Add VMIdentity type, relocate homeblocks_sig_t off devblock 0
Phase A of the identity pipeline (FABRIC-3.md §F.2/§F.16, §F.13):
- New include/starkernel/vm_identity.h: VMIdentity{owner_pubkey[32],
installed, acl_caps}, its own header per the project's "give real-shaped
data its own header" convention (VMUuid's own precedent), embedded by
value on struct VM. acl_caps is an independent capability bitmask, not
an ordered privilege tier (decided 2026-08-28) -- Zuse isn't a
structurally special VM, her identity just has every bit set
(VM_IDENTITY_CAP_ALL). No individual capability bits assigned yet,
deliberate slack matching blk_meta_t's own acl_reserved precedent --
real bits get names once the operation they gate (BINDSTEP, MINT, ...)
actually gets built.
- Applied the devblock-1 relocation decided in §F.13: new
HOMEBLOCKS_SIG_START_FBLOCK constant (homeblocks_sig.h), repl.c's
homeblocks_sig_check() call site updated from the literal 0. Also
applied the still-owed blockmap_offset/blockmap_devblocks ->
identity_src_offset/identity_src_devblocks rename decided in §F.6 (no
other code referenced the old names). Updated the header's own stale
GPT-relative doc comments to match -- GPT was dropped permanently, this
location is final, not an interim stand-in.
Verified live on all three architectures: clean compile, clean boot to
ok>, Hermes/Artemis both confirmed live with no KILL (no regression from
last session's session-less fix). One pre-existing, unrelated anomaly
observed consistently on all three arches, not caused by this change (no
code touched here intersects Zuse's own fence-write path): "Zuse: minted
but fence write FAILED (not persistent)" -- flagged for its own
investigation, not chased here.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD
This commit is contained in:
Robert Allan James
co-authored by
Claude Sonnet 5
Claude Sonnet 5
parent
2cc1d27f19
commit
c07184e984
+50
-50
@@ -1,5 +1,5 @@
|
||||
# Capsule Block Manifest — Auto-generated
|
||||
<!-- Generated by mkcapsule --manifest 2026-08-28T12:43:09Z -->
|
||||
<!-- Generated by mkcapsule --manifest 2026-08-28T13:27:40Z -->
|
||||
<!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh. -->
|
||||
<!-- Hand-written justifications and immutability notes live -->
|
||||
<!-- in MANIFEST.md alongside this auto-generated index. -->
|
||||
@@ -9,7 +9,7 @@
|
||||
| Capsule | Blocks claimed | xxHash64 | Signed |
|
||||
|---------|----------------|----------|--------|
|
||||
| `ACL.4th` | 4000, 4001, 4002, 4003, 4004, 4005, 4006, 4007, 4015 | `0xd781d22148ff171d` | yes |
|
||||
| `artemis:init.4th` | 4110, 4111, 4112, 4113, 4122, 4123, 4124, 4125, 4126, 4127, 4128, 4129, 4130, 4131, 4132, 4133, 4134, 4135, 4136, 4137, 4138, 4139, 4140, 4141, 4160, 4161, 4162, 4163, 4164, 4165, 4166, 4167, 4168, 4169, 4170, 4171, 4172, 4173, 4174, 4177, 4178, 4179, 4180, 4181, 4182, 4851, 4852, 4853 | `0x87f90140dc5932df` | yes |
|
||||
| `artemis:init.4th` | 4110, 4111, 4112, 4113, 4122, 4123, 4124, 4125, 4126, 4127, 4128, 4129, 4130, 4131, 4132, 4133, 4134, 4135, 4136, 4137, 4138, 4139, 4140, 4141, 4160, 4161, 4162, 4163, 4164, 4165, 4166, 4167, 4168, 4169, 4170, 4171, 4172, 4173, 4174, 4177, 4178, 4179, 4180, 4181, 4182, 4851, 4852, 4853 | `0x8ecaf0453f02df27` | yes |
|
||||
| `common:msg.4th` | 4055 | `0x850a0382344ea6c4` | yes |
|
||||
| `doe-campaign.4th` | 4060, 4061, 4062, 4063, 4064, 4065 | `0x3d4549142d91ec20` | yes |
|
||||
| `doe.4th` | 2100, 2101, 2102, 2103, 2104, 2105, 2106, 2107 | `0xf154616d248e861f` | yes |
|
||||
@@ -124,10 +124,10 @@
|
||||
| 4107 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
| 4108 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
| 4109 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
| 4110 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4111 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4112 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4113 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4110 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4111 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4112 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4113 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4114 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
| 4115 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
| 4116 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
@@ -136,26 +136,26 @@
|
||||
| 4119 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
| 4120 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
| 4121 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
| 4122 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4123 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4124 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4125 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4126 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4127 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4128 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4129 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4130 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4131 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4132 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4133 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4134 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4135 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4136 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4137 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4138 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4139 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4140 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4141 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4122 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4123 