Nitro Enclaves run Linux inside as well as outside the Enclave. Outside the Enclave, we already have the nitro_enclaves driver in upstream Linux which controls a Nitro Enclave's lifecycle. Inside the Enclave, the environment looks like a typical Firecracker microvm. In addition to standard virtio devices, an Enclave also has an additional "Nitro Secure Module" (NSM) virtio device which so far was missing an upstream Linux driver. The NSM provides access to PCRs, an attestation document as well as entropy. To support the NSM communication protocol, Linux needs to learn to generate and parse the Concise Binary Object Representation (CBOR) format. The first patch adds support for a CBOR library. The second adds the actual NSM driver. With these patches in place, upstream Linux has everything that's needed to run inside a Nitro Enclave. Alex v1 -> v2: - Remove boilerplate - Add uapi header v2 -> v3: - Move globals to device struct - Add compat handling - Simplify some naming - Remove debug prints - Use module_virtio_driver - Ensure remove only happens on target device - Drop use of uio.h v3 -> v4: - Add CBOR library - Merge hwrng into the misc driver - Add dependency on CBOR library - Add internal and ioctl logic for all current NSM actions - Use in-struct arrays instead of kvecs - Add sysfs entries for NSM metadata - Use dev_ print and devm_ allocation helpers Alexander Graf (2): Import CBOR library misc: Add Nitro Secure Module driver MAINTAINERS | 17 + drivers/misc/Kconfig | 13 + drivers/misc/Makefile | 1 + drivers/misc/nsm.c | 1466 ++++++++++++++++++++++++++++++++++ include/linux/cbor/base.h | 94 +++ include/linux/cbor/cbor.h | 22 + include/linux/cbor/decoder.h | 42 + include/linux/cbor/encoder.h | 48 ++ include/linux/cbor/helper.h | 41 + include/linux/cbor/ieee754.h | 52 ++ include/linux/cbor/parser.h | 32 + include/uapi/linux/nsm.h | 188 +++++ lib/Kconfig | 3 + lib/Makefile | 2 + lib/cbor/Makefile | 12 + lib/cbor/common.c | 105 +++ lib/cbor/decoder.c | 170 ++++ lib/cbor/encoder.c | 218 +++++ lib/cbor/helper.c | 175 ++++ lib/cbor/ieee754.c | 205 +++++ lib/cbor/parser.c | 243 ++++++ 21 files changed, 3149 insertions(+) create mode 100644 drivers/misc/nsm.c create mode 100644 include/linux/cbor/base.h create mode 100644 include/linux/cbor/cbor.h create mode 100644 include/linux/cbor/decoder.h create mode 100644 include/linux/cbor/encoder.h create mode 100644 include/linux/cbor/helper.h create mode 100644 include/linux/cbor/ieee754.h create mode 100644 include/linux/cbor/parser.h create mode 100644 include/uapi/linux/nsm.h create mode 100644 lib/cbor/Makefile create mode 100644 lib/cbor/common.c create mode 100644 lib/cbor/decoder.c create mode 100644 lib/cbor/encoder.c create mode 100644 lib/cbor/helper.c create mode 100644 lib/cbor/ieee754.c create mode 100644 lib/cbor/parser.c -- 2.40.1 Amazon Development Center Germany GmbH Krausenstr. 38 10117 Berlin Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B Sitz: Berlin Ust-ID: DE 289 237 879
