code wiki / _hdl_build / _gpu_dxg_gate_tamper.nx
`_gpu_dxg_gate_tamper.nx` source

1// _gpu_dxg_gate_tamper.nx -- NO-FALSE-GREEN PROOF for _gpu_dxg_gate. Identical logic, EXCEPT the
2// "real call" uses a BOGUS ioctl code (magic 0x99 instead of 0x47/LX_DXENUMADAPTERS2). If the real
3// gate's GREEN were a constant/no-op, this would still print GREEN. It must instead go RED, proving
4// the real gate's GREEN comes from the kernel ACCEPTING the genuine LX_DXENUMADAPTERS2 code -- a
5// real device response, not a fabricated marker. This is a throwaway control, not a shipped organ.
6// license_tier: ORIGINAL
7import "nx_syscalls.nx"
8
9// BOGUS code: a magic-0x99 _IOWR with the same size/nr as LX_DXENUMADAPTERS2 but the WRONG magic.
10// The real dxgkrnl device rejects it (-ENOTTY) exactly like the tamper control -> check (A) fails.
11const BOGUS_ENUM: i64 = 0x99104714
12const TAMPER_MAGIC: i64 = 0x99000000
13
14func t_set(res: *u8, off: i64, v: i64) -> i64 { let p: *i64 = (res as i64 + off) as *i64; p[0] = v; return 0 }
15func t_get(res: *u8, off: i64) -> i64 { let p: *i64 = (res as i64 + off) as *i64; return p[0] }
16
17func t_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
18func t_n(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
19
20func main() -> i64 {
21    t_p("=== TAMPER control: bogus ioctl code 0x99104714 instead of LX_DXENUMADAPTERS2 ===\n" as *u8)
22    let fd: i64 = sys_openat_rd("/dev/dxg" as *u8)
23    if fd < 0 { t_p("open failed\n" as *u8); sys_exit(2); return 2 }
24
25    let ainfo: *u8 = sys_mmap(4096); var z: i64=0; while z<4096 { ainfo[z]=0 as u8; z=z+1 }
26    let req: *u8 = sys_mmap(64); var y: i64=0; while y<64 { req[y]=0 as u8; y=y+1 }
27    req[0]=8 as u8
28    let r8: *i64 = (req as i64 + 8) as *i64; r8[0]=ainfo as i64
29
30    let ret: i64 = sys_ioctl(fd, BOGUS_ENUM, req as i64)   // BOGUS magic -> expect a real errno
31    let nc: i64 = (req[0] as i64)|((req[1] as i64)<<8)|((req[2] as i64)<<16)|((req[3] as i64)<<24)
32    let la: i64 = (ainfo[4] as i64)|((ainfo[5] as i64)<<8)|((ainfo[6] as i64)<<16)|((ainfo[7] as i64)<<24)
33    sys_close(fd)
34
35    t_p("  bogus-code ret=" as *u8); t_n(ret); t_p(" num_adapters=" as *u8); t_n(nc); t_p(" luid.a=" as *u8); t_n(la); t_p("\n" as *u8)
36
37    // Same (A) check as the real gate: ret==0 AND num_adapters>=1 AND non-zero luid.
38    var a_ok: i64 = 0
39    if ret == 0 { if nc >= 1 { if la != 0 { a_ok = 1 } } }
40    if a_ok == 1 {
41        t_p("DXGGATE_TAMPER verdict=GREEN  <-- BUG: bogus code falsely passed (gate is NOT sound)\n" as *u8)
42        sys_exit(0); return 0
43    }
44    t_p("DXGGATE_TAMPER verdict=RED  (bogus ioctl code rejected by real device -> real-call check fails as it MUST = gate is sound, GREEN requires the genuine LX_DXENUMADAPTERS2)\n" as *u8)
45    sys_exit(1); return 1
46}
_gpu_dxg_gate_tamper.nx source

`_gpu_dxg_gate_tamper.nx` source
