_driver_exceed_gate.nx source

1// _driver_exceed_gate.nx -- gate for DRIVER-EXCEEDS-LINUX (X-DRV-W3). Enforces NO-OVERCLAIM. 2// 3// (1) AUTHORED -- runs the REAL nx_driver_exceed; it must exit GREEN (>=1 measured win, no blob). 4// (2) NO-OVERCLAIM (the core W3 discipline) -- the throughput-blockio + latency-per-io rows MUST 5// be OPEN, never WIN (we have no common substrate with a real Linux driver, so a perf "win" 6// would be a wave). POSITIVE control: the real panel's perf rows carry no WIN. NEGATIVE 7// control: a synthetic panel that marks a perf row WIN MUST be caught as an overclaim (proves 8// the check bites -- it is not a rubber stamp). 9// (3) MEASURED-WIN RE-DERIVE -- at least one WIN, and its basis re-derives from the artifact: the 10// minimal-standalone-tcb value equals the ACTUAL stat of _drv_proto_blk.bin (re-measured here), 11// and the retarget basis (bound_working=2) is present in driver_bind.log. A win not backed by 12// a re-derivable artifact value is rejected. 13// 14// NATIVE-STORE MIGRATION (operator directive 2026-06-20 "stop using tsv, nishi ecosystem only"): 15// the panel is no longer parsed from a flat .tsv. This gate is SELF-CONTAINED -- it MEASURES the 16// same real artifacts the organ measures (re-stat _drv_proto_blk.bin = standalone-tcb bytes, 17// re-confirm bound_working=2 in driver_bind.log), SEEDS those measured rows into a fresh 18// content-addressed seg_store under /tmp, and runs every check by reading that NATIVE store via 19// nx_native_config (ncfg). The negative control seeds a SEPARATE tampered store (a perf-WIN) and 20// proves the same check flags it. No TSV, no SQL -- nishi ecosystem only. 21// 22// Evidence -> knowledge/status/driver_exceed.log (DRVEXCEEDGATE row). Sovereign. license_tier: ORIGINAL 23import "nx_syscalls.nx" 24import "nx_native_config.nx" 25 26const GX_ORGAN: *u8 = "_offc/nx_driver_exceed.elf" 27const GX_BLK: *u8 = "runtime/_hdl_build/_drv_proto_blk.bin" 28const GX_BIND: *u8 = "knowledge/status/driver_bind.log" 29 30func g_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 31func g_fp(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 32func g_fn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 33 34func g_run(prog: *u8, outpath: *u8) -> i64 { 35 let pid: i64 = sys_fork() 36 if pid == 0 { 37 if outpath != (0 as *u8) { let ofd: i64 = sys_openat_wr(outpath, 0x1a4); if ofd >= 0 { sys_dup3(ofd, 1, 0); sys_dup3(ofd, 2, 0) } } 38 let argv: *i64 = sys_mmap(16) as *i64 39 argv[0] = prog as i64; argv[1] = 0 40 let envp: *i64 = sys_mmap(16) as *i64 41 envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64; envp[1] = 0 42 sys_execve(prog, argv, envp) 43 sys_exit(127) 44 } 45 let st: *i64 = sys_mmap(16) as *i64 46 sys_wait4(pid, st, 0) 47 let sig: i64 = st[0] & 0x7f 48 if sig != 0 { return 128 + sig } 49 return (st[0] >> 8) & 0xff 50} 51 52func g_read(path: *u8, buf: *u8, cap: i64) -> i64 { 53 let fd: i64 = sys_openat_rd(path) 54 if fd < 0 { return 0 } 55 var n: i64 = 0 56 var go: i64 = 1 57 while go == 1 { let r: i64 = sys_read(fd, (buf as i64 + n) as *u8, cap - 1 - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap - 1 { go = 0 } } 58 sys_close(fd) 59 return n 60} 61 62func g_strlen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 63func g_streq(a: *u8, b: *u8) -> i64 { var i: i64=0; while a[i]!