nx_fw_robust_flash.nx source

1// nx_fw_robust_flash.nx -- S-CLASS never-brick: survives suboptimal/adverse conditions. 2// 3// module: nishi-core.genealogy.fw_robust_flash 4// capability: CORE_COMPUTE (never-brick that holds through power loss at ANY step + double faults) 5// 6// THE PROBLEM (operator 2026-06-16: "make our never brick s class even in suboptimal situations"): 7// nx_fw_safeflash's golden recovery assumes the golden anchor is always intact and the recovery 8// itself completes. Real devices brick from the SUBOPTIMAL cases: power loss MID-flash, power loss 9// MID-recovery, a corrupted recovery copy, torn writes, double faults. S-class never-brick must 10// survive ALL of them. The proven field design (dual-BIOS + flashback ROM) is modeled here: 11// 12// * TWO banks A/B + an IMMUTABLE FACTORY anchor (the write-protected last resort). 13// * A flash writes ONLY the INACTIVE bank, verifies it (sha256), then ATOMICALLY flips a tiny 14// selector (write-temp + rename -- power loss leaves it fully-old or fully-new, never torn). 15// The ACTIVE bank is NEVER overwritten, so a crash before the commit leaves the OLD image 16// selected = still bootable. 17// * rf_select (what firmware runs at power-on): preferred bank -> the other bank (self-heal) -> 18// the immutable factory. It returns a BOOTABLE image unless EVEN THE FACTORY is gone. 19// 20// INVARIANT (S-class never-brick): as long as the immutable factory survives (it is write- 21// protected by design), rf_select returns a bootable image after ANY interruption sequence. 22// Sandboxed (/tmp only). Sovereign: reuses nx_fw_safeflash image+sha256 primitives. license_tier: ORIGINAL 23import "nx_fw_safeflash.nx" 24import "nx_syscalls.nx" 25 26const RF_HELD: i64 = 6 // inactive write failed verify -> NOT committed, active retained (no brick) 27const RF_BANK_A: i64 = 65 // 'A' 28const RF_BANK_B: i64 = 66 // 'B' 29 30func rf_tmp(sel: *u8, out: *u8) -> i64 { 31 var o: i64 = fw_cat(out, 0, sel) 32 o = fw_cat(out, o, ".tmp\x00" as *u8) 33 out[o] = 0 as u8 34 return o 35} 36 37// read the selector: 65('A') / 66('B') / 0 (missing or invalid -> caller defaults to A) 38func rf_read_sel(sel: *u8) -> i64 { 39 let lb: *i64 = sys_mmap(16) as *i64; lb[0] = 0 40 let b: *u8 = fw_read(sel, lb) 41 if (b as i64) == 0 { return 0 } 42 if lb[0] < 1 { return 0 } 43 let c: i64 = b[0] as i64 44 if c == RF_BANK_A { return RF_BANK_A } 45 if c == RF_BANK_B { return RF_BANK_B } 46 return 0 47} 48 49// ATOMIC selector commit: write a temp, then rename over the live selector. A power loss leaves the 50// selector either fully-old or fully-new -- never a torn half-write (rename is atomic on one fs). 51func rf_write_sel_atomic(sel: *u8, bankc: i64) -> i64 { 52 if fw_is_sandbox(sel) == 0 { return 0 - 1 } 53 let tmp: *u8 = sys_mmap(512); rf_tmp(sel, tmp) 54 let buf: *u8 = sys_mmap(2); buf[0] = bankc as u8; buf[1] = 0 as u8 55 fw_write_bytes(tmp, buf, 1) 56 sys_renameat(tmp, sel) 57 return 0 58} 59 60func rf_other(bankc: i64) -> i64 { if bankc == RF_BANK_B { return RF_BANK_A } return RF_BANK_B } 61 62// SELECT what firmware boots: preferred bank -> the other bank (self-heal) -> the immutable factory 63// anchor. Returns a BOOTABLE image path, or null ONLY if even the factory is gone (truly bricked). 