nx_cmos_signed.nx source

1// nx_cmos_signed.nx -- AUTHENTICATED CMOS config recovery (rung 7 CMOS x rung 8 capsule). 2// 3// module: nishi-core.genealogy.cmos_signed 4// capability: CORE_COMPUTE (recover CMOS only from a platform-SIGNED golden snapshot) 5// 6// nx_cmos kept a golden snapshot for restore -- but a checksum-valid golden could still be a TAMPERED 7// or FORGED config. Here the golden snapshot is a platform-SIGNED capsule (the 128-byte CMOS image is 8// the ed25519-signed payload). cmos_restore_signed restores ONLY IF: the golden's signature verifies 9// against the trusted platform key AND the payload is a CMOS image AND its AT checksum is valid. 10// So config recovery is AUTHENTIC -- a forged/tampered golden cannot brick you with a bad config. 11// Sandboxed/in-memory. Sovereign: nx_cmos + nx_fw_capsule (-> nx_ed25519) + nx_syscalls. license_tier: ORIGINAL 12import "nx_cmos.nx" 13import "nx_fw_capsule.nx" 14import "nx_syscalls.nx" 15 16const CS_REFUSED: i64 = 0 - 1 17 18// wrap a 128-byte CMOS image as a platform-SIGNED golden capsule. 19func cmos_golden_capsule(path: *u8, img: *u8, seed: *u8) -> i64 { 20 cap_make(path, img, CMOS_SIZE, seed) 21 return 0 22} 23 24// restore `working` from a golden capsule ONLY IF: signature verifies (authentic) AND payload is a 25// CMOS_SIZE image AND its AT checksum is valid. Else REFUSE -- never recover from an untrusted golden. 26func cmos_restore_signed(working: *u8, golden_cap: *u8) -> i64 { 27 if cap_verify(golden_cap) == 0 { return CS_REFUSED } // not platform-signed -> refuse 28 let lb: *i64 = sys_mmap(16) as *i64; lb[0] = 0 29 let buf: *u8 = cp_read(golden_cap, lb) 30 if (buf as i64) == 0 { return CS_REFUSED } 31 let plen: i64 = cp_rd_u32(buf, 4) 32 if plen != CMOS_SIZE { return CS_REFUSED } 33 let pay: *u8 = ((buf as i64) + 8) as *u8 34 if cmos_valid(pay) == 0 { return CS_REFUSED } // signed but not a valid CMOS -> refuse 35 var i: i64 = 0 36 while i < CMOS_SIZE { working[i] = pay[i]; i = i + 1 } 37 return 0 38} 39 40func main() -> i64 { 41 c_puts("=== NISHI SIGNED CMOS GOLDEN (authenticated config recovery) ===\n") 42 let epoch: i64 = sys_now_realtime_sec() 43 let pid: i64 = __syscall(39, 0, 0, 0, 0, 0, 0) 44 let plat: *u8 = sys_mmap(32); cap_plat_seed(plat) 45 let forged: *u8 = sys_mmap(32); var i: i64 = 0; while i < 32 { forged[i] = ((i * 3 + 99) & 0xff) as u8; i = i + 1 } 46 let img: *u8 = sys_mmap(CMOS_SIZE + 16); cmos_golden(img) 47 let work: *u8 = sys_mmap(CMOS_SIZE + 16); cmos_golden(work) 48 let gcap: *u8 = sys_mmap(256); cap_path(gcap, "/tmp/cmoss_g." as *u8, epoch, pid) 49 cmos_golden_capsule(gcap, img, plat) 50 c_puts(" signed golden capsule verify="); c_putn(cap_verify(gcap)); c_puts("\n") 51 cmos_corrupt_raw(work, 20) 52 c_puts(" working CMOS corrupted -> valid="); c_putn(cmos_valid(work)); c_puts("\n") 53 let r1: i64 = cmos_restore_signed(work, gcap) 54 c_puts(" restore from SIGNED golden -> rc="); c_putn(r1); c_puts(" working valid="); c_putn(cmos_valid(work)); c_puts("\n") 55 cap_corrupt(gcap) 56 let r2: i64 = cmos_restore_signed(work, gcap) 57 c_puts(" restore from TAMPERED golden -> rc="); c_putn(r2); c_puts(" (-1=REFUSED: authenticity protects recovery)\n") 58 let fcap: *u8 = sys_mmap(256); cap_path(fcap, "/tmp/cmoss_f." as *u8, epoch, pid) 59 cmos_golden_capsule(fcap, img, forged) 60 let r3: i64 = cmos_restore_signed(work, fcap) 61 c_puts(" restore from FORGED golden -> rc="); c_putn(r3); c_puts(" (-1=REFUSED)\n") 62 c_puts(" INVARIANT: CMOS recovery restores ONLY a platform-signed + checksum-valid config -> authenticated never-brick\n") 63 sys_exit(0); return 0 64}