code wiki / _hdl_build / nx_nxe_kernel0.nx
nx_nxe_kernel0.nx source
↩ module page · 1195 lines · 83024 B
1// nx_nxe_kernel0.nx -- N2: emit KERNEL.NXE, the FIRST Nishi-native-format executable (constitution A2:
2// NXE not ELF -- SSOT knowledge/nishi_os_constitution.txt). The payload is PIC x86-64 that receives
3// rbx=&bootinfo from the boot shim ({fb_base,fb_size,...}) and paints the Nishi desktop scene v0:
4// background, top bar, brand accent line, taskbar + start block, centered window with title bar and
5// close button, and the NISHI wordmark in 16px block cells -- then parks holding the screen (EB FE),
6// which is what a kernel owning the display does. Judged by the sovereign emulator's MEASURED
7// SCENE-PAINTED-AND-HOLDING verdict (every pixel written, many transitions) and by OVMF as oracle.
8//
9// NXE v0 HEADER (little-endian, spec = the constitution):
10// 0x00 magic "NXE0" | 0x04 ver=1 | 0x08 arch=1 (x86_64) | 0x0C flags=3 (kernel|needs-fb)
11// 0x10 entry_off | 0x18 text_off (0x40) | 0x20 text_size (8-padded) | 0x28 bss | 0x30 stack
12// 0x38 payload_sum64 (wrapping sum of payload LE u64s; the loader verifies or REFUSES loud)
13//
14// NEVER-BRICK (#26): the payload writes ONLY the framebuffer whose base the loader hands it; it makes
15// ZERO calls of any kind (structurally: the payload contains NO 0xFF byte at all -- colors and offsets
16// are chosen so the scan is exact), touches no firmware, no ports, no Set-Variable-class services.
17// license_tier: ORIGINAL
18import "nx_syscalls.nx"
19import "nx_font8x8.nx" // the sovereign 8x8 ASCII font -- pure glyph DATA, reused not reinvented
20const PCI_MAGIC_4096: i64 = 4096
21const PCI_MAGIC_8086: i64 = 8086
22const PCI_MAGIC_1237: i64 = 1237
23const PCI_CFG_ENABLE: i64 = 2147483648 // bit31 of CONFIG_ADDRESS
24const DECODE_WALK_GUARD: i64 = 4096 // max instructions the never-brick walk will decode
25const EMIT_BUF_BYTES: i64 = 65536 // emitter scratch
26
27const FB_W: i64 = 1280
28const FB_H: i64 = 800
29const NXE_HDR: i64 = 0x40
30const COL_BG: i64 = 0x001B2430 // desktop background (no 0xFF bytes in any color -- see fence)
31const COL_TOP: i64 = 0x002E3B4E // top bar
32const COL_ACCENT: i64 = 0x00AA8844 // brand tan
33const COL_TASK: i64 = 0x00232E3D // taskbar
34const COL_WIN: i64 = 0x00E8E4DC // window panel
35const COL_TITLE: i64 = 0x003A4A60 // window title bar
36const COL_CLOSE: i64 = 0x00AA4444 // close button
37const COL_TALLY: i64 = 0x0044CC88 // per-keystroke tally block (N3 input evidence, in pixels)
38// ===== AI1 (constitution A11): the AI compute primitive, executed AT BOOT =====================
39// An integer multiply-accumulate -- the inner loop of every GEMM in the nx_nofloat_* stack -- runs
40// inside the kernel with no libc, no allocator and no floating point, and the 32-bit accumulator is
41// PAINTED AS A PIXEL so the screen itself carries the result and the existing framebuffer
42// measurement reads it back. The vectors deliberately include NEGATIVE values: a zero/unsigned-
43// extension bug would change the sum, so sign handling is pinned by the KAT rather than assumed.
44const AI_K: i64 = 32 // dot-product length
45const AI_X: i64 = 1100 // KAT swatch position (top bar, clear of the scene)
46const AI_Y: i64 = 8
47const AI_W: i64 = 24
48const AI_H: i64 = 20
49// The three state lines. Restated as plain ASCII here so the SOURCE says exactly what the SCREEN
50// will say -- a reader should never have to decode a colour to learn what the machine decided.
51func str_off(i: i64) -> i64 {
52 let t: *u8 = "NISHI OS 0.1 GPT ESP NXE KERNEL AI: OFF (no NISHI.AI on the medium)" as *u8
53 return t[i] as i64
54}
55func str_bad(i: i64) -> i64 {
56 let t: *u8 = "NISHI OS 0.1 GPT ESP NXE KERNEL AI: REFUSED (NISHI.AI did not validate)" as *u8
57 return t[i] as i64
58}
59func str_on(i: i64) -> i64 {
60 let t: *u8 = "NISHI OS 0.1 GPT ESP NXE KERNEL AI: ON (weights loaded from NISHI.AI)" as *u8
61 return t[i] as i64
62}
63func str_len(which: i64) -> i64 {
64 var n: i64 = 0
65 while n < PCI_MAGIC_4096 {
66 var c: i64 = 0
67 if which == 0 { c = str_off(n) } else { if which == 1 { c = str_bad(n) } else { c = str_on(n) } }
68 if c == 0 { return n }
69 n = n + 1
70 }
71 return 0
72}
73func ai_a(k: i64) -> i64 { return (k % 7) - 3 } // -3..3, crosses zero and goes negative
74func ai_b(k: i64) -> i64 { return (k % 5) + 1 } // 1..5
75// ===== AI2: the OPTIONAL assistant. THE TOGGLE IS THE FILE. =====================================
76// The loader hands the kernel a pointer at bootinfo +0x78: non-zero = /NISHI.AI was on the ESP and
77// was read, zero = it was absent (the DEFAULT). The kernel decides what that is worth, and paints
78// its verdict in THREE DISTINCT COLOURS rather than reusing a computed value -- a status that can
79// collide with a legitimate result is indistinguishable from one, which is the trap that made a
80// backwards registry scan look like an honest UNBOUND for a whole cycle.
81// OFF = no file. The built-in KAT vectors run, exactly as before this rung.
82// REFUSED = a file is present but is not ours / is corrupt. The KAT vectors run; the FILE DOES
83// NOT. A blob we cannot validate must never reach the multiply-accumulate.
84// ON = validated. The MAC runs over the FILE'S weights, so the painted accumulator is a
85// function of the file -- swap the file, the number changes. That is the whole claim.
86// Validation is three independent checks: magic, declared K, and a sum64 the file carries over its
87// own weights. Magic and K are compared against 32-bit immediates so NO new payload data and NO new
88// instruction shape is needed -- the never-brick allow-set does not grow by one byte for this rung.
89// ===== TEXT (rung 1 of the published /compare/smallos climb) ====================================
90// Until now the kernel could paint a FIXED 5x7 wordmark and nothing else -- it could not draw a
91// string. This renders arbitrary NUL-terminated ASCII from the sovereign 8x8 font carried as payload
92// DATA, at runtime, with the string CHOSEN BY THE MACHINE'S OWN STATE. One renderer, three strings:
93// the assistant's OFF/REFUSED/ON verdict is now written in WORDS as well as colour, because a colour
94// block is only legible to someone holding this source.
95// A glyph is 8 bytes = exactly ONE qword load, which is why no byte-load shape is needed.
96const FONT_GLYPHS: i64 = 96 // printable 0x20..0x7E, indexed (ch-0x20)*8
97const FONT_BYTES: i64 = 768 // FONT_GLYPHS * 8
98const TXT_X: i64 = 264
99const TXT_Y: i64 = 664
100const COL_TEXT: i64 = 0x00E0E6F0
101const STR_PAD: i64 = 8 // 8 zero bytes after the last string: the char fetch reads a
102 // QWORD, so the final NUL must have 7 readable bytes behind it
103const AI_MAGIC: i64 = 0x3057584E // "NXW0" little-endian; the file stores it as a qword
104// NXW2: NISHI.AI is the SLOT, not the model. The blob carries the ORIGINAL model name and the URL it
105// came from, so the machine can SAY what it loaded and the user can choose something else. Both live
106// INSIDE the checksummed region -- provenance you can edit without detection is not provenance.
107const AIW_NAME: i64 = 0x20 // 64B NUL-terminated model name (rendered on screen)
108const AIW_ORIGIN: i64 = 0x60 // 128B NUL-terminated origin URL (carried for the GUI installer)
109const AIW_LICENSE: i64 = 0xE0 // 32B
110const AIW_WEIGHTS: i64 = 0x100 // A[K] then B[K]
111// the sum covers everything from the name onward: provenance AND numbers, in qwords
112const AIW_SUMQ: i64 = 92 // (AIW_WEIGHTS - AIW_NAME)/8 + 2*AI_K = 28 + 64
113const COL_AI_OFF: i64 = 0x00566070 // slate -- no assistant file present (honest default)
114const COL_AI_REFUSED: i64 = 0x00DD3355 // red -- present but did not validate; NOT executed
115const COL_AI_ON: i64 = 0x0033DD66 // green -- validated; the MAC below ran on ITS weights
116const AIST_X: i64 = 1064
117const AIST_Y: i64 = 8
118const AIST_W: i64 = 24
119const AIST_H: i64 = 20
120const TALLY_X: i64 = 160
121const TALLY_Y: i64 = 772
122const TALLY_W: i64 = 16
123const TALLY_H: i64 = 20
124const TALLY_GAP: i64 = 6
125// N4 ownership swatch: painted only AFTER ExitBootServices returns, so its presence is proof the
126// kernel survived losing the firmware. Sits beside the AI1 swatch in the top bar.
127const COL_OWNED: i64 = 0x00CC44AA
128const OWN_X: i64 = 1140
129const OWN_Y: i64 = 8
130const MM_BUF_BYTES: i64 = 0x4000
131// HW1 (A16 spore): the kernel enumerates the PCI bus ITSELF after the firmware is gone -- no host
132// OS, no /sys, no firmware service. CONFIG_ADDRESS is a selector (safe to write); CONFIG_DATA is
133// read only. A slot that reads back all-ones is ABSENT: enumeration must treat that as nothing
134// there, or it invents hardware.
135const PCI_ADDR_PORT: i64 = 0xCF8
136const PCI_DATA_PORT: i64 = 0xCFC
137const PCI_SLOTS: i64 = 32
138const PCI_X: i64 = 300
139const PCI_Y: i64 = 44 // just under the accent line, clear of the desktop window
140const PCI_W: i64 = 18
141const PCI_H: i64 = 14
142const PCI_GAP: i64 = 4
143// HW2 (A16): the driver REGISTRY is DATA carried in the payload -- a new supported device is a new
144// ROW, never new code (X-DRV-W1's law, applied in the x86 lane). A probed ID that is not in the
145// registry paints UNBOUND: an unbound device is a true statement, a false bind is a lie.
146const COL_BOUND: i64 = 0x0044CC88 // registry hit -> we know how to drive this
147const COL_UNBOUND: i64 = 0x00CC7744 // no spec -> honestly not bound
148// Each row carries a PROGRAM -- an op-list the kernel interprets. The control flow is the SPEC'S,
149// not ours: row 0 runs 4 steps, row 1 runs 7 (it checks the vendor register FIRST, then the class
150// register), and the interpreter never changes. That is X-DRV-W1's claim -- a driver spec carries
151// the protocol step-sequence as DATA -- expressed in the x86 lane.
