`_dxg_probe.nx` source

1// _dxg_probe.nx -- SOVEREIGN-GPU foundation RECON probe (no libvulkan/libcuda/libdxcore,
2// no libc): raw openat("/dev/dxg") + raw ioctl on the real dxgkrnl thunk for the RTX 5080.
3//
4// This is a SCOPE/RECON probe, NOT the gate. It proves three things from a REAL run:
5//   (A) /dev/dxg opens with a raw openat() -> prints the fd (>=0 = real device handle).
6//   (B) a TAMPER ioctl with a non-dxg magic returns a real device errno (NOT 0) -> the
7//       fd is the real device, not a no-op; a bogus code does NOT falsely succeed.
8//   (C) a magic-0x47 LX_DX* ioctl returns the kernel's REAL response code (0 or -errno),
9//       distinguishable from the tamper -> the 0x47 ioctl path reaches dxgkrnl.
10//
11// The dxgkrnl uapi (WSL2-Linux-Kernel drivers/hv/dxgkrnl, include/uapi/misc/d3dkmthk-style):
12//   ioctl numbers are _IOWR(0x47, nr, struct ...) -> 32-bit code =
13//     dir(2 bits, _IOWR=3=0xC0000000) | size(14 bits, <<16) | magic(8 bits 0x47, <<8) | nr(8 bits).
14//   LX_DXENUMADAPTERS3 nr is in the LX_DX* enum; this probe issues a representative 0x47 code and a
15//   stub arg to read the kernel's response (a real call needs the exact struct -- see the gate plan).
16// license_tier: ORIGINAL
17import "nx_syscalls.nx"
18
19func dp_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
20func dp_n(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
21
22func main() -> i64 {
23    // (A) raw open of the real GPU device. NO libc -- openat(2) directly.
24    let fd: i64 = sys_openat_rd("/dev/dxg" as *u8)
25    dp_p("DXGPROBE open(/dev/dxg) fd=" as *u8); dp_n(fd); dp_p("\n" as *u8)
26    if fd < 0 {
27        dp_p("DXGPROBE verdict=RED reason=open-failed\n" as *u8)
28        sys_exit(1); return 1
29    }
30
31    // a scratch arg buffer for ioctl (zeroed); real structs come in the gate.
32    let arg: *u8 = sys_mmap(4096)
33    var z: i64 = 0
34    while z < 4096 { arg[z] = 0 as u8; z = z + 1 }
35
36    // (B) TAMPER: an ioctl with a NON-dxg magic (0x99) -- the real device must reject it
37    // with a real errno (typically -ENOTTY=-25 or -EINVAL=-22), NOT silently return 0.
38    let tamper_code: i64 = 0x99000000
39    let rt: i64 = sys_ioctl(fd, tamper_code, arg as i64)
40    dp_p("DXGPROBE tamper-ioctl(magic=0x99) ret=" as *u8); dp_n(rt); dp_p("\n" as *u8)
41
42    // (C) a magic-0x47 LX_DX* ioctl. _IOWR(0x47, 0, ...) style code. The kernel returns
43    // its real response for this code path (0, -EINVAL/-EFAULT for the stub arg, etc.) --
44    // any value that DIFFERS from the tamper proves the 0x47 path reaches dxgkrnl.
45    let dxg_code: i64 = 0xC0004700
46    let rd: i64 = sys_ioctl(fd, dxg_code, arg as i64)
47    dp_p("DXGPROBE dxg-ioctl(magic=0x47) ret=" as *u8); dp_n(rd); dp_p("\n" as *u8)
48
49    sys_close(fd)
50    dp_p("DXGPROBE verdict=OPEN-CONFIRMED (fd>=0; ioctl syscall issued to real /dev/dxg)\n" as *u8)
51    return 0
52}
_dxg_probe.nx source

`_dxg_probe.nx` source
