code wiki / _hdl_build / nx_uefi_ovmf_oracle.nx
`nx_uefi_ovmf_oracle.nx` source

↩ module page · 428 lines · 18008 B
1// nx_uefi_ovmf_oracle.nx -- BENCH-ONLY ORACLE (operator law 2026-07-20).
2//
3// THE THIRD REFERENCE FOR THE UEFI LANE.  nx_boot_uefi AUTHORS the EFI image and nx_emu_uefi
4// EXECUTES it -- but both are OURS, so a GREEN from that pair proves the pair is self-consistent,
5// never that real firmware agrees.  ("A TWO-WAY COMPARISON ATTRIBUTES THE INCUMBENT'S ERROR TO
6// YOU -- BUILD THE THIRD REFERENCE ONCE AND REUSE IT AT EVERY SCALE.")  The third reference is
7// EDK2/OVMF: an independent UEFI implementation nobody here wrote.
8//
9// This organ does NOT run qemu (qemu is a foreign binary and lives only on the laptop; the NAS
10// has neither qemu nor OVMF -- measured 2026-08-08).  It is the RULER: it takes the framebuffer
11// real firmware actually produced (a qemu `screendump` P6 PPM) and the framebuffer the sovereign
12// emulator modelled (`nx_emu_uefi --shot` 24-bit BMP) and compares them PIXEL FOR PIXEL, plus
13// re-derives nx_emu_uefi's own fb_measure statistics over the FOREIGN buffer so both engines are
14// judged by ONE ruler on ONE scale.
15//
16// Orientation/channel order are NOT assumed: PPM is top-down RGB, BMP is bottom-up BGR, and the
17// transform is applied explicitly.  Geometry comes FROM each file's own header, never from a
18// constant -- a comparator that trusts the writer's constants is one implementation, not two.
19//
20// Usage:  nx_uefi_ovmf_oracle <ovmf.ppm> <sov.bmp>
21//         nx_uefi_ovmf_oracle selftest        (teeth, incl. a planted-difference negative control)
22// Exit:   0 GREEN (dims agree AND zero differing pixels) | 1 RED | 3 UNPROVEN (could not read)
23//   -- the third state exists so "I could not look" never reports as "it is broken".
24// Log ->  knowledge/status/nishi_os.log, canonical verdict= on the LAST field (positional anchor).
25// Sovereign: syscalls only, no gcc/.sh.  license_tier: ORIGINAL
26import "nx_syscalls.nx"
27const OVO_MAGIC_4096: i64 = 4096
28
29const OVO_MAXW: i64 = 8192
30const OVO_MAXH: i64 = 8192
31
32// out slots
33const O_W:      i64 = 0
34const O_H:      i64 = 1
35const O_TOTAL:  i64 = 2
36const O_EQUAL:  i64 = 3
37const O_DIFF:   i64 = 4
38const O_FDX:    i64 = 5
39const O_FDY:    i64 = 6
40const O_COLOR:  i64 = 7
41const O_MATCH:  i64 = 8
42const O_ZEROS:  i64 = 9
43const O_TRANS:  i64 = 10
44
45func o_p(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
46func o_fp(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
47func o_fn(fd: i64, v: i64) -> i64 {
  let bb: *u8 = sys_mmap(28); var m: i64 = v
  if m < 0 { m = 0 - m; bb[0] = 45 as u8; sys_write(fd, bb, 1) }
  let t: *u8 = sys_mmap(28); var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0
  while i < k { bb[i] = t[k - 1 - i]; i = i + 1 }
  sys_write(fd, bb, k); return 0
56}
57func o_fx(fd: i64, v: i64) -> i64 {
  let hx: *u8 = "0123456789ABCDEF" as *u8            // hoisted: indexing an inline-cast literal never matches
  let bb: *u8 = sys_mmap(20)
  var i: i64 = 0
  while i < 8 { bb[i] = hx[(v >> ((7 - i) * 4)) & 0xf]; i = i + 1 }
  sys_write(fd, bb, 8); return 0
63}
64func o_eq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
  if b[i] != (0 as u8) { return 0 }
  return 1
69}
70func rd32(b: *u8, o: i64) -> i64 {
  return (b[o] as i64) | ((b[o+1] as i64) << 8) | ((b[o+2] as i64) << 16) | ((b[o+3] as i64) << 24)
72}
73
74// ---- P6 PPM header: "P6" ws [#comment] w ws h ws maxval <one ws> data ----------------------
75// ip[0] carries the cursor in and out.  A SEPARATE `done` flag ends each scan: a loop that exits
76// by clobbering its own cursor destroys the position it was searching for.
