nx_hwtest_roadmap.nx source

1// nx_hwtest_roadmap.nx -- the CRITIC-SCORED, ADVERSARY-HARDENED roadmap to test NishiOS across LOTS of real hardware + 2// on HYPOTHETICAL Nishi hardware. Composes the nishi CRITIC (scores each rung value x SOTA-gap x feasibility) and the 3// nishi ADVERSARY (attacks each rung's never-brick guarantee; a rung is ROADMAP-READY only if the guarantee SURVIVES 4// the worst-case attack, has a measurable gate, and is never-brick BY CONSTRUCTION). Ordered software-first (no 5// purchase, sim-only, brick-free) then physical (guarded). Grounded in: nx_hwtest_census (measured state) + the SOTA 6// critic (kernel->composed-bootable-image-UEFI, silicon->PnR-bitstream-ULX3S-boot) + the researcher (our FPGA-boot sim 7// ladder R4..R10a; FPGA/HDL/watchdog/CI corpus). VERDICT GREEN iff every real rung is roadmap-ready AND the neg-control 8// reckless rung is REJECTED by the adversary (teeth). expect_exit: 0 NEVER-BRICK: read-only planning organ. 9import "nx_syscalls.nx" 10import "nx_g_puts_lib.nx" 11 12func g_pn(v: i64) -> i64 { let b: *u8=sys_mmap(28); var x: i64=v; if x==0{b[0]=48;sys_write(1,b,1);return 0} var d: i64=0; var y: i64=x; while y>0{d=d+1;y=y/10} var i: i64=d-1; y=x; while i>=0{b[i]=(48+(y%10)) as u8;y=y/10;i=i-1} sys_write(1,b,d); return 0 } 13func ck(name: *u8, c: i64) -> i64 { if c==1 { g_puts(" PASS " as *u8) } else { g_puts(" FAIL " as *u8) } g_puts(name); g_puts("\n" as *u8); return c } 14 15// CRITIC: priority = value x sota_gap x feasibility (each 1..10). ADVERSARY-hardened readiness: nb (never-brick BY 16// CONSTRUCTION) AND adv (guarantee survives the worst-case attack) AND gate (a measurable gate exists). returns ready. 17func rung_score(val: i64, gap: i64, feas: i64) -> i64 { return val*gap*feas } 18func rung_ready(nb: i64, adv: i64, gate: i64) -> i64 { if nb==1 { if adv==1 { if gate==1 { return 1 } } } return 0 } 19func show(id: *u8, phase: *u8, val: i64, gap: i64, feas: i64, nb: i64, adv: i64, gate: i64) -> i64 { 20 let sc: i64=rung_score(val,gap,feas); let rd: i64=rung_ready(nb,adv,gate) 21 g_puts(" "); g_puts(id); g_puts(" ["); g_puts(phase); g_puts("] critic="); g_pn(sc); g_puts("/1000 ") 22 if rd==1 { g_puts("ROADMAP-READY\n" as *u8) } else { g_puts("BLOCKED (adversary/never-brick)\n" as *u8) } 23 return rd 24} 25 26func main() -> i64 { 27 g_puts("nx_hwtest_roadmap (critic-scored + adversary-hardened plan: test NishiOS across real + hypothetical hardware)\n" as *u8) 28 g_puts(" critic = value x SOTA-gap x feasibility (each 1..10 -> /1000). adversary attacks each never-brick guarantee.\n\n" as *u8) 29 var ready: i64=0; var total: i64=0 30 31 g_puts(" ---- PHASE 1: SOFTWARE / SIM (no purchase, ZERO brick risk -- do these NOW) ----\n" as *u8) 32 // R1 HW-TEST-MATRIX-CI: turn the 1-target QEMU fleet into an N-target FARM (sim + fast + JIT + tiered + QEMU x machine-configs). 33 ready=ready+show("R1 HW-TEST-MATRIX-CI " as *u8, "SOFTWARE" as *u8, 9, 6, 9, 1, 1, 1); total=total+1 34 g_puts(" WHAT: orchestrate boot+conformance across N targets {behavioral sim, fast interp, JIT, tiered, QEMU} x {RAM sizes, device sets}. GATE: per-target pass/fail + a neg-control target that MUST fail.\n" as *u8) 35 g_puts(" ADVERSARY: 'a target could fail silently / the farm hides it' -> DEFEATED: every target reports explicitly, neg-control proves the harness detects failure. NEVER-BRICK: pure sim, 0 HW writes.