From 1dbb65cc97517b77de040cf82f238dfa7ab34d3b Mon Sep 17 00:00:00 2001 From: bunnie Date: Fri, 5 Dec 2025 00:59:59 +0800 Subject: [PATCH] zerorize backup registers & fix aoram range in zeroize backup registers are a high priority target on zeroizing because it would contain the ephemeral unlock secret, e.g. PIN code. --- libs/bao1x-hal/src/sigcheck.rs | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/libs/bao1x-hal/src/sigcheck.rs b/libs/bao1x-hal/src/sigcheck.rs index fd4f9412f..814ea20f5 100644 --- a/libs/bao1x-hal/src/sigcheck.rs +++ b/libs/bao1x-hal/src/sigcheck.rs @@ -397,6 +397,22 @@ pub fn die_no_std() -> ! { core::arch::asm! ( // TODO: any SCE other security-sensitive registers to be zeorized? + // - bureg zeroize - this is priority because it has the ephemeral key + "li x1, 0x40065000", + "li x2, 0x40065020", + "30:", + "sw x0, 0(x1)", + "addi x1, x1, 4", + "bne x1, x2, 30b", + + // - AORAM_MEM zeroize - also priority because it can have ephemeral secrets + "li x1, 0x50300000", + "li x2, 0x50304000", + "16:", + "sw x0, 0(x1)", + "addi x1, x1, 4", + "bne x1, x2, 16b", + // key regions "li x1, 0x40020000", "li x2, 0x40022700", @@ -434,14 +450,6 @@ pub fn die_no_std() -> ! { "addi x1, x1, 4", "bne x1, x2, 13b", - // - AO_MEM zeroize - "li x1, 0x40060000", - "li x2, 0x40070000", - "16:", - "sw x0, 0(x1)", - "addi x1, x1, 4", - "bne x1, x2, 16b", - // zeroize main RAM "li x1, 0x61000000", "li x2, 0x61200000",