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4124 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4125 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4126 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4127 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4128 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4129 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4130 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4131 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4132 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4133 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4134 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4135 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4136 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4137 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4138 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4139 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4140 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4141 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4142 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
| 4143 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
| 4144 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
@@ -174,29 +174,29 @@
|
||||
| 4157 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
| 4158 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
| 4159 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
| 4160 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4161 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4162 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4163 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4164 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4165 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4166 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4167 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4168 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4169 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4170 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4171 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4172 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4173 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4174 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4160 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4161 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4162 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4163 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4164 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4165 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4166 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4167 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4168 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4169 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4170 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4171 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4172 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4173 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4174 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4175 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
| 4176 | `hermes:init.4th` | `0xc4f09ac30715b659` | ok |
|
||||
| 4177 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4178 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4179 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4180 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4181 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4182 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4177 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4178 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4179 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4180 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4181 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4182 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4200 | `user-font-demo.4th` | `0xce1fd7d1b581a56d` | ok |
|
||||
| 4201 | `user-font-demo.4th` | `0xce1fd7d1b581a56d` | ok |
|
||||
| 4202 | `user-font-demo.4th` | `0xce1fd7d1b581a56d` | ok |
|
||||
@@ -236,9 +236,9 @@
|
||||
| 4840 | `init-l8-transition.4th` | `0xbcc1a81976f0a4c9` | ok |
|
||||
| 4841 | `init-l8-transition.4th` | `0xbcc1a81976f0a4c9` | ok |
|
||||
| 4842 | `init-l8-transition.4th` | `0xbcc1a81976f0a4c9` | ok |
|
||||
| 4851 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4852 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4853 | `artemis:init.4th` | `0x87f90140dc5932df` | ok |
|
||||
| 4851 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4852 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4853 | `artemis:init.4th` | `0x8ecaf0453f02df27` | ok |
|
||||
| 4900 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
|
||||
| 4901 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
|
||||
| 4902 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
|
||||
|
||||
@@ -22,15 +22,17 @@
|
||||
|
||||
/**
|
||||
* homeblocks_sig.h - Home-blocks drive signature format (FABRIC-3.md,
|
||||
* Milestone 4, Phase 8 kickoff)
|
||||
* Milestone 4, Phase 8 kickoff; relocated + GPT dropped §F.13/§F.8,
|
||||
* 2026-08-28)
|
||||
*
|
||||
* Identifies and authenticates a physical thumb drive as a legitimate
|
||||
* LithosAnanke home-blocks drive, before any write path touches it.
|
||||
* Lives at the first 4KiB devblock of the drive's GPT metadata partition
|
||||
* (the ~1GB partition decided 2026-08-22) -- this header's own format does
|
||||
* not depend on the GPT parser that locates that partition; it is simply
|
||||
* what gets written starting at that partition's first devblock, once
|
||||
* something can find it.
