Robert Allan JamesandClaude Sonnet 5
2a30212bd3
Wires the previously-unused vm_log_attributed_vm() into LOG-APPEND's kernel primitive so persisted log records carry a trustworthy source (the real attributed VM's registry name, or "HADES" pseudo-source) instead of a caller-supplied, trivially forgeable string. Drops src-addr/src-u from LOG-APPEND's stack signature accordingly. Pins LOG-APPEND via bare ACL-PIN in Artemis's own init.4th, matching BIRTH/CAPSULE-BIRTH's precedent for a privileged word that can't reach the shared, host-portable ACL.4th. Also fixes two console-banner nitpicks: a mis-rendering em dash (U+2014) in the boot banner, and drops "Emergency" from the CLI banner text. Doc corrections to artemis_sig.h/zuse_eligibility_list.h reconciling the three fixed devblock ranges now in play. LOG-FLUSH (the intended normal entry point) and level-aware log eviction remain open, flagged not fixed. Re-verified clean boot to ok> on all 3 architectures after every change. riscv64 showed one new, unrelated virtio_blk write-timeout anomaly during Artemis's early physics self-test (self-recovered, boot unaffected, sector doesn't map to the log region) -- flagged, not investigated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016UNhH1mhi52i6Qihh7ZV5S
100 lines
5.3 KiB
C
100 lines
5.3 KiB
C
/*
|
|
* zuse_eligibility_list.h -- on-disk record format for Zuse's word/block
|
|
* elevation eligibility list (FABRIC-2.md §H.5/§H.12 Phase 6): a simple
|
|
* growable list of owner_pubkey[32] entries, no extra per-entry metadata
|
|
* ("simple list, no extra metadata, unless we find a reason this won't
|
|
* work"). Zuse checks this list before honoring any ELEVATE-REQUEST
|
|
* (§H.7/§H.8) -- gating layer on top of the message-based elevation
|
|
* trigger, not a replacement for it.
|
|
*
|
|
* Lives in the same top-of-device system-metadata fence as
|
|
* zuse_genesis_marker_t (block_subsystem.h's blk_meta_zone_read()/
|
|
* write(), Phase 8/§C), one slot over: the genesis marker owns
|
|
* devblock_from_top=0, this list starts at devblock_from_top=1. Growable
|
|
* across multiple devblocks via a singly-linked chain (each devblock's
|
|
* `next_devblock_from_top` points at the next one, ZULIST_NO_NEXT means
|
|
* "this is the last devblock in the chain") -- entries are appended by
|
|
* filling the current tail devblock, then chaining a fresh one out of the
|
|
* already-reserved BLK_META_FENCE_INIT budget once it's full. No fence
|
|
* growth logic is needed yet.
|
|
*
|
|
* CORRECTION (FABRIC-3.md SXXVI follow-on, Step 4, 2026-09-13): the fence
|
|
* is no longer this list's alone to grow into. artemis_sig_t now owns
|
|
* devblock_from_top=64 (include/starkernel/artemis_sig.h), and the
|
|
* per-VM log-persistence ring now owns devblock_from_top 65-96
|
|
* (include/starkernel/log_region.h) -- both fixed, compile-time
|
|
* constants, chosen deliberately clear of this list's own growth
|
|
* direction (chaining upward from devblock_from_top=1). This list's real
|
|
* remaining headroom is devblocks 1-63 (not "126 more slots" as this
|
|
* comment used to say): 63 devblocks x ZUSE_ELIGIBILITY_ENTRIES_PER_DEVBLOCK
|
|
* (127) = 8001 possible eligible identities before ever reaching
|
|
* devblock_from_top=64 -- vastly beyond any plausible real deployment of
|
|
* this project, but genuinely unenforced: there is no code-level ceiling
|
|
* stopping this chain from growing into devblock 64+ if that number were
|
|
* ever actually approached. Noted here, not silently assumed safe, after
|
|
* a fixed-offset collision was caught and fixed once already this session
|
|
* (Artemis's own disk vs. its live BAM, artemis_sig.h's own CORRECTION
|
|
* comment) -- the lesson being to state the real bound in writing rather
|
|
* than trust "it'll never get that big."
