nx_spore_boot.nx source

1// nx_spore_boot.nx -- GATE: the BOOTABLE SPORE. NishiOS rung 4 capstone -- "match Puppy = a live image from POST". 2// Composes the three capabilities built this rung into a full cold boot to userland: 3// * the LIVE IMAGE = an NSFS-v2 filesystem image (a file = the medium; nx_vfsblock_lib) carrying /sbin/init.nxe 4// * MOUNT ROOT = vb_mount validates the superblock + REPLAYS the journal (crash-safe boot; nx_vfsblock_lib) 5// * LOAD + RUN INIT = read the .nxe by path from the mounted FS, VERIFY (SHA-256 + capability + never-brick), 6// then EXECUTE it (nx_nxe_lib: mmap RWX + cast fn-ptr + call = real machine code at userland) 7// The RESET stage is REAL executed x86_64: from cold reset the boot-stage runs as machine code (mmap RWX + call), 8// the C9-class "boot runs as real executed code" seam -- not a function called in sequence. 9// T1 COLD BOOT TO USERLAND: reset-code runs -> load medium -> mount(replay) -> load+verify+exec /sbin/init.nxe -> marker. 10// T2 PERSISTENCE / POWER-CYCLE: reboot from the same medium -> same userland result (a live image boots repeatedly). 11// T3 CRASH-DURING-INSTALL: journaled install of /sbin/init2.nxe crashes after commit -> reboot replays -> init2 BOOTS. 12// T4 NEVER-BRICK SAFE-HALT: a tampered /sbin/init.nxe on the medium -> loader REFUSES -> boot halts, init NEVER runs. 13// T5 MISSING INIT: no /sbin/init.nxe -> boot halts cleanly (-3), no crash. 14// HONEST: emulator/file-model -- RWX-exec stands in for the CPU fetch, the medium is a file; real-hardware POST 15// (BIOS/UEFI on physical silicon) remains the guarded never-brick operator step. expect_exit: 0 16// Sovereign: nx_cc->nxasm via nx_vfsblock_lib + nx_nxe_lib + nx_sha256. NEVER-BRICK: RAM + an image file, 0 firmware. 17import "nx_vfsblock_lib.nx" 18import "nx_nxe_lib.nx" 19const K_MAGIC_4096: i64 = 4096 20const K_MAGIC_45063: i64 = 45063 21 22func g_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 23func g_pn(v: i64) -> i64 { let b: *u8=sys_mmap(28); var x: i64=v; if x<0{b[0]=45;sys_write(1,b,1);x=0-x} if x==0{b[0]=48;sys_write(1,b,1);return 0} var d: i64=0; var y: i64=x; while y>0{d=d+1;y=y/10} var i: i64=d-1; y=x; while i>=0{b[i]=(48+(y%10)) as u8;y=y/10;i=i-1} sys_write(1,b,d); return 0 } 24func ck(name: *u8, c: i64) -> i64 { if c==1 { g_puts(" PASS " as *u8) } else { g_puts(" FAIL " as *u8) } g_puts(name); g_puts("\n" as *u8); return c } 25func wlog(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 26 27// init organ payload: f(x)=x*x+1 (x86_64; arg rdi, ret rax) -- 11 bytes. The userland program the spore boots into. 28func emit_init(dst: *u8) -> i64 { 29 dst[0]=0x48 as u8; dst[1]=0x89 as u8; dst[2]=0xf8 as u8 30 dst[3]=0x48 as u8; dst[4]=0x0f as u8; dst[5]=0xaf as u8; dst[6]=0xc7 as u8 31 dst[7]=0x48 as u8; dst[8]=0xff as