_gpu_dxg_pagingqueue_gate.nx source

1// _gpu_dxg_pagingqueue_gate.nx -- SOVEREIGN-GPU ladder R4c (create a GPU PAGING QUEUE + fence on the 5080). 2// 3// R4b read the real VRAM budget. R4c creates the WDDM residency-manager object (the paging queue) that GPU 4// memory is paged/made-resident against via LX_DXCREATEPAGINGQUEUE -- and the kernel mmaps a FENCE PAGE into 5// our address space for lock-free CPU<->GPU fence polling. This is the residency substrate for real 6// allocations (R4d) + command submission (R4e). 7// 8// ABI (recon-pinned LIVE, _gpu_dxg_r4c_pq_recon: no uapi header -> size-swept, only _IOC_SIZE=32 recognized; 9// OUT offsets located by dump): 10// LX_DXCREATEPAGINGQUEUE = _IOWR(0x47, 0x07, 32) = 0xC0204707 11// struct (32B): device @0 (in); priority @4 (in, 0=NORMAL); paging_queue @8 (OUT); sync_object @12 (OUT); 12// fence_cpu_virtual_address @16 (u64, OUT -- a REAL page the kernel maps into us); physical_adapter_index @24 (in). 13// 14// GREEN iff (author=organ, from REAL device returns): 15// A) device-create chain ok (enum/discrete/open-adapter/create-device all ret==0); 16// B) CREATEPAGINGQUEUE #1 ret==0 AND paging_queue!=0 AND sync_object!=0 AND fence_VA!=0 (all written into pre-zeroed slots) 17// AND fence_VA is a canonical userspace addr (<0x800000000000); 18// C) the fence page is GENUINELY MAPPED: we DEREFERENCE fence_VA and read its u64 fence value -- if the VA were 19// bogus the process would fault and never reach GREEN, so reaching the verdict after the read IS the proof; 20// D) CREATEPAGINGQUEUE #2 ret==0 AND paging_queue2!=0 AND paging_queue2 != paging_queue1 (per-call allocation); 21// E) TAMPER: T1 bogus device(0xdeadbeef) -> ret!=0 AND paging_queue stays 0; T2 wrong _IOC_SIZE(28) -> -ENOTTY; 22// T3 on a non-dxg fd -> -ENOTTY. 23// Marker -> knowledge/status/gpu_dxg.log (DXGPQGATE). raw syscalls only. NO-WAVE: creates a residency object + 24// reads a fence page; NO compute/throughput claimed (that is R7). 25// license_tier: ORIGINAL 26import "nx_syscalls.nx" 27 28const ENUM2_CODE: i64 = 0xC0104714 29const QAI_CODE: i64 = 0xC0184709 30const OAFL_CODE: i64 = 0xC00C4701 31const CDEV_CODE: i64 = 0xC0404702 32const CPQ_CODE: i64 = 0xC0204707 // LX_DXCREATEPAGINGQUEUE (_IOWR(0x47,0x07,32), recon-pinned) 33const CPQ_BADSZ: i64 = 0xC01C4707 // wrong _IOC_SIZE=28 -> -ENOTTY tamper 34const USER_CANON: i64 = 0x800000000000 35 36func p(s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(1,s,nn); return 0 } 37func fp(fd: i64, s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(fd,s,nn); return 0 } 38func n(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 39func x(v: i64) -> i64 { p("0x" as *u8); let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } var i:i64=0; let o:*u8=sys_mmap(20); while i<k{o[i]=bb[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 40func fx(fd: i64, v: i64) -> i64 { let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } let o:*u8=sys_mmap(20); var i:i64=0; while i<k{o[i]=bb[k-1-i];i=i+1} fp(fd,"0x" as *u8); sys_write(fd,o,k); return 0 } 41func rd32(buf: *u8, off: i64) -> i64 { return (buf[off] as i64)|((buf[off+1] as i64)<<8)|((buf[off+2] as