_gpu_dxg_context_gate.nx source

1// _gpu_dxg_context_gate.nx -- SOVEREIGN-GPU ladder R4a (create a GPU CONTEXT on the 5080 WDDM device). 2// 3// R3 made a real WDDM device. The command-submission arc (R4) begins with a CONTEXT -- the queue GPU 4// work is submitted on. The WSL2 paravirt path exposes LX_DXCREATECONTEXTVIRTUAL (nr=0x04), NOT plain 5// CREATECONTEXT (nr=0x03 -> -ENOTTY on this kernel, recon-confirmed). This rung opens the context only; 6// allocations (R4b) + command buffer/submit/fence (R4c) follow. 7// 8// ABI (recon-pinned LIVE, _gpu_dxg_r4_recon: no uapi header -> size-swept, only _IOC_SIZE=40 recognized; 9// OUT context handle located by write-back scan): 10// LX_DXCREATECONTEXTVIRTUAL = _IOWR(0x47, 0x04, 40) = 0xC0284704 11// struct d3dkmt_createcontextvirtual (40B): device @0 (in); node_ordinal @4; engine_affinity @8; 12// client_hint @12; priv_drv_data @16 (u64 ptr, NULL ok); priv_drv_data_size @24; **context @32 (OUT)**. 13// 14// GREEN iff (author=organ, from REAL device returns): 15// A) device-create chain ok (enum/discrete/open-adapter/create-device all ret==0); 16// B) CREATECONTEXTVIRTUAL #1 ret==0 AND context1 != 0 (written into a pre-zeroed slot @32); 17// C) CREATECONTEXTVIRTUAL #2 ret==0 AND context2 != 0 AND context2 != context1 (per-call allocation); 18// D) TAMPER: T1 bogus device(0xdeadbeef) -> ret!=0 AND no context written; T2 wrong _IOC_SIZE(32) -> -ENOTTY; 19// T3 on a non-dxg fd -> -ENOTTY. 20// (Context handles share the per-process namespace with devices -> we never test cross-namespace numeric 21// inequality; only write-back + per-call distinctness + tamper.) fd close releases all handles. 22// Marker -> knowledge/status/gpu_dxg.log (DXGCTXGATE). raw syscalls only. NO-WAVE: context-create only, ZERO throughput. 23// license_tier: ORIGINAL 24import "nx_syscalls.nx" 25 26const ENUM2_CODE: i64 = 0xC0104714 27const QAI_CODE: i64 = 0xC0184709 28const OAFL_CODE: i64 = 0xC00C4701 29const CDEV_CODE: i64 = 0xC0404702 // LX_DXCREATEDEVICE (R3) 30const CCV_CODE: i64 = 0xC0284704 // LX_DXCREATECONTEXTVIRTUAL (_IOWR(0x47,0x04,40), recon-pinned) 31const CCV_BADSZ: i64 = 0xC0204704 // wrong _IOC_SIZE=32 -> -ENOTTY tamper 32const CTX_OFF: i64 = 32 // OUT context-handle offset within the 40B struct 33 34func p(s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(1,s,nn); return 0 } 35func fp(fd: i64, s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(fd,s,nn); return 0 } 36func n(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 37func x(v: i64) -> i64 { p("0x" as *u8); let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } var i:i64=0; let o:*u8=sys_mmap(20); while i<k{o[i]=bb[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 38func fx(fd: i64, v: i64) -> i64 { let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } let o:*u8=sys_mmap(20); var i:i64=0; while i<k{o[i]=bb[k-1-i];i=i+1} fp(fd,"0x" as *u8); sys_write(fd,o,k); return 0 } 39func rd32(buf: *u8, off: i64) -> i64 { return (buf[off] as i64)|((buf[off+1] as i64)<<8)|((buf[off+2] as i64)<<16)|((buf[off+3] as i64)<<24) } 40 41func query_type(fd: i64, handle: i64, qtype: i64, psize: i64, outv: *i64) -> i64 { 42 let priv: *u8 = sys_mmap(64); var zz: i64 = 0; while zz < 64 { priv[zz] = 0 as u8; zz = zz + 1 } 43 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 44 let h: *i64 = (req as i64 + 0) as *i64; h[0] = (handle & 0xffffffff) | ((qtype & 0xffffffff) << 32) 45 let pd: *i64 = (req as i64 + 8) as *i64; pd[0] = priv as i64 46 let pds: *i64 = (req as i64 + 16) as *i64; pds[0] = psize & 0xffffffff 47 let ret: i64 = sys_ioctl(fd, QAI_CODE, req as i64); outv[0] = rd32(priv, 0); return ret 48} 49func open_from_luid(fd: i64, luid_lo: i64, luid_hi: i64, outh: *i64) -> i64 { 50 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 51 let lo: *i64 = (req as i64 + 0) as *i64; lo[0] = (luid_lo & 0xffffffff) | ((luid_hi & 0xffffffff) << 32) 52 let ret: i64 = sys_ioctl(fd, OAFL_CODE, req as i64); outh[0] = rd32(req, 8); return ret 53} 54func create_device(fd: i64, adapter: i64, outd: *i64) -> i64 { 55 let buf: *u8 = sys_mmap(512); var bz: i64 = 0; while bz < 512 { buf[bz] = 0 as u8; bz = bz + 1 } 56 let a0: *i64 = (buf as i64) as *i64; a0[0] = adapter & 0xffffffff 57 let ret: i64 = sys_ioctl(fd, CDEV_CODE, buf as i64); outd[0] = rd32(buf, 12); return ret 58} 59// create a context-virtual on `device` via `code`; OUT context handle (offset 32) -> outc[0]. buffer pre-zeroed. 60func create_context(fd: i64, code: i64, device: i64, outc: *i64) -> i64 { 61 let buf: *u8 = sys_mmap(512); var bz: i64 = 0; while bz < 512 { buf[bz] = 0 as u8; bz = bz + 1 } 62 let d0: *i64 = (buf as i64) as *i64; d0[0] = device & 0xffffffff // device @0; node/engine/hint @4..16 = 0 63 // priv_drv_data @16 = NULL, priv_drv_data_size @24 = 0 (already zeroed); context @32 OUT = 0 -> write-back proof 64 let ret: i64 = sys_ioctl(fd, code, buf as i64); outc[0] = rd32(buf, CTX_OFF); return ret 65} 66 67func main() -> i64 { 68 p("=== SOVEREIGN-GPU R4a gate (raw /dev/dxg LX_DXCREATECONTEXTVIRTUAL -> a GPU context on the 5080 device) ===\n" as *u8) 69 let fd: i64 = sys_openat_rd("/dev/dxg" as *u8) 70 if fd < 0 { p("open(/dev/dxg) failed\n" as *u8); sys_exit(1); return 1 } 71 72 let ainfo: *u8 = sys_mmap(4096); var z: i64 = 0; while z < 4096 { ainfo[z] = 0 as u8; z = z + 1 } 73 let ereq: *u8 = sys_mmap(64); ereq[0] = 8 as u8; let r8: *i64 = (ereq as i64 + 8) as *i64; r8[0] = ainfo as i64 74 let eret: i64 = sys_ioctl(fd, ENUM2_CODE, ereq as i64); let nc: i64 = rd32(ereq, 0) 75 let v: *i64 = sys_mmap(16); var n_discrete: i64 = 0; var disc_lo: i64 = 0; var disc_hi: i64 = 0 76 var ai: i64 = 0 77 while ai < nc { 78 let base: i64 = ai * 20; let eh: i64 = rd32(ainfo, base) 79 let qret: i64 = query_type(fd, eh, 15, 4, v); let t: i64 = v[0] 80 if qret == 0 { if ((t>>4)&1) == 1 { if ((t>>2)&1) == 0 { n_discrete = n_discrete + 1; disc_lo = rd32(ainfo, base+4); disc_hi = rd32(ainfo, base+8) } } } 81 ai = ai + 1 82 } 83 let ah: *i64 = sys_mmap(16); let aor: i64 = open_from_luid(fd, disc_lo, disc_hi, ah); let adapter: i64 = ah[0] 84 let dh: *i64 = sys_mmap(16); let dr: i64 = create_device(fd, adapter, dh); let device: i64 = dh[0] 85 p(" chain: enum ret=" as *u8); n(eret); p(" discrete_count=" as *u8); n(n_discrete); p(" adapter=" as *u8); x(adapter) 86 p(" device_create ret=" as *u8); n(dr); p(" device=" as *u8); x(device); p("\n" as *u8) 87 88 // REAL: create a context twice on the device. 