1. nonce should be generated from the LSB of the commit hash.
security doesn't come from the nonce, and having the commit hash
in the nonce is helpful for version control of the swap image
(although it doesn't capture "dirty" builds, e.g. builds
made with uncommitted changes).
2. fix IniS regions to not require special alignment. Since the
data is copied (similar to IniE), we don't have to waste space
page-aligning things so that offsets map perfectly between
the image on disk and in RAM.
3. add checks that the loading position of data inside the
swap image matches our expectations. We should have 0x1000
bytes of unencrypted header, then 0x1000 bytes of XArgs + padding,
and then image data should start.
There is a "just so" coincidence in that the image data by
the MiniElf program always lines up at an address > 0x1000, making
space for the XArgs. I actually don't know why this padding is
there, but the "section" doesn't decode to anything we
can parse. Maybe it's some reserved space for OS-specific
loader shenanigans?
Not sure how this even worked in the first place....I think we
always just got lucky with the size of .gcc_except_table. However,
something changed in the last rustc update that causes this section
to align to a 256-byte boundary instead of a 4-byte boundary, which
exposes downstream alignment issues.
This patch now captures the actual offset alignment + padding,
which is somewhat complicated by the fact that we throw away
the first section (not sure why??? it doesn't seem to have
a valid name or header, but the first 0x114 bytes are non-existent)
so we have to factor this into all the downstream padding efforts.
Make the first word in the signature block a jump past the block
this is for the cramium target, where the best memory efficiency
happens if we align the data to the bottom of the memory. This
means that the signature block ends up "in the way" of the boot
process, because the reset vector can only be configured to something
on a 16k-page boundary (e.g., we'd waste 15k of memory without this).
This will require some reworking of the existing code base for
checking signatures down the line.
Each platform interprets this differently.
On Precursor, it's the offset in FLASH of the swap region.
Probably, flags should be added to configure this somehow for each
platform, but still figuring a lot of things out.
The plan is on Cramium for the swap data to always be at 0
in the external SPI, so, we don't store an offset (field is
ignored).
This is set to 0 in the image creator, but the keying ceremony
should set this to something more secure after the device has
been initialized (and likewise, re-encrypt the swap region
to match the new, secure key).
looks like about 9 crates will be affected by this. Point them
all to the latest version of the API, and specify the
"precursor" feature (which activates our patch)
A missing translation will cause a panic in the localization
macro. As a short term solution. The stub function in the
i18n_helper.py just fills anything missing with its English
placeholder. Note: After refactoring the python packing, I intend
to add an "auto machine translate" funciton as well.
The loader image uses the original signing method, because changing
that would require us to modify the gateware ROM, which is a huge
pain in the ass, and doesn't buy us anything.
Thus only the kernel signing uses the pre-hash method.
This requires us to modify our dependencies to have dalek-ed25519
as one of our dependencies.
Which requires another patch in this commit set to implement
sha512 for hosts, since we patch the sha2 crate for all targets
to our local version.
