Retire emergency CLI: Zuse goes thumbdrive-resident, ACL.4th activated
Three tightly-coupled changes, verified together per Captain Bob's own "getting rid of the emergency cli" direction: 1. Zuse's identity is thumbdrive-resident, never system-resident. New zuse_genesis_marker_t (magic/version/zuse_pubkey[32]/crc) replaces zuse_cert_devblock_t's slot in the top-of-device fence -- the system now remembers only that a root identity exists and its pubkey, never a seed. zuse_cert_devblock_t is kept in the repo, marked superseded, no longer written by any code path. capsule_mint_identity() grows a genesis mode (issuer_vm=NULL): no cert is built or written (Zuse isn't verified against a separate signer -- she's recognized by pubkey match against the marker) and two new optional out-params (out_pubkey/out_seed) let the caller install the cert immediately after a genesis mint. New capsule_zuse_boot_try_attach() (capsule_zuse_boot.c), called from sk_repl_idle() on every fresh USB attach (the only point in the boot lifecycle a thumbdrive can actually be detected -- attach polling doesn't exist yet at kernel_main.c's old one-shot mint point, which is why that whole block is gone): no marker + blank drive -> genesis-mint; marker present + matching drive -> read its own user_identity_seed_t, install the cert. Either way, re-runs ACL-ZUSE-BOOT (zuse.4th) so zuse_session activates exactly like it always has for a same-boot cert install -- ACL-PIN only blocks redefinition, not re-execution, so no new C-side auth logic needed. 2. ACL.4th activated (capsules/init.4th) -- inactive all session until now. Found and fixed a real bug this immediately surfaced: zuse.4th's ACL-ZUSE-BOOT tried `['] ACL-ZUSE-BOOT ACL-PIN` from inside its own still-compiling definition -- the word isn't findable yet at that point, so the whole definition silently failed to compile every previous boot this session (dormant, since ACL.4th never loaded). Fixed: pin after the definition closes, not from within it -- it only needs to happen once anyway, and pinning doesn't block the re-invocation genesis/attach needs. 3. The unauthenticated emergency-CLI ACL bypass is retired (repl.c): `emergency_console = is_hera ? (zuse_session ? 0 : 1) : 0` deleted from both sk_repl_step and sk_repl_run. Every word run from Hera's own bare prompt now goes through ordinary ACL enforcement; emergency_console is driven only by the genuine C-level fault handler again. Added ZUSE-SESSION? (starforth_words.c), a read-only diagnostic matching ZUSE-PUBKEY@'s own precedent, to verify the whole chain directly rather than by inference. Verified end-to-end live in QEMU: fresh boot, no thumbdrive -> ZUSE-SESSION? reads 0. Attach a genuinely blank drive via QMP -> genesis mint fires automatically (no typing) -> ZUSE-SESSION? reads -1 (true). Hermes/Artemis both birth clean on all three architectures with ACL now actually enforced for the first time all session -- no denials, no UNKNOWN WORD beyond the deliberate POST self-test cases. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD
This commit is contained in:
Robert Allan James
co-authored by
Claude Sonnet 5
Claude Sonnet 5
parent
7fc3e93358
commit
cc9521d2cc
@@ -66,8 +66,6 @@ EFI_RUNTIME_SERVICES *g_sk_runtime_services = NULL;
|
||||
#include "starkernel/pci.h"
|
||||
#include "starkernel/virtio_blk.h"
|
||||
#include "starkernel/virtio_rng.h"
|
||||
#include "starkernel/ed25519.h"
|
||||
#include "starkernel/zuse_cert_devblock.h"
|
||||
#include "starkernel/virtio_input.h"
|
||||
#include "starkernel/xhci_driver.h"
|
||||
#include "block_subsystem.h"
|
||||
@@ -607,62 +605,21 @@ static void kernel_main_deep(BootInfo *boot_info) {
|
||||
}
|
||||
}
|
||||
|
||||
/* Phase 8: Zuse first-boot mint-then-load, via the top-of-device
|
||||
* system-metadata fence (block_subsystem.h's blk_meta_zone_read()/
|
||||
* write(), FABRIC-3.md Phase 8 §C) -- NOT UEFI NVRAM. An earlier
|
||||
* NVRAM-based attempt page-faulted inside OVMF's variable service on
|
||||
* a real flash write (root-caused, documented, reverted); raw block
|
||||
* I/O against Artemis's already-proven virtio-blk device has none of
|
||||
* that risk and needs no runtime-services timing care at all. Runs
|
||||
* here, before capsule_birth_mama() below, so ACL.4th/zuse.4th's
|
||||
* self-activating ACL-ZUSE-BOOT sees a populated cert on its one,
|
||||
* ordinary first pass -- no re-invocation workaround needed this
|
||||
* time. "Mint once, ever": a valid ZUSE_CERT_DEVBLOCK_MAGIC record
|
||||
* in the fence means a prior boot already minted -- load it back
|
||||
* rather than generating a new one. Graceful no-op if there's no
|
||||
* disk-backed device or no entropy source; Zuse simply won't
|
||||
* authenticate this boot. */
|
||||
{
|
||||
zuse_cert_devblock_t rec;
|
||||
int found = 0;
|
||||
if (blk_meta_zone_read(0, (uint8_t *)&rec) == 0 &&
|
||||
rec.magic == ZUSE_CERT_DEVBLOCK_MAGIC &&
|
||||
rec.version == ZUSE_CERT_DEVBLOCK_VERSION) {
|
||||
uint64_t want_crc = compute_crc64((const uint8_t *)&rec, offsetof(zuse_cert_devblock_t, crc));
|
||||
if (want_crc == rec.crc) found = 1;
|
||||
}
|
||||
|
||||
VM *zuse_vm = (VM *)mama_vm;
|
||||
if (found) {
|
||||
if (vm_zuse_cert_install(zuse_vm, rec.seed, rec.pubkey) == 0) {
|
||||
console_println("Zuse: cert loaded from block fence");
|
||||
}
|
||||
} else if (virtio_rng_ready()) {
|
||||
uint8_t seed[32];
|
||||
if (virtio_rng_get_bytes(seed, sizeof(seed)) == 0) {
|
||||
uint8_t pubkey[32];
|
||||
ed25519_keygen(seed, pubkey);
|
||||
if (vm_zuse_cert_install(zuse_vm, seed, pubkey) == 0) {
|
||||
zuse_cert_devblock_t wrec;
|
||||
memset(&wrec, 0, sizeof(wrec));
|
||||
wrec.magic = ZUSE_CERT_DEVBLOCK_MAGIC;
|
||||
wrec.version = ZUSE_CERT_DEVBLOCK_VERSION;
|
||||
memcpy(wrec.seed, seed, 32);
|
||||
memcpy(wrec.pubkey, pubkey, 32);
|
||||
wrec.crc = compute_crc64((const uint8_t *)&wrec, offsetof(zuse_cert_devblock_t, crc));
|
||||
if (blk_meta_zone_write(0, (const uint8_t *)&wrec) == 0) {
|
||||
console_println("Zuse: minted, fuse blown");
|
||||
} else {
|
||||
console_println("Zuse: minted but fence write FAILED (not persistent)");
|
||||
}
|
||||
}
|
||||
} else {
|
||||
console_println("Zuse: entropy read failed, not minted this boot");
|
||||
}
|
||||
} else {
|
||||
console_println("Zuse: no cert and no entropy source, not minted this boot");
|
||||
}
|
||||
}
|
||||
/* Zuse identity: SUPERSEDED 2026-08-28 (FABRIC-3.md §F.20/§F.21).
|
||||
* The one-shot block-fence mint-or-load that used to run here is
|
||||
* gone -- Zuse is thumbdrive-resident now (her seed never touches
|
||||
* system storage), and a thumbdrive can't be detected this early in
|
||||
* boot anyway (USB attach polling only exists inside the REPL's own
|
||||
* idle loop, which hasn't started yet at this point). The real
|
||||
* genesis-mint/attach-authenticate logic now lives in
|
||||
* capsule_zuse_boot_try_attach() (capsule_zuse_boot.c), called from
|
||||
* sk_repl_idle() on every fresh USB attach; ACL.4th/zuse.4th's
|
||||
* ACL-ZUSE-BOOT self-activation at Mama's own birth below will see
|
||||
* no cert installed yet on a fresh boot (expected -- it gets
|
||||
* re-invoked once a matching/genesis-eligible drive actually
|
||||
* attaches). The system-resident fence slot this block used to write
|
||||
* (zuse_cert_devblock_t, devblock_from_top=0) now holds
|
||||
* zuse_genesis_marker_t instead -- pubkey only, never a seed. */
|
||||
|
||||
/* item 4.3.5c: virtio-keyboard-pci, riscv64 only today. Unconditional
|
||||
* call site, same as virtio_blk_find_artemis() above -- the function
|
||||
|
||||
Reference in New Issue
Block a user