Robert Allan JamesandClaude Sonnet 5
309e792f07
The kernel's ed25519_verify() is deliberately verify-only -- no signing, no keygen, no entropy source. That conflicts with the on-device MINT word vision (Zuse signing new user certs live at runtime), so this reopens that constraint on request rather than reshaping MINT around verify-only. vm_uuid.h already found the real gap: amd64 has RDRAND, riscv64 has Zkr, but QEMU's aarch64 CPU models have neither -- confirmed against QEMU 10.2.1. A deterministic PRNG (fine for VM UUIDs) is not safe for key generation, so this adds a virtio-rng device instead of a per-arch split: real host entropy, identical guest-side protocol on all three arches. New src/starkernel/virtio/virtio_rng.c + include/starkernel/virtio_rng.h, transport plumbing mirroring the existing virtio_blk.c driver exactly. Wired into kernel_main.c boot, -device virtio-rng-pci added to all three QEMU targets. Verified live (temp probe, written/run/captured/reverted): 16 real bytes pulled through the full request/notify/poll round trip on all three arches, three different values confirming real entropy. Final boot against the reverted, permanent code: clean compile, clean boot to ok> on amd64/aarch64/riscv64, Stadium conservation intact, no panics or guest errors. Ed25519 keygen/signing itself (Phase B) and the MINT word design (Phase C) remain open, documented in FABRIC-3.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01U14ET9CWAtbQMbYqomKgXd
59 lines
2.1 KiB
C
59 lines
2.1 KiB
C
/*
|
|
* virtio_rng.h — Virtio 1.0 entropy source driver for StarKernel
|
|
*
|
|
* Real hardware/host entropy, uniformly across all three architectures.
|
|
* Exists specifically because this kernel has no per-arch RNG that covers
|
|
* all three ISAs: amd64 has RDRAND and riscv64 has the Zkr extension, but
|
|
* QEMU's aarch64 CPU models (including "max") expose neither RNDR nor any
|
|
* other RNG property (checked directly against QEMU 10.2.1, see
|
|
* vm_uuid.h's identical finding). A paravirtualized virtio-rng device
|
|
* sidesteps the per-ISA gap entirely: the host supplies the entropy, the
|
|
* guest-side protocol is identical on all three arches.
|
|
*
|
|
* QEMU-only: there is no virtio-rng on real hardware (Milestone 8, bare-
|
|
* metal boot). A real per-arch RNG driver is a separate, later problem.
|
|
*
|
|
* Only one virtio-rng device is supported.
|
|
*/
|
|
|
|
#ifndef STARKERNEL_VIRTIO_RNG_H
|
|
#define STARKERNEL_VIRTIO_RNG_H
|
|
|
|
#include <stddef.h>
|
|
#include <stdint.h>
|
|
|
|
/* virtio PCI vendor (shared with every virtio device) */
|
|
#define VIRTIO_RNG_PCI_VENDOR_ID 0x1AF4u
|
|
/* device IDs: virtio device id 4 (entropy source) */
|
|
#define VIRTIO_RNG_DEVICE_MODERN 0x1044u
|
|
#define VIRTIO_RNG_DEVICE_LEGACY 0x1005u
|
|
|
|
/*
|
|
* virtio_rng_init — locate the virtio-rng device on the PCI bus and bring
|
|
* the driver up. Call once, before the first virtio_rng_get_bytes() call.
|
|
*
|
|
* Returns 0 on success.
|
|
* Returns -1 if no virtio-rng device was found on the PCI bus.
|
|
* Returns -2 on driver initialisation failure (bad BAR, queue setup, etc.).
|
|
*/
|
|
int virtio_rng_init(void);
|
|
|
|
/*
|
|
* virtio_rng_ready — 1 if virtio_rng_init() has already succeeded.
|
|
*/
|
|
int virtio_rng_ready(void);
|
|
|
|
/*
|
|
* virtio_rng_get_bytes — fill buf with n bytes of real host-supplied
|
|
* entropy, blocking (polling) until all n bytes are obtained. The device
|
|
* may return fewer bytes than requested per request; this loops
|
|
* internally until the buffer is full.
|
|
*
|
|
* Returns 0 on success (buf fully filled).
|
|
* Returns -1 if virtio_rng_init() has not succeeded.
|
|
* Returns -2 on a device/timeout error partway through.
|
|
*/
|
|
int virtio_rng_get_bytes(uint8_t *buf, size_t n);
|
|
|
|
#endif /* STARKERNEL_VIRTIO_RNG_H */
|