nx_fw_capstone_gate.nx source

1// nx_fw_capstone_gate.nx -- the WHOLE-STACK never-brick capstone, on a REAL artifact, EXECUTED. 2// 3// Ties the entire arc together: the real _offc/nx_boot_uefi.efi is wrapped as SIGNED UEFI capsules 4// (real EFI_CAPSULE_HEADER + ed25519, rung 11) into A/B banks + an immutable factory; selection is 5// SIGNATURE-gated (uc_verify); a forged image planted in the active bank is rejected and the system 6// falls back to a signed survivor, which is UNWRAPPED and ACTUALLY BOOTED in nx_emu_uefi (-> NISHI). 7// 8// C1 forged-active-survivor-boots : forged active -> signed survivor selected -> emu rc==0 (boots NISHI) 9// C2 double-fault-signed-factory : forged A + garbage B -> the signed immutable factory is selected 10// C3 all-forged-not-selectable : banks + factory all forged/garbage -> select null (never boot a forgery) 11// 12// GREEN only if all three hold. ONE emu fork (bounded reads keep fork cheap). The emu must be 13// pre-built: ./_offc/nx_sov_build_run.elf nx_emu_uefi. Evidence -> knowledge/status/fw_capstone_gate.log. 14// Sovereign: nx_fw_uefi_capsule (-> nx_fw_capsule -> nx_ed25519) + nx_framed_append + nx_syscalls. license_tier: ORIGINAL 15import "nx_fw_uefi_capsule.nx" 16import "nx_framed_append.nx" 17import "nx_syscalls.nx" 18 19const CAP_LOG: *u8 = "knowledge/status/fw_capstone_gate.log" 20const REAL_EFI: *u8 = "_offc/nx_boot_uefi.efi" 21const EMU_ELF: *u8 = "/tmp/nx_emu_uefi.sov.elf" 22const CAP_A: i64 = 65 23const CAP_B: i64 = 66 24 25func cap_copy(src: *u8, dst: *u8) -> i64 { 26 let lb: *i64 = sys_mmap(16) as *i64; lb[0] = 0 27 let b: *u8 = cp_read(src, lb) 28 if (b as i64) == 0 { return 0 - 1 } 29 cp_write(dst, b, lb[0]) 30 return 0 31} 32func cap_garbage(path: *u8) -> i64 { 33 let g: *u8 = sys_mmap(64); var i: i64 = 0; while i < 32 { g[i] = 0xff as u8; i = i + 1 } 34 cp_write(path, g, 32) 35 return 0 36} 37func cap_write_sel(sel: *u8, c: i64) -> i64 { let b: *u8 = sys_mmap(2); b[0] = c as u8; b[1] = 0 as u8; cp_write(sel, b, 1); return 0 } 38func cap_read_sel(sel: *u8) -> i64 { 39 let lb: *i64 = sys_mmap(16) as *i64; lb[0] = 0 40 let b: *u8 = cp_read(sel, lb) 41 if (b as i64) == 0 { return 0 } 42 if lb[0] < 1 { return 0 } 43 let c: i64 = b[0] as i64 44 if c == CAP_A { return CAP_A } 45 if c == CAP_B { return CAP_B } 46 return 0 47} 48// signature-gated select: preferred bank -> other -> signed factory; null if none verifies. 49func cap_select(sel: *u8, ba: *u8, bb: *u8, fac: *u8) -> *u8 { 50 let pref: i64 = cap_read_sel(sel) 51 if pref == CAP_B { if uc_verify(bb) == 1 { return bb } } else { if uc_verify(ba) == 1 { return ba } } 52 if pref == CAP_B { if uc_verify(ba) == 1 { return ba } } else { if uc_verify(bb) == 1 { return bb } } 53 if uc_verify(fac) == 1 { return fac } 54 return 0 as *u8 55} 56// extract the payload (the raw .efi) from a verified UEFI capsule into rawout. 