_gpu_dxg_device_gate.nx source

1// _gpu_dxg_device_gate.nx -- SOVEREIGN-GPU ladder R3 (create a real WDDM DEVICE on the RTX 5080). 2// 3// R0 reached the GPU set, R1 IDed the discrete 5080, R2 opened a per-adapter kernel handle from its 4// LUID. R3 feeds that adapter handle to LX_DXCREATEDEVICE and gets back a real WDDM DEVICE handle -- 5// the object GPU command submission (R4+) hangs off of. 6// 7// ABI (recon-pinned LIVE on this kernel, _gpu_dxg_r3_recon: the uapi header is absent so the size was 8// found by sweep -- only _IOC_SIZE=64 is recognized, all others -ENOTTY; the OUT handle's offset was 9// found by write-back scan): 10// LX_DXCREATEDEVICE = _IOWR(0x47, 0x02, 64) = 0xC0404702 11// struct d3dkmt_createdevice (64B): adapter @0 (union d3dkmthandle/u64, IN); flags @8 (u32, IN=0); 12// device @12 (d3dkmthandle, OUT); rest @16.. reserved (legacy cmd-buf). 13// NB: device handles live in the per-process DEVICE namespace, numerically independent of the global 14// ADAPTER namespace -- so a device handle may share a NUMBER with an adapter handle; we never test 15// device-vs-adapter numeric inequality. We test write-back + per-call distinctness + tamper instead. 16// 17// GREEN iff (author=organ, from REAL device returns, never $?): 18// A) enum ret==0 AND num_adapters>=2 AND exactly ONE discrete hw adapter; open(discrete LUID) ret==0; 19// B) CREATEDEVICE #1 ret==0 AND device1 != 0 AND device1 was WRITTEN into a pre-zeroed slot (offset 12); 20// C) CREATEDEVICE #2 ret==0 AND device2 != 0 AND device2 != device1 21// (per-call allocation -> a REAL device object each time, not a stuck constant); 22// D) TAMPER matrix, each distinct from the real ret==0: 23// T1 bogus adapter handle (0xdeadbeef), size 64 -> ret!=0 AND device slot stays 0 (no device w/o a real adapter); 24// T2 wrong _IOC_SIZE (56) -> -ENOTTY (unknown ioctl); T3 CREATEDEVICE on a non-dxg fd -> -ENOTTY. 25// fd close releases the device + adapter handles (per-fd dxgkrnl cleanup). Marker -> knowledge/status/gpu_dxg.log 26// (DXGDEVGATE). raw syscalls only (no libvulkan/cuda/dxcore/libc). NO-WAVE: device-create only, ZERO throughput. 27// license_tier: ORIGINAL 28import "nx_syscalls.nx" 29 30const ENUM2_CODE: i64 = 0xC0104714 // LX_DXENUMADAPTERS2 31const QAI_CODE: i64 = 0xC0184709 // LX_DXQUERYADAPTERINFO (ADAPTERTYPE) 32const OAFL_CODE: i64 = 0xC00C4701 // LX_DXOPENADAPTERFROMLUID 33const CDEV_CODE: i64 = 0xC0404702 // LX_DXCREATEDEVICE (_IOWR(0x47,0x02,64), recon-pinned) 34const CDEV_BADSZ: i64 = 0xC0384702 // wrong _IOC_SIZE=56 -> unknown ioctl (-ENOTTY) tamper 35const DEV_OFF: i64 = 12 // OUT device-handle offset within the 64B struct 36 37func p(s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(1,s,nn); return 0 } 38func fp(fd: i64, s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(fd,s,nn); return 0 } 39func n(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 40func x(v: i64) -> i64 { p("0x" as *u8); let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } var i:i64=0; let o:*u8=sys_mmap(20); while i<k{o[i]=bb[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 41func fx(fd: i64, v: i64) -> i64 { let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } let o:*u8=sys_mmap(20); var