code wiki / (root) / nx_attest_silicon.nx

nx_attest_silicon.nx source

↩ module page · 322 lines · 13610 B

1// nx_attest_silicon.nx -- per-chip trust declaration. 2// 3// Per [[feedback-captain-moroni-doctrine]] Phase M4 and 4// [[feedback-reclamation-doctrine-captain-moroni]]: every supported 5// chip declares its known threat surface (Intel ME, AMD PSP, Apple 6// T2, Qualcomm baseband, vendor BMC) + the mitigations available 7// against that surface + the resulting trust ceiling. 8// 9// This is the LOOKUP TABLE that turns the reclamation doctrine into 10// runtime data: given a chip family, what xenocells need to be 11// instantiated, what budget caps apply, what operations remain 12// unsafe even after all mitigations are applied. 13// 14// Composes: 15// nx_xenocell -- the threat surfaces listed here become 16// xenocells the substrate instantiates 17// nx_organism -- xenocells from attest_silicon get registered 18// with the organism so they're counted in 19// host pressure aggregation 20// nx_budget -- trust ceiling influences how much RAM/VRAM 21// budget the substrate will accept declarations 22// for (low-trust hardware refuses big budgets) 23// nx_reclaim -- the composed operation that consumes this 24// attestation to produce a safety envelope 25// 26// V1 ships a hard-coded chip family enum + threat-surface bitmask + 27// trust_score per family. V2 will read from a content-addressed 28// chip-attestation database (peer-sharable so the community can 29// extend coverage without recompiling substrate). 30// 31// Gap list (V1 honest perf verdict): 32// - chip family enum is HARDCODED (V2 makes it data-driven) 33// - no actual silicon probe to AUTO-DETECT chip family (the host 34// OS's /proc/cpuinfo or DMI tables are queued; today the caller 35// supplies the chip family ID) 36// - mitigation_applied is a bitmask; partial application not 37// representable (mitigation either applied or not) 38// - sovereign-Nishi silicon entry is a stub 39// 40// genealogy_id: cardinal_2026-05-07_captain_moroni_doctrine + 41// cardinal_2026-05-19_reclamation_doctrine_phase_M4 42// lineage_id: substrate_attest_silicon_v1 43// 44// nx_safety_envelope: 45// intended_use: "Per-chip threat-surface declaration and 46// trust-ceiling computation; substrate refuses 47// sovereignty-critical operations on low-trust 48// hardware" 49// sil_target: SIL3 50// evidence: [chip_family_enum_sealed, trust_score_q10, 51// eight_mitigations_per_doctrine] 52// verdict: NOT_YET_EVALUATED 53 54import "nx_syscalls.nx" 55import "nx_tier.nx" 56const NX_MAGIC_1024: i64 = 1024 57 58// ===== Sealed enum: NxChipFamily ================================== 59// 60// Major commodity-CPU + auxiliary-processor families with known threat 61// surfaces. SOVEREIGN_NISHI is the aspirational endpoint (own silicon 62// with no opaque firmware). UNKNOWN is the default for chips the 63// substrate hasn't yet catalogued -- treated as low-trust. 