Relase 0.9 notes

This release signals the stabilization of most Xous APIs; however, we reserve the right to make breaking changes, but with some justification. You could call this a "beta" release.

Notably, in 0.9, we have libstd integrated into Xous, and solidly intergated into several servers; thus this release is not backward compatible with 0.8 (and was never intended to be).

Aside from the introduction of libstd, few other breaking changes were implemented in the APIs. Thus, we refer you to the 0.8 release notes for examples of idiomatic ways to write code for Xous.

Major new features of 0.9

Xous now targets riscv32-imac-uknown-xous-elf instead of riscv32-imac-unknown-none-elf.
- cargo xtask, when run interactively, will offer to install the xous target.
- Kernel debug primitives are accessible via the kernel console
- GDB improvements
- Improved MemoryRange API
- Various stability improvements and major bug fixes (ELF loader bugs, stack pointer alignment, etc.)
- Elimination of heapless crate
- Transition from master->main for the default branch
All hardware drivers are available in some form:
- AES (using VexRiscV CPU extensions)
- Audio Codec (low-level interface only, 8kHz rec/playback)
- Curve25519 accelerator
- SHA512 (based on Google's OpenTitan core)
- JTAG self-introspection drivers
- Real time Clock
- FLASH memory writing
- Suspend/Resume
- Clock throttling when idle
- TRNG upgraded with health monitoring and CSPRNG whitener
- Upgrades to previous drivers (keyboard, graphics, etc.)
- Wifi enhancements including SSID scanning and AP join commands
Secured boot flow:
- Signed gateware, loader and kernel
- Compatible with BBRAM and eFuse keyed gateware images
- Semi-automated BBRAM key burning
- Self-provisioning of root keys (update and boot unlock keys)
- Local re-encryption of gateware updates to a secret key known only to your device
- Re-signing of loader/OS updates to protect code-at-rest
- Detection of image "downgrade" attacks that use developer keys
- Indication of downgrade through hardware-enforced hash marks on the status bar
Enhanced graphical user interface primitives:
- Modal dialog boxes
- Menus
- Progress bars
- Text and password entry forms with input validators
- Radio buttons
- Check boxes
- Notifications
- Defacement of less secure items: random hashes on background areas; complicates phishing attacks that present fake UI elements
Enforcement of delimited attack surfaces
- xous-names can optionally enforce a fixed number of connections to a server
  - Once all the connections are occupied after boot, new connections are no longer possible
  - Developers must increment the connection count, specified inside the target server itself, when adding new resources that require server access
- gam enforces a registry of all UX elements
  - Rogue processes cannot create new trusted UX resources
  - Developers must register their UX tokens in the gam inside tokens.rs
Extended simulation support
- Hosted mode performance improvements
- Hosted mode now supports thread creation with std::thread::spawn()
Improved emulation in Renode
- Full emulation of ENGINE
- Full emulation of SHA512 block
- Initial support of emulation of EC
  - No COM-based inter-chip communication yet

New in 0.9.5

modals server for a simple "Pure Rust" API for creating dialog boxes and getting user input. See the tests.rs file for some examples how to use the applcation calls.

New in 0.9.6

Networking: DNS, UDP, Ping and TCP
- Basic demo of ping, rudimentary http get/serve
- EC offload of ARP and DHCP – thanks to samblenny for adding that, along with a solid refactor of the EC code base! The EC now also has the capability to act as a coarse packet filter for the core CPU.
Connection manager
- Maintains a list of known SSID/password combos
- Manages passive SSID scanning and re-connection
- Enrolling in and saving a network profile is done via shellchat's wlan series of commands
- Only WPA2 is supported
- Still a lot of corner cases to work through
PDDB: Plausibly Deniable DataBase for system config and user data storage.
- Uniform filesystem for all user-specific Xous data
- Fully encrypted database
- Plausibly deniable secret overlays
- See this blog post for more details
- Rust API bindings available, but as of now, few command line tools
EC events – asynchronous callbacks triggered by network and battery events
CPU load monitor in status bar
Improved fonts
- B/W display optimized emoji
- Chinese-native Hanzi glyphs
- Japanese-native Kanji glyphs
- Hangul glyph set
- Thanks again to samblenny for all the hard work to make a slick new set of glyphs and a smooth new API!
Japanese locale
AZERTY and QWERTZ layouts
Auto word-wrapping in the TextView objects
Simplified graphical abstractions
- Modal server: create notifications, checkboxes, progress bars, radio boxes, and text entry boxes with validators using a single API call
- Simplified menu API
Modular application programs
- manifest.json file to specify application integration parameters, such as the localized name and app launcher menu name
- Build-time command line selection of which apps you want baked into the Xous image
Many bug fixes and improvements
Improved libstd support
Improved Renode and Hosted mode support

