nx_attest_silicon.nx source
↩ module page · 322 lines · 13610 B
1// nx_attest_silicon.nx -- per-chip trust declaration.
2//
3// Per [[feedback-captain-moroni-doctrine]] Phase M4 and
4// [[feedback-reclamation-doctrine-captain-moroni]]: every supported
5// chip declares its known threat surface (Intel ME, AMD PSP, Apple
6// T2, Qualcomm baseband, vendor BMC) + the mitigations available
7// against that surface + the resulting trust ceiling.
8//
9// This is the LOOKUP TABLE that turns the reclamation doctrine into
10// runtime data: given a chip family, what xenocells need to be
11// instantiated, what budget caps apply, what operations remain
12// unsafe even after all mitigations are applied.
13//
14// Composes:
15// nx_xenocell -- the threat surfaces listed here become
16// xenocells the substrate instantiates
17// nx_organism -- xenocells from attest_silicon get registered
18// with the organism so they're counted in
19// host pressure aggregation
20// nx_budget -- trust ceiling influences how much RAM/VRAM
21// budget the substrate will accept declarations
22// for (low-trust hardware refuses big budgets)
23// nx_reclaim -- the composed operation that consumes this
24// attestation to produce a safety envelope
25//
26// V1 ships a hard-coded chip family enum + threat-surface bitmask +
27// trust_score per family. V2 will read from a content-addressed
28// chip-attestation database (peer-sharable so the community can
29// extend coverage without recompiling substrate).
30//
31// Gap list (V1 honest perf verdict):
32// - chip family enum is HARDCODED (V2 makes it data-driven)
33// - no actual silicon probe to AUTO-DETECT chip family (the host
34// OS's /proc/cpuinfo or DMI tables are queued; today the caller
35// supplies the chip family ID)
36// - mitigation_applied is a bitmask; partial application not
37// representable (mitigation either applied or not)
38// - sovereign-Nishi silicon entry is a stub
39//
40// genealogy_id: cardinal_2026-05-07_captain_moroni_doctrine +
41// cardinal_2026-05-19_reclamation_doctrine_phase_M4
42// lineage_id: substrate_attest_silicon_v1
43//
44// nx_safety_envelope:
45// intended_use: "Per-chip threat-surface declaration and
46// trust-ceiling computation; substrate refuses
47// sovereignty-critical operations on low-trust
48// hardware"
49// sil_target: SIL3
50// evidence: [chip_family_enum_sealed, trust_score_q10,
51// eight_mitigations_per_doctrine]
52// verdict: NOT_YET_EVALUATED
53
54import "nx_syscalls.nx"
55import "nx_tier.nx"
56const NX_MAGIC_1024: i64 = 1024
57
58// ===== Sealed enum: NxChipFamily ==================================
59//
60// Major commodity-CPU + auxiliary-processor families with known threat
61// surfaces. SOVEREIGN_NISHI is the aspirational endpoint (own silicon
62// with no opaque firmware). UNKNOWN is the default for chips the
63// substrate hasn't yet catalogued -- treated as low-trust.
64
65const NX_CHIP_UNKNOWN: nx_int = 0
66const NX_CHIP_INTEL_ME: nx_int = 1
67const NX_CHIP_AMD_PSP: nx_int = 2
68const NX_CHIP_APPLE_T2: nx_int = 3
69const NX_CHIP_APPLE_SECURE_ENCLAVE: nx_int = 4
70const NX_CHIP_QUALCOMM_BASEBAND: nx_int = 5
71const NX_CHIP_MEDIATEK_MODEM: nx_int = 6
72const NX_CHIP_BROADCOM_WIFI: nx_int = 7
73const NX_CHIP_VENDOR_BMC: nx_int = 8 // server out-of-band
74const NX_CHIP_NXP_SE: nx_int = 9 // smartcard SE
75const NX_CHIP_INFINEON_TPM: nx_int = 10
76const NX_CHIP_RISCV_OPEN: nx_int = 11 // SiFive/T-Head/etc open RISC-V
77const NX_CHIP_SOVEREIGN_NISHI: nx_int = 12
78const NX_CHIP_N_FAMILIES: nx_int = 13
79
80// ===== Sealed enum: NxThreatSurface (bitmask flags) ==============
81//
82// Bitmask flags. One chip can have multiple surfaces (ME has RAM_READ
83// + NET_EGRESS + FIRMWARE_PERSIST; PSP has FIRMWARE_PERSIST + DMA;
84// baseband has RADIO_ACTIVATE + DMA).