=(0 as u8){ if a[i]!=b[i]{return 0} i=i+1 } if b[i]!=(0 as u8){return 0} return 1 } 64 65func g_has(buf: *u8, n: i64, pat: *u8, pl: i64) -> i64 { 66 if pl <= 0 { return 0 } 67 var i: i64 = 0 68 while i + pl <= n { 69 var k: i64 = 0; var hit: i64 = 1 70 while k < pl { if buf[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } } 71 if hit == 1 { return 1 } 72 i = i + 1 73 } 74 return 0 75} 76func g_hasz(buf: *u8, n: i64, pat: *u8) -> i64 { return g_has(buf, n, pat, g_strlen(pat)) } 77 78// does a NUL-terminated value `hay` contain the NUL-terminated `pat`? 1/0 79func g_strstr(hay: *u8, pat: *u8) -> i64 { 80 if (hay as i64) == 0 { return 0 } 81 return g_has(hay, g_strlen(hay), pat, g_strlen(pat)) 82} 83 84func g_itoa(v: i64, out: *u8) -> i64 { 85 var m: i64 = v; if m < 0 { m = 0 - m } 86 let t: *u8 = sys_mmap(28); var k: i64 = 0 87 if m == 0 { t[0] = 48; k = 1 } 88 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 89 var i: i64 = 0; while i < k { out[i] = t[k-1-i]; i = i + 1 } 90 out[k] = 0 as u8; return k 91} 92 93// fresh unique native store prefix per run. 94func g_fresh_prefix(out: *u8, base: *u8) -> i64 { 95 var po: i64 = 0 96 while base[po] != (0 as u8) { out[po] = base[po]; po = po + 1 } 97 var m: i64 = sys_now_ms() 98 let ds: *u8 = sys_mmap(28) 99 var k: i64 = 0 100 if m == 0 { ds[0] = 48 as u8; k = 1 } 101 while m > 0 { ds[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 102 var j: i64 = 0 103 while j < k { out[po] = ds[k - 1 - j]; po = po + 1; j = j + 1 } 104 out[po] = 45 as u8; po = po + 1 105 out[po] = 0 as u8 106 return po 107} 108 109// author one panel row (axis,nishi,incumbent,verdict,evidence) into the native store. 110func g_panel_row(w: *i64, idx: i64, axis: *u8, nishi: *u8, incumbent: *u8, verdict: *u8, evidence: *u8) -> i64 { 111 let keys: *i64 = sys_mmap(8 * 8) as *i64 112 let vals: *i64 = sys_mmap(8 * 8) as *i64 113 keys[0] = ("axis\x00") as i64; vals[0] = (axis as i64) 114 keys[1] = ("nishi\x00") as i64; vals[1] = (nishi as i64) 115 keys[2] = ("incumbent\x00") as i64; vals[2] = (incumbent as i64) 116 keys[3] = ("verdict\x00") as i64; vals[3] = (verdict as i64) 117 keys[4] = ("evidence\x00") as i64; vals[4] = (evidence as i64) 118 return ncfg_add_row(w, "panel\x00" as *u8, idx, keys, vals, 5) 119} 120 121// seed the REAL panel (5 rows) into the native store. data-derived cells come from MEASURED args: 122// tcb_nishi = "<nbytes>B-raw-rv64-no-kernel/libc/blob" (re-stat), retarget=1 -> driver-logic-form WIN. 