starkernel: item 3.8 -- VM identifiers as UUID/GUID
Punch list §25 item 3.8 complete. Added after starting item 4.1
surfaced the need to thread a vm_id into stadium_admit()'s new quota
parameter; Captain Bob ruled UUID/GUID rather than keeping the
narrower uint32_t.
New VMUuid type (vm_uuid.h/vm_uuid.c): two uint64_t halves, RFC-4122-
shaped for logging. Not real randomness -- checked directly against
QEMU 10.2.1's actual CPU feature set: amd64 RDRAND and riscv64 Zkr are
both real, available features here; aarch64 has no RNG property on any
CPU model including "max" (verified exhaustively via QMP
query-cpu-model-expansion). Captain Bob ruled a uniform fallback
across all three ISAs rather than a per-architecture split.
Fallback is a deterministic PRNG (splitmix64) seeded from the Mama
capsule's content hash, pre-filling a 16-entry FIFO pool at boot and
refilling with another batch of the same stream when exhausted --
exactly the shape requested. Same capsule booted twice produces the
same id sequence, preserving the dict_hash reproducibility this
session has relied on throughout.
Hera keeps a fixed, reserved all-zero id, not drawn from the pool --
capsule_birth.c uses vm_id == 0 as a load-bearing sentinel in three
places (KILL protection x2, fleet heat-fanout parent-chain
terminator), found by reading before writing any code.
Two real sentinel-collision bugs caught before shipping, same class as
STADIUM_CONTAINS_NONE: vm_uuid_none() (all-ones, not all-zero) for
"not yet assigned"/"no VM" placeholders; confirmed item 3.7's quota
table already used an in_use boolean rather than a vm_id sentinel, so
no second collision was actually possible there -- the dead,
never-referenced STADIUM_QUOTA_SLOT_EMPTY macro was removed.
Blast radius larger than first scoped, flagged mid-work rather than
silently absorbed: capsule_vm_physics.c/.h (the fleet heat-transfer
layer item 2.1 modified earlier this session) has its own vm_id-keyed
node table and walks parent_vm_id chains through the same identity
space, so it needed the same change, plus its callers in
mama_forth_words.c and sk_vm_bootstrap.c.
One live FORTH word contract changed, by explicit ruling: CAPSULE-BIRTH
was ( capsule-id -- vm-id ), a single cell -- can't hold 128 bits.
Captain Bob picked pushing two cells ("there is doubles support in the
FORTH std word set anyway"): ( capsule-id -- vm-id-hi vm-id-lo ).
MAMA-VM-ID changed the same way: ( -- 0 0 ).
Verified: full (not standalone-file) kernel rebuild to catch cross-file
breakage given the size of this change -- it surfaced the
capsule_vm_physics.c blast radius a narrower check would have missed.
Three-architecture boot (amd64, aarch64, riscv64), all reaching ok>
with identical dict_hash=0x3d4e1daf289da94f matching the item-3.7
baseline.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Robert Allan James
co-authored by
Claude Sonnet 5
Claude Sonnet 5
parent
ec2c97ef70
commit
9b305a5be7
@@ -0,0 +1,137 @@
|
||||
/*
|
||||
StarForth — Steady-State Virtual Machine Runtime
|
||||
|
||||
Copyright (c) 2023–2025 Robert A. James
|
||||
All rights reserved.
|
||||
|
||||
This file is part of the StarForth project.
|
||||
|
||||
Licensed under the StarForth License, Version 1.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
|
||||
You may obtain a copy of the License at:
|
||||
https://github.com/star.4th@proton.me/StarForth/LICENSE.txt
|
||||
|
||||
This software is provided "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
express or implied, including but not limited to the warranties of
|
||||
merchantability, fitness for a particular purpose, and noninfringement.
|
||||
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
|
||||
*/
|
||||
|
||||
/**
|
||||
* vm_uuid.c - 128-bit VM identifiers (FABRIC.md punch list item 3.8)
|
||||
*
|
||||
* See vm_uuid.h for the design rationale (no RNG source exists on any of
|
||||
* the three ISAs uniformly, so this is deterministic, not random).
