admin/LithosAnanake
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(kernel): Zuse's drive check without a VM

Browse Source 
capsule_zuse_boot_check() makes the check capsule_zuse_boot_try_attach()
made -- the genesis marker, the drive's identity record (magic, version,
CRC-64, public key) -- and says HERS, GENESIS or NOT_HERS, with no VM;
capsule_zuse_boot_root_pubkey() reads the marker's key. try_attach and
load_root_pubkey call them; their behaviour and messages are unchanged.
The v4 boot will make the same check (identity gate plan, D1).

Shown on v3 (system=v3, amd64): the minted pair, "Zuse: identity
confirmed" and [zuse@Hera] ok> (logs/20261026-083603); a blank pair,
"Zuse: genesis minted onto attached thumbdrive" (logs/20261026-084729).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
rajames
2026-10-26 08:48:17 -04:00
co-authored by Claude Opus 5.5
parent 5b181458df
commit 75785fb025
6 changed files with 18138 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel/src/capsule/capsule_zuse_boot.c
+52 -28
View File
@@ -113,10 +113,57 @@ static void install_and_activate(VM *mama_vm, struct blkio_dev *dev,
* "ACL-ZUSE-BOOT") above already sets. Nothing to call here anymore. */
}
/* The check, with no VM (split out 2026-10-26 so the v4 boot makes the same
* one: docs/v4.0.0/plans/2026-10-26-engine-step4-identity-gate.md, D1). */
zuse_drive_t capsule_zuse_boot_check(struct blkio_dev *dev,
homeblocks_sig_result_t sig_rc,
const homeblocks_sig_t *sig,
uint8_t seed[32], uint8_t pubkey[32]) {
zuse_genesis_marker_t marker;
if (!dev) return ZUSE_DRIVE_NOT_HERS;
if (genesis_marker_read(&marker) != 0) {
/* no marker: a blank drive is eligible for genesis, nothing else is */
return sig_rc == HOMEBLOCKS_SIG_BLANK ? ZUSE_DRIVE_GENESIS : ZUSE_DRIVE_NOT_HERS;
}
/* Marker present: genesis already happened, on some thumbdrive.
* Only this drive if it is that drive. */
if (sig_rc != HOMEBLOCKS_SIG_OK || !sig) return ZUSE_DRIVE_NOT_HERS;
if (sig->identity_src_offset == 0 || sig->identity_src_devblocks < 1) return ZUSE_DRIVE_NOT_HERS;
user_identity_seed_t idrec;
if (read_devblock(dev, sig->identity_src_offset, (uint8_t *)&idrec) != 0) return ZUSE_DRIVE_NOT_HERS;
/* Same magic -> version -> CRC-64 discipline as genesis_marker_read():
* this record carries Zuse's private key (the seed), so a corrupt or
* format-mismatched record must be refused, never loaded -- a bad CRC
* could otherwise install a garbage seed as Zuse's identity. */
if (idrec.magic != USER_IDENTITY_SEED_MAGIC) return ZUSE_DRIVE_NOT_HERS;
if (idrec.version != USER_IDENTITY_SEED_VERSION) return ZUSE_DRIVE_NOT_HERS;
uint64_t want_crc = compute_crc64((const uint8_t *)&idrec,
offsetof(user_identity_seed_t, crc));
if (want_crc != idrec.crc) return ZUSE_DRIVE_NOT_HERS;
if (memcmp(idrec.pubkey, marker.zuse_pubkey, 32) != 0) return ZUSE_DRIVE_NOT_HERS; /* not Zuse's drive */
memcpy(seed, idrec.seed, 32);
memcpy(pubkey, idrec.pubkey, 32);
return ZUSE_DRIVE_HERS;
}
int capsule_zuse_boot_root_pubkey(uint8_t pubkey[32]) {
zuse_genesis_marker_t marker;
if (genesis_marker_read(&marker) != 0) return -1; /* no genesis yet */
memcpy(pubkey, marker.zuse_pubkey, 32);
return 0;
}
void capsule_zuse_boot_try_attach(struct blkio_dev *dev,
homeblocks_sig_result_t sig_rc,
const homeblocks_sig_t *sig,
VM *mama_vm) {
uint8_t seed[32], pubkey[32];
zuse_drive_t which;
if (!dev || !mama_vm) return;
/* FABRIC-2.md §I.8, re-scoped 2026-09-04: gate on zuse_session, not
* zuse_cert_installed. zuse_cert_installed never clears (one-way,
@@ -126,13 +173,9 @@ void capsule_zuse_boot_try_attach(struct blkio_dev *dev,
* Zuse THIS SESSION" check this early-return is actually for. */
if (mama_vm->zuse_session) return;
zuse_genesis_marker_t marker;
int have_marker = (genesis_marker_read(&marker) == 0);
which = capsule_zuse_boot_check(dev, sig_rc, sig, seed, pubkey);
if (!have_marker) {
if (sig_rc != HOMEBLOCKS_SIG_BLANK) return; /* not eligible for genesis */
uint8_t seed[32], pubkey[32];
if (which == ZUSE_DRIVE_GENESIS) {
MintResult r = capsule_mint_identity(dev, (VM *)0, "Zuse", "zuse",
(const char *)0, (const char *)0,
pubkey, seed,
@@ -159,26 +202,10 @@ void capsule_zuse_boot_try_attach(struct blkio_dev *dev,
return;
}
/* Marker present: genesis already happened, on some thumbdrive.
* Only act if THIS attach is that drive. */
if (sig_rc != HOMEBLOCKS_SIG_OK || !sig) return;
if (sig->identity_src_offset == 0 || sig->identity_src_devblocks < 1) return;
user_identity_seed_t idrec;
if (read_devblock(dev, sig->identity_src_offset, (uint8_t *)&idrec) != 0) return;
/* Same magic -> version -> CRC-64 discipline as genesis_marker_read():
* this record carries Zuse's private key (the seed), so a corrupt or
* format-mismatched record must be refused, never loaded -- a bad CRC
* could otherwise install a garbage seed as Zuse's identity. */
if (idrec.magic != USER_IDENTITY_SEED_MAGIC) return;
if (idrec.version != USER_IDENTITY_SEED_VERSION) return;
uint64_t want_crc = compute_crc64((const uint8_t *)&idrec,
offsetof(user_identity_seed_t, crc));
if (want_crc != idrec.crc) return;
if (memcmp(idrec.pubkey, marker.zuse_pubkey, 32) != 0) return; /* not Zuse's drive */
if (which != ZUSE_DRIVE_HERS) return;
console_println("Zuse: identity confirmed from attached thumbdrive");
install_and_activate(mama_vm, dev, idrec.seed, idrec.pubkey);
install_and_activate(mama_vm, dev, seed, pubkey);
}
void capsule_zuse_boot_logout(VM *mama_vm, struct blkio_dev *dev) {
@@ -203,9 +230,6 @@ struct blkio_dev *capsule_zuse_boot_attached_dev(void) {
void capsule_zuse_boot_load_root_pubkey(VM *mama_vm) {
if (!mama_vm || mama_vm->zuse_root_pubkey_known) return;
zuse_genesis_marker_t marker;
if (genesis_marker_read(&marker) != 0) return; /* no genesis yet -- nothing to load */
memcpy(mama_vm->zuse_root_pubkey, marker.zuse_pubkey, 32);
if (capsule_zuse_boot_root_pubkey(mama_vm->zuse_root_pubkey) != 0) return; /* no genesis yet -- nothing to load */
mama_vm->zuse_root_pubkey_known = 1;
}