Measure payload only when EXTENDMR is not set

td-shim/src/bin/td-shim/main.rs

@@ -146,6 +146,7 @@ pub extern "win64" fn _start(
     // If the Payload Information GUID HOB is present, try to boot the Linux kernel.
     if let Some(payload_info) = dynamic_info.payload_info {
         boot_linux_kernel(
+            &static_info,
             &payload_info,
             &dynamic_info.acpi_tables,
             &mem,
@@ -154,12 +155,18 @@ pub extern "win64" fn _start(
         );
     }
 
-    boot_builtin_payload(&mut mem, &mut td_event_log, &dynamic_info.acpi_tables);
+    boot_builtin_payload(
+        &static_info,
+        &mut mem,
+        &mut td_event_log,
+        &dynamic_info.acpi_tables,
+    );
 
     panic!("payload entry() should not return here, deadloop!!!");
 }
 
 fn boot_linux_kernel(
+    static_info: &BootTimeStatic,
     kernel_info: &PayloadInfo,
     acpi_tables: &Vec<&[u8]>,
     mem: &memory::Memory,
@@ -184,7 +191,9 @@ fn boot_linux_kernel(
     let payload_parameter = mem.get_dynamic_mem_slice(SliceType::PayloadParameter);
 
     // Record the payload binary/paramater into event log.
-    log_payload_binary(payload, event_log);
+    if static_info.payload_extend_rtmr() {
+        log_payload_binary(payload, event_log);
+    }
     log_payload_parameter(payload_parameter, event_log);
 
     let mailbox = mem.get_dynamic_mem_slice_mut(SliceType::RelocatedMailbox);
@@ -203,6 +212,7 @@ fn boot_linux_kernel(
 }
 
 fn boot_builtin_payload(
+    static_info: &BootTimeStatic,
     mem: &mut memory::Memory,
     event_log: &mut CcEventLogWriter,
     acpi_tables: &Vec<&[u8]>,
@@ -222,7 +232,9 @@ fn boot_builtin_payload(
     }
 
     // Record the payload binary information into event log.
-    log_payload_binary(payload_bin, event_log);
+    if static_info.payload_extend_rtmr() {
+        log_payload_binary(payload_bin, event_log);
+    }
 
     // Create an EV_SEPARATOR event to mark the end of the td-shim events
     event_log.create_seperator();

td-shim/src/bin/td-shim/shim_info.rs

@@ -24,6 +24,11 @@ pub struct BootTimeStatic {
     // If metadata contains one/more `PermMem` sections,
     // TD-Shim should ignore the memory information in TD HOB.
     metadata_has_perm: bool,
+
+    // If metadata contains `Payload` section and the attribute
+    // is `1` (PAGE.AUG), the payload is not extended into MRTD and will
+    // be measured into RTMR[1]
+    payload_extend_rtmr: bool,
 }
 
 impl BootTimeStatic {
@@ -76,12 +81,16 @@ impl BootTimeStatic {
         let mut offset = metadata_offset + TDX_METADATA_DESCRIPTOR_LEN;
         let mut sections = Vec::new();
         let mut metadata_has_perm = false;
+        let mut payload_extend_rtmr = false;
 
         for _ in 0..descriptor.number_of_section_entry {
             let section = firmware.pread::<TdxMetadataSection>(offset as usize).ok()?;
             if section.r#type == TDX_METADATA_SECTION_TYPE_PERM_MEM {
                 metadata_has_perm = true;
             }
+            if section.r#type == TDX_METADATA_SECTION_TYPE_PAYLOAD && section.attributes == 0 {
+                payload_extend_rtmr = true;
+            }
 
             sections.push(section);
             offset += TDX_METADATA_SECTION_LEN;
@@ -96,12 +105,17 @@ impl BootTimeStatic {
         Some(Self {
             sections,
             metadata_has_perm,
+            payload_extend_rtmr,
         })
     }
 
     pub fn sections(&self) -> &[TdxMetadataSection] {
         self.sections.as_slice()
     }
+
+    pub fn payload_extend_rtmr(&self) -> bool {
+        self.payload_extend_rtmr
+    }
 }
 
 pub struct BootTimeDynamic<'a> {

td-shim/src/metadata.rs

@@ -335,7 +335,7 @@ pub fn validate_sections(sections: &[TdxMetadataSection]) -> Result<(), TdxMetad
                 if payload_cnt > 1 {
                     return Err(TdxMetadataError::InvalidSection);
                 }
-                if section.attributes != 0 {
+                if section.attributes & (!TDX_METADATA_ATTRIBUTES_EXTENDMR) != 0 {
                     return Err(TdxMetadataError::InvalidSection);
                 }
                 if !check_data_memory_fields(
@@ -692,8 +692,11 @@ mod tests {
         assert!(validate_sections(&sections).is_ok());
         sections[4].r#type = TDX_METADATA_SECTION_TYPE_PAYLOAD;
         sections[5].r#type = TDX_METADATA_SECTION_TYPE_PAYLOAD_PARAM;
-        // section.attributes != 0
+        // section.attributes == 1 means it is extended into MRTD
         sections[4].attributes = 1;
+        assert!(validate_sections(&sections).is_ok());
+        // section.attributes != 0 or 1
+        sections[4].attributes = 2;
         assert!(!validate_sections(&sections).is_ok());
         sections[4].attributes = 0;
         // raw_data_size == 0 but data_offset != 0