152const OP_END: i64 = 0
153const OP_READ: i64 = 1 // acc = pci config dword at (arg & 0xFC)
154const OP_AND: i64 = 2 // acc = acc & arg
155const OP_EXPECT: i64 = 3 // acc must equal arg, else the device is MISMATCHED
156const OP_SHR: i64 = 4 // acc = acc >> arg (extract a field without a mask)
157const OPS_MAX: i64 = 10
158const REG_N: i64 = 2
159const REG_STRIDE: i64 = 168 // id(8) + OPS_MAX * (op,arg)(16)
160func reg_id(i: i64) -> i64 {
161 if i == 0 { return 0x12378086 } // host bridge PCI_MAGIC_8086:PCI_MAGIC_1237
162 return 0x100E8086 // network PCI_MAGIC_8086:100E (virtio block is NOT in the registry)
163}
164func reg_op(i: i64, k: i64) -> i64 {
165 if i == 0 {
166 if k == 0 { return OP_READ }
167 if k == 1 { return OP_AND }
168 if k == 2 { return OP_EXPECT }
169 return OP_END
170 }
171 if k == 0 { return OP_READ }
172 if k == 1 { return OP_AND }
173 if k == 2 { return OP_EXPECT }
174 if k == 3 { return OP_READ }
175 if k == 4 { return OP_SHR }
176 if k == 5 { return OP_EXPECT }
177 if k == 6 { return OP_READ }
178 if k == 7 { return OP_AND }
179 if k == 8 { return OP_EXPECT }
180 return OP_END
181}
182func reg_arg(i: i64, k: i64) -> i64 {
183 if i == 0 {
184 if k == 0 { return 8 }
185 if k == 1 { return 0xFFFFFF00 } // class+subclass+progif; revision is NOT identity
186 if k == 2 { return 0x06000000 }
187 return 0
188 }
189 if k == 0 { return 0 }
190 if k == 1 { return 0x0000FFFF }
191 if k == 2 { return 0x00008086 } // vendor
192 if k == 3 { return 8 }
193 if k == 4 { return 24 } // shift the class byte down instead of masking
194 if k == 5 { return 0x02 } // class 02 = network
195 if k == 6 { return 0x10 } // BAR0 -- the address a driver would bring the device up through
196 if k == 7 { return 1 } // bit0: 0 = memory BAR, 1 = I/O BAR
197 if k == 8 { return 0 } // must be a MEMORY BAR before anything maps it
198 return 0
199}
200const COL_VERIFIED: i64 = 0x0033DD66 // spec matched AND the device answered as the spec says
201const COL_MISMATCH: i64 = 0x00DD3355 // in the registry, but the device did NOT match its spec
202const COL_PCI: i64 = 0x00DDAA33
203// N4b: after ExitBootServices there is no ConIn, so the kernel drives the 8042 itself. The
204// heartbeat bar grows one column per loop iteration, which is what proves on real hardware that
205// the machine is RUNNING our code rather than frozen on a pretty picture.
206const PS2_STATUS: i64 = 0x64
207const PS2_DATA: i64 = 0x60
208const HB_X: i64 = 300
209const HB_Y: i64 = 772
210const HB_W: i64 = 700
211const HB_H: i64 = 20
212const COL_HB: i64 = 0x0066AACC
213
214func _w8(b: *u8, o: i64, v: i64) -> i64 { b[o] = (v & 0xff) as u8; return o + 1 }
215func _w32(b: *u8, o: i64, v: i64) -> i64 { _w8(b,o,v); _w8(b,o+1,v>>8); _w8(b,o+2,v>>16); _w8(b,o+3,v>>24); return o + 4 }
216func _w64(b: *u8, o: i64, v: i64) -> i64 { _w32(b, o, v); _w32(b, o + 4, v >> 32); return o + 8 }
217func _r64(b: *u8, o: i64) -> i64 {
218 var v: i64 = 0; var i: i64 = 0
219 while i < 8 { v = v | ((b[o + i] as i64) << (8 * i)); i = i + 1 }
220 return v
221}
222func e_p(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
223func e_fp(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
224func e_fn(fd: i64, v: i64) -> i64 {
225 let bb: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { m = 0 - m }
226 let t: *u8 = sys_mmap(28); var k: i64 = 0
227 if m == 0 { t[0] = 48; k = 1 }
228 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
229 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 }
230 sys_write(fd, bb, k); return 0
231}
232
233// NISHI 5x7 block glyphs, one 5-bit row value per (letter,row); MSB = leftmost column
234func glyph_row(l: i64, r: i64) -> i64 {
235 if l == 0 { // N
236 if r == 0 { return 17 } if r == 1 { return 25 } if r == 2 { return 21 }
237 if r == 3 { return 19 } return 17
238 }
239 if l == 1 { // I
240 if r == 0 { return 31 } if r == 6 { return 31 } return 4
241 }
242 if l == 2 { // S
243 if r == 0 { return 15 } if r == 1 { return 16 } if r == 2 { return 16 }
244 if r == 3 { return 14 } if r == 4 { return 1 } if r == 5 { return 1 }
245 return 30
246 }
247 if l == 3 { // H
248 if r == 3 { return 31 } return 17
249 }
250 // I again
251 if r == 0 { return 31 } if r == 6 { return 31 } return 4
252}
253
254// ===== emit one PIC rect-fill block (47 bytes; regs: rsi=fb rdi=cursor rdx/rax/rcx scratch rbp=rows) ==
255// FAIL-CLOSED: refuses (exit 3) any rect outside the 1280x800 mode -- an OOB rect is never emitted.
256func emit_rect(b: *u8, o0: i64, x: i64, y: i64, w: i64, h: i64, color: i64) -> i64 {
257 if x < 0 { e_p("NXEK REFUSED: rect x<0\n" as *u8); sys_exit(3); return 0 }
258 if y < 0 { e_p("NXEK REFUSED: rect y<0\n" as *u8); sys_exit(3); return 0 }
259 if (x + w) > FB_W { e_p("NXEK REFUSED: rect exceeds width\n" as *u8); sys_exit(3); return 0 }
260 if (y + h) > FB_H { e_p("NXEK REFUSED: rect exceeds height\n" as *u8); sys_exit(3); return 0 }
261 var o: i64 = o0
262 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC2); o=_w32(b,o,(y*FB_W+x)*4) // mov rdx, byte-offset
263 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0xF7) // mov rdi, rsi
264 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD7) // add rdi, rdx
265 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC5); o=_w32(b,o,h) // mov rbp, rows
266 // ROW:
267 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC1); o=_w32(b,o,w) // mov rcx, w
268 o=_w8(b,o,0xB8); o=_w32(b,o,color) // mov eax, color
269 o=_w8(b,o,0xF3); o=_w8(b,o,0xAB) // rep stosd
270 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC2); o=_w32(b,o,(FB_W-w)*4) // mov rdx, row gap
271 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD7) // add rdi, rdx
272 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xED); o=_w8(b,o,0x01) // sub rbp, 1
273 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xFD); o=_w8(b,o,0x00) // cmp rbp, 0
274 o=_w8(b,o,0x75); o=_w8(b,o,0xDE) // jnz ROW (rel8 -34)
275 return o
276}
277
278// ===== build the payload; returns its length ====================================================
279func build_payload(b: *u8, txtbytes: *i64) -> i64 {
280 var o: i64 = 0
281 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x73); o=_w8(b,o,0x00) // mov rsi,[rbx+0] fb_base
282 o = emit_rect(b, o, 0, 0, FB_W, 800, COL_BG)
283 o = emit_rect(b, o, 0, 0, FB_W, 36, COL_TOP)
284 o = emit_rect(b, o, 0, 36, FB_W, 4, COL_ACCENT)
285 o = emit_rect(b, o, 0, 764, FB_W, 36, COL_TASK)
286 o = emit_rect(b, o, 8, 770, 120, 24, COL_ACCENT) // start block
287 o = emit_rect(b, o, 240, 140, 800, 480, COL_WIN)
288 o = emit_rect(b, o, 240, 140, 800, 36, COL_TITLE)
289 o = emit_rect(b, o, 1012,148, 20, 20, COL_CLOSE) // close button
290 // NISHI wordmark: 5 letters, 16px cells, merged horizontal runs per glyph row
291 var l: i64 = 0
292 while l < 5 {
293 var r: i64 = 0
294 while r < 7 {
295 let bits: i64 = glyph_row(l, r)
296 var c: i64 = 0
297 while c < 5 {
298 if ((bits >> (4 - c)) & 1) == 1 {
299 var run: i64 = 1
300 var scan: i64 = 1
301 while scan == 1 {
302 if (c + run) < 5 {
303 if ((bits >> (4 - (c + run))) & 1) == 1 { run = run + 1 } else { scan = 0 }
304 } else { scan = 0 }
305 }
306 o = emit_rect(b, o, 408 + l*96 + c*16, 342 + r*16, run*16, 16, COL_ACCENT)
307 c = c + run
308 } else { c = c + 1 }
309 }
310 r = r + 1
311 }
312 l = l + 1
313 }
314 // ===== AI1: multiply-accumulate at boot, then paint the accumulator as a colour ==============
315 // Vectors live at the payload's tail and are reached RIP-relative (the payload is PIC and does
316 // not know its own load address). rsi/rdi walk them; rax accumulates; the result is stashed in
317 // the bootinfo scratch (+0x28) and used as the fill colour of a swatch in the top bar.
318 // ---- AI2 SELECT: the file decides which weights the MAC below runs on -------------------
319 // Every shape here is ALREADY in the never-brick allow-set (mod01 lea, mod00/mod01 loads,
320 // cmp r64,r64, grp1 imm8/imm32, mov rdi,rsi, jcc rel32/rel8, jmp rel32) -- this rung widens
321 // the decode surface by EXACTLY ZERO instructions, which is the evidence that it fits the
322 // envelope rather than stretching it.
323 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x78) // mov rax,[rbx+0x78] ai_ptr
324 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xF8); o=_w8(b,o,0x00) // cmp rax,0
325 let ai_jz_off: i64 = o
326 o=_w8(b,o,0x0F); o=_w8(b,o,0x84); o=_w32(b,o,0) // jz AI_OFF (patched)
327 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x08) // mov rcx,[rax] magic
328 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC2); o=_w32(b,o,AI_MAGIC) // mov rdx,AI_MAGIC
329 o=_w8(b,o,0x48); o=_w8(b,o,0x39); o=_w8(b,o,0xD1) // cmp rcx,rdx
330 let ai_jnz_bad1: i64 = o
331 o=_w8(b,o,0x0F); o=_w8(b,o,0x85); o=_w32(b,o,0) // jnz AI_BAD (patched)
332 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x48); o=_w8(b,o,0x08) // mov rcx,[rax+8] declared K
333 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC2); o=_w32(b,o,AI_K) // mov rdx,AI_K
334 o=_w8(b,o,0x48); o=_w8(b,o,0x39); o=_w8(b,o,0xD1) // cmp rcx,rdx
335 let ai_jnz_bad2: i64 = o
336 o=_w8(b,o,0x0F); o=_w8(b,o,0x85); o=_w32(b,o,0) // jnz AI_BAD (patched)
337 // sum64 over the file's own 2K weight lanes, compared against the sum the file carries.
