_gpu_dxg_alloc_gate.nx source

1// _gpu_dxg_alloc_gate.nx -- SOVEREIGN-GPU ladder R4d (allocate REAL GPU memory on the 5080, UMD-less). 2// 3// R4c built the paging queue. R4d allocates actual memory through LX_DXCREATEALLOCATION via the UMD-less 4// STANDARD-ALLOCATION / EXISTINGHEAP path -- no vendor (NVIDIA) UMD blob needed. The recipe was reverse- 5// engineered: fault-probes pinned device@0/alloc_count@44/allocation_info@48; the WSL2-Linux-Kernel header 6// (WebFetch, verified vs runtime) gave the field layout; and dxgkio_create_allocation's open-source 7// validation gave the exact requirements: 8// flags@56 = standard_allocation(bit16,0x10000) | existing_sysmem(bit5,0x20) = 0x10020 9// priv_drv_data_size@40 = 0 ; alloc_count@44 = 1 10// standard_allocation@32 -> d3dkmt_createstandardallocation{ type@0=EXISTINGHEAP(1); existing_heap.size@8 (!=0, page-aligned) } 11// allocation_info@48 -> d3dddi_allocationinfo2{ sysmem@8 (!=NULL, page-aligned); allocation@0 (OUT handle); gpu_virtual_address@40 (OUT) } 12// 13// GREEN iff (author=organ, from REAL device returns): 14// A) device-create chain ok; 15// B) CREATEALLOCATION #1 ret==0 AND allocation handle != 0 (written into pre-zeroed entry@0); 16// C) CREATEALLOCATION #2 (distinct sysmem) ret==0 AND handle != 0 AND != #1 (per-call REAL allocation, not a constant); 17// D) TAMPER matrix, each from a real validation rule, all != the real ret==0: 18// T1 flags w/o existing_sysmem (0x10000) -> STATUS_INVALID_PARAMETER; T2 priv_drv_data_size=16 -> -EINVAL; 19// T3 existing_heap.size unaligned (65535) -> -EINVAL; T4 on a non-dxg fd -> -ENOTTY. 20// fd close frees the allocations (per-fd dxgkrnl cleanup). Marker -> knowledge/status/gpu_dxg.log (DXGALLOCGATE). 21// raw syscalls only. NO-WAVE: allocates memory (a real GPU object); gpu_va mapping=R4e, compute/throughput=R7. ZERO throughput. 22// license_tier: ORIGINAL 23import "nx_syscalls.nx" 24 25const ENUM2_CODE: i64 = 0xC0104714 26const QAI_CODE: i64 = 0xC0184709 27const OAFL_CODE: i64 = 0xC00C4701 28const CDEV_CODE: i64 = 0xC0404702 29const CALLOC_CODE: i64 = 0xC0484706 30 31func p(s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(1,s,nn); return 0 } 32func fp(fd: i64, s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(fd,s,nn); return 0 } 33func n(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 34func x(v: i64) -> i64 { p("0x" as *u8); let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } var i:i64=0; let o:*u8=sys_mmap(20); while i<k{o[i]=bb[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 35func fx(fd: i64, v: i64) -> i64 { let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } let o:*u8=sys_mmap(20); var i:i64=0; while i<k{o[i]=bb[k-1-i];i=i+1} fp(fd,"0x" as *u8); sys_write(fd,o,k); return 0 } 36func rd32(buf: *u8, off: i64) -> i64 { return (buf[off] as i64)|((buf[off+1] as i64)<<8)|((buf[off+2] as i64)<<16)|((buf[off+3] as i64)<<24) } 37func rd64(buf: *u8, off: i64) -> i64 { let q: *i64 = (buf as i64 + off) as *i64; return q[0] } 38func setu32(buf: *u8, off: i64, val: i64) -> i64 { let w: *u8 = (buf as i64 + off) as *u8; w[0]=(val&0xff) as u8; w[1]=((val>>8)&0xff) as u8; w[2]=((val>>16)&0xff) as u8; w[3]=((val>>24)&0xff) as u8; return 0 } 39func setu64(buf: *u8, off: i64, val: i64) -> i64 { let q: *i64 = (buf as i64 + off) as *i64; q[0]=val; return 0 } 40 41func query_type(fd: i64, handle: i64, qtype: i64, psize: i64, outv: *i64) -> i64 { 42 let priv: *u8 = sys_mmap(64); var zz: i64 = 0; while zz < 64 { priv[zz] = 0 as u8; zz = zz + 1 } 43 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 