nx_asm_selfheal_test.nx source

1// nx_asm_selfheal_test.nx -- the WHOLE loop, from MACHINE CODE up, in one fast pass, clean 2// RACI. The bug is a real register-pressure miscompile living in emitted x86-64 assembly 3// (a value live across a call in a caller-saved register). No synthetic probe: 4// ENGINEER detect (eng_asm_scan) -> finds %rax live across the call, from the .s 5// DOCTOR fix (doc_asm_fix) -> wraps that call with pushq/popq, into a NEW .s 6// ENGINEER re-scan (eng_asm_scan) -> the patched .s is CLEAN (0 flags) 7// ENGINEER execute (eng_link/eng_run) -> broken returns 7 (wrong), fixed returns 42 (right) 8// COUNCIL admit (cc_council) -> ACTs on the Engineer's runtime verdict 9// Known answer: detected=1, clean=0, broken-runs=7, fixed-runs=42, council ACT -> exit 0. 10// All work is in asm_heal_run (fills memory arrays); main stays tiny so the gate that 11// proves it is not itself a victim of the register-pressure miscompile it heals. 12 13import "nx_eng_asm_scan.nx" // ENGINEER detect + re-verify (machine-code scan) 14import "nx_doctor_asm_fix.nx" // DOCTOR fix (machine-code patch) 15import "nx_engineer_crash.nx" // ENGINEER execute (eng_link + eng_run) 16import "nx_crew_council.nx" // COUNCIL admit 17 18func ap_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 19func ap_num(v: i64) -> i64 { 20 let b: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { m = 0 - m } 21 let t: *u8 = sys_mmap(28); var k: i64 = 0 22 if m == 0 { t[0] = 48; k = 1 } 23 while m > 0 { t[k] = 48 + (m % 10); m = m / 10; k = k + 1 } 24 if v < 0 { ap_puts("-" as *u8) } 25 var i: i64 = 0; while i < k { b[i] = t[k - 1 - i]; i = i + 1 } 26 sys_write(1, b, k); return 0 27} 28func tally(r: *i64, n: i64) -> i64 { 29 var ec: i64 = 0; var i: i64 = 0 30 while i < n { if r[i] != 1 { if ec == 0 { ec = i + 1 } } i = i + 1 } 31 return ec 32} 33 34// do the entire loop, storing every result to memory s[] and every verdict to r[]. 35// s: 0=detected 1=wraps 2=reverify 3=broken_rc 4=fixed_rc 5=reg 6=call_line 7=council 36func asm_heal_run(s: *i64, r: *i64) -> i64 { 37 let broken: *u8 = "runtime/_hdl_build/nx_asm_bug_fixture.s" as *u8 38 let fixed: *u8 = "/tmp/asm_fixed.s" as *u8 39 let fr: *i64 = sys_mmap(8 * 64) as *i64 40 let fl: *i64 = sys_mmap(8 * 64) as *i64 41 let fr2: *i64 = sys_mmap(8 * 64) as *i64 42 let fl2: *i64 = sys_mmap(8 * 64) as *i64 43 let a: *CrewAction = sys_mmap(64) as *CrewAction 44 let why: *i64 = sys_mmap(8) as *i64 45 46 s[0] = eng_asm_scan(broken, fr, fl) // ENGINEER detect 47 s[5] = fr[0]; s[6] = fl[0] 48 s[1] = doc_asm_fix(broken, fixed, fr, fl, s[0]) // DOCTOR fix 49 s[2] = eng_asm_scan(fixed, fr2, fl2) // ENGINEER re-scan patched code 50 eng_link(broken, "/tmp/asm_broken.elf" as *u8) // ENGINEER execute both 51 s[3] = eng_run("/tmp/asm_broken.elf" as *u8, 0 as *u8) 52 eng_link(fixed, "/tmp/asm_fixed.elf" as *u8) 53 s[4] = eng_run("/tmp/asm_fixed.elf" as *u8, 0 as *u8) 54 55 r[0] = 0; if s[0] == 1 { r[0] = 1 } // detected exactly one bug 56 r[1] = 0; if s[2] == 0 { r[1] = 1 } // patched machine code is clean 57 r[2] = 0; if s[3] == 7 { r[2] = 1 } // broken really mis-runs (returns 7) 58 r[3] = 0; if s[4] == 42 { r[3] = 1 } // fixed runs correctly (returns 42) 59 60 var verified: i64 = 0 61 if r[1] == 1 { if r[3] == 1 { verified = 1 } } 62 cc_set(a, "admit machine-code self-heal (pushq/popq across call)" as *u8, verified, 1, 1, 1, 1) 63 let vd: i64 = cc_council(a, why) // COUNCIL admit 64 s[7] = vd 65 r[4] = 0; if vd == CC_ACT { r[4] = 1 } 66 return 0 67} 68 69func asm_heal_report(s: *i64) -> i64 { 70 ap_puts(" ENGINEER detect : flags=" as *u8); ap_num(s[0]); ap_puts(" (%" as *u8); ap_puts(as_regname(s[5])); ap_puts(" live across call line " as *u8); ap_num(s[6]); ap_puts(")\n" as *u8) 71 ap_puts(" DOCTOR fix : pushq/popq wraps emitted=" as *u8); ap_num(s[1]); ap_puts("\n" as *u8) 72 ap_puts(" ENGINEER reverify: patched machine code flags=" as *u8); ap_num(s[2]); ap_puts(" (0 = clean)\n" as *u8) 73 ap_puts(" ENGINEER execute: broken returns " as *u8); ap_num(s[3]); ap_puts(" (wrong) fixed returns " as *u8); ap_num(s[4]); ap_puts(" (correct)\n" as *u8) 74 ap_puts(" COUNCIL govern : verdict = " as *u8); ap_puts(cc_verdict_name(s[7])); ap_puts("\n" as *u8) 75 return 0 76} 77 78func main() -> i64 { 79 ap_puts("=== MACHINE-CODE self-heal: ENGINEER detect -> DOCTOR fix -> ENGINEER execute -> COUNCIL admit ===\n" as *u8) 80 let s: *i64 = sys_mmap(8 * 8) as *i64 81 let r: *i64 = sys_mmap(8 * 8) as *i64 82 asm_heal_run(s, r) 83 asm_heal_report(s) 84 ap_puts("----------------------------------------------------------------\n" as *u8) 85 ap_puts(" Engineer reads the bug from machine code; Doctor fixes it in machine code; proven by execution.\n" as *u8) 86 let ec: i64 = tally(r, 5) 87 sys_exit(ec) 88 return ec 89}