nx_boot_run_sov.nx source

1// nx_boot_run_sov.nx -- the SOVEREIGN boot runtime. Loads an emitter-authored rv64 flat binary 2// into the Nishi-owned rv64 emulator (rv64im_min_sim + its 16550 UART / SiFive finisher / M-mode 3// CSR / CLINT / virtio / NVMe / Sv39-MMU device models) and RUNS it -- the kernel boots on OUR 4// silicon model, not qemu. qemu stays a pure ALIGNMENT cross-check, never the runtime. 5// 6// ★FIXED 2026-07-31 (debt 1785517037): this runner used to decide its verdict from 7// `halted && halt_code==0` ALONE and NEVER READ THE SERIAL IT HAD JUST CAPTURED. Proven by 8// tamper: an image whose Sv39 walk was broken emitted "...TICK TX" -- the paging phase DEAD -- 9// and BOOTSOV still returned verdict=GREEN exit=0; clearing medeleg dropped the USER marker and 10// it still returned GREEN. A runner that returns GREEN on a boot it can see is broken is not a 11// check. It now compares the captured transcript against the artifact's golden and goes RED on 12// mismatch. Backwards-compatible BY CONSTRUCTION: an image with NO golden behaves exactly as 13// before (halt-only verdict) and says so, so nothing that boots a golden-less payload changes. 14// nx_boot_run_sov [binpath] [goldpath] 15// exit 0 = booted + clean halt + (golden matched or absent); 1 = otherwise 16// Boot-and-capture comes from the shared nx_bootcap primitive so this runner, the gate, the 17// census and the adoption ruler cannot disagree about what "booting the image" means. 18// Sovereign: the emulator IS the runtime. license_tier: ORIGINAL 19import "nx_bootcap.nx" 20 21const BR_BIN: *u8 = "runtime/_hdl_build/_boot_nishi_virt.bin" 22const BR_BIN_ALT: *u8 = "_boot_nishi_virt.bin" 23const BR_GOLD_ALT: *u8 = "runtime/_hdl_build/_boot_nishi_virt.bin.gold" 24const BR_TX_CAP: i64 = 4096 25const BR_LOG: *u8 = "knowledge/status/boot_stub.log" 26 27func br_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 28func br_fp(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 29func br_fn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 30 31func br_eq(a: *u8, an: i64, b: *u8, bn: i64) -> i64 { 32 if an != bn { return 0 } 33 var i: i64 = 0 34 while i < an { if a[i] != b[i] { return 0 } i = i + 1 } 35 return 1 36} 37 38func main(argc: i64, argv: *i64) -> i64 { 39 var binp: *u8 = BR_BIN 40 if argc >= 2 { binp = argv[1] as *u8 } 41 42 let lenp: *i64 = sys_mmap(16) as *i64 43 let pathp: *i64 = sys_mmap(16) as *i64 44 let img: *u8 = bootcap_load(binp, BR_BIN_ALT, lenp, pathp) 45 let ilen: i64 = lenp[0] 46 if ilen <= 0 { br_p("BOOTSOV verdict=RED reason=binary-missing\n" as *u8); sys_exit(1); return 1 } 47 binp = (pathp[0]) as *u8 48 49 let tx: *u8 = sys_mmap(BR_TX_CAP) 50 let res: *i64 = sys_mmap(8 * BOOTCAP_R_N) as *i64 51 bootcap_run(img, ilen, tx, BR_TX_CAP, res) 52 let cnt: i64 = res[BOOTCAP_R_TXN] 53 54 br_p("SOVEREIGN-EMU serial: " as *u8) 55 sys_write(1, tx, cnt) 56 br_p("\n" as *u8) 57 58 // Resolve the golden: <binpath>.gold first (the golden travels with its artifact), then an 59 // explicit argv[2], then the buildroot location for images authored before that convention. 60 let gpath: *u8 = sys_mmap(512) 61 var gi: i64 = 0 62 while binp[gi] != (0 as u8) { gpath[gi] = binp[gi]; gi = gi + 1 } 63 let suf: *u8 = ".gold" as *u8 64 var si: i64 = 0 65 while suf[si] != (0 as u8) { gpath[gi + si] = suf[si]; si = si + 1 } 66 gpath[gi + si] = 0 as u8 67 var goldp: *u8 = gpath 68 if argc >= 3 { goldp = argv[2] as *u8 } 69 let glenp: *i64 = sys_mmap(16) as *i64 70 var gold: *u8 = sys_read_file(goldp, glenp) 71 if glenp[0] <= 0 { goldp = BR_GOLD_ALT; gold = sys_read_file(goldp, glenp) } 72 let glen: i64 = glenp[0] 73 74 var halted_ok: i64 = 0 75 if res[BOOTCAP_R_HALTED] == 1 { if res[BOOTCAP_R_CODE] == 0 { halted_ok = 1 } } 76 77 // A transcript that disagrees with the artifact's own golden is a FAILED boot, however 78 // cleanly it halted -- halting is not the same as working. 79 var tmatch: i64 = 1 80 var checked: i64 = 0 81 if glen > 0 { checked = 1; tmatch = br_eq(tx, cnt, gold, glen) } 82 83 let lfd: i64 = sys_openat_append(BR_LOG, 0x1a4) 84 if halted_ok == 1 { 85 if tmatch == 1 { 86 br_p("BOOTSOV verdict=GREEN (booted on the sovereign rv64 emu; clean finisher halt" as *u8) 87 if checked == 1 { br_p("; transcript==golden" as *u8) } else { br_p("; golden=ABSENT, transcript UNCHECKED" as *u8) } 88 br_p(") steps=" as *u8); br_fn(1, res[BOOTCAP_R_STEPS]); br_p("\n" as *u8) 89 if lfd >= 0 { 90 br_fp(lfd, "BOOTSOV verdict=GREEN steps=" as *u8); br_fn(lfd, res[BOOTCAP_R_STEPS]) 91 br_fp(lfd, " bytes=" as *u8); br_fn(lfd, cnt) 92 if checked == 1 { br_fp(lfd, " transcript=matched-golden" as *u8) } else { br_fp(lfd, " transcript=unchecked-no-golden" as *u8) } 93 br_fp(lfd, "\n" as *u8); sys_close(lfd) 94 } 95 sys_exit(0); return 0 96 } 97 br_p("BOOTSOV verdict=RED reason=transcript-mismatch (it halted cleanly but did NOT do what the golden says) golden=" as *u8) 98 br_p(goldp); br_p(" expected=[" as *u8); sys_write(1, gold, glen); br_p("] got=[" as *u8); sys_write(1, tx, cnt); br_p("]\n" as *u8) 99 if lfd >= 0 { br_fp(lfd, "BOOTSOV verdict=RED reason=transcript-mismatch got=" as *u8); sys_write(lfd, tx, cnt); br_fp(lfd, "\n" as *u8); sys_close(lfd) } 100 sys_exit(1); return 1 101 } 102 br_p("BOOTSOV verdict=RED (no clean halt) halted=" as *u8); br_fn(1, res[BOOTCAP_R_HALTED]) 103 br_p(" code=" as *u8); br_fn(1, res[BOOTCAP_R_CODE]); br_p("\n" as *u8) 104 if lfd >= 0 { br_fp(lfd, "BOOTSOV verdict=RED halted=" as *u8); br_fn(lfd, res[BOOTCAP_R_HALTED]); br_fp(lfd, "\n" as *u8); sys_close(lfd) } 105 sys_exit(1) 106 return 1 107}