src/pqc_hypervisor_attestation/backends/sev_snp.py
| 1 | """AMD SEV-SNP backend (stub interface). |
| 2 | |
| 3 | Real integration uses ``/dev/sev-guest`` via the ``sev-snp`` kernel module. |
| 4 | This stub documents the expected shape; users plug in their real syscalls. |
| 5 | |
| 6 | A production implementation of this backend is expected to: |
| 7 | |
| 8 | * Enumerate guest-physical memory ranges the confidential workload owns, |
| 9 | usually by reading the SEV-SNP launch measurement and combining it with |
| 10 | static manifest data produced at VM boot. |
| 11 | * Issue an ``SNP_GET_REPORT`` ioctl on ``/dev/sev-guest`` per region and |
| 12 | compute a SHA3-256 hash of the page contents. |
| 13 | * Return ``MemoryRegion`` / ``RegionSnapshot`` values whose ``address`` |
| 14 | and ``size`` match the actual guest-physical ranges. |
| 15 | """ |
| 16 | |
| 17 | from __future__ import annotations |
| 18 | |
| 19 | from pqc_hypervisor_attestation.backends.base import AttestationBackend |
| 20 | from pqc_hypervisor_attestation.errors import BackendError |
| 21 | from pqc_hypervisor_attestation.region import MemoryRegion, RegionSnapshot |
| 22 | |
| 23 | |
| 24 | class AMDSEVSNPBackend(AttestationBackend): |
| 25 | """Stub AMD SEV-SNP backend. |
| 26 | |
| 27 | Raises :class:`BackendError` when invoked without real kernel wiring. |
| 28 | """ |
| 29 | |
| 30 | name = "amd-sev-snp" |
| 31 | platform = "amd-sev-snp" |
| 32 | |
| 33 | def __init__(self, device_path: str = "/dev/sev-guest") -> None: |
| 34 | self.device_path = device_path |
| 35 | |
| 36 | def list_regions(self, workload_id: str) -> list[MemoryRegion]: |
| 37 | raise BackendError( |
| 38 | "AMDSEVSNPBackend is a stub. Provide a real implementation that reads " |
| 39 | f"the workload's launch digest from {self.device_path} and translates " |
| 40 | "guest-physical memory pages into MemoryRegion entries." |
| 41 | ) |
| 42 | |
| 43 | def snapshot(self, region: MemoryRegion) -> RegionSnapshot: |
| 44 | raise BackendError( |
| 45 | "AMDSEVSNPBackend.snapshot is a stub. A real implementation issues " |
| 46 | "an SNP_GET_REPORT ioctl to attest the region's current state." |
| 47 | ) |
| 48 | |