admin/LithosAnanake
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FABRIC-3.md §I.5: Milestone 7 trust tiers (QEMU-vs-real-hardware), closing it

Browse Source 
Closes the contributor-capsule/trust-tier punch-list item. Decided
direction: QEMU-vs-real-hardware conditional enforcement.

Found before building on that decision: the obvious mechanism (expose
TimerInfo.vm_mode) only works on amd64 -- aarch64 and riscv64 both had
vm_mode hardcoded to 1 unconditionally, meaning they'd always report
"running under QEMU" even on real hardware. Built real detection for
both instead of shipping that: aarch64 checks the ACPI RSDP's OEM ID
for QEMU's "BOCHS " SeaBIOS-heritage signature; riscv64 checks the
devicetree root compatible property for "qemu". Confirmed vm_mode was
otherwise unread anywhere else in either file first -- zero risk to
existing timing behavior.

CAPSULE_FLAG_CONTRIB (mkcapsule.c: FLAG_CONTRIB) path-matches on
capsules/contrib/, mirroring FLAG_MAMA_INIT's exact-match pattern.
contrib_capsule_refused() (capsule_birth.c) enforces: no additional
check under QEMU (same WARN-only as everything else); on real hardware,
a contrib capsule additionally requires CAPSULE_SIG_OK, since it has no
other provenance to fall back on. Wired into capsule_birth_baby() and
capsule_run_experiment().

Also updates §I.7 (Milestone 9): its stated precondition (Milestone 7
closing) is now met, flagged as stale rather than treated as a green
light to design networking from nothing.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the
foreground) -- compile/boot verification only; the real-hardware
enforcement branch is unverifiable from this environment, same as all
of §I.6. logs and DoE CSVs from this session's verification runs
included per this repo's own audit-artifact convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var
This commit is contained in:
Robert Allan James
2026-09-04 11:04:25 -04:00
co-authored by Claude Sonnet 5
parent 5567d03c12
commit eeceec21a5
15 changed files with 27811 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/starkernel/capsule/capsule_birth.c
+34
View File
@@ -35,6 +35,7 @@
#include "starkernel/console.h"
#include "starkernel/vm/stadium.h" /* item 4.1a -- stadium_grant_quota() */
#include "starkernel/session.h" /* session_register()/session_set_pinned() -- FABRIC-3.md §H.12 step 5 */
#include "starkernel/timer.h" /* timer_calibration_record()->vm_mode -- FABRIC-3.md §I.5 CONTRIB trust tier */
#include "vm.h"
#include "platform_alloc.h"
/* No LOG_LINE_MAX include-order constraint anymore: vm.h's own
@@ -450,6 +451,25 @@ void capsule_vm_kill_all_nonmama(void) {
}
}
/* FABRIC-3.md §I.5, 2026-09-04: contributor-capsule trust tier
* (QEMU-vs-real-hardware conditional enforcement, decided in
* conversation). CAPSULE_FLAG_CONTRIB capsules get the same WARN-only
* treatment as everything else under QEMU (timer_calibration_record()->
* vm_mode == 1) -- development/test is meant to run contrib capsules
* freely. On real hardware (vm_mode == 0), a contrib capsule additionally
* requires CAPSULE_SIG_OK -- MISSING/NO_ROOT_KEY, which stay WARN-only
* for every other capsule (no offline signing key on most machines,
* see capsule_birth_mama()'s own comment), are refused here specifically
* because a contributor's capsule has no other provenance to fall back
* on the way this project's own capsules do. Never touches the
* CAPSULE_SIG_INVALID refusal already in place for every capsule --
* additive, not a replacement. */
static int contrib_capsule_refused(uint32_t flags, CapsuleSigResult sr) {
if (!(flags & CAPSULE_FLAG_CONTRIB)) return 0;
if (timer_calibration_record()->vm_mode) return 0; /* QEMU: relaxed */
return sr != CAPSULE_SIG_OK; /* real hardware: must actually verify */
}
/*===========================================================================
* Mama Init
*===========================================================================*/
@@ -569,6 +589,13 @@ CapsuleRunResult capsule_birth_baby(
names[idx].name, capsule_sig_result_str(sr));
if (sr == CAPSULE_SIG_INVALID) return CAPSULE_RUN_ERR_INVALID;
}
/* FABRIC-3.md §I.5: contrib trust tier -- see contrib_capsule_
* refused()'s own doc comment. */
if (contrib_capsule_refused(cap->flags, sr)) {
log_message(LOG_WARN, "capsule sig: %s: contrib capsule refused on real hardware (%s)",
names[idx].name, capsule_sig_result_str(sr));
return CAPSULE_RUN_ERR_INVALID;
}
}
if (vm_registry_live_count() >= stadium_max_vm_count()) {
@@ -759,6 +786,13 @@ CapsuleRunResult capsule_run_experiment(
names[idx].name, capsule_sig_result_str(sr));
if (sr == CAPSULE_SIG_INVALID) return CAPSULE_RUN_ERR_INVALID;
}
/* FABRIC-3.md §I.5: contrib trust tier -- see contrib_capsule_
* refused()'s own doc comment. */
if (contrib_capsule_refused(cap->flags, sr)) {
log_message(LOG_WARN, "capsule sig: %s: contrib capsule refused on real hardware (%s)",
names[idx].name, capsule_sig_result_str(sr));
return CAPSULE_RUN_ERR_INVALID;
}
}
uint64_t pre_dict_hash = vm_dict_hash_fn(mama_vm);