nx_gop_efi_gate.nx source

1import "nx_gate_gn.nx" 2import "nx_gate_base.nx" 3// nx_gop_efi_gate.nx -- GATE for GX2: emit a real bootable UEFI GOP app (the games' pixels on a real x86 4// screen). Follows the nx_boot_uefi precedent: EMIT-proven + STRUCTURALLY-proven here; BOOT-proven on 5// OVMF/QEMU/real metal is GX4 (operator-gated). BUT adds a FUNCTIONAL check the text stub never had: the 6// GOP struct-walk + fill ALGORITHM is run against a MODELED GOP Mode + framebuffer -> the offset logic is 7// proven, not just the PE structure. 8// T1 ALGORITHM (functional): a modeled GOP Mode (FrameBufferBase/FrameBufferSize) -> gop_fill_mode fills the 9// framebuffer pixel-exact (every dword == color). Encodes a PNG (eyeball: a solid fill). 10// T2 STRUCTURAL: the emitted image is a valid subsystem-10 EFI PE32+ (MZ/PE/machine/subsystem/entry). 11// T3 GUID: the EFI_GRAPHICS_OUTPUT_PROTOCOL_GUID bytes are present + exact at .text+0x44. 12// T4 REPRO + TAMPER: two emits byte-identical; corrupting the subsystem OR a GUID byte makes verify REJECT. 13// T3 GUID offset is .text+0x46 (the 2-byte persist spin at 0x3D shifted it; 2026-08-04). 14// T5 NEVER-BRICK (#26): the .text writes ONLY volatile VRAM (rep stosd) + calls ONLY LocateProtocol 15// (read-only discovery) -- exactly one `call rax`, the FB-write present, NO SetMode/Blt call. By 16// construction it cannot touch firmware/CMOS/NVRAM. 17// Writes _offc/nx_gop_efi.efi for the operator to run (GX4). 18// expect_exit: 0 license_tier: ORIGINAL 19import "nx_gop_efi.nx" 20import "nx_png.nx" 21import "nx_syscalls.nx" 22 23func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw(" 24" as *u8); return ok } 25 26func main() -> i64 { 27 gw("=== nx_gop_efi_gate: GX2 -- emit a real bootable UEFI GOP app (the games' pixels on a real x86 screen) ===\n" as *u8) 28 var pass: i64 = 0; var total: i64 = 0 29 let W: i64=32; let H: i64=24; let LB: i64=W*H*4 // a modeled framebuffer (FrameBufferSize bytes) 30 let color: i64 = GOP_FILL_COLOR 31 32 // ---- T1: the GOP struct-walk + fill ALGORITHM, run against a MODELED GOP Mode ---- 33 let lfb: *u8 = sys_mmap(LB) 34 let mode: *i64 = sys_mmap(8*8) as *i64 35 mode[3] = lfb as i64 // +0x18 FrameBufferBase 36 mode[4] = LB // +0x20 FrameBufferSize 37 let nd: i64 = gop_fill_mode(mode as i64, color) 38 var mism: i64=0; var i: i64=0 39 while i < LB { 40 let dw: i64 = (lfb[i] as i64) | ((lfb[i+1] as i64)<<8) | ((lfb[i+2] as i64)<<16) | ((lfb[i+3] as i64)<<24) 41 if dw != (color & 0xFFFFFFFF) { mism=mism+1 } 42 i = i + 4 43 } 44 let pfb: *i64 = sys_mmap(8*(W*H+8)) as *i64 45 i=0; while i < W*H { pfb[i] = (lfb[i*4] as i64) | ((lfb[i*4+1] as i64)<<8) | ((lfb[i*4+2] as i64)<<16); i=i+1 } 46 write_png(pfb, W, H, "knowledge/nx_gop_efi.png" as *u8) 47 var t1ok: i64=1; if nd != LB/4 { t1ok=0 } if mism != 0 { t1ok=0 } 48 total=total+1; if t1ok==1 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) } 49 gw("T1 algorithm: modeled GOP Mode -> filled " as *u8); gn(nd); gw(" dwords, all==color mismatches=" as *u8); gn(mism); gw(" (PNG knowledge/nx_gop_efi.png)\n" as *u8) 50 51 // ---- emit the EFI image ---- 52 let buf: *u8 = sys_mmap(4096); let buf2: *u8 = sys_mmap(4096) 53 let sz: i64 = gop_efi_emit(buf); let sz2: i64 = gop_efi_emit(buf2) 54 55 // ---- T2: structural ---- 56 let structural: i64 = gop_efi_verify(buf) 57 total=total+1; if structural==1 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) } 58 gw("T2 structural: emitted a valid subsystem-10 EFI PE32+ (" as *u8); gn(sz); gw(" bytes, machine=0x8664, entry->.text)\n" as *u8) 59 60 // ---- T3: GUID exact ---- 61 var guid_ok: i64=1; var g: i64=0 62 while g < 16 { if (buf[FOFF_TEXT + 0x46 + g] as i64) != gop_guid_byte(g) { guid_ok=0 } g=g+1 } 63 total=total+1; if guid_ok==1 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) } 64 gw("T3 GUID: EFI_GRAPHICS_OUTPUT_PROTOCOL_GUID (9042a9de-..-516a) present + exact at .text+0x46\n" as *u8) 65 66 // ---- T4: repro + tamper ---- 67 var repro: i64=1; if sz != sz2 { repro=0 } i=0; while i < sz { if buf[i] != buf2[i] { repro=0 } i=i+1 } 68 _w16(buf2, OPT_SUBSYS, 3) // corrupt subsystem 10 -> 3 69 let tamper_sub: i64 = gop_efi_verify(buf2) // must reject 70 gop_efi_emit(buf2) // re-emit clean, then corrupt a GUID byte 71 buf2[FOFF_TEXT + 0x46] = (buf2[FOFF_TEXT + 0x46] as i64 ^ 0xFF) as u8 72 let tamper_guid: i64 = gop_efi_verify(buf2) // must reject 73 var t4ok: i64=1; if repro != 1 { t4ok=0 } if tamper_sub != 0 { t4ok=0 } if tamper_guid != 0 { t4ok=0 } 74 total=total+1; if t4ok==1 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) } 75 gw("T4 repro+tamper: two emits byte-identical (repro=" as *u8); gn(repro); gw("); corrupt subsystem->reject + corrupt GUID->reject (liar-kill)\n" as *u8) 76 77 // ---- T5: never-brick ---- 78 let nb: i64 = gop_efi_never_brick(buf) 79 total=total+1; if nb==1 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) } 80 gw("T5 never-brick (#26): .text writes ONLY volatile VRAM (rep stosd) + calls ONLY LocateProtocol -- no SetMode/Blt/Set-Variable/flash (nb=" as *u8); gn(nb); gw(")\n" as *u8) 81 82 // ---- write the bootable image (only if all green) ---- 83 if pass == total { 84 let ofd: i64 = sys_openat_wr("_offc/nx_gop_efi.efi" as *u8, 0x1a4) 85 if ofd >= 0 { sys_write(ofd, buf, sz); sys_close(ofd) } 86 gw("\n=== nx_gop_efi_gate " as *u8); gn(pass); gw("/" as *u8); gn(total) 87 gw(" GREEN (authored _offc/nx_gop_efi.efi -- a bootable UEFI GOP app; run on OVMF/QEMU/real x86 = GX4)\n" as *u8) 88 sys_exit(0); return 0 89 } 90 gw("\n=== nx_gop_efi_gate " as *u8); gn(pass); gw("/" as *u8); gn(total); gw(" RED\n" as *u8) 91 sys_exit(1); return 1 92}