New in 0.9.7

pddb has salamanders fixed (https://eprint.iacr.org/2020/1456.pdf). This changes the root basis record storage, causing all prior versions to be unrecognized.
betrusted-soc was updated to the latest Litex in prep for some work optimizing CPU performance and USB cores

New in 0.9.8

TcpStream is now part of libstd. Legacy TcpStream has been removed.
TcpListener is now part of libstd. Legacy TcpListener has been removed.
net server demo program has been upgraded to use multiple worker threads + MPSC for communications. Users can now attempt to access buzz/ to cause the vibration motor to run, and there is now a 404 response for pages not found.
UdpSocket is now part of libstd. DNS and all test routines switched over to libstd, and all prior scaffolding implementations have been removed.
NetPump call added after Tx (UDP/TCP) and connect (TCP) events. This should improve the transmit latency.
Duration and Instant are now part of libstd
Timezone and time setting has been refactored. The HW RTC is now simply treated as a seconds counter since arbitrary time in the past; the BCD data that the hardware device tries to return is mapped into seconds since epoch. On first boot or invalid RTC detection, a random time is picked since epoch as the offset, between 1-10 years, to provide some deniability about how long the device has been used.
One can now switch the local time by just updating the Timezone offset. The actual timezone offsets are not dynamically updated with DST; one has to explicitly program in the offset from UTC upon daylight savings.
NTP option for time setting introduced with fallback to manual option
CPU load meter has been shifting around in the status bar to accommodate worst-case proportional font layouts. Maybe we're there?
Focus events refactored for the GAM to only send to apps (and not to menus and dialogs); it is strongly encouraged that all apps take advantage of them.
Sleep screen is now blanked of all prior content and just the sentinel message is held
Sleep/suspend lightly refactored to fix some bugs. Ticktimer is now the sole Last event.
Preliminary text to speech (TTS) support added; compile with cargo xtask tts or set the LOCALE to en-tts to try it out.
QR code rendering option added to modals (thank you nworbnhoj!)
Introduce deferred-response pattern into modals, pddb, and susres.
pddb critical bug fixed where page table entries were not having their journal numbers synchronized with the free space table when read off of the disk. This would cause inconsistency glitches in the pddb. This release fixes the problem, but, it may require you to reformat the pddb once the patch is in place. Because this is a genuine bug, if you're unlucky to be hit by this, there is no effective migration path. :(
pddb major bug fixed where zero-length file allocations were not being committed to disk.
pddb revision bumped to v2.1:
- A first problem was identified where a key was being re-used between the ECB page table cipher and the AES-GCM-SIV data cipher
- HKDF is now used to derive two separate keys for each
- A second problem was identified where the virtual page number was being stored as a fully expanded address in the paget able, and not as a page number. Due to the compressed encoding of the page table entry, this means that the virtual address space would be shrunk by ~4000x. This is now fixed, so we have the full as-designed virtual memory space once again.
- A migration routine was created to go from v1 -> v2 databases. It automatically detects the older version and attempts to guide the user through a migration. Although we don't have many users and databases today, this is a "best practice" for breaking revisions and this serves as a basis for forward-looking changes that are migrateable.
Various fixes and improvements to the USB update scripts to improve reliability.
Graphical panic outputs: when there is a panic, you get a "Guru Meditation" error box plus the panic message.
- Currently all panics are hard crashes
- Most of the time the system will reboot itself within a few seconds of displaying the panic
- There will be occassions where you will need to insert a paperclip into the reset port on the lower right hand corner to recover from the panic.
- If you get a panic, please snap a photo of it and drop it in a new issue in the xous-core repo, along with a description of what you were doing at the time.

New in 0.9.9 (currently in development)

This release requires a new SoC. It is highly recommended to first upload the SoC and install the update, and then perform the Xous firmware upgrade. This requires running manual update commands, instead of the all-in-one updater script.

