_gpu_bm_gmmu_gate.nx source

1// _gpu_bm_gmmu_gate.nx -- BARE-METAL SOVEREIGN-GPU rung BM-GPU-MMU: the NVIDIA GMMU (GPU page tables) VA->PA 2// translation -- FULLY FAITHFUL (no stand-in: pure deterministic address translation). 3// 4// Hardens the implicit "GPU VA = direct offset" simplification in every model rung with a real GMMU. Sovereign 5// driver builds GP100+ (Pascal..Blackwell) page tables; a faithful 5-level radix walker translates VA->PA. 6// PTE format (from nouveau gp100_vmm_pgt_pte): VALID@0, APERTURE@2:1 (VRAM=1), VOL@3, PRIV@5, RO@6; physical addr = 7// (PA>>4) merged into the upper bits (4KB-aligned PA -> low 8 bits free for the flags). Decode PA=(PTE&~0xFF)<<4. 8// 5-level radix for 49-bit VAs: index bits per level {2,9,9,8,9}, 12-bit page offset. PDE = (next_table>>4)|valid|aperture. 9// NISHI-ECOSYSTEM-ONLY: our model+driver; GMMU format = last-mile hardware spec (VERIFIED vs nouveau). This rung is 10// FAITHFUL end-to-end (real format + real bit-splits + real walk); it transfers to real silicon at BM-GPU-6. 11// 12// GREEN iff: map VA1->PA1, VA2->PA2 then translate -> exact PA+page-offset; an UNMAPPED VA FAULTS; a corrupted 13// (valid-cleared) PTE FAULTS; a read-only mapping decodes its RO bit. 14// Marker -> knowledge/status/gpu_baremetal.log (BMMMUGATE). license_tier: ORIGINAL 15import "nx_syscalls.nx" 16 17func p(s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(1,s,nn); return 0 } 18func fp(fd: i64, s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(fd,s,nn); return 0 } 19func n(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 20func x(v: i64) -> i64 { p("0x" as *u8); let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } var i:i64=0; let o:*u8=sys_mmap(20); while i<k{o[i]=bb[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 21func fx(fd: i64, v: i64) -> i64 { let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } let o:*u8=sys_mmap(20); var i:i64=0; while i<k{o[i]=bb[k-1-i];i=i+1} fp(fd,"0x" as *u8); sys_write(fd,o,k); return 0 } 22func rd64(b: *u8, o: i64) -> i64 { let q: *i64 = (b as i64 + o) as *i64; return q[0] } 23func wr64(b: *u8, o: i64, v: i64) -> i64 { let q: *i64 = (b as i64 + o) as *i64; q[0] = v; return 0 } 24 25const APERTURE_VRAM: i64 = 2 // (1 << 1): aperture field = VRAM 26const PTE_VALID: i64 = 1 27const PTE_RO: i64 = 0x40 // bit 6 28 29// page-table page allocator (bump). st[0] = next free offset in gmem. 30func pt_alloc(gmem: *u8, st: *i64) -> i64 { 31 let off: i64 = st[0]; st[0] = st[0] + 0x1000 32 var z: i64 = 0; while z < 0x1000 { gmem[off+z] = 0 as u8; z = z + 1 } // zero the new table 33 return off 34} 35// level index bits (top->bottom): {2,9,9,8,9}; shifts {47,38,29,21,12} 