nx_priv_emit.nx source

1// nx_priv_emit.nx -- M/S/U PRIVILEGE + privilege-gated paging proof (privilege-levels capability). 2// 3// Proves the riscv-privileged-spec rule that Sv39 translation applies ONLY in S/U mode (M-mode is 4// always Bare) AND that mret transitions M->S. Same VA, two privilege modes, two results: 5// 1. M-mode: program a valid page table + satp(Sv39); load VA 0xC0009000 -> priv=M so Bare 6// (identity) -> reads physical 0xC0009000 (out of guest RAM) -> 0 != sentinel -> emit "MID" 7// (M-mode did NOT translate; if it HAD, beq -> "MX" = RED). 8// 2. mret to S-mode (mepc=&cont, mstatus.MPP=S); in S-mode load the SAME VA 0xC0009000 -> priv=S 9// so it TRANSLATES -> PA 0x80009000 -> sentinel -> emit "SOK" (else "SX"). 10// Success transcript "MIDSOK": the identical VA is identity in M and translated in S = translation 11// is privilege-gated, and mret M->S works. Zero hand-written machine code; two-pass branch resolve. 12// nx_priv_emit -> runtime/_hdl_build/_priv_virt.bin + .gold 13// Sovereign, no gcc/.sh. license_tier: ORIGINAL 14import "nx_syscalls.nx" 15const PV_MAGIC_8192: i64 = 8192 16 17const PV_OUT: *u8 = "runtime/_hdl_build/_priv_virt.bin" 18const PV_GOLD: *u8 = "runtime/_hdl_build/_priv_virt.bin.gold" 19const PV_LOG: *u8 = "knowledge/status/priv.log" 20 21const PV_UART: i64 = 0x10000000 22const PV_FIN: i64 = 0x100000 23const PV_PASS: i64 = 0x5555 24const PV_MEM_BASE: i64 = 0x80000000 25const PV_CSR_SATP: i64 = 0x180 26const PV_CSR_MSTATUS: i64 = 0x300 27const PV_CSR_MEPC: i64 = 0x341 28const PV_MRET: i64 = 0x30200073 29const PV_MPP_S: i64 = 0x800 30 31const RV_X0: i64 = 0 32const RV_T0: i64 = 5 33const RV_T1: i64 = 6 34const RV_T2: i64 = 7 35const RV_T3: i64 = 28 36const RV_T4: i64 = 29 37const RV_T5: i64 = 30 38 39const PV_PTE_ADDR: i64 = 0x80008000 40const PV_PTE_OFF: i64 = 0x18 41const PV_PTE_VAL: i64 = 0x20000007 42const PV_SENT_PA: i64 = 0x80009000 43const PV_SENT_VAL: i64 = 0x5ECA1234 44const PV_VA: i64 = 0xC0009000 45const PV_SATP_PPN: i64 = 0x80008 46const PV_SV39: i64 = 8 47 48func pv_lui(rd: i64, imm20: i64) -> i64 { return ((imm20 & 0xFFFFF) << 12) | (rd << 7) | 0x37 } 49func pv_addi(rd: i64, rs1: i64, imm: i64) -> i64 { return ((imm & 0xFFF) << 20) | (rs1 << 15) | (rd << 7) | 0x13 } 50func pv_load(rd: i64, rs1: i64, f3: i64, imm: i64) -> i64 { return ((imm & 0xFFF) << 20) | (rs1 << 15) | (f3 << 12) | (rd << 7) | 0x03 } 51func pv_store(rs2: i64, rs1: i64, f3: i64, imm: i64) -> i64 { 52 