u8; dst[9]=0xc0 as u8 32 dst[10]=0xc3 as u8 33 return 11 34} 35// reset/boot-stage payload: g(x)=x + 0xB007 (x86_64: mov rax,rdi; add rax,imm32; ret) -- proves real code at RESET 36func emit_boot(dst: *u8) -> i64 { 37 dst[0]=0x48 as u8; dst[1]=0x89 as u8; dst[2]=0xf8 as u8 // mov rax, rdi 38 dst[3]=0x48 as u8; dst[4]=0x05 as u8; dst[5]=0x07 as u8; dst[6]=0xb0 as u8; dst[7]=0x00 as u8; dst[8]=0x00 as u8 // add rax, 0xB007 39 dst[9]=0xc3 as u8 // ret 40 return 10 41} 42 43// build an init.nxe organ image (header+code) into out, return its byte length. 44func build_init_nxe(out: *u8) -> i64 { 45 let code: *u8=sys_mmap(64); let clen: i64=emit_init(code) 46 nxe_write(out, 1, 0, 8, 0, code, clen) // arch x86_64, flags 0, caps EXEC 47 return nxe_size(out) 48} 49 50// THE BOOT PATH from a medium file: load -> mount(replay) -> resolve /sbin/init.nxe -> read -> verify+EXECUTE. 51// returns boot status: 1 booted (init ran; result in resbox[0]); -1 medium load fail; -2 mount fail; -3 init not found; 52// -4 init verification refused (safe halt). ranbox[0]=1 iff init actually executed. 53func spore_boot(a: *u8, imgpath: *u8, arg: i64, resbox: *i64, ranbox: *i64) -> i64 { 54 resbox[0]=0; ranbox[0]=0 55 let ld: i64=vb_load(a, imgpath); if ld!=VB_NB*VB_BS { return 0-1 } 56 let m: i64=vb_mount(a); if m!=0 { return 0-2 } 57 let ii: i64=vb_resolve(a, "/sbin/init.nxe" as *u8); if ii<0 { return 0-3 } 58 let buf: *u8=sys_mmap(K_MAGIC_4096) 59 let n: i64=vb_read(a, ii, buf); if n<=0 { return 0-3 } 60 let rc: i64=nxe_load_exec(buf, arg, resbox, ranbox) 61 if rc!=0 { return 0-4 } 62 return 1 63} 64 65// stage a single-data-block file creation through the WAL WITHOUT committing (caller controls the crash point). 66func stage_file(a: *u8, scr: *u8, parent: i64, name: *u8, data: *u8, len: i64) -> i64 { 67 let idx: i64=vb_alloc_inode(a); let start: i64=vb_rd(a,24) 68 vbj_begin(a) 69 vbj_add(a, start, data, len) 70 let ds: i64=vb_sum(a, vbj_rec(0), len) 71 var k: i64=0; while k<VB_BS { scr[k]=0 as u8; k=k+1 } 72 vb_wr(scr,0,1); vb_wr(scr,8,0); vb_wr(scr,16,parent); vb_wr(scr,24,len); vb_wr(scr,32,start); vb_wr(scr,40,1); vb_wr(scr,48,ds) 73 var i: i64=0; while i<63 { if name[i]==(0 as u8) { scr[64+i]=0 as u8; i=63 } else { scr[64+i]=name[i]; i=i+1 } } scr[64+63]=0 as u8 74 vbj_add(a, VB_INO0+idx, scr, VB_BS) 75 var k2: i64=0; while k2<VB_BS { scr[k2]=a[k2]; k2=k2+1 } 76 vb_wr(scr,24,start+1) 77 vbj_add(a, 0, scr, VB_BS) 78 return idx 79} 80 81func main() -> i64 { 82 g_puts("nx_spore_boot (the BOOTABLE SPORE: POST -> load medium -> mount+replay -> load+verify+EXECUTE /sbin/init.nxe -> userland)\n" as *u8) 83 var pass: i64=0; var total: i64=0 84 let a: *u8 = sys_mmap(VB_NB*VB_BS) 85 let scr: *u8 = sys_mmap(VB_BS) 86 let res: *i64=sys_mmap(16) as *i64; let ran: *i64=sys_mmap(16) as *i64 87 let medium: *u8 = "knowledge/spore_live.img" as *u8 88 89 // ---- author the LIVE IMAGE: format -> journaled mkdir /sbin -> journaled write /sbin/init.nxe -> save the medium 90 vb_format(a) 91 let sbin: i64=vbj_mkdir_tx(a, 0, "sbin" as *u8) 92 let nxe: *u8=sys_mmap(K_MAGIC_4096); let nxlen: i64=build_init_nxe(nxe) 93 let ii0: i64=vbj_create_tx(a, sbin, "init.nxe" as *u8, nxe, nxlen) 94 vb_save(a, medium) 95 96 // ---- T1: COLD BOOT TO USERLAND (reset-code runs as real machine code, then the full boot path) 97 let boot: *u8=nxe_mmap_rwx(64); emit_boot(boot) 98 let bfp: func(i64) -> i64 = (boot as i64) as func(i64) -> i64 99 let bootmagic: i64=bfp(0) // reset stage executes -> 0xB007 = K_MAGIC_45063 100 let a1: *u8=sys_mmap(VB_NB*VB_BS) 101 let bs1: i64=spore_boot(a1, medium, 11, res, ran) // init is f(x)=x*x+1 -> init(11)=122 102 var t1: i64=0; if bootmagic==K_MAGIC_45063 { if bs1==1 { if ran[0]==1 { if res[0]==122 { t1=1 } } } } 103 g_puts(" T1 RESET code ran magic="); g_pn(bootmagic); g_puts(" (45063=0xB007); boot status="); g_pn(bs1); g_puts(" init(11)="); g_pn(res[0]); g_puts(" -> USERLAND\n" as *u8) 104 pass=pass+ck("T1: COLD BOOT -- reset runs real x86_64; medium loads; root MOUNTS; /sbin/init.nxe VERIFIES + EXECUTES -> userland" as *u8, t1); total=total+1 105 106 // ---- T2: PERSISTENCE across a power cycle -- reboot from the same medium, same result 107 let a2: *u8=sys_mmap(VB_NB*VB_BS) 108 let bs2: i64=spore_boot(a2, medium, 20, res, ran) 109 var t2: i64=0; if bs2==1 { if res[0]==401 { t2=1 } } // init(20)=20*20+1=401 110 g_puts(" T2 reboot from medium: status="); g_pn(bs2); g_puts(" init(20)="); g_pn(res[0]); g_puts(" (401 = live image boots repeatedly)\n" as *u8) 111 pass=pass+ck("T2: the live image BOOTS REPEATEDLY from the persisted medium (power-cycle stable)" as *u8, t2); total=total+1 112 113 // ---- T3: CRASH-DURING-INSTALL -- journaled install of init2 crashes AFTER commit; reboot replays -> init2 present 114 let a3: *u8=sys_mmap(VB_NB*VB_BS) 115 vb_load(a3, medium); vb_mount(a3) 116 let nxe2: *u8=sys_mmap(K_MAGIC_4096); let nxlen2: i64=build_init_nxe(nxe2) 117 let sbin3: i64=vb_resolve(a3, "/sbin" as *u8) 118 stage_file(a3, scr, sbin3, "init2.nxe" as *u8, nxe2, nxlen2) 119 vbj_commit(a3) 120 vb_save(a3, "knowledge/spore_crash.img" as *u8) // <-- crash instant: WAL durable, home blocks not applied 121 let a3b: *u8=sys_mmap(VB_NB*VB_BS) 122 vb_load(a3b, "knowledge/spore_crash.img" as *u8) 123 let m3: i64=vb_mount(a3b) // mount REPLAYS the committed install 124 let i2: i64=vb_resolve(a3b, "/sbin/init2.nxe" as *u8) 125 let b2: *u8=sys_mmap(K_MAGIC_4096); let rn2: i64=vb_read(a3b, i2, b2) 126 let rc3: i64=nxe_load_exec(b2, 6, res, ran) 127 var t3: i64=0; if m3==0 { if i2>=0 { if rc3==0 { if res[0]==37 { t3=1 } } } } // init2(6)=37 128 g_puts(" T3 crash-after-commit