64func rf_select(sel: *u8, ba: *u8, bb: *u8, fac: *u8) -> *u8 { 65 let pref: i64 = rf_read_sel(sel) 66 if pref == RF_BANK_B { if fw_bootable(bb) == 1 { return bb } } else { if fw_bootable(ba) == 1 { return ba } } 67 if pref == RF_BANK_B { if fw_bootable(ba) == 1 { return ba } } else { if fw_bootable(bb) == 1 { return bb } } 68 if fw_bootable(fac) == 1 { return fac } 69 return 0 as *u8 70} 71func rf_selectable(sel: *u8, ba: *u8, bb: *u8, fac: *u8) -> i64 { 72 if (rf_select(sel, ba, bb, fac) as i64) != 0 { return 1 } 73 return 0 74} 75 76// POWER-FAIL-ATOMIC flash. Writes ONLY the inactive bank, verifies it, then atomically flips the 77// selector. The ACTIVE bank is never overwritten. corrupt=1 injects a bad/interrupted inactive write. 78func rf_safe_flash(sel: *u8, ba: *u8, bb: *u8, fac: *u8, newimg: *u8, corrupt: i64) -> i64 { 79 if fw_is_sandbox(sel) == 0 { return FW_SANDBOX_VIOLATION } 80 if fw_is_sandbox(ba) == 0 { return FW_SANDBOX_VIOLATION } 81 if fw_is_sandbox(bb) == 0 { return FW_SANDBOX_VIOLATION } 82 if fw_is_sandbox(newimg) == 0 { return FW_SANDBOX_VIOLATION } 83 if fw_bootable(newimg) == 0 { return FW_REJECTED_PRE } 84 var act: i64 = rf_read_sel(sel) 85 if act == 0 { act = RF_BANK_A } 86 var actpath: *u8 = ba 87 if act == RF_BANK_B { actpath = bb } 88 // a fallback MUST survive the flash: the current active bank OR the immutable factory 89 if fw_bootable(actpath) == 0 { if fw_bootable(fac) == 0 { return FW_REFUSED_NO_ANCHOR } } 90 let tgtc: i64 = rf_other(act) 91 var tgt: *u8 = ba 92 if tgtc == RF_BANK_B { tgt = bb } 93 fw_copy(newimg, tgt) // write the INACTIVE bank (active untouched) 94 if corrupt == 1 { fw_corrupt_byte(tgt) } // bad/interrupted write to the inactive bank 95 if fw_bootable(tgt) == 0 { return RF_HELD } // inactive bad -> DO NOT commit -> active retained 96 rf_write_sel_atomic(sel, tgtc) // ATOMIC commit: flip to the freshly-verified bank 97 return FW_OK 98} 99 100func main() -> i64 { 101 fw_puts("=== NISHI ROBUST FLASH (S-class never-brick: A/B + immutable factory + atomic commit) ===\n") 102 let epoch: i64 = sys_now_realtime_sec() 103 let pid: i64 = __syscall(39, 0, 0, 0, 0, 0, 0) 104 let fac: *u8 = sys_mmap(256); let a: *u8 = sys_mmap(256); let b: *u8 = sys_mmap(256) 105 let sel: *u8 = sys_mmap(256); let nw: *u8 = sys_mmap(256) 106 fw_path(fac, "/tmp/rf_fac." as *u8, epoch, pid); fw_path(a, "/tmp/rf_a." as *u8, epoch, pid) 107 fw_path(b, "/tmp/rf_b." as *u8, epoch, pid); fw_path(sel, "/tmp/rf_sel." as *u8, epoch, pid) 108 fw_path(nw, "/tmp/rf_new." as *u8, epoch, pid) 109 110 fw_make(fac, "NISHI-FACTORY-immutable-recovery-anchor-rom" as *u8, 43) 111 fw_make(a, "NISHI-fw-v1-current-shipping-image" as *u8, 34) 112 fw_make(b, "NISHI-fw-v1-current-shipping-image" as *u8, 34) 113 rf_write_sel_atomic(sel, RF_BANK_A) 114 fw_make(nw, "NISHI-fw-v2-candidate-being-flashed" as *u8, 35) 115 116 fw_puts(" start: selectable="); fw_putn(rf_selectable(sel, a, b, fac)); fw_puts(" active="); fw_putn(rf_read_sel(sel)); fw_puts(" (65=A 66=B)\n") 117 let r1: i64 = rf_safe_flash(sel, a, b, fac, nw, 0) 118 fw_puts(" clean flash -> status="); fw_putn(r1); fw_puts(" selectable="); fw_putn(rf_selectable(sel, a, b, fac)); fw_puts(" active="); fw_putn(rf_read_sel(sel)); fw_puts("\n") 119 let r2: i64 = rf_safe_flash(sel, a, b, fac, nw, 1) 120 fw_puts(" interrupted flash -> status="); fw_putn(r2); fw_puts(" (6=HELD, not committed) selectable="); fw_putn(rf_selectable(sel, a, b, fac)); fw_puts(" active="); fw_putn(rf_read_sel(sel)); fw_puts("\n") 121 fw_corrupt_byte(a); fw_corrupt_byte(b) 122 fw_puts(" DOUBLE FAULT (both banks dead) -> selectable="); fw_putn(rf_selectable(sel, a, b, fac)); fw_puts(" (immutable factory fallback)\n") 123 fw_puts(" INVARIANT: select() stays bootable through power loss at any step + double fault -> NEVER BRICKED\n") 124 sys_exit(0); return 0 125}