code wiki / _hdl_build / nx_fw_signed_robust.nx

nx_fw_signed_robust.nx

buildroot/runtime/_hdl_build/nx_fw_signed_robust.nx

6072 B115 linesdepth 10pulls 14 transitivereach 1 importersview sourcekind tooltopic fw
docsdependenciesstructsconstsfunctions

about

nx_fw_signed_robust.nx -- the fusion: S-class never-brick (A/B + immutable factory + atomic commit) WHERE BOOTABILITY = ed25519 SIGNATURE, not just a checksum. module: nishi-core.genealogy.fw_signed_robust capability: CORE_COMPUTE (forgery-resistant AND fault-resistant firmware selection) Rung 6 (nx_fw_robust_flash) survives power loss + double faults but would boot any image with a valid checksum. Rung 8 (nx_fw_capsule) rejects forgery but had no fallback. FUSED here: the banks + factory hold SIGNED capsules, and sr_select boots a bank ONLY if cap_verify passes (signature valid against the trusted platform key). So a FORGED image planted in the active bank is rejected at select time and the system falls back to the other bank or the signed immutable factory. Sandboxed (/tmp). Sovereign: nx_fw_capsule (-> nx_ed25519) + nx_syscalls. license_tier: ORIGINAL

dependencies 2 imports · 1 importers

nx_fw_capsule.nx nx_syscalls.nx nx_fw_signed_robust.nx nx_fw_signed_robust_gate.nx

imports: nx_fw_capsule.nxnx_syscalls.nx

imported by: nx_fw_signed_robust_gate.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main cp_puts sys_write sys_now_realtime_sec sys_mmap sys_clock_gettime_real sys_mmap ↻ cap_plat_seed cap_path cp_cat cp_catn sys_mmap ↻ cap_make sys_mmap ↻ cp_wr_u32 ed25519_sign_full sys_mmap ↻ ed25519_sha512 sys_mmap ↻ sha512_init sha512_update sha512_blk_set_byte blk_get_i64 blk_set_i64 sha512_compress sys_mmap ↻ blk_get_i64 ↻ sha512_gamma0 sha512_gamma1 sha512_sigma1 sha512_ch sha512_k sha512_sigma0 sha512_maj sha512_final sha512_blk_set_byte ↻ sha512_compress ↻ ge_p3_alloc sys_mmap ↻ fe_alloc

structs

none

consts

16const SR_BANK_A: i64 = 65
17const SR_BANK_B: i64 = 66
18const SR_OK: i64 = 0
19const SR_REJECTED: i64 = 1 // unsigned/forged/corrupt source -> not written
20const SR_NO_ANCHOR: i64 = 3 // no signature-valid fallback (active bank nor factory) -> refuse
21const SR_VIOLATION: i64 = 4 // a path not under /tmp/
22const SR_HELD: i64 = 6 // inactive write failed verify -> not committed, active retained

functions

24func sr_is_sandbox(p: *u8) -> i64
called by 2: sr_write_sel_atomicsr_safe_flash
30func sr_tmp(sel: *u8, out: *u8) -> i64 { var o: i64 = cp_cat(out, 0, sel); o = cp_cat(out, o, ".tmp\x00" as *u8); out[o] = 0 as u8; return o }
called by 1: sr_write_sel_atomic calls 1: cp_cat
31func sr_read_sel(sel: *u8) -> i64
called by 4: sr_selectsr_safe_flashmainmain calls 2: sys_mmapcp_read
41func sr_write_sel_atomic(sel: *u8, bankc: i64) -> i64
called by 3: sr_safe_flashmainmain calls 5: sr_is_sandboxsys_mmapsr_tmpcp_writesys_renameat
49func sr_other(bankc: i64) -> i64 { if bankc == SR_BANK_B { return SR_BANK_A } return SR_BANK_B }
called by 1: sr_safe_flash
50func sr_copy(src: *u8, dst: *u8) -> i64
called by 2: sr_safe_flashmain calls 3: sys_mmapcp_readcp_write
60func sr_select(sel: *u8, ba: *u8, bb: *u8, fac: *u8) -> *u8
called by 1: sr_selectable calls 2: sr_read_selcap_verify
67func sr_selectable(sel: *u8, ba: *u8, bb: *u8, fac: *u8) -> i64
called by 2: mainmain calls 1: sr_select
74func sr_safe_flash(sel: *u8, ba: *u8, bb: *u8, fac: *u8, newcap: *u8, corrupt: i64) -> i64
called by 1: main calls 7: sr_is_sandboxcap_verifysr_read_selsr_othersr_copycap_corrupt+1
95func main() -> i64
calls 12: cp_putssys_now_realtime_secsys_mmapcap_plat_seedcap_pathcap_make+6