admin/LithosAnanake
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v2.0.1: G.4 amd64 RDRAND backend behind rng_get_bytes() (SER5 entropy)

Browse Source 
First real per-arch RNG backend, added to the v2.0.0 unified entry point in
src/starkernel/rng/rng.c, #if-guarded to amd64: CPUID.01H:ECX[30] RDRAND
detection + inline-asm rdrand draws feeding rdrand_fill() (whole-byte
emission from the low end; a partial final draw is discarded -- throwing
away entropy is always safe).

Probe order honors the release policy: virtio-rng is tried first, so the
QEMU path stays on virtio-rng unchanged; RDRAND is the fallback only real
hardware (which has no virtio-rng device) reaches. QEMU-verified both ways
on amd64: with virtio-rng present -> "rng: backend = virtio-rng" (unchanged);
with virtio-rng absent and RDRAND exposed (-cpu max) -> "rng: backend =
rdrand" + "entropy: ready" + Zuse attach confirmed. rdrand_fill()'s exact
logic host-proven: fills 32-byte/16-byte buffers and yields differing draws
run-to-run (non-deterministic). aarch64/riscv64 builds unaffected (guarded
off). riscv64 Zkr and aarch64 peripheral-RNG backends remain parked for their
real boards.

FABRIC-3.md G.4 amd64 slice marked BUILT + QEMU-verified.
This commit is contained in:
Robert Allan James
2026-08-29 10:18:07 -04:00
parent 19bc90c97d
commit 28de700645
4 changed files with 90 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
FABRIC-3.md
+13
View File
@@ -3413,6 +3413,19 @@ there.
primitive) returns genuinely non-deterministic bytes (two boots differ), the Zuse mint
path seeded from it produces a valid distinct cert per boot when bleached, and QEMU
behavior is unchanged.
- **v2.0.1 — amd64 RDRAND backend BUILT + QEMU-verified 2026-08-29 (SER5 slice).** The first
real per-arch backend lands in `src/starkernel/rng/rng.c`, behind the v2.0.0 unified
entry point, `#if`-guarded to amd64: CPUID.01H:ECX[30] detection + inline-asm `rdrand`
draws feeding `rdrand_fill()` (whole-byte emission, partial draw discarded — throwing
away entropy is always safe). Probe order honors the policy: virtio-rng is tried first,
so the QEMU path stays on virtio-rng unchanged; RDRAND is the fallback that only real
hardware (which has no virtio-rng) reaches. QEMU-verified both ways on amd64: with
virtio-rng present → `rng: backend = virtio-rng` (unchanged); with virtio-rng absent and
RDRAND exposed (`-cpu max`) → `rng: backend = rdrand` + `entropy: ready` + Zuse attach
confirmed. `rdrand_fill()`'s exact logic host-proven to fill 32-byte/16-byte buffers and
produce differing draws run-to-run (non-deterministic). aarch64/riscv64 builds unaffected
(guarded off). Still parked for their real boards: riscv64 Zkr (RNDR), aarch64 peripheral
RNG. Full "two distinct certs per bleached boot" proof remains v2.5.0/real-board.
#### G.5 [v2.5.0] Real-machine boot validation (SER5 / RasPi 6 / Milk-V)