_syscall_gate.nx source

1// _syscall_gate.nx -- gate for the SYSCALL ABI (args + dispatch + return + resume). NO mocks. 2// 3// (1) SYSCALL ROUND-TRIP -- emits + runs nx_syscall_emit: a U-mode program makes two PUTC 4// syscalls + EXIT; the M-mode kernel dispatches on a0, emits a1, advances mepc, and mret's 5// back so the user RESUMES. Serial "AB" + clean halt = both syscalls serviced AND the user 6// resumed between them (the return path works). 7// (2) CONTROL (resume is real) -- re-emit with advance=0 (kernel does NOT advance mepc past the 8// ecall): the user re-runs the first syscall forever -> "AAAA..." (step cap), never reaching 9// "B". Proves "AB" REQUIRES the mepc+4 + mret resume path (not a fixed transcript). 10// 11// Evidence -> knowledge/status/priv.log (SYSCALLGATE row). Sovereign. license_tier: ORIGINAL 12import "nx_syscalls.nx" 13import "nx_gate_verdict.nx" 14 15const S_EMIT: *u8 = "_offc/nx_syscall_emit.elf" 16const S_SOV: *u8 = "_offc/nx_boot_run_sov.elf" 17const S_BIN: *u8 = "runtime/_hdl_build/_syscall_virt.bin" 18 19func g_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 20func g_fp(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 21func g_fn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(fd,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 22 23func g_run(prog: *u8, a1: *u8, a2: *u8, outpath: *u8) -> i64 { 24 let pid: i64 = sys_fork() 25 if pid == 0 { 26 if outpath != (0 as *u8) { let ofd: i64 = sys_openat_wr(outpath, 0x1a4); if ofd >= 0 { sys_dup3(ofd, 1, 0); sys_dup3(ofd, 2, 0) } } 27 let argv: *i64 = sys_mmap(32) as *i64 28 argv[0] = prog as i64 29 var k: i64 = 1 30 if a1 != (0 as *u8) { argv[k] = a1 as i64; k = k + 1 } 31 if a2 != (0 as *u8) { argv[k] = a2 as i64; k = k + 1 } 32 argv[k] = 0 33 let envp: *i64 = sys_mmap(16) as *i64 34 envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64; envp[1] = 0 35 sys_execve(prog, argv, envp) 36 sys_exit(127) 37 } 38 let st: *i64 = sys_mmap(16) as *i64 39 sys_wait4(pid, st, 0) 40 let sg: i64 = st[0] & 0x7f 41 if sg != 0 { return 128 + sg } 42 return (st[0] >> 8) & 0xff 43} 44func g_read(path: *u8, buf: *u8, cap: i64) -> i64 { 45 let fd: i64 = sys_openat_rd(path) 46 if fd < 0 { return 0 } 47 var n: i64 = 0 48 var go: i64 = 1 49 while go == 1 { let r: i64 = sys_read(fd, (buf as i64 + n) as *u8, cap - 1 - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap - 1 { go = 0 } } 50 sys_close(fd) 51 return n 52} 53func g_has(buf: *u8, n: i64, pat: *u8, pl: i64) -> i64 { 54 if pl <= 0 { return 0 } 55 var i: i64 = 0 56 while i + pl <= n { var k: i64=0; var hit: i64=1; while k<pl { if buf[i+k]!=pat[k]{hit=0;k=pl}else{k=k+1} } if hit==1 { return 1 } i=i+1 } 57 return 0 58} 59 60func main() -> i64 { 61 g_p("=== syscall ABI gate (U-mode args + kernel dispatch + mepc+4 + mret resume) ===\n" as *u8) 62 let lfd: i64 = sys_openat_append("knowledge/status/priv.log" as *u8, 0x1a4) 63 64 // (1) round-trip: AB 65 g_run(S_EMIT, 0 as *u8, 0 as *u8, "/tmp/_sc_emit.out" as *u8) 66 g_run(S_SOV, S_BIN, 0 as *u8, "/tmp/_sc_main.txt" as *u8) 67 let mb: *u8 = sys_mmap(65536); let mn: i64 = g_read("/tmp/_sc_main.txt" as *u8, mb, 65536) 68 var rt_ok: i64 = 0 69 if g_has(mb, mn, "AB" as *u8, 2) == 1 { if g_has(mb, mn, "BOOTSOV verdict=GREEN" as *u8, 21) == 1 { rt_ok = 1 } } 70 71 // (2) control: advance=0 -> no resume -> re-loops first syscall -> no "AB" 72 g_run(S_EMIT, "0" as *u8, "/tmp/_sc_ctrl.bin" as *u8, "/tmp/_sc_ctrl_emit.out" as *u8) 73 g_run(S_SOV, "/tmp/_sc_ctrl.bin" as *u8, 0 as *u8, "/tmp/_sc_ctrl.txt" as *u8) 74 let cb: *u8 = sys_mmap(131072); let cn: i64 = g_read("/tmp/_sc_ctrl.txt" as *u8, cb, 131072) 75 var control_ok: i64 = 0 76 if g_has(cb, cn, "AB" as *u8, 2) == 0 { if g_has(cb, cn, "A" as *u8, 1) == 1 { control_ok = 1 } } // A's present, never B 77 78 g_p(" syscall_roundtrip=" as *u8); if rt_ok==1 { g_p("GREEN(AB: two PUTC syscalls serviced + user resumed between them)" as *u8) } else { g_p("RED" as *u8) } 79 g_p(" control_no_resume_no_B=" as *u8); g_fn(1, control_ok); g_p("\n" as *u8) 80 81 // ---- D001 MIGRATION 2026-08-06 -- IDIOM G (boolean conjunction, no counter) ------------------- 82 // Same shape and same remedy as _mmu_gate: the conjuncts BECOME the teeth, which creates the 83 // counter that idioms A-F assume already exists. gv_verdict is GREEN iff pass==total, exactly the 84 // old `rt_ok && control_ok`. No test logic changed -- only who reports the verdict, so that 85 // nx_gate_green can judge it and /api/promote stops refusing it. 86 let ctr: *i64 = gv_ctr() 87 gv_check("T1 syscall round-trip (U-mode a0/a1 -> kernel dispatch PUTC/EXIT -> mepc+4 + mret -> user RESUMES, serial shows AB)" as *u8, rt_ok, ctr) 88 gv_check("T2 control: advance=0 re-loops the first syscall forever (A present, never B) -- proves the resume path is load-bearing" as *u8, control_ok, ctr) 89 let rc: i64 = gv_verdict("SYSCALLGATE" as *u8, ctr, "working syscall ABI: U-mode passes a0=syscall#/a1=arg, the M-mode kernel dispatches [PUTC emits a1, EXIT halts], advances mepc and mret's back, and the user RESUMES -> AB; the advance=0 control re-loops the first syscall forever [no B], so the resume path is load-bearing. probe=syscall-abi" as *u8) 90 // knowledge/status/priv.log evidence row PRESERVED in both branches -- the rollup reads it. 91 if lfd >= 0 { 92 if rc == 0 { 93 g_fp(lfd, "SYSCALLGATE verdict=GREEN keystone=syscall-abi probe=syscall-abi args=a0/a1 dispatch=PUTC/EXIT return=mepc+4+mret resume=verified(AB) control=no-advance-no-B epoch=" as *u8); g_fn(lfd, sys_now_realtime_sec()); g_fp(lfd, "\n" as *u8) 94 } 95 if rc != 0 { 96 g_fp(lfd, "SYSCALLGATE verdict=RED rt=" as *u8); g_fn(lfd, rt_ok); g_fp(lfd, " control=" as *u8); g_fn(lfd, control_ok); g_fp(lfd, "\n" as *u8) 97 } 98 sys_close(lfd) 99 } 100 sys_exit(rc) 101 return rc 102}