MigTD v0.7.0 Release

[sgrams]

MigTD v0.7.0 Release

Breaking Changes

• Remove two-phase prepare/finalize rebinding model — replaced with single-phase model

Features

• Update MIGTD_DATA to GHCI 1.5 TDINFO format
• Verify SERVTD_ATTR using SERVTD.RD API
• Account for SERVTD_EXT in migration flow (consistent with rebind flow)
• Verify policy against TDINFO_STRUCT
• Implement FatalError TdVmcall during panic()
• Add SPDM attestation initial flow for rebinding
• Refactor v1/v2 attestation into separate functions

Bug Fixes

• Fix SERVTD_EXT padding and zeroing
• Fix multiple mutable borrow of reader in SPDM migration flow
• Fix RatlsError to MigrationResult conversion in RATLS setup
• Fix attestation transport not being closed
• Fix TDG.VM.WR tdcall write mask
• Fix GetMigTDData optional reportdata size
• Fix rebind order of repeated functions for finalize phase
• Fix missed eval of the common policy

Testing & CI

• Add unit tests for InitData and RebindingInfo
• Add SPDM attestation emulation tests and rebind-prepare tests to CI
• Make TDX Integration Test optional (workflow_dispatch only)
• Update CONTRIBUTING.md with commit message conventions

Dependencies

• Upgrade spdm-rs to v0.5.2
• Upgrade rustls-webpki to 0.103.13 (RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0104)
• Upgrade zerocopy to 0.8.27
• Upgrade td-shim submodule
• Dependency bumps: bitflags, env_logger, serde_json, tokio, sha2, clap

Validation

CI Emulation Tests (55/55 checks passed)

Integration tests (8/8 passed):

Test	Transport	Policy	Attestation	Status
Build and Test (Skip RA)	TLS	—	Skipped	PASS
Policy v2 with Mock Report	TLS	v2	Mock	PASS
Policy v2 with Mock Report + IGVM Attest	TLS	v2	Mock + IGVM	PASS
Rebind Prepare (Skip RA)	TLS	v2	Skipped	PASS
Rebind Prepare (Mock Report)	TLS	v2	Mock	PASS
SPDM Migration (Skip RA)	SPDM	—	Skipped	PASS
SPDM Policy v2 with Mock Report	SPDM	v2	Mock	PASS
SPDM Rebind Prepare (Skip RA)	SPDM	v2	Skipped	PASS

Build matrix (24/24 passed): All combinations of transport (virtio-vsock, virtio-serial, vmcall-vsock, vmcall-raw) × policy (v1, v2) × attestation (TLS, SPDM) × profile (Release, Debug).

Quality & security checks (all passed): Format, Clippy, CodeQL, Trivy, cargo-deny (advisories, bans, sources), Dependency Review, Fuzzing, CIFuzz, Library Crates.

TDX Hardware Validation

All pull requests merged since v0.6.0 were individually validated on TDX hardware in the developer's environment prior to merge. Hardware-validated features:

• GHCI 1.5 TDINFO format (MIGTD_DATA update)
• SERVTD_ATTR verification via SERVTD.RD API
• SERVTD_EXT in migration flow
• Rebinding flow (single-phase model)
• Policy verification against TDINFO_STRUCT
• FatalError TdVmcall during panic()

---

This discussion was created from the release MigTD v0.7.0 Release.

[sgrams]

MigTD v0.7.0 — Work Item Cross-Reference

Cross-reference of management work items against the v0.7.0 codebase (tag v0.7.0, April 24, 2026).

Work Item	Component	List Status	v0.7.0 Status	Evidence
MigTD changes for GHCI_20260114 (rebind, servtd_ext, InitMigTD data)	MigTD	Done	Done	c35e102, fe87131, 1bfc8b2
VMM changes for Servicing MigTD	VMM	Done	Out of scope	—
VMM changes for rebind flows	VMM	Done	Out of scope	—
Integration/Debug rebind with VMM	VMM+MigTD	Done	Done (MigTD side)	HW validated per-PR, CI rebind tests pass
Verify TDX module rebind (xcr0 hang)	TDX Module	WIP	Out of scope	—
Verify Migration with Rebind done TD	VMM	Not Started	Out of scope	—
MigTD changes for GHCI_20260213	MigTD	Not Started	Done	All 4 sub-items complete
— 1. Clean up prepare/finalize			Done	433dd79 remove two-phase model
— 2. Support updated rebind flows			Done	9096677, 4566d40, ac845d8
— 3. Update MIGTD_DATA_ENTRY_STRUCT			Done	486769f, c35e102
— 4. Policy + SERVTD_EXT verifications			Done	f2ea0ef, a7c6ac0, fe87131
VMM clean up old rebind flows	VMM	Not Started	Out of scope	—
Integration/Debug updated Rebind	VMM+MigTD	Not Started	Done (MigTD side)	CI + HW validated
Provisional log support	MigTD	WIP	Done	a1da894 provisional logs; 28c3784 test fix; logging.rs implementation
DCAP library logs	MigTD	Deferred	Deferred	No commits
CoRIM/TOML format support	MigTD	Deferred	Deferred	No commits