123func g_seed_real(prefix: *u8, tcb_nishi: *u8, retarget: i64) -> i64 { 124 let w: *i64 = ncfg_begin() 125 var lf_verdict: *u8 = "OPEN\x00" as *u8 126 if retarget == 1 { lf_verdict = "WIN\x00" as *u8 } 127 g_panel_row(w, 0, "driver-logic-form\x00" as *u8, "DATA-op-list-spec(43-ops,retargetable-0-recompile)\x00" as *u8, "hand-written-C(.ko-per-driver,recompile)\x00" as *u8, lf_verdict, "driver_bind.log:bound_working=2(W2)\x00" as *u8) 128 g_panel_row(w, 1, "minimal-standalone-tcb\x00" as *u8, tcb_nishi, "kernel-resident-C(not-standalone)\x00" as *u8, "WIN\x00" as *u8, "stat+no-ELF-magic\x00" as *u8) 129 g_panel_row(w, 2, "firmware-blob-freedom\x00" as *u8, "0-blobs\x00" as *u8, "virtio-blk-also-0(paravirtual)\x00" as *u8, "TIE\x00" as *u8, "spec-blob-scan\x00" as *u8) 130 g_panel_row(w, 3, "throughput-blockio\x00" as *u8, "OPEN\x00" as *u8, "OPEN\x00" as *u8, "OPEN\x00" as *u8, "no-common-substrate(emu-vs-real)-NOT-CLAIMED\x00" as *u8) 131 g_panel_row(w, 4, "latency-per-io\x00" as *u8, "OPEN\x00" as *u8, "OPEN\x00" as *u8, "OPEN\x00" as *u8, "no-common-substrate(emu-vs-real)-NOT-CLAIMED\x00" as *u8) 132 ncfg_set_count(w, "panel\x00" as *u8, 5) 133 return ncfg_commit(prefix, w) 134} 135 136// seed a TAMPERED panel: throughput-blockio fabricates a WIN (the overclaim the gate must catch). 137func g_seed_tamper(prefix: *u8) -> i64 { 138 let w: *i64 = ncfg_begin() 139 g_panel_row(w, 0, "throughput-blockio\x00" as *u8, "fast\x00" as *u8, "slow\x00" as *u8, "WIN\x00" as *u8, "fabricated\x00" as *u8) 140 g_panel_row(w, 1, "latency-per-io\x00" as *u8, "OPEN\x00" as *u8, "OPEN\x00" as *u8, "OPEN\x00" as *u8, "ok\x00" as *u8) 141 ncfg_set_count(w, "panel\x00" as *u8, 2) 142 return ncfg_commit(prefix, w) 143} 144 145// find the row whose axis==want; copy field `field` (NUL-term) into out. 1=found, 0=not. 146func g_field_of_axis(h: *i64, want: *u8, field: *u8, out: *u8) -> i64 { 147 let cnt: i64 = ncfg_count(h, "panel\x00" as *u8) 148 let rk: *i64 = sys_mmap(8 * 8) as *i64 149 let rv: *i64 = sys_mmap(8 * 8) as *i64 150 var i: i64 = 0 151 while i < cnt { 152 let rf: i64 = ncfg_row(h, "panel\x00" as *u8, i, rk, rv, 8) 153 if rf > 0 { 154 let ab: *u8 = ncfg_field(rk, rv, rf, "axis\x00" as *u8) 155 if (ab as i64) != 0 { if g_streq(ab, want) == 1 { 156 let fb: *u8 = ncfg_field(rk, rv, rf, field) 157 var j: i64 = 0 158 if (fb as i64) != 0 { while fb[j] != (0 as u8) { out[j] = fb[j]; j = j + 1 } } 159 out[j] = 0 as u8 160 return 1 161 } } 162 } 163 i = i + 1 164 } 165 out[0] = 0 as u8 166 return 0 167} 168 169// is the verdict of row axis==want equal to "WIN"? 