code wiki / _hdl_build / nx_fw_safeflash_gate.nx

nx_fw_safeflash_gate.nx

buildroot/runtime/_hdl_build/nx_fw_safeflash_gate.nx

5969 B116 linesdepth 6pulls 8 transitivereach 0 importersview sourcekind gate/prooftopic fw
docsdependenciesstructsconstsfunctions

about

nx_fw_safeflash_gate.nx -- THE REFEREE for the never-brick firmware flash. Proves fw_safe_flash upholds the NEVER-BRICK invariant (active is BOOTABLE after every flash) against deliberate failures, AND that each guard actually fires (no-fabricated-green): T1 good-flash : valid new image, clean write -> FW_OK + active bootable N1 reject-bad : the SOURCE image is corrupt -> FW_REJECTED_PRE + active bootable (untouched) N2 mid-corrupt : write injected with corruption -> FW_RECOVERED + active bootable (from golden) N3 no-anchor : golden (recovery copy) is corrupt -> FW_REFUSED_NO_ANCHOR + active bootable (untouched) N4 host-path : active path is NOT under /tmp/ -> FW_SANDBOX_VIOLATION (cannot touch host) INV never-brick : active is BOOTABLE after T1,N1,N2,N3 (the headline guarantee) GREEN only if all six hold. Evidence -> knowledge/status/fw_safeflash_gate.log. Sovereign: imports the organ + nx_framed_append + nx_syscalls (no gcc). license_tier: ORIGINAL

dependencies 3 imports · 0 importers

nx_fw_safeflash.nx nx_framed_append.nx nx_syscalls.nx nx_fw_safeflash_gate.nx

imports: nx_fw_safeflash.nxnx_framed_append.nxnx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main sys_now_realtime_sec sys_mmap sys_clock_gettime_real et_len sys_mmap ↻ fw_path fw_cat fw_catn sys_mmap ↻ fw_make sys_mmap ↻ fw_wr_u32 sha256_digest sys_mmap ↻ sha256_init sys_mmap ↻ sha256_k sha256_update sha256_compress_ni_blocks blk_set_byte sha256_compress sha256_compress_ni blk_word blk_byte sha256_final blk_set_byte ↻ sha256_compress ↻ fw_write_bytes sys_openat_wr sys_write sys_close fw_safe_flash fw_is_sandbox fw_bootable sys_mmap ↻ fw_read sys_openat_rd sys_mmap ↻ sys_read

structs

none

consts

19const FWSF_LOG: *u8 = "knowledge/status/fw_safeflash_gate.log"
20const FWSF_GOOD: *u8 = "GOLDEN-ANCHOR-firmware-v1-immutable-recovery-copy"
21const FWSF_NEW: *u8 = "NEW-firmware-v2-candidate-image-being-flashed-in"

functions

23func et_len(s: *u8) -> i64 { var i: i64 = 0; while s[i] != 0 as u8 { i = i + 1 } return i }
called by 1: main
25func et_row(name: *u8, pass: i64) -> i64
called by 1: main calls 4: sys_mmapfw_catfa_appendzfw_puts
38func main() -> i64
calls 13: sys_now_realtime_secet_lensys_mmapfw_pathfw_makefw_safe_flash+7