install: reboot mount="); g_pn(m3); g_puts(" /sbin/init2.nxe idx="); g_pn(i2); g_puts(" verify+exec(6)="); g_pn(res[0]); g_puts(" (37 = install survived crash)\n" as *u8) 129 pass=pass+ck("T3: an install interrupted by power loss (crash after commit) REPLAYS on reboot -> the organ boots" as *u8, t3); total=total+1 130 131 // ---- T4: NEVER-BRICK SAFE-HALT -- tamper /sbin/init.nxe code on the medium; boot must REFUSE, init must not run 132 let a4: *u8=sys_mmap(VB_NB*VB_BS) 133 vb_load(a4, medium) 134 let ii4: i64=vb_resolve(a4, "/sbin/init.nxe" as *u8) 135 let st4: i64=vb_rd(a4, vb_ino(ii4)+32) // init.nxe's data start block 136 a4[st4*VB_BS+NXE_HOFF+1] = (a4[st4*VB_BS+NXE_HOFF+1] ^ (0xFF as u8)) // corrupt a CODE byte inside the .nxe 137 vb_save(a4, "knowledge/spore_tamper.img" as *u8) 138 let a4b: *u8=sys_mmap(VB_NB*VB_BS) 139 let bs4: i64=spore_boot(a4b, "knowledge/spore_tamper.img" as *u8, 11, res, ran) 140 var t4: i64=0; if bs4==(0-4) { if ran[0]==0 { t4=1 } } 141 g_puts(" T4 tampered init.nxe: boot status="); g_pn(bs4); g_puts(" (-4=verification refused) init executed?="); g_pn(ran[0]); g_puts(" (0=safe halt)\n" as *u8) 142 pass=pass+ck("T4 (never-brick): a tampered /sbin/init.nxe is REFUSED at load -> boot halts safely, init NEVER executes" as *u8, t4); total=total+1 143 144 // ---- T5: MISSING INIT -- a fresh formatted medium has no init; boot halts cleanly, no crash 145 let a5: *u8=sys_mmap(VB_NB*VB_BS) 146 vb_format(a5); vb_save(a5, "knowledge/spore_bare.img" as *u8) 147 let a5b: *u8=sys_mmap(VB_NB*VB_BS) 148 let bs5: i64=spore_boot(a5b, "knowledge/spore_bare.img" as *u8, 11, res, ran) 149 var t5: i64=0; if bs5==(0-3) { if ran[0]==0 { t5=1 } } 150 g_puts(" T5 no init on medium: boot status="); g_pn(bs5); g_puts(" (-3=init not found, clean halt) executed?="); g_pn(ran[0]); g_puts("\n" as *u8) 151 pass=pass+ck("T5: a medium with no /sbin/init.nxe halts CLEANLY (-3) -- no crash, no garbage execution" as *u8, t5); total=total+1 152 153 var okall: i64=0; if pass==total { okall=1 } 154 g_puts("---- nx_spore_boot: passed "); g_pn(pass); g_puts(" / "); g_pn(total); g_puts(" ----\n" as *u8) 155 if okall==1 { 156 let logf: i64=sys_openat_append("knowledge/status/spore_boot.log" as *u8, 420) 157 if logf>=0 { wlog(logf,"NXSPOREBOOT GREEN: cold boot POST->load medium->mount+journal-replay->verify+execute /sbin/init.nxe->userland; power-cycle stable; crash-during-install replays; tampered init safe-halts; missing init clean-halts\n" as *u8); sys_close(logf) } 158 g_puts("verdict=GREEN (the bootable spore: a live image boots from POST to userland -- mount+replay+verify+execute; crash-safe + never-brick-halt; match-Puppy live-image-from-POST realized in the emulator/file-model)\n" as *u8); sys_exit(0); return 0 159 } 160 g_puts("verdict=RED\n" as *u8); sys_exit(1); return 1 161}