let hi: i64 = ((imm >> 5) & 0x7f) << 25 53 let lo: i64 = (imm & 0x1f) << 7 54 return hi | (rs2 << 20) | (rs1 << 15) | (f3 << 12) | lo | 0x23 55} 56func pv_branch(rs1: i64, rs2: i64, f3: i64, imm: i64) -> i64 { 57 let b12: i64 = ((imm >> 12) & 0x1) << 31 58 let b11: i64 = ((imm >> 11) & 0x1) << 7 59 let b10_5: i64 = ((imm >> 5) & 0x3f) << 25 60 let b4_1: i64 = ((imm >> 1) & 0xf) << 8 61 return b12 | b10_5 | (rs2 << 20) | (rs1 << 15) | (f3 << 12) | b4_1 | b11 | 0x63 62} 63func pv_jal(rd: i64, imm: i64) -> i64 { 64 let b20: i64 = ((imm >> 20) & 0x1) << 31 65 let b19_12: i64 = ((imm >> 12) & 0xff) << 12 66 let b11: i64 = ((imm >> 11) & 0x1) << 20 67 let b10_1: i64 = ((imm >> 1) & 0x3ff) << 21 68 return b20 | b10_1 | b11 | b19_12 | (rd << 7) | 0x6f 69} 70func pv_slli(rd: i64, rs1: i64, shamt: i64) -> i64 { return ((shamt & 0x3f) << 20) | (rs1 << 15) | (1 << 12) | (rd << 7) | 0x13 } 71func pv_srli(rd: i64, rs1: i64, shamt: i64) -> i64 { return ((shamt & 0x3f) << 20) | (rs1 << 15) | (5 << 12) | (rd << 7) | 0x13 } 72func pv_or(rd: i64, rs1: i64, rs2: i64) -> i64 { return (rs2 << 20) | (rs1 << 15) | (6 << 12) | (rd << 7) | 0x33 } 73func pv_csrrw(rd: i64, csr: i64, rs1: i64) -> i64 { return ((csr & 0xfff) << 20) | (rs1 << 15) | (1 << 12) | (rd << 7) | 0x73 } 74func pv_w32(buf: *u8, off: i64, w: i64) -> i64 { buf[off]=(w&0xff) as u8; buf[off+1]=((w>>8)&0xff) as u8; buf[off+2]=((w>>16)&0xff) as u8; buf[off+3]=((w>>24)&0xff) as u8; return off+4 } 75func pv_li32(buf: *u8, off: i64, rd: i64, val: i64) -> i64 { 76 var hi: i64 = (val >> 12) & 0xFFFFF 77 var lo: i64 = val & 0xFFF 78 if lo >= 0x800 { lo = lo - 0x1000; hi = (hi + 1) & 0xFFFFF } 79 var o: i64 = pv_w32(buf, off, pv_lui(rd, hi)) 80 o = pv_w32(buf, o, pv_addi(rd, rd, lo)) 81 return o 82} 83func pv_li32u(buf: *u8, off: i64, rd: i64, val: i64) -> i64 { 84 var o: i64 = pv_li32(buf, off, rd, val) 85 o = pv_w32(buf, o, pv_slli(rd, rd, 32)) 86 o = pv_w32(buf, o, pv_srli(rd, rd, 32)) 87 return o 88} 89func pv_emit_str(buf: *u8, off: i64, s: *u8, n: i64) -> i64 { 90 var o: i64 = off 91 var i: i64 = 0 92 while i < n { o = pv_w32(buf, o, pv_addi(RV_T1, RV_X0, s[i] as i64)); o = pv_w32(buf, o, pv_store(RV_T1, RV_T0, 0, 0)); i = i + 1 } 93 return o 94} 95func pv_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 96func pv_fn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 97 98// pos_out[0]=MFAIL [1]=SFAIL [2]=HALT [3]=CONT(S-mode entry) 99func pv_emit_image(buf: *u8, mfail_off: i64, sfail_off: i64, halt_off: i64, cont_off: i64, pos_out: *i64, mpp: i64) -> i64 { 100 var o: i64 = 0 101 o = pv_w32(buf, o, pv_lui(RV_T0, PV_UART >> 12)) 102 // M-mode: lay PTEs + sentinel + satp (satp set, but priv=M -> Bare -> no translation yet). 