77func ppm_ws(b: *u8, len: i64, ip: *i64) -> i64 {
  var i: i64 = ip[0]
  var done: i64 = 0
  while done == 0 {
      if i >= len { done = 1 }
      else {
          let c: i64 = b[i] as i64
          if c == 35 {                                  // '#' comment to end of line
              var j: i64 = i
              var eol: i64 = 0
              while eol == 0 {
                  if j >= len { eol = 1 } else { if (b[j] as i64) == 10 { eol = 1 } else { j = j + 1 } }
              }
              i = j
          } else {
              if c == 32 { i = i + 1 } else {
              if c == 9  { i = i + 1 } else {
              if c == 10 { i = i + 1 } else {
              if c == 13 { i = i + 1 } else { done = 1 } } } }
          }
      }
  }
  ip[0] = i
  return 0
101}
102func ppm_int(b: *u8, len: i64, ip: *i64) -> i64 {
  var i: i64 = ip[0]
  var v: i64 = 0
  var n: i64 = 0
  var done: i64 = 0
  while done == 0 {
      if i >= len { done = 1 }
      else {
          let d: i64 = (b[i] as i64) - 48
          if d < 0 { done = 1 } else { if d > 9 { done = 1 } else {
              v = v * 10 + d; n = n + 1; i = i + 1
          } }
      }
  }
  ip[0] = i
  if n == 0 { return 0 - 1 }
  return v
119}
120
121// ---- the comparison.  Returns 0 ok, negative = a NAMED refusal (never a silent zero) --------
122//  -1 ppm magic  -2 ppm header  -3 ppm truncated  -4 bmp magic  -5 bmp bpp
123//  -6 bmp truncated  -7 dimension mismatch  -8 insane geometry
124func fb_compare(pp: *u8, plen: i64, bm: *u8, blen: i64, out: *i64) -> i64 {
  if plen < 16 { return 0 - 1 }
  if (pp[0] as i64) != 80 { return 0 - 1 }              // 'P'
  if (pp[1] as i64) != 54 { return 0 - 1 }              // '6'
  let ip: *i64 = sys_mmap(16) as *i64
  ip[0] = 2
  ppm_ws(pp, plen, ip)
  let pw: i64 = ppm_int(pp, plen, ip)
  ppm_ws(pp, plen, ip)
  let ph: i64 = ppm_int(pp, plen, ip)
  ppm_ws(pp, plen, ip)
  let pmax: i64 = ppm_int(pp, plen, ip)
  if pw < 0 { return 0 - 2 }
  if ph < 0 { return 0 - 2 }
  if pmax != 255 { return 0 - 2 }
  let pdata: i64 = ip[0] + 1                            // exactly one whitespace byte precedes data
  if pw <= 0 { return 0 - 8 }
  if ph <= 0 { return 0 - 8 }
  if pw > OVO_MAXW { return 0 - 8 }
  if ph > OVO_MAXH { return 0 - 8 }
  if (pdata + pw * ph * 3) > plen { return 0 - 3 }
145
  if blen < 54 { return 0 - 4 }
  if (bm[0] as i64) != 66 { return 0 - 4 }              // 'B'
  if (bm[1] as i64) != 77 { return 0 - 4 }              // 'M'
  let bdata: i64 = rd32(bm, 10)
  let bw: i64 = rd32(bm, 18)
  let bh: i64 = rd32(bm, 22)
  let bpp: i64 = (bm[28] as i64) | ((bm[29] as i64) << 8)
  if bpp != 24 { return 0 - 5 }
  if bw != pw { return 0 - 7 }
  if bh != ph { return 0 - 7 }
  let rowb: i64 = bw * 3
  var pad: i64 = 0
  while ((rowb + pad) % 4) != 0 { pad = pad + 1 }
  let stride: i64 = rowb + pad
  if (bdata + stride * bh) > blen { return 0 - 6 }
161
  var equal: i64 = 0
  var diff: i64 = 0
  var fdx: i64 = 0 - 1
  var fdy: i64 = 0 - 1
  // fb_measure over the FOREIGN buffer, in the SAME BGRX dword form and the SAME memory order
  // (top-down) nx_emu_uefi uses, so the two stat vectors are comparable rather than merely alike.
  var color: i64 = 0
  var matches: i64 = 0
  var zeros: i64 = 0
  var trans: i64 = 0
  var prev: i64 = 0
  var first: i64 = 1
174
  var y: i64 = 0
  while y < ph {
      let prow: i64 = pdata + y * pw * 3
      let brow: i64 = bdata + (bh - 1 - y) * stride     // BMP rows are bottom-up
      var x: i64 = 0
      while x < pw {
          let pr: i64 = pp[prow + x * 3] as i64
          let pg: i64 = pp[prow + x * 3 + 1] as i64
          let pb: i64 = pp[prow + x * 3 + 2] as i64
          let bb2: i64 = bm[brow + x * 3] as i64
          let bg: i64 = bm[brow + x * 3 + 1] as i64
          let br: i64 = bm[brow + x * 3 + 2] as i64
          var same: i64 = 1
          if pr != br { same = 0 }
          if pg != bg { same = 0 }
          if pb != bb2 { same = 0 }
          if same == 1 { equal = equal + 1 } else {
              diff = diff + 1
              if fdx < 0 { fdx = x; fdy = y }
          }
          let dw: i64 = pb | (pg << 8) | (pr << 16)     // B | G<<8 | R<<16 == the GOP BGRX dword
          if first == 1 { color = dw; prev = dw; first = 0 }
          if dw == color { matches = matches + 1 }
          if dw == 0 { zeros = zeros + 1 }
          if dw != prev { trans = trans + 1 }
          prev = dw
          x = x + 1
      }
      y = y + 1
  }
205
  out[O_W] = pw; out[O_H] = ph; out[O_TOTAL] = pw * ph
  out[O_EQUAL] = equal; out[O_DIFF] = diff
  out[O_FDX] = fdx; out[O_FDY] = fdy
  out[O_COLOR] = color; out[O_MATCH] = matches; out[O_ZEROS] = zeros; out[O_TRANS] = trans
  return 0
211}
212
213// ---- fixtures: build a matched PPM/BMP pair in memory, then plant a single-pixel difference --
214// The negative control is the whole point: a comparator that has only ever seen identical inputs
215// has not been shown to fire.