85
86const NX_TS_NONE: nx_int = 0
87const NX_TS_RAM_READ: nx_int = 1 // can read user RAM out-of-band
88const NX_TS_DMA: nx_int = 2 // direct memory access bypass
89const NX_TS_NET_EGRESS: nx_int = 4 // can phone home
90const NX_TS_RADIO_ACTIVATE: nx_int = 8 // can turn on transponder
91const NX_TS_FIRMWARE_PERSIST: nx_int = 16 // survives OS reinstall
92const NX_TS_MICROCODE_PATCH: nx_int = 32 // can flash CPU microcode
93const NX_TS_BOOT_INTERPOSE: nx_int = 64 // pre-OS boot hook
94const NX_TS_KEY_ESCROW: nx_int = 128 // vendor holds master keys
95
96// ===== Sealed enum: NxMitigationFlag =============================
97//
98// The 8 proven-shipping mitigations from the reclamation doctrine.
99// Each chip family lists WHICH mitigations are AVAILABLE; the
100// runtime tracks which have been APPLIED.
101
102const NX_MIT_NONE: nx_int = 0
103const NX_MIT_ME_CLEANER_HAP: nx_int = 1 // me_cleaner + HAP bit
104const NX_MIT_COREBOOT: nx_int = 2 // libreboot/coreboot
105const NX_MIT_EGRESS_FILTER: nx_int = 4 // host firewall vendor endpoints
106const NX_MIT_KILL_SWITCH: nx_int = 8 // physical disconnect
107const NX_MIT_SILICON_TRUST_ENF: nx_int = 16 // per-cell trust enforced
108const NX_MIT_CRYPTO_COMPART: nx_int = 32 // hardware-security-key
109const NX_MIT_MEMORY_HYGIENE: nx_int = 64 // swap-encrypt + no-hibernate
110const NX_MIT_DMA_DISCIPLINE: nx_int = 128 // IOMMU + thunderbolt off
111
112// ===== Struct: NxSiliconAttestation ===============================
113//
114// One row per chip family in the catalogue. Caller queries by chip
115// family ID to learn what xenocells to instantiate, what mitigations
116// apply, and what trust ceiling results.
117
118struct NxSiliconAttestation {
119 chip_family: nx_int,
120 threat_surface_mask: nx_int,
121 available_mitigations: nx_int,
122 applied_mitigations: nx_int,
123 base_trust_q10: nx_int, // 0-NX_MAGIC_1024 trust before mitigations
124 name: *u8,
125}
126
127// ===== nx_chip_family_is_valid ===================================
128
129func nx_chip_family_is_valid(f: nx_int) -> nx_int {
130 if f < 0 { return 0 }
131 if f >= NX_CHIP_N_FAMILIES { return 0 }
132 return 1
133}
134
135// ===== nx_chip_threat_surface ====================================
136//
137// Hardcoded catalogue of which surfaces each chip family exposes.
138// V2 will read this from a content-addressed peer-sharable database.
