code wiki / _hdl_build / _drv_bind_gate.nx
`_drv_bind_gate.nx` source

↩ module page · 182 lines · 10565 B
1// _drv_bind_gate.nx -- the gate for AUTONOMOUS DRIVER BRING-UP (X-DRV-W2).  NO mocks.
2//
3// (1) AUTONOMY -- runs the REAL nx_drv_bind over the REAL emu device manifest + driver registry:
4//     it must PROBE both devices, look each DeviceID up, emit the bound driver, run it on the
5//     SOVEREIGN rv64 emu, and report probed=2 bound_working=2 unbound=0 failed=0 -- both real
6//     devices brought up with NO per-device code.
7// (2) DISCRIMINATION -- emit the BLK driver spec BOUND to the NET device base (0x10002000) and
8//     run it: the blk driver's identity verify (DeviceID==2) rejects the net device (DeviceID==1),
9//     so its golden NEVER appears.  Proves the registry's DeviceID->spec mapping is load-bearing:
10//     you cannot bind any driver to any device (a fixed template would wrongly "work").
11// (3) NO-FALSE-BIND -- run nx_drv_bind over a scratch manifest with an UNKNOWN DeviceID (99):
12//     the registry lookup misses, so the device is reported UNBOUND, never falsely bound.  Proves
13//     the binder refuses iron it has no driver for (honest, no fabricated bring-up).
14//
15// Evidence -> knowledge/status/driver_bind.log (DRVBINDGATE row; the queue row's ||MARK= reads
16// it).  Sovereign orchestration (fork/dup3/execve/wait4), no gcc/.sh.  license_tier: ORIGINAL
17import "nx_syscalls.nx"
18import "nx_gate_verdict.nx"
19// ct_admit_now(): the shared "can this host afford the work" question, proven in nx_ctxtop_lib's gate.
20import "nx_ctxtop_lib.nx"
21
22const G_BIND_ELF: *u8 = "_offc/nx_drv_bind.elf"
23const G_EMIT_ELF: *u8 = "_offc/nx_drv_proto_emit.elf"
24const G_SOV_ELF:  *u8 = "_offc/nx_boot_run_sov.elf"
25
26func g_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
27func g_fp(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
28func g_fn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(fd,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 }
29
30func g_run(prog: *u8, a1: *u8, a2: *u8, a3: *u8, outpath: *u8) -> i64 {
  let pid: i64 = sys_fork()
  if pid == 0 {
      if outpath != (0 as *u8) { let ofd: i64 = sys_openat_wr(outpath, 0x1a4); if ofd >= 0 { sys_dup3(ofd, 1, 0); sys_dup3(ofd, 2, 0) } }
      let argv: *i64 = sys_mmap(64) as *i64
      argv[0] = prog as i64
      var k: i64 = 1
      if a1 != (0 as *u8) { argv[k] = a1 as i64; k = k + 1 }
      if a2 != (0 as *u8) { argv[k] = a2 as i64; k = k + 1 }
      if a3 != (0 as *u8) { argv[k] = a3 as i64; k = k + 1 }
      argv[k] = 0
      let envp: *i64 = sys_mmap(16) as *i64
      envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64; envp[1] = 0
      sys_execve(prog, argv, envp)
      sys_exit(127)
  }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, st, 0)
  let sig: i64 = st[0] & 0x7f
  if sig != 0 { return 128 + sig }
  return (st[0] >> 8) & 0xff
51}
52
53func g_read(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 }
  var n: i64 = 0
  var go: i64 = 1
  while go == 1 { let r: i64 = sys_read(fd, (buf as i64 + n) as *u8, cap - 1 - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap - 1 { go = 0 } }
  sys_close(fd)
  return n
61}
62
63func g_has(buf: *u8, n: i64, pat: *u8, pl: i64) -> i64 {
  if pl <= 0 { return 0 }
  var i: i64 = 0
  while i + pl <= n {
      var k: i64 = 0; var hit: i64 = 1
      while k < pl { if buf[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } }
      if hit == 1 { return 1 }
      i = i + 1
  }
  return 0
73}
74func g_strlen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
75func g_hasz(buf: *u8, n: i64, pat: *u8) -> i64 { return g_has(buf, n, pat, g_strlen(pat)) }
76func g_idx(buf: *u8, n: i64, pat: *u8) -> i64 {
  let pl: i64 = g_strlen(pat)
  if pl <= 0 { return 0 - 1 }
  var i: i64 = 0
  while i + pl <= n {
      var k: i64 = 0; var hit: i64 = 1
      while k < pl { if buf[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } }
      if hit == 1 { return i }
      i = i + 1
  }
  return 0 - 1
87}
88
89func main() -> i64 {
  g_p("=== driver-registry autobind gate (X-DRV-W2: probe -> registry lookup -> emit-bound -> run) ===\n" as *u8)
  // SAME EXPOSURE AS ITS SIBLING, SAME GUARD. This gate forks nx_drv_bind, which brings up BOTH devices
  // on the sovereign rv64 emulator -- heavier again than _drv_proto_gate's two runs. MEASURED
  // 2026-08-15: under host saturation it reported autonomy=RED ("both devices brought up" FAILING),
  // and the same binary returns 3/3 GREEN on a quiet box. Two of the estate's nine standing RED gates
  // were this one artifact, which is how a fleet metric stops being believed.
