nx_fw_capsule_gate.nx source

1// nx_fw_capsule_gate.nx -- proves the signed capsule = Secure-Boot-grade integrity. 2// 3// T1 authentic-verifies : a capsule signed by the platform key -> cap_verify == 1 4// N1 corrupted-rejected : flip a payload byte (signature no longer matches)-> cap_verify == 0 5// N2 FORGED-rejected : signed with a DIFFERENT key (forgery) -> cap_verify == 0 6// N3 garbage-rejected : a too-short / non-capsule blob -> cap_verify == 0 7// 8// N2 is the capability sha256 LACKS: a forger can recompute a hash, but cannot forge a signature 9// without the platform private key. GREEN only if all four hold. Evidence -> knowledge/status/fw_capsule_gate.log. 10// Sovereign: imports nx_fw_capsule (-> nx_ed25519) + nx_framed_append + nx_syscalls. license_tier: ORIGINAL 11import "nx_fw_capsule.nx" 12import "nx_framed_append.nx" 13import "nx_syscalls.nx" 14 15const CGC_LOG: *u8 = "knowledge/status/fw_capsule_gate.log" 16const CGC_PAY: *u8 = "NISHI-fw-capsule-gate-payload-image" 17 18func cgc_len(s: *u8) -> i64 { var i: i64 = 0; while s[i] != 0 as u8 { i = i + 1 } return i } 19func cgc_row(name: *u8, pass: i64) -> i64 { 20 let buf: *u8 = sys_mmap(528) 21 var o: i64 = 0 22 o = cp_cat(buf, o, "CAPG row=\x00" as *u8) 23 o = cp_cat(buf, o, name) 24 if pass == 1 { o = cp_cat(buf, o, " verdict=PASS\x00" as *u8) } else { o = cp_cat(buf, o, " verdict=FAIL\x00" as *u8) } 25 buf[o] = 0 as u8 26 fa_appendz(CGC_LOG, buf, 512) 27 cp_puts(" "); cp_puts(name) 28 if pass == 1 { cp_puts(" PASS\n") } else { cp_puts(" FAIL\n") } 29 return 0 30} 31 32func main() -> i64 { 33 cp_puts("fw-capsule gate (Secure-Boot-grade: authentic / corrupted / FORGED / garbage)\n") 34 let e: i64 = sys_now_realtime_sec() 35 let p: i64 = __syscall(39, 0, 0, 0, 0, 0, 0) 36 let pl: i64 = cgc_len(CGC_PAY) 37 let plat: *u8 = sys_mmap(32); cap_plat_seed(plat) 38 let forged: *u8 = sys_mmap(32); var i: i64 = 0; while i < 32 { forged[i] = ((i * 3 + 99) & 0xff) as u8; i = i + 1 } 39 let cap: *u8 = sys_mmap(256) 40 41 // T1 authentic 42 cap_path(cap, "/tmp/capg_t1." as *u8, e, p) 43 cap_make(cap, CGC_PAY, pl, plat) 44 var t1: i64 = 0; if cap_verify(cap) == 1 { t1 = 1 } 45 46 // N1 corrupted 47 cap_path(cap, "/tmp/capg_n1." as *u8, e, p) 48 cap_make(cap, CGC_PAY, pl, plat) 49 cap_corrupt(cap) 50 var n1: i64 = 0; if cap_verify(cap) == 0 { n1 = 1 } 51 52 // N2 forged (different key) 53 cap_path(cap, "/tmp/capg_n2." as *u8, e, p) 54 cap_make(cap, CGC_PAY, pl, forged) 55 var n2: i64 = 0; if cap_verify(cap) == 0 { n2 = 1 } 56 57 // N3 garbage / too short 58 cap_path(cap, "/tmp/capg_n3." as *u8, e, p) 59 let g: *u8 = sys_mmap(32); var j: i64 = 0; while j < 16 { g[j] = 0xff as u8; j = j + 1 } 60 cp_write(cap, g, 16) 61 var n3: i64 = 0; if cap_verify(cap) == 0 { n3 = 1 } 62 63 var passes: i64 = 0 64 if t1 == 1 { passes = passes + 1 } 65 if n1 == 1 { passes = passes + 1 } 66 if n2 == 1 { passes = passes + 1 } 67 if n3 == 1 { passes = passes + 1 } 68 var green: i64 = 0 69 if passes == 4 { green = 1 } 70 71 cgc_row("T1-authentic-verifies \x00" as *u8, t1) 72 cgc_row("N1-corrupted-rejected \x00" as *u8, n1) 73 cgc_row("N2-FORGED-rejected \x00" as *u8, n2) 74 cgc_row("N3-garbage-rejected \x00" as *u8, n3) 75 76 let vb: *u8 = sys_mmap(528) 77 var o: i64 = 0 78 o = cp_cat(vb, o, "FW-CAPSULE verdict=\x00" as *u8) 79 if green == 1 { o = cp_cat(vb, o, "GREEN\x00" as *u8) } else { o = cp_cat(vb, o, "RED\x00" as *u8) } 80 o = cp_cat(vb, o, " passes=\x00" as *u8); o = cp_catn(vb, o, passes); o = cp_cat(vb, o, "/4 END\x00" as *u8) 81 vb[o] = 0 as u8 82 fa_appendz(CGC_LOG, vb, 512) 83 cp_puts(vb); cp_puts("\n") 84 85 if green == 1 { return 0 } 86 return 1 87}