139
140func nx_chip_threat_surface(f: nx_int) -> nx_int {
141 if f == NX_CHIP_INTEL_ME {
142 return NX_TS_RAM_READ + NX_TS_DMA + NX_TS_NET_EGRESS +
143 NX_TS_FIRMWARE_PERSIST + NX_TS_MICROCODE_PATCH +
144 NX_TS_BOOT_INTERPOSE + NX_TS_KEY_ESCROW
145 }
146 if f == NX_CHIP_AMD_PSP {
147 return NX_TS_RAM_READ + NX_TS_DMA + NX_TS_FIRMWARE_PERSIST +
148 NX_TS_MICROCODE_PATCH + NX_TS_BOOT_INTERPOSE
149 }
150 if f == NX_CHIP_APPLE_T2 {
151 return NX_TS_RAM_READ + NX_TS_FIRMWARE_PERSIST +
152 NX_TS_BOOT_INTERPOSE + NX_TS_KEY_ESCROW
153 }
154 if f == NX_CHIP_APPLE_SECURE_ENCLAVE {
155 return NX_TS_KEY_ESCROW
156 }
157 if f == NX_CHIP_QUALCOMM_BASEBAND {
158 return NX_TS_DMA + NX_TS_NET_EGRESS + NX_TS_RADIO_ACTIVATE
159 }
160 if f == NX_CHIP_MEDIATEK_MODEM {
161 return NX_TS_DMA + NX_TS_NET_EGRESS + NX_TS_RADIO_ACTIVATE
162 }
163 if f == NX_CHIP_BROADCOM_WIFI {
164 return NX_TS_DMA + NX_TS_NET_EGRESS + NX_TS_RADIO_ACTIVATE
165 }
166 if f == NX_CHIP_VENDOR_BMC {
167 return NX_TS_RAM_READ + NX_TS_DMA + NX_TS_NET_EGRESS +
168 NX_TS_BOOT_INTERPOSE
169 }
170 if f == NX_CHIP_NXP_SE {
171 return NX_TS_KEY_ESCROW
172 }
173 if f == NX_CHIP_INFINEON_TPM {
174 return NX_TS_KEY_ESCROW
175 }
176 if f == NX_CHIP_RISCV_OPEN { return NX_TS_NONE }
177 if f == NX_CHIP_SOVEREIGN_NISHI { return NX_TS_NONE }
178 return NX_TS_RAM_READ + NX_TS_DMA + NX_TS_NET_EGRESS // UNKNOWN -> assume worst
179}
180
181// ===== nx_chip_available_mitigations =============================
182
183func nx_chip_available_mitigations(f: nx_int) -> nx_int {
184 if f == NX_CHIP_INTEL_ME {
185 return NX_MIT_ME_CLEANER_HAP + NX_MIT_COREBOOT +
186 NX_MIT_EGRESS_FILTER + NX_MIT_MEMORY_HYGIENE +
187 NX_MIT_DMA_DISCIPLINE + NX_MIT_CRYPTO_COMPART +
188 NX_MIT_SILICON_TRUST_ENF
189 }
190 if f == NX_CHIP_AMD_PSP {
191 return NX_MIT_COREBOOT + NX_MIT_EGRESS_FILTER +
192 NX_MIT_MEMORY_HYGIENE + NX_MIT_DMA_DISCIPLINE +
193 NX_MIT_CRYPTO_COMPART + NX_MIT_SILICON_TRUST_ENF
194 }
195 if f == NX_CHIP_APPLE_T2 {
196 return NX_MIT_EGRESS_FILTER + NX_MIT_MEMORY_HYGIENE
197 }
198 if f == NX_CHIP_QUALCOMM_BASEBAND {
199 return NX_MIT_KILL_SWITCH + NX_MIT_EGRESS_FILTER +
200 NX_MIT_DMA_DISCIPLINE
201 }
202 if f == NX_CHIP_MEDIATEK_MODEM {
203 return NX_MIT_KILL_SWITCH + NX_MIT_EGRESS_FILTER +
204 NX_MIT_DMA_DISCIPLINE
205 }
206 if f == NX_CHIP_BROADCOM_WIFI {
207 return NX_MIT_KILL_SWITCH + NX_MIT_EGRESS_FILTER +
208 NX_MIT_DMA_DISCIPLINE
209 }
210 if f == NX_CHIP_VENDOR_BMC {
211 return NX_MIT_KILL_SWITCH + NX_MIT_EGRESS_FILTER
212 }
213 if f == NX_CHIP_SOVEREIGN_NISHI { return NX_MIT_NONE } // no mitigation needed
214 return NX_MIT_NONE
215}
216
217// ===== nx_chip_base_trust_q10 ====================================
218//
219// Base trust score BEFORE mitigations applied. SOVEREIGN_NISHI is
220// Q10 1024 (full trust). UNKNOWN is Q10 0 (no trust). Commodity
221// hardware sits between based on documented compromise severity.