i64)<<16)|((buf[off+3] as i64)<<24) } 42func rd64(buf: *u8, off: i64) -> i64 { let q: *i64 = (buf as i64 + off) as *i64; return q[0] } 43 44func query_type(fd: i64, handle: i64, qtype: i64, psize: i64, outv: *i64) -> i64 { 45 let priv: *u8 = sys_mmap(64); var zz: i64 = 0; while zz < 64 { priv[zz] = 0 as u8; zz = zz + 1 } 46 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 47 let h: *i64 = (req as i64 + 0) as *i64; h[0] = (handle & 0xffffffff) | ((qtype & 0xffffffff) << 32) 48 let pd: *i64 = (req as i64 + 8) as *i64; pd[0] = priv as i64 49 let pds: *i64 = (req as i64 + 16) as *i64; pds[0] = psize & 0xffffffff 50 let ret: i64 = sys_ioctl(fd, QAI_CODE, req as i64); outv[0] = rd32(priv, 0); return ret 51} 52func open_from_luid(fd: i64, luid_lo: i64, luid_hi: i64, outh: *i64) -> i64 { 53 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 54 let lo: *i64 = (req as i64 + 0) as *i64; lo[0] = (luid_lo & 0xffffffff) | ((luid_hi & 0xffffffff) << 32) 55 let ret: i64 = sys_ioctl(fd, OAFL_CODE, req as i64); outh[0] = rd32(req, 8); return ret 56} 57func create_device(fd: i64, adapter: i64, outd: *i64) -> i64 { 58 let buf: *u8 = sys_mmap(512); var bz: i64 = 0; while bz < 512 { buf[bz] = 0 as u8; bz = bz + 1 } 59 let a0: *i64 = (buf as i64) as *i64; a0[0] = adapter & 0xffffffff 60 let ret: i64 = sys_ioctl(fd, CDEV_CODE, buf as i64); outd[0] = rd32(buf, 12); return ret 61} 62// create a paging queue on `device` via `code`; OUT pq@8 -> outpq[0], sync@12 -> outsync[0], fenceVA@16 -> outfva[0]. 63func create_pq(fd: i64, code: i64, device: i64, outpq: *i64, outsync: *i64, outfva: *i64) -> i64 { 64 let buf: *u8 = sys_mmap(512); var bz: i64 = 0; while bz < 512 { buf[bz] = 0 as u8; bz = bz + 1 } 65 let d0: *i64 = (buf as i64) as *i64; d0[0] = device & 0xffffffff // device @0; priority @4 = 0 66 let ret: i64 = sys_ioctl(fd, code, buf as i64) 67 outpq[0] = rd32(buf, 8); outsync[0] = rd32(buf, 12); outfva[0] = rd64(buf, 16); return ret 68} 69 70func main() -> i64 { 71 p("=== SOVEREIGN-GPU R4c gate (raw /dev/dxg LX_DXCREATEPAGINGQUEUE -> a residency paging queue + fence page on the 5080) ===\n" as *u8) 72 let fd: i64 = sys_openat_rd("/dev/dxg" as *u8) 73 if fd < 0 { p("open(/dev/dxg) failed\n" as *u8); sys_exit(1); return 1 } 74 let ainfo: *u8 = sys_mmap(4096); var z: i64 = 0; while z < 4096 { ainfo[z] = 0 as u8; z = z + 1 } 75 let ereq: *u8 = sys_mmap(64); ereq[0] = 8 as u8; let r8: *i64 = (ereq as i64 + 8) as *i64; r8[0] = ainfo as i64 76 let eret: i64 = sys_ioctl(fd, ENUM2_CODE, ereq as i64); let nc: i64 = rd32(ereq, 0) 77 let v: *i64 = sys_mmap(16); var n_discrete: i64 = 0; var disc_lo: i64 = 0; var disc_hi: i64 = 0 78 var ai: i64 = 0 79 while ai < nc { 80 let base: i64 = ai * 20; let eh: i64 = rd32(ainfo, base) 81 let qret: i64 = query_type(fd, eh, 15, 4, v); let t: i64 = v[0] 82 if qret == 0 { if ((t>>4)&1) == 1 { if ((t>>2)&1) == 0 { n_discrete = n_discrete + 1; disc_lo = rd32(ainfo, base+4); disc_hi = rd32(ainfo, base+8) } } } 83 ai = ai + 1 84 } 85 let ah: *i64 = sys_mmap(16); let aor: i64 = open_from_luid(fd, disc_lo, disc_hi, ah); let adapter: i64 = ah[0] 86 let dh: *i64 = sys_mmap(16); let dr: i64 = create_device(fd, adapter, dh); let device: i64 = dh[0] 87 p(" chain: enum ret=" as *u8); n(eret); p(" discrete_count=" as *u8); n(n_discrete); p(" adapter=" as *u8); x(adapter); p(" device=" as *u8); x(device); p("\n" as *u8) 88 89 // REAL: create a paging queue twice. 