Reorganize source tree: kernel/, v3/, v4/ split and board infrastructure
Source tree reorganization: - Move StarForth v3 engine to v3/ (src/, include/, Makefile) - Move kernel to kernel/ (src/, include/, linker/, Makefile) - Create v4/ skeleton for F18-ISA golden model (DECOMPOSITION.md, JUSTIFICATION.md) - Move FABRIC-0..4.md to docs/fabric/ - Move ONTOLOGY.md and ROADMAP.md to docs/ Board infrastructure: - Add boards/ser5/, boards/raspi/, boards/milkv/, boards/zynq7020/ - Each board has board.mk (ISA, CPU flags, boot recipe) and README.md - Root Makefile becomes thin dispatcher: boot_image, all, clean, docs take TARGET - make boot_image TARGET=SER5|RASPI|MILKV builds one GPT/MBR image per board - ZYNQ7020 target exists but stops with clear error (ARMv7 port not built yet) - scripts/mkdiskimage.sh builds disk images for all boards Docs pipeline: - docs/book/ with LaTeX master (main.tex) and Makefile - pandoc converts Markdown to LaTeX at build time - Two Lua filters: table-widths.lua (wide tables wrap), code-breaks.lua (inline code breaks) - make docs builds single PDF (754 pages, 0 missing characters) - make docs TARGET=<board> adds board appendix - build/docs/<book|board>/meta.tex stamps git commit into PDF Bug fixes: - 42 include paths that only worked by accident now use correct relative paths - clang-18 hardcode replaced with configurable CC variable (fixed aarch64 build) - Pi 5: kernel_2712.img linked at 0x80000, .bss zeroed, memory reserved - Doxyfile, .clang-tidy, README.md, Kconfig paths updated Verified: - Hosted v3 build passes 1012 tests, 0 failures - SER5 image boots in QEMU (OVMF), POST passes, K exact (65536 = Q48_ONE) - Milk-V image boots in QEMU (OpenSBI + U-Boot + bootefi), POST passes - make clean TARGET=<board> removes only that board and its ISA objects - make all builds all boards, hosted v3, and docs in one run Co-authored-by: Junie <junie@jetbrains.com>
This commit is contained in:
rajames
@@ -0,0 +1,125 @@
|
||||
/*
|
||||
StarForth — Steady-State Virtual Machine Runtime
|
||||
|
||||
Copyright (c) 2023–2025 Robert A. James
|
||||
All rights reserved.
|
||||
|
||||
This file is part of the StarForth project.
|
||||
|
||||
Licensed under the StarForth License, Version 1.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
|
||||
You may obtain a copy of the License at:
|
||||
https://github.com/star.4th@proton.me/StarForth/LICENSE.txt
|
||||
|
||||
This software is provided "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
express or implied, including but not limited to the warranties of
|
||||
merchantability, fitness for a particular purpose, and noninfringement.
|
||||
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
/**
|
||||
* vm_identity.h - Per-VM owner identity + ACL capabilities (FABRIC-2.md
|
||||
* §F.2/§F.16, decided 2026-08-27/28)
|
||||
*
|
||||
* Holds only what a VM needs to prove *who owns it* and *what that owner
|
||||
* is allowed to do* -- never a private key. A regular VM's lock never
|
||||
* signs anything itself, so no seed/private material belongs here at all
|
||||
* (unlike Zuse's own zuse_cert_seed/zuse_cert_pubkey pair, which does need
|
||||
* one because she actively signs). Deliberately its own header rather
|
||||
* than inline fields on struct VM, mirroring VMUuid's own precedent
|
||||
* (vm_uuid.h) -- standing instruction: give real-shaped data its own
|
||||
* header and integrate as a field, don't grow struct VM ad hoc.
|
||||
*
|
||||
* acl_caps is a capability bitmask, not an ordered privilege tier
|
||||
* (decided 2026-08-28) -- independent bits, not a nested hierarchy. Zuse
|
||||
* is not a structurally special VM: her identity just has every bit set.
|
||||
* No bit values are assigned yet -- deliberate slack, per this project's
|
||||
* "flexibility until we understand the recipe" precedent (see
|
||||
* blk_meta_t's own acl_reserved bytes, FABRIC-2.md §F.4) -- real bits get
|
||||
* names only once the operation they gate actually gets built (BINDSTEP,
|
||||
* MINT, ...), not speculatively here.
