_4kpage_gate.nx source

1// _4kpage_gate.nx -- LOCK for the FULL 3-LEVEL Sv39 walk with a 4KB-page leaf (X-PAGE-4K-001). NO mocks. 2// Proves VA 0xC0009000 resolves through ALL THREE levels (root -> L1 -> L0 -> 4KB leaf) to read the 3// sentinel, and that the walk VALIDATES the intermediate L1 level (not just the root/leaf): 4// T1 full-walk : default L1 PTE -> the 3-level walk reaches the 4KB data page -> "K4OK" 5// T2 tamper-L1 : L1 PTE V=0 (0x20000C00) -> the walk faults at level 1 -> "K4OK" never prints 6// GREEN only if T1 && T2. Evidence -> knowledge/status/paging.log (K4GATE). license_tier: ORIGINAL 7import "nx_syscalls.nx" 8 9const K4_EMIT: *u8 = "_offc/nx_4kpage_emit.elf" 10const K4_SOV: *u8 = "_offc/nx_boot_run_sov.elf" 11 12func g_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 13func g_fp(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 14func g_fn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 15 16func g_run(prog: *u8, a1: *u8, a2: *u8, outpath: *u8) -> i64 { 17 let pid: i64 = sys_fork() 18 if pid == 0 { 19 if outpath != (0 as *u8) { let ofd: i64 = sys_openat_wr(outpath, 0x1a4); if ofd >= 0 { sys_dup3(ofd, 1, 0); sys_dup3(ofd, 2, 0) } } 20 let argv: *i64 = sys_mmap(32) as *i64 21 argv[0] = prog as i64 22 var k: i64 = 1 23 if a1 != (0 as *u8) { argv[k] = a1 as i64; k = k + 1 } 24 if a2 != (0 as *u8) { argv[k] = a2 as i64; k = k + 1 } 25 argv[k] = 0 26 let envp: *i64 = sys_mmap(16) as *i64 27 envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64; envp[1] = 0 28 sys_execve(prog, argv, envp) 29 sys_exit(127) 30 } 31 let st: *i64 = sys_mmap(16) as *i64 32 sys_wait4(pid, st, 0) 33 return (st[0] >> 8) & 0xff 34} 35func g_read(path: *u8, buf: *u8, cap: i64) -> i64 { 36 let fd: i64 = sys_openat_rd(path) 37 if fd < 0 { return 0 } 38 var n: i64 = 0 39 var go: i64 = 1 40 while go == 1 { let r: i64 = sys_read(fd, (buf as i64 + n) as *u8, cap - 1 - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap - 1 { go = 0 } } 41 sys_close(fd) 42 return n 43} 44func g_has(buf: *u8, n: i64, pat: *u8, pl: i64) -> i64 { 45 if pl <= 0 { return 0 } 46 var i: i64 = 0 47 while i + pl <= n { var k: i64=0; var hit: i64=1; while k<pl { if buf[i+k]!=pat[k]{hit=0;k=pl}else{k=k+1} } if hit==1 { return 1 } i=i+1 } 48 return 0 49} 50func g_case(l1: *u8, binp: *u8, txt: *u8, buf: *u8) -> i64 { 51 g_run(K4_EMIT, l1, binp, "/tmp/_k4_emit.out" as *u8) 52 g_run(K4_SOV, binp, 0 as *u8, txt) 53 return g_read(txt, buf, 65536) 54} 55func g_row(name: *u8, pass: i64) -> i64 { g_p(" " as *u8); g_p(name); if pass==1 { g_p(" PASS\n" as *u8) } else { g_p(" FAIL\n" as *u8) } return 0 } 56 57func main() -> i64 { 58 let b: *u8 = sys_mmap(65536) 59 60 // T1 full 3-level walk -> K4OK 61 var n: i64 = g_case("0x20000C01" as *u8, "/tmp/_k4_ok.bin" as *u8, "/tmp/_k4_ok.txt" as *u8, b) 62 var t1: i64 = 0 63 if g_has(b, n, "K4OK" as *u8, 4) == 1 { if g_has(b, n, "BOOTSOV verdict=GREEN" as *u8, 21) == 1 { t1 = 1 } } 64 65 // T2 tamper L1 (V=0) -> walk faults at level 1 -> no K4OK 66 n = g_case("0x20000C00" as *u8, "/tmp/_k4_bad.bin" as *u8, "/tmp/_k4_bad.txt" as *u8, b) 67 var t2: i64 = 0 68 if g_has(b, n, "K4OK" as *u8, 4) == 0 { t2 = 1 } 69 70 var ok: i64 = 0 71 if t1 == 1 { if t2 == 1 { ok = 1 } } 72 73 g_p("4KPAGE gate (full 3-level Sv39 walk: root -> L1 -> L0 -> 4KB leaf)\n" as *u8) 74 g_row("T1 full-3-level-walk (->K4OK)" as *u8, t1) 75 g_row("T2 tamper-L1-V0 (->!K4OK) " as *u8, t2) 76 77 let lf: i64 = sys_openat_append("knowledge/status/paging.log" as *u8, 0x1a4) 78 if ok == 1 { 79 g_p("K4GATE verdict=GREEN keystone=sv39-4kb-page-3-level-walk probe=4kpage levels=root+L1+L0 leaf=4KB va=0xC0009000 tamper=L1-V0-rejected\n" as *u8) 80 if lf >= 0 { g_fp(lf, "K4GATE verdict=GREEN keystone=sv39-4kb-page-3-level-walk probe=4kpage full-3-level-walk + L1-tamper-rejected epoch=" as *u8); g_fn(lf, sys_now_realtime_sec()); g_fp(lf, "\n" as *u8); sys_close(lf) } 81 sys_exit(0); return 0 82 } 83 g_p("K4GATE verdict=RED (t1=" as *u8); g_fn(1, t1); g_p(" t2=" as *u8); g_fn(1, t2); g_p(")\n" as *u8) 84 if lf >= 0 { g_fp(lf, "K4GATE verdict=RED t1=" as *u8); g_fn(lf, t1); g_fp(lf, " t2=" as *u8); g_fn(lf, t2); g_fp(lf, "\n" as *u8); sys_close(lf) } 85 sys_exit(1) 86 return 1 87}