ohhhhhhhhhhh (exclude linux-extra-rootfs.img build artifact)

CODE/UTSM/crypto/blake2b.c

@@ -0,0 +1,137 @@
+/* blake2b.c — BLAKE2b（RFC 7693）实现
+ *
+ * 12 轮、128B 块、64-bit G 函数（旋转 32/24/16/63）。
+ * keyed 模式：init 时将 key 填充为首个 128B 块（RFC 7693 §2.3），
+ * update/final 沿用引用实现语义（惰性缓冲 + 计数器含 key 块）。
+ */
+
+#include <utsm/blake2b.h>
+
+static const u64 blake2b_iv[8] = {
+    0x6a09e667f3bcc908ULL, 0xbb67ae8584caa73bULL,
+    0x3c6ef372fe94f82bULL, 0xa54ff53a5f1d36f1ULL,
+    0x510e527fade682d1ULL, 0x9b05688c2b3e6c1fULL,
+    0x1f83d9abfb41bd6bULL, 0x5be0cd19137e2179ULL
+};
+
+static const u8 blake2b_sigma[10][16] = {
+    { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
+    { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
+    { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
+    { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
+    { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
+    { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
+    { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
+    { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
+    { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
+    { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 }
+};
+
+static inline u64 rotr64(u64 v, u32 c) {
+    return (v >> c) | (v << (64 - c));
+}
+
+#define B2B_G(v, a, b, c, d, x, y) do {                      \
+    (v)[a] = (v)[a] + (v)[b] + (x); (v)[d] = rotr64((v)[d] ^ (v)[a], 32); \
+    (v)[c] = (v)[c] + (v)[d];       (v)[b] = rotr64((v)[b] ^ (v)[c], 24); \
+    (v)[a] = (v)[a] + (v)[b] + (y); (v)[d] = rotr64((v)[d] ^ (v)[a], 16); \
+    (v)[c] = (v)[c] + (v)[d];       (v)[b] = rotr64((v)[b] ^ (v)[c], 63); \
+} while (0)
+
+static void blake2b_compress(utsm_blake2b_ctx *ctx, const u8 *block) {
+    u64 m[16];
+    u64 v[16];
+
+    for (int i = 0; i < 16; i++) {
+        m[i] = utsm_load64_le(block + 8 * i);
+    }
+    for (int i = 0; i < 8; i++) {
+        v[i] = ctx->h[i];
+        v[i + 8] = blake2b_iv[i];
+    }
+    v[12] ^= ctx->t[0];
+    v[13] ^= ctx->t[1];
+    if (ctx->last_block) {
+        v[14] ^= ~(u64)0;
+    }
+
+    for (int r = 0; r < 12; r++) {
+        const u8 *s = blake2b_sigma[r % 10];
+        B2B_G(v, 0, 4, 8, 12, m[s[0]], m[s[1]]);
+        B2B_G(v, 1, 5, 9, 13, m[s[2]], m[s[3]]);
+        B2B_G(v, 2, 6, 10, 14, m[s[4]], m[s[5]]);
+        B2B_G(v, 3, 7, 11, 15, m[s[6]], m[s[7]]);
+        B2B_G(v, 0, 5, 10, 15, m[s[8]], m[s[9]]);
+        B2B_G(v, 1, 6, 11, 12, m[s[10]], m[s[11]]);
+        B2B_G(v, 2, 7, 8, 13, m[s[12]], m[s[13]]);
+        B2B_G(v, 3, 4, 9, 14, m[s[14]], m[s[15]]);
+    }
+
+    for (int i = 0; i < 8; i++) {
+        ctx->h[i] ^= v[i] ^ v[i + 8];
+    }
+}
+
+void utsm_blake2b_init(utsm_blake2b_ctx *ctx, u32 out_len, const void *key, u32 key_len) {
+    if (out_len == 0 || out_len > UTSM_BLAKE2B_MAXOUT) out_len = UTSM_BLAKE2B_MAXOUT;
+    if (key_len > 64u) key_len = 64u;
+
+    for (int i = 0; i < 8; i++) ctx->h[i] = blake2b_iv[i];
+    ctx->h[0] ^= 0x01010000ULL ^ ((u64)key_len << 8) ^ (u64)out_len;
+    ctx->t[0] = 0;
+    ctx->t[1] = 0;
+    ctx->out_len = out_len;
+    ctx->buf_len = 0;
+    ctx->last_block = 0;
+
+    if (key && key_len > 0u) {
+        const u8 *k = (const u8 *)key;
+        for (u32 i = 0; i < key_len; i++) ctx->buf[i] = k[i];
+        for (u32 i = key_len; i < 128u; i++) ctx->buf[i] = 0;
+        ctx->buf_len = 128u;    /* key 块挂起，随首个 update/final 压缩 */
+    }
+}
+
+void utsm_blake2b_update(utsm_blake2b_ctx *ctx, const void *data, u64 len) {
+    const u8 *in = (const u8 *)data;
+
+    while (len > 0) {
+        u32 left = ctx->buf_len;
+        u32 fill = UTSM_BLAKE2B_BLOCKBYTES - left;
+
+        if (len > (u64)fill) {
+            for (u32 i = 0; i < fill; i++) ctx->buf[left + i] = in[i];
+            ctx->t[0] += 128;
+            if (ctx->t[0] < 128) ctx->t[1]++;
+            blake2b_compress(ctx, ctx->buf);
+            ctx->buf_len = 0;
+            in += fill;
+            len -= fill;
+        } else {
+            for (u64 i = 0; i < len; i++) ctx->buf[left + i] = in[i];
+            ctx->buf_len += (u32)len;
+            return;
+        }
+    }
+}
+
+void utsm_blake2b_final(utsm_blake2b_ctx *ctx, void *out) {
+    ctx->t[0] += ctx->buf_len;
+    if (ctx->t[0] < (u64)ctx->buf_len) ctx->t[1]++;
+    ctx->last_block = 1;
+
+    for (u32 i = ctx->buf_len; i < UTSM_BLAKE2B_BLOCKBYTES; i++) ctx->buf[i] = 0;
+    blake2b_compress(ctx, ctx->buf);
+
+    u8 tmp[64];
+    for (int i = 0; i < 8; i++) utsm_store64_le(tmp + 8 * i, ctx->h[i]);
+    u8 *o = (u8 *)out;
+    for (u32 i = 0; i < ctx->out_len; i++) o[i] = tmp[i];
+}
+
+void utsm_blake2b(const void *data, u64 len, const void *key, u32 key_len, void *out, u32 out_len) {
+    utsm_blake2b_ctx ctx;
+    utsm_blake2b_init(&ctx, out_len, key, key_len);
+    utsm_blake2b_update(&ctx, data, len);
+    utsm_blake2b_final(&ctx, out);
+}