|
||||
*/
|
||||
|
||||
#ifndef STARKERNEL_VM_IDENTITY_H
|
||||
#define STARKERNEL_VM_IDENTITY_H
|
||||
|
||||
#ifdef __STARKERNEL__
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stddef.h>
|
||||
|
||||
typedef struct {
|
||||
uint8_t owner_pubkey[32]; /**< Ed25519 public key of this VM's owning
|
||||
* identity. Meaningless unless installed
|
||||
* is set. */
|
||||
uint8_t installed; /**< 0 = no identity installed yet (e.g.
|
||||
* Hera/Hermes/Artemis today, before
|
||||
* D.5's per-VM-identity work lands) --
|
||||
* BINDSTEP-style checks must treat this
|
||||
* as "no lock, allow freely," matching
|
||||
* §F.9 decision 2. 1 = owner_pubkey/
|
||||
* acl_caps are real. */
|
||||
uint32_t acl_caps; /**< Capability bitmask. All-zero until a
|
||||
* real caller defines and checks a bit;
|
||||
* VM_IDENTITY_CAP_ALL for Zuse's own
|
||||
* identity ("her ACL just grants
|
||||
* everything," not a special VM type). */
|
||||
} VMIdentity;
|
||||
|
||||
/** Every capability bit set -- Zuse's own identity uses this, not a
|
||||
* distinct "is this Zuse" flag anywhere else in the system. */
|
||||
#define VM_IDENTITY_CAP_ALL 0xFFFFFFFFu
|
||||
|
||||
/**
|
||||
* vm_identity_has_cap - Check whether an installed identity holds a
|
||||
* capability. Returns 0 (denied) if identity isn't installed at all --
|
||||
* callers that mean "no lock, allow freely" (§F.9 decision 2) must check
|
||||
* installed themselves first, not call this and treat 0 as a denial in
|
||||
* that case.
|
||||
*
|
||||
* @param id Identity to check.
|
||||
* @param cap A single capability bit (or bits) to test for.
|
||||
* @return Non-zero if id is installed and every bit in cap is set.
|
||||
*/
|
||||
int vm_identity_has_cap(const VMIdentity *id, uint32_t cap);
|
||||
|
||||
/**
|
||||
* vm_identity_from_cert - CERTVERIFY (FABRIC-2.md §F.7/§F.17): verify a
|
||||
* DER-encoded, Zuse-signed X.509 cert and populate a VMIdentity from it.
|
||||
*
|
||||
* Three checks, all must pass: the cert's own signature verifies against
|
||||
* issuer_pubkey (Zuse's own on-device key -- a separate trust root from
|
||||
* the capsule-PKI chain, no chain walk needed); the cert's serialNumber
|
||||
* equals drive_uuid byte-for-byte (binds this cert to one physical drive,
|
||||
* §F.7 decision 2 -- a copied cert on different media will not verify);
|
||||
* the subject's Ed25519 public key extracts cleanly.
|
||||
*
|
||||
* acl_caps is *not* read from the cert -- nothing in the decided cert
|
||||
* fields encodes capabilities (§F.16). It's supplied by the caller, whose
|
||||
* job it is to decide what this verified identity is allowed to do (e.g.
|
||||
* comparing the extracted pubkey against Zuse's own system-resident
|
||||
* pubkey to decide VM_IDENTITY_CAP_ALL vs. a lesser default) -- that
|
||||
* policy decision doesn't belong inside a pure verification function.
|
||||
*
|
||||
* @param out Populated on success; left untouched on failure.
|
||||
* @param der DER-encoded certificate bytes.
|
||||
* @param der_len Their length.
|
||||
* @param issuer_pubkey Zuse's own Ed25519 public key.
|
||||
* @param drive_uuid This physical drive's own 16-byte drive_uuid
|
||||
* (homeblocks_sig_t), compared against the cert's
|
||||
* serialNumber.
|
||||
* @param acl_caps Capability bitmask to install, caller-decided.
|
||||
* @return 0 on success, -1 if any check fails (malformed DER, wrong
|
||||
* signature algorithm, signature doesn't verify, serial mismatch,
|
||||
* or the extracted key isn't a valid Ed25519 point).
|
||||
*/
|
||||
int vm_identity_from_cert(VMIdentity *out, const uint8_t *der, size_t der_len,
|
||||
const uint8_t issuer_pubkey[32],
|
||||
const uint8_t drive_uuid[16], uint32_t acl_caps);
|
||||
|
||||
#endif /* __STARKERNEL__ */
|
||||
|
||||
#endif /* STARKERNEL_VM_IDENTITY_H */
|
||||
Reference in New Issue
Block a user