338 o=_w8(b,o,0x48); o=_w8(b,o,0x8D); o=_w8(b,o,0x70); o=_w8(b,o,AIW_NAME) // lea rsi,[rax+name]
339 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC5); o=_w32(b,o,AIW_SUMQ) // mov rbp, name..weights end
340 o=_w8(b,o,0x48); o=_w8(b,o,0x31); o=_w8(b,o,0xC9) // xor rcx,rcx
341 let ai_sumloop: i64 = o
342 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x16) // AISUM: mov rdx,[rsi]
343 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD1) // add rcx,rdx
344 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xC6); o=_w8(b,o,0x08) // add rsi,8
345 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xED); o=_w8(b,o,0x01) // sub rbp,1
346 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xFD); o=_w8(b,o,0x00) // cmp rbp,0
347 let d_aisum: i64 = rel8(ai_sumloop, o + 2) // computed BEFORE emitting: the first _w8 ADVANCES
348 // o, so an inline (o+2) measures from the wrong
349 // origin and the back-edge lands one byte early.
350 o=_w8(b,o,0x75); o=_w8(b,o,d_aisum) // jnz AISUM
351 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x50); o=_w8(b,o,0x10) // mov rdx,[rax+0x10] stored sum
352 o=_w8(b,o,0x48); o=_w8(b,o,0x39); o=_w8(b,o,0xD1) // cmp rcx,rdx
353 let ai_jnz_bad3: i64 = o
354 o=_w8(b,o,0x0F); o=_w8(b,o,0x85); o=_w32(b,o,0) // jnz AI_BAD (patched)
355 // ON: paint the green status block, then aim the MAC at the FILE'S vectors.
356 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x73); o=_w8(b,o,0x00) // mov rsi,[rbx+0] fb
357 o = emit_rect(b, o, AIST_X, AIST_Y, AIST_W, AIST_H, COL_AI_ON)
358 let txt_lea_on: i64 = o
359 o=_w8(b,o,0x48); o=_w8(b,o,0x8D); o=_w8(b,o,0x05); o=_w32(b,o,0) // lea rax,[rip+STR2] (patched)
360 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x48) // mov [rbx+0x48],rax = the line to draw
361 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x78) // reload ai_ptr (the rect
362 // fill clobbers rax)
363 // THE SCREEN NAMES THE MODEL IT LOADED. The text renderer takes a pointer, so pointing it at the
364 // blob's own name field costs two instructions and turns "ON" into "which one, and from where".
365 // Swap the file and the words change -- the bite is free.
366 o=_w8(b,o,0x48); o=_w8(b,o,0x8D); o=_w8(b,o,0x48); o=_w8(b,o,AIW_NAME) // lea rcx,[rax+name]
367 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x4B); o=_w8(b,o,0x48) // mov [rbx+0x48],rcx
368 // Weights sit past the provenance now. mod10 lea is NOT in the never-brick allow-set, so the
369 // offset is applied with mov+add -- two shapes already audited -- rather than widening it.
370 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0xC6) // mov rsi,rax
371 o=_w8(b,o,0x48); o=_w8(b,o,0x81); o=_w8(b,o,0xC6); o=_w32(b,o,AIW_WEIGHTS) // add rsi,0x100 = A
372 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0xF7) // mov rdi,rsi
373 o=_w8(b,o,0x48); o=_w8(b,o,0x81); o=_w8(b,o,0xC7); o=_w32(b,o,AI_K * 8) // add rdi,K*8 = B
374 let ai_jmp_on: i64 = o
375 o=_w8(b,o,0xE9); o=_w32(b,o,0) // jmp AI_MAC (patched)
376 let ai_bad_lbl: i64 = o
377 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x73); o=_w8(b,o,0x00) // AI_BAD: mov rsi,[rbx+0]
378 o = emit_rect(b, o, AIST_X, AIST_Y, AIST_W, AIST_H, COL_AI_REFUSED)
379 let txt_lea_bad: i64 = o
380 o=_w8(b,o,0x48); o=_w8(b,o,0x8D); o=_w8(b,o,0x05); o=_w32(b,o,0) // lea rax,[rip+STR1] (patched)
381 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x48) // mov [rbx+0x48],rax = the line to draw
382 let ai_jmp_bad: i64 = o
383 o=_w8(b,o,0xE9); o=_w32(b,o,0) // jmp AI_BAKED (patched)
384 let ai_off_lbl: i64 = o
385 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x73); o=_w8(b,o,0x00) // AI_OFF: mov rsi,[rbx+0]
386 o = emit_rect(b, o, AIST_X, AIST_Y, AIST_W, AIST_H, COL_AI_OFF)
387 let txt_lea_off: i64 = o
388 o=_w8(b,o,0x48); o=_w8(b,o,0x8D); o=_w8(b,o,0x05); o=_w32(b,o,0) // lea rax,[rip+STR0] (patched)
389 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x48) // mov [rbx+0x48],rax = the line to draw
390 let ai_baked_lbl: i64 = o
391 _w32(b, ai_jz_off + 2, ai_off_lbl - (ai_jz_off + 6))
392 _w32(b, ai_jnz_bad1 + 2, ai_bad_lbl - (ai_jnz_bad1 + 6))
393 _w32(b, ai_jnz_bad2 + 2, ai_bad_lbl - (ai_jnz_bad2 + 6))
394 _w32(b, ai_jnz_bad3 + 2, ai_bad_lbl - (ai_jnz_bad3 + 6))
395 _w32(b, ai_jmp_bad + 1, ai_baked_lbl - (ai_jmp_bad + 5))
396 let ai_lea_a: i64 = o
397 o=_w8(b,o,0x48); o=_w8(b,o,0x8D); o=_w8(b,o,0x35); o=_w32(b,o,0) // lea rsi,[rip+A] (patched)
398 let ai_lea_b: i64 = o
399 o=_w8(b,o,0x48); o=_w8(b,o,0x8D); o=_w8(b,o,0x3D); o=_w32(b,o,0) // lea rdi,[rip+B] (patched)
400 let ai_mac_setup: i64 = o
401 _w32(b, ai_jmp_on + 1, ai_mac_setup - (ai_jmp_on + 5)) // the ON path skips the baked leas
402 o=_w8(b,o,0x48); o=_w8(b,o,0x31); o=_w8(b,o,0xC0) // xor rax,rax (accumulator)
403 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC5); o=_w32(b,o,AI_K) // mov rbp,K
404 let ai_loop: i64 = o
405 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x0E) // MAC: mov rcx,[rsi]
406 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x17) // mov rdx,[rdi]
407 o=_w8(b,o,0x48); o=_w8(b,o,0x0F); o=_w8(b,o,0xAF); o=_w8(b,o,0xCA) // imul rcx,rdx (SIGNED)
408 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xC8) // add rax,rcx
409 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xC6); o=_w8(b,o,0x08) // add rsi,8
410 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xC7); o=_w8(b,o,0x08) // add rdi,8
411 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xED); o=_w8(b,o,0x01) // sub rbp,1
412 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xFD); o=_w8(b,o,0x00) // cmp rbp,0
413 let d_ai: i64 = rel8(ai_loop, o + 2)
414 o=_w8(b,o,0x75); o=_w8(b,o,d_ai) // jnz MAC
415 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x28) // mov [rbx+0x28],rax (result)
416 // paint the swatch, colour = the computed accumulator (NOT a constant)
417 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x73); o=_w8(b,o,0x00) // mov rsi,[rbx+0] fb
418 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0xF7) // mov rdi,rsi
419 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC2); o=_w32(b,o,(AI_Y*FB_W+AI_X)*4) // mov rdx,offset
420 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD7) // add rdi,rdx
421 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC5); o=_w32(b,o,AI_H) // mov rbp,rows
422 let ai_row: i64 = o
423 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC1); o=_w32(b,o,AI_W) // AROW: mov rcx,w
424 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x28) // mov rax,[rbx+0x28]
425 o=_w8(b,o,0xF3); o=_w8(b,o,0xAB) // rep stosd
426 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC2); o=_w32(b,o,(FB_W-AI_W)*4) // mov rdx,gap
427 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD7) // add rdi,rdx
428 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xED); o=_w8(b,o,0x01) // sub rbp,1
429 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xFD); o=_w8(b,o,0x00) // cmp rbp,0
430 let d_arow: i64 = rel8(ai_row, o + 2)
431 o=_w8(b,o,0x75); o=_w8(b,o,d_arow) // jnz AROW
432
433 // ===== RUNTIME TEXT: draw the NUL-terminated line at [rbx+0x48] in the 8x8 sovereign font =====
434 // Scratch lives in bootinfo (the kernel's own slots) because there are not enough registers:
435 // +0x48 string cursor +0x50 glyph-origin framebuffer address +0x58 font base
436 // +0x60 the current glyph's 8 rows, shifted down one row per pass +0x68 column counter
437 // Those slots are firmware-map fields that are only written by the ExitBootServices path, which
438 // cannot have run yet -- the text is drawn while boot services are still alive. Stated because
439 // "this register is free here" is exactly the assumption that rots when the code moves.
