The second half of "the OS stores itself". The store was already the kernel's; what was missing
was the kernel *saying* something of its own rather than a client doing it. At its first write of
a boot the driver now appends one record describing the boot it is having — its own version
banner, the wall-clock time, and the store device it resolved — to a reserved space, through the
same append path every other mutation uses.
Three things had to be decided, and each had a wrong answer that looked right:
WHERE IT HOOKS. "At store init" does not exist and must not be invented: there is no init-time
open, deliberately, so there is no ordering to get wrong against the block driver that provides
the device. An __initcall appending a record would reintroduce exactly that ordering problem.
The moment is the FIRST WRITE, which needs no ordering at all and is the semantically right one —
the kernel records itself when it becomes the writer. A boot in which the kernel only reads
writes no record, which is honest rather than a gap.
WHICH SPACE. 0xFD was the first choice, following the convention that a reserved space is one
repeated byte. 0xFD is the OS KEYSTORE — the space the kill switch exists to destroy — and
writing boot records into it would have been a serious bug. Only the userspace name table catches
this (format_space in crates/cube-command) because the kernel keeps no table of space names, so
the table is now written down where the constant is: 0x00 root, 0xFF edges, 0xFE portal,
0xFD keystore, 0xFC boot. The record lives at (0,0,0) in 0xFC: one record, the current boot.
WHAT IT SAYS. boot=<epoch seconds> device=<resolved path> kernel=<the version banner>, banner
last and unquoted so everything after the final = is the kernel's own words rather than a field
this code parsed. Raw epoch seconds rather than a date: rendering a calendar date in the kernel
is date arithmetic, and a caller with a clock can do it without a kernel bug being the reason a
timestamp is wrong. The banner comes from linux_banner and the time from ktime_get_real_ts64.
WHY IT IS OFF BY DEFAULT. Not caution, but an invariant. The gates' method is that the store the
kernel produces is comparable, byte for byte, with the store userspace produces from the same
mutations; a record the kernel injects that the caller never asked for would turn those
comparisons into non-comparisons. So it is cube_boot_record=1 on the kernel command line, parsed
in C beside cube_store= for the reason that parameter is in C (this kernel's Rust cannot express
a string parameter), and kernel/verify-boot-record.sh is the gate that turns it on.
A failure to record is logged and never propagated: the record is worth having and is not a
precondition for the caller's write. It is attempted once per boot rather than retried per write,
because a store that will not take it will not take it later, and one warning is information
where a stream of them is noise.
surface-camera-build
087c6b0e60