44 let h: *i64 = (req as i64 + 0) as *i64; h[0] = (handle & 0xffffffff) | ((qtype & 0xffffffff) << 32) 45 let pd: *i64 = (req as i64 + 8) as *i64; pd[0] = priv as i64 46 let pds: *i64 = (req as i64 + 16) as *i64; pds[0] = psize & 0xffffffff 47 let ret: i64 = sys_ioctl(fd, QAI_CODE, req as i64); outv[0] = rd32(priv, 0); return ret 48} 49func open_from_luid(fd: i64, luid_lo: i64, luid_hi: i64, outh: *i64) -> i64 { 50 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 51 let lo: *i64 = (req as i64 + 0) as *i64; lo[0] = (luid_lo & 0xffffffff) | ((luid_hi & 0xffffffff) << 32) 52 let ret: i64 = sys_ioctl(fd, OAFL_CODE, req as i64); outh[0] = rd32(req, 8); return ret 53} 54func create_device(fd: i64, adapter: i64, outd: *i64) -> i64 { 55 let buf: *u8 = sys_mmap(512); var bz: i64 = 0; while bz < 512 { buf[bz] = 0 as u8; bz = bz + 1 } 56 setu32(buf, 0, adapter & 0xffffffff) 57 let ret: i64 = sys_ioctl(fd, CDEV_CODE, buf as i64); outd[0] = rd32(buf, 12); return ret 58} 59// allocate via EXISTINGHEAP. params expose the tamper knobs (flags, priv_size, heapsize). OUT handle->outh[0], gpu_va->outva[0]. 60func alloc_eh(fd: i64, device: i64, sysmem: *u8, heapsize: i64, flags: i64, priv_size: i64, outh: *i64, outva: *i64) -> i64 { 61 let desc: *u8 = sys_mmap(64); var dz: i64 = 0; while dz < 64 { desc[dz] = 0 as u8; dz = dz + 1 } 62 setu32(desc, 0, 1); setu64(desc, 8, heapsize) 63 let entry: *u8 = sys_mmap(256); var ez: i64 = 0; while ez < 256 { entry[ez] = 0 as u8; ez = ez + 1 } 64 setu64(entry, 8, sysmem as i64) 65 let buf: *u8 = sys_mmap(512); var bz: i64 = 0; while bz < 512 { buf[bz] = 0 as u8; bz = bz + 1 } 66 setu32(buf, 0, device & 0xffffffff) 67 setu64(buf, 32, desc as i64); setu32(buf, 40, priv_size) 68 setu32(buf, 44, 1); setu64(buf, 48, entry as i64) 69 setu32(buf, 56, flags) 70 let ret: i64 = sys_ioctl(fd, CALLOC_CODE, buf as i64) 71 outh[0] = rd32(entry, 0); outva[0] = rd64(entry, 40); return ret 72} 73 74func main() -> i64 { 75 p("=== SOVEREIGN-GPU R4d gate (raw /dev/dxg LX_DXCREATEALLOCATION -> a REAL UMD-less GPU allocation on the 5080) ===\n" as *u8) 76 let fd: i64 = sys_openat_rd("/dev/dxg" as *u8) 77 if fd < 0 { p("open(/dev/dxg) failed\n" as *u8); sys_exit(1); return 1 } 78 let ainfo: *u8 = sys_mmap(4096); var z: i64 = 0; while z < 4096 { ainfo[z] = 0 as u8; z = z + 1 } 79 let ereq: *u8 = sys_mmap(64); ereq[0] = 8 as u8; let r8: *i64 = (ereq as i64 + 8) as *i64; r8[0] = ainfo as i64 80 let eret: i64 = sys_ioctl(fd, ENUM2_CODE, ereq as i64); let nc: i64 = rd32(ereq, 0) 81 let v: *i64 = sys_mmap(16); var n_discrete: i64 = 0; var disc_lo: i64 = 0; var disc_hi: i64 = 0 82 var ai: i64 = 0 83 while ai < nc { 84 let base: i64 = ai * 20; let eh: i64 = rd32(ainfo, base) 85 let qret: i64 = query_type(fd, eh, 15, 4, v); let t: i64 = v[0] 86 if qret == 0 { if ((t>>4)&1) == 1 { if ((t>>2)&1) == 0 { n_discrete = n_discrete + 1; disc_lo = rd32(ainfo, base+4); disc_hi = rd32(ainfo, base+8) } } } 87 ai = ai + 1 88 } 89 let ah: *i64 = sys_mmap(16); let aor: i64 = open_from_luid(fd, disc_lo, disc_hi, ah) 90 let dh: *i64 = sys_mmap(16); let dr: i64 = create_device(fd, ah[0], dh); let device: i64 = dh[0] 91 p(" chain: enum ret=" as *u8); n(eret); p(" discrete_count=" as *u8); n(n_discrete); p(" device=" as *u8); x(device); p("\n" as *u8) 92 93 // two distinct 64KB page-aligned existing-heap regions. 