When running Linux inside a Nitro Enclave, the hypervisor provides a special virtio device called "Nitro Security Module" (NSM). This device has 3 main functions: 1) Provide attestation reports 2) Modify PCR state 3) Provide entropy This patch adds a driver for NSM that exposes a /dev/nsm device node which user space can issue an ioctl on this device with raw NSM CBOR formatted commands to request attestation documents, influence PCR states, read entropy and enumerate status of the device. In addition, the driver implements a hwrng backend.
Showing the changes to include/uapi (1 of 5 files). Show all
Unified · Split
| @@ -0,0 +1,31 @@ | |||
| 1 | /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ | ||
| 2 | /* | ||
| 3 | * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| 4 | */ | ||
| 5 | |||
| 6 | #ifndef __UAPI_LINUX_NSM_H | ||
| 7 | #define __UAPI_LINUX_NSM_H | ||
| 8 | |||
| 9 | #include <linux/ioctl.h> | ||
| 10 | #include <linux/types.h> | ||
| 11 | |||
| 12 | #define NSM_MAGIC 0x0A | ||
| 13 | |||
| 14 | #define NSM_REQUEST_MAX_SIZE 0x1000 | ||
| 15 | #define NSM_RESPONSE_MAX_SIZE 0x3000 | ||
| 16 | |||
| 17 | struct nsm_iovec { | ||
| 18 | __u64 addr; /* Virtual address of target buffer */ | ||
| 19 | __u64 len; /* Length of target buffer */ | ||
| 20 | }; | ||
| 21 | |||
| 22 | /* Raw NSM message. Only available with CAP_SYS_ADMIN. */ | ||
| 23 | struct nsm_raw { | ||
| 24 | /* Request from user */ | ||
| 25 | struct nsm_iovec request; | ||
| 26 | /* Response to user */ | ||
| 27 | struct nsm_iovec response; | ||
| 28 | }; | ||
| 29 | #define NSM_IOCTL_RAW _IOWR(NSM_MAGIC, 0x0, struct nsm_raw) | ||
| 30 | |||
| 31 | #endif /* __UAPI_LINUX_NSM_H */ | ||