_uproc_gate.nx source

1// _uproc_gate.nx -- LOCK for PER-PROCESS ADDRESS SPACES (U-mode WITH paging, X-PAGE-UPROC-001). NO mocks. 2// Proves a user program runs at U-privilege in its OWN Sv39 address space (its code is FETCHED + its data 3// LOADED through the page table) AND is ISOLATED from kernel pages -- the full memory-protected process 4// model (translation + permission + U-bit + privilege, all in U-mode). Drives nx_uproc_emit on the emu: 5// T1 own-page : user loads VA 0xC0009000 (its U=1 page) -> succeeds -> ecall -> kernel "UPROC" 6// T2 isolation: user loads VA 0x80009000 (a U=0 SUPERVISOR page) -> U-mode DENIED -> load-page-fault 7// -> kernel "UISO" (the process cannot touch kernel memory; UPROC never prints) 8// T1 vs T2 differ ONLY in which page the user touches (its own U=1 vs a kernel U=0) -- the U-bit isolates. 9// GREEN only if T1 && T2. Evidence -> knowledge/status/priv.log (UPROCGATE). license_tier: ORIGINAL 10import "nx_syscalls.nx" 11 12const UP_EMIT: *u8 = "_offc/nx_uproc_emit.elf" 13const UP_SOV: *u8 = "_offc/nx_boot_run_sov.elf" 14 15func g_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 16func g_fp(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 17func g_fn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 18 19func g_run(prog: *u8, a1: *u8, a2: *u8, outpath: *u8) -> i64 { 20 let pid: i64 = sys_fork() 21 if pid == 0 { 22 if outpath != (0 as *u8) { let ofd: i64 = sys_openat_wr(outpath, 0x1a4); if ofd >= 0 { sys_dup3(ofd, 1, 0); sys_dup3(ofd, 2, 0) } } 23 let argv: *i64 = sys_mmap(32) as *i64 24 argv[0] = prog as i64 25 var k: i64 = 1 26 if a1 != (0 as *u8) { argv[k] = a1 as i64; k = k + 1 } 27 if a2 != (0 as *u8) { argv[k] = a2 as i64; k = k + 1 } 28 argv[k] = 0 29 let envp: *i64 = sys_mmap(16) as *i64 30 envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64; envp[1] = 0 31 sys_execve(prog, argv, envp) 32 sys_exit(127) 33 } 34 let st: *i64 = sys_mmap(16) as *i64 35 sys_wait4(pid, st, 0) 36 return (st[0] >> 8) & 0xff 37} 38func g_read(path: *u8, buf: *u8, cap: i64) -> i64 { 39 let fd: i64 = sys_openat_rd(path) 40 if fd < 0 { return 0 } 41 var n: i64 = 0 42 var go: i64 = 1 43 while go == 1 { let r: i64 = sys_read(fd, (buf as i64 + n) as *u8, cap - 1 - n); if r <= 0 { go = 0 } else { n = n + r } if n >= cap - 1 { go = 0 } } 44 sys_close(fd) 45 return n 46} 47func g_has(buf: *u8, n: i64, pat: *u8, pl: i64) -> i64 { 48 if pl <= 0 { return 0 } 49 var i: i64 = 0 50 while i + pl <= n { var k: i64=0; var hit: i64=1; while k<pl { if buf[i+k]!=pat[k]{hit=0;k=pl}else{k=k+1} } if hit==1 { return 1 } i=i+1 } 51 return 0 52} 53func g_case(va: *u8, binp: *u8, txt: *u8, buf: *u8) -> i64 { 54 g_run(UP_EMIT, va, binp, "/tmp/_up_emit.out" as *u8) 55 g_run(UP_SOV, binp, 0 as *u8, txt) 56 return g_read(txt, buf, 65536) 57} 58func g_row(name: *u8, pass: i64) -> i64 { g_p(" " as *u8); g_p(name); if pass==1 { g_p(" PASS\n" as *u8) } else { g_p(" FAIL\n" as *u8) } return 0 } 59 60func main() -> i64 { 61 let b: *u8 = sys_mmap(65536) 62 63 // T1 own-page: user loads its U=1 page -> runs in its address space -> ecall -> UPROC 64 var n: i64 = g_case("0xC0009000" as *u8, "/tmp/_up_own.bin" as *u8, "/tmp/_up_own.txt" as *u8, b) 65 var t1: i64 = 0 66 if g_has(b, n, "UPROC" as *u8, 5) == 1 { if g_has(b, n, "BOOTSOV verdict=GREEN" as *u8, 21) == 1 { t1 = 1 } } 67 68 // T2 isolation: user loads a U=0 kernel page -> denied -> UISO, no UPROC 69 n = g_case("0x80009000" as *u8, "/tmp/_up_iso.bin" as *u8, "/tmp/_up_iso.txt" as *u8, b) 70 var t2: i64 = 0 71 if g_has(b, n, "UISO" as *u8, 4) == 1 { if g_has(b, n, "UPROC" as *u8, 5) == 0 { t2 = 1 } } 72 73 var ok: i64 = 0 74 if t1 == 1 { if t2 == 1 { ok = 1 } } 75 76 g_p("UPROC gate (per-process address space: U-mode WITH paging + isolation)\n" as *u8) 77 g_row("T1 user-in-own-addr-space (->UPROC)" as *u8, t1) 78 g_row("T2 isolation-from-kernel (->UISO) " as *u8, t2) 79 80 let lf: i64 = sys_openat_append("knowledge/status/priv.log" as *u8, 0x1a4) 81 if ok == 1 { 82 g_p("UPROCGATE verdict=GREEN keystone=per-process-address-space probe=uproc U-mode-paged=yes(code-fetched+data-loaded-via-pagetable) isolation=U-mode-denied-U0-kernel-page ecall-boundary=UPROC\n" as *u8) 83 if lf >= 0 { g_fp(lf, "UPROCGATE verdict=GREEN keystone=per-process-address-space probe=uproc U-mode-translated+isolated-from-kernel epoch=" as *u8); g_fn(lf, sys_now_realtime_sec()); g_fp(lf, "\n" as *u8); sys_close(lf) } 84 sys_exit(0); return 0 85 } 86 g_p("UPROCGATE verdict=RED (t1=" as *u8); g_fn(1, t1); g_p(" t2=" as *u8); g_fn(1, t2); g_p(")\n" as *u8) 87 if lf >= 0 { g_fp(lf, "UPROCGATE verdict=RED t1=" as *u8); g_fn(lf, t1); g_fp(lf, " t2=" as *u8); g_fn(lf, t2); g_fp(lf, "\n" as *u8); sys_close(lf) } 88 sys_exit(1) 89 return 1 90}