nx_ifetch_emit.nx source

1// nx_ifetch_emit.nx -- INSTRUCTION-FETCH translation test (virtual-memory-paging-mmu, CPU-datapath 2// completion rung). The data-load/store rung proved the CPU translates DATA addresses under Sv39; 3// this proves the CPU also translates the INSTRUCTION FETCH -- i.e. the PC itself is virtual in 4// S/U-mode and the next instruction is read through the page table. 5// 6// Table-computes a bare-metal rv64 image: 7// 1. M-mode (physical PC): install mtvec=&handler; lay a gigapage code PTE root[VPN2=3] 8// (VA 0xC0000000.. -> PA 0x80000000..); csrrw satp (Sv39 ON); mepc = the VIRTUAL address 9// 0xC0000000+cont_off; mstatus.MPP = S; mret. 10// 2. mret lands the PC at a VIRTUAL address -> the CPU FETCHES the continuation through the page 11// table (VA 0xC00000xx -> PA 0x800000xx) and runs it in S-mode -> emits "IOK". VA != PA, so 12// "IOK" can only print if the fetch was genuinely translated (not a physical read of the PC). 13// 3. CONTROL (gate re-emits with the code PTE's Valid bit cleared, 0x20000006): the mret targets an 14// UNMAPPED virtual PC -> the FETCH walk faults -> instruction-page-fault (mcause=12) -> vectors 15// to mtvec (the handler is fetched physically in M-mode) -> the handler confirms mcause==12 and 16// emits "IPF". "IPF" (and the absence of "IOK") proves the fetch faults on a bad code page. 17// Zero hand-written machine code: a tiny rv64 encoder + two-pass forward-branch resolution. 18// nx_ifetch_emit -> runtime/_hdl_build/_ifetch_virt.bin + .gold 19// Sovereign, no gcc/.sh. license_tier: ORIGINAL 20import "nx_syscalls.nx" 21const IFT_MAGIC_8192: i64 = 8192 22 23const IFT_OUT: *u8 = "runtime/_hdl_build/_ifetch_virt.bin" 24const IFT_GOLD: *u8 = "runtime/_hdl_build/_ifetch_virt.bin.gold" 25const IFT_LOG: *u8 = "knowledge/status/paging.log" 26 27const IFT_UART: i64 = 0x10000000 28const IFT_FIN: i64 = 0x100000 29const IFT_PASS: i64 = 0x5555 30const IFT_MEM_BASE: i64 = 0x80000000 31const IFT_VBASE: i64 = 0xC0000000 // virtual code base -> PA 0x80000000 (gigapage root[VPN2=3]) 32const IFT_CSR_SATP: i64 = 0x180 33const IFT_CSR_MSTATUS: i64 = 0x300 34const IFT_CSR_MTVEC: i64 = 0x305 35const IFT_CSR_MEPC: i64 = 0x341 36const IFT_CSR_MCAUSE: i64 = 0x342 37const IFT_MRET: i64 = 0x30200073 38const IFT_MPP_S: i64 = 0x800 // mstatus with MPP=01 (Supervisor) 39 40const RV_X0: i64 = 0 41const RV_T0: i64 = 5 // UART 42const RV_T1: i64 = 6 // value / satp scratch 43const RV_T2: i64 = 7 // mode scratch 44const RV_T3: i64 = 28 // mcause 45const RV_T4: i64 = 29 // expected cause 46const RV_T5: i64 = 30 // base scratch 47 48const IFT_PTE_ADDR: i64 = 0x80008000 // root page table 49const IFT_PTE_OFF: i64 = 0x18 // root[VPN2=3] = +3*8 (maps VA 0xC0000000..) 