aa: record initdata in RTMR3 when MRCONFIGID is unset

attestation-agent/attestation-agent/Cargo.toml

@@ -48,6 +48,9 @@ tonic = { workspace = true, optional = true }
 ttrpc = { workspace = true, features = ["async"], optional = true }
 
 [dev-dependencies]
+attester = { path = "../attester", default-features = false, features = [
+    "test-utils",
+] }
 rstest.workspace = true
 serial_test.workspace = true
 tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }

attestation-agent/attestation-agent/src/bin/grpc-aa/main.rs

@@ -117,12 +117,14 @@ rpc: grpc
     let mut aa = AttestationAgent::new(config).context("start AA")?;
 
     let mut initdata_digest = None;
+    let mut initdata_alg = None;
     if let Some(initdata_toml_path) = cli.initdata_toml {
         info!("Initdata TOML file is given by parameter");
         let initdata_toml =
             std::fs::read_to_string(&initdata_toml_path).context("read initdata toml file")?;
-        let (_, digest) = Initdata::parse_and_get_digest(&initdata_toml)?;
+        let (initdata, digest) = Initdata::parse_and_get_digest(&initdata_toml)?;
         aa.set_initdata_toml(initdata_toml);
+        initdata_alg = Some(initdata.algorithm);
         initdata_digest = Some(digest);
     } else if let Some(initdata) = cli.initdata_digest {
         info!("Initdata digest is given by parameter");
@@ -132,20 +134,31 @@ rpc: grpc
         initdata_digest = Some(initdata);
     }
 
+    // Open the eventlog first, so that initdata measured into it starts from a recovered log.
+    aa.init().await.context("init AA")?;
+
     if let Some(initdata_digest) = initdata_digest {
-        let res = aa.bind_init_data(&initdata_digest).await.context(
-        "The initdata supplied by the parameter is inconsistent with that of the current platform.",
-    )?;
+        let res = aa
+            .bind_init_data(&initdata_digest)
+            .await
+            .context("Failed to bind initdata to the platform")?;
 
         match res {
             attester::InitDataResult::Ok => info!("Check initdata passed."),
             attester::InitDataResult::Unsupported => {
                 info!("Platform does not support initdata checking. Jumping.")
             }
+            attester::InitDataResult::NotBound => {
+                // The event content names the hash algorithm, which only the TOML gives.
+                let alg = initdata_alg
+                    .context("Initdata is not bound: pass --initdata-toml so AA can measure it")?;
+                aa.measure_init_data(alg, &initdata_digest)
+                    .await
+                    .context("Failed to measure initdata")?;
+            }
         }
     }
 
-    aa.init().await.context("init AA")?;
     debug!(
         "Attestation gRPC service listening on: {:?}",
         cli.attestation_sock

attestation-agent/attestation-agent/src/bin/grpc-aa/server.rs

@@ -4,7 +4,7 @@
 //
 
 use anyhow::*;
-use attestation_agent::{AttestationAPIs, AttestationAgent, RuntimeMeasurement};
+use attestation_agent::{AttestationAPIs, AttestationAgent, InitDataResult, RuntimeMeasurement};
 use protos::grpc::aa::attestation_agent::{
     BindInitDataRequest, BindInitDataResponse, ExtendRuntimeMeasurementRequest,
     ExtendRuntimeMeasurementResponse, GetAdditionalEvidenceRequest, GetAdditionalTeesRequest,
@@ -143,14 +143,23 @@ impl AttestationAgentService for AA {
 
         debug!("AA (grpc): bind init data ...");
 
-        self.inner
+        let result = self
+            .inner
             .bind_init_data(&request.digest)
             .await
             .map_err(|e| {
                 error!("AA (grpc): binding init data failed:\n{e:?}");
                 Status::internal(format!("[ERROR:{AGENT_NAME}] AA binding init data failed"))
             })?;
 
+        // A digest alone can't be measured instead, so an unset register is a failure here.
+        if let InitDataResult::NotBound = result {
+            error!("AA (grpc): init data is not bound: the platform register for it is unset");
+            return Err(Status::failed_precondition(format!(
+                "[ERROR:{AGENT_NAME}] AA init data is not bound"
+            )));
+        }
+
         debug!("AA (grpc): init data binding successfully!");
 
         let reply = BindInitDataResponse {};

attestation-agent/attestation-agent/src/bin/ttrpc-aa.rs

@@ -141,12 +141,14 @@ rpc: ttrpc
     let mut aa = AttestationAgent::new(config).context("start AA")?;
 
     let mut initdata_digest = None;
+    let mut initdata_alg = None;
     if let Some(initdata_toml_path) = cli.initdata_toml {
         info!("Initdata TOML file is given by parameter");
         let initdata_toml =
             std::fs::read_to_string(&initdata_toml_path).context("read initdata toml file")?;
-        let (_, digest) = Initdata::parse_and_get_digest(&initdata_toml)?;
+        let (initdata, digest) = Initdata::parse_and_get_digest(&initdata_toml)?;
         aa.set_initdata_toml(initdata_toml);
+        initdata_alg = Some(initdata.algorithm);
         initdata_digest = Some(digest);
     } else if let Some(initdata) = cli.initdata_digest {
         info!("Initdata digest is given by parameter");
@@ -156,20 +158,31 @@ rpc: ttrpc
         initdata_digest = Some(initdata);
     }
 
+    // Open the eventlog first, so that initdata measured into it starts from a recovered log.
+    aa.init().await.context("init AA")?;
+
     if let Some(initdata_digest) = initdata_digest {
-        let res = aa.bind_init_data(&initdata_digest).await.context(
-        "The initdata supplied by the parameter is inconsistent with that of the current platform.",
-    )?;
+        let res = aa
+            .bind_init_data(&initdata_digest)
+            .await
+            .context("Failed to bind initdata to the platform")?;
 
         match res {
             attester::InitDataResult::Ok => info!("Check initdata passed."),
             attester::InitDataResult::Unsupported => {
                 info!("Platform does not support initdata checking. Jumping.")
             }
+            attester::InitDataResult::NotBound => {
+                // The event content names the hash algorithm, which only the TOML gives.
+                let alg = initdata_alg
+                    .context("Initdata is not bound: pass --initdata-toml so AA can measure it")?;
+                aa.measure_init_data(alg, &initdata_digest)
+                    .await
+                    .context("Failed to measure initdata")?;
+            }
         }
     }
 
-    aa.init().await.context("init AA")?;
     let att = start_ttrpc_service(aa)?;
 
     let mut atts = Server::new()