36func lvl_shift(l: i64) -> i64 { if l==0 { return 47 } if l==1 { return 38 } if l==2 { return 29 } if l==3 { return 21 } return 12 } 37func lvl_bits(l: i64) -> i64 { if l==0 { return 2 } if l==1 { return 9 } if l==2 { return 9 } if l==3 { return 8 } return 9 } 38 39// map VA->PA (ro=1 for read-only). builds the path tables; sets the leaf PTE. 40func pt_map(gmem: *u8, st: *i64, root: i64, va: i64, pa: i64, ro: i64) -> i64 { 41 var table: i64 = root; var l: i64 = 0 42 while l < 4 { 43 let idx: i64 = (va >> lvl_shift(l)) & ((1 << lvl_bits(l)) - 1) 44 let entry: i64 = rd64(gmem, table + idx*8) 45 if (entry & 1) == 0 { 46 let nt: i64 = pt_alloc(gmem, st) 47 wr64(gmem, table + idx*8, ((nt >> 4)) | PTE_VALID | APERTURE_VRAM) // PDE: next-table + valid + VRAM 48 table = nt 49 } else { table = (entry & (0 - 256)) << 4 } // decode next-table PA (clear low 8 flag bits) 50 l = l + 1 51 } 52 let lidx: i64 = (va >> 12) & 0x1ff 53 var pte: i64 = ((pa >> 4)) | PTE_VALID | APERTURE_VRAM 54 if ro == 1 { pte = pte | PTE_RO } 55 wr64(gmem, table + lidx*8, pte) 56 return table + lidx*8 // return the PTE address (for tamper) 57} 58// translate VA. out[0]=PA(+offset), out[1]=valid(1)/fault(0), out[2]=ro 59func pt_translate(gmem: *u8, root: i64, va: i64, out: *i64) -> i64 { 60 var table: i64 = root; var l: i64 = 0 61 while l < 4 { 62 let idx: i64 = (va >> lvl_shift(l)) & ((1 << lvl_bits(l)) - 1) 63 let entry: i64 = rd64(gmem, table + idx*8) 64 if (entry & 1) == 0 { out[1] = 0; return 0 } 65 table = (entry & (0 - 256)) << 4 66 l = l + 1 67 } 68 let lidx: i64 = (va >> 12) & 0x1ff 69 let pte: i64 = rd64(gmem, table + lidx*8) 70 if (pte & 1) == 0 { out[1] = 0; return 0 } 71 out[1] = 1; out[0] = ((pte & (0 - 256)) << 4) | (va & 0xfff); out[2] = (pte >> 6) & 1 72 return 0 73} 74 75func main() -> i64 { 76 p("=== BARE-METAL SOVEREIGN-GPU BM-GPU-MMU: faithful GMMU VA->PA translation (5-level page tables) ===\n" as *u8) 77 let gmem: *u8 = sys_mmap(8388608) 78 let st: *i64 = sys_mmap(16); st[0] = 0x100000 // page tables bump-allocated from 1MiB 79 let root: i64 = pt_alloc(gmem, st) 80 81 let VA1: i64 = 0x12345678; let PA1: i64 = 0xABCD000 82 let VA2: i64 = 0x12346000; let PA2: i64 = 0x7FF000 // shares the prefix with VA1 (same upper levels) 83 let VA3: i64 = 0x99999000 // never mapped -> must FAULT 84 let VA4: i64 = 0x55500000; let PA4: i64 = 0x222000 // mapped READ-ONLY 85 pt_map(gmem, st, root, VA1, PA1, 0) 86 pt_map(gmem, st, root, VA2, PA2, 0) 87 let pte4_addr: i64 = pt_map(gmem, st, root, VA4, PA4, 1) 88 89 let o1: *i64 = sys_mmap(64); pt_translate(gmem, root, VA1, o1) 90 let o2: *i64 = sys_mmap(64); pt_translate(gmem, root, VA2, o2) 91 let o3: *i64 = sys_mmap(64); pt_translate(gmem, root, VA3, o3) 92 let o4: *i64 = sys_mmap(64); pt_translate(gmem, root, VA4, o4) 93 p(" VA1 " as *u8); x(VA1); p(" -> PA " as *u8); x(o1[0]); p(" (expect " as *u8); x(PA1 | 0x678); p(") valid=" as *u8); n(o1[1]); p("\n" as *u8) 94 p(" VA2 " as *u8); x(VA2); p(" -> PA " as *u8); x(o2[0]); p(" (expect " as *u8); x(PA2); p(") valid=" as *u8); n(o2[1]); p("\n" as *u8) 95 p(" VA4 " as *u8); x(VA4); p(" -> PA " as *u8); x(o4[0]); p(" valid=" as *u8); n(o4[1]); p(" RO=" as *u8); n(o4[2]); p("\n" as *u8) 96 p(" VA3 (unmapped) " as *u8); x(VA3); p(" -> valid=" as *u8); n(o3[1]); p(" (must be 0=FAULT)\n" as *u8) 97 98 // tamper: clear the VALID bit of VA4's PTE -> VA4 must now FAULT 99 let pte4: i64 = rd64(gmem, pte4_addr); wr64(gmem, pte4_addr, pte4 & (0 - 2)) 100 let o5: *i64 = sys_mmap(64); pt_translate(gmem, root, VA4, o5) 101 p(" [tamper] VA4 after PTE-valid-cleared -> valid=" as *u8); n(o5[1]); p(" (must be 0=FAULT)\n" as *u8) 102 103 var pass: i64 = 0 104 if o1[1] == 1 { if o1[0] == (PA1 | 0x678) { if o2[1] == 1 { if o2[0] == PA2 { 105 if o4[1] == 1 { if o4[2] == 1 { if o3[1] == 0 { if o5[1] == 0 { pass = 1 } } } } } } } } 106 p(" checks: VA1_translates=" as *u8); var c1: i64=0; if o1[1]==1 { if o1[0]==(PA1|0x678) { c1=1 } } n(c1) 107 p(" VA2_translates=" as *u8); var c2: i64=0; if o2[1]==1 { if o2[0]==PA2 { c2=1 } } n(c2); p(" RO_decoded=" as *u8); n(o4[2]); p(" unmapped_faults=" as *u8); n(o3[1]==0); p(" cleared-PTE_faults=" as *u8); n(o5[1]==0); p("\n" as *u8) 108 109 let lfd: i64 = sys_openat_append("knowledge/status/gpu_baremetal.log" as *u8, 0x1a4) 110 if pass == 1 { 111 p("BMMMUGATE verdict=GREEN reason=FAITHFUL-GMMU-VA->PA (real GP100+ PTE format VALID@0/APERTURE@2:1/RO@6/PA=(PTE&~0xFF)<<4; real 5-level radix walk idx-bits{2,9,9,8,9}; map VA1/VA2->correct PA+offset, RO bit decoded, UNMAPPED VA faults, valid-cleared PTE faults) SCOPE=FULLY-FAITHFUL-no-stand-in[pure-deterministic-translation]; transfers to real silicon at BM-GPU-6\n" as *u8) 112 if lfd >= 0 { 113 fp(lfd, "BMMMUGATE verdict=GREEN rung=BM-GPU-MMU device=sovereign-GMMU-page-tables(GP100..Blackwell) VA1=" as *u8); fx(lfd, VA1); fp(lfd, "->PA=" as *u8); fx(lfd, o1[0]) 114 fp(lfd, " VA2->" as *u8); fx(lfd, o2[0]); fp(lfd, " RO_decoded=1 unmapped+cleared-PTE=FAULT 5-level{2,9,9,8,9} PTE=valid@0/aperture@2:1/RO@6/PA=(PTE&~0xFF)<<4 scope=FULLY-FAITHFUL-no-stand-in next=harden(NVC6C0-QMD) / BM-GPU-6-real-silicon\n" as *u8) 115 sys_close(lfd) 116 } 117 sys_exit(0); return 0 118 } 119 p("BMMMUGATE verdict=RED (translation/fault/RO not satisfied)\n" as *u8) 120 if lfd >= 0 { fp(lfd, "BMMMUGATE verdict=RED see-console\n" as *u8); sys_close(lfd) } 121 sys_exit(1) 122 return 1 123}