underhill_attestation/runtime_sealing/tcb_floor/
saved_state.rs

1// Copyright (c) Microsoft Corporation.
2// Licensed under the MIT License.
3
4//! Typed servicing DTOs, not evidence that a TCB was observed or accepted.
5//!
6//! Only transport these through an authenticated, VM-bound, fresh servicing
7//! channel. The caller must establish authentication, VM binding, and freshness;
8//! these messages provide none of them. Never restore them from VMGS, protector
9//! headers, or other host-controlled metadata. They contain no keys or secrets.
10
11use mesh::payload::Protobuf;
12
13/// An accepted runtime floor transferred through trusted servicing state.
14#[derive(Debug, Clone, PartialEq, Eq, Protobuf)]
15#[mesh(package = "underhill_attestation.runtime_sealing")]
16pub struct SavedRuntimeTcbFloor {
17    /// Schema version. Must be 1; absent (zero) and unknown versions fail restore.
18    #[mesh(1)]
19    pub version: u32,
20    /// Required on restore. Optional on the wire to detect an absent variant.
21    #[mesh(2)]
22    pub svn: Option<SavedRuntimeTcbFloorSvn>,
23}
24
25/// Raw SVN and its exact comparison domain, without keys or a hardware report.
26#[derive(Debug, Clone, PartialEq, Eq, Protobuf)]
27#[mesh(package = "underhill_attestation.runtime_sealing")]
28pub enum SavedRuntimeTcbFloorSvn {
29    /// Preserve every raw TCB byte, including reserved bytes and unknown domains.
30    #[mesh(1)]
31    Snp {
32        /// Complete raw reported TCB, with no component normalization.
33        #[mesh(1)]
34        tcb_version: u64,
35        /// Exact report version, including equality-only unknown versions.
36        #[mesh(2)]
37        report_version: u32,
38        /// Absent below report version 3; exactly [family, model] otherwise.
39        #[mesh(3)]
40        cpuid: Option<Vec<u8>>,
41    },
42    /// Preserve both 16-byte SVN arrays exactly, including reserved bytes.
43    #[mesh(2)]
44    Tdx {
45        /// Exact 16-byte TEE TCB SVN, including module identity and reserved bytes.
46        #[mesh(1)]
47        tee_tcb_svn: Vec<u8>,
48        /// Exact 16-byte CPU SVN.
49        #[mesh(2)]
50        cpu_svn: Vec<u8>,
51    },
52}
underhill_attestation/runtime_sealing/tcb_floor/saved_state.rs

underhill_attestation/runtime_sealing/tcb_floor/
saved_state.rs