222
223func nx_chip_base_trust_q10(f: nx_int) -> nx_int {
224 if f == NX_CHIP_SOVEREIGN_NISHI { return NX_MAGIC_1024 }
225 if f == NX_CHIP_RISCV_OPEN { return 819 } // 80%
226 if f == NX_CHIP_INFINEON_TPM { return 512 } // 50%
227 if f == NX_CHIP_NXP_SE { return 512 }
228 if f == NX_CHIP_APPLE_SECURE_ENCLAVE { return 410 } // 40%
229 if f == NX_CHIP_APPLE_T2 { return 307 } // 30%
230 if f == NX_CHIP_AMD_PSP { return 256 } // 25%
231 if f == NX_CHIP_INTEL_ME { return 205 } // 20% -- worst commodity
232 if f == NX_CHIP_BROADCOM_WIFI { return 256 }
233 if f == NX_CHIP_QUALCOMM_BASEBAND { return 205 }
234 if f == NX_CHIP_MEDIATEK_MODEM { return 205 }
235 if f == NX_CHIP_VENDOR_BMC { return 102 } // 10%
236 return 0 // UNKNOWN
237}
238
239// ===== nx_attestation_new ========================================
240//
241// Construct an attestation record for one chip with no mitigations
242// applied yet. Caller then calls nx_attestation_apply_mitigation as
243// it ships each mitigation (boots Coreboot, enables egress filter,
244// etc) to track the effective trust.
245
246func nx_attestation_new(chip_family: nx_int, name: *u8) -> *NxSiliconAttestation {
247 let a: *NxSiliconAttestation = (sys_mmap(56)) as *NxSiliconAttestation
248 a.chip_family = chip_family
249 a.threat_surface_mask = nx_chip_threat_surface(chip_family)
250 a.available_mitigations = nx_chip_available_mitigations(chip_family)
251 a.applied_mitigations = NX_MIT_NONE
252 a.base_trust_q10 = nx_chip_base_trust_q10(chip_family)
253 a.name = name
254 return a
255}
256
257// ===== nx_attestation_apply_mitigation ===========================
258
259func nx_attestation_apply_mitigation(a: *NxSiliconAttestation,
260 mit: nx_int) -> nx_int {
261 // Only allow if mitigation is in the available set.
262 if (a.available_mitigations & mit) == 0 { return 1 }
263 a.applied_mitigations = a.applied_mitigations | mit
264 return 0
265}
266
267// ===== _popcount8 ================================================
268//
269// Count set bits in low 8 bits of x. Used to compute applied-
270// mitigation count for trust-ceiling adjustment.
271
272func _popcount8(x: nx_int) -> nx_int {
273 var c: nx_int = 0
274 var v: nx_int = x & 255
275 var i: nx_int = 0
276 while i < 8 {
277 if (v & 1) != 0 { c = c + 1 }
278 v = v >> 1
279 i = i + 1
280 }
281 return c
282}
283
284// ===== nx_attestation_effective_trust_q10 =========================
285//
286// Compute the post-mitigation trust ceiling. Formula:
287// base_trust + (1024 - base_trust) * (applied_count / 8)
288// So sovereign-Nishi (base 1024) stays 1024. Intel ME (base 205)
289// with all 7 applicable mitigations gets to ~205 + 819 * 7/8 = 922.
290// No commodity hardware can reach 1024 without sovereign silicon.
291
292func nx_attestation_effective_trust_q10(a: *NxSiliconAttestation) -> nx_int {
293 let applied_count: nx_int = _popcount8(a.applied_mitigations)
294 let headroom: nx_int = NX_MAGIC_1024 - a.base_trust_q10
295 // Cap at 8 (max mitigations).
296 var n: nx_int = applied_count
297 if n > 8 { n = 8 }
298 return a.base_trust_q10 + (headroom * n) / 8
299}
300
301// ===== nx_attestation_safe_for_secrets ============================
302//
303// Predicate: returns 1 if effective trust >= 768 (75%). Substrate
304// refuses to store master secrets / sign as identity / handle PII
305// on chips below this ceiling.
306
307func nx_attestation_safe_for_secrets(a: *NxSiliconAttestation) -> nx_int {
308 if nx_attestation_effective_trust_q10(a) >= 768 { return 1 }
309 return 0
310}
311
312// ===== nx_attestation_safe_for_gameplay ===========================
313//
314// Predicate: returns 1 if effective trust >= 410 (40%). Gameplay,
315// content rendering, non-PII compute is OK on chips that pass this
316// bar. Captain Moroni's discipline: don't refuse to USE commodity
317// hardware; refuse to put sovereign secrets ON commodity hardware.
318
319func nx_attestation_safe_for_gameplay(a: *NxSiliconAttestation) -> nx_int {
320 if nx_attestation_effective_trust_q10(a) >= 410 { return 1 }
321 return 0
322}