modals text entry has been refactored to allow multi-field text entries with defaults! Thanks to gsora for PR #140.
fix issue #141: bug fix in log-server where max-length buffers were not being printed + refactor of method to use send vs scalars
PR #149: index support for modals. Lists can be submitted as a Vec now, with an array index returned as the selection result. Thanks to nworbnhoj for the PR.
PR #150 & #153: QR codes can now display a separate QR code from the actual text in the box via a Some/None specifier. Thanks to nworbnhoj for the PR & refinements.
PR #151: message forwarding standardized as part of the messaging API. See https://betrusted.io/xous-book/ch07-07-forwarding.html
fixed locking bug in dlmalloc (stdlib version 1.60.0.7)
update smoltcp to 0.8.1
refactor wait threads in net crate - use statically allocated pool of waiters + better filtering of requests for less churn
defer Drop on TcpStream until all written packets have been transmitted
scheduler quantum is now a tuning parameter in xous definitions.rs (BASE_QUANTA_MS). it is now set to 10ms, down from 20ms.
USB device core with keyboard HID emulation demo and FIDO2 HID support; fix issue #170
Issue #162 and #159: fix bugs with condvar support. condvar IDs are now serial, so re-allocations are not a problem, and the routine to remove old ones from the notification table now looks at the correct sender ID.
Add ceil, floor, and trunc (f32 and f64) variants to the built-ins list (this is a std lib update, in 1.61.0.2)
Add CI test automation facilities - CI infra now drives actual hardware through expect scripts, instead of just doing simulation checks
Vendor in getrandom so we can support a Xous API for the crate, allowing us access some of the more modern rustcrypto APIs. This is necssary for randcore 0.6 compatibility. randcore 0.5 APIs are retained by integrating them directly into the TRNG object.
Update AES API level to 0.8, and cipher dependency to 0.4 (on rootkeys). This was necessary to get CBC support for AES, which is needed for FIDO2. This should have no user-facing impact.
vault app: a user authentication management app is now ready for Alpha testing. It aims to provide FIDO2, TOTP, and stored password DB functions.
- U2F/FIDO2 are a vendor-in of Google OpenSK's FIDO2 implementation. The code basically passes the CTAP2 test suite (https://github.com/google/CTAP2-test-tool) ("basically passes" in that the timeouts tests fail because they aren't automated to not "press the button" when timeouts are being tested).
- U2F functions are best supported with UX flow. FIDO2 transactions still trying to figure out what the UX flow is even supposed to be: we're lacking actual FIDO2 applications to test against. Some prompts are still just stand-in text.
- TOTP integration is thanks to blakesmiths's PoC TOTP code!
- Password vault functionality in place
- Test routine for adding dozens of TOTP/FIDO records and a hundred passwords added. System tested up to 300 passwords -- no crash observed, but query performance of the PDDB is slow (~8 seconds)
Strip out gratuitous use of floating point -- this trims about 100k overall from the memory footprint.
Autobacklight feature: selectable feature to automatically raise the backlight when keys are pressed. Thanks to gsora for the feature!
- More importantly, this adds crossbeam into the kernel. This is a somewhat heavyweight item and is not recommended for use in core services, but by including it to drive the auto-backlight feature, we get regular code coverage of the condvar pathway.
Fix PDDB FSCB generation problems
- some issue were found in free space cache generation, these are now fixed
- fuzzer added to push many more corner cases than before -- disk is filled to ~75% capacity with dozens of Bases, triggering roughly 4 FSCB ops, and then all Bases and keys are verified to be correct.
Optimize GAM performance
- context switches that revert to a prior app screen are restored from a stashed bitmap instead of a full redraw. This prevents old menus, contexts, and defacements from "piling up" when an app is blocked due to an exceptional condition being raised (such as the PDDB requesting a full basis unlock to generate the FSCB)
PDDB support in libstd
- Directories are implemented as dicts in the flat namespace
- The : separator is used between path components
- A path that begins with a : specifies a basis. That is, the path example specifies a dict in the Union basis, while the path :.System:example specifies a dict example in the basis .System.
- A path that is only : specifies all bases, and is used to list the open bases
- The path :: specifies the "default basis", which is the most recently-opened one
- Because the path delimiter is :, this cannot be used as a string in filenames
  - Note, however, that the underlying API allows for : in filenames, which will confuse the libstd API
- It is possible for a "file" and a "directory" with the same name to exist in the same "directory". In this case, the entity will return true for both .is_file() and .is_directory(). In practice this doesn't matter, since there are different calls for working with files and directories.
- When deleting a file, it is immediately deleted and all open file handles on the system are now invalid. This is in contrast to other platforms where open file handles still work, or where a file that is open cannot be deleted.
- It is not yet possible to create or delete bases using this API.
- Libstd support for PDDB is not possible with hosted mode. File operations will write to your local filesystem.
BIP39 wordlist handling
- Display of BIP39 words from a [u8]
- Input of BIP39 words into a [u8], with validation and dynamic lookup/autocomplete of words
Improved kernel revisioning
- A readable semantic version tag is appended to loader and kernel images
- In addition to the current tag, a tag for "minimum xous version" to read a PDDB backup generated by the current Xous image is included.

Roadmap to 1.0

The items that are still missing before we can hit a 1.0 release include:

PDDB (plausibly deniable database): a key/value store that is the equivalent of a "filesystem" for Xous
Networking capabilities: a simple (think UDP-only) network stack
Password changes in the rootkey context
Post-boot loadable applications. We currently have modularized integrated applications, but no notion of a disk-loadable application. Still not sure if this is a feature we want, though, given that Xous is supposed to be a single-purpose tool and not a general OS.
Further integration of drivers into libstd
Maybe a functional USB device stack??
Lots of testing and bug fixes

17 KiB Raw Blame History Unescape Escape