mbox series

[v4,0/2] Add Nitro Secure Module support

Message ID 20231009212053.2007-1-graf@amazon.com
Headers show
Series Add Nitro Secure Module support | expand

Message

Alexander Graf Oct. 9, 2023, 9:20 p.m. UTC 
Nitro Enclaves run Linux inside as well as outside the Enclave. Outside
the Enclave, we already have the nitro_enclaves driver in upstream Linux
which controls a Nitro Enclave's lifecycle.

Inside the Enclave, the environment looks like a typical Firecracker
microvm. In addition to standard virtio devices, an Enclave also has an
additional "Nitro Secure Module" (NSM) virtio device which so far was
missing an upstream Linux driver. The NSM provides access to PCRs, an
attestation document as well as entropy.

To support the NSM communication protocol, Linux needs to learn to
generate and parse the Concise Binary Object Representation (CBOR)
format. The first patch adds support for a CBOR library. The second adds
the actual NSM driver.

With these patches in place, upstream Linux has everything that's needed
to run inside a Nitro Enclave.


Alex

v1 -> v2:

  - Remove boilerplate
  - Add uapi header

v2 -> v3:

  - Move globals to device struct
  - Add compat handling
  - Simplify some naming
  - Remove debug prints
  - Use module_virtio_driver
  - Ensure remove only happens on target device
  - Drop use of uio.h

v3 -> v4:

  - Add CBOR library
  - Merge hwrng into the misc driver
  - Add dependency on CBOR library
  - Add internal and ioctl logic for all current NSM actions
  - Use in-struct arrays instead of kvecs
  - Add sysfs entries for NSM metadata
  - Use dev_ print and devm_ allocation helpers

Alexander Graf (2):
  Import CBOR library
  misc: Add Nitro Secure Module driver

 MAINTAINERS                  |   17 +
 drivers/misc/Kconfig         |   13 +
 drivers/misc/Makefile        |    1 +
 drivers/misc/nsm.c           | 1466 ++++++++++++++++++++++++++++++++++
 include/linux/cbor/base.h    |   94 +++
 include/linux/cbor/cbor.h    |   22 +
 include/linux/cbor/decoder.h |   42 +
 include/linux/cbor/encoder.h |   48 ++
 include/linux/cbor/helper.h  |   41 +
 include/linux/cbor/ieee754.h |   52 ++
 include/linux/cbor/parser.h  |   32 +
 include/uapi/linux/nsm.h     |  188 +++++
 lib/Kconfig                  |    3 +
 lib/Makefile                 |    2 +
 lib/cbor/Makefile            |   12 +
 lib/cbor/common.c            |  105 +++
 lib/cbor/decoder.c           |  170 ++++
 lib/cbor/encoder.c           |  218 +++++
 lib/cbor/helper.c            |  175 ++++
 lib/cbor/ieee754.c           |  205 +++++
 lib/cbor/parser.c            |  243 ++++++
 21 files changed, 3149 insertions(+)
 create mode 100644 drivers/misc/nsm.c
 create mode 100644 include/linux/cbor/base.h
 create mode 100644 include/linux/cbor/cbor.h
 create mode 100644 include/linux/cbor/decoder.h
 create mode 100644 include/linux/cbor/encoder.h
 create mode 100644 include/linux/cbor/helper.h
 create mode 100644 include/linux/cbor/ieee754.h
 create mode 100644 include/linux/cbor/parser.h
 create mode 100644 include/uapi/linux/nsm.h
 create mode 100644 lib/cbor/Makefile
 create mode 100644 lib/cbor/common.c
 create mode 100644 lib/cbor/decoder.c
 create mode 100644 lib/cbor/encoder.c
 create mode 100644 lib/cbor/helper.c
 create mode 100644 lib/cbor/ieee754.c
 create mode 100644 lib/cbor/parser.c