Module snp_id_block 

SEV-SNP ID block generation and signing.

Adds a signed SNP ID block to an already-built IGVM file as an [IgvmDirectiveHeader::SnpIdBlock] directive. Two signing modes are supported:

• Out-of-band (production): manifest emits the ID block signing payload as <base>-snp.idblock – the raw [SnpPspIdBlock] bytes, i.e. exactly the content the SNP firmware hashes (SHA-384) and validates. A generic file-content signer (e.g. openssl dgst -sha384 -sign key -out sig.der file) signs those bytes and emits a DER-encoded ECDSA signature file. That signature, plus the signing public key (X.509 cert or SPKI PEM), is fed back via add_snp_id_block_signed, which reconstructs the directive without ever holding a private key.
• Temporary key (development/test): add_snp_id_block_temp_key generates an ephemeral ECDSA P-384 key, signs the block in-process, and embeds the result. This is for local testing only.

Either way, the launch digest embedded in the block is the SNP measurement that the igvm crate’s [IgvmSerializer] computes eagerly at construction time, so the file is measured exactly once. The SNP measurement algorithm only hashes page-data directives, so adding the SnpIdBlock directive afterwards does not perturb that launch digest – the embedded ld stays valid. Its presence signals the IGVM loader to set id_block_en = 1.

Structs

SnpImageIdentity 🔒

Identity fields included in an SNP ID block.

Constants

SHA_384_OUTPUT_SIZE_BYTES 🔒

SNP_ECC_COMPONENT_SIZE_BYTES 🔒

SNP_ECC_KEY_SIZE_BYTES 🔒

SNP_ECDSA_CURVE_P384 🔒

SNP_FAMILY_ID

SNP family identifier for OpenHCL guests.

SNP_ID_KEY_ALGORITHM_ECDSA_P384_SHA384 🔒

SNP_IMAGE_ID

SNP image identifier for OpenHCL guests.

Functions

add_snp_id_block_signed

Add an SNP ID block using an out-of-band signature (production).

add_snp_id_block_temp_key 🔒

Add an SNP ID block signed by an ephemeral key (development/test only).

finish 🔒

Serialize the staged serializer to bytes with a trace of the result size.

guest_policy

Read the SNP GuestPolicy value for compatibility_mask from an IGVM file, if present.

id_block_directive 🔒

Assemble an [IgvmDirectiveHeader::SnpIdBlock] from an ID block plus its signature and public key. Author-key fields are left zeroed (author signing is not used); the directive’s presence signals the loader to set id_block_en = 1.

id_block_signing_payload

Build the SNP ID block signing payload for an IGVM file.

id_block_signing_payload_with_identity 🔒

Build an SNP ID block signing payload with an explicit image identity.

left_pad_be 🔒

Left-pad a big-endian ECC scalar/coordinate to 48 bytes.

padded_le_component 🔒

Zero-pads and reverses a big-endian ECC component into a 72-byte little-endian array as required by the PSP ID block format.

parse_der_ecdsa_p384 🔒

Parse a DER-encoded ECDSA signature (SEQUENCE { INTEGER r, INTEGER s }) into its big-endian 48-byte P-384 (r, s) components.

parse_p384_public_key 🔒

Extract the signer’s ECDSA P-384 public key from a supplied public key.

parse_signing_payload 🔒

Parse and validate an SNP ID block signing payload (the raw [SnpPspIdBlock] bytes emitted by manifest).

sign_id_block_with_temp_key 🔒

Generate a temporary ECDSA P-384 key pair using the selected crypto backend, sign the SHA-384 hash of the ID block, and return the signature

signature_and_verify 🔒

Parse a DER ECDSA signature + public key, cryptographically verify the signature over signed_bytes (the signing payload the signer signed), and return the IGVM ID block signature and public-key structures (big-endian in, PSP little-endian layout out).

snp_context 🔒

Locate the SEV-SNP compatibility mask, reject a pre-existing ID block, and return (compatibility_mask, guest_policy).

snp_measurement 🔒

Fetch the cached SNP launch measurement (48-byte SHA-384) from a serializer.