_gpu_dxg_mapva_gate.nx source

1// _gpu_dxg_mapva_gate.nx -- SOVEREIGN-GPU ladder R4e (map a real allocation to a GPU VIRTUAL ADDRESS on the 5080). 2// 3// The keystone uniting R4c (paging queue + fence page) and R4d (allocation): LX_DXMAPGPUVIRTUALADDRESS assigns 4// the allocation a GPU virtual address (synchronously) and pages it in ASYNC -> completion is signaled when the 5// paging queue's monitored fence reaches the returned paging_fence_value. We WAIT by polling the kernel-mapped 6// fence page (R4c) -> proves the GPU actually completed the mapping. 7// 8// ABI (header-derived, natural-aligned, recon-confirmed live): LX_DXMAPGPUVIRTUALADDRESS = 0xC068470C (size 104). 9// d3dddi_mapgpuvirtualaddress: paging_queue@0; base_address@8(=0 auto); minimum_address@16; maximum_address@24; 10// allocation@32; offset_in_pages@40; size_in_pages@48; protection@56 (write=bit0); driver_protection@64; 11// virtual_address@88 (OUT); paging_fence_value@96 (OUT). ret=259 = STATUS_PENDING (accepted, async). 12// 13// GREEN iff (author=organ, from REAL device returns): 14// A) chain ok (device + paging queue [capture fence_cpu_va] + EXISTINGHEAP allocation); 15// B) MAP #1 ret==STATUS_PENDING(259) AND gpu_va != 0 AND paging_fence_value > fence-before; 16// C) the paging fence ADVANCES to paging_fence_value (poll the kernel fence page) = GPU completed the map; 17// D) MAP #2 ret pending AND gpu_va2 != 0 AND gpu_va2 != gpu_va1 (distinct real VAs) AND its fence also completes; 18// E) TAMPER: T1 bogus paging_queue(0xdeadbeef) -> negative errno; T2 bogus allocation -> negative; T3 non-dxg fd -> -ENOTTY. 19// Marker -> knowledge/status/gpu_dxg.log (DXGMAPGATE). raw syscalls only. NO-WAVE: assigns + pages-in a GPU VA 20// (real memory addressing); NO compute/throughput (that is R7). ZERO speedup claimed. 21// license_tier: ORIGINAL 22import "nx_syscalls.nx" 23 24const ENUM2_CODE: i64 = 0xC0104714 25const QAI_CODE: i64 = 0xC0184709 26const OAFL_CODE: i64 = 0xC00C4701 27const CDEV_CODE: i64 = 0xC0404702 28const CPQ_CODE: i64 = 0xC0204707 29const CALLOC_CODE: i64 = 0xC0484706 30const MAPVA_CODE: i64 = 0xC068470C 31const STATUS_PENDING: i64 = 259 32 33func p(s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(1,s,nn); return 0 } 34func fp(fd: i64, s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(fd,s,nn); return 0 } 35func n(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 36func x(v: i64) -> i64 { p("0x" as *u8); let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } var i:i64=0; let o:*u8=sys_mmap(20); while i<k{o[i]=bb[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 37func fx(fd: i64, v: i64) -> i64 { let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } let o:*u8=sys_mmap(20); var i:i64=0; while i<k{o[i]=bb[k-1-i];i=i+1} fp(fd,"0x" as *u8); sys_write(fd,o,k); return 0 } 38func fn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;fp(fd,"-" as *u8)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 39func rd32(buf: *u8, off: i64) -> i64 { return (buf[off] as i64)|((buf[off+1] as i64)<<8)|((buf[off+2] as i64)<<16)|((buf[off+3] as i64)<<24) } 40func