add keystore to dabao configuration

After some contemplation, we should include the keystore in the
core service set featured by the dabao-xous configuration.

The pros are: any compatibility/sharing of resources
that require access to RRAM, one-way counters, UUIDs, etc.
will either require a wholly separate implementation that is
"insecure" or it could just reuse the baosec work. Furthermore,
as cryptographic accelerators are laid into the keystore,
the APIs become available to the dabao environment

The cons are: more space is used in a space-constrained
dabao environment (roughly 140k "deadweight" at the start, but
as cryptographic APIs get layered in this can grow substantially);
the key slots are "used up" in part by the scheme, which leaves
less key slots available for user-defined purposes.

This is mitigated by the fact that there are a couple thousand
key slots, and so even though we use a couple hundred of them
it's still not the whole range.

Also, the baosec/dabao feature flag can be used to feature-out
cryptographic APIs/accelerators that are too obscure or not
useful for the dabao environment, to "lighten up" the
firmware load.

Cargo.lock

@@ -3311,7 +3311,6 @@ dependencies = [
  "sha2",
  "subtle",
  "utralib 0.1.26",
- "ux-api",
  "xous 0.9.67 (registry+https://github.com/rust-lang/crates.io-index)",
  "xous-api-log",
  "xous-api-names",

libs/bao1x-api/src/offsets/dabao.rs

@@ -42,4 +42,7 @@ pub const DATA_SLOTS: [SlotIndex; 8] = [
     crate::offsets::BETA_PUBKEY,
     crate::offsets::DEV_PUBKEY,
 ];
-pub const KEY_SLOTS: [SlotIndex; 0] = [];
+
+pub use crate::baosec::{CHAFF_KEYS, NUISANCE_KEYS, NUISANCE_KEYS_0, NUISANCE_KEYS_1, RMA_KEY, ROOT_SEED};
+
+pub const KEY_SLOTS: [SlotIndex; 5] = [ROOT_SEED, RMA_KEY, NUISANCE_KEYS_0, NUISANCE_KEYS_1, CHAFF_KEYS];

services/keystore/Cargo.toml

@@ -19,7 +19,6 @@ bao1x-hal = { path = "../../libs/bao1x-hal", features = [
     "std",
 ], optional = true }
 bao1x-hal-service = { path = "../bao1x-hal-service", optional = true }
-ux-api = { path = "../../libs/ux-api" }
 bao1x-emu = { path = "../bao1x-emu", optional = true }
 bao1x-api = { path = "../../libs/bao1x-api" }
 xous-ipc = "0.10.7"
@@ -42,7 +41,7 @@ blowfish = { version = "0.9.1", features = ["bcrypt"] }
 # password modals - keep them in this crate to minimize plaintext password manipulations
 locales = { path = "../../locales" }
 # non-password modals are outsourced to a common crate
-modals = { path = "../modals" }
+modals = { path = "../modals", optional = true }
 
 # backups
 aes-gcm-siv = { version = "0.11.1", default-features = false, features = [
@@ -60,7 +59,7 @@ aes = { path = "../aes", default-features = false, optional = true }
 # engine-25519 = { path = "../engine-25519" }
 byteorder = "1.4.3" # used by keywrap
 # hardware acceleration adaptations are inserted into a fork of the main branch.
-hex = { version = "0.4.3", default-features = false, features = [] }
+hex = { version = "0.4.3", default-features = false, features = ["alloc"] }
 hkdf = "0.12.4"
 
 #[dependencies.curve25519-dalek]
@@ -78,15 +77,12 @@ hkdf = "0.12.4"
 bao1x = ["utralib/bao1x", "aes/bao1x"]
 board-baosec = [
     "utralib/bao1x",
-    "ux-api/board-baosec",
     "keystore-api/gen2",
-    "modals/no-gam",
-    "modals/bao1x",
     "bao1x-hal",
     "bao1x-hal-service/board-baosec",
 ] # USB form factor token
-loader-baosec = ["ux-api/loader-baosec"]
-test-baosec = ["ux-api/loader-baosec"]
+loader-baosec = []
+test-baosec = []
 hosted-baosec = [
     "keystore-api/gen2",
     "modals/no-gam",
@@ -101,12 +97,11 @@ loader-baosor = []
 board-dabao = [
     "utralib/bao1x",
     "keystore-api/gen2",
+    "bao1x-hal",
     "bao1x-hal-service/board-dabao",
 ] # Dev board form factor
 loader-dabao = []
 
-policy-menu = [
-] # provisions for users to set their password retention policies (on the block for deprecation) (note: to re-enable you need to add "rootkeys menu" to the tokens.rs in the GAM)
 hazardous-debug = [
 ] # this feature enables the printing of secret materials for debug purposes
 tts = []

services/keystore/src/platform.rs

@@ -1,6 +1,7 @@
-#[cfg(feature = "board-baosec")]
+// Dabao comes along for the ride for baosec
+#[cfg(any(feature = "board-baosec", feature = "board-dabao"))]
 mod baosec;
-#[cfg(feature = "board-baosec")]
+#[cfg(any(feature = "board-baosec", feature = "board-dabao"))]
 pub use baosec::*;
 
 #[cfg(feature = "hosted-baosec")]

xtask/src/main.rs

@@ -786,7 +786,8 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
 
             // minimal set of services for app development on a dabao. Need to save space for the app itself!
             let bao_rram_pkgs =
-                ["xous-ticktimer", "xous-log", "xous-names", "usb-bao1x", "bao1x-hal-service"].to_vec();
+                ["xous-ticktimer", "keystore", "xous-log", "xous-names", "usb-bao1x", "bao1x-hal-service"]
+                    .to_vec();
             let bao_app_pkgs: Vec<&'static str> = ["dabao-console"].to_vec();
 
             builder.add_loader_feature("debug-print");