nx_nxe_loader.nx source

1// nx_nxe_loader.nx -- GATE: the NATIVE NXE LOADER that VERIFIES then EXECUTES (composes nx_nxe_lib, rule-15 DRY). 2// Closes the EXEC-FORMAT census gap ("emit organs AS .nxe + a native NXE loader/boot" -- organs were ELF-only, the 3// NXE format was write+header-check only). This loader actually RUNS the code section: mmap RWX -> copy the verified 4// code -> cast the entry to a function pointer -> CALL it on this machine (proven by nx_nxe_exec_probe). 5// 6// THE EXCEED vs ELF/Mach-O/PE (grounded osb_elf/osb_loader): verify-BEFORE-execute BY CONSTRUCTION. An ELF loader 7// maps+jumps to whatever bytes are present; NXE refuses to even map-exec a binary that fails ANY of: 8// (1) INTEGRITY -- a FIPS-180-4 SHA-256 of the code section, baked in the header; a tampered byte -> refused. 9// (2) CAPABILITY -- the binary must DECLARE the EXEC capability to be executed (least-privilege manifest). 10// (3) NEVER-BRICK (cardinal 26 in the format) -- a HW_WRITE binary without a never-brick proof -> refused. 11// Only after all three pass does a single byte execute. Payload = a REAL function f(x)=x*x+1 in x86_64 machine code. 12// T1 write+load+EXECUTE (f(7)=50, f(12)=145). T2 tamper->SHA-256 fail->REFUSED(-2), never executes. 13// T3 no-EXEC-cap->REFUSED(-4). T4 HW_WRITE w/o never-brick->REFUSED(-3); with proof->runs. T5 disk .nxe round-trips+runs. 14// expect_exit: 0 Sovereign: nx_cc->nxasm via nx_syscalls + canonical nx_sha256. NEVER-BRICK: RAM + a file, 0 firmware. 15import "nx_nxe_lib.nx" 16import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc) 17const K_MAGIC_4096: i64 = 4096 18 19func g_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 20// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer 21// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the 22// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls). 23// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign. 24func g_pn(v: i64) -> i64 { nxi_out(v); return 0 } 25func ck(name: *u8, c: i64) -> i64 { if c==1 { g_puts(" PASS " as *u8) } else { g_puts(" FAIL " as *u8) } g_puts(name); g_puts("\n" as *u8); return c } 26func wlog(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 27 28// f(x)=x*x+1 as x86_64: 48 89 f8 | 48 0f af c7 | 48 ff c0 | c3 (arg rdi, ret rax) -- 11 bytes 29func emit_payload(dst: *u8) -> i64 { 30 dst[0]=0x48 as u8; dst[1]=0x89 as u8; dst[2]=0xf8 as u8 31 dst[3]=0x48 as u8; dst[4]=0x0f as u8; dst[5]=0xaf as u8; dst[6]=0xc7 as u8 32 dst[7]=0x48 as u8; dst[8]=0xff as u8; dst[9]=0xc0 as u8 33 dst[10]=0xc3 as u8 34 return 11 35} 36 37func main() -> i64 { 38 g_puts("nx_nxe_loader (NATIVE NXE loader: verify SHA-256 integrity + capability + never-brick, THEN execute the code)\n" as *u8) 39 var pass: i64=0; var total: i64=0 40 let code: *u8=sys_mmap(64); let clen: i64=emit_payload(code) 41 let res: *i64=sys_mmap(16) as *i64; let ran: *i64=sys_mmap(16) as *i64 42 43 let m: *u8=sys_mmap(K_MAGIC_4096) 44 nxe_write(m, 1, 0, 8, 0, code, clen) // caps = EXEC(bit3)=8 45 let rc1: i64=nxe_load_exec(m, 7, res, ran); let r7: i64=res[0] 46 let rc1b: i64=nxe_load_exec(m, 12, res, ran); let r12: i64=res[0] 47 var t1: i64=0; if rc1==0 { if r7==50 { if rc1b==0 { if r12==145 { if ran[0]==1 { t1=1 } } } } } 48 g_puts(" T1 load+exec: rc="); g_pn(rc1); g_puts(" f(7)="); g_pn(r7); g_puts(" f(12)="); g_pn(r12); g_puts(" (real x86_64 code ran)\n" as *u8) 49 pass=pass+ck("T1: a valid NXE loads + its code section EXECUTES on this machine (f(7)=50, f(12)=145)" as *u8, t1); total=total+1 50 51 m[NXE_HOFF+2] = (m[NXE_HOFF+2] ^ (0xFF as u8)) 52 let rc2: i64=nxe_load_exec(m, 7, res, ran); let ran2: i64=ran[0] 53 m[NXE_HOFF+2] = (m[NXE_HOFF+2] ^ (0xFF as u8)) 54 let rc2b: i64=nxe_load_exec(m, 7, res, ran) 55 var t2: i64=0; if rc2==(0-2) { if ran2==0 { if rc2b==0 { if res[0]==50 { t2=1 } } } } 56 g_puts(" T2 tampered code: rc="); g_pn(rc2); g_puts(" (-2) executed?