440 let txt_lea_font: i64 = o
441 o=_w8(b,o,0x48); o=_w8(b,o,0x8D); o=_w8(b,o,0x05); o=_w32(b,o,0) // lea rax,[rip+FONT] (patched)
442 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x58) // mov [rbx+0x58],rax
443 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x00) // mov rax,[rbx+0] fb
444 o=_w8(b,o,0x48); o=_w8(b,o,0x81); o=_w8(b,o,0xC0); o=_w32(b,o,(TXT_Y*FB_W+TXT_X)*4) // add rax,origin
445 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x50) // mov [rbx+0x50],rax
446 let ch_loop: i64 = o
447 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x73); o=_w8(b,o,0x48) // CHAR: mov rsi,[rbx+0x48]
448 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x06) // mov rax,[rsi] (qword; NUL-safe: padded)
449 o=_w8(b,o,0x48); o=_w8(b,o,0x81); o=_w8(b,o,0xE0); o=_w32(b,o,0xFF) // and rax,0xFF -> the char
450 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xF8); o=_w8(b,o,0x00) // cmp rax,0
451 let jz_txt_done: i64 = o
452 o=_w8(b,o,0x0F); o=_w8(b,o,0x84); o=_w32(b,o,0) // jz TXT_DONE (patched)
453 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xE8); o=_w8(b,o,0x20) // sub rax,0x20 (font base char)
454 o=_w8(b,o,0x48); o=_w8(b,o,0xC1); o=_w8(b,o,0xE0); o=_w8(b,o,0x03) // shl rax,3 (x8 bytes/glyph)
455 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x53); o=_w8(b,o,0x58) // mov rdx,[rbx+0x58] font
456 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD0) // add rax,rdx
457 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0xC6) // mov rsi,rax (glyph ptr)
458 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x06) // mov rax,[rsi] all 8 rows
459 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x60) // mov [rbx+0x60],rax
460 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x7B); o=_w8(b,o,0x50) // mov rdi,[rbx+0x50] origin
461 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC5); o=_w32(b,o,8) // mov rbp,8 (rows)
462 let row_loop: i64 = o
463 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x60) // ROW: mov rax,[rbx+0x60]
464 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0xC2) // mov rdx,rax
465 o=_w8(b,o,0x48); o=_w8(b,o,0x81); o=_w8(b,o,0xE2); o=_w32(b,o,0xFF) // and rdx,0xFF (this row)
466 o=_w8(b,o,0x48); o=_w8(b,o,0xC1); o=_w8(b,o,0xE8); o=_w8(b,o,0x08) // shr rax,8 (next row down)
467 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x60) // mov [rbx+0x60],rax
468 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,8) // mov rax,8 (cols)
469 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x68) // mov [rbx+0x68],rax
470 let col_loop: i64 = o
471 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0xD0) // COL: mov rax,rdx
472 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xE0); o=_w8(b,o,0x01) // and rax,1 (bit0 = leftmost)
473 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xF8); o=_w8(b,o,0x00) // cmp rax,0
474 let jz_skip: i64 = o
475 o=_w8(b,o,0x74); o=_w8(b,o,0x00) // jz SKIP (rel8, patched)
476 o=_w8(b,o,0xB8); o=_w32(b,o,COL_TEXT) // mov eax,COL_TEXT
477 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC1); o=_w32(b,o,1) // mov rcx,1
478 o=_w8(b,o,0xF3); o=_w8(b,o,0xAB) // rep stosd: ONE pixel, rdi += 4
479 let jmp_nextcol: i64 = o
480 o=_w8(b,o,0xEB); o=_w8(b,o,0x00) // jmp NEXTCOL (patched)
481 let skip_lbl: i64 = o
482 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xC7); o=_w8(b,o,0x04) // SKIP: add rdi,4 (blank pixel)
483 let nextcol_lbl: i64 = o
484 o=_w8(b,o,0x48); o=_w8(b,o,0xC1); o=_w8(b,o,0xEA); o=_w8(b,o,0x01) // shr rdx,1 (next column)
485 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x68) // mov rax,[rbx+0x68]
486 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xE8); o=_w8(b,o,0x01) // sub rax,1
487 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x68) // mov [rbx+0x68],rax
488 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xF8); o=_w8(b,o,0x00) // cmp rax,0
489 let jnz_col: i64 = o
490 o=_w8(b,o,0x0F); o=_w8(b,o,0x85); o=_w32(b,o,0) // jnz COL (rel32, patched)
491 o=_w8(b,o,0x48); o=_w8(b,o,0x81); o=_w8(b,o,0xC7); o=_w32(b,o,(FB_W-8)*4) // add rdi, next scanline
492 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xED); o=_w8(b,o,0x01) // sub rbp,1
493 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xFD); o=_w8(b,o,0x00) // cmp rbp,0
494 let jnz_row: i64 = o
495 o=_w8(b,o,0x0F); o=_w8(b,o,0x85); o=_w32(b,o,0) // jnz ROW (rel32, patched)
496 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x48) // mov rax,[rbx+0x48]
497 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xC0); o=_w8(b,o,0x01) // add rax,1 (next char)
498 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x48) // mov [rbx+0x48],rax
499 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x50) // mov rax,[rbx+0x50]
500 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xC0); o=_w8(b,o,0x20) // add rax,32 (8px advance)
501 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x50) // mov [rbx+0x50],rax
502 let jmp_ch: i64 = o
503 o=_w8(b,o,0xE9); o=_w32(b,o,0) // jmp CHAR (patched)
504 let txt_done_lbl: i64 = o
505 // Patch every branch now that all labels exist. rel8 displacements are computed into a `let`
506 // BEFORE the opcode byte is written -- writing the opcode first advances `o` and silently
507 // shifts the origin, which is the trap that desynced the AI sum loop earlier today.
508 b[jz_skip + 1] = (rel8(skip_lbl, jz_skip + 2)) as u8
509 b[jmp_nextcol + 1] = (rel8(nextcol_lbl, jmp_nextcol + 2)) as u8
510 _w32(b, jnz_col + 2, col_loop - (jnz_col + 6))
511 _w32(b, jnz_row + 2, row_loop - (jnz_row + 6))
512 _w32(b, jmp_ch + 1, ch_loop - (jmp_ch + 5))
513 _w32(b, jz_txt_done + 2, txt_done_lbl - (jz_txt_done + 6))
514
515 // ===== N3 EVENT LOOP: poll ConIn->ReadKeyStroke; every accepted key paints one more block in
516 // the taskbar tally strip, so INPUT PRODUCES A VISIBLE STATE CHANGE -- the functionality proof
517 // in the only currency a display OS has: pixels. Deliberately uses ONLY legacy registers; rbx
518 // (=&bootinfo) is the single live value across iterations and DOUBLES AS THE KERNEL'S SCRATCH
519 // (+0x18 tally cursor, +0x20 the EFI_INPUT_KEY the firmware fills), so no r8-r15 are needed.
520 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x10) // mov rax,[rbx+0x10] conin
521 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xF8); o=_w8(b,o,0x00) // cmp rax,0
522 let jz_hold_at: i64 = o
523 o=_w8(b,o,0x0F); o=_w8(b,o,0x84); o=_w32(b,o,0) // jz rel32 HOLD (the body it skips outgrew rel8)
524 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,(TALLY_Y*FB_W+TALLY_X)*4) // mov rax,tally0
525 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x18) // mov [rbx+0x18],rax
526 let loop_at: i64 = o
527 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x4B); o=_w8(b,o,0x10) // LOOP: mov rcx,[rbx+0x10] This
528 o=_w8(b,o,0x48); o=_w8(b,o,0x8D); o=_w8(b,o,0x53); o=_w8(b,o,0x20) // lea rdx,[rbx+0x20] &key
529 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x41); o=_w8(b,o,0x08) // mov rax,[rcx+8] ReadKeyStroke
530 o=_w8(b,o,0xFF); o=_w8(b,o,0xD0) // call rax (the ONE call in the kernel)
531 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xF8); o=_w8(b,o,0x00) // cmp rax,0 (EFI_SUCCESS?)
532 let jnz_loop_at: i64 = o
533 o=_w8(b,o,0x75); o=_w8(b,o,0x00) // jnz LOOP (NOT_READY -> keep polling)
534 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0xF7) // mov rdi,rsi
535 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x53); o=_w8(b,o,0x18) // mov rdx,[rbx+0x18] cursor
536 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD7) // add rdi,rdx
537 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC5); o=_w32(b,o,TALLY_H) // mov rbp,rows
538 let trow_at: i64 = o
539 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC1); o=_w32(b,o,TALLY_W) // TROW: mov rcx,w
540 o=_w8(b,o,0xB8); o=_w32(b,o,COL_TALLY) // mov eax,color
541 o=_w8(b,o,0xF3); o=_w8(b,o,0xAB) // rep stosd
542 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC2); o=_w32(b,o,(FB_W-TALLY_W)*4) // mov rdx,row gap
543 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD7) // add rdi,rdx
544 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xED); o=_w8(b,o,0x01) // sub rbp,1
545 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xFD); o=_w8(b,o,0x00) // cmp rbp,0
546 // ⚠compute the displacement BEFORE emitting the opcode: `o=_w8(b,o,0x75)` ALREADY advanced o,
547 // so an inline `(trow_at - (o+2))` measures from the wrong origin and jumps one byte early.
548 let d_trow: i64 = rel8(trow_at, o + 2)
549 o=_w8(b,o,0x75); o=_w8(b,o,d_trow) // jnz TROW
550 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x53); o=_w8(b,o,0x18) // mov rdx,[rbx+0x18]
551 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,(TALLY_W+TALLY_GAP)*4) // mov rax,step
552 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xC2) // add rdx,rax
553 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x53); o=_w8(b,o,0x18) // mov [rbx+0x18],rdx
554 // 'x' is the take-the-machine key: it leaves the poll loop and runs the N4 handoff. Any other
555 // key just tallies. (The qword at +0x20 is the EFI_INPUT_KEY: ScanCode low, UnicodeChar next,
556 // so a unicode 'x' with ScanCode 0 reads as 0x780000 -- comparable without byte-width ops.)
557 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x20) // mov rax,[rbx+0x20] key
558 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC1); o=_w32(b,o,0x780000) // mov rcx,'x'<<16
559 o=_w8(b,o,0x48); o=_w8(b,o,0x39); o=_w8(b,o,0xC8) // cmp rax,rcx
560 let jz_take_at: i64 = o
561 o=_w8(b,o,0x0F); o=_w8(b,o,0x84); o=_w32(b,o,0) // jz TAKE (patched)
562 let d_loop: i64 = rel8(loop_at, o + 2)
563 o=_w8(b,o,0xEB); o=_w8(b,o,d_loop) // jmp LOOP
564 // ===== N4: THE KERNEL TAKES THE MACHINE FROM FIRMWARE =================================
565 // Real two-call UEFI sequence. The MapKey must be the one from THIS GetMemoryMap: a stale key
566 // is refused by firmware, which is the classic ExitBootServices mistake. After this returns
567 // success there is no firmware left -- the framebuffer is simply memory, and it is ours.
568 let take_at: i64 = o
569 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x38) // mov rax,[rbx+0x38] SystemTable
570 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x40); o=_w8(b,o,0x60) // mov rax,[rax+0x60] BootServices
571 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x78) // mov [rbx+0x78],rax
572 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,MM_BUF_BYTES) // mov rax,bufcap
573 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x48) // mov [rbx+0x48],rax MapSize
574 o=_w8(b,o,0x48); o=_w8(b,o,0x8D); o=_w8(b,o,0x4B); o=_w8(b,o,0x48) // lea rcx,[rbx+0x48]
575 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x53); o=_w8(b,o,0x40) // mov rdx,[rbx+0x40] MapBuf
576 o=_w8(b,o,0x4C); o=_w8(b,o,0x8D); o=_w8(b,o,0x43); o=_w8(b,o,0x28) // lea r8,[rbx+0x28] &MapKey
577 o=_w8(b,o,0x4C); o=_w8(b,o,0x8D); o=_w8(b,o,0x4B); o=_w8(b,o,0x50) // lea r9,[rbx+0x50] &DescSize
578 o=_w8(b,o,0x48); o=_w8(b,o,0x8D); o=_w8(b,o,0x43); o=_w8(b,o,0x58) // lea rax,[rbx+0x58] &DescVer
579 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x44); o=_w8(b,o,0x24); o=_w8(b,o,0x20) // mov [rsp+0x20],rax
580 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x78) // mov rax,[rbx+0x78] BS
581 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x40); o=_w8(b,o,0x38) // mov rax,[rax+0x38] GetMemoryMap
582 o=_w8(b,o,0xFF); o=_w8(b,o,0xD0) // call rax
583 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x60) // mov [rbx+0x60],rax status
584 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x4B); o=_w8(b,o,0x30) // mov rcx,[rbx+0x30] ImageHandle
585 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x53); o=_w8(b,o,0x28) // mov rdx,[rbx+0x28] FRESH MapKey
586 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x78) // mov rax,[rbx+0x78] BS
587 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x80); o=_w32(b,o,0xE8) // mov rax,[rax+0xE8] ExitBootServices
588 o=_w8(b,o,0xFF); o=_w8(b,o,0xD0) // call rax
589 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x68) // mov [rbx+0x68],rax status
590 // Paint the ownership swatch: colour IS the ExitBootServices status, so the screen reports
591 // success (0 -> black-ish) or the exact firmware error. Then hold, owning the machine.
