: &TdxQuote,
)
| 827 | |
| 828 | impl<T: GetDeviceId> Attestation<T> { |
| 829 | fn decode_mr_tdx( |
| 830 | &self, |
| 831 | boottime_mr: bool, |
| 832 | mr_key_provider: &[u8], |
| 833 | tdx_quote: &TdxQuote, |
| 834 | ) -> Result<Mrs> { |
| 835 | let quote = Quote::parse(&tdx_quote.quote).context("Failed to parse quote")?; |
| 836 | let rtmr3 = self.replay_runtime_events::<Sha384>(boottime_mr.then_some("boot-mr-done")); |
| 837 | let td_report = quote.report.as_td10().context("TDX report not found")?; |
| 838 | let mr_system = sha256([ |
| 839 | &td_report.mr_td[..], |
| 840 | &td_report.rt_mr0, |
| 841 | &td_report.rt_mr1, |
| 842 | &td_report.rt_mr2, |
| 843 | mr_key_provider, |
| 844 | ]); |
| 845 | let mr_aggregated = { |
| 846 | let mut hasher = sha2::Sha256::new(); |
| 847 | for d in [ |
| 848 | &td_report.mr_td, |
| 849 | &td_report.rt_mr0, |
| 850 | &td_report.rt_mr1, |
| 851 | &td_report.rt_mr2, |
| 852 | &rtmr3, |
| 853 | ] { |
| 854 | hasher.update(d); |
| 855 | } |
| 856 | // For backward compatibility. Don't include mr_config_id, mr_owner, mr_owner_config if they are all 0. |
| 857 | if td_report.mr_config_id != [0u8; 48] |
| 858 | || td_report.mr_owner != [0u8; 48] |
| 859 | || td_report.mr_owner_config != [0u8; 48] |
| 860 | { |
| 861 | hasher.update(td_report.mr_config_id); |
| 862 | hasher.update(td_report.mr_owner); |
| 863 | hasher.update(td_report.mr_owner_config); |
| 864 | } |
| 865 | hasher.finalize().into() |
| 866 | }; |
| 867 | Ok(Mrs { |
| 868 | mr_system, |
| 869 | mr_aggregated, |
| 870 | }) |
| 871 | } |
| 872 | |
| 873 | /// Decode the VM config from the external or embedded config |
| 874 | pub fn decode_vm_config<'a>(&'a self, mut config: &'a str) -> Result<VmConfig> { |
no test coverage detected