i:i64=0; while i<k{o[i]=bb[k-1-i];i=i+1} fp(fd,"0x" as *u8); sys_write(fd,o,k); return 0 } 42func rd32(buf: *u8, off: i64) -> i64 { return (buf[off] as i64)|((buf[off+1] as i64)<<8)|((buf[off+2] as i64)<<16)|((buf[off+3] as i64)<<24) } 43 44func query_type(fd: i64, handle: i64, qtype: i64, psize: i64, outv: *i64) -> i64 { 45 let priv: *u8 = sys_mmap(64); var zz: i64 = 0; while zz < 64 { priv[zz] = 0 as u8; zz = zz + 1 } 46 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 47 let h: *i64 = (req as i64 + 0) as *i64; h[0] = (handle & 0xffffffff) | ((qtype & 0xffffffff) << 32) 48 let pd: *i64 = (req as i64 + 8) as *i64; pd[0] = priv as i64 49 let pds: *i64 = (req as i64 + 16) as *i64; pds[0] = psize & 0xffffffff 50 let ret: i64 = sys_ioctl(fd, QAI_CODE, req as i64) 51 outv[0] = rd32(priv, 0) 52 return ret 53} 54func open_from_luid(fd: i64, luid_lo: i64, luid_hi: i64, outh: *i64) -> i64 { 55 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 56 let lo: *i64 = (req as i64 + 0) as *i64; lo[0] = (luid_lo & 0xffffffff) | ((luid_hi & 0xffffffff) << 32) 57 let ret: i64 = sys_ioctl(fd, OAFL_CODE, req as i64) 58 outh[0] = rd32(req, 8) 59 return ret 60} 61// create a device from `adapter` via `code`; OUT device handle (offset 12) -> outd[0]. buffer pre-zeroed. 62func create_device(fd: i64, code: i64, adapter: i64, outd: *i64) -> i64 { 63 let buf: *u8 = sys_mmap(512); var bz: i64 = 0; while bz < 512 { buf[bz] = 0 as u8; bz = bz + 1 } 64 let a0: *i64 = (buf as i64) as *i64; a0[0] = adapter & 0xffffffff // adapter @0 (union), upper 4B zero 65 // flags @8 = 0 (already zeroed); device @12 OUT = 0 (already zeroed -> proves write-back) 66 let ret: i64 = sys_ioctl(fd, code, buf as i64) 67 outd[0] = rd32(buf, DEV_OFF) 68 return ret 69} 70 71func main() -> i64 { 72 p("=== SOVEREIGN-GPU R3 gate (raw /dev/dxg LX_DXCREATEDEVICE -> a real WDDM device on the 5080) ===\n" as *u8) 73 let fd: i64 = sys_openat_rd("/dev/dxg" as *u8) 74 if fd < 0 { p("open(/dev/dxg) failed\n" as *u8); sys_exit(1); return 1 } 75 76 // enum + identify discrete (R1) + open adapter handle (R2). 77 let ainfo: *u8 = sys_mmap(4096); var z: i64 = 0; while z < 4096 { ainfo[z] = 0 as u8; z = z + 1 } 78 let ereq: *u8 = sys_mmap(64); ereq[0] = 8 as u8; let r8: *i64 = (ereq as i64 + 8) as *i64; r8[0] = ainfo as i64 79 let eret: i64 = sys_ioctl(fd, ENUM2_CODE, ereq as i64) 80 let nc: i64 = rd32(ereq, 0) 81 let v: *i64 = sys_mmap(16) 82 var n_discrete: i64 = 0; var disc_lo: i64 = 0; var disc_hi: i64 = 0 83 var ai: i64 = 0 84 while ai < nc { 85 let base: i64 = ai * 20 86 let eh: i64 = rd32(ainfo, base) 87 let qret: i64 = query_type(fd, eh, 15, 4, v); let t: i64 = v[0] 88 if qret == 0 { if ((t>>4)&1) == 1 { if ((t>>2)&1) == 0 { n_discrete = n_discrete + 1; disc_lo = rd32(ainfo, base+4); disc_hi = rd32(ainfo, base+8) } } } 89 ai = ai + 1 90 } 91 let ah: *i64 = sys_mmap(16) 92 let aor: i64 = open_from_luid(fd, disc_lo, disc_hi, ah); let adapter: i64 = ah[0] 93 p(" enum ret=" as *u8); n(eret); p(" num_adapters=" as *u8); n(nc); p(" discrete_count=" as *u8); n(n_discrete) 94 p(" adapter_open ret=" as *u8); n(aor); p(" adapter_handle=" as *u8); x(adapter); p("\n" as *u8) 95 96 // REAL: create a device twice from the adapter handle. 