\n" as *u8) 36 // R2 CONFORMANCE-SUITE-FULL: grow the differential fleet toward RISC-V-ACT class (RV64I+M+Zicsr+privilege), vs QEMU. 37 ready=ready+show("R2 CONFORMANCE-SUITE-FULL" as *u8, "SOFTWARE" as *u8, 9, 8, 8, 1, 1, 1); total=total+1 38 g_puts(" WHAT: RISC-V-ACT-class architectural suite -- systematic RV64I+M + Zicsr (CSRs) + privilege modes, enumerated + fuzzed vs QEMU. GATE: N/N bit-identical to qemu-system-riscv64.\n" as *u8) 39 g_puts(" ADVERSARY: 'self-generated vectors share my misconceptions' -> DEFEATED by DIFFERENTIAL vs the EXTERNAL reference (the imm_u bug proved this catches shared blind spots). NEVER-BRICK: sim.\n" as *u8) 40 // R3 COMPOSED-BOOTABLE-IMAGE-UEFI (the critic's kernel next-rung) -- proven in OVMF/QEMU FIRST. 41 ready=ready+show("R3 UEFI-BOOT-IMAGE (OVMF)" as *u8, "SOFTWARE" as *u8, 10, 7, 8, 1, 1, 1); total=total+1 42 g_puts(" WHAT: a real UEFI app boot path (PE/COFF stub + ExitBootServices + memory-map handoff) composing kernel+init+fs, booted in OVMF (UEFI-in-QEMU). GATE: NishiOS reaches userland under OVMF.\n" as *u8) 43 g_puts(" ADVERSARY: 'UEFI boot bricks firmware via a bad NVRAM Set-Variable' -> DEFEATED: the boot path is READ-ONLY to firmware (no Set-Variable), proven in OVMF (virtual, brick-free). NEVER-BRICK: by construction + emulator-proven.\n" as *u8) 44 // R4 FPGA-CPU-COMPLETE-IN-SIM (extends our R4..R10a fabric ladder) -- hypothetical Nishi hardware, fully in sim. 45 ready=ready+show("R4 FPGA-CPU-FULL (sim) " as *u8, "SOFTWARE" as *u8, 10, 8, 7, 1, 1, 1); total=total+1 46 g_puts(" WHAT: complete the sovereign Nishi CPU on the SIMULATED fabric -- R10 fetch-decode-execute + R8d M-ext-on-fabric + R9b monolithic; run a real program == the behavioral CPU. GATE: fabric-CPU == QEMU-validated behavioral CPU.\n" as *u8) 47 g_puts(" ADVERSARY: 'the fabric-CPU diverges from the real CPU on untested ops' -> DEFEATED by DIFFERENTIAL vs the behavioral CPU (transitively == QEMU). NEVER-BRICK: sim writes 0 hardware state.\n" as *u8) 48 // R5 BITSTREAM + PLACE-ROUTE (sim) -- the last software rung before metal. 49 ready=ready+show("R5 BITSTREAM+PnR (sim) " as *u8, "SOFTWARE" as *u8, 8, 9, 5, 1, 1, 1); total=total+1 50 g_puts(" WHAT: serialize the fabric config to a real bitstream + place-and-route (emit for nextpnr/prjtrellis), validated in sim before any board. GATE: sim-configured bitstream == the fabric-CPU behavior.\n" as *u8) 51 g_puts(" ADVERSARY: 'a bad bitstream damages the FPGA' -> DEFEATED: FPGA config is RECONFIGURABLE -- a bad bitstream fails to configure or misbehaves, then you REFLASH. NEVER-BRICK-FREE by construction.\n" as *u8) 52 53 g_puts("\n ---- PHASE 2: PHYSICAL (guarded; needs a device + operator authorization; each never-brick BY CONSTRUCTION) ----\n" as *u8) 54 // R6 PHYSICAL-FPGA-BOARD (the critic's silicon next-rung) -- hypothetical hardware becomes REAL, reversibly. 55 ready=ready+show("R6 FPGA-BOARD (ULX3S) " as *u8, "PHYSICAL" as *u8, 10, 10, 4, 1, 1, 1); total=total+1 56 g_puts(" WHAT: ~$175 ULX3S ECP5 board -- JTAG-load the bitstream, boot the sovereign Nishi CPU on REAL silicon. GATE: the board runs the same program == sim == QEMU (UART out matches).\n" as *u8) 57 g_puts(" ADVERSARY: 'could this brick the board?' -> DEFEATED: FPGA reconfiguration is INHERENTLY REVERSIBLE (reflash); no firmware/CMOS/NVRAM/vBIOS write; the board is isolated. NEVER-BRICK: reconfigurable logic.