50const IFT_CODE_PTE: i64 = 0x2000000F // gigapage PPN 0x80000, V|R|W|X (leaf; X required to FETCH under perm enforcement) 51const IFT_SATP_PPN: i64 = 0x80008 // root >> 12 52const IFT_SV39: i64 = 8 53const IFT_INSTR_PF_CAUSE: i64 = 12 // instruction-page-fault mcause 54 55func ift_lui(rd: i64, imm20: i64) -> i64 { return ((imm20 & 0xFFFFF) << 12) | (rd << 7) | 0x37 } 56func ift_addi(rd: i64, rs1: i64, imm: i64) -> i64 { return ((imm & 0xFFF) << 20) | (rs1 << 15) | (rd << 7) | 0x13 } 57func ift_store(rs2: i64, rs1: i64, f3: i64, imm: i64) -> i64 { 58 let hi: i64 = ((imm >> 5) & 0x7f) << 25 59 let lo: i64 = (imm & 0x1f) << 7 60 return hi | (rs2 << 20) | (rs1 << 15) | (f3 << 12) | lo | 0x23 61} 62func ift_branch(rs1: i64, rs2: i64, f3: i64, imm: i64) -> i64 { 63 let b12: i64 = ((imm >> 12) & 0x1) << 31 64 let b11: i64 = ((imm >> 11) & 0x1) << 7 65 let b10_5: i64 = ((imm >> 5) & 0x3f) << 25 66 let b4_1: i64 = ((imm >> 1) & 0xf) << 8 67 return b12 | b10_5 | (rs2 << 20) | (rs1 << 15) | (f3 << 12) | b4_1 | b11 | 0x63 68} 69func ift_jal(rd: i64, imm: i64) -> i64 { 70 let b20: i64 = ((imm >> 20) & 0x1) << 31 71 let b19_12: i64 = ((imm >> 12) & 0xff) << 12 72 let b11: i64 = ((imm >> 11) & 0x1) << 20 73 let b10_1: i64 = ((imm >> 1) & 0x3ff) << 21 74 return b20 | b10_1 | b11 | b19_12 | (rd << 7) | 0x6f 75} 76func ift_slli(rd: i64, rs1: i64, shamt: i64) -> i64 { return ((shamt & 0x3f) << 20) | (rs1 << 15) | (1 << 12) | (rd << 7) | 0x13 } 77func ift_srli(rd: i64, rs1: i64, shamt: i64) -> i64 { return ((shamt & 0x3f) << 20) | (rs1 << 15) | (5 << 12) | (rd << 7) | 0x13 } 78func ift_or(rd: i64, rs1: i64, rs2: i64) -> i64 { return (rs2 << 20) | (rs1 << 15) | (6 << 12) | (rd << 7) | 0x33 } 79func ift_csrrw(rd: i64, csr: i64, rs1: i64) -> i64 { return ((csr & 0xfff) << 20) | (rs1 << 15) | (1 << 12) | (rd << 7) | 0x73 } 80func ift_csrrs(rd: i64, csr: i64, rs1: i64) -> i64 { return ((csr & 0xfff) << 20) | (rs1 << 15) | (2 << 12) | (rd << 7) | 0x73 } 81 82func ift_w32(buf: *u8, off: i64, w: i64) -> i64 { 83 buf[off]=(w&0xff) as u8; buf[off+1]=((w>>8)&0xff) as u8; buf[off+2]=((w>>16)&0xff) as u8; buf[off+3]=((w>>24)&0xff) as u8 84 return off + 4 85} 86func ift_li32(buf: *u8, off: i64, rd: i64, val: i64) -> i64 { 87 var hi: i64 = (val >> 12) & 0xFFFFF 88 var lo: i64 = val & 0xFFF 89 if lo >= 0x800 { lo = lo - 0x1000; hi = (hi + 1) & 0xFFFFF } 90 var o: i64 = ift_w32(buf, off, ift_lui(rd, hi)) 91 o = ift_w32(buf, o, ift_addi(rd, rd, lo)) 92 return o 