CODE/UTSM/crypto/blake2b.d

@@ -0,0 +1,4 @@
+crypto/blake2b.o: crypto\blake2b.c include\utsm\blake2b.h \
+  include\utsm\types.h
+include\utsm\blake2b.h:
+include\utsm\types.h:

CODE/UTSM/crypto/chacha20.c

@@ -0,0 +1,60 @@
+/* chacha20.c — ChaCha20 block function（RFC 8439 §2.3）
+ *
+ * block function = 20 轮纯 ARX（无 message word 吸收；sigma 表仅用于
+ * 带明文的加密模式）。UTSM 用途：1 block = 1×64B cache line keystream。
+ *   counter = 0（整条 line 只消费一个 block）
+ *   nonce   = tweak（低 32 位在前，高 32 位在后，第三字为 0）
+ * 纯 32-bit 整数运算，-mno-sse 下可用。
+ */
+
+#include <utsm/blake2b.h>
+#include <utsm/crypto.h>
+
+static const u32 chacha_iv[4] = {
+    0x61707865u, 0x3320646eu, 0x79622d32u, 0x6b206574u
+};
+
+static inline u32 rotl32(u32 v, u32 c) {
+    return (v << c) | (v >> (32 - c));
+}
+
+static void chacha_qr(u32 *v, int a, int b, int c, int d) {
+    v[a] += v[b]; v[d] ^= v[a]; v[d] = rotl32(v[d], 16);
+    v[c] += v[d]; v[b] ^= v[c]; v[b] = rotl32(v[b], 12);
+    v[a] += v[b]; v[d] ^= v[a]; v[d] = rotl32(v[d], 8);
+    v[c] += v[d]; v[b] ^= v[c]; v[b] = rotl32(v[b], 7);
+}
+
+void utsm_chacha20_block(const u32 key_words[8], u64 nonce, u64 counter, u8 out[64]) {
+    u32 st[16];
+    u32 v[16];
+
+    st[0] = chacha_iv[0];
+    st[1] = chacha_iv[1];
+    st[2] = chacha_iv[2];
+    st[3] = chacha_iv[3];
+    for (int i = 0; i < 8; i++) st[4 + i] = key_words[i];
+    st[12] = (u32)counter;
+    st[13] = (u32)(counter >> 32);
+    st[14] = (u32)nonce;
+    st[15] = (u32)(nonce >> 32);
+
+    for (int i = 0; i < 16; i++) v[i] = st[i];
+
+    for (int r = 0; r < 10; r++) {
+        /* column rounds */
+        chacha_qr(v, 0, 4, 8, 12);
+        chacha_qr(v, 1, 5, 9, 13);
+        chacha_qr(v, 2, 6, 10, 14);
+        chacha_qr(v, 3, 7, 11, 15);
+        /* diagonal rounds */
+        chacha_qr(v, 0, 5, 10, 15);
+        chacha_qr(v, 1, 6, 11, 12);
+        chacha_qr(v, 2, 7, 8, 13);
+        chacha_qr(v, 3, 4, 9, 14);
+    }
+
+    for (int i = 0; i < 16; i++) {
+        utsm_store32_le(out + 4 * i, v[i] + st[i]);
+    }
+}

