_umode_gate.nx source

1// _umode_gate.nx -- gate for U-MODE PROGRAM + SYSCALL boundary (user/kernel separation). NO mocks. 2// 3// (1) U-MODE SYSCALL -- emits + runs nx_umode_emit: M-mode drops to U via mret, the U-mode user 4// program executes `ecall`, the CPU traps to the M-mode kernel with mcause=8 (ecall-from-U), 5// and the handler confirms it -> serial "U8" + clean halt. 6// (2) CONTROL -- re-emit with MPP=M (0x1800): mret stays in M, so the `ecall` is from M-mode -> 7// mcause=11 (not 8) -> handler emits "X8" not "U8". Proves "U8" REQUIRES the syscall to come 8// from U-mode (the privilege/cause distinction is real). 9// 10// Evidence -> knowledge/status/priv.log (UMODEGATE row). Sovereign. license_tier: ORIGINAL 11import "nx_syscalls.nx" 12import "nx_gate_verdict.nx" 13 14const U_EMIT: *u8 = "_offc/nx_umode_emit.elf" 15const U_SOV: *u8 = "_offc/nx_boot_run_sov.elf" 16const U_BIN: *u8 = "runtime/_hdl_build/_umode_virt.bin" 17 18func g_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 19func g_fp(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 20func g_fn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(fd,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 21 22func g_run(prog: *u8, a1: *u8, a2: *u8, outpath: *u8) -> i64 { 23 let pid: i64 = sys_fork() 24 if pid == 0 { 25 if outpath != (0 as *u8) { let ofd: i64 = sys_openat_wr(outpath, 0x1a4); if ofd >= 0 { sys_dup3(ofd, 1, 0); sys_dup3(ofd, 2, 0) } } 26 let argv: *i64 = sys_mmap(32) as *i64 27 argv[0] = prog as i64 28 var k: i64 = 1 29 if a1 != (0 as *u8) { argv[k] = a1 as i64; k = k + 1 } 30 if a2 != (0 as *u8) { argv[k] = a2 as i64; k = k + 1 } 31 argv[k] = 0 32 let envp: *i64 = sys_mmap(16) as *i64 33 envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64; envp[1] = 0 34 sys_execve(prog, argv, envp) 35 sys_exit(127) 36 } 37 let st: *i64 = sys_mmap(16) as *i64 38 sys_wait4(pid, st, 0) 39 let sg: i64 = st[0] & 0x7f 40 if sg != 0 { return 128 + sg } 41 return (st[0] >> 8) & 0xff 42} 43func g_read(path: *u8, buf: *u8, cap: i64) -> i64 { 44 let fd: i64 = sys_openat_rd(path) 45 if fd < 0 { return 0 } 46 var n: i64 = 0 47 var go: i64 = 1 48 while go == 1 { let r: i64 = sys_read(fd, (buf as i64 + n) as *u8, cap - 1 - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap - 1 { go = 0 } } 49 sys_close(fd) 50 return n 51} 52func g_has(buf: *u8, n: i64, pat: *u8, pl: i64) -> i64 { 53 if pl <= 0 { return 0 } 54 var i: i64 = 0 55 while i + pl <= n { var k: i64=0; var hit: i64=1; while k<pl { if buf[i+k]!=pat[k]{hit=0;k=pl}else{k=k+1} } if hit==1 { return 1 } i=i+1 } 56 return 0 57} 58 59func main() -> i64 { 60 g_p("=== U-mode syscall gate (mret M->U; ecall-from-U -> M-mode kernel, mcause=8) ===\n" as *u8) 61 let lfd: i64 = sys_openat_append("knowledge/status/priv.log" as *u8, 0x1a4) 62 63 // (1) U-mode syscall: U8 64 g_run(U_EMIT, 0 as *u8, 0 as *u8, "/tmp/_um_emit.out" as *u8) 65 g_run(U_SOV, U_BIN, 0 as *u8, "/tmp/_um_main.txt" as *u8) 66 let mb: *u8 = sys_mmap(65536); let mn: i64 = g_read("/tmp/_um_main.txt" as *u8, mb, 65536) 67 var umode_ok: i64 = 0 68 if g_has(mb, mn, "U8" as *u8, 2) == 1 { if g_has(mb, mn, "BOOTSOV verdict=GREEN" as *u8, 21) == 1 { umode_ok = 1 } } 69 70 // (2) control: MPP=M -> ecall from M -> mcause=11 -> "X8", NOT "U8" 71 g_run(U_EMIT, "0x1800" as *u8, "/tmp/_um_ctrl.bin" as *u8, "/tmp/_um_ctrl_emit.out" as *u8) 72 g_run(U_SOV, "/tmp/_um_ctrl.bin" as *u8, 0 as *u8, "/tmp/_um_ctrl.txt" as *u8) 73 let cb: *u8 = sys_mmap(65536); let cn: i64 = g_read("/tmp/_um_ctrl.txt" as *u8, cb, 65536) 74 var control_ok: i64 = 0 75 if g_has(cb, cn, "X8" as *u8, 2) == 1 { if g_has(cb, cn, "U8" as *u8, 2) == 0 { control_ok = 1 } } 76 77 g_p(" umode_syscall=" as *u8); if umode_ok==1 { g_p("GREEN(U8: U-mode ecall -> kernel mcause=8)" as *u8) } else { g_p("RED" as *u8) } 78 g_p(" control_M_gives_X8=" as *u8); g_fn(1, control_ok); g_p("\n" as *u8) 79 80 // ---- D001 MIGRATION 2026-08-06 -- IDIOM G (boolean conjunction, no counter) ------------------- 81 // Third of the family. nx_gate_dry_apply cannot do this shape for TWO stacked reasons, both of 82 // which its own source states: idioms A-F need a pass/total COUNTER PAIR that these gates do not 83 // have, and the verdict emission is NESTED inside `if pass == 1 { ... }`, so its cut point would 84 // delete a branch -- its fail-closed brace-delta guard REFUSES rather than emit damage, and the 85 // comment there says the cut point "needs to move to the enclosing `if` line, which this applier 86 // does not yet do". Until that lands, this shape migrates by hand. 87 // ONE gv_check PER CONJUNCT creates the counter; gv_verdict is GREEN iff pass==total, exactly the 88 // old `umode_ok && control_ok`. Teeth unchanged -- only the verdict reporter. 89 let ctr: *i64 = gv_ctr() 90 gv_check("T1 U-mode syscall (mret M->U, U-mode ecall traps to the M-mode kernel with mcause=8 [ecall-from-U] -> U8)" as *u8, umode_ok, ctr) 91 gv_check("T2 control MPP=M traps with mcause=11 -> X8 and never U8 -- proves the U-mode cause is real, not a rubber stamp" as *u8, control_ok, ctr) 92 let rc: i64 = gv_verdict("UMODEGATE" as *u8, ctr, "user/kernel separation: a U-mode program made a syscall via ecall; the CPU trapped to the M-mode kernel with mcause=8 [ecall-from-U] -> U8; the MPP=M control traps with mcause=11 -> X8, proving the U-mode cause is real. probe=umode-syscall" as *u8) 93 // knowledge/status/priv.log evidence row PRESERVED in both branches -- the rollup reads it. 94 if lfd >= 0 { 95 if rc == 0 { 96 g_fp(lfd, "UMODEGATE verdict=GREEN keystone=umode-syscall probe=umode-syscall mret-M-to-U=yes ecall-from-U-cause=8 kernel-dispatch=yes control=M-gives-cause-11 epoch=" as *u8); g_fn(lfd, sys_now_realtime_sec()); g_fp(lfd, "\n" as *u8) 97 } 98 if rc != 0 { 99 g_fp(lfd, "UMODEGATE verdict=RED umode=" as *u8); g_fn(lfd, umode_ok); g_fp(lfd, " control=" as *u8); g_fn(lfd, control_ok); g_fp(lfd, "\n" as *u8) 100 } 101 sys_close(lfd) 102 } 103 sys_exit(rc) 104 return rc 105}