code wiki / _hdl_build / nx_fw_capsule.nx

nx_fw_capsule.nx

buildroot/runtime/_hdl_build/nx_fw_capsule.nx

7502 B159 linesdepth 9pulls 13 transitivereach 8 importersview sourcekind tooltopic fw

docs dependencies structs consts functions

about

nx_fw_capsule.nx -- Secure-Boot-grade signed firmware capsule (sovereign ed25519). module: nishi-core.genealogy.fw_capsule capability: CORE_COMPUTE (authenticity + integrity for firmware images and golden snapshots) sha256 (rungs 4-6) detects CORRUPTION but not FORGERY -- an attacker can recompute the hash over a malicious image. A real capsule is SIGNED: only an image signed by the trusted PLATFORM key is bootable. This is the Secure-Boot model, sovereign (our own ed25519, no vendor blob): capsule "NXC1" = magic(4) + payload_len(4) + payload + ed25519_signature(64) over magic||len||payload. cap_verify(path) = 1 ONLY IF the magic/len are intact AND the signature verifies against the baked TRUSTED platform public key. A corrupted OR forged (wrong-key) capsule -> 0 (rejected). In production the verifier holds ONLY the public key (the private seed is offline with the signer); here a fixed test seed lets the gate both sign and anchor -- ed25519 is deterministic (RFC 8032), so signatures + this gate are reproducible. Sovereign: nx_ed25519 + nx_syscalls. license_tier: ORIGINAL

dependencies 3 imports · 4 importers

imports: nx_ed25519_signature.nxnx_itoa_lib.nxnx_syscalls.nx

imported by: nx_cmos_signed.nxnx_fw_capsule_gate.nxnx_fw_signed_robust.nxnx_fw_uefi_capsule.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

18	const CAP_MAGIC_65536: i64 = 65536
19	const CAP_MAGIC_16777216: i64 = 16777216
21	const CAP_HDR: i64 = 8 // magic(4) + payload_len(4)
22	const CAP_SIG: i64 = 64 // ed25519 signature
23	const CAP_MAXIMG: i64 = 16777216

functions

25	func cp_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != 0 as u8 { n = n + 1 } sys_write(1, s, n); return 0 } called by 5: main cgc_row main main main calls 1: sys_write
30	func cp_putn(v: i64) -> i64 { nxi_out(v); return 0 } called by 3: main main main calls 1: nxi_out
31	func cp_read(path: u8, lb: i64) -> *u8 called by 9: cmos_restore_signed cap_verify cap_corrupt sr_read_sel sr_copy uc_verify+3 calls 4: sys_openat_rd sys_mmap sys_read sys_close
44	func cp_write(path: u8, buf: u8, n: i64) -> i64 called by 15: cs_copy cap_copy cap_garbage cap_write_sel cap_unwrap cap_make+9 calls 3: sys_openat_wr sys_write sys_close
49	func cp_wr_u32(buf: *u8, off: i64, v: i64) -> i64 called by 2: cap_make uc_make
54	func cp_rd_u32(buf: *u8, off: i64) -> i64 called by 6: cmos_restore_signed cap_unwrap cap_verify uc_header_ok main main
63	func cap_plat_seed(out: u8) -> i64 { var i: i64 = 0; while i < 32 { out[i] = ((i 7 + 13) & 0xff) as u8; i = i + 1 } return 0 } called by 10: main main main cap_trusted_pub main main+4
64	func cap_trusted_pub(out: *u8) -> i64 called by 3: cap_verify main uc_verify calls 3: sys_mmap cap_plat_seed ed25519_pub_from_priv
71	func cap_make(path: u8, payload: u8, plen: i64, seed32: *u8) -> i64 called by 5: cmos_golden_capsule main main main main calls 4: sys_mmap cp_wr_u32 ed25519_sign_full cp_write
87	func cap_verify(path: *u8) -> i64 called by 9: cmos_restore_signed main main main main sr_select+3 calls 5: sys_mmap cp_read cp_rd_u32 cap_trusted_pub ed25519_verify_full
107	func cp_cat(dst: u8, off: i64, s: u8) -> i64 { var i: i64 = 0; while s[i] != 0 as u8 { dst[off + i] = s[i]; i = i + 1 } return off + i } called by 4: cap_path cgc_row main sr_tmp
108	func cp_catn(dst: *u8, off: i64, v: i64) -> i64 called by 2: cap_path main calls 1: sys_mmap
118	func cap_path(out: u8, stem: u8, epoch: i64, pid: i64) -> i64 called by 5: main main main main main calls 2: cp_cat cp_catn
124	func cap_corrupt(path: *u8) -> i64 called by 5: main main main main sr_safe_flash calls 3: sys_mmap cp_read cp_write
134	func main() -> i64 calls 11: cp_puts sys_now_realtime_sec sys_mmap cap_trusted_pub cp_putn cap_plat_seed+5