94 let sm1: *u8 = sys_mmap(65536); var s1: i64 = 0; while s1 < 65536 { sm1[s1] = 0 as u8; s1 = s1 + 1 } 95 let sm2: *u8 = sys_mmap(65536); var s2: i64 = 0; while s2 < 65536 { sm2[s2] = 0 as u8; s2 = s2 + 1 } 96 let h1: *i64 = sys_mmap(16); let va1: *i64 = sys_mmap(16) 97 let h2: *i64 = sys_mmap(16); let va2: *i64 = sys_mmap(16) 98 let r1: i64 = alloc_eh(fd, device, sm1, 65536, 0x10020, 0, h1, va1) 99 let r2: i64 = alloc_eh(fd, device, sm2, 65536, 0x10020, 0, h2, va2) 100 p(" ALLOC #1 ret=" as *u8); n(r1); p(" handle=" as *u8); x(h1[0]); p(" gpu_va=" as *u8); x(va1[0]); p("\n" as *u8) 101 p(" ALLOC #2 ret=" as *u8); n(r2); p(" handle=" as *u8); x(h2[0]); p(" gpu_va=" as *u8); x(va2[0]); p("\n" as *u8) 102 103 // ---- TAMPER matrix (each from a real validation rule) ---- 104 let th: *i64 = sys_mmap(16); let tv: *i64 = sys_mmap(16) 105 let t1: i64 = alloc_eh(fd, device, sm1, 65536, 0x10000, 0, th, tv) // missing existing_sysmem 106 let t2: i64 = alloc_eh(fd, device, sm1, 65536, 0x10020, 16, th, tv) // priv_drv_data_size != 0 107 let t3: i64 = alloc_eh(fd, device, sm1, 65535, 0x10020, 0, th, tv) // unaligned heap size 108 let nfd: i64 = sys_openat_rd("/dev/null" as *u8) 109 let t4: i64 = alloc_eh(nfd, device, sm1, 65536, 0x10020, 0, th, tv) // non-dxg fd 110 if nfd >= 0 { sys_close(nfd) } 111 p(" [tamper] no-existing_sysmem ret=" as *u8); n(t1); p(" | priv_size!=0 ret=" as *u8); n(t2) 112 p(" | unaligned-size ret=" as *u8); n(t3); p(" | non-dxg ret=" as *u8); n(t4); p("\n" as *u8) 113 sys_close(fd) 114 115 var made1: i64 = 0; if r1 == 0 { if h1[0] != 0 { made1 = 1 } } 116 var distinct: i64 = 0; if h1[0] != 0 { if h2[0] != 0 { if h1[0] != h2[0] { distinct = 1 } } } 117 var tamper_ok: i64 = 0; if t1 != 0 { if t2 != 0 { if t3 != 0 { if t4 != 0 { tamper_ok = 1 } } } } 118 119 var pass: i64 = 0 120 if eret == 0 { if n_discrete == 1 { if aor == 0 { if dr == 0 { 121 if made1 == 1 { if r2 == 0 { if distinct == 1 { if tamper_ok == 1 { pass = 1 } } } } } } } } 122 123 p(" checks: chain_ok=" as *u8); var ch: i64=0; if eret==0 { if aor==0 { if dr==0 { ch=1 } } } n(ch) 124 p(" alloc1_ok=" as *u8); n(made1); p(" alloc2_ok=" as *u8); n(r2==0); p(" distinct_allocations=" as *u8); n(distinct); p(" tamper_ok=" as *u8); n(tamper_ok); p("\n" as *u8) 125 126 let lfd: i64 = sys_openat_append("knowledge/status/gpu_dxg.log" as *u8, 0x1a4) 127 if pass == 1 { 128 p("DXGALLOCGATE verdict=GREEN reason=raw-/dev/dxg-LX_DXCREATEALLOCATION-makes-a-REAL-UMD-less-EXISTINGHEAP-allocation-on-the-5080 (standard_allocation|existing_sysmem flags, priv_drv_data_size=0, 64KB page-aligned; two allocs -> two DISTINCT non-zero handles; tampers from real validation rules [no-existing_sysmem=INVALID_PARAMETER, priv_size!=0=EINVAL, unaligned-size=EINVAL, non-dxg=ENOTTY]; wrapper-free, NO vendor UMD blob) SCOPE=memory-allocation-only-NO-throughput; gpu-va-map=R4e\n" as *u8) 129 if lfd >= 0 { 130 fp(lfd, "DXGALLOCGATE verdict=GREEN rung=R4d-gpu-allocation device=discrete-RTX5080 via=raw-/dev/dxg-LX_DXCREATEALLOCATION(0xC0484706)-EXISTINGHEAP-standard-alloc(flags=0x10020,priv_drv_data_size=0,size=65536) device_handle=" as *u8); fx(lfd, device) 131 fp(lfd, " alloc1=" as *u8); fx(lfd, h1[0]); fp(lfd, " alloc2=" as *u8); fx(lfd, h2[0]) 132 fp(lfd, " distinct=1 UMD-less=1 tamper=rejected(no-existing_sysmem-INVALID_PARAMETER+priv_size!=0-EINVAL+unaligned-size-EINVAL+non-dxg-ENOTTY) wrapper-free scope=memory-allocation-only-NO-throughput next=R4e-LX_DXMAPGPUVIRTUALADDRESS\n" as *u8) 133 sys_close(lfd) 134 } 135 sys_exit(0); return 0 136 } 137 p("DXGALLOCGATE verdict=RED (one of chain/alloc1/alloc2/distinct/tamper not satisfied)\n" as *u8) 138 if lfd >= 0 { fp(lfd, "DXGALLOCGATE verdict=RED see-console\n" as *u8); sys_close(lfd) } 139 sys_exit(1) 140 return 1 141}