592 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x73); o=_w8(b,o,0x00) // mov rsi,[rbx+0] fb
593 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0xF7) // mov rdi,rsi
594 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC2); o=_w32(b,o,(OWN_Y*FB_W+OWN_X)*4) // mov rdx,offset
595 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD7) // add rdi,rdx
596 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC5); o=_w32(b,o,AI_H) // mov rbp,rows
597 let own_row: i64 = o
598 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC1); o=_w32(b,o,AI_W) // OROW: mov rcx,w
599 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,COL_OWNED) // mov rax,colour
600 o=_w8(b,o,0xF3); o=_w8(b,o,0xAB) // rep stosd
601 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC2); o=_w32(b,o,(FB_W-AI_W)*4) // mov rdx,gap
602 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD7) // add rdi,rdx
603 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xED); o=_w8(b,o,0x01) // sub rbp,1
604 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xFD); o=_w8(b,o,0x00) // cmp rbp,0
605 let d_orow: i64 = rel8(own_row, o + 2)
606 o=_w8(b,o,0x75); o=_w8(b,o,d_orow) // jnz OROW
607 // ===== HW1: ENUMERATE THE BUS OURSELVES ==============================================
608 // For each slot: write the selector, read vendor/device, and paint a block ONLY if something
609 // answered. rbx (&bootinfo) and rsi (fb) are preserved; the slot index lives at +0x50.
610 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,0) // mov rax,0
611 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x50) // slot = 0
612 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,(PCI_Y*FB_W+PCI_X)*4)
613 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x58) // cursor = base
614 let pci_loop: i64 = o
615 // selector = 0x80000000 | (slot << 11)
616 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x50) // mov rax,slot
617 o=_w8(b,o,0x48); o=_w8(b,o,0xC1); o=_w8(b,o,0xE0); o=_w8(b,o,0x0B) // shl rax,11
618 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC1); o=_w32(b,o,0 - PCI_CFG_ENABLE) // mov rcx,0x80000000
619 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xC8) // add rax,rcx
620 o=_w8(b,o,0xBA); o=_w32(b,o,PCI_ADDR_PORT) // mov edx,0xCF8
621 o=_w8(b,o,0xEF) // out dx,eax
622 o=_w8(b,o,0xBA); o=_w32(b,o,PCI_DATA_PORT) // mov edx,0xCFC
623 o=_w8(b,o,0xED) // in eax,dx
624 // ⚠`48 C7 C1 imm32` SIGN-EXTENDS to -1, but `in eax,dx` ZERO-EXTENDS -- so comparing against a
625 // sign-extended all-ones NEVER matches and every empty slot reads as a device. Use the 32-bit
626 // form, which zero-extends, so "all ones" means the same thing on both sides.
627 o=_w8(b,o,0xB9); o=_w32(b,o,0 - 1) // mov ecx,0xFFFFFFFF
628 o=_w8(b,o,0x48); o=_w8(b,o,0x39); o=_w8(b,o,0xC8) // cmp rax,rcx
629 // ⚠rel8 CANNOT reach: the loop body grew past 127 bytes once HW2's registry scan landed in it.
630 // A raw `& 0xff` here would have wrapped silently into the middle of an instruction (it did).
631 let jz_absent_at: i64 = o
632 o=_w8(b,o,0x0F); o=_w8(b,o,0x84); o=_w32(b,o,0) // jz rel32 ABSENT (patched)
633 // HW2: look the probed ID up in the registry (DATA) and choose BOUND vs UNBOUND honestly
634 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x60) // save probed ID
635 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,0) // found = 0
636 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x68)
637 let reg_lea: i64 = o
638 o=_w8(b,o,0x48); o=_w8(b,o,0x8D); o=_w8(b,o,0x15); o=_w32(b,o,0) // lea rdx,[rip+REG] (patched)
639 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC5); o=_w32(b,o,REG_N) // mov rbp,REG_N
640 let scan_at: i64 = o
641 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x02) // mov rax,[rdx]
642 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x4B); o=_w8(b,o,0x60) // mov rcx,probed
643 o=_w8(b,o,0x48); o=_w8(b,o,0x39); o=_w8(b,o,0xC8) // cmp rax,rcx
644 let jnz_next_at: i64 = o
645 o=_w8(b,o,0x75); o=_w8(b,o,0x00) // jnz NEXT (patched)
646 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,1) // found = 1
647 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x68)
648 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x53); o=_w8(b,o,0x78) // remember the ROW
649 let next_at: i64 = o
650 // ⚠REG_STRIDE outgrew imm8 the moment programs got longer: `48 83 C2 A8` sign-extends 168 to
651 // -88 and the scan walks BACKWARDS through the registry. Same failure as rel8, different field.
652 // ★AN 8-BIT IMMEDIATE IS A CEILING, AND A CEILING NOBODY CHECKS IS A SILENT WRAP.
653 o=_w8(b,o,0x48); o=_w8(b,o,0x81); o=_w8(b,o,0xC2); o=_w32(b,o,REG_STRIDE) // next row (imm32)
654 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xED); o=_w8(b,o,0x01) // sub rbp,1
655 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xFD); o=_w8(b,o,0x00) // cmp rbp,0
656 let d_scan: i64 = rel8(scan_at, o + 2)
657 o=_w8(b,o,0x75); o=_w8(b,o,d_scan) // jnz SCAN
658 b[jnz_next_at + 1] = rel8(next_at, jnz_next_at + 2) as u8
659 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x68) // rax = found
660 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xF8); o=_w8(b,o,0x00) // cmp rax,0
661 let jz_unb_at: i64 = o
662 o=_w8(b,o,0x0F); o=_w8(b,o,0x84); o=_w32(b,o,0) // jz rel32 UNBOUND (patched)
663 // BOUND: RUN THE ROW'S PROGRAM. rbp is the op cursor (free -- the registry scan finished with
664 // it), and the row slot is reused as the accumulator now the row pointer has been consumed.
665 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x78) // rax = row
666 o=_w8(b,o,0x48); o=_w8(b,o,0x8D); o=_w8(b,o,0x68); o=_w8(b,o,0x08) // lea rbp,[rax+8]
667 o=_w8(b,o,0x48); o=_w8(b,o,0x31); o=_w8(b,o,0xC0) // xor rax,rax
668 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x78) // acc = 0
669 let op_loop_at: i64 = o
670 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x45); o=_w8(b,o,0x00) // rax = opcode
671 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x4D); o=_w8(b,o,0x08) // rcx = arg
672 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xF8); o=_w8(b,o,OP_END)
673 let jz_ok_at: i64 = o
674 o=_w8(b,o,0x0F); o=_w8(b,o,0x84); o=_w32(b,o,0)
675 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xF8); o=_w8(b,o,OP_READ)
676 let jz_rd_at: i64 = o
677 o=_w8(b,o,0x0F); o=_w8(b,o,0x84); o=_w32(b,o,0)
678 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xF8); o=_w8(b,o,OP_AND)
679 let jz_and_at: i64 = o
680 o=_w8(b,o,0x0F); o=_w8(b,o,0x84); o=_w32(b,o,0)
681 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xF8); o=_w8(b,o,OP_EXPECT)
682 let jz_exp_at: i64 = o
683 o=_w8(b,o,0x0F); o=_w8(b,o,0x84); o=_w32(b,o,0)
684 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xF8); o=_w8(b,o,OP_SHR)
685 let jz_shr_at: i64 = o
686 o=_w8(b,o,0x0F); o=_w8(b,o,0x84); o=_w32(b,o,0)
687 // an opcode we do not know is a REFUSAL, never a silently skipped step: a spec we cannot fully
688 // execute must not be reported as a spec we satisfied.
689 let jmp_fail1_at: i64 = o
690 o=_w8(b,o,0xE9); o=_w32(b,o,0)
691 let rd_at: i64 = o // --- READ_CFG ---
692 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x50) // rax = slot
693 o=_w8(b,o,0x48); o=_w8(b,o,0xC1); o=_w8(b,o,0xE0); o=_w8(b,o,0x0B) // shl rax,11
694 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xE1); o=_w8(b,o,0xFC) // and rcx,0xFC
695 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xC8) // add rax,rcx
696 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC1); o=_w32(b,o,0 - PCI_CFG_ENABLE) // enable bit
697 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xC8)
698 o=_w8(b,o,0xBA); o=_w32(b,o,PCI_ADDR_PORT)
699 o=_w8(b,o,0xEF) // out dx,eax
700 o=_w8(b,o,0xBA); o=_w32(b,o,PCI_DATA_PORT)
701 o=_w8(b,o,0xED) // in eax,dx
702 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x78) // acc = value
703 let jmp_next1_at: i64 = o
704 o=_w8(b,o,0xE9); o=_w32(b,o,0)
705 let shr_at: i64 = o // --- SHR ---
706 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x78) // rax = acc
707 o=_w8(b,o,0x48); o=_w8(b,o,0xD3); o=_w8(b,o,0xE8) // shr rax,cl (cl = arg)
708 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x78)
709 let jmp_next3_at: i64 = o
710 o=_w8(b,o,0xE9); o=_w32(b,o,0)
711 let and_at: i64 = o // --- AND ---
712 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x78)
713 o=_w8(b,o,0x48); o=_w8(b,o,0x21); o=_w8(b,o,0xC8) // and rax,rcx
714 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x78)
715 let jmp_next2_at: i64 = o
716 o=_w8(b,o,0xE9); o=_w32(b,o,0)
717 let exp_at: i64 = o // --- EXPECT ---
718 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x78)
719 o=_w8(b,o,0x48); o=_w8(b,o,0x39); o=_w8(b,o,0xC8) // cmp acc,arg
720 let jnz_fail_at: i64 = o
721 o=_w8(b,o,0x0F); o=_w8(b,o,0x85); o=_w32(b,o,0)
722 let next_op_at: i64 = o // --- NEXT ---
723 o=_w8(b,o,0x48); o=_w8(b,o,0x8D); o=_w8(b,o,0x6D); o=_w8(b,o,0x10) // lea rbp,[rbp+16]
724 let jmp_loop_at: i64 = o
725 o=_w8(b,o,0xE9); o=_w32(b,o,0)
726 let fail_at: i64 = o
727 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,COL_MISMATCH)
728 let jmp_setcol2_at: i64 = o
729 o=_w8(b,o,0xEB); o=_w8(b,o,0x00)
730 let ver_at: i64 = o
731 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,COL_VERIFIED)
732 let jmp_setcol_at: i64 = o
733 o=_w8(b,o,0xEB); o=_w8(b,o,0x00)
734 // every branch here is rel32 on purpose: this body has already outgrown rel8 once, and a
735 // wrapped rel8 lands in the MIDDLE of an instruction rather than failing loudly.