90 let pq1: *i64 = sys_mmap(16); let sy1: *i64 = sys_mmap(16); let fv1: *i64 = sys_mmap(16) 91 let pq2: *i64 = sys_mmap(16); let sy2: *i64 = sys_mmap(16); let fv2: *i64 = sys_mmap(16) 92 let r1: i64 = create_pq(fd, CPQ_CODE, device, pq1, sy1, fv1) 93 let r2: i64 = create_pq(fd, CPQ_CODE, device, pq2, sy2, fv2) 94 p(" PAGINGQUEUE #1 ret=" as *u8); n(r1); p(" pq=" as *u8); x(pq1[0]); p(" sync=" as *u8); x(sy1[0]); p(" fenceVA=" as *u8); x(fv1[0]); p("\n" as *u8) 95 p(" PAGINGQUEUE #2 ret=" as *u8); n(r2); p(" pq=" as *u8); x(pq2[0]); p(" sync=" as *u8); x(sy2[0]); p(" fenceVA=" as *u8); x(fv2[0]); p("\n" as *u8) 96 97 // PROOF the fence page is genuinely mapped: DEREFERENCE fence_VA #1 and read its u64 fence value. 98 // (If the VA were bogus this read faults -> the process dies before GREEN. Reaching here = the page is real.) 99 var fence_val: i64 = 0 - 1 100 var fva_ok: i64 = 0 101 if r1 == 0 { if fv1[0] != 0 { if fv1[0] < USER_CANON { let fpp: *i64 = fv1[0] as *i64; fence_val = fpp[0]; fva_ok = 1 } } } 102 p(" fence page DEREFERENCED at " as *u8); x(fv1[0]); p(" -> fence_value=" as *u8); n(fence_val); p(" (read did not fault => page is REAL)\n" as *u8) 103 104 // ---- TAMPER matrix ---- 105 let tp: *i64 = sys_mmap(16); let ts: *i64 = sys_mmap(16); let tv: *i64 = sys_mmap(16) 106 let t1: i64 = create_pq(fd, CPQ_CODE, 0xdeadbeef, tp, ts, tv); let t1pq: i64 = tp[0] // bogus device 107 let t2: i64 = create_pq(fd, CPQ_BADSZ, device, tp, ts, tv) // wrong _IOC_SIZE 108 let nfd: i64 = sys_openat_rd("/dev/null" as *u8) 109 let t3: i64 = create_pq(nfd, CPQ_CODE, device, tp, ts, tv) // non-dxg fd 110 if nfd >= 0 { sys_close(nfd) } 111 p(" [tamper] bogus-device ret=" as *u8); n(t1); p(" pq=" as *u8); x(t1pq) 112 p(" | wrong-size ret=" as *u8); n(t2); p(" | non-dxg-fd ret=" as *u8); n(t3); p("\n" as *u8) 113 sys_close(fd) 114 115 var made1: i64 = 0; if r1 == 0 { if pq1[0] != 0 { if sy1[0] != 0 { made1 = 1 } } } 116 var distinct: i64 = 0; if pq1[0] != 0 { if pq2[0] != 0 { if pq1[0] != pq2[0] { distinct = 1 } } } 117 var tamper_ok: i64 = 0; if t1 != 0 { if t1pq == 0 { if t2 != 0 { if t3 != 0 { tamper_ok = 1 } } } } 118 119 var pass: i64 = 0 120 if eret == 0 { if n_discrete == 1 { if aor == 0 { if dr == 0 { 121 if made1 == 1 { if fva_ok == 1 { if r2 == 0 { if distinct == 1 { if tamper_ok == 1 { pass = 1 } } } } } } } } } 122 123 p(" checks: chain_ok=" as *u8); var ch: i64=0; if eret==0 { if aor==0 { if dr==0 { ch=1 } } } n(ch) 124 p(" pq1_made=" as *u8); n(made1); p(" fence_page_mapped=" as *u8); n(fva_ok); p(" pq2_ok=" as *u8); n(r2==0); p(" distinct_queues=" as *u8); n(distinct); p(" tamper_ok=" as *u8); n(tamper_ok); p("\n" as *u8) 125 126 let lfd: i64 = sys_openat_append("knowledge/status/gpu_dxg.log" as *u8, 0x1a4) 127 if pass == 1 { 128 p("DXGPQGATE verdict=GREEN reason=raw-/dev/dxg-LX_DXCREATEPAGINGQUEUE-makes-a-residency-queue+fence-page-on-the-5080 (device from R3; pq+sync handles written; fence_VA dereferenced w/o