Module random 

Shared guest random-state and memory operations, independent of a backend. These synchronous operations preserve draws even when a later write fails.

Structs

InitialImage

Identity of the sole initial image whose real auxv was already written. Backends must authenticate this identity before constructing a handoff.

RandomCopyFailure

A user-access random copy failed for a reason other than a guest fault.

RandomFill

One fill of guest memory from the stream: the bytes written and, in debug builds, the hash its record logs (zero in release builds, which log none).

Enums

EarlyRequest

One request a loader served before post-exec. None emits a record when served, because Detcore’s root thread does not exist yet: post-exec emits their records after the AT_RANDOM record, in the order they were served.

LimitReadCall

The syscall that made an early resource-limit read. Their records differ, as when Detcore’s own handlers serve them: prlimit64 records the read, getrlimit records nothing.

LoaderState

Authenticated loader result. Continuations carry no random state and must leave the ordinary newly constructed thread completely unchanged.

Constants

MAX_EARLY_GETRANDOM

Most getrandom fills a loader may serve before post-exec. glibc’s early initialization makes one (the malloc tcache key); the bound keeps the handoff within MAX_INITIAL_STATE_BYTES.

MAX_EARLY_LIMIT_READS

Most resource-limit reads a loader may serve before post-exec. glibc’s startup makes one (RLIMIT_STACK, for the default thread stack size); the bound keeps the handoff within MAX_INITIAL_STATE_BYTES.

MAX_INITIAL_STATE_BYTES

Fixed maximum for the backend-independent initial random-state handoff.

Functions

decode_loader_state

Decode an exact canonical, configuration- and image-bound loader result. The backend must obtain these bytes only from its authenticated callback.

encode_continuation

Encode a supervisor-authenticated legacy path without transferring RNG, clock, metadata or any auxiliary-vector completion fact.

encode_initial_state

Encode only the actual PRNG, the completed auxv identity, the bytes written there (write_initial_auxv) and the loader’s early requests (EarlyRequest), whose records are still to be emitted. No clock, metadata, chaos RNG or scheduler state is transferred.

fill_bytes

Fill guest memory from the same stream/chunk/write algorithm used by the normal Detcore handler. No syscall/scheduler accounting is performed here.

getrandom

Apply getrandom’s existing flag, length, null-buffer and fill semantics.

getrandom_unrecorded

getrandom for a loader that runs before the thread’s post-exec callback: it emits no record and returns the fill, if any, whose record getrandom would have emitted. The loader hands the fills over with encode_initial_state, and post-exec emits their records after the AT_RANDOM record, where every other backend’s handler emits them.

initialize_auxv

Draw and write the actual initial auxv bytes. A write failure preserves the consumed PRNG state, as in the normal post-exec callback.

root_prng

Construct the root guest stream from its configured seed, without creating a thread or discovering any process metadata.

write_initial_auxv

Draw and write the initial auxv bytes before the thread’s post-exec callback, emitting no record, and return them for the handoff (encode_initial_state). Post-exec then emits the record, so a run’s records come in the same order whichever backend wrote the bytes, and the root thread’s seeding records precede it on every backend.