/* StarForth — Steady-State Virtual Machine Runtime Copyright (c) 2023–2025 Robert A. James All rights reserved. Licensed under the StarForth License, Version 1.0 */ #ifndef __STARKERNEL__ #error "capsule_zuse_boot.c is kernel-only" #endif #include "starkernel/capsule_zuse_boot.h" #include "starkernel/capsule_mint.h" #include "starkernel/zuse_genesis_marker.h" #include "starkernel/user_identity_seed.h" #include "starkernel/console.h" #include "block_subsystem.h" /* compute_crc64(), blk_meta_zone_read/write */ #include "blkio.h" #include #include /* FABRIC-2.md §I.8 (re-scoped 2026-09-04): tracks whether the currently * home-blocks-attached device is Zuse's own -- the single-USB-device * constraint (§F.8) means capsule_zuse_boot_logout() only needs one flag, * not a device/uuid comparison, to know a detach event is hers to act on * (a regular WIREBIND user occupying the one slot instead is tracked * separately, in capsule_wirebind.c -- the two paths never overlap). */ static int g_zuse_attached_this_device = 0; /* Read exactly one devblock (4096 bytes) at devblock offset `devblock`, * as 4 consecutive 1KiB forth-block reads -- mirrors capsule_runcap.c's * and homeblocks_sig_check()'s own read convention. */ static int read_devblock(struct blkio_dev *dev, uint32_t devblock, uint8_t *buf4096) { uint32_t base = devblock * 4u; for (uint32_t i = 0; i < 4u; i++) { if (blkio_read((blkio_dev_t *)dev, base + i, buf4096 + (size_t)i * BLKIO_FORTH_BLOCK_SIZE) != BLKIO_OK) { return -1; } } return 0; } static int genesis_marker_read(zuse_genesis_marker_t *out) { if (blk_meta_zone_read(0, (uint8_t *)out) != 0) return -1; if (out->magic != ZUSE_GENESIS_MARKER_MAGIC) return -1; if (out->version != ZUSE_GENESIS_MARKER_VERSION) return -1; uint64_t want_crc = compute_crc64((const uint8_t *)out, offsetof(zuse_genesis_marker_t, crc)); if (want_crc != out->crc) return -1; return 0; } static void install_and_activate(VM *mama_vm, const uint8_t seed[32], const uint8_t pubkey[32]) { /* vm_zuse_cert_install() is deliberately one-way (returns -1, no-op, * once vm->zuse_cert_installed is already 1) -- that's a real * security property (the cert/pubkey must never be re-installed or * swapped) and stays untouched here. Its return is NOT used to gate * ACL-ZUSE-BOOT below anymore (FABRIC-2.md §I.8, re-scoped * 2026-09-04): re-authenticating after capsule_zuse_boot_logout() * needs ACL-ZUSE-BOOT to re-run and re-set zuse_session even when * the cert itself was already installed from an earlier boot-time * attach -- gating it on install's success/failure made re-login * impossible, since a second install always fails by design. */ vm_zuse_cert_install(mama_vm, seed, pubkey); /* zuse.4th's ACL-ZUSE-BOOT self-activated once already at Mama's own * birth, when no cert was installed yet (the thumbdrive wasn't * attached at that early, one-shot point) -- ACL-PIN only blocks * *redefinition*, not re-execution, so re-running the same policy * word here is the correct, already-designed way to activate * zuse_session now that a cert genuinely exists. No new C-side auth * logic; policy stays in ACL.4th/zuse.4th per this project's own * convention. */ vm_interpret(mama_vm, "ACL-ZUSE-BOOT"); g_zuse_attached_this_device = 1; } void capsule_zuse_boot_try_attach(struct blkio_dev *dev, homeblocks_sig_result_t sig_rc, const homeblocks_sig_t *sig, VM *mama_vm) { if (!dev || !mama_vm) return; /* FABRIC-2.md §I.8, re-scoped 2026-09-04: gate on zuse_session, not * zuse_cert_installed. zuse_cert_installed never clears (one-way, * see install_and_activate()'s own comment) and would permanently * block re-authentication after a logout; zuse_session does clear * (capsule_zuse_boot_logout()), which is exactly the "already have * Zuse THIS SESSION" check this early-return is actually for. */ if (mama_vm->zuse_session) return; zuse_genesis_marker_t marker; int have_marker = (genesis_marker_read(&marker) == 0); if (!have_marker) { if (sig_rc != HOMEBLOCKS_SIG_BLANK) return; /* not eligible for genesis */ uint8_t seed[32], pubkey[32]; MintResult r = capsule_mint_identity(dev, (VM *)0, "Zuse", "zuse", (const char *)0, (const char *)0, pubkey, seed, 1 /* sig_rc already confirmed BLANK above */); if (r != MINT_OK) { console_println("Zuse: genesis mint failed"); return; } zuse_genesis_marker_t wm; memset(&wm, 0, sizeof(wm)); wm.magic = ZUSE_GENESIS_MARKER_MAGIC; wm.version = ZUSE_GENESIS_MARKER_VERSION; memcpy(wm.zuse_pubkey, pubkey, 32); wm.crc = compute_crc64((const uint8_t *)&wm, offsetof(zuse_genesis_marker_t, crc)); if (blk_meta_zone_write(0, (const uint8_t *)&wm) != 0) { console_println("Zuse: genesis minted but fence marker write FAILED (not persistent)"); } else { console_println("Zuse: genesis minted onto attached thumbdrive"); } install_and_activate(mama_vm, seed, pubkey); return; } /* Marker present: genesis already happened, on some thumbdrive. * Only act if THIS attach is that drive. */ if (sig_rc != HOMEBLOCKS_SIG_OK || !sig) return; if (sig->identity_src_offset == 0 || sig->identity_src_devblocks < 1) return; user_identity_seed_t idrec; if (read_devblock(dev, sig->identity_src_offset, (uint8_t *)&idrec) != 0) return; /* Same magic -> version -> CRC-64 discipline as genesis_marker_read(): * this record carries Zuse's private key (the seed), so a corrupt or * format-mismatched record must be refused, never loaded -- a bad CRC * could otherwise install a garbage seed as Zuse's identity. */ if (idrec.magic != USER_IDENTITY_SEED_MAGIC) return; if (idrec.version != USER_IDENTITY_SEED_VERSION) return; uint64_t want_crc = compute_crc64((const uint8_t *)&idrec, offsetof(user_identity_seed_t, crc)); if (want_crc != idrec.crc) return; if (memcmp(idrec.pubkey, marker.zuse_pubkey, 32) != 0) return; /* not Zuse's drive */ console_println("Zuse: identity confirmed from attached thumbdrive"); install_and_activate(mama_vm, idrec.seed, idrec.pubkey); } void capsule_zuse_boot_logout(VM *mama_vm) { if (!mama_vm || !g_zuse_attached_this_device) return; mama_vm->zuse_session = 0; g_zuse_attached_this_device = 0; console_println("Zuse: session ended -- reattach to re-authenticate"); }