64 65const NX_CHIP_UNKNOWN: nx_int = 0 66const NX_CHIP_INTEL_ME: nx_int = 1 67const NX_CHIP_AMD_PSP: nx_int = 2 68const NX_CHIP_APPLE_T2: nx_int = 3 69const NX_CHIP_APPLE_SECURE_ENCLAVE: nx_int = 4 70const NX_CHIP_QUALCOMM_BASEBAND: nx_int = 5 71const NX_CHIP_MEDIATEK_MODEM: nx_int = 6 72const NX_CHIP_BROADCOM_WIFI: nx_int = 7 73const NX_CHIP_VENDOR_BMC: nx_int = 8 // server out-of-band 74const NX_CHIP_NXP_SE: nx_int = 9 // smartcard SE 75const NX_CHIP_INFINEON_TPM: nx_int = 10 76const NX_CHIP_RISCV_OPEN: nx_int = 11 // SiFive/T-Head/etc open RISC-V 77const NX_CHIP_SOVEREIGN_NISHI: nx_int = 12 78const NX_CHIP_N_FAMILIES: nx_int = 13 79 80// ===== Sealed enum: NxThreatSurface (bitmask flags) ============== 81// 82// Bitmask flags. One chip can have multiple surfaces (ME has RAM_READ 83// + NET_EGRESS + FIRMWARE_PERSIST; PSP has FIRMWARE_PERSIST + DMA; 84// baseband has RADIO_ACTIVATE + DMA). 85 86const NX_TS_NONE: nx_int = 0 87const NX_TS_RAM_READ: nx_int = 1 // can read user RAM out-of-band 88const NX_TS_DMA: nx_int = 2 // direct memory access bypass 89const NX_TS_NET_EGRESS: nx_int = 4 // can phone home 90const NX_TS_RADIO_ACTIVATE: nx_int = 8 // can turn on transponder 91const NX_TS_FIRMWARE_PERSIST: nx_int = 16 // survives OS reinstall 92const NX_TS_MICROCODE_PATCH: nx_int = 32 // can flash CPU microcode 93const NX_TS_BOOT_INTERPOSE: nx_int = 64 // pre-OS boot hook 94const NX_TS_KEY_ESCROW: nx_int = 128 // vendor holds master keys 95 96// ===== Sealed enum: NxMitigationFlag ============================= 97// 98// The 8 proven-shipping mitigations from the reclamation doctrine. 99// Each chip family lists WHICH mitigations are AVAILABLE; the 100// runtime tracks which have been APPLIED. 101 102const NX_MIT_NONE: nx_int = 0 103const NX_MIT_ME_CLEANER_HAP: nx_int = 1 // me_cleaner + HAP bit 104const NX_MIT_COREBOOT: nx_int = 2 // libreboot/coreboot 105const NX_MIT_EGRESS_FILTER: nx_int = 4 // host firewall vendor endpoints 106const NX_MIT_KILL_SWITCH: nx_int = 8 // physical disconnect 107const NX_MIT_SILICON_TRUST_ENF: nx_int = 16 // per-cell trust enforced 108const NX_MIT_CRYPTO_COMPART: nx_int = 32 // hardware-security-key 109const NX_MIT_MEMORY_HYGIENE: nx_int = 64 // swap-encrypt + no-hibernate 110const NX_MIT_DMA_DISCIPLINE: nx_int = 128 // IOMMU + thunderbolt off 111 112// ===== Struct: NxSiliconAttestation =============================== 113// 114// One row per chip family in the catalogue. Caller queries by chip 115// family ID to learn what xenocells to instantiate, what mitigations 116// apply, and what trust ceiling results. 117 118struct NxSiliconAttestation { 119 chip_family: nx_int, 120 threat_surface_mask: nx_int, 121 available_mitigations: nx_int, 122 applied_mitigations: nx_int, 123 base_trust_q10: nx_int, // 0-NX_MAGIC_1024 trust before mitigations 124 name: *u8, 125} 126 127// ===== nx_chip_family_is_valid =================================== 128 129func nx_chip_family_is_valid(f: nx_int) -> nx_int { 130 if f < 0 { return 0 } 131 if f >= NX_CHIP_N_FAMILIES { return 0 } 132 return 1 133} 134 135// ===== nx_chip_threat_surface ==================================== 136// 137// Hardcoded catalogue of which surfaces each chip family exposes. 138// V2 will read this from a content-addressed peer-sharable database. 