CODE/UTSM/crypto/chacha20.d

@@ -0,0 +1,6 @@
+crypto/chacha20.o: crypto\chacha20.c include\utsm\blake2b.h \
+  include\utsm\types.h include\utsm\crypto.h include\utsm\uuid.h
+include\utsm\blake2b.h:
+include\utsm\types.h:
+include\utsm\crypto.h:
+include\utsm\uuid.h:

CODE/UTSM/crypto/kdf.c

@@ -1,19 +1,31 @@
-#include <utsm/crypto.h>
-#include <utsm/drr.h>
+/* kdf.c — 段密钥派生（Phase 9：keyed BLAKE2b）
+ *
+ * segment_key = BLAKE2b-256(key=root_key, "UTSMSEGK"||p_uuid||s_uuid||key_epoch)
+ * root key 不直接加密数据；UUID 作为派生调谐因子（非明文密钥）。
+ * 确定性：同 (puuid, suuid, epoch) 恒得同 key —— PCKC 缓存正确性依赖此性质。
+ */
 
-static u64 mix64(u64 x) {
-    x ^= x >> 30;
-    x *= 0xbf58476d1ce4e5b9ULL;
-    x ^= x >> 27;
-    x *= 0x94d049bb133111ebULL;
-    x ^= x >> 31;
-    return x;
-}
+#include <utsm/crypto.h>
+#include <utsm/blake2b.h>
+#include <utsm/drr.h>
 
 void utsm_kdf_segment_key(uuid128_t process_uuid, uuid128_t segment_uuid, u64 key_epoch, utsm_key_material *out_key) {
     const u64 *root = drr_get_root_key();
-    out_key->words[0] = mix64(root[0] ^ process_uuid.hi ^ segment_uuid.lo ^ key_epoch);
-    out_key->words[1] = mix64(root[1] ^ process_uuid.lo ^ segment_uuid.hi ^ (key_epoch << 1));
-    out_key->words[2] = mix64(root[2] ^ process_uuid.hi ^ segment_uuid.hi ^ (key_epoch << 7));
-    out_key->words[3] = mix64(root[3] ^ process_uuid.lo ^ segment_uuid.lo ^ (key_epoch << 13));
+
+    u8 root_le[32];
+    u8 data[8 + 8 + 8 + 8 + 8];
+    u8 digest[32];
+
+    for (int i = 0; i < 4; i++) utsm_store64_le(root_le + 8 * i, root[i]);
+
+    utsm_store64_le(data + 0, 0x4B4745534D535455ULL);   /* "UTSMSEGK" LE */
+    utsm_store64_le(data + 8, process_uuid.hi);
+    utsm_store64_le(data + 16, process_uuid.lo);
+    utsm_store64_le(data + 24, segment_uuid.hi);
+    utsm_store64_le(data + 32, segment_uuid.lo);
+    utsm_store64_le(data + 40, key_epoch);
+
+    utsm_blake2b(data, sizeof(data), root_le, 32, digest, 32);
+
+    for (int i = 0; i < 4; i++) out_key->words[i] = utsm_load64_le(digest + 8 * i);
 }

CODE/UTSM/crypto/kdf.d

@@ -1,7 +1,9 @@
 crypto/kdf.o: crypto\kdf.c include\utsm\crypto.h include\utsm\types.h \
-  include\utsm\uuid.h include\utsm\drr.h include\utsm\config.h
+  include\utsm\uuid.h include\utsm\blake2b.h include\utsm\drr.h \
+  include\utsm\config.h
 include\utsm\crypto.h:
 include\utsm\types.h:
 include\utsm\uuid.h:
+include\utsm\blake2b.h:
 include\utsm\drr.h:
 include\utsm\config.h:

CODE/UTSM/crypto/mac.c

@@ -0,0 +1,32 @@
+/* mac.c — 4KB 密文页 MAC（Phase 9：keyed BLAKE2b）
+ *
+ * page_mac = BLAKE2b-256(key=root_key, "UTSMPAGE"||seg_slot||page_index||key_epoch||cipher_page)[0..8)
+ * 绑定页归属（段/页号/纪元），防密文页在段间移位或跨纪元重放。
+ * 用途：DRR checkpoint 快照完整性 / rollback 校验（替换 CRC64 占位 MAC）。
+ */
+
+#include <utsm/crypto.h>
+#include <utsm/blake2b.h>
+#include <utsm/config.h>
+
+u64 utsm_page_mac(const u64 *root_key, u32 seg_slot, u64 page_index, u64 key_epoch, const void *page) {
+    u8 root_le[32];
+    u8 ctx_data[8 + 4 + 4 + 8 + 8];
+    u8 digest[32];
+
+    for (int i = 0; i < 4; i++) utsm_store64_le(root_le + 8 * i, root_key[i]);
+
+    utsm_store64_le(ctx_data + 0, 0x454741504D535455ULL);   /* "UTSMPAGE" LE */
+    utsm_store32_le(ctx_data + 8, seg_slot);
+    utsm_store32_le(ctx_data + 12, 0);
+    utsm_store64_le(ctx_data + 16, page_index);
+    utsm_store64_le(ctx_data + 24, key_epoch);
+
+    utsm_blake2b_ctx c;
+    utsm_blake2b_init(&c, 32, root_le, 32);
+    utsm_blake2b_update(&c, ctx_data, sizeof(ctx_data));
+    utsm_blake2b_update(&c, page, UTSM_PAGE_SIZE);
+    utsm_blake2b_final(&c, digest);
+
+    return utsm_load64_le(digest);
+}

CODE/UTSM/crypto/mac.d

@@ -0,0 +1,7 @@
+crypto/mac.o: crypto\mac.c include\utsm\crypto.h include\utsm\types.h \
+  include\utsm\uuid.h include\utsm\blake2b.h include\utsm\config.h
+include\utsm\crypto.h:
+include\utsm\types.h:
+include\utsm\uuid.h:
+include\utsm\blake2b.h:
+include\utsm\config.h:

CODE/UTSM/crypto/stream.c

@@ -1,19 +1,26 @@
+/* stream.c — 64B cache line 流加密（Phase 9：ChaCha20）
+ *
+ * ct = pt XOR ChaCha20_block(segment_key, nonce=tweak, counter=0)
+ * 1 block = 1 line；加密解密同函数（XOR 流）。
+ * nonce 唯一性：(segment_key 全局唯一) × (line_index 段内唯一)，
+ * key_epoch 混入 key 派生，故同 (key,nonce) 只生成一次 keystream。
+ */
+
 #include <utsm/crypto.h>
+#include <utsm/blake2b.h>
 #include <utsm/config.h>
 
-static u64 next_stream_word(u64 x) {
-    x ^= x << 13;
-    x ^= x >> 7;
-    x ^= x << 17;
-    return x;
-}
-
 void utsm_crypt_line(const utsm_key_material *key, u64 tweak, const u8 *in, u8 *out) {
-    u64 state = key->words[0] ^ key->words[1] ^ key->words[2] ^ key->words[3] ^ tweak;
-    for (u64 i = 0; i < UTSM_CACHE_LINE_SIZE; i += 8) {
-        state = next_stream_word(state + i + 0xa5a5a5a5a5a5a5a5ULL);
-        for (u64 j = 0; j < 8; j++) {
-            out[i + j] = in[i + j] ^ (u8)(state >> (j * 8));
-        }
+    u32 kw[8];
+    for (int i = 0; i < 4; i++) {
+        kw[2 * i] = (u32)(key->words[i] & 0xFFFFFFFFu);
+        kw[2 * i + 1] = (u32)(key->words[i] >> 32);
+    }
+
+    u8 ks[64];
+    utsm_chacha20_block(kw, tweak, 0, ks);
+
+    for (u32 i = 0; i < UTSM_CACHE_LINE_SIZE; i++) {
+        out[i] = in[i] ^ ks[i];
     }
 }

CODE/UTSM/crypto/stream.d

@@ -1,6 +1,8 @@
 crypto/stream.o: crypto\stream.c include\utsm\crypto.h \
-  include\utsm\types.h include\utsm\uuid.h include\utsm\config.h
+  include\utsm\types.h include\utsm\uuid.h include\utsm\blake2b.h \
+  include\utsm\config.h
 include\utsm\crypto.h:
 include\utsm\types.h:
 include\utsm\uuid.h:
+include\utsm\blake2b.h:
 include\utsm\config.h:

CODE/UTSM/crypto/tweak.d

@@ -1,5 +0,0 @@
-crypto/tweak.o: crypto\tweak.c include\utsm\crypto.h include\utsm\types.h \
-  include\utsm\uuid.h
-include\utsm\crypto.h:
-include\utsm\types.h:
-include\utsm\uuid.h: