linux-kernel - [PATCH v4 0/2] Add Nitro Secure Module support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231009212053.2007-1-graf@amazon.com>
Date:   Mon, 9 Oct 2023 21:20:51 +0000
From:   Alexander Graf <graf@...zon.com>
To:     <linux-kernel@...r.kernel.org>
CC:     <linux-crypto@...r.kernel.org>, Arnd Bergmann <arnd@...db.de>,
        "Greg Kroah-Hartman" <gregkh@...uxfoundation.org>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        Olivia Mackall <olivia@...enic.com>,
        "Petre Eftime" <petre.eftime@...il.com>,
        Erdem Meydanlli <meydanli@...zon.nl>,
        Benjamin Herrenschmidt <benh@...nel.crashing.org>,
        David Woodhouse <dwmw@...zon.co.uk>,
        "Michael S . Tsirkin" <mst@...hat.com>,
        Jason Wang <jasowang@...hat.com>,
        Xuan Zhuo <xuanzhuo@...ux.alibaba.com>,
        Kyunghwan Kwon <k@...onn.com>
Subject: [PATCH v4 0/2] Add Nitro Secure Module support

Nitro Enclaves run Linux inside as well as outside the Enclave. Outside
the Enclave, we already have the nitro_enclaves driver in upstream Linux
which controls a Nitro Enclave's lifecycle.

Inside the Enclave, the environment looks like a typical Firecracker
microvm. In addition to standard virtio devices, an Enclave also has an
additional "Nitro Secure Module" (NSM) virtio device which so far was
missing an upstream Linux driver. The NSM provides access to PCRs, an
attestation document as well as entropy.

To support the NSM communication protocol, Linux needs to learn to
generate and parse the Concise Binary Object Representation (CBOR)
format. The first patch adds support for a CBOR library. The second adds
the actual NSM driver.

With these patches in place, upstream Linux has everything that's needed
to run inside a Nitro Enclave.


Alex

v1 -> v2:

  - Remove boilerplate
  - Add uapi header

v2 -> v3:

  - Move globals to device struct
  - Add compat handling
  - Simplify some naming
  - Remove debug prints
  - Use module_virtio_driver
  - Ensure remove only happens on target device
  - Drop use of uio.h

v3 -> v4:

  - Add CBOR library
  - Merge hwrng into the misc driver
  - Add dependency on CBOR library
  - Add internal and ioctl logic for all current NSM actions
  - Use in-struct arrays instead of kvecs
  - Add sysfs entries for NSM metadata
  - Use dev_ print and devm_ allocation helpers

Alexander Graf (2):
  Import CBOR library
  misc: Add Nitro Secure Module driver

 MAINTAINERS                  |   17 +
 drivers/misc/Kconfig         |   13 +
 drivers/misc/Makefile        |    1 +
 drivers/misc/nsm.c           | 1466 ++++++++++++++++++++++++++++++++++
 include/linux/cbor/base.h    |   94 +++
 include/linux/cbor/cbor.h    |   22 +
 include/linux/cbor/decoder.h |   42 +
 include/linux/cbor/encoder.h |   48 ++
 include/linux/cbor/helper.h  |   41 +
 include/linux/cbor/ieee754.h |   52 ++
 include/linux/cbor/parser.h  |   32 +
 include/uapi/linux/nsm.h     |  188 +++++
 lib/Kconfig                  |    3 +
 lib/Makefile                 |    2 +
 lib/cbor/Makefile            |   12 +
 lib/cbor/common.c            |  105 +++
 lib/cbor/decoder.c           |  170 ++++
 lib/cbor/encoder.c           |  218 +++++
 lib/cbor/helper.c            |  175 ++++
 lib/cbor/ieee754.c           |  205 +++++
 lib/cbor/parser.c            |  243 ++++++
 21 files changed, 3149 insertions(+)
 create mode 100644 drivers/misc/nsm.c
 create mode 100644 include/linux/cbor/base.h
 create mode 100644 include/linux/cbor/cbor.h
 create mode 100644 include/linux/cbor/decoder.h
 create mode 100644 include/linux/cbor/encoder.h
 create mode 100644 include/linux/cbor/helper.h
 create mode 100644 include/linux/cbor/ieee754.h
 create mode 100644 include/linux/cbor/parser.h
 create mode 100644 include/uapi/linux/nsm.h
 create mode 100644 lib/cbor/Makefile
 create mode 100644 lib/cbor/common.c
 create mode 100644 lib/cbor/decoder.c
 create mode 100644 lib/cbor/encoder.c
 create mode 100644 lib/cbor/helper.c
 create mode 100644 lib/cbor/ieee754.c
 create mode 100644 lib/cbor/parser.c

-- 
2.40.1




Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879