93} 94func ift_li32u(buf: *u8, off: i64, rd: i64, val: i64) -> i64 { 95 var o: i64 = ift_li32(buf, off, rd, val) 96 o = ift_w32(buf, o, ift_slli(rd, rd, 32)) 97 o = ift_w32(buf, o, ift_srli(rd, rd, 32)) 98 return o 99} 100func ift_emit_str(buf: *u8, off: i64, s: *u8, n: i64) -> i64 { 101 var o: i64 = off 102 var i: i64 = 0 103 while i < n { o = ift_w32(buf, o, ift_addi(RV_T1, RV_X0, s[i] as i64)); o = ift_w32(buf, o, ift_store(RV_T1, RV_T0, 0, 0)); i = i + 1 } 104 return o 105} 106func ift_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 107func ift_fn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 108 109// pos_out[0]=CONT (virtual S-mode entry), [1]=HANDLER (physical M-mode), [2]=NOTIF, [3]=HALT 110func ift_emit_image(buf: *u8, cont_off: i64, handler_off: i64, notif_off: i64, halt_off: i64, pos_out: *i64, code_pte: i64) -> i64 { 111 var o: i64 = 0 112 o = ift_w32(buf, o, ift_lui(RV_T0, IFT_UART >> 12)) // t0 = UART 113 // install mtvec = &handler (physical M-mode kernel entry; fetched physically after a trap) 114 o = ift_li32u(buf, o, RV_T1, IFT_MEM_BASE + handler_off) 115 o = ift_w32(buf, o, ift_csrrw(RV_X0, IFT_CSR_MTVEC, RV_T1)) 116 // lay the code-map PTE root[VPN2=3]: VA 0xC0000000.. -> PA 0x80000000.. (tamper-able by the gate) 117 o = ift_li32u(buf, o, RV_T5, IFT_PTE_ADDR) 118 o = ift_li32(buf, o, RV_T1, code_pte) 119 o = ift_w32(buf, o, ift_store(RV_T1, RV_T5, 2, IFT_PTE_OFF)) // sw code_pte, 0x18(t5) 120 // build satp = (8<<60)|PPN and write it (translation ON) 121 o = ift_li32(buf, o, RV_T1, IFT_SATP_PPN) 122 o = ift_w32(buf, o, ift_addi(RV_T2, RV_X0, IFT_SV39)) 123 o = ift_w32(buf, o, ift_slli(RV_T2, RV_T2, 60)) 124 o = ift_w32(buf, o, ift_or(RV_T1, RV_T1, RV_T2)) 125 o = ift_w32(buf, o, ift_csrrw(RV_X0, IFT_CSR_SATP, RV_T1)) 126 // mepc = the VIRTUAL &cont (0xC0000000 + cont_off); mstatus.MPP = S; mret -> fetch from a virtual PC 127 o = ift_li32u(buf, o, RV_T1, IFT_VBASE + cont_off) 128 o = ift_w32(buf, o, ift_csrrw(RV_X0, IFT_CSR_MEPC, RV_T1)) 129 o = ift_li32(buf, o, RV_T1, IFT_MPP_S) 130 o = ift_w32(buf, o, ift_csrrw(RV_X0, IFT_CSR_MSTATUS, RV_T1)) 131 o = ift_w32(buf, o, IFT_MRET) 132 pos_out[0] = o // CONT: fetched via VA translation, runs in S-mode 133 o = ift_emit_str(buf, o, "IOK" as *u8, 3) 134 o = ift_w32(buf, o, ift_jal(RV_X0, halt_off - o)) // jal HALT 135 pos_out[1] = o // HANDLER (mtvec, physical, M-mode) 136 o = ift_w32(buf, o, ift_csrrs(RV_T3, IFT_CSR_MCAUSE, RV_X0)) // t3 = mcause 137 o = ift_li32(buf, o, RV_T4, IFT_INSTR_PF_CAUSE) // t4 = 12 138 let pcb: i64 = o 139 o = ift_w32(buf, o, ift_branch(RV_T3, RV_T4, 1, notif_off - pcb)) // bne t3,t4 -> NOTIF 140 o = ift_emit_str(buf, o, "IPF" as *u8, 3) // instruction-page-fault confirmed 141 o = ift_w32(buf, o, ift_jal(RV_X0, halt_off - o)) 142 pos_out[2] = o // NOTIF (some other cause) 143 o = ift_emit_str(buf, o, "IX" as *u8, 2) 144 pos_out[3] = o // HALT 145 o = ift_li32(buf, o, RV_T5, IFT_FIN) 146 o = ift_li32(buf, o, RV_T1, IFT_PASS) 147 o = ift_w32(buf, o, ift_store(RV_T1, RV_T5, 2, 0)) 148 o = ift_w32(buf, o, ift_jal(RV_X0, 0)) 149 return o 150} 151 152func ift_parse_num(s: *u8) -> i64 { 153 var q: i64 = 0; var val: i64 = 0 154 if s[0] == (48 as u8) { if s[1] == (120 as u8) { 155 q = 2 156 var go: i64 = 1 157 while go == 1 { let c: i64 = s[q] as i64; var d: i64 = 0-1; if c>=48 { if c<=57 { d=c-48 } } if c>=97 { if c<=102 { d=c-87 } } if c>=65 { if c<=70 { d=c-55 } } if d<0 { go=0 } else { val=val*16+d; q=q+1 } } 158 return val 159 }} 160 var go2: i64 = 1 161 while go2 == 1 { let c: i64 = s[q] as i64; if c>=48 { if c<=57 { val=val*10+(c-48); q=q+1 } else { go2=0 } } else { go2=0 } } 162 return val 163} 164 165func main(argc: i64, argv: *i64) -> i64 { 166 var code_pte: i64 = IFT_CODE_PTE 167 var outp: *u8 = IFT_OUT 168 if argc >= 2 { code_pte = ift_parse_num(argv[1] as *u8) } // code-PTE override (gate's bad-PTE tamper) 169 if argc >= 3 { outp = argv[2] as *u8 } // out-path override 170 let scratch: *u8 = sys_mmap(IFT_MAGIC_8192) 171 let pos: *i64 = sys_mmap(32) as *i64 172 ift_emit_image(scratch, 0, 0, 0, 0, pos, code_pte) // measure pass -> fixes CONT/HANDLER/NOTIF/HALT offsets 173 let cont_off: i64 = pos[0] 174 let handler_off: i64 = pos[1] 175 let notif_off: i64 = pos[2] 176 let halt_off: i64 = pos[3] 177 let buf: *u8 = sys_mmap(IFT_MAGIC_8192) 178 let sz: i64 = ift_emit_image(buf, cont_off, handler_off, notif_off, halt_off, pos, code_pte) 179 let fd: i64 = sys_openat_wr(outp, 420) 180 if fd < 0 { ift_p("IFETCHEMIT verdict=RED reason=out-unwritable\n" as *u8); return 1 } 181 sys_write(fd, buf, sz); sys_close(fd) 182 let gold: *u8 = sys_mmap(8) 183 gold[0]=73 as u8; gold[1]=79 as u8; gold[2]=75 as u8 // "IOK" 184 let gfd: i64 = sys_openat_wr(IFT_GOLD, 420) 185 if gfd >= 0 { sys_write(gfd, gold, 3); sys_close(gfd) } 186 ift_p("IFETCHEMIT name=" as *u8); ift_p(outp); ift_p(" bytes=" as *u8); ift_fn(1, sz); ift_p(" golden=IOK (CPU fetches code via a virtual PC under Sv39)\n" as *u8) 187 let lf: i64 = sys_openat_append(IFT_LOG, 420) 188 if lf >= 0 { var n: i64=0; let m: *u8="IFETCHEMIT authored _ifetch_virt.bin golden=IOK\n" as *u8; while m[n]!=(0 as u8){n=n+1} sys_write(lf,m,n); sys_close(lf) } 189 return 0 190}