nx_ownership_ok.nx source
↩ module page · 79 lines · 3433 B
1// nx_ownership_ok.nx -- THE POSITIVE CONTROL for LN4/LN5 ownership (nx_ownership_gate).
2//
3// A GUARD THAT REFUSES EVERYTHING PASSES EVERY NEGATIVE TEST. Every tooth in the gate that asserts a
4// REFUSAL is satisfied by a checker that refuses all source, by a broken fixture path, by a missing
5// assembler, by NAS /tmp being noexec -- by anything at all going wrong. This file is the only thing
6// that can tell those apart: it must COMPILE AND RUN EXIT 0 under `--ownership`, and it drags the
7// whole imported stdlib through the mode with it, so a rung that refuses real code fails HERE.
8//
9// Each function is one ACCEPT the rung must not break. license_tier: ORIGINAL No hw writes (Rule 26).
10import "nx_syscalls.nx"
11
12const OWN_OK_BYTES: i64 = 64
13const OWN_OK_MARK: i64 = 7
14
15// ACCEPT 1: move, then never touch the old name again -- the ordinary correct shape, and the one the
16// mode exists to permit. Reading through the name the move produced is the point of moving.
17func own_ok_move_then_silence(seed: i64) -> i64 {
18 let buf: *u8 = sys_mmap(OWN_OK_BYTES)
19 buf[0] = seed as u8
20 let taken: *u8 = __move(buf)
21 return taken[0] as i64
22}
23
24// ACCEPT 2: read everything you need, THEN release. The release's own read of the name is the last
25// legitimate use and must not be refused by the rule the release itself installs.
26func own_ok_release_then_silence(seed: i64) -> i64 {
27 let buf: *u8 = sys_mmap(OWN_OK_BYTES)
28 buf[0] = seed as u8
29 let v: i64 = buf[0] as i64
30 sys_munmap(buf, OWN_OK_BYTES)
31 return v
32}
33
34// ACCEPT 3: RE-INITIALISATION after a move. THE tooth that separates a checker from a nuisance -- a
35// rung that refused every second use of a name would pass every refusal test and be worthless.
36func own_ok_reinit_after_move(seed: i64) -> i64 {
37 var buf: *u8 = sys_mmap(OWN_OK_BYTES)
38 buf[0] = seed as u8
39 let taken: *u8 = __move(buf)
40 buf = sys_mmap(OWN_OK_BYTES)
41 buf[0] = (seed + 1) as u8
42 return (buf[0] as i64) - (taken[0] as i64)
43}
44
45// ACCEPT 4: RE-INITIALISATION after a release -- the allocate/free/allocate loop body, which is the
46// commonest real shape in this corpus and must keep building.
47func own_ok_reinit_after_release(seed: i64) -> i64 {
48 var buf: *u8 = sys_mmap(OWN_OK_BYTES)
49 buf[0] = seed as u8
50 sys_munmap(buf, OWN_OK_BYTES)
51 buf = sys_mmap(OWN_OK_BYTES)
52 buf[0] = seed as u8
53 return buf[0] as i64
54}
55
56// ACCEPT 5: a pointer this rung cannot see the origin of (a PARAMETER) is never refused. The
57// declared floors must express themselves as silence, never as a refusal -- a floor that refuses is
58// a false positive wearing the word "conservative".
59func own_ok_param(p: *u8) -> i64 {
60 return p[0] as i64
61}
62
63// ACCEPT 6: __move on a name this rung does not track is a no-op, not an error. Same reason.
64func own_ok_move_untracked(p: *u8) -> i64 {
65 let q: *u8 = __move(p)
66 return q[0] as i64
67}
68
69func main(argc: i64, argv: *i64) -> i64 {
70 if own_ok_move_then_silence(OWN_OK_MARK) != OWN_OK_MARK { return 1 }
71 if own_ok_release_then_silence(OWN_OK_MARK) != OWN_OK_MARK { return 2 }
72 if own_ok_reinit_after_move(OWN_OK_MARK) != 1 { return 3 }
73 if own_ok_reinit_after_release(OWN_OK_MARK) != OWN_OK_MARK { return 4 }
74 let s: *u8 = sys_mmap(OWN_OK_BYTES)
75 s[0] = OWN_OK_MARK as u8
76 if own_ok_param(s) != OWN_OK_MARK { return 5 }
77 if own_ok_move_untracked(s) != OWN_OK_MARK { return 6 }
78 return 0
79}