736 _w32(b, jz_ok_at + 2, rel32(ver_at, jz_ok_at + 6))
737 _w32(b, jz_rd_at + 2, rel32(rd_at, jz_rd_at + 6))
738 _w32(b, jz_and_at + 2, rel32(and_at, jz_and_at + 6))
739 _w32(b, jz_exp_at + 2, rel32(exp_at, jz_exp_at + 6))
740 _w32(b, jz_shr_at + 2, rel32(shr_at, jz_shr_at + 6))
741 _w32(b, jmp_fail1_at + 1, rel32(fail_at, jmp_fail1_at + 5))
742 _w32(b, jmp_next1_at + 1, rel32(next_op_at, jmp_next1_at + 5))
743 _w32(b, jmp_next2_at + 1, rel32(next_op_at, jmp_next2_at + 5))
744 _w32(b, jmp_next3_at + 1, rel32(next_op_at, jmp_next3_at + 5))
745 _w32(b, jnz_fail_at + 2, rel32(fail_at, jnz_fail_at + 6))
746 _w32(b, jmp_loop_at + 1, rel32(op_loop_at, jmp_loop_at + 5))
747 let unb_at: i64 = o
748 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,COL_UNBOUND)
749 let setcol_at: i64 = o
750 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x70) // colour slot
751 _w32(b, jz_unb_at + 2, rel32(unb_at, jz_unb_at + 6))
752 b[jmp_setcol_at + 1] = rel8(setcol_at, jmp_setcol_at + 2) as u8
753 b[jmp_setcol2_at + 1] = rel8(setcol_at, jmp_setcol2_at + 2) as u8
754
755 // present -> paint one block at the cursor, then advance it
756 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x73); o=_w8(b,o,0x00) // mov rsi,[rbx+0]
757 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0xF7) // mov rdi,rsi
758 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x53); o=_w8(b,o,0x58) // mov rdx,cursor
759 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD7) // add rdi,rdx
760 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC5); o=_w32(b,o,PCI_H) // mov rbp,rows
761 let pci_row: i64 = o
762 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC1); o=_w32(b,o,PCI_W) // mov rcx,w
763 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x70) // mov rax,[rbx+0x70] colour
764 o=_w8(b,o,0xF3); o=_w8(b,o,0xAB) // rep stosd
765 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC2); o=_w32(b,o,(FB_W-PCI_W)*4) // mov rdx,gap
766 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD7) // add rdi,rdx
767 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xED); o=_w8(b,o,0x01) // sub rbp,1
768 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xFD); o=_w8(b,o,0x00) // cmp rbp,0
769 let d_pcirow: i64 = rel8(pci_row, o + 2)
770 o=_w8(b,o,0x75); o=_w8(b,o,d_pcirow) // jnz
771 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x53); o=_w8(b,o,0x58) // mov rdx,cursor
772 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,(PCI_W+PCI_GAP)*4)
773 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xC2) // add rdx,rax
774 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x53); o=_w8(b,o,0x58) // mov cursor,rdx
775 let pci_absent: i64 = o
776 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x43); o=_w8(b,o,0x50) // mov rax,slot
777 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xC0); o=_w8(b,o,0x01) // add rax,1
778 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x50) // mov slot,rax
779 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC1); o=_w32(b,o,PCI_SLOTS) // mov rcx,32
780 o=_w8(b,o,0x48); o=_w8(b,o,0x39); o=_w8(b,o,0xC8) // cmp rax,rcx
781 o=_w8(b,o,0x0F); o=_w8(b,o,0x85); o=_w32(b,o,rel32(pci_loop, o + 4)) // jnz rel32 PCILOOP
782 _w32(b, jz_absent_at + 2, rel32(pci_absent, jz_absent_at + 6))
783
784 // ===== N4b: OUR OWN DRIVER LOOP, NO FIRMWARE UNDERNEATH ==============================
785 // Poll the 8042 status port; when a byte is waiting, read the scancode and tally it exactly
786 // as the firmware path did -- so the SAME visible effect is now produced by our driver. Every
787 // iteration also advances a heartbeat column: motion on screen is the liveness proof.
788 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,(HB_Y*FB_W+HB_X)*4) // mov rax,hb0
789 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x43); o=_w8(b,o,0x28) // mov [rbx+0x28],rax
790 let hb_at: i64 = o
791 o=_w8(b,o,0x48); o=_w8(b,o,0x31); o=_w8(b,o,0xC0) // HB: xor rax,rax
792 o=_w8(b,o,0xE4); o=_w8(b,o,PS2_STATUS) // in al,0x64
793 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xE0); o=_w8(b,o,0x01) // and rax,1
794 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xF8); o=_w8(b,o,0x00) // cmp rax,0
795 let jz_nokey_at: i64 = o
796 o=_w8(b,o,0x0F); o=_w8(b,o,0x84); o=_w32(b,o,0) // jz NOKEY (patched)
797 o=_w8(b,o,0x48); o=_w8(b,o,0x31); o=_w8(b,o,0xC0) // xor rax,rax
798 o=_w8(b,o,0xE4); o=_w8(b,o,PS2_DATA) // in al,0x60 (consume)
799 // tally the scancode with the same block the firmware path used
800 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x73); o=_w8(b,o,0x00) // mov rsi,[rbx+0] fb
801 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0xF7) // mov rdi,rsi
802 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x53); o=_w8(b,o,0x18) // mov rdx,[rbx+0x18] cursor
803 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD7) // add rdi,rdx
804 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC5); o=_w32(b,o,TALLY_H) // mov rbp,rows
805 let p2row_at: i64 = o
806 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC1); o=_w32(b,o,TALLY_W) // mov rcx,w
807 o=_w8(b,o,0xB8); o=_w32(b,o,COL_TALLY) // mov eax,colour
808 o=_w8(b,o,0xF3); o=_w8(b,o,0xAB) // rep stosd
809 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC2); o=_w32(b,o,(FB_W-TALLY_W)*4) // mov rdx,gap
810 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD7) // add rdi,rdx
811 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xED); o=_w8(b,o,0x01) // sub rbp,1
812 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xFD); o=_w8(b,o,0x00) // cmp rbp,0
813 let d_p2row: i64 = rel8(p2row_at, o + 2)
814 o=_w8(b,o,0x75); o=_w8(b,o,d_p2row) // jnz
815 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x53); o=_w8(b,o,0x18) // mov rdx,[rbx+0x18]
816 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,(TALLY_W+TALLY_GAP)*4)
817 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xC2) // add rdx,rax
818 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x53); o=_w8(b,o,0x18) // mov [rbx+0x18],rdx
819 let nokey_at: i64 = o
820 // heartbeat: paint one column at the running offset, then advance and wrap
821 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x73); o=_w8(b,o,0x00) // mov rsi,[rbx+0] fb
822 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0xF7) // mov rdi,rsi
823 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x53); o=_w8(b,o,0x28) // mov rdx,[rbx+0x28] hb
824 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD7) // add rdi,rdx
825 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC5); o=_w32(b,o,HB_H) // mov rbp,rows
826 let hbrow_at: i64 = o
827 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC1); o=_w32(b,o,1) // mov rcx,1 (one column)
828 o=_w8(b,o,0xB8); o=_w32(b,o,COL_HB) // mov eax,colour
829 o=_w8(b,o,0xF3); o=_w8(b,o,0xAB) // rep stosd
830 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC2); o=_w32(b,o,(FB_W-1)*4) // mov rdx,gap
831 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xD7) // add rdi,rdx
832 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xED); o=_w8(b,o,0x01) // sub rbp,1
833 o=_w8(b,o,0x48); o=_w8(b,o,0x83); o=_w8(b,o,0xFD); o=_w8(b,o,0x00) // cmp rbp,0
834 let d_hbrow: i64 = rel8(hbrow_at, o + 2)
835 o=_w8(b,o,0x75); o=_w8(b,o,d_hbrow) // jnz
836 o=_w8(b,o,0x48); o=_w8(b,o,0x8B); o=_w8(b,o,0x53); o=_w8(b,o,0x28) // mov rdx,[rbx+0x28]
837 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC0); o=_w32(b,o,4) // mov rax,4
838 o=_w8(b,o,0x48); o=_w8(b,o,0x01); o=_w8(b,o,0xC2) // add rdx,rax
839 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC1); o=_w32(b,o,(HB_Y*FB_W+HB_X+HB_W)*4)
840 o=_w8(b,o,0x48); o=_w8(b,o,0x39); o=_w8(b,o,0xCA) // cmp rdx,rcx
841 let jnz_nowrap_at: i64 = o
842 o=_w8(b,o,0x0F); o=_w8(b,o,0x85); o=_w32(b,o,0) // jnz NOWRAP (patched)
843 o=_w8(b,o,0x48); o=_w8(b,o,0xC7); o=_w8(b,o,0xC2); o=_w32(b,o,(HB_Y*FB_W+HB_X)*4) // wrap
844 let nowrap_at: i64 = o
845 o=_w8(b,o,0x48); o=_w8(b,o,0x89); o=_w8(b,o,0x53); o=_w8(b,o,0x28) // mov [rbx+0x28],rdx
846 o=_w8(b,o,0xE9); o=_w32(b,o,hb_at - (o + 4)) // jmp HB rel32 (forever)
847 let hold_at: i64 = o
848 o=_w8(b,o,0xEB); o=_w8(b,o,0xFE) // (unreached; the driver loops)
849 _w32(b, jz_take_at + 2, rel32(take_at, jz_take_at + 6))
850 _w32(b, jz_nokey_at + 2, rel32(nokey_at, jz_nokey_at + 6))
851 _w32(b, jnz_nowrap_at + 2, rel32(nowrap_at, jnz_nowrap_at + 6))
852 _w32(b, jz_hold_at + 2, rel32(hold_at, jz_hold_at + 6)) // patch forward branches
853 b[jnz_loop_at + 1] = rel8(loop_at, jnz_loop_at + 2) as u8
854 while (o % 8) != 0 { o = _w8(b, o, 0) } // 8-align the vectors
855 // AI1 data: A then B, i64 lanes. Patch the two RIP-relative leas now that the offsets are known
856 // (each disp32 is measured from the byte AFTER its instruction, which is lea_site+7).
857 let a_at: i64 = o
858 var k: i64 = 0
859 while k < AI_K { _w64(b, o, ai_a(k)); o = o + 8; k = k + 1 }
860 let b_at: i64 = o
861 k = 0
862 while k < AI_K { _w64(b, o, ai_b(k)); o = o + 8; k = k + 1 }
863 let reg_at: i64 = o
864 k = 0
865 while k < REG_N {
866 _w64(b, o, reg_id(k)); o = o + 8
867 // A program with no END would walk the interpreter off the end of its row into the next
868 // row's bytes. Refuse HERE, at build time, rather than discovering it on real hardware.