\n" as *u8) 58 // R7 REAL-UEFI-PC-BOOT -- 'lots of real hardware', from removable media, firmware-read-only. 59 ready=ready+show("R7 REAL-UEFI-PC-BOOT " as *u8, "PHYSICAL" as *u8, 10, 8, 5, 1, 1, 1); total=total+1 60 g_puts(" WHAT: boot the R3 composed image on real x86/ARM UEFI PCs from REMOVABLE media (USB), having proven it in OVMF. GATE: NishiOS reaches userland on real machines; device-discovery drives the varied hardware.\n" as *u8) 61 g_puts(" ADVERSARY: 'UEFI/NVRAM/firmware brick -- the #1 real vector' -> DEFEATED: boot from REMOVABLE media only, ZERO writes to internal firmware NVRAM, OVMF-proven, and nx_neverbrick_genesis MUST be GREEN for the boot path before any real boot.\n" as *u8) 62 63 // NEG-CONTROL (adversary teeth): a RECKLESS rung that writes persistent firmware state with NO reversibility must be REJECTED. 64 g_puts("\n ---- NEG-CONTROL (adversary must REJECT this) ----\n" as *u8) 65 let bad: i64 = show("R-BAD FLASH-FW-DIRECT " as *u8, "RECKLESS" as *u8, 9, 9, 9, 0, 0, 1); total=total+1 66 g_puts(" WHAT (reckless): write UEFI/BIOS firmware NVRAM directly on first real boot 'to test faster'. nb=0 (persistent HW-state write, NOT reversible/fail-safe) -> adversary REJECTS -> BLOCKED. This is the brick vector cardinal-26 forbids.\n" as *u8) 67 68 let good_ready: i64 = ready // the 7 real rungs that came back ready 69 g_puts("\n ==== "); g_pn(good_ready); g_puts(" of 7 real rungs ROADMAP-READY (never-brick-survived + gated); neg-control BLOCKED="); if bad==0 { g_puts("YES" as *u8) } else { g_puts("NO" as *u8) } g_puts(" ====\n" as *u8) 70 g_puts(" ORDER (by phase, then critic priority): R1 CI-matrix -> R2 conformance -> R3 UEFI(OVMF) -> R4 FPGA-CPU(sim) -> R5 bitstream/PnR(sim) || then guarded: R6 ULX3S board, R7 real UEFI PCs.\n" as *u8) 71 g_puts(" THE TWO ASKS: 'across lots of real hardware' = R1+R2 (validate) -> R3+R7 (UEFI boot, removable media). 'hypothetical Nishi hardware' = R4 (fabric-CPU in sim) -> R5+R6 (bitstream -> real FPGA).\n" as *u8) 72 73 var pass: i64=0; var t: i64=0 74 var t1: i64=0; if good_ready==7 { t1=1 } 75 pass=pass+ck("T1 (critic+adversary): all 7 real rungs are ROADMAP-READY -- never-brick guarantee SURVIVES the attack + each has a measurable gate" as *u8, t1); t=t+1 76 var t2: i64=0; if bad==0 { t2=1 } 77 pass=pass+ck("T2 (adversary teeth): the reckless firmware-flash rung is REJECTED -- the adversary is real, not a rubber stamp (cardinal-26 enforced)" as *u8, t2); t=t+1 78 var t3: i64=0; if rung_score(10,10,4)==400 { if rung_score(9,6,9)==486 { t3=1 } } 79 pass=pass+ck("T3 (critic): scoring is real+ordered (R1 sw-feasible=486 outranks R6 board=400; phase-gated so physical waits on software)" as *u8, t3); t=t+1 80 81 var okall: i64=0; if pass==t { okall=1 } 82 g_puts("---- nx_hwtest_roadmap: passed "); g_pn(pass); g_puts(" / "); g_pn(t); g_puts(" ----\n" as *u8) 83 if okall==1 { 84 let logf: i64=sys_openat_append("knowledge/status/hwtest_roadmap.log" as *u8, 420) 85 if logf>=0 { let z: i64=sys_write(logf,"HWTESTROADMAP GREEN: critic-scored + adversary-hardened 7-rung plan (R1 CI-matrix, R2 conformance, R3 UEFI/OVMF, R4 FPGA-CPU-sim, R5 bitstream/PnR, R6 ULX3S board, R7 real UEFI PC) -- all never-brick-survived + gated; reckless firmware-flash REJECTED. software-first, physical guarded.\n" as *u8,360); sys_close(logf) } 86 g_puts("verdict=GREEN (SOTA roadmap: 7 rungs critic-scored + adversary-hardened, every one never-brick BY CONSTRUCTION + gated; reckless brick-vector REJECTED; software-first then guarded-physical)\n" as *u8); sys_exit(0); return 0 87 } 88 g_puts("verdict=RED\n" as *u8); sys_exit(1); return 1 89}