139 140func nx_chip_threat_surface(f: nx_int) -> nx_int { 141 if f == NX_CHIP_INTEL_ME { 142 return NX_TS_RAM_READ + NX_TS_DMA + NX_TS_NET_EGRESS + 143 NX_TS_FIRMWARE_PERSIST + NX_TS_MICROCODE_PATCH + 144 NX_TS_BOOT_INTERPOSE + NX_TS_KEY_ESCROW 145 } 146 if f == NX_CHIP_AMD_PSP { 147 return NX_TS_RAM_READ + NX_TS_DMA + NX_TS_FIRMWARE_PERSIST + 148 NX_TS_MICROCODE_PATCH + NX_TS_BOOT_INTERPOSE 149 } 150 if f == NX_CHIP_APPLE_T2 { 151 return NX_TS_RAM_READ + NX_TS_FIRMWARE_PERSIST + 152 NX_TS_BOOT_INTERPOSE + NX_TS_KEY_ESCROW 153 } 154 if f == NX_CHIP_APPLE_SECURE_ENCLAVE { 155 return NX_TS_KEY_ESCROW 156 } 157 if f == NX_CHIP_QUALCOMM_BASEBAND { 158 return NX_TS_DMA + NX_TS_NET_EGRESS + NX_TS_RADIO_ACTIVATE 159 } 160 if f == NX_CHIP_MEDIATEK_MODEM { 161 return NX_TS_DMA + NX_TS_NET_EGRESS + NX_TS_RADIO_ACTIVATE 162 } 163 if f == NX_CHIP_BROADCOM_WIFI { 164 return NX_TS_DMA + NX_TS_NET_EGRESS + NX_TS_RADIO_ACTIVATE 165 } 166 if f == NX_CHIP_VENDOR_BMC { 167 return NX_TS_RAM_READ + NX_TS_DMA + NX_TS_NET_EGRESS + 168 NX_TS_BOOT_INTERPOSE 169 } 170 if f == NX_CHIP_NXP_SE { 171 return NX_TS_KEY_ESCROW 172 } 173 if f == NX_CHIP_INFINEON_TPM { 174 return NX_TS_KEY_ESCROW 175 } 176 if f == NX_CHIP_RISCV_OPEN { return NX_TS_NONE } 177 if f == NX_CHIP_SOVEREIGN_NISHI { return NX_TS_NONE } 178 return NX_TS_RAM_READ + NX_TS_DMA + NX_TS_NET_EGRESS // UNKNOWN -> assume worst 179} 180 181// ===== nx_chip_available_mitigations ============================= 182 183func nx_chip_available_mitigations(f: nx_int) -> nx_int { 184 if f == NX_CHIP_INTEL_ME { 185 return NX_MIT_ME_CLEANER_HAP + NX_MIT_COREBOOT + 186 NX_MIT_EGRESS_FILTER + NX_MIT_MEMORY_HYGIENE + 187 NX_MIT_DMA_DISCIPLINE + NX_MIT_CRYPTO_COMPART + 188 NX_MIT_SILICON_TRUST_ENF 189 } 190 if f == NX_CHIP_AMD_PSP { 191 return NX_MIT_COREBOOT + NX_MIT_EGRESS_FILTER + 192 NX_MIT_MEMORY_HYGIENE + NX_MIT_DMA_DISCIPLINE + 193 NX_MIT_CRYPTO_COMPART + NX_MIT_SILICON_TRUST_ENF 194 } 195 if f == NX_CHIP_APPLE_T2 { 196 return NX_MIT_EGRESS_FILTER + NX_MIT_MEMORY_HYGIENE 197 } 198 if f == NX_CHIP_QUALCOMM_BASEBAND { 199 return NX_MIT_KILL_SWITCH + NX_MIT_EGRESS_FILTER + 200 NX_MIT_DMA_DISCIPLINE 201 } 202 if f == NX_CHIP_MEDIATEK_MODEM { 203 return NX_MIT_KILL_SWITCH + NX_MIT_EGRESS_FILTER + 204 NX_MIT_DMA_DISCIPLINE 205 } 206 if f == NX_CHIP_BROADCOM_WIFI { 207 return NX_MIT_KILL_SWITCH + NX_MIT_EGRESS_FILTER + 208 NX_MIT_DMA_DISCIPLINE 209 } 210 if f == NX_CHIP_VENDOR_BMC { 211 return NX_MIT_KILL_SWITCH + NX_MIT_EGRESS_FILTER 212 } 213 if f == NX_CHIP_SOVEREIGN_NISHI { return NX_MIT_NONE } // no mitigation needed 214 return NX_MIT_NONE 215} 216 217// ===== nx_chip_base_trust_q10 ==================================== 218// 219// Base trust score BEFORE mitigations applied. SOVEREIGN_NISHI is 220// Q10 1024 (full trust). UNKNOWN is Q10 0 (no trust). Commodity 221// hardware sits between based on documented compromise severity. 222 223func nx_chip_base_trust_q10(f: nx_int) -> nx_int { 224 if f == NX_CHIP_SOVEREIGN_NISHI { return NX_MAGIC_1024 } 225 if f == NX_CHIP_RISCV_OPEN { return 819 } // 80% 226 if f == NX_CHIP_INFINEON_TPM { return 512 } // 50% 227 if f == NX_CHIP_NXP_SE { return 512 } 228 if f == NX_CHIP_APPLE_SECURE_ENCLAVE { return 410 } // 40% 229 if f == NX_CHIP_APPLE_T2 { return 307 } // 30% 230 if f == NX_CHIP_AMD_PSP { return 256 } // 25% 231 if f == NX_CHIP_INTEL_ME { return 205 } // 20% -- worst commodity 232 if f == NX_CHIP_BROADCOM_WIFI { return 256 } 233 if f == NX_CHIP_QUALCOMM_BASEBAND { return 205 } 234 if f == NX_CHIP_MEDIATEK_MODEM { return 205 } 235 if f == NX_CHIP_VENDOR_BMC { return 102 } // 10% 236 return 0 // UNKNOWN 237} 238 239// ===== nx_attestation_new ======================================== 240// 241// Construct an attestation record for one chip with no mitigations 242// applied yet. Caller then calls nx_attestation_apply_mitigation as 243// it ships each mitigation (boots Coreboot, enables egress filter, 244// etc) to track the effective trust. 