97 let d1: *i64 = sys_mmap(16); let d2: *i64 = sys_mmap(16) 98 let r1: i64 = create_device(fd, CDEV_CODE, adapter, d1) 99 let r2: i64 = create_device(fd, CDEV_CODE, adapter, d2) 100 p(" CREATEDEVICE #1 ret=" as *u8); n(r1); p(" device=" as *u8); x(d1[0]); p("\n" as *u8) 101 p(" CREATEDEVICE #2 ret=" as *u8); n(r2); p(" device=" as *u8); x(d2[0]); p("\n" as *u8) 102 103 // ---- TAMPER matrix ---- 104 let td: *i64 = sys_mmap(16) 105 let t1: i64 = create_device(fd, CDEV_CODE, 0xdeadbeef, td); let t1d: i64 = td[0] // bogus adapter 106 let t2: i64 = create_device(fd, CDEV_BADSZ, adapter, td); let t2d: i64 = td[0] // wrong _IOC_SIZE 107 let nfd: i64 = sys_openat_rd("/dev/null" as *u8) 108 let t3: i64 = create_device(nfd, CDEV_CODE, adapter, td); let t3d: i64 = td[0] // non-dxg fd 109 if nfd >= 0 { sys_close(nfd) } 110 p(" [tamper] bogus-adapter ret=" as *u8); n(t1); p(" dev=" as *u8); x(t1d) 111 p(" | wrong-size ret=" as *u8); n(t2); p(" | non-dxg-fd ret=" as *u8); n(t3); p("\n" as *u8) 112 sys_close(fd) // releases device + adapter handles (per-fd dxgkrnl cleanup) 113 114 var written: i64 = 0; if d1[0] != 0 { written = 1 } // device slot was 0 pre-call (create_device zeroes it) 115 var distinct: i64 = 0; if d1[0] != 0 { if d2[0] != 0 { if d1[0] != d2[0] { distinct = 1 } } } 116 var tamper_ok: i64 = 0 117 if t1 != 0 { if t1d == 0 { if t2 != 0 { if t3 != 0 { tamper_ok = 1 } } } } 118 119 var pass: i64 = 0 120 if eret == 0 { if nc >= 2 { if n_discrete == 1 { if aor == 0 { 121 if r1 == 0 { if r2 == 0 { if written == 1 { if distinct == 1 { if tamper_ok == 1 { pass = 1 } } } } } } } } } 122 123 p(" checks: enum=" as *u8); n(eret==0); p(" discrete_count=" as *u8); n(n_discrete); p(" adapter_open_ok=" as *u8); n(aor==0) 124 p(" create1_ok=" as *u8); n(r1==0); p(" create2_ok=" as *u8); n(r2==0); p(" written_back=" as *u8); n(written); p(" distinct_devices=" as *u8); n(distinct); p(" tamper_ok=" as *u8); n(tamper_ok); p("\n" as *u8) 125 126 let lfd: i64 = sys_openat_append("knowledge/status/gpu_dxg.log" as *u8, 0x1a4) 127 if pass == 1 { 128 p("DXGDEVGATE verdict=GREEN reason=raw-/dev/dxg-LX_DXCREATEDEVICE-makes-a-real-WDDM-device-on-the-5080 (adapter from R2; two creates -> two DISTINCT non-zero device handles written into pre-zeroed slots; bogus-adapter writes no device; wrong-size/non-dxg tampers -ENOTTY; wrapper-free) SCOPE=device-create-only-NO-throughput; cmd-submission=R4\n" as *u8) 129 if lfd >= 0 { 130 fp(lfd, "DXGDEVGATE verdict=GREEN rung=R3-wddm-device-create device=discrete-RTX5080 via=raw-/dev/dxg-LX_DXCREATEDEVICE(0xC0404702,size64,device@12) adapter_handle=" as *u8); fx(lfd, adapter) 131 fp(lfd, " device1=" as *u8); fx(lfd, d1[0]); fp(lfd, " device2=" as *u8); fx(lfd, d2[0]) 132 fp(lfd, " written_back=1 distinct=1 tamper=rejected(bogus-adapter-no-device+wrong-IOC_SIZE-ENOTTY+non-dxg-ENOTTY) wrapper-free scope=device-create-only-NO-throughput next=R4-command-submission\n" as *u8) 133 sys_close(lfd) 134 } 135 sys_exit(0); return 0 136 } 137 p("DXGDEVGATE verdict=RED (one of enum/discrete/adapter-open/create1/create2/written/distinct/tamper not satisfied)\n" as *u8) 138 if lfd >= 0 { fp(lfd, "DXGDEVGATE verdict=RED see-console\n" as *u8); sys_close(lfd) } 139 sys_exit(1) 140 return 1 141}