  // ★A DIAGNOSTIC THAT CANNOT REFUSE TO RUN IS A LOAD GENERATOR WITH GOOD INTENTIONS.
  if ct_admit_now() == 0 {
      let ctrA: *i64 = gv_ctr()
      gv_need("a host quiet enough to trust an emulator bring-up (threshold: knowledge/status/procchurn.conf admit-max-load-centi)" as *u8, 0, ctrA)
      let rcA: i64 = gv_verdict("DRVBIND-GATE", ctrA, "driver-registry autobind -- abstained, the host was too loaded to measure")
      sys_exit(rcA)
      return rcA
  }
  let lfd: i64 = sys_openat_append("knowledge/status/driver_bind.log" as *u8, 0x1a4)
105
  // (1) AUTONOMY: the real bring-up over the real manifest + registry.
  let bst: i64 = g_run(G_BIND_ELF, 0 as *u8, 0 as *u8, 0 as *u8, "/tmp/_bindgate_run.txt" as *u8)
  let rb: *u8 = sys_mmap(65536)
  let rn: i64 = g_read("/tmp/_bindgate_run.txt" as *u8, rb, 65536)
  var autonomy: i64 = 0
  if bst == 0 { if g_hasz(rb, rn, "bound_working=2" as *u8) == 1 { if g_hasz(rb, rn, "unbound=0" as *u8) == 1 { if g_hasz(rb, rn, "failed=0" as *u8) == 1 { autonomy = 1 } } } }
112
  // (2) DISCRIMINATION: blk driver spec BOUND to the NET base must NOT work (DeviceID verify rejects).
  let dest: i64 = g_run(G_EMIT_ELF, "knowledge/specs/drv_proto_blk_virt.spec" as *u8, "0x10002000" as *u8, "/tmp/_disc.bin" as *u8, "/tmp/_disc_emit.out" as *u8)
  let dgold: *u8 = sys_mmap(2048)
  let dgn: i64 = g_read("/tmp/_disc.bin.gold" as *u8, dgold, 2048)
  dgold[dgn] = 0 as u8
  var discrim: i64 = 0
  if dest == 0 { if dgn > 0 {
      g_run(G_SOV_ELF, "/tmp/_disc.bin" as *u8, 0 as *u8, 0 as *u8, "/tmp/_disc_serial.txt" as *u8)
      let db: *u8 = sys_mmap(65536)
      let dn: i64 = g_read("/tmp/_disc_serial.txt" as *u8, db, 65536)
      // ANCHORED READ (2026-08-11 root-cause): the emu's mismatch diagnostic prints
      // expected=[<golden>] into this very transcript, so a whole-file substring scan found the
      // golden in the DIAGNOSTIC and reported discrimination broken exactly when the rejection
      // worked (got=[] empty). Judge the golden against the got=[...] field ONLY -- the runner's
      // canonical transcript -- never the prose around it.
      let gp: i64 = g_idx(db, dn, "got=[" as *u8)
      if gp >= 0 {
          let s0: i64 = gp + 5
          var e0: i64 = s0
          var scanning: i64 = 1
          while scanning == 1 { if e0 >= dn { scanning = 0 } else { if db[e0] == (93 as u8) { scanning = 0 } else { e0 = e0 + 1 } } }
          if g_has((db as i64 + s0) as *u8, e0 - s0, dgold, dgn) == 0 { discrim = 1 }   // blk golden absent from the ACTUAL transcript
      }
      // no got=[ field: either verdict=GREEN (driver worked at the wrong base = discrimination
      // truly broken) or an unclassified crash -- both correctly leave discrim=0 (fail toward RED).