|
||||
* Lives at forth-block HOMEBLOCKS_SIG_START_FBLOCK (devblock 1) of the raw
|
||||
* device -- GPT partitioning was decided against permanently (§F.8): this
|
||||
* is the real, final on-disk location, not an interim stand-in. Devblock 0
|
||||
* is left alone for the block-subsystem's own generic 'STFR'/v2 volume
|
||||
* header (block_subsystem.h) -- the two formats would otherwise collide
|
||||
* (§F.13, found while scoping BMAPREAD).
|
||||
*
|
||||
* Mirrors two existing precedents exactly, not invented fresh:
|
||||
* - CAPSULE_MAGIC_PACK's bit-packed magic (starkernel/capsule.h)
|
||||
@@ -38,11 +40,10 @@
|
||||
* convention (block_subsystem.h)
|
||||
*
|
||||
* Deliberately narrow in scope: this header identifies/authenticates the
|
||||
* DRIVE only. It does not invent the on-drive block-map format (Milestone
|
||||
* 3, still undesigned) or the credential/cert format (Milestone 6, blocked
|
||||
* on a real CA that does not exist yet) -- it only reserves offset/size
|
||||
* pointers to where those will attach, so this format does not need to be
|
||||
* revisited when those get designed.
|
||||
* DRIVE only. It reserves offset/size pointers to where the cert
|
||||
* (CERTVERIFY, §F.7) and this identity's own personality/init source
|
||||
* (RUNCAP/MINT, §F.6/§F.8) attach, so this format doesn't need revisiting
|
||||
* when those get built -- it does not itself decide their content.
|
||||
*/
|
||||
|
||||
#ifndef STARKERNEL_HOMEBLOCKS_SIG_H
|
||||
@@ -72,6 +73,15 @@ extern "C" {
|
||||
#define HOMEBLOCKS_SIG_GET_MAGIC(m) ((uint32_t)((m) & 0xFFFFFFFFULL))
|
||||
#define HOMEBLOCKS_SIG_GET_VERSION(m) ((uint8_t)(((m) >> 32) & 0xFF))
|
||||
|
||||
/* Where this header actually lives on a home-blocks drive: forth-block 4
|
||||
* (devblock 1), NOT devblock 0 -- FABRIC-3.md §F.13, decided 2026-08-28.
|
||||
* Devblock 0 is reserved for the block-subsystem's own generic 'STFR'/v2
|
||||
* volume header (block_subsystem.c); the two formats collide if both try
|
||||
* to occupy devblock 0 of the same raw device. GPT is permanently dropped
|
||||
* (§F.8) -- this is not an interim stand-in pending a GPT parser, it's the
|
||||
* real, final location. */
|
||||
#define HOMEBLOCKS_SIG_START_FBLOCK 4u
|
||||
|
||||
/*===========================================================================
|
||||
* homeblocks_sig_t - drive signature header (exactly one 4KiB devblock)
|
||||
*===========================================================================*/
|
||||
@@ -81,18 +91,26 @@ typedef struct {
|
||||
uint8_t drive_uuid[16]; /* Unique per-mint instance id -- Phase 8 mints multiple
|
||||
* distinct drives, needs something to tell them apart. */
|
||||
uint64_t minted_time_ns; /* Monotonic timestamp at mint time. */
|
||||
uint64_t metadata_devblocks; /* Size of this GPT metadata partition, in 4KiB devblocks --
|
||||
* sanity/bounds check against the GPT entry once a parser
|
||||
* exists. */
|
||||
uint64_t metadata_devblocks; /* Size of the metadata region at the start of this raw
|
||||
* device (sig header + cert + identity-source regions),
|
||||
* in 4KiB devblocks -- everything past this is the owning
|
||||
* identity's own general block-storage pool directly (§F.6
|
||||
* decision 3), no partition boundary involved. */
|
||||