103 // root[VPN2=2] (offset 0x10) = always-valid gigapage identity map for the kernel text (VA 104 // 0x80000000.. -> PA 0x80000000..) so the S-mode CONT code can be FETCHED once Sv39 is on; the 105 // data leaf root[VPN2=3] (offset 0x18) maps VA 0xC0000000.. for the load test. 106 o = pv_li32u(buf, o, RV_T5, PV_PTE_ADDR) 107 o = pv_li32(buf, o, RV_T1, 0x2000000F) // identity code-map gigapage (PPN 0x80000, V|R|W|X -- X required to FETCH under perm enforcement) 108 o = pv_w32(buf, o, pv_store(RV_T1, RV_T5, 2, 0x10)) // sw code-map, 0x10(t5) = root[VPN2=2] 109 o = pv_li32(buf, o, RV_T1, PV_PTE_VAL) 110 o = pv_w32(buf, o, pv_store(RV_T1, RV_T5, 2, PV_PTE_OFF)) 111 o = pv_li32u(buf, o, RV_T5, PV_SENT_PA) 112 o = pv_li32(buf, o, RV_T1, PV_SENT_VAL) 113 o = pv_w32(buf, o, pv_store(RV_T1, RV_T5, 2, 0)) 114 o = pv_li32(buf, o, RV_T1, PV_SATP_PPN) 115 o = pv_w32(buf, o, pv_addi(RV_T2, RV_X0, PV_SV39)) 116 o = pv_w32(buf, o, pv_slli(RV_T2, RV_T2, 60)) 117 o = pv_w32(buf, o, pv_or(RV_T1, RV_T1, RV_T2)) 118 o = pv_w32(buf, o, pv_csrrw(RV_X0, PV_CSR_SATP, RV_T1)) 119 // M-mode load VA -> Bare (identity) -> out-of-range -> 0. If it EQUALS the sentinel, M wrongly 120 // translated -> MFAIL. Else emit "MID" (M-mode is Bare, as required). 121 o = pv_li32u(buf, o, RV_T5, PV_VA) 122 o = pv_w32(buf, o, pv_load(RV_T3, RV_T5, 2, 0)) 123 o = pv_li32(buf, o, RV_T4, PV_SENT_VAL) 124 let pcm: i64 = o 125 o = pv_w32(buf, o, pv_branch(RV_T3, RV_T4, 0, mfail_off - pcm)) // beq -> MFAIL (M translated = wrong) 126 o = pv_emit_str(buf, o, "MID" as *u8, 3) 127 // enter S-mode 128 o = pv_li32u(buf, o, RV_T1, PV_MEM_BASE + cont_off) 129 o = pv_w32(buf, o, pv_csrrw(RV_X0, PV_CSR_MEPC, RV_T1)) 130 o = pv_li32(buf, o, RV_T1, mpp) 131 o = pv_w32(buf, o, pv_csrrw(RV_X0, PV_CSR_MSTATUS, RV_T1)) 132 o = pv_w32(buf, o, PV_MRET) 133 pos_out[3] = o // CONT (S-mode) 134 // S-mode load SAME VA -> translate -> sentinel -> "SOK" 135 o = pv_li32u(buf, o, RV_T5, PV_VA) 136 o = pv_w32(buf, o, pv_load(RV_T3, RV_T5, 2, 0)) 137 o = pv_li32(buf, o, RV_T4, PV_SENT_VAL) 138 let pcs: i64 = o 139 o = pv_w32(buf, o, pv_branch(RV_T3, RV_T4, 1, sfail_off - pcs)) // bne -> SFAIL 140 o = pv_emit_str(buf, o, "SOK" as *u8, 3) 141 o = pv_w32(buf, o, pv_jal(RV_X0, halt_off - o)) 142 pos_out[0] = o // MFAIL 143 o = pv_emit_str(buf, o, "MX" as *u8, 2) 144 o = pv_w32(buf, o, pv_jal(RV_X0, halt_off - o)) 145 pos_out[1] = o // SFAIL 146 o = pv_emit_str(buf, o, "SX" as *u8, 2) 147 pos_out[2] = o // HALT 148 o = pv_li32(buf, o, RV_T5, PV_FIN) 149 o = pv_li32(buf, o, RV_T1, PV_PASS) 150 o = pv_w32(buf, o, pv_store(RV_T1, RV_T5, 2, 0)) 151 o = pv_w32(buf, o, pv_jal(RV_X0, 0)) 152 return o 153} 154 155func pv_parse_num(s: *u8) -> i64 { 156 var q: i64 = 0; var val: i64 = 0 157 if s[0] == (48 as u8) { if s[1] == (120 as u8) { 158 q = 2 159 var go: i64 = 1 160 while go == 1 { let c: i64 = s[q] as i64; var d: i64 = 0-1; if c>=48 { if c<=57 { d=c-48 } } if c>=97 { if c<=102 { d=c-87 } } if c>=65 { if c<=70 { d=c-55 } } if d<0 { go=0 } else { val=val*16+d; q=q+1 } } 161 return val 162 }} 163 var go2: i64 = 1 164 while go2 == 1 { let c: i64 = s[q] as i64; if c>=48 { if c<=57 { val=val*10+(c-48); q=q+1 } else { go2=0 } } else { go2=0 } } 165 return val 166} 167 168func main(argc: i64, argv: *i64) -> i64 { 169 var mpp: i64 = PV_MPP_S 170 var outp: *u8 = PV_OUT 171 if argc >= 2 { mpp = pv_parse_num(argv[1] as *u8) } // control: pass 0x1800 (MPP=M) -> stay M -> no SOK 172 if argc >= 3 { outp = argv[2] as *u8 } 173 let scratch: *u8 = sys_mmap(PV_MAGIC_8192) 174 let pos: *i64 = sys_mmap(32) as *i64 175 pv_emit_image(scratch, 0, 0, 0, 0, pos, mpp) 176 let mfail_off: i64 = pos[0] 177 let sfail_off: i64 = pos[1] 178 let halt_off: i64 = pos[2] 179 let cont_off: i64 = pos[3] 180 let buf: *u8 = sys_mmap(PV_MAGIC_8192) 181 let sz: i64 = pv_emit_image(buf, mfail_off, sfail_off, halt_off, cont_off, pos, mpp) 182 let fd: i64 = sys_openat_wr(outp, 420) 183 if fd < 0 { pv_p("PRIVEMIT verdict=RED reason=out-unwritable\n" as *u8); return 1 } 184 sys_write(fd, buf, sz); sys_close(fd) 185 let gold: *u8 = sys_mmap(8) 186 gold[0]=77 as u8; gold[1]=73 as u8; gold[2]=68 as u8; gold[3]=83 as u8; gold[4]=79 as u8; gold[5]=75 as u8 // "MIDSOK" 187 let gfd: i64 = sys_openat_wr(PV_GOLD, 420) 188 if gfd >= 0 { sys_write(gfd, gold, 6); sys_close(gfd) } 189 pv_p("PRIVEMIT name=" as *u8); pv_p(outp); pv_p(" bytes=" as *u8); pv_fn(1, sz); pv_p(" golden=MIDSOK (M=Bare, S=translate)\n" as *u8) 190 let lf: i64 = sys_openat_append(PV_LOG, 420) 191 if lf >= 0 { var n: i64=0; let m: *u8="PRIVEMIT authored _priv_virt.bin golden=MIDSOK\n" as *u8; while m[n]!=(0 as u8){n=n+1} sys_write(lf,m,n); sys_close(lf) } 192 return 0 193}