nx_nxe_lib.nx

buildroot/runtime/nx_nxe_lib.nx

3197 B51 linesdepth 5pulls 5 transitivereach 7 importersview sourcekind librarytopic nxe

docs dependencies structs consts functions

about

nx_nxe_lib.nx -- the SOVEREIGN NXE writer + native VERIFY-THEN-EXECUTE loader, extracted (rule-15 DRY) so both the loader gate (nx_nxe_loader) and the bootable spore (nx_spore_boot) compose ONE copy. The format is our OWN file (magic 'NXE1'), NOT an ELF clone; the loader refuses to map-exec any binary that fails integrity/capability/ never-brick -- verify-BEFORE-execute BY CONSTRUCTION. RWX-mmap + cast-fn-ptr execution is proven live (nx_nxe_exec_probe). Integrity = canonical FIPS-180-4 SHA-256 of the code section. NXE header (8-byte fields): [0]magic'NXE1' [8]ver=1 [16]arch(1=x86_64) [24]flags [32]caps [40]entry [48]code_off=96 [56]code_len [64..96]code_hash(32B SHA-256) ; code@96. flags: HW_WRITE=1 NEVER_BRICK_PROVEN=2. caps bits: FILE_READ=0 FILE_WRITE=1 NET=2 EXEC=3 RAW_HW=4. NEVER-BRICK: RAM + a file, 0 firmware writes. license_tier: ORIGINAL

dependencies 2 imports · 3 importers

imports: nx_syscalls.nxnx_sha256.nx

imported by: nx_nxe_loader.nxnx_pabi.nxnx_spore_boot.nx

structs

none

consts

13	const NXE_HOFF: i64 = 96

functions

14	func nxe_mmap_rwx(size: i64) -> u8 { let r: i64 = __syscall(SYS_MMAP, 0, size, 7, 0x22, -1, 0); return r as u8 } // PROT_RWX\|MAP_PRIV\|ANON called by 2: nxe_load_exec main
15	func nxe_p64(m: u8, o: i64, v: i64) -> i64 { var i: i64=0; while i<8 { m[o+i]=((v>>(i8))&255) as u8; i=i+1 } return 0 } called by 1: nxe_write
16	func nxe_r64(m: u8, o: i64) -> i64 { var v: i64=0; var i: i64=0; while i<8 { v=v\|((m[o+i] as i64)<<(i8)); i=i+1 } return v } called by 4: nxe_size nxe_integrity_ok nxe_may nxe_load_exec
18	func nxe_write(m: u8, arch: i64, flags: i64, caps: i64, entry: i64, code: u8, clen: i64) -> i64 called by 3: main pabi_exec build_init_nxe calls 2: nxe_p64 sha256_digest
25	func nxe_size(m: *u8) -> i64 { return NXE_HOFF + nxe_r64(m,56) } called by 2: main build_init_nxe calls 1: nxe_r64
26	func nxe_magic_ok(m: *u8) -> i64 { if m[0]==(0x4E as u8) { if m[1]==(0x58 as u8) { if m[2]==(0x45 as u8) { if m[3]==(0x31 as u8) { return 1 } } } } return 0 } called by 1: nxe_load_exec
27	func nxe_integrity_ok(m: *u8) -> i64 called by 1: nxe_load_exec calls 3: nxe_r64 sys_mmap sha256_digest
33	func nxe_may(m: *u8, capbit: i64) -> i64 { return (nxe_r64(m,32)>>capbit)&1 } called by 1: nxe_load_exec calls 1: nxe_r64
37	func nxe_load_exec(m: u8, arg: i64, resbox: i64, ranbox: *i64) -> i64 called by 5: main pabi_exec pabi_spawn spore_boot main calls 5: nxe_magic_ok nxe_integrity_ok nxe_r64 nxe_may nxe_mmap_rwx