|
||||
uint32_t cert_offset; /* Devblock offset within this partition where the CA-signed
|
||||
* cert blob starts; 0 = not yet minted. Format not decided --
|
||||
* Milestone 6's real CA does not exist yet. */
|
||||
uint32_t cert_offset; /* Devblock offset from this device's start where this
|
||||
* identity's Zuse-signed cert blob starts (§F.7); 0 = not
|
||||
* yet minted. */
|
||||
uint32_t cert_devblocks; /* Size reserved for the cert blob, in devblocks. */
|
||||
|
||||
uint32_t blockmap_offset; /* Devblock offset where the block-map starts; 0 = not yet
|
||||
* minted. Format not decided -- Milestone 3, still open. */
|
||||
uint32_t blockmap_devblocks; /* Size reserved for the block-map, in devblocks. */
|
||||
uint32_t identity_src_offset; /* Devblock offset where this identity's own record
|
||||
* starts (RUNCAP/MINT, FABRIC-3.md §F.6/§F.8): first
|
||||
* devblock is a user_identity_seed_t, remainder is raw
|
||||
* FORTH personality/init source. Renamed from
|
||||
* blockmap_offset -- BMAPFMT (§F.4) repurposed blk_meta_t
|
||||
* instead of a centralized block-map, making the original
|
||||
* field unnecessary; this reuses the same reserved bytes
|
||||
* rather than adding new ones. 0 = not yet minted. */
|
||||
uint32_t identity_src_devblocks; /* Size reserved for the identity record, in devblocks. */
|
||||
|
||||
uint64_t hdr_crc; /* REAL from day one, not a placeholder like
|
||||
* blk_volume_meta_t's "unused yet" hdr_crc -- this header's
|
||||
@@ -109,7 +127,7 @@ typedef struct {
|
||||
8 + /* minted_time_ns */
|
||||
8 + /* metadata_devblocks */
|
||||
4 + 4 + /* cert_offset, cert_devblocks */
|
||||
4 + 4 + /* blockmap_offset, blockmap_devblocks */
|
||||
4 + 4 + /* identity_src_offset, identity_src_devblocks */
|
||||
8 /* hdr_crc */
|
||||
)];
|
||||
} homeblocks_sig_t;
|
||||
@@ -141,13 +159,15 @@ struct blkio_dev;
|
||||
* Reads 4 consecutive 1KB "forth blocks" (dev->read()'s own unit) starting
|
||||
* at sig_start_fblock into a local 4KB buffer and interprets it as a
|
||||
* homeblocks_sig_t. Deliberately takes the starting block as a plain
|
||||
* parameter rather than resolving it internally -- this function verifies a
|
||||
* signature given a location; finding that location (GPT-partition-relative
|
||||
* today, once a GPT parser exists) is the caller's job, not invented here.
|
||||
* parameter rather than resolving it internally, even though every real
|
||||
* caller now passes the same fixed HOMEBLOCKS_SIG_START_FBLOCK (GPT was
|
||||
* dropped, §F.8) -- keeps this function's own job (verify a signature
|
||||
* given a location) separate from callers deciding what that location is.
|
||||
*
|
||||
* @param dev Open block device to read from.
|
||||
* @param sig_start_fblock First of 4 consecutive forth-blocks holding the
|
||||
* 4KB header.
|
||||
* 4KB header -- HOMEBLOCKS_SIG_START_FBLOCK for
|
||||
* every real caller today.
|
||||
* @param out_sig On HOMEBLOCKS_SIG_OK, populated with the verified
|
||||
* header. Left unspecified on any other result.
|
||||
* @return HOMEBLOCKS_SIG_OK, or the specific reason for refusal.
|
||||
|
||||
@@ -0,0 +1,90 @@
|
||||
/*
|
||||
StarForth — Steady-State Virtual Machine Runtime
|
||||
|
||||
Copyright (c) 2023–2025 Robert A. James
|
||||
All rights reserved.
|
||||
|
||||
This file is part of the StarForth project.
|
||||
|
||||
Licensed under the StarForth License, Version 1.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
|
||||
You may obtain a copy of the License at:
|
||||
https://github.com/star.4th@proton.me/StarForth/LICENSE.txt
|
||||
|
||||
This software is provided "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
express or implied, including but not limited to the warranties of
|
||||
merchantability, fitness for a particular purpose, and noninfringement.
|
||||
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
/**
|
||||
* vm_identity.h - Per-VM owner identity + ACL capabilities (FABRIC-3.md
|
||||
* §F.2/§F.16, decided 2026-08-27/28)
|
||||
*
|
||||
* Holds only what a VM needs to prove *who owns it* and *what that owner
|
||||
* is allowed to do* -- never a private key. A regular VM's lock never
|
||||
* signs anything itself, so no seed/private material belongs here at all
|
||||
* (unlike Zuse's own zuse_cert_seed/zuse_cert_pubkey pair, which does need
|
||||
* one because she actively signs). Deliberately its own header rather
|
||||
* than inline fields on struct VM, mirroring VMUuid's own precedent
|
||||
* (vm_uuid.h) -- standing instruction: give real-shaped data its own
|
||||
* header and integrate as a field, don't grow struct VM ad hoc.
|
||||
*
|
||||
* acl_caps is a capability bitmask, not an ordered privilege tier
|
||||
* (decided 2026-08-28) -- independent bits, not a nested hierarchy. Zuse
|
||||
* is not a structurally special VM: her identity just has every bit set.
|
||||
* No bit values are assigned yet -- deliberate slack, per this project's
|
||||
* "flexibility until we understand the recipe" precedent (see
|
||||
* blk_meta_t's own acl_reserved bytes, FABRIC-3.md §F.4) -- real bits get
|
||||
* names only once the operation they gate actually gets built (BINDSTEP,
|
||||
* MINT, ...), not speculatively here.
|
||||
*/
|
||||
|
||||
#ifndef STARKERNEL_VM_IDENTITY_H
|
||||
#define STARKERNEL_VM_IDENTITY_H
|
||||
|
||||
#ifdef __STARKERNEL__
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
typedef struct {
|
||||
uint8_t owner_pubkey[32]; /**< Ed25519 public key of this VM's owning
|
||||
* identity. Meaningless unless installed
|
||||
* is set. */
|
||||
uint8_t installed; /**< 0 = no identity installed yet (e.g.
|
||||
* Hera/Hermes/Artemis today, before
|
||||
* D.5's per-VM-identity work lands) --
|
||||
* BINDSTEP-style checks must treat this
|
||||
* as "no lock, allow freely," matching
|
||||
* §F.9 decision 2. 1 = owner_pubkey/
|
||||
* acl_caps are real. */
|
||||
uint32_t acl_caps; /**< Capability bitmask. All-zero until a
|
||||
* real caller defines and checks a bit;
|
||||
* VM_IDENTITY_CAP_ALL for Zuse's own
|
||||
* identity ("her ACL just grants
|
||||
* everything," not a special VM type). */
|
||||
} VMIdentity;
|
||||
|
||||
/** Every capability bit set -- Zuse's own identity uses this, not a
|
||||
* distinct "is this Zuse" flag anywhere else in the system. */
|
||||
#define VM_IDENTITY_CAP_ALL 0xFFFFFFFFu
|
||||
|
||||
/**
|
||||
* vm_identity_has_cap - Check whether an installed identity holds a
|
||||
* capability. Returns 0 (denied) if identity isn't installed at all --
|
||||
* callers that mean "no lock, allow freely" (§F.9 decision 2) must check
|
||||
* installed themselves first, not call this and treat 0 as a denial in
|
||||
* that case.
|
||||
*
|
||||
* @param id Identity to check.
|
||||
* @param cap A single capability bit (or bits) to test for.