869 var seen_end: i64 = 0
870 var j: i64 = 0
871 while j < OPS_MAX {
872 if reg_op(k, j) == OP_END { seen_end = 1 }
873 _w64(b, o, reg_op(k, j)); o = o + 8
874 _w64(b, o, reg_arg(k, j)); o = o + 8
875 j = j + 1
876 }
877 if seen_end == 0 { e_p("NXEK REFUSED: registry row has no OP_END -- unterminated program\n" as *u8); sys_exit(4); return 0 }
878 k = k + 1
879 }
880 // FONT + the three state lines, appended as payload DATA. The font is the estate's existing
881 // sovereign 8x8 table -- reused, not reinvented -- copied in whole so the kernel can render any
882 // printable ASCII, not just the characters these three lines happen to use. A font trimmed to
883 // the current strings would be a renderer that only renders what we already wrote.
884 let font_at: i64 = o
885 let ft: *u8 = font8x8_table()
886 var fi: i64 = 0
887 while fi < FONT_BYTES { b[o] = ft[fi]; o = o + 1; fi = fi + 1 }
888 let str0_at: i64 = o
889 var si: i64 = 0
890 let n0: i64 = str_len(0)
891 while si < n0 { b[o] = str_off(si) as u8; o = o + 1; si = si + 1 }
892 b[o] = 0 as u8; o = o + 1
893 let str1_at: i64 = o
894 si = 0
895 let n1: i64 = str_len(1)
896 while si < n1 { b[o] = str_bad(si) as u8; o = o + 1; si = si + 1 }
897 b[o] = 0 as u8; o = o + 1
898 let str2_at: i64 = o
899 si = 0
900 let n2: i64 = str_len(2)
901 while si < n2 { b[o] = str_on(si) as u8; o = o + 1; si = si + 1 }
902 b[o] = 0 as u8; o = o + 1
903 // The char fetch reads a QWORD, so the final NUL needs 7 readable bytes behind it. Zero pad.
904 var zp: i64 = 0
905 while zp < STR_PAD { b[o] = 0 as u8; o = o + 1; zp = zp + 1 }
906 // text_size is declared 8-padded in the NXE header, and variable-length strings do not land on
907 // an 8-byte boundary by luck. Pad to alignment HERE and COUNT the padding, so the tail tooth's
908 // arithmetic and the header's size field cannot disagree.
909 var apad: i64 = 0
910 while ((o % 8) != 0) { b[o] = 0 as u8; o = o + 1; apad = apad + 1 }
911 let txt_data_bytes: i64 = FONT_BYTES + (n0 + 1) + (n1 + 1) + (n2 + 1) + STR_PAD + apad
912 _w32(b, ai_lea_a + 3, a_at - (ai_lea_a + 7))
913 _w32(b, ai_lea_b + 3, b_at - (ai_lea_b + 7))
914 _w32(b, reg_lea + 3, reg_at - (reg_lea + 7))
915 _w32(b, txt_lea_font + 3, font_at - (txt_lea_font + 7))
916 _w32(b, txt_lea_off + 3, str0_at - (txt_lea_off + 7))
917 _w32(b, txt_lea_bad + 3, str1_at - (txt_lea_bad + 7))
918 _w32(b, txt_lea_on + 3, str2_at - (txt_lea_on + 7))
919 txtbytes[0] = txt_data_bytes
920 return o
921}
922
923// The reference answer, derived by a SEPARATE path from the emitted machine code: plain summation
924// here versus imul/add executed by the CPU there. Agreement across the two derivations (plus a
925// foreign engine rendering the same pixel) is what makes AI1 a proof rather than a demo.
926func ai_expect() -> i64 {
927 var s: i64 = 0
928 var k: i64 = 0
929 while k < AI_K { s = s + ai_a(k) * ai_b(k); k = k + 1 }
930 return s & 0xFFFFFFFF
931}
932
933// expect a literal opcode byte at a fixed position; returns 1 iff it matches
934func opc(b: *u8, o: i64, v: i64) -> i64 { if (b[o] as i64) == v { return 1 } return 0 }
935
936// An 8-bit branch displacement that does not fit SILENTLY WRAPS and sends execution into the
937// middle of an instruction. Measured 2026-08-04: the post-EBS driver loop grew past 127 bytes
938// and the back-edge landed in an immediate (emulator sentinel -21). REFUSE instead of wrapping.
939// Same trap as rel8 but for 32-bit displacements: the operand is measured from the END of the
940// instruction, and `o` has ALREADY advanced past the opcode bytes by the time the caller computes
941// it. Pass the instruction's END explicitly and stop guessing.
942func rel32(target: i64, end_ip: i64) -> i64 { return target - end_ip }
943
944func rel8(target: i64, next_ip: i64) -> i64 {
945 let d: i64 = target - next_ip
946 if d < (0 - 128) { e_p("NXEK REFUSED: rel8 underflow d=" as *u8); e_fn(2, 0 - d); e_p(" target=" as *u8); e_fn(2, target); e_p(" -- use rel32
947" as *u8); sys_exit(4); return 0 }
948 if d > 127 { e_p("NXEK REFUSED: rel8 overflow d=" as *u8); e_fn(2, d); e_p(" target=" as *u8); e_fn(2, target); e_p(" -- use rel32
949" as *u8); sys_exit(4); return 0 }
950 return d & 0xff
951}
952
953// ===== NEVER-BRICK BY DECODE: prove the payload is ONLY prologue + rect-fills + hold ============
954// Returns the rect count (>0) iff every instruction position matches the emitted template AND the
955// walk consumes the payload exactly; 0 on any deviation. Because only rect-fill and hold shapes can
956// match, the payload provably contains NO call, NO port I/O, NO firmware-service access -- the
957// never-brick claim is then a DECODE result, not a byte-frequency coincidence.
958func verify_payload(b: *u8, base: i64, plen: i64, dbg: *i64, txtbytes: *i64) -> i64 {
959 var o: i64 = base
960 let endp: i64 = base + plen
961 if opc(b,o,0x48) == 0 { return 0 }
962 if opc(b,o+1,0x8B) == 0 { return 0 }
963 if opc(b,o+2,0x73) == 0 { return 0 }
964 if opc(b,o+3,0x00) == 0 { return 0 }
965 o = o + 4
966 var n: i64 = 0
967 var go: i64 = 1
968 while go == 1 {
969 if o + 2 > endp { return 0 }
970 if rect_at(b, o, endp) == 0 { go = 0 } else {
971 o = o + 54
972 n = n + 1
973 }
974 }
975 // report the PARTS, never one collapsed number: a single 0 for "rects" hid a passing rect walk
976 // behind a failing tail for a whole build cycle.
977 dbg[0] = n
978 dbg[1] = verify_tail(b, o, endp, dbg, txtbytes)
979 if n < 8 { return 0 } // non-vacuity: the scene has >=8 rects
980 if dbg[1] == 0 { return 0 } // the event loop + hold decode cleanly
981 return n
982}
983
984// does a full 54-byte rect-fill template start at o?
985func rect_at(b: *u8, o: i64, endp: i64) -> i64 {
986 if (o + 54) > endp { return 0 }
987 var ok: i64 = 1
988 ok = ok & opc(b,o+0,0x48); ok = ok & opc(b,o+1,0xC7); ok = ok & opc(b,o+2,0xC2)
989 ok = ok & opc(b,o+7,0x48); ok = ok & opc(b,o+8,0x89); ok = ok & opc(b,o+9,0xF7)
990 ok = ok & opc(b,o+10,0x48); ok = ok & opc(b,o+11,0x01); ok = ok & opc(b,o+12,0xD7)
991 ok = ok & opc(b,o+13,0x48); ok = ok & opc(b,o+14,0xC7); ok = ok & opc(b,o+15,0xC5)
992 ok = ok & opc(b,o+20,0x48); ok = ok & opc(b,o+21,0xC7); ok = ok & opc(b,o+22,0xC1)
993 ok = ok & opc(b,o+27,0xB8)
994 ok = ok & opc(b,o+32,0xF3); ok = ok & opc(b,o+33,0xAB)
995 ok = ok & opc(b,o+34,0x48); ok = ok & opc(b,o+35,0xC7); ok = ok & opc(b,o+36,0xC2)
996 ok = ok & opc(b,o+41,0x48); ok = ok & opc(b,o+42,0x01); ok = ok & opc(b,o+43,0xD7)
997 ok = ok & opc(b,o+44,0x48); ok = ok & opc(b,o+45,0x83); ok = ok & opc(b,o+46,0xED); ok = ok & opc(b,o+47,0x01)
998 ok = ok & opc(b,o+48,0x48); ok = ok & opc(b,o+49,0x83); ok = ok & opc(b,o+50,0xFD); ok = ok & opc(b,o+51,0x00)
999 ok = ok & opc(b,o+52,0x75); ok = ok & opc(b,o+53,0xDE)
1000 return ok
1001}
1002
1003// ===== TAIL DECODER: walk the event loop INSTRUCTION BY INSTRUCTION over a closed allow-set.
1004// Immediates are skipped by decoded length, so a 0xFF inside an operand can never be mistaken for
1005// a call opcode -- the flaw that made the byte-frequency version unsound. Exactly ONE `call rax`
1006// (ReadKeyStroke) is permitted and nothing else: no other call, no port I/O, no firmware service.
1007func verify_tail(b: *u8, o0: i64, endp: i64, dbg: *i64, txtbytes: *i64) -> i64 {
1008 var o: i64 = o0
1009 var calls: i64 = 0
1010 var done: i64 = 0
1011 var guard: i64 = 0
1012 // FLAT dispatch on purpose: the first draft of this used a 6-deep if/else chain, mis-nested by
1013 // one brace, so the outer reject bound to the wrong level and valid 0x48 instructions were
1014 // refused. ★A DEEP ELSE-CHAIN HIDES ITS OWN MIS-NESTING -- compute a LENGTH, then judge it.