1/0 (0 if row absent) 170func g_axis_verdict_is_win(h: *i64, want: *u8) -> i64 { 171 let vb: *u8 = sys_mmap(64) 172 if g_field_of_axis(h, want, "verdict\x00" as *u8, vb) == 0 { return 0 } 173 if g_streq(vb, "WIN\x00" as *u8) == 1 { return 1 } 174 return 0 175} 176 177// does ANY row in the native panel carry verdict==WIN? 1/0 178func g_any_win(h: *i64) -> i64 { 179 let cnt: i64 = ncfg_count(h, "panel\x00" as *u8) 180 let rk: *i64 = sys_mmap(8 * 8) as *i64 181 let rv: *i64 = sys_mmap(8 * 8) as *i64 182 var i: i64 = 0 183 while i < cnt { 184 let rf: i64 = ncfg_row(h, "panel\x00" as *u8, i, rk, rv, 8) 185 if rf > 0 { 186 let vb: *u8 = ncfg_field(rk, rv, rf, "verdict\x00" as *u8) 187 if (vb as i64) != 0 { if g_streq(vb, "WIN\x00" as *u8) == 1 { return 1 } } 188 } 189 i = i + 1 190 } 191 return 0 192} 193 194func main() -> i64 { 195 g_p("=== driver-exceed gate (X-DRV-W3: no-overclaim measured panel, NATIVE store) ===\n" as *u8) 196 let lfd: i64 = sys_openat_append("knowledge/status/driver_exceed.log" as *u8, 0x1a4) 197 198 // (1) AUTHORED: run the real organ. 199 let ost: i64 = g_run(GX_ORGAN, "/tmp/_dxgate_organ.out" as *u8) 200 var authored: i64 = 0 201 if ost == 0 { authored = 1 } 202 203 // ---- MEASURE the same artifacts the organ measures (re-derive basis) ---- 204 let ib: *u8 = sys_mmap(65536) 205 let nbytes: i64 = g_read(GX_BLK, ib, 65536) // standalone-tcb bytes (re-stat) 206 let bindb: *u8 = sys_mmap(262144) 207 let bindn: i64 = g_read(GX_BIND, bindb, 262144) 208 var retarget: i64 = 0 209 if g_hasz(bindb, bindn, "bound_working=2" as *u8) == 1 { retarget = 1 } 210 211 // build the measured minimal-standalone-tcb nishi cell: "<nbytes>B-raw-rv64-no-kernel/libc/blob" 212 let tcb: *u8 = sys_mmap(64) 213 let nbn: i64 = g_itoa(nbytes, tcb) 214 let suf: *u8 = "B-raw-rv64-no-kernel/libc/blob\x00" as *u8 215 var si: i64 = 0 216 while suf[si] != (0 as u8) { tcb[nbn + si] = suf[si]; si = si + 1 } 217 tcb[nbn + si] = 0 as u8 218 219 // ---- SEED the REAL panel into a fresh native store, then OPEN it ---- 220 let rp: *u8 = sys_mmap(256); g_fresh_prefix(rp, "/tmp/dxpanel-real-\x00" as *u8) 221 var seed_ok: i64 = 0 222 if g_seed_real(rp, tcb, retarget) == 0 { seed_ok = 1 } 223 let h: *i64 = ncfg_open(rp) 224 225 // (2a) NO-OVERCLAIM positive control: perf rows carry NO win in the native panel. 226 var noover_real: i64 = 0 227 let tput_win: i64 = g_axis_verdict_is_win(h, "throughput-blockio\x00" as *u8) 228 let lat_win: i64 = g_axis_verdict_is_win(h, "latency-per-io\x00" as *u8) 229 if tput_win == 0 { if lat_win == 0 { noover_real = 1 } } 230 231 // (2b) NO-OVERCLAIM negative control: a synthetic panel marking a perf row WIN MUST be caught. 232 let tp: *u8 = sys_mmap(256); g_fresh_prefix(tp, "/tmp/dxpanel-tamper-\x00" as *u8) 233 g_seed_tamper(tp) 234 let th: *i64 = ncfg_open(tp) 235 let tamper_win: i64 = g_axis_verdict_is_win(th, "throughput-blockio\x00" as *u8) 236 var tamper_caught: i64 = 0 237 if tamper_win == 1 { tamper_caught = 1 } // the same check that passed the real panel FLAGS the fake 238 239 // (3) MEASURED WIN re-derive: >=1 WIN, minimal-standalone-tcb value == actual stat of the image, 240 // and driver-logic-form evidence carries bound_working=2. 241 let has_win: i64 = g_any_win(h) 242 // panel records "<nbytes>B-raw-rv64..." -> assert "<nbytes>B-raw" appears in the tcb nishi cell. 243 let numbuf: *u8 = sys_mmap(32); g_itoa(nbytes, numbuf) 244 let nblen: i64 = g_strlen(numbuf) 245 let pat: *u8 = sys_mmap(48) 246 var pi: i64 = 0 247 while pi < nblen { pat[pi] = numbuf[pi]; pi = pi + 1 } 248 pat[pi] = 66 as u8; pi = pi + 1 // 'B' 249 pat[pi] = 45 as u8; pi = pi + 1 // '-' 250 pat[pi] = 114 as u8; pi = pi + 1 // 'r' 251 pat[pi] = 97 as u8; pi = pi + 1 // 'a' 252 pat[pi] = 119 as u8; pi = pi + 1 // 'w' 253 pat[pi] = 0 as u8 254 let tcb_cell: *u8 = sys_mmap(64) 255 g_field_of_axis(h, "minimal-standalone-tcb\x00" as *u8, "nishi\x00" as *u8, tcb_cell) 256 var bytes_match: i64 = 0 257 if g_strstr(tcb_cell, pat) == 1 { bytes_match = 1 } 258 let lf_ev: *u8 = sys_mmap(128) 259 g_field_of_axis(h, "driver-logic-form\x00" as *u8, "evidence\x00" as *u8, lf_ev) 260 var retarget_basis: i64 = 0 261 if g_strstr(lf_ev, "bound_working=2" as *u8) == 1 { retarget_basis = 1 } 262 var win_real: i64 = 0 263 if has_win == 1 { if bytes_match == 1 { if retarget_basis == 1 { win_real = 1 } } } 264 265 g_p(" authored=" as *u8); g_fn(1, authored) 266 g_p(" seeded_native=" as *u8); g_fn(1, seed_ok) 267 g_p(" no_overclaim_real=" as *u8); g_fn(1, noover_real) 268 g_p(" overclaim_caught(neg-control)=" as *u8); g_fn(1, tamper_caught) 269 g_p(" measured_win_rederives=" as *u8); g_fn(1, win_real) 270 g_p(" (standalone=" as *u8); g_fn(1, nbytes); g_p("B)\n" as *u8) 271 272 var pass: i64 = 0 273 if authored == 1 { if seed_ok == 1 { if noover_real == 1 { if tamper_caught == 1 { if win_real == 1 { pass = 1 } } } } } 274 275 if pass == 1 { 276 g_p("DRVEXCEEDGATE verdict=GREEN (no-overclaim measured panel in NATIVE store: Nishi driver-from-spec exceeds the generic Linux virtio-blk driver on driver-as-retargetable-DATA + minimal-standalone-auditable-TCB [" as *u8); g_fn(1, nbytes); g_p("B, re-stat verified]; perf rows OPEN-not-claimed [positive control], a fabricated perf-WIN is CAUGHT [negative control])\n" as *u8) 277 if lfd >= 0 { g_fp(lfd, "DRVEXCEEDGATE verdict=GREEN keystone=driver-exceeds-linux-panel store=native(no-tsv) no-overclaim=enforced(perf-rows-OPEN,fake-WIN-caught) measured-win-rederives=yes standalone_bytes=" as *u8); g_fn(lfd, nbytes); g_fp(lfd, " epoch=" as *u8); g_fn(lfd, sys_now_realtime_sec()); g_fp(lfd, "\n" as *u8); sys_close(lfd) } 278 sys_exit(0); return 0 279 } 280 g_p("DRVEXCEEDGATE verdict=RED (authored/seed/no-overclaim/neg-control/win-rederive not all green)\n" as *u8) 281 if lfd >= 0 { g_fp(lfd, "DRVEXCEEDGATE verdict=RED authored=" as *u8); g_fn(lfd, authored); g_fp(lfd, " seed=" as *u8); g_fn(lfd, seed_ok); g_fp(lfd, " noover=" as *u8); g_fn(lfd, noover_real); g_fp(lfd, " caught=" as *u8); g_fn(lfd, tamper_caught); g_fp(lfd, " win_real=" as *u8); g_fn(lfd, win_real); g_fp(lfd, "\n" as *u8); sys_close(lfd) } 282 sys_exit(1) 283 return 1 284}