|
||||
* @return Non-zero if id is installed and every bit in cap is set.
|
||||
*/
|
||||
int vm_identity_has_cap(const VMIdentity *id, uint32_t cap);
|
||||
|
||||
#endif /* __STARKERNEL__ */
|
||||
|
||||
#endif /* STARKERNEL_VM_IDENTITY_H */
|
||||
@@ -359,6 +359,7 @@ typedef enum
|
||||
|
||||
#ifdef __STARKERNEL__
|
||||
#include "starkernel/vm_uuid.h" /* VMUuid -- item 4.2, VM.stadium_vm_id */
|
||||
#include "starkernel/vm_identity.h" /* VMIdentity -- FABRIC-3.md §F.2/§F.16 */
|
||||
|
||||
/* Saved interpreter state for VM lifecycle calls (BIRTH, VM-EXEC, START).
|
||||
* Dynamically allocated; grows on demand via sf_realloc. */
|
||||
@@ -554,6 +555,15 @@ typedef struct VM
|
||||
* ran the word, instead of item 4.1's hardcoded
|
||||
* vm_uuid_hera(). */
|
||||
/** @} */
|
||||
|
||||
/** @name Owner identity + ACL capabilities (FABRIC-3.md §F.2/§F.16)
|
||||
* @{
|
||||
*/
|
||||
VMIdentity identity; /**< This VM's owning identity. installed=0 (the
|
||||
* zero-init default) means no lock -- every
|
||||
* VM today, until D.5's per-VM-identity work
|
||||
* and CERTVERIFY/MINT actually populate it. */
|
||||
/** @} */
|
||||
#endif
|
||||
} VM;
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,19 @@
|
||||
/*
|
||||
StarForth — Steady-State Virtual Machine Runtime
|
||||
|
||||
Copyright (c) 2023–2025 Robert A. James
|
||||
All rights reserved.
|
||||
|
||||
Licensed under the StarForth License, Version 1.0
|
||||
*/
|
||||
|
||||
#ifndef __STARKERNEL__
|
||||
#error "vm_identity.c is kernel-only"
|
||||
#endif
|
||||
|
||||
#include "starkernel/vm_identity.h"
|
||||
|
||||
int vm_identity_has_cap(const VMIdentity *id, uint32_t cap) {
|
||||
if (!id || !id->installed) return 0;
|
||||
return (id->acl_caps & cap) == cap;
|
||||
}
|
||||
@@ -121,14 +121,12 @@ static void sk_repl_idle(VM *active_vm)
|
||||
* belongs on the write path, once WRITE(10) gives it something
|
||||
* to gate.
|
||||
*
|
||||
* sig_start_fblock = 0: correct for today's unpartitioned raw
|
||||
* test/real media (no GPT parser exists yet -- see
|
||||
* homeblocks_sig.h's own doc). Will need to become a real
|
||||
* GPT-partition-relative lookup once that parser lands; this is
|
||||
* the one place that changes, isolated from homeblocks_sig.c's
|
||||
* own location-agnostic check. */
|
||||
* HOMEBLOCKS_SIG_START_FBLOCK (devblock 1): the real, final
|
||||
* location -- GPT was dropped permanently, this is not an
|
||||
* interim value (FABRIC-3.md §F.8/§F.13). */
|
||||
homeblocks_sig_t sig;
|
||||
homeblocks_sig_result_t sig_rc = homeblocks_sig_check(&usb_blk_dev, 0, &sig);
|
||||
homeblocks_sig_result_t sig_rc =
|
||||
homeblocks_sig_check(&usb_blk_dev, HOMEBLOCKS_SIG_START_FBLOCK, &sig);
|
||||
switch (sig_rc) {
|
||||
case HOMEBLOCKS_SIG_OK:
|
||||
console_println("xhci: USB drive recognized as a home-blocks drive");
|
||||
|
||||
Reference in New Issue
Block a user