216func mk_ppm(b: *u8, w: i64, h: i64) -> i64 {
  let hd: *u8 = "P6\n4 3\n255\n" as *u8                 // fixture geometry is fixed at 4x3
  var i: i64 = 0
  while hd[i] != (0 as u8) { b[i] = hd[i]; i = i + 1 }
  let d: i64 = i
  var k: i64 = 0
  while k < (w * h) {
      b[d + k * 3]     = (10 + k) as u8                 // R
      b[d + k * 3 + 1] = (20 + k * 2) as u8             // G
      b[d + k * 3 + 2] = (30 + k * 3) as u8             // B
      k = k + 1
  }
  return d + w * h * 3
229}
230func mk_bmp(b: *u8, w: i64, h: i64) -> i64 {
  let rowb: i64 = w * 3
  var pad: i64 = 0
  while ((rowb + pad) % 4) != 0 { pad = pad + 1 }
  let stride: i64 = rowb + pad
  let total: i64 = 54 + stride * h
  var z: i64 = 0
  while z < total { b[z] = 0 as u8; z = z + 1 }
  b[0] = 66 as u8; b[1] = 77 as u8
  b[10] = 54 as u8
  b[14] = 40 as u8
  b[18] = (w & 0xff) as u8; b[19] = ((w >> 8) & 0xff) as u8
  b[22] = (h & 0xff) as u8; b[23] = ((h >> 8) & 0xff) as u8
  b[26] = 1 as u8; b[28] = 24 as u8
  var y: i64 = 0
  while y < h {
      let row: i64 = 54 + (h - 1 - y) * stride
      var x: i64 = 0
      while x < w {
          let k: i64 = y * w + x
          b[row + x * 3]     = (30 + k * 3) as u8       // B
          b[row + x * 3 + 1] = (20 + k * 2) as u8       // G
          b[row + x * 3 + 2] = (10 + k) as u8           // R
          x = x + 1
      }
      y = y + 1
  }
  return total
258}
259
260func ovo_selftest() -> i64 {
  let out: *i64 = sys_mmap(8 * 16) as *i64
  var pass: i64 = 0
  var teeth: i64 = 0
  let W: i64 = 4
  let H: i64 = 3
266
  let pp: *u8 = sys_mmap(OVO_MAGIC_4096)
  let bm: *u8 = sys_mmap(OVO_MAGIC_4096)
  let plen: i64 = mk_ppm(pp, W, H)
  let blen: i64 = mk_bmp(bm, W, H)
271
  // T1 POSITIVE CONTROL: a matched pair must report zero differing pixels over the FULL count.
  // Bound the assertion to its denominator -- a tooth that passes on the empty set is not a tooth.
  teeth = teeth + 1
  var r: i64 = fb_compare(pp, plen, bm, blen, out)
  var ok: i64 = 0
  if r == 0 { if out[O_TOTAL] == (W * H) { if out[O_DIFF] == 0 { if out[O_EQUAL] == (W * H) { ok = 1 } } } }
  if ok == 1 { pass = pass + 1; o_p("OVO-T1 matched-pair-zero-diff GREEN\n" as *u8) }
  else { o_p("OVO-T1 RED\n" as *u8) }
280
  // T2 NEGATIVE CONTROL: plant ONE pixel difference at a KNOWN coordinate and demand the
  // comparator name that exact coordinate.  Asserting only "diff>0" would pass for a
  // comparator that reports every pixel as different.
  teeth = teeth + 1
  let tx: i64 = 2
  let ty: i64 = 1
  let rowb2: i64 = W * 3
  var pad2: i64 = 0
  while ((rowb2 + pad2) % 4) != 0 { pad2 = pad2 + 1 }
  let stride2: i64 = rowb2 + pad2
  let poff: i64 = 54 + (H - 1 - ty) * stride2 + tx * 3
  let before: i64 = bm[poff] as i64
  bm[poff] = (before ^ 0xff) as u8                       // flip the BLUE channel of one pixel
  var fixture_moved: i64 = 0
  if (bm[poff] as i64) != before { fixture_moved = 1 }   // assert the fixture REACHED the condition
  r = fb_compare(pp, plen, bm, blen, out)
  ok = 0
  if fixture_moved == 1 { if r == 0 {
      if out[O_DIFF] == 1 { if out[O_FDX] == tx { if out[O_FDY] == ty { ok = 1 } } }
  } }
  if ok == 1 { pass = pass + 1; o_p("OVO-T2 neg-control-planted-pixel-located GREEN\n" as *u8) }
  else {
      o_p("OVO-T2 RED  fixture_moved=" as *u8); o_fn(1, fixture_moved)
      o_p(" rc=" as *u8); o_fn(1, r)
      o_p(" diff=" as *u8); o_fn(1, out[O_DIFF])
      o_p(" fdx=" as *u8); o_fn(1, out[O_FDX])
      o_p(" fdy=" as *u8); o_fn(1, out[O_FDY]); o_p("\n" as *u8)
  }
  bm[poff] = before as u8                                // restore: the restore is part of the experiment
310
  // T3 a dimension mismatch must be REFUSED by name, never compared to a truncated overlap.