rd64(buf: *u8, off: i64) -> i64 { let q: *i64 = (buf as i64 + off) as *i64; return q[0] } 41func setu32(buf: *u8, off: i64, val: i64) -> i64 { let w: *u8 = (buf as i64 + off) as *u8; w[0]=(val&0xff) as u8; w[1]=((val>>8)&0xff) as u8; w[2]=((val>>16)&0xff) as u8; w[3]=((val>>24)&0xff) as u8; return 0 } 42func setu64(buf: *u8, off: i64, val: i64) -> i64 { let q: *i64 = (buf as i64 + off) as *i64; q[0]=val; return 0 } 43 44func query_type(fd: i64, handle: i64, qtype: i64, psize: i64, outv: *i64) -> i64 { 45 let priv: *u8 = sys_mmap(64); var zz: i64 = 0; while zz < 64 { priv[zz] = 0 as u8; zz = zz + 1 } 46 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 47 let h: *i64 = (req as i64 + 0) as *i64; h[0] = (handle & 0xffffffff) | ((qtype & 0xffffffff) << 32) 48 let pd: *i64 = (req as i64 + 8) as *i64; pd[0] = priv as i64 49 let pds: *i64 = (req as i64 + 16) as *i64; pds[0] = psize & 0xffffffff 50 let ret: i64 = sys_ioctl(fd, QAI_CODE, req as i64); outv[0] = rd32(priv, 0); return ret 51} 52func open_from_luid(fd: i64, luid_lo: i64, luid_hi: i64, outh: *i64) -> i64 { 53 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 54 let lo: *i64 = (req as i64 + 0) as *i64; lo[0] = (luid_lo & 0xffffffff) | ((luid_hi & 0xffffffff) << 32) 55 let ret: i64 = sys_ioctl(fd, OAFL_CODE, req as i64); outh[0] = rd32(req, 8); return ret 56} 57func create_device(fd: i64, adapter: i64, outd: *i64) -> i64 { 58 let buf: *u8 = sys_mmap(512); var bz: i64 = 0; while bz < 512 { buf[bz] = 0 as u8; bz = bz + 1 } 59 setu32(buf, 0, adapter & 0xffffffff) 60 let ret: i64 = sys_ioctl(fd, CDEV_CODE, buf as i64); outd[0] = rd32(buf, 12); return ret 61} 62func create_pq(fd: i64, device: i64, outpq: *i64, outfva: *i64) -> i64 { 63 let buf: *u8 = sys_mmap(512); var bz: i64 = 0; while bz < 512 { buf[bz] = 0 as u8; bz = bz + 1 } 64 setu32(buf, 0, device & 0xffffffff) 65 let ret: i64 = sys_ioctl(fd, CPQ_CODE, buf as i64); outpq[0] = rd32(buf, 8); outfva[0] = rd64(buf, 16); return ret 66} 67func alloc_eh(fd: i64, device: i64, sysmem: *u8, outh: *i64) -> i64 { 68 let desc: *u8 = sys_mmap(64); var dz: i64 = 0; while dz < 64 { desc[dz] = 0 as u8; dz = dz + 1 } 69 setu32(desc, 0, 1); setu64(desc, 8, 65536) 70 let entry: *u8 = sys_mmap(256); var ez: i64 = 0; while ez < 256 { entry[ez] = 0 as u8; ez = ez + 1 } 71 setu64(entry, 8, sysmem as i64) 72 let buf: *u8 = sys_mmap(512); var bz: i64 = 0; while bz < 512 { buf[bz] = 0 as u8; bz = bz + 1 } 73 setu32(buf, 0, device & 0xffffffff); setu64(buf, 32, desc as i64); setu32(buf, 40, 0) 74 setu32(buf, 44, 1); setu64(buf, 48, entry as i64); setu32(buf, 56, 0x10020) 75 let ret: i64 = sys_ioctl(fd, CALLOC_CODE, buf as i64); outh[0] = rd32(entry, 0); return ret 76} 77// map allocation -> GPU VA via paging queue `pq`. OUT va@88 -> outva[0], paging_fence@96 -> outf[0]. 78func map_va(fd: i64, pq: i64, alloc: i64, outva: *i64, outf: *i64) -> i64 { 79 let buf: *u8 = sys_mmap(256); var bz: i64 = 0; while bz < 256 { buf[bz] = 0 as u8; bz = bz + 1 } 80 setu32(buf, 0, pq & 0xffffffff); setu64(buf, 24, 0x10000000000) 81 setu32(buf, 32, alloc & 0xffffffff); setu64(buf, 48, 16); setu64(buf, 56, 1) 82 let ret: i64 = sys_ioctl(fd, MAPVA_CODE, buf as i64) 83 outva[0] = rd64(buf, 88); outf[0] = rd64(buf, 96); return ret 84} 85// poll the kernel-mapped fence page until it reaches target (bounded). returns 1 if reached. 