245 246func nx_attestation_new(chip_family: nx_int, name: *u8) -> *NxSiliconAttestation { 247 let a: *NxSiliconAttestation = (sys_mmap(56)) as *NxSiliconAttestation 248 a.chip_family = chip_family 249 a.threat_surface_mask = nx_chip_threat_surface(chip_family) 250 a.available_mitigations = nx_chip_available_mitigations(chip_family) 251 a.applied_mitigations = NX_MIT_NONE 252 a.base_trust_q10 = nx_chip_base_trust_q10(chip_family) 253 a.name = name 254 return a 255} 256 257// ===== nx_attestation_apply_mitigation =========================== 258 259func nx_attestation_apply_mitigation(a: *NxSiliconAttestation, 260 mit: nx_int) -> nx_int { 261 // Only allow if mitigation is in the available set. 262 if (a.available_mitigations & mit) == 0 { return 1 } 263 a.applied_mitigations = a.applied_mitigations | mit 264 return 0 265} 266 267// ===== _popcount8 ================================================ 268// 269// Count set bits in low 8 bits of x. Used to compute applied- 270// mitigation count for trust-ceiling adjustment. 271 272func _popcount8(x: nx_int) -> nx_int { 273 var c: nx_int = 0 274 var v: nx_int = x & 255 275 var i: nx_int = 0 276 while i < 8 { 277 if (v & 1) != 0 { c = c + 1 } 278 v = v >> 1 279 i = i + 1 280 } 281 return c 282} 283 284// ===== nx_attestation_effective_trust_q10 ========================= 285// 286// Compute the post-mitigation trust ceiling. Formula: 287// base_trust + (1024 - base_trust) * (applied_count / 8) 288// So sovereign-Nishi (base 1024) stays 1024. Intel ME (base 205) 289// with all 7 applicable mitigations gets to ~205 + 819 * 7/8 = 922. 290// No commodity hardware can reach 1024 without sovereign silicon. 291 292func nx_attestation_effective_trust_q10(a: *NxSiliconAttestation) -> nx_int { 293 let applied_count: nx_int = _popcount8(a.applied_mitigations) 294 let headroom: nx_int = NX_MAGIC_1024 - a.base_trust_q10 295 // Cap at 8 (max mitigations). 296 var n: nx_int = applied_count 297 if n > 8 { n = 8 } 298 return a.base_trust_q10 + (headroom * n) / 8 299} 300 301// ===== nx_attestation_safe_for_secrets ============================ 302// 303// Predicate: returns 1 if effective trust >= 768 (75%). Substrate 304// refuses to store master secrets / sign as identity / handle PII 305// on chips below this ceiling. 306 307func nx_attestation_safe_for_secrets(a: *NxSiliconAttestation) -> nx_int { 308 if nx_attestation_effective_trust_q10(a) >= 768 { return 1 } 309 return 0 310} 311 312// ===== nx_attestation_safe_for_gameplay =========================== 313// 314// Predicate: returns 1 if effective trust >= 410 (40%). Gameplay, 315// content rendering, non-PII compute is OK on chips that pass this 316// bar. Captain Moroni's discipline: don't refuse to USE commodity 317// hardware; refuse to put sovereign secrets ON commodity hardware. 318 319func nx_attestation_safe_for_gameplay(a: *NxSiliconAttestation) -> nx_int { 320 if nx_attestation_effective_trust_q10(a) >= 410 { return 1 } 321 return 0 322}