Phase D: RUNCAP -- runtime capsule construction from thumbdrive content
capsule_runcap_birth() (new capsule_runcap.h/.c): builds a heap-only, single-entry CapsuleDirHeader + CapsuleDesc + CapsuleNameEntry + arena from a home-blocks drive's identity_src region (skipping the first devblock, reserved for MINT's user_identity_seed_t record) and hands it to the existing, unmodified capsule_birth_baby() -- no new birth mechanism, matching FABRIC-3.md §F.6's own trace. Found and closed a real gap in that trace along the way: capsule_birth_baby()'s signature check calls capsule_get_signatures(), which unconditionally returns the compile-time-baked global array -- meaningless for a heap-built directory, where index 0 would compare RUNCAP's own content against whatever real capsule happens to occupy that slot in the baked array (guaranteed-wrong, not a security check). Added an explicit skip_pki_sig flag (0 for all 4 existing call sites, 1 for RUNCAP): that content's trust comes from CERTVERIFY, a separate root, not the capsule-PKI chain. Also found live: capsule_birth_baby() never sets the registry entry's own .name (every existing caller does this itself afterward via capsule_vm_registry_set_name() -- RUNCAP now does too), and capsule_exec_payload() requires a "Block NNNN" header per chunk of content or it's silently skipped, never executed -- not a bug, but necessary context for whoever authors MINT's default personality content next. Added a small accessor pair (repl.h/.c) exposing the currently attached home-blocks device/sig -- the same gap F.9's own BINDSTEP scoping had already flagged, needed by both. Verified end-to-end live in QEMU: synthetic identity-source content written directly to a thumbdrive image's raw devblocks (no capsule build, no mkcapsule) was read, compiled, and executed by a genuinely new VM via a diagnostic RUNCAP-TEST word -- confirmed via VM-EXEC invoking a word defined only in that source. Clean 3-architecture regression boot (no RUNCAP drive attached) confirms no side effects. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD
This commit is contained in:
Robert Allan James
co-authored by
Claude Sonnet 5
Claude Sonnet 5
parent
75311967a7
commit
e1e839258d
@@ -39,6 +39,7 @@
|
||||
#include "platform_alloc.h"
|
||||
#include "starkernel/capsule.h"
|
||||
#include "starkernel/capsule_birth.h"
|
||||
#include "starkernel/capsule_runcap.h"
|
||||
#include "starkernel/capsule_loader.h"
|
||||
#include "starkernel/capsule_run.h"
|
||||
#include "starkernel/capsule_loader.h"
|
||||
@@ -294,6 +295,7 @@ void mama_word_birth(VM *vm)
|
||||
capsule_get_descriptors(),
|
||||
capsule_get_names(),
|
||||
capsule_get_arena(),
|
||||
0, /* skip_pki_sig: normal build-time capsule */
|
||||
&new_vm_id,
|
||||
(void **)0
|
||||
);
|
||||
@@ -768,6 +770,51 @@ static void mama_word_vm_call(VM *vm)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief RUNCAP-TEST ( caddr u -- ok? rc )
|
||||
* Diagnostic-only word (FABRIC-3.md §F.6/§F.18): calls
|
||||
* capsule_runcap_birth() against whatever drive sk_repl_get_homeblocks_
|
||||
* dev()/sig() currently report, naming the new VM from the given string.
|
||||
* Not the real RUNCAP call site -- that's WIREBIND (still unbuilt); this
|
||||
* exists to exercise capsule_runcap_birth() live before WIREBIND exists.
|
||||
* ok? is 1/0; rc is the raw CapsuleRunResult for diagnosis either way.
|
||||
*/
|
||||
static void mama_word_runcap_test(VM *vm)
|
||||
{
|
||||
char vm_name[VM_NAME_MAX];
|
||||
cell_t u, caddr;
|
||||
uint32_t i;
|
||||
|
||||
if (vm->dsp < 1) { vm->error = 1; return; }
|
||||
u = vm_pop(vm);
|
||||
caddr = vm_pop(vm);
|
||||
|
||||
if (u <= 0 || (uint32_t)u >= VM_NAME_MAX) {
|
||||
console_println("RUNCAP-TEST: name too long or empty");
|
||||
vm_push(vm, 0); vm_push(vm, (cell_t)CAPSULE_RUN_ERR_INVALID);
|
||||
return;
|
||||
}
|
||||
{
|
||||
const uint8_t *p = vm_ptr(vm, (vaddr_t)caddr);
|
||||
if (!p) { vm->error = 1; return; }
|
||||
for (i = 0; i < (uint32_t)u; i++) vm_name[i] = (char)p[i];
|
||||
}
|
||||
vm_name[u] = '\0';
|
||||
|
||||
struct blkio_dev *dev = sk_repl_get_homeblocks_dev();
|
||||
const homeblocks_sig_t *sig = sk_repl_get_homeblocks_sig();
|
||||
if (!dev || !sig) {
|
||||
console_println("RUNCAP-TEST: no home-blocks drive attached");
|
||||
vm_push(vm, 0); vm_push(vm, (cell_t)CAPSULE_RUN_ERR_INVALID);
|
||||
return;
|
||||
}
|
||||
|
||||
VMUuid new_vm_id;
|
||||
CapsuleRunResult r = capsule_runcap_birth(dev, sig, vm_name, &new_vm_id, (void **)0);
|
||||
vm_push(vm, r == CAPSULE_RUN_OK ? 1 : 0);
|
||||
vm_push(vm, (cell_t)r);
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief CAPSULE-BIRTH ( capsule-id -- vm-id-hi vm-id-lo )
|
||||
* Birth a baby VM from a production (p) capsule.
|
||||
@@ -798,6 +845,7 @@ void mama_word_capsule_birth(VM *vm)
|
||||
capsule_get_descriptors(),
|
||||
capsule_get_names(),
|
||||
capsule_get_arena(),
|
||||
0, /* skip_pki_sig: normal build-time capsule */
|
||||
&new_vm_id,
|
||||
(void **)0 /* Don't need VM context back */
|
||||
);
|
||||
@@ -991,6 +1039,7 @@ static void mama_word_connect_artemis(VM *vm __attribute__((unused)))
|
||||
capsule_get_descriptors(),
|
||||
capsule_get_names(),
|
||||
capsule_get_arena(),
|
||||
0, /* skip_pki_sig: normal build-time capsule */
|
||||
&new_vm_id, (void **)0);
|
||||
console_set_vm_name(saved);
|
||||
|
||||
@@ -1062,6 +1111,7 @@ static void mama_word_connect_hermes(VM *vm __attribute__((unused)))
|
||||
capsule_get_descriptors(),
|
||||
capsule_get_names(),
|
||||
capsule_get_arena(),
|
||||
0, /* skip_pki_sig: normal build-time capsule */
|
||||
&new_vm_id, (void **)0);
|
||||
console_set_vm_name(saved);
|
||||
|
||||
@@ -1118,6 +1168,7 @@ void register_mama_forth_words(VM *vm)
|
||||
register_word(vm, "CAPSULE-LEN@", mama_word_capsule_len_fetch);
|
||||
register_word(vm, "CAPSULE-BIRTH", mama_word_capsule_birth);
|
||||
register_word(vm, "CAPSULE-RUN", mama_word_capsule_run);
|
||||
register_word(vm, "RUNCAP-TEST", mama_word_runcap_test);
|
||||
register_word(vm, "MAMA-VM-ID", mama_word_mama_vm_id);
|
||||
register_word(vm, "VM-COUNT", mama_word_vm_count);
|
||||
register_word(vm, "VM-CONSERVED?", mama_word_vm_conserved);
|
||||
@@ -1147,6 +1198,7 @@ void register_mama_forth_words(VM *vm)
|
||||
register_word(vm, "CAPSULE-LEN@", mama_word_capsule_len_fetch);
|
||||
register_word(vm, "CAPSULE-BIRTH", mama_word_capsule_birth);
|
||||
register_word(vm, "CAPSULE-RUN", mama_word_capsule_run);
|
||||
register_word(vm, "RUNCAP-TEST", mama_word_runcap_test);
|
||||
register_word(vm, "MAMA-VM-ID", mama_word_mama_vm_id);
|
||||
register_word(vm, "VM-COUNT", mama_word_vm_count);
|
||||
register_word(vm, "VM-CONSERVED?", mama_word_vm_conserved);
|
||||
|
||||
Reference in New Issue
Block a user