57func cap_unwrap(capf: *u8, rawout: *u8) -> i64 { 58 let lb: *i64 = sys_mmap(16) as *i64; lb[0] = 0 59 let buf: *u8 = cp_read(capf, lb) 60 if (buf as i64) == 0 { return 0 - 1 } 61 let total: i64 = lb[0] 62 let plen: i64 = cp_rd_u32(buf, 24) - UC_HDR - UC_SIG 63 if plen < 0 { return 0 - 1 } 64 if (UC_HDR + plen) > total { return 0 - 1 } 65 cp_write(rawout, ((buf as i64) + UC_HDR) as *u8, plen) 66 return 0 67} 68// fork+exec the emu on the raw .efi, blocking wait; rc==0 => booted + printed NISHI. 69func cap_emu_boot(efi: *u8) -> i64 { 70 let pid: i64 = sys_fork() 71 if pid < 0 { return 125 } 72 if pid == 0 { 73 let argv: *i64 = sys_mmap(32) as *i64 74 argv[0] = EMU_ELF as i64; argv[1] = efi as i64; argv[2] = 0 75 let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0 76 let dn: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4) 77 if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) } 78 sys_execve(EMU_ELF, argv, envp) 79 sys_exit(127) 80 } 81 let st: *i64 = sys_mmap(16) as *i64 82 let w: i64 = sys_wait4(pid, st, 0) 83 if w < 0 { return 125 } 84 let sig: i64 = st[0] & 0x7f 85 if sig != 0 { return 128 + sig } 86 return (st[0] >> 8) & 0xff 87} 88func cap_row(name: *u8, pass: i64) -> i64 { 89 let buf: *u8 = sys_mmap(528) 90 var o: i64 = 0 91 o = cp_cat(buf, o, "CAPSTONE row=\x00" as *u8) 92 o = cp_cat(buf, o, name) 93 if pass == 1 { o = cp_cat(buf, o, " verdict=PASS\x00" as *u8) } else { o = cp_cat(buf, o, " verdict=FAIL\x00" as *u8) } 94 buf[o] = 0 as u8 95 fa_appendz(CAP_LOG, buf, 512) 96 cp_puts(" "); cp_puts(name) 97 if pass == 1 { cp_puts(" PASS\n") } else { cp_puts(" FAIL\n") } 98 return 0 99} 100 101func main() -> i64 { 102 cp_puts("fw-capstone gate (signed A/B survivor BOOTS in nx_emu_uefi on the REAL .efi)\n") 103 let e: i64 = sys_now_realtime_sec() 104 let p: i64 = __syscall(39, 0, 0, 0, 0, 0, 0) 105 let plat: *u8 = sys_mmap(32); cap_plat_seed(plat) 106 let forged: *u8 = sys_mmap(32); var i: i64 = 0; while i < 32 { forged[i] = ((i * 3 + 99) & 0xff) as u8; i = i + 1 } 107 108 // load the REAL boot stub 109 let lb: *i64 = sys_mmap(16) as *i64; lb[0] = 0 110 let efi: *u8 = cp_read(REAL_EFI, lb) 111 let efi_len: i64 = lb[0] 112 var loaded: i64 = 0 113 if (efi as i64) != 0 { if efi_len > 100 { loaded = 1 } } 114 cp_puts(" real .efi bytes="); cp_putn(efi_len); cp_puts("\n") 115 116 // sign ONCE: a signed UEFI capsule + a forged one; copy into slots per scenario 117 let srcS: *u8 = sys_mmap(256); cap_path(srcS, "/tmp/cap_s." as *u8, e, p) 118 let srcF: *u8 = sys_mmap(256); cap_path(srcF, "/tmp/cap_f." as *u8, e, p) 119 let srcG: *u8 = sys_mmap(256); cap_path(srcG, "/tmp/cap_g." as *u8, e, p) 120 var c1: i64 = 0; var c2: i64 = 0; var c3: i64 = 0; var rc: i64 = 0 - 1 121 if loaded == 1 { 122 uc_make(srcS, efi, efi_len, plat) 123 uc_make(srcF, efi, efi_len, forged) 124 cap_garbage(srcG) 125 126 let a: *u8 = sys_mmap(256); let b: *u8 = sys_mmap(256); let fac: *u8 = sys_mmap(256); let sel: *u8 = sys_mmap(256); let raw: *u8 = sys_mmap(256) 127 128 // C1: forged active -> signed survivor -> BOOT in emu 129 cap_path(a, "/tmp/cap_c1a." as *u8, e, p); cap_path(b, "/tmp/cap_c1b." as *u8, e, p); cap_path(fac, "/tmp/cap_c1f." as *u8, e, p); cap_path(sel, "/tmp/cap_c1s." as *u8, e, p); cap_path(raw, "/tmp/cap_c1raw." as *u8, e, p) 130 cap_copy(srcF, a); cap_copy(srcS, b); cap_copy(srcS, fac); cap_write_sel(sel, CAP_A) 131 let surv: *u8 = cap_select(sel, a, b, fac) 132 if (surv as i64) != 0 { if uc_verify(surv) == 1 { cap_unwrap(surv, raw); rc = cap_emu_boot(raw); if rc == 0 { c1 = 1 } } } 133 cp_puts(" C1: forged active -> survivor signed="); cp_putn(uc_verify(surv)); cp_puts(" emu rc="); cp_putn(rc); cp_puts(" (0=boots NISHI)\n") 134 135 // C2: double fault (forged A + garbage B) -> signed factory selected 136 cap_path(a, "/tmp/cap_c2a." as *u8, e, p); cap_path(b, "/tmp/cap_c2b." as *u8, e, p); cap_path(fac, "/tmp/cap_c2f." as *u8, e, p); cap_path(sel, "/tmp/cap_c2s." as *u8, e, p) 137 cap_copy(srcF, a); cap_garbage(b); cap_copy(srcS, fac); cap_write_sel(sel, CAP_A) 138 let surv2: *u8 = cap_select(sel, a, b, fac) 139 if (surv2 as i64) != 0 { if uc_verify(surv2) == 1 { c2 = 1 } } 140 141 // C3 teeth: all forged/garbage incl factory -> select null (never boot a forgery) 142 cap_path(a, "/tmp/cap_c3a." as *u8, e, p); cap_path(b, "/tmp/cap_c3b." as *u8, e, p); cap_path(fac, "/tmp/cap_c3f." as *u8, e, p); cap_path(sel, "/tmp/cap_c3s." as *u8, e, p) 143 cap_copy(srcF, a); cap_garbage(b); cap_copy(srcF, fac); cap_write_sel(sel, CAP_A) 144 let surv3: *u8 = cap_select(sel, a, b, fac) 145 if (surv3 as i64) == 0 { c3 = 1 } 146 } 147 148 var passes: i64 = 0 149 if c1 == 1 { passes = passes + 1 } 150 if c2 == 1 { passes = passes + 1 } 151 if c3 == 1 { passes = passes + 1 } 152 var green: i64 = 0 153 if passes == 3 { green = 1 } 154 155 cap_row("C1-forged-active-survivor-boots\x00" as *u8, c1) 156 cap_row("C2-double-fault-signed-factory \x00" as *u8, c2) 157 cap_row("C3-all-forged-not-selectable \x00" as *u8, c3) 158 159 let vb: *u8 = sys_mmap(528) 160 var o: i64 = 0 161 o = cp_cat(vb, o, "FW-CAPSTONE verdict=\x00" as *u8) 162 if green == 1 { o = cp_cat(vb, o, "GREEN\x00" as *u8) } else { o = cp_cat(vb, o, "RED\x00" as *u8) } 163 o = cp_cat(vb, o, " passes=\x00" as *u8); o = cp_catn(vb, o, passes); o = cp_cat(vb, o, "/3 END\x00" as *u8) 164 vb[o] = 0 as u8 165 fa_appendz(CAP_LOG, vb, 512) 166 cp_puts(vb); cp_puts("\n") 167 168 if green == 1 { return 0 } 169 return 1 170}