The TL;DR is this now treats dabao exactly the same as
baosec in terms of keystore setup from the security flow perspective.
baosec & dabao were different originally because baosec would
rely upon the Avalanche generator TRNG as supplemental randomness
and dabao would not. This special case had to be handled in the
bootloader and propagated through.
However, in a previous commit, the keystore setup was moved to
the OS *anyways* - thus making this difference moot.
This patch backs out the one-way counters that would track the
dabao initialization state.
It also doesn't fail the boot on the erase key proof check
failing if the keystores aren't initialized yet. This creates
yet another condition that could be glitched over to bypass
the erase check but it is checked twice indepedently.
this is a big, ugly, multi-file commit but it turns out when
you start shaking one part of the clock tree everything rattles
along with it.
Basically this updates the clock tree to use a search for an
optimal setting instead of a hueristic/table lookup, and then
a bunch of small bugs in the clock settings were found that had
to be proopagated to dependent crates.
i2c clock set now seems ... more correct, the frequency is
not overclocking the bus (was at 600khz before, now just below 400khz)
the uart equations finally sees sane
the spi clocks check out
the only inconsistency left is that i can't seem to get a fractional
division on peri clk. it would be really nice to be able to do a
fractional divide and get a little more peformance out of the spi
busses but i think it just doesn't work that way - the "fractional"
division is actually more of a "time-average frequency is correct"
but when you go into fractional mode it's spending some time pulsing
at 2x the rate and some time at 1x the rate to get to the time average
frequency, and when you're at the 2x rate things break.
the routines provided in the reference crossbar libraries are
not great and the recco of their team is to just use hard-coded
table lookups. Replaced this with a computational method that can
find arbitrary clocks; however, the computation *is* somewhat expensive
because you have to iterate through a fairly large solution space
to find an "optimal" solution.
That being said, these solutions can be memoized if they are
frequently re-used. I rather prefer this method than just an undocumented
table lookup.
More testing is needed but the initial results look pretty good.
Also peripheral clock setting is reworked to be more clear as to what
is going on. I think I finally have some clarity on why a mysterious
"divide by 2" was ending up in everything; other dependencies have
been reworked to clean that up. I think actually I may have been
overclocking the peripheral bus by a factor of 2 prior to now :-/
a slice of key material is written to backup RAM from boot0
all the way to the loader, to prove to the loader that secret
keys were erased in a higher privilege state (loader then erases
the key, and this key is considered leakable without harm to
security).
The problem is that writing the key to backup RAM in boot0
was fixing the hash on the backup block, which is before
the check happens to see if it was a cold power-on. This would
defeat the RTC setting & backup setup logic.
THe solution to this is to exclude that one key from the hashing
area and special case it. A set of routines and API names were
added to help enforce this case.
The original RTC was set to a 1Hz tick, which isn't sufficient
for the time API
This has been reworked to give a 1/1024 second increment.
Rollover logic is implemented in the RTC. Requires the system
to be powered on at least once every 48 days to capture the
rollover, otherwise it could miss a rollover event. This is
fine because the backup battery doesn't last that long, and
scans of QR codes for password login always reset the RTC anyways.
The RTC offset randomization code is now gone because we're
not tracking long-term power-on information in the RTC.
add a little bit of timing dither to one of the core delay routines
this hardens the OS against glitch attacks by making the timing of
concurrent tasks less predictable
this makes i2c accessible without having to rely explicitly
on the server itself, making the library callable in more contexts.
necessitated avoiding a name space collision and moving the
I2C hardware drivers to a stucture named I2cDriver; the I2C
object now unambiguously refers to the userspace interface
to I2C.