  teeth = teeth + 1
  bm[18] = 8 as u8
  r = fb_compare(pp, plen, bm, blen, out)
  if r == (0 - 7) { pass = pass + 1; o_p("OVO-T3 dim-mismatch-refused GREEN\n" as *u8) }
  else { o_p("OVO-T3 RED rc=" as *u8); o_fn(1, r); o_p("\n" as *u8) }
  bm[18] = (W & 0xff) as u8
318
  // T4 a non-PPM input must be refused by name rather than parsed into confident nonsense.
  teeth = teeth + 1
  let sv: i64 = pp[1] as i64
  pp[1] = 51 as u8                                       // "P3" -- ASCII PPM, not P6
  r = fb_compare(pp, plen, bm, blen, out)
  if r == (0 - 1) { pass = pass + 1; o_p("OVO-T4 non-p6-refused GREEN\n" as *u8) }
  else { o_p("OVO-T4 RED rc=" as *u8); o_fn(1, r); o_p("\n" as *u8) }
  pp[1] = sv as u8
327
  // T5 the foreign-side stat vector must be REAL, not a constant wearing the shape of a
  // measurement: the fixture is a gradient, so transitions must exceed zero.
  teeth = teeth + 1
  r = fb_compare(pp, plen, bm, blen, out)
  ok = 0
  if r == 0 { if out[O_TRANS] > 0 { if out[O_ZEROS] == 0 { ok = 1 } } }
  if ok == 1 { pass = pass + 1; o_p("OVO-T5 stat-vector-non-constant GREEN\n" as *u8) }
  else { o_p("OVO-T5 RED trans=" as *u8); o_fn(1, out[O_TRANS]); o_p("\n" as *u8) }
336
  o_p("OVO-SELFTEST " as *u8); o_fn(1, pass); o_p("/" as *u8); o_fn(1, teeth); o_p("\n" as *u8)
  let lf: i64 = sys_openat_append("knowledge/status/nishi_os.log" as *u8, 0x1a4)
  if lf >= 0 {
      o_fp(lf, "NOSOVMF selftest teeth=" as *u8); o_fn(lf, pass)
      o_fp(lf, "of" as *u8); o_fn(lf, teeth)
      o_fp(lf, " verdict=" as *u8)
      if pass == teeth { o_fp(lf, "GREEN\n" as *u8) } else { o_fp(lf, "RED\n" as *u8) }
      sys_close(lf)
  }
  if pass == teeth { sys_exit(0); return 0 }
  sys_exit(1); return 1
348}
349
350func main(argc: i64, argv: *i64) -> i64 {
  if argc >= 2 { if o_eq(argv[1] as *u8, "selftest" as *u8) == 1 { return ovo_selftest() } }
  if argc < 3 {
      o_p("usage: nx_uefi_ovmf_oracle <ovmf.ppm> <sov.bmp> | nx_uefi_ovmf_oracle selftest\n" as *u8)
      sys_exit(3); return 3
  }
  let ppath: *u8 = argv[1] as *u8
  let bpath: *u8 = argv[2] as *u8
358
  let pl: *i64 = sys_mmap(16) as *i64
  let pp: *u8 = sys_read_file(ppath, pl)
  if pl[0] <= 0 {
      o_p("NOS-OVMF UNPROVEN: cannot read " as *u8); o_p(ppath); o_p("\n" as *u8)
      sys_exit(3); return 3
  }
  let bl: *i64 = sys_mmap(16) as *i64
  let bm: *u8 = sys_read_file(bpath, bl)
  if bl[0] <= 0 {
      o_p("NOS-OVMF UNPROVEN: cannot read " as *u8); o_p(bpath); o_p("\n" as *u8)
      sys_exit(3); return 3
  }
371
  let out: *i64 = sys_mmap(8 * 16) as *i64