|
||||
*/
|
||||
|
||||
#include "starkernel/vm_uuid.h"
|
||||
|
||||
#ifdef __STARKERNEL__
|
||||
|
||||
#include <stddef.h>
|
||||
|
||||
#define VM_UUID_POOL_SIZE 16
|
||||
|
||||
static uint64_t vm_uuid_prng_state = 0;
|
||||
static int vm_uuid_seeded = 0;
|
||||
static VMUuid vm_uuid_pool[VM_UUID_POOL_SIZE];
|
||||
static size_t vm_uuid_pool_pos = VM_UUID_POOL_SIZE; /* "empty": first next() call refills */
|
||||
|
||||
VMUuid vm_uuid_hera(void) {
|
||||
VMUuid id;
|
||||
id.hi = 0;
|
||||
id.lo = 0;
|
||||
return id;
|
||||
}
|
||||
|
||||
int vm_uuid_is_hera(VMUuid id) {
|
||||
return id.hi == 0 && id.lo == 0;
|
||||
}
|
||||
|
||||
VMUuid vm_uuid_none(void) {
|
||||
VMUuid id;
|
||||
id.hi = 0xFFFFFFFFFFFFFFFFULL;
|
||||
id.lo = 0xFFFFFFFFFFFFFFFFULL;
|
||||
return id;
|
||||
}
|
||||
|
||||
int vm_uuid_is_none(VMUuid id) {
|
||||
return id.hi == 0xFFFFFFFFFFFFFFFFULL && id.lo == 0xFFFFFFFFFFFFFFFFULL;
|
||||
}
|
||||
|
||||
int vm_uuid_equal(VMUuid a, VMUuid b) {
|
||||
return a.hi == b.hi && a.lo == b.lo;
|
||||
}
|
||||
|
||||
/* splitmix64 -- public-domain, well-known, minimal. Deterministic given a
|
||||
* seed; not cryptographically random, not claimed to be. */
|
||||
static uint64_t splitmix64_next(uint64_t *state) {
|
||||
uint64_t z = (*state += 0x9E3779B97F4A7C15ULL);
|
||||
z = (z ^ (z >> 30)) * 0xBF58476D1CE4E5B9ULL;
|
||||
z = (z ^ (z >> 27)) * 0x94D049BB133111EBULL;
|
||||
return z ^ (z >> 31);
|
||||
}
|
||||
|
||||
static void vm_uuid_pool_refill(void) {
|
||||
size_t i;
|
||||
for (i = 0; i < VM_UUID_POOL_SIZE; i++) {
|
||||
uint64_t hi = splitmix64_next(&vm_uuid_prng_state);
|
||||
uint64_t lo = splitmix64_next(&vm_uuid_prng_state);
|
||||
/* RFC 4122 version 4 / variant bits -- cosmetic shape only, not a
|
||||
* claim these are cryptographically random. */
|
||||
hi = (hi & 0xFFFFFFFFFFFF0FFFULL) | 0x0000000000004000ULL;
|
||||
lo = (lo & 0x3FFFFFFFFFFFFFFFULL) | 0x8000000000000000ULL;
|
||||
vm_uuid_pool[i].hi = hi;
|
||||
vm_uuid_pool[i].lo = lo;
|
||||
}
|
||||
vm_uuid_pool_pos = 0;
|
||||
}
|
||||
|
||||
void vm_uuid_pool_init(uint64_t seed) {
|
||||
vm_uuid_prng_state = seed;
|
||||
vm_uuid_seeded = 1;
|
||||
vm_uuid_pool_refill();
|
||||
}
|
||||
|
||||
VMUuid vm_uuid_next(void) {
|
||||
VMUuid id;
|
||||
|
||||
if (!vm_uuid_seeded) {
|
||||
/* Safety net, not the intended path -- callers should seed from the
|
||||
* Mama capsule's content hash before the first non-Hera VM birth. */
|
||||
vm_uuid_pool_init(0x9E3779B97F4A7C15ULL);
|
||||
}
|
||||
if (vm_uuid_pool_pos >= VM_UUID_POOL_SIZE) {
|
||||
vm_uuid_pool_refill();
|
||||
}
|
||||
|
||||
id = vm_uuid_pool[vm_uuid_pool_pos];
|
||||
vm_uuid_pool_pos++;
|
||||
return id;
|
||||
}
|
||||
|
||||
void vm_uuid_format(VMUuid id, char *buf) {
|
||||
static const char hex[] = "0123456789abcdef";
|
||||
int pos = 0;
|
||||
int i;
|
||||
uint64_t halves[2];
|
||||
/* Group boundaries per RFC 4122: 8-4-4-4-12 hex digits, dashes after
|
||||
* digit 8, 12, 16, 20 (of 32 total). hi supplies digits 0-15, lo
|
||||
* supplies digits 16-31. */
|
||||
halves[0] = id.hi;
|
||||
halves[1] = id.lo;
|
||||
|
||||
for (i = 0; i < 32; i++) {
|
||||
uint64_t v = (i < 16) ? halves[0] : halves[1];
|
||||
int shift = (15 - (i % 16)) * 4;
|
||||
buf[pos++] = hex[(v >> shift) & 0xF];
|
||||
if (i == 7 || i == 11 || i == 15 || i == 19) buf[pos++] = '-';
|
||||
}
|
||||
buf[pos] = '\0';
|
||||
}
|
||||
|
||||
#endif /* __STARKERNEL__ */
|
||||
Reference in New Issue
Block a user