1015 while done == 0 {
1016 guard = guard + 1
1017 if guard > DECODE_WALK_GUARD { return 0 }
1018 if o + 2 > endp { return 0 }
1019 let c0: i64 = b[o] as i64
1020 let c1: i64 = b[o + 1] as i64
1021 var ln: i64 = 0
1022 if c0 == 0x74 { ln = 2 } // jz rel8
1023 if c0 == 0x75 { ln = 2 } // jnz rel8
1024 if c0 == 0xB8 { ln = 5 }
1025 if c0 == 0xB9 { ln = 5 } // mov ecx,imm32 (zero-extended) // mov eax,imm32
1026 if c0 == 0xEB { // jmp rel8; EB FE = the hold
1027 ln = 2
1028 if c1 == 0xFE { done = 1 }
1029 }
1030 if c0 == 0xF3 { // rep stosd (the only F3 form)
1031 if c1 != 0xAB { return 0 }
1032 ln = 2
1033 }
1034 if c0 == 0xFF { // ONLY `call rax` may appear
1035 if c1 != 0xD0 { return 0 }
1036 calls = calls + 1
1037 ln = 2
1038 }
1039 if c0 == 0xBA { ln = 5 } // mov edx,imm32 (port selector)
1040 if c0 == 0xEF { ln = 1 } // OUT dx,eax -- CONFIG_ADDRESS
1041 if c0 == 0xED { ln = 1 } // IN eax,dx -- CONFIG_DATA
1042 if c0 == 0x0F { if c1 == 0x85 { ln = 6 } if c1 == 0x84 { ln = 6 } } // jnz/jz rel32
1043 if c0 == 0xE9 { ln = 5 } // jmp rel32 (long back-edge)
1044 if c0 == 0xE4 { // IN al,imm8 -- PS/2 ONLY
1045 if c1 != PS2_STATUS { if c1 != PS2_DATA { return 0 } } // any other port: REFUSED
1046 ln = 2
1047 }
1048 if c0 == 0x4C { // REX.WR: lea r8/r9 (N4 args)
1049 if c1 == 0x8D { ln = 4 }
1050 }
1051 if c0 == 0x48 {
1052 if c1 == 0xC7 { ln = 7 } // mov r64,imm32
1053 if c1 == 0x83 { ln = 4 } // grp1 r/m64,imm8
1054 if c1 == 0x01 { ln = 3 } // add r64,r64
1055 if c1 == 0xC1 { ln = 4 } // shl r64,imm8 (slot<<11)
1056 if c1 == 0xD3 { ln = 3 } // shr r64,CL -- OP_SHR shifts by a DATA-supplied amount
1057 if c1 == 0x81 { ln = 7 } // grp1 r/m64,imm32 -- registry stride outgrew imm8
1058 if c1 == 0x31 { ln = 3 } // xor r64,r64 (zero the accumulator)
1059 if c1 == 0x39 { ln = 3 } // cmp r64,r64 (the take-the-machine key test)
1060 if c1 == 0x21 { ln = 3 } // and r64,r64 (apply the spec's mask)
1061 if c1 == 0x0F { // 0F AF = imul r64,r64 (AI1 MAC)
1062 if (b[o + 2] as i64) == 0xAF { ln = 4 }
1063 }
1064 if c1 == 0x8D { // lea: [base+disp8] or [rip+disp32]
1065 ln = 4
1066 if ((b[o + 2] as i64) >> 6) == 0 { ln = 7 }
1067 }
1068 if c1 == 0x8B { // mov load: [base]/[+disp8]/[+disp32]
1069 ln = 4
1070 if ((b[o + 2] as i64) >> 6) == 0 { ln = 3 }
1071 if ((b[o + 2] as i64) >> 6) == 2 { ln = 7 }
1072 }
1073 if c1 == 0x89 { // mov r/m64,r64
1074 ln = 4
1075 if ((b[o + 2] as i64) >> 6) == 3 { ln = 3 } // ANY reg-direct mov r64,r64.
1076 // This GENERALISES a former 0xF7-only special case. The old rule gave a 3-byte
1077 // instruction a length of 4 for every register pair except rdi<-rsi, which desyncs
1078 // the walk instead of refusing -- an allow-set that is right for one operand and
1079 // silently wrong for the rest. Widened deliberately, by exactly this one shape.
1080 if (b[o + 2] as i64) == 0x44 { ln = 5 } // [rsp+disp8] store (5th arg)
1081 }
1082 }
1083 if ln == 0 {
1084 dbg[2] = o - o0; dbg[3] = c0; dbg[4] = c1 // NAME the refused byte
1085 return 0
1086 }
1087 o = o + ln
1088 }
1089 // EXACTLY three firmware calls, all audited: ReadKeyStroke (input), GetMemoryMap (read-only)
1090 // and ExitBootServices (hands the machine over -- it writes NO firmware state; it is how
1091 // every OS boots). A fourth cannot appear without failing this tooth.
1092 if calls != 3 { dbg[2] = 0 - 1; dbg[3] = calls; return 0 }
1093 // After the hold come the 8-aligned AI1 vectors (data, never executed -- the hold is terminal
1094 // and no branch targets past it). Their presence is checked by SIZE, not by decoding data.
1095 let tailbytes: i64 = endp - o
1096 // The AI1 vectors sit at the very end, preceded by up to 7 bytes of 8-alignment padding.
1097 // Accept exactly that: the pad must be ZERO bytes, and the vectors must be the exact size.
1098 // The tail now also carries the FONT and the three state lines. Their exact size is passed in
1099 // rather than recomputed here: two independent size formulas drift, and the one that drifts is
1100 // always the one nobody re-derives.
1101 let pad: i64 = tailbytes - (AI_K * 16) - (REG_N * REG_STRIDE) - txtbytes[0]
1102 if pad < 0 { dbg[2] = 0 - 2; dbg[3] = tailbytes; return 0 }
1103 if pad > 7 { dbg[2] = 0 - 2; dbg[3] = tailbytes; return 0 }
1104 var pz: i64 = 0
1105 while pz < pad { if (b[o + pz] as i64) != 0 { dbg[2] = 0 - 3; dbg[3] = pz; return 0 } pz = pz + 1 }
1106 return 1
1107}
1108
1109func sum64(b: *u8, off: i64, len: i64) -> i64 {
1110 var s: i64 = 0
1111 var i: i64 = 0
1112 while i < len { s = s + _r64(b, off + i); i = i + 8 }
1113 return s
1114}
1115
1116func main(argc: i64, argv: *i64) -> i64 {
1117 let buf: *u8 = sys_mmap(EMIT_BUF_BYTES)
1118 let pay: *u8 = sys_mmap(EMIT_BUF_BYTES)
1119 let txtbytes: *i64 = sys_mmap(16) as *i64
1120 txtbytes[0] = 0
1121 let plen: i64 = build_payload(pay, txtbytes)
1122
1123 // header
1124 _w8(buf,0,0x4E); _w8(buf,1,0x58); _w8(buf,2,0x45); _w8(buf,3,0x30) // "NXE0"
1125 _w32(buf, 0x04, 1) // ver
1126 _w32(buf, 0x08, 1) // arch x86_64
1127 _w32(buf, 0x0C, 3) // flags kernel|needs-fb
1128 _w64(buf, 0x10, 0) // entry_off
1129 _w64(buf, 0x18, NXE_HDR) // text_off
1130 _w64(buf, 0x20, plen) // text_size
1131 _w64(buf, 0x28, 0) // bss
1132 _w64(buf, 0x30, 0) // stack (loader's v0 default)
1133 var i: i64 = 0
1134 while i < plen { buf[NXE_HDR + i] = pay[i]; i = i + 1 }
1135 _w64(buf, 0x38, sum64(buf, NXE_HDR, plen)) // integrity over the COPY
1136 let total: i64 = NXE_HDR + plen
1137
1138 // ===== self-gate (every run): structural + integrity + tamper + never-brick =================
1139 var g: i64 = 0
1140 var t1: i64 = 0
1141 if buf[0] == (0x4E as u8) { if buf[1] == (0x58 as u8) { if buf[2] == (0x45 as u8) { if buf[3] == (0x30 as u8) { t1 = 1 } } } } // G1 magic
1142 var t2: i64 = 0
1143 if _r64(buf, 0x18) == NXE_HDR { t2 = 1 } // G2 text_off
1144 var t3: i64 = 0
1145 if _r64(buf, 0x20) == plen { if (plen % 8) == 0 { if plen > 512 { t3 = 1 } } } // G3 size sane
1146 var t4: i64 = 0
1147 if sum64(buf, NXE_HDR, plen) == _r64(buf, 0x38) { t4 = 1 } // G4 integrity re-derives
1148 // G5 NEVER-BRICK, BY DECODE not by byte-search: walk the payload and prove it is EXCLUSIVELY
1149 // the prologue + N rect-fill blocks + the hold. A naive "contains no 0xFF" scan is UNSOUND here
1150 // -- FF occurs legitimately inside framebuffer-offset immediates (first seen at payload+602,
1151 // the rect at x=472,y=358 whose byte offset is 0x1BFFE0). Matching the template at INSTRUCTION
1152 // positions proves no call/port/firmware instruction exists at all, which is the real claim.
1153 let dbg: *i64 = sys_mmap(32) as *i64
1154 let rects: i64 = verify_payload(buf + 0, NXE_HDR, plen, dbg, txtbytes)
1155 var t5: i64 = 0
1156 if rects > 0 { t5 = 1 }
1157 let was: i64 = buf[NXE_HDR + 100] as i64 // G6 tamper bite
1158 buf[NXE_HDR + 100] = ((was + 1) & 0xff) as u8
1159 var t6: i64 = 0
1160 if sum64(buf, NXE_HDR, plen) != _r64(buf, 0x38) { t6 = 1 }
1161 buf[NXE_HDR + 100] = was as u8
1162 g = t1 + t2 + t3 + t4 + t5 + t6
1163 // a gate that will not NAME the failing tooth wastes every future debug cycle
1164 e_p("NXEK ai1: K=" as *u8); e_fn(1, AI_K); e_p(" expect_dot=" as *u8); e_fn(1, ai_expect())
1165 e_p(" (the kernel must paint this exact value at " as *u8); e_fn(1, AI_X); e_p("," as *u8)
1166 e_fn(1, AI_Y); e_p(")\n" as *u8)
1167 e_p("NXEK teeth: magic=" as *u8); e_fn(1, t1); e_p(" textoff=" as *u8); e_fn(1, t2)
1168 e_p(" size=" as *u8); e_fn(1, t3); e_p(" integrity=" as *u8); e_fn(1, t4)
1169 e_p(" decode=" as *u8); e_fn(1, t5); e_p("(rects=" as *u8); e_fn(1, dbg[0])
1170 e_p(" tail=" as *u8); e_fn(1, dbg[1]); e_p("@" as *u8); e_fn(1, dbg[2])
1171 e_p(" c0=" as *u8); e_fn(1, dbg[3]); e_p(" c1=" as *u8); e_fn(1, dbg[4]); e_p(") tamper=" as *u8); e_fn(1, t6); e_p("\n" as *u8)
1172
1173 e_p("NXE-KERNEL0: payload=" as *u8); e_fn(1, plen); e_p("B total=" as *u8); e_fn(1, total)
1174 e_p("B teeth=" as *u8); e_fn(1, g); e_p("of6\n" as *u8)
1175
1176 if g == 6 {
1177 let fd: i64 = sys_openat_wr("_offc/KERNEL.NXE" as *u8, 0x1a4)
1178 if fd < 0 { e_p("NXEK RED: cannot write _offc/KERNEL.NXE\n" as *u8); sys_exit(2) }
1179 sys_write(fd, buf, total)
1180 sys_close(fd)
1181 }
1182 let lf: i64 = sys_openat_append("knowledge/status/nishi_os.log" as *u8, 0x1a4)
1183 if lf >= 0 {
1184 e_fp(lf, "NXEK name=KERNEL.NXE format=NXE0 arch=x86_64 payload_bytes=" as *u8); e_fn(lf, plen)
1185 e_fp(lf, " teeth=" as *u8); e_fn(lf, g); e_fp(lf, "of6 verdict=" as *u8)
1186 if g == 6 { e_fp(lf, "GREEN\n" as *u8) } else { e_fp(lf, "RED\n" as *u8) }
1187 sys_close(lf)
1188 }
1189 if g == 6 {
1190 e_p("NXE-KERNEL0 GREEN: KERNEL.NXE emitted (the first Nishi-native-format executable) -- constitution A2\n" as *u8)
1191 sys_exit(0); return 0
1192 }
1193 e_p("NXE-KERNEL0 RED\n" as *u8)
1194 sys_exit(1); return 1
1195}