89 let c1: *i64 = sys_mmap(16); let c2: *i64 = sys_mmap(16) 90 let r1: i64 = create_context(fd, CCV_CODE, device, c1) 91 let r2: i64 = create_context(fd, CCV_CODE, device, c2) 92 p(" CREATECONTEXTVIRTUAL #1 ret=" as *u8); n(r1); p(" context=" as *u8); x(c1[0]); p("\n" as *u8) 93 p(" CREATECONTEXTVIRTUAL #2 ret=" as *u8); n(r2); p(" context=" as *u8); x(c2[0]); p("\n" as *u8) 94 95 // ---- TAMPER matrix ---- 96 let tc: *i64 = sys_mmap(16) 97 let t1: i64 = create_context(fd, CCV_CODE, 0xdeadbeef, tc); let t1c: i64 = tc[0] // bogus device 98 let t2: i64 = create_context(fd, CCV_BADSZ, device, tc); let t2c: i64 = tc[0] // wrong _IOC_SIZE 99 let nfd: i64 = sys_openat_rd("/dev/null" as *u8) 100 let t3: i64 = create_context(nfd, CCV_CODE, device, tc); let t3c: i64 = tc[0] // non-dxg fd 101 if nfd >= 0 { sys_close(nfd) } 102 p(" [tamper] bogus-device ret=" as *u8); n(t1); p(" ctx=" as *u8); x(t1c) 103 p(" | wrong-size ret=" as *u8); n(t2); p(" | non-dxg-fd ret=" as *u8); n(t3); p("\n" as *u8) 104 sys_close(fd) 105 106 var written: i64 = 0; if c1[0] != 0 { written = 1 } 107 var distinct: i64 = 0; if c1[0] != 0 { if c2[0] != 0 { if c1[0] != c2[0] { distinct = 1 } } } 108 var tamper_ok: i64 = 0 109 if t1 != 0 { if t1c == 0 { if t2 != 0 { if t3 != 0 { tamper_ok = 1 } } } } 110 111 var pass: i64 = 0 112 if eret == 0 { if n_discrete == 1 { if aor == 0 { if dr == 0 { 113 if r1 == 0 { if r2 == 0 { if written == 1 { if distinct == 1 { if tamper_ok == 1 { pass = 1 } } } } } } } } } 114 115 p(" checks: chain_ok=" as *u8); var ch: i64=0; if eret==0 { if aor==0 { if dr==0 { ch=1 } } } n(ch) 116 p(" ctx1_ok=" as *u8); n(r1==0); p(" ctx2_ok=" as *u8); n(r2==0); p(" written_back=" as *u8); n(written); p(" distinct_contexts=" as *u8); n(distinct); p(" tamper_ok=" as *u8); n(tamper_ok); p("\n" as *u8) 117 118 let lfd: i64 = sys_openat_append("knowledge/status/gpu_dxg.log" as *u8, 0x1a4) 119 if pass == 1 { 120 p("DXGCTXGATE verdict=GREEN reason=raw-/dev/dxg-LX_DXCREATECONTEXTVIRTUAL-makes-a-real-GPU-context-on-the-5080-device (device from R3; two creates -> two DISTINCT non-zero context handles into pre-zeroed slots; bogus-device writes no context; wrong-size/non-dxg -ENOTTY; plain CREATECONTEXT nr=0x03 -ENOTTY on WSL; wrapper-free) SCOPE=context-create-only-NO-throughput; allocation=R4b\n" as *u8) 121 if lfd >= 0 { 122 fp(lfd, "DXGCTXGATE verdict=GREEN rung=R4a-gpu-context-create device=discrete-RTX5080 via=raw-/dev/dxg-LX_DXCREATECONTEXTVIRTUAL(0xC0284704,size40,context@32) device_handle=" as *u8); fx(lfd, device) 123 fp(lfd, " context1=" as *u8); fx(lfd, c1[0]); fp(lfd, " context2=" as *u8); fx(lfd, c2[0]) 124 fp(lfd, " written_back=1 distinct=1 plain-CREATECONTEXT(nr0x03)=ENOTTY-on-WSL tamper=rejected(bogus-device-no-context+wrong-IOC_SIZE-ENOTTY+non-dxg-ENOTTY) wrapper-free scope=context-create-only-NO-throughput next=R4b-LX_DXCREATEALLOCATION\n" as *u8) 125 sys_close(lfd) 126 } 127 sys_exit(0); return 0 128 } 129 p("DXGCTXGATE verdict=RED (one of chain/ctx1/ctx2/written/distinct/tamper not satisfied)\n" as *u8) 130 if lfd >= 0 { fp(lfd, "DXGCTXGATE verdict=RED see-console\n" as *u8); sys_close(lfd) } 131 sys_exit(1) 132 return 1 133}