linux-kernel - Re: [PATCH v7] misc: Add Nitro Secure Module driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 02 Nov 2023 21:44:24 +0100
From:   "Arnd Bergmann" <arnd@...db.de>
To:     "Greg Kroah-Hartman" <gregkh@...uxfoundation.org>,
        "Alexander Graf" <graf@...zon.com>
Cc:     linux-kernel@...r.kernel.org, linux-crypto@...r.kernel.org,
        "Herbert Xu" <herbert@...dor.apana.org.au>,
        "Olivia Mackall" <olivia@...enic.com>,
        "Petre Eftime" <petre.eftime@...il.com>,
        "Erdem Meydanlli" <meydanli@...zon.nl>,
        "Benjamin Herrenschmidt" <benh@...nel.crashing.org>,
        "David Woodhouse" <dwmw@...zon.co.uk>,
        "Michael S. Tsirkin" <mst@...hat.com>,
        "Jason Wang" <jasowang@...hat.com>,
        "Xuan Zhuo" <xuanzhuo@...ux.alibaba.com>,
        "Christophe JAILLET" <christophe.jaillet@...adoo.fr>
Subject: Re: [PATCH v7] misc: Add Nitro Secure Module driver

On Thu, Nov 2, 2023, at 12:29, Greg Kroah-Hartman wrote:
> On Thu, Nov 02, 2023 at 10:54:34AM +0100, Alexander Graf wrote:
>> On 11.10.23 23:35, Alexander Graf wrote:
>> > When running Linux inside a Nitro Enclave, the hypervisor provides a
>> > special virtio device called "Nitro Security Module" (NSM). This device
>> > has 3 main functions:
>> > 
>> >    1) Provide attestation reports
>> >    2) Modify PCR state
>> >    3) Provide entropy
>> > 
>> > This patch adds a driver for NSM that exposes a /dev/nsm device node which
>> > user space can issue an ioctl on this device with raw NSM CBOR formatted
>> > commands to request attestation documents, influence PCR states, read
>> > entropy and enumerate status of the device. In addition, the driver
>> > implements a hwrng backend.
>> > 
>> > Originally-by: Petre Eftime <petre.eftime@...il.com>
>> > Signed-off-by: Alexander Graf <graf@...zon.com>
>> 
>> 
>> Ping for inclusion? I haven't seen any further comments on v7 of this patch,
>> so I'd assume it's good to go? :)
>
> Ah, I thought there would be a new version for some reason, sorry about
> that.  I'll review it after -rc1 is out, in the middle of the merge
> window right now, I can't add anything to my trees, but new drivers can
> always be added after that.

FWIW, all my comments have been addressed in this version. I'm not
exactly happy with the design, but none of the alternatives we looked
at were better, so I guess merging this version is better than having
it maintained out of tree.

Reviewed-by: Arnd Bergmann <arnd@...db.de>