admin/LithosAnanake
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

G.2 (v2.0.0): unified rng_get_bytes() entropy entry point; virtio-rng sole backend

Browse Source 
The QEMU-verifiable slice of the real-hardware RNG driver (per FABRIC-3.md
§G.2). New include/starkernel/rng.h + src/starkernel/rng/rng.c provide the
single entropy entry point: rng_init() probes the backend set (v2.0.0:
virtio-rng only) and, on no backend, prints a loud boot-time warning while
rng_get_bytes() returns RNG_ERR_NO_BACKEND - never silently degrading to a
deterministic seed. The backend-selection switch in rng.c is the exact seam
v2.5.0's per-arch drivers (amd64 RDRAND, riscv64 Zkr, aarch64 peripheral) plug
into without touching the call path.

Consumers route through the unified layer instead of virtio-rng directly:
capsule_mint.c (identity seed + drive_uuid) and kernel_main.c phase 8
(rng_init()). virtio_rng.c stays as the sole backend. Built clean on
amd64/aarch64/riscv64. QEMU amd64 boot: POST 1012/0/0 + ok>, "rng: backend =
virtio-rng" + "entropy: ready", Zuse identity confirmed from thumbdrive -
mint/cert behavior unchanged.

FABRIC-3.md §G.2 v2.0.0 slice marked BUILT+VERIFIED.
This commit is contained in:
Robert Allan James
2026-08-29 09:57:17 -04:00
parent aee1ecaa8f
commit 09857b7228
8 changed files with 157 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
FABRIC-3.md
+13
View File
@@ -3362,6 +3362,19 @@ redesign of the call path.
loudly (boot-time message, safe fallback to this-boot-only cert) if no backend is present,
and the pre-existing Zuse mint/cert behavior is unchanged on all three arches. The
per-arch backends themselves are parked, explicitly, for v2.5.0.
- **v2.0.0 slice — BUILT and VERIFIED 2026-08-29.** `include/starkernel/rng.h` +
`src/starkernel/rng/rng.c` provide the single `rng_get_bytes()` entry point; `rng_init()`
probes the backend set (v2.0.0: virtio-rng only) and, on no backend, prints a loud
boot-time warning and `rng_get_bytes()` returns `RNG_ERR_NO_BACKEND` — it never silently
degrades to a deterministic seed. The backend-selection switch in `rng.c` is the exact seam
the v2.5.0 real per-arch drivers (amd64 RDRAND, riscv64 Zkr, aarch64 peripheral RNG) plug
into without touching the call path. Kernel consumers no longer touch `virtio_rng_*`
directly: `capsule_mint.c` (identity seed + `drive_uuid`) and `kernel_main.c` phase 8
(`rng_init()`) route through the unified layer; `virtio_rng.c` stays as the sole backend.
Built clean on all three arches (`make -f Makefile.starkernel ARCH={amd64,aarch64,riscv64}`).
QEMU amd64 boot: POST `1012/0/0` + `ok>`, `rng: backend = virtio-rng` + `entropy: ready`
printed by the unified layer, and Zuse attach/identity confirmed from the thumbdrive —
Zuse mint/cert behavior unchanged.
- **Exit criterion (v2.5.0 completion, for reference):** on each real board `rng_get_bytes()`
returns genuinely non-deterministic bytes (two boots differ) and the Zuse mint path seeded
from it produces a valid distinct cert per boot when bleached.