  } }
139
  // (3) NO-FALSE-BIND: a scratch manifest with an UNKNOWN DeviceID (99) -> UNBOUND, never bound.
  let tfd: i64 = sys_openat_wr("/tmp/_bindgate_unknown.tsv" as *u8, 0x1a4)
  if tfd >= 0 { g_fp(tfd, "# scratch manifest: one device with a DeviceID absent from the registry\n0x10003000\t99\tunknown-iron\n" as *u8); sys_close(tfd) }
  let ust: i64 = g_run(G_BIND_ELF, "/tmp/_bindgate_unknown.tsv" as *u8, 0 as *u8, 0 as *u8, "/tmp/_bindgate_unknown.txt" as *u8)
  let ub: *u8 = sys_mmap(65536)
  let un: i64 = g_read("/tmp/_bindgate_unknown.txt" as *u8, ub, 65536)
  var nofalse: i64 = 0
  if ust == 0 { if g_hasz(ub, un, "UNBOUND" as *u8) == 1 { if g_hasz(ub, un, "bound_working=0" as *u8) == 1 { nofalse = 1 } } }
148
  g_p("  autonomy=" as *u8)
  if autonomy == 1 { g_p("GREEN(probed=2 bound_working=2 unbound=0 failed=0, both devices brought up, no per-device code)" as *u8) } else { g_p("RED" as *u8) }
  g_p(" discrimination=" as *u8)
  if discrim == 1 { g_p("yes(blk driver @net base rejected by DeviceID verify, golden absent)" as *u8) } else { g_p("no" as *u8) }
  g_p(" no_false_bind=" as *u8)
  if nofalse == 1 { g_p("yes(unknown DeviceID=99 -> UNBOUND)\n" as *u8) } else { g_p("no\n" as *u8) }
155
  var pass: i64 = 0
  if autonomy == 1 { if discrim == 1 { if nofalse == 1 { pass = 1 } } }
158
  // driver_bind.log evidence rows UNCHANGED (the queue row's ||MARK= reads this file).
  if pass == 1 {
      if lfd >= 0 {
          g_fp(lfd, "DRVBINDGATE verdict=GREEN keystone=driver-registry-autobind composes=HWMAP-probe+driver-from-spec autonomy=probed2-boundworking2 discrimination=blk-rejected-at-net-base no-false-bind=unknown-deviceid-unbound epoch=" as *u8)
          g_fn(lfd, sys_now_realtime_sec()); g_fp(lfd, "\n" as *u8); sys_close(lfd)
      }
  }
  if pass == 0 {
      if lfd >= 0 {
          g_fp(lfd, "DRVBINDGATE verdict=RED autonomy=" as *u8); g_fn(lfd, autonomy)
          g_fp(lfd, " discrimination=" as *u8); g_fn(lfd, discrim)
          g_fp(lfd, " no_false_bind=" as *u8); g_fn(lfd, nofalse); g_fp(lfd, "\n" as *u8); sys_close(lfd)
      }
  }
  // MIGRATED onto nx_gate_verdict (D001, 2026-08-11): the three conjuncts are gv_check rows, the
  // exit code carries the verdict, and the canonical verdict= line is LAST on stdout.
  let ctr: *i64 = gv_ctr()
  gv_check("autonomy: probe -> registry lookup -> emit-bound -> run, both devices, no per-device code" as *u8, autonomy, ctr)
  gv_check("discrimination: blk driver at the net base rejected (golden absent from got=[...])" as *u8, discrim, ctr)
  gv_check("no-false-bind: unknown DeviceID=99 -> UNBOUND" as *u8, nofalse, ctr)
  let rc: i64 = gv_verdict("DRVBIND-GATE" as *u8, ctr, "driver-registry autobind: bring up ANY iron, refuse unknown iron" as *u8)
  sys_exit(rc)
  return rc
182}
_drv_bind_gate.nx source

`_drv_bind_gate.nx` source
