rajamesandJunie
a8b70e88d3
Source tree reorganization: - Move StarForth v3 engine to v3/ (src/, include/, Makefile) - Move kernel to kernel/ (src/, include/, linker/, Makefile) - Create v4/ skeleton for F18-ISA golden model (DECOMPOSITION.md, JUSTIFICATION.md) - Move FABRIC-0..4.md to docs/fabric/ - Move ONTOLOGY.md and ROADMAP.md to docs/ Board infrastructure: - Add boards/ser5/, boards/raspi/, boards/milkv/, boards/zynq7020/ - Each board has board.mk (ISA, CPU flags, boot recipe) and README.md - Root Makefile becomes thin dispatcher: boot_image, all, clean, docs take TARGET - make boot_image TARGET=SER5|RASPI|MILKV builds one GPT/MBR image per board - ZYNQ7020 target exists but stops with clear error (ARMv7 port not built yet) - scripts/mkdiskimage.sh builds disk images for all boards Docs pipeline: - docs/book/ with LaTeX master (main.tex) and Makefile - pandoc converts Markdown to LaTeX at build time - Two Lua filters: table-widths.lua (wide tables wrap), code-breaks.lua (inline code breaks) - make docs builds single PDF (754 pages, 0 missing characters) - make docs TARGET=<board> adds board appendix - build/docs/<book|board>/meta.tex stamps git commit into PDF Bug fixes: - 42 include paths that only worked by accident now use correct relative paths - clang-18 hardcode replaced with configurable CC variable (fixed aarch64 build) - Pi 5: kernel_2712.img linked at 0x80000, .bss zeroed, memory reserved - Doxyfile, .clang-tidy, README.md, Kconfig paths updated Verified: - Hosted v3 build passes 1012 tests, 0 failures - SER5 image boots in QEMU (OVMF), POST passes, K exact (65536 = Q48_ONE) - Milk-V image boots in QEMU (OpenSBI + U-Boot + bootefi), POST passes - make clean TARGET=<board> removes only that board and its ISA objects - make all builds all boards, hosted v3, and docs in one run Co-authored-by: Junie <junie@jetbrains.com>
53 lines
2.3 KiB
C
53 lines
2.3 KiB
C
/*
|
|
* capsule_sig.h -- per-capsule Ed25519 signature verification
|
|
* (Milestone 6, Phase 8). Deliberately kept separate from
|
|
* capsule_validate.c: that function is already tested and its
|
|
* signature/behavior stays untouched; this is a new, additive check
|
|
* called alongside it, not folded into it.
|
|
*
|
|
* Enforced ONLY on CAPSULE_SIG_INVALID (2026-08-26, after landing
|
|
* WARN-only and proving correct on all three architectures against both
|
|
* a valid and a deliberately-corrupted capsule -- see FABRIC-2.md's
|
|
* Milestone 6 writeup). CAPSULE_SIG_MISSING and CAPSULE_SIG_NO_ROOT_KEY
|
|
* stay WARN-only, deliberately: MISSING is the normal state on every
|
|
* machine without access to the offline signing key (CI, any other
|
|
* checkout) -- refusing on it would brick boot everywhere but the one
|
|
* machine that minted the key, not catch anything real. Only INVALID
|
|
* (a signature that IS present but does not verify) is unambiguous
|
|
* tampering/corruption evidence, safe to refuse on regardless of who's
|
|
* building.
|
|
*/
|
|
#ifndef STARKERNEL_CAPSULE_SIG_H
|
|
#define STARKERNEL_CAPSULE_SIG_H
|
|
|
|
#include "starkernel/capsule.h"
|
|
|
|
typedef enum {
|
|
CAPSULE_SIG_OK = 0, /* has_sig=1, and it verifies */
|
|
CAPSULE_SIG_MISSING, /* has_sig=0 -- not signed at all */
|
|
CAPSULE_SIG_INVALID, /* has_sig=1 but verification failed */
|
|
CAPSULE_SIG_NO_ROOT_KEY, /* couldn't find/parse the embedded intermediate cert */
|
|
} CapsuleSigResult;
|
|
|
|
/*
|
|
* Verify capsule descs[index]'s Ed25519 signature against the embedded
|
|
* snakeoil intermediate cert's public key (capsule name
|
|
* "pki:snakeoil-intermediate.der", found and parsed once, cached for
|
|
* every later call this boot -- the cert doesn't change mid-boot).
|
|
*
|
|
* descs/names/sigs must be the same three parallel arrays
|
|
* (capsule_get_descriptors()/capsule_get_names()/capsule_get_signatures()),
|
|
* desc_count their shared length, arena_base the payload arena
|
|
* (capsule_get_arena()). index must be < desc_count.
|
|
*/
|
|
CapsuleSigResult capsule_verify_signature(
|
|
const CapsuleDesc *descs, const CapsuleNameEntry *names,
|
|
const CapsuleSigEntry *sigs, const uint8_t *arena_base,
|
|
uint32_t desc_count, int index);
|
|
|
|
/* Human-readable string for logging, mirroring
|
|
* capsule_validate_result_str()'s existing shape. */
|
|
const char *capsule_sig_result_str(CapsuleSigResult result);
|
|
|
|
#endif /* STARKERNEL_CAPSULE_SIG_H */
|