Module register 

Single-writer registers: recovery layer 1 (docs/rhdl_ubft-recovery-design.md).

Problem. Consistent broadcast needs memory that each replica owns, every replica can read, and a read can’t see half a write. RDMA writes of several words reach memory in pieces, so a reader racing a writer can see a mix of an old and a new value.

First attempt, and why it failed. The first version followed uBFT (LPD-EPFL/ubft 504eba0, swmr/): a checksum over incarnation and value, and a read was valid when the checksum matched. Atlas found two payloads with the same checksum at the same incarnation, so a read mixing their words looks complete. That works with whole-word tearing, and with whole 64-byte beats (tests/register_integrity.rs). No checksum fixes this: the payload is partly chosen by others (a broadcaster’s signature, stored in an honest receiver’s register), so anyone who knows the function can aim for a collision. uBFT’s XXH3 has the same weakness in principle.

Idea. Tag every word with the write it belongs to. A subslot is an incarnation word, then the payload packed 24 bits per word, each word carrying the incarnation’s low 8 bits on top:

word 0:  incarnation (32 bits)
word j:  [tag(incarnation) | 24 payload bits]      j = 1 .. S − 1
tag(i) = 0x80 | (i & 0x7f)

A read is valid only if every word’s tag equals tag of the incarnation word. The tag’s top bit is always set, so zeroed memory never matches a tag. (An independent review found the first version, which used the incarnation’s low byte, accepted an all-zero subslot under incarnation 256.) A read mixing words of two writes has mismatched tags whatever the payload, so nobody can choose values to get one through. As in uBFT, there are two subslots, the incarnation’s parity picks the one to write, and the reader keeps the valid subslot with the higher incarnation.

Assumptions (stated here; they must be enforced by future layer-2 engines, which do not exist yet; these kernels cannot enforce them):

• a 32-bit aligned word is written and read whole (the AXI strobe unit);
• tags repeat every 128 incarnations (64 writes to one subslot), so the incarnation must advance by exactly one per write (no caller-chosen jumps), and a read must not overlap more than one write. The writer starts a write at least COOLDOWN cycles after the previous one became visible, and a reader accepts a sample only if its whole span, queues included, is strictly less than COOLDOWN cycles (the strict audit’s bound; then mixed subslots differ by two generations). Without those engines the tags alias: a mix of writes 1 and 129 (or 257) of one subslot passes (review witnesses, agent/ubft-register-generation 0f323f3). uBFT has the same kind of timing rule (a 1 ms write cooldown).
• Open (review finding): with replicated registers, a memory host that missed 128 or more updates can hold a subslot whose mix of an old and a new write shares a tag. Logical incarnations alone cannot rule that out. The fix planned for layer 2 is a physical generation per host, stamped by that host’s trusted receive path on every applied write and checked by readers, distinct from the logical incarnation.

Incarnation 0 means “never written”. Cleared memory has incarnation 0 and so never reads as a value.

Cost. Payload density is 24/32: a 64-byte signature takes 22 words plus the incarnation word.

Structs

RegisterInspection

Value selection and fault observation answer different questions. Identical valid subslots can supply a value while still revealing a same-host tie.

Constants

CHUNK_BITS

Payload bits per tagged word.

Functions

inspect_register

Inspect one host’s pair without losing the distinction between a usable identical copy and a contradictory pair. Never compare different hosts here.

pack_subslot

A subslot for incarnation holding v. S must be subslot_words(W).

select_register

The register read from its two subslots a (subslot 0) and b: whether either is valid, the higher valid incarnation, and its value. Equal valid generations with different decoded payloads are ambiguous and return invalid/default. Identical copies remain acceptable. This comparison is within one host’s register; equal generations across hosts are normal.

subslot_of

Which subslot a write of incarnation goes to (0 or 1, by parity).

subslot_words

Words in a subslot holding w 32-bit payload words: the incarnation word plus ⌈32w / 24⌉ tagged words.

unpack_subslot

One subslot as read: whether every word belongs to one write, and the payload.