src/pqc_hypervisor_attestation/backends/tdx.py
| 1 | """Intel TDX backend (stub interface). |
| 2 | |
| 3 | Real integration uses ``/dev/tdx-guest`` via the Intel TDX kernel module. |
| 4 | This stub documents the expected shape; users plug in their real syscalls. |
| 5 | |
| 6 | A production implementation of this backend is expected to: |
| 7 | |
| 8 | * Enumerate guest-physical memory ranges inside the TD (trust domain) that |
| 9 | cover the confidential workload, usually derived from the TDX module's |
| 10 | MRTD / RTMR measurements at build time. |
| 11 | * Issue a ``TDX_CMD_GET_REPORT0`` ioctl on ``/dev/tdx-guest`` per region and |
| 12 | compute a SHA3-256 hash of the page contents. |
| 13 | * Return ``MemoryRegion`` / ``RegionSnapshot`` values whose ``address`` |
| 14 | and ``size`` match the actual guest-physical ranges inside the TD. |
| 15 | """ |
| 16 | |
| 17 | from __future__ import annotations |
| 18 | |
| 19 | from pqc_hypervisor_attestation.backends.base import AttestationBackend |
| 20 | from pqc_hypervisor_attestation.errors import BackendError |
| 21 | from pqc_hypervisor_attestation.region import MemoryRegion, RegionSnapshot |
| 22 | |
| 23 | |
| 24 | class IntelTDXBackend(AttestationBackend): |
| 25 | """Stub Intel TDX backend. |
| 26 | |
| 27 | Raises :class:`BackendError` when invoked without real kernel wiring. |
| 28 | """ |
| 29 | |
| 30 | name = "intel-tdx" |
| 31 | platform = "intel-tdx" |
| 32 | |
| 33 | def __init__(self, device_path: str = "/dev/tdx-guest") -> None: |
| 34 | self.device_path = device_path |
| 35 | |
| 36 | def list_regions(self, workload_id: str) -> list[MemoryRegion]: |
| 37 | raise BackendError( |
| 38 | "IntelTDXBackend is a stub. Provide a real implementation that reads " |
| 39 | f"the workload's TD measurement from {self.device_path} and translates " |
| 40 | "guest-physical memory pages into MemoryRegion entries." |
| 41 | ) |
| 42 | |
| 43 | def snapshot(self, region: MemoryRegion) -> RegionSnapshot: |
| 44 | raise BackendError( |
| 45 | "IntelTDXBackend.snapshot is a stub. A real implementation issues " |
| 46 | "a TDX_CMD_GET_REPORT0 ioctl to attest the region's current state." |
| 47 | ) |
| 48 | |