86func wait_fence(fence_va: i64, target: i64) -> i64 { 87 let fpp: *i64 = fence_va as *i64 88 var iters: i64 = 0; var reached: i64 = 0 89 while iters < 500000000 { if fpp[0] >= target { reached = 1; iters = 500000000 } else { iters = iters + 1 } } 90 return reached 91} 92 93func main() -> i64 { 94 p("=== SOVEREIGN-GPU R4e gate (raw /dev/dxg LX_DXMAPGPUVIRTUALADDRESS -> map an allocation to a GPU VA on the 5080) ===\n" as *u8) 95 let fd: i64 = sys_openat_rd("/dev/dxg" as *u8) 96 if fd < 0 { p("open(/dev/dxg) failed\n" as *u8); sys_exit(1); return 1 } 97 let ainfo: *u8 = sys_mmap(4096); var z: i64 = 0; while z < 4096 { ainfo[z] = 0 as u8; z = z + 1 } 98 let ereq: *u8 = sys_mmap(64); ereq[0] = 8 as u8; let r8: *i64 = (ereq as i64 + 8) as *i64; r8[0] = ainfo as i64 99 let eret: i64 = sys_ioctl(fd, ENUM2_CODE, ereq as i64); let nc: i64 = rd32(ereq, 0) 100 let v: *i64 = sys_mmap(16); var n_discrete: i64 = 0; var disc_lo: i64 = 0; var disc_hi: i64 = 0 101 var ai: i64 = 0 102 while ai < nc { 103 let base: i64 = ai * 20; let eh: i64 = rd32(ainfo, base) 104 let qret: i64 = query_type(fd, eh, 15, 4, v); let t: i64 = v[0] 105 if qret == 0 { if ((t>>4)&1) == 1 { if ((t>>2)&1) == 0 { n_discrete = n_discrete + 1; disc_lo = rd32(ainfo, base+4); disc_hi = rd32(ainfo, base+8) } } } 106 ai = ai + 1 107 } 108 let ah: *i64 = sys_mmap(16); let aor: i64 = open_from_luid(fd, disc_lo, disc_hi, ah) 109 let dh: *i64 = sys_mmap(16); let dr: i64 = create_device(fd, ah[0], dh); let device: i64 = dh[0] 110 let pqh: *i64 = sys_mmap(16); let fvah: *i64 = sys_mmap(16); let pqr: i64 = create_pq(fd, device, pqh, fvah); let pq: i64 = pqh[0]; let fence_va: i64 = fvah[0] 111 let sysmem: *u8 = sys_mmap(65536); var sz: i64 = 0; while sz < 65536 { sysmem[sz] = 0 as u8; sz = sz + 1 } 112 let alh: *i64 = sys_mmap(16); let alr: i64 = alloc_eh(fd, device, sysmem, alh); let alloc: i64 = alh[0] 113 let fp0: *i64 = fence_va as *i64; let fence_before: i64 = fp0[0] 114 p(" chain: device=" as *u8); x(device); p(" pq=" as *u8); x(pq); p(" alloc=" as *u8); x(alloc); p(" fence_va=" as *u8); x(fence_va); p(" fence_before=" as *u8); n(fence_before); p("\n" as *u8) 115 116 // MAP #1 + wait 117 let va1: *i64 = sys_mmap(16); let f1: *i64 = sys_mmap(16) 118 let r1: i64 = map_va(fd, pq, alloc, va1, f1) 119 let done1: i64 = wait_fence(fence_va, f1[0]) 120 p(" MAP #1 ret=" as *u8); n(r1); p(" gpu_va=" as *u8); x(va1[0]); p(" fence_target=" as *u8); n(f1[0]); p(" fence_reached=" as *u8); n(done1); p("\n" as *u8) 121 // MAP #2 (distinct VA) + wait 122 let va2: *i64 = sys_mmap(16); let f2: *i64 = sys_mmap(16) 123 let r2: i64 = map_va(fd, pq, alloc, va2, f2) 124 let done2: i64 = wait_fence(fence_va, f2[0]) 125 p(" MAP #2 ret=" as *u8); n(r2); p(" gpu_va=" as *u8); x(va2[0]); p(" fence_target=" as *u8); n(f2[0]); p(" fence_reached=" as *u8); n(done2); p("\n" as *u8) 126 127 // ---- TAMPER matrix ---- 128 let tva: *i64 = sys_mmap(16); let tf: *i64 = sys_mmap(16) 129 let t1: i64 = map_va(fd, 0xdeadbeef, alloc, tva, tf) // bogus paging queue 130 let t2: i64 = map_va(fd, pq, 0xdeadbeef, tva, tf) // bogus allocation 131 let nfd: i64 = sys_openat_rd("/dev/null" as *u8) 132 let t3: i64 = map_va(nfd, pq, alloc, tva, tf) // non-dxg fd 133 if nfd >= 0 { sys_close(nfd) } 134 p(" [tamper] bogus-pq ret=" as *u8); n(t1); p(" | bogus-alloc ret=" as *u8); n(t2); p(" | non-dxg ret=" as *u8); n(t3); p("\n" as *u8) 135 sys_close(fd) 136 137 var pend1: i64 = 0; if r1 == STATUS_PENDING { if va1[0] != 0 { if f1[0] > fence_before { pend1 = 1 } } } 138 var pend2: i64 = 0; if r2 == STATUS_PENDING { if va2[0] != 0 { pend2 = 1 } } 139 var distinct: i64 = 0; if va1[0] != 0 { if va2[0] != 0 { if va1[0] != va2[0] { distinct = 1 } } } 140 var tamper_ok: i64 = 0; if t1 < 0 { if t2 < 0 { if t3 < 0 { tamper_ok = 1 } } } 141 142 var pass: i64 = 0 143 if eret == 0 { if n_discrete == 1 { if aor == 0 { if dr == 0 { if pqr == 0 { 144 if pend1 == 1 { if done1 == 1 { if pend2 == 1 { if done2 == 1 { if distinct == 1 { if tamper_ok == 1 { pass = 1 } } } } } } } } } } } 145 146 p(" checks: chain_ok=" as *u8); var ch: i64=0; if eret==0 { if aor==0 { if dr==0 { if pqr==0 { ch=1 } } } } n(ch) 147 p(" map1_pending=" as *u8); n(pend1); p(" fence1_completed=" as *u8); n(done1); p(" map2_pending=" as *u8); n(pend2); p(" fence2_completed=" as *u8); n(done2); p(" distinct_vas=" as *u8); n(distinct); p(" tamper_ok=" as *u8); n(tamper_ok); p("\n" as *u8) 148 149 let lfd: i64 = sys_openat_append("knowledge/status/gpu_dxg.log" as *u8, 0x1a4) 150 if pass == 1 { 151 p("DXGMAPGATE verdict=GREEN reason=raw-/dev/dxg-LX_DXMAPGPUVIRTUALADDRESS-maps-the-allocation-to-a-real-GPU-VA-on-the-5080 (STATUS_PENDING+assigned gpu_va; the paging fence ADVANCES to paging_fence_value via the R4c kernel fence page = GPU completed the async map; two maps -> DISTINCT GPU VAs; bogus-pq/bogus-alloc/non-dxg tampers all negative; wrapper-free) SCOPE=gpu-va-mapping-only-NO-throughput; make-resident/submit=R4f\n" as *u8) 152 if lfd >= 0 { 153 fp(lfd, "DXGMAPGATE verdict=GREEN rung=R4e-map-gpu-va device=discrete-RTX5080 via=raw-/dev/dxg-LX_DXMAPGPUVIRTUALADDRESS(0xC068470C,size104,va@88,fence@96) paging_queue=" as *u8); fx(lfd, pq) 154 fp(lfd, " allocation=" as *u8); fx(lfd, alloc); fp(lfd, " gpu_va1=" as *u8); fx(lfd, va1[0]); fp(lfd, " gpu_va2=" as *u8); fx(lfd, va2[0]) 155 fp(lfd, " fence_before=" as *u8); fn(lfd, fence_before); fp(lfd, " fence_target1=" as *u8); fn(lfd, f1[0]); fp(lfd, " fence_target2=" as *u8); fn(lfd, f2[0]) 156 fp(lfd, " STATUS_PENDING=259 fence_advanced_to_target=1 distinct_vas=1 tamper=rejected(bogus-pq+bogus-alloc+non-dxg) wrapper-free scope=gpu-va-mapping-only-NO-throughput next=R4f-LX_DXMAKERESIDENT+submit\n" as *u8) 157 sys_close(lfd) 158 } 159 sys_exit(0); return 0 160 } 161 p("DXGMAPGATE verdict=RED (one of chain/map1/fence1/map2/fence2/distinct/tamper not satisfied)\n" as *u8) 162 if lfd >= 0 { fp(lfd, "DXGMAPGATE verdict=RED see-console\n" as *u8); sys_close(lfd) } 163 sys_exit(1) 164 return 1 165}