  let r: i64 = fb_compare(pp, pl[0], bm, bl[0], out)
  if r < 0 {
      o_p("NOS-OVMF RED: refused, code " as *u8); o_fn(1, r); o_p("\n" as *u8)
      let lf2: i64 = sys_openat_append("knowledge/status/nishi_os.log" as *u8, 0x1a4)
      if lf2 >= 0 {
          o_fp(lf2, "NOSOVMF ovmf=" as *u8); o_fp(lf2, ppath)
          o_fp(lf2, " sov=" as *u8); o_fp(lf2, bpath)
          o_fp(lf2, " refused_code=" as *u8); o_fn(lf2, r)
          o_fp(lf2, " verdict=RED\n" as *u8)
          sys_close(lf2)
      }
      sys_exit(1); return 1
  }
386
  var permil: i64 = 0
  if out[O_TOTAL] > 0 { permil = (out[O_EQUAL] * 1000) / out[O_TOTAL] }
  var green: i64 = 0
  if out[O_DIFF] == 0 { green = 1 }
391
  o_p("NOS-OVMF " as *u8); o_fn(1, out[O_W]); o_p("x" as *u8); o_fn(1, out[O_H])
  o_p(" px_total=" as *u8); o_fn(1, out[O_TOTAL])
  o_p(" px_equal=" as *u8); o_fn(1, out[O_EQUAL])
  o_p(" px_diff=" as *u8); o_fn(1, out[O_DIFF])
  o_p(" agree_permil=" as *u8); o_fn(1, permil)
  o_p(" first_diff_x=" as *u8); o_fn(1, out[O_FDX])
  o_p(" first_diff_y=" as *u8); o_fn(1, out[O_FDY])
  o_p(" ovmf_color=0x" as *u8); o_fx(1, out[O_COLOR])
  o_p(" ovmf_match=" as *u8); o_fn(1, out[O_MATCH])
  o_p(" ovmf_zeros=" as *u8); o_fn(1, out[O_ZEROS])
  o_p(" ovmf_trans=" as *u8); o_fn(1, out[O_TRANS])
  o_p("\n" as *u8)
404
  let lf: i64 = sys_openat_append("knowledge/status/nishi_os.log" as *u8, 0x1a4)
  if lf >= 0 {
      o_fp(lf, "NOSOVMF ovmf=" as *u8); o_fp(lf, ppath)
      o_fp(lf, " sov=" as *u8); o_fp(lf, bpath)
      o_fp(lf, " w=" as *u8); o_fn(lf, out[O_W])
      o_fp(lf, " h=" as *u8); o_fn(lf, out[O_H])
      o_fp(lf, " px_total=" as *u8); o_fn(lf, out[O_TOTAL])
      o_fp(lf, " px_equal=" as *u8); o_fn(lf, out[O_EQUAL])
      o_fp(lf, " px_diff=" as *u8); o_fn(lf, out[O_DIFF])
      o_fp(lf, " agree_permil=" as *u8); o_fn(lf, permil)
      o_fp(lf, " ovmf_color=0x" as *u8); o_fx(lf, out[O_COLOR])
      o_fp(lf, " ovmf_zeros=" as *u8); o_fn(lf, out[O_ZEROS])
      o_fp(lf, " ovmf_trans=" as *u8); o_fn(lf, out[O_TRANS])
      o_fp(lf, " engines=edk2-ovmf-vs-nx_emu_uefi verdict=" as *u8)
      if green == 1 { o_fp(lf, "GREEN\n" as *u8) } else { o_fp(lf, "RED\n" as *u8) }
      sys_close(lf)
  }
  if green == 1 {
      o_p("NOS-OVMF GREEN: the sovereign emulator reproduces real EDK2 firmware PIXEL FOR PIXEL\n" as *u8)
      sys_exit(0); return 0
  }
  o_p("NOS-OVMF RED: sovereign and real firmware DISAGREE on the framebuffer\n" as *u8)
  sys_exit(1); return 1
428}
nx_uefi_ovmf_oracle.nx source

`nx_uefi_ovmf_oracle.nx` source