="); g_pn(ran2); g_puts(" (0=refused before exec); restored rc="); g_pn(rc2b); g_puts("\n" as *u8) 57 pass=pass+ck("T2 (teeth): a tampered code byte fails SHA-256 -> REFUSED (-2) and NEVER executes" as *u8, t2); total=total+1 58 59 let mn: *u8=sys_mmap(K_MAGIC_4096); nxe_write(mn, 1, 0, 1, 0, code, clen) // caps = FILE_READ only (no EXEC) 60 let rc3: i64=nxe_load_exec(mn, 7, res, ran) 61 var t3: i64=0; if rc3==(0-4) { if ran[0]==0 { t3=1 } } 62 g_puts(" T3 no-EXEC-cap: rc="); g_pn(rc3); g_puts(" (-4) executed?="); g_pn(ran[0]); g_puts("\n" as *u8) 63 pass=pass+ck("T3 (teeth): a binary that does not DECLARE the EXEC capability is REFUSED (-4) before execution" as *u8, t3); total=total+1 64 65 let mh: *u8=sys_mmap(K_MAGIC_4096); nxe_write(mh, 1, 1, 8, 0, code, clen) // flags=HW_WRITE(1), caps=EXEC 66 let rc4: i64=nxe_load_exec(mh, 7, res, ran); let ran4: i64=ran[0] 67 let mg: *u8=sys_mmap(K_MAGIC_4096); nxe_write(mg, 1, 3, 8, 0, code, clen) // flags=HW_WRITE|NEVER_BRICK_PROVEN(3) 68 let rc4b: i64=nxe_load_exec(mg, 7, res, ran) 69 var t4: i64=0; if rc4==(0-3) { if ran4==0 { if rc4b==0 { if res[0]==50 { t4=1 } } } } 70 g_puts(" T4 hw-write: no-proof rc="); g_pn(rc4); g_puts(" (-3) executed?="); g_pn(ran4); g_puts("; with-proof rc="); g_pn(rc4b); g_puts(" f(7)="); g_pn(res[0]); g_puts("\n" as *u8) 71 pass=pass+ck("T4 (teeth): HW_WRITE without never-brick REFUSED (-3); with the proof it loads+executes" as *u8, t4); total=total+1 72 73 let total_bytes: i64=nxe_size(m) 74 let fd: i64=sys_openat_wr("knowledge/organ_fx.nxe" as *u8, 0x1a4) 75 if fd>=0 { sys_write(fd, m, total_bytes); sys_close(fd) } 76 let m2: *u8=sys_mmap(K_MAGIC_4096) 77 let rfd: i64=sys_openat_rd("knowledge/organ_fx.nxe" as *u8); var got: i64=0 78 if rfd>=0 { var go: i64=1; while go==1 { let k: i64=sys_read(rfd,((m2 as i64)+got) as *u8, K_MAGIC_4096-got); if k<=0 { go=0 } else { got=got+k } } sys_close(rfd) } 79 let rc5: i64=nxe_load_exec(m2, 9, res, ran) 80 var t5: i64=0; if got==total_bytes { if rc5==0 { if res[0]==82 { if ran[0]==1 { t5=1 } } } } // f(9)=82 81 g_puts(" T5 disk .nxe: wrote "); g_pn(total_bytes); g_puts("B -> read "); g_pn(got); g_puts("B -> load+exec rc="); g_pn(rc5); g_puts(" f(9)="); g_pn(res[0]); g_puts(" (expect 82)\n" as *u8) 82 pass=pass+ck("T5: a real .nxe FILE round-trips off disk and its code EXECUTES (the format is a runnable executable)" as *u8, t5); total=total+1 83 84 var okall: i64=0; if pass==total { okall=1 } 85 g_puts("---- nx_nxe_loader: passed "); g_pn(pass); g_puts(" / "); g_pn(total); g_puts(" ----\n" as *u8) 86 if okall==1 { 87 let logf: i64=sys_openat_append("knowledge/status/nxe_loader.log" as *u8, 420) 88 if logf>=0 { wlog(logf,"NXE-LOADER GREEN: native NXE loader VERIFIES (SHA-256 + EXEC cap + never-brick) then EXECUTES; tamper/no-cap/hw-write refused before execution; disk .nxe runs\n" as *u8); sys_close(logf) } 89 g_puts("verdict=GREEN (native NXE loader: verify-before-execute BY CONSTRUCTION -- a real .nxe runs, a tampered/over-privileged one is refused before a byte executes; the EXEC-FORMAT gap closed)\n" as *u8); sys_exit(0); return 0 90 } 91 g_puts("verdict=RED\n" as *u8); sys_exit(1); return 1 92}