|
|
*
|
|
* Raw, unpacked 4 KiB devblock -- same convention as
|
|
* zuse_genesis_marker_t/homeblocks_sig_t: real CRC from day one, this
|
|
* gates a real security check, not a placeholder.
|
|
*/
|
|
#ifndef STARKERNEL_ZUSE_ELIGIBILITY_LIST_H
|
|
#define STARKERNEL_ZUSE_ELIGIBILITY_LIST_H
|
|
|
|
#include <stdint.h>
|
|
|
|
/* Packed via shifts, not a hand-computed hex literal -- see
|
|
* zuse_genesis_marker.h's own note on this project's standing
|
|
* numeric-constant convention. */
|
|
#define ZUSE_ELIGIBILITY_LIST_MAGIC \
|
|
((uint32_t)'Z' | ((uint32_t)'E' << 8) | ((uint32_t)'L' << 16) | ((uint32_t)'G' << 24))
|
|
|
|
#define ZUSE_ELIGIBILITY_LIST_VERSION 1u
|
|
|
|
/* devblock_from_top of this list's head devblock -- one past the genesis
|
|
* marker's devblock_from_top=0. */
|
|
#define ZUSE_ELIGIBILITY_LIST_HEAD_DEVBLOCK 1u
|
|
|
|
/* next_devblock_from_top value meaning "no further devblock -- this is
|
|
* the tail of the chain." 0xFFFFFFFF can never be a real
|
|
* devblock_from_top (BLK_META_FENCE_INIT is 128), so it is unambiguous. */
|
|
#define ZUSE_ELIGIBILITY_LIST_NO_NEXT 0xFFFFFFFFu
|
|
|
|
/* How many owner_pubkey[32] entries fit in one devblock alongside the
|
|
* header/crc/next-pointer overhead below. */
|
|
#define ZUSE_ELIGIBILITY_ENTRIES_PER_DEVBLOCK 127u
|
|
|
|
typedef struct {
|
|
uint32_t magic; /* ZUSE_ELIGIBILITY_LIST_MAGIC; anything else on
|
|
* the head devblock means "list not created
|
|
* yet" (blank/foreign bytes), not a
|
|
* format-corruption error. A non-head devblock
|
|
* is only ever read by following a real
|
|
* next_devblock_from_top link, so its own
|
|
* magic is still checked the same way to catch
|
|
* a corrupt/foreign devblock mid-chain. */
|
|
uint32_t version; /* ZUSE_ELIGIBILITY_LIST_VERSION */
|
|
uint32_t count; /* Number of valid entries in this devblock's
|
|
* own entries[] (0..ZUSE_ELIGIBILITY_ENTRIES_
|
|
* PER_DEVBLOCK), not a running total across the
|
|
* whole chain. */
|
|
uint32_t next_devblock_from_top; /* Next devblock in the chain, or
|
|
* ZUSE_ELIGIBILITY_LIST_NO_NEXT if this is the
|
|
* tail. */
|
|
uint8_t entries[ZUSE_ELIGIBILITY_ENTRIES_PER_DEVBLOCK][32]; /* Ed25519
|
|
* public keys eligible for elevation. Only the
|
|
* first `count` entries are meaningful. */
|
|
uint64_t crc; /* CRC-64/ISO (block_subsystem.h's
|
|
* compute_crc64()) over every byte of this
|
|
* struct up to (not including) this field. */
|
|
uint8_t _pad[4096 - (4 + 4 + 4 + 4 + (ZUSE_ELIGIBILITY_ENTRIES_PER_DEVBLOCK * 32) + 8)];
|
|
} zuse_eligibility_devblock_t;
|
|
|
|
_Static_assert(sizeof(zuse_eligibility_devblock_t) == 4096,
|
|
"zuse_eligibility_devblock_t must be exactly one 4 KiB devblock");
|
|
|
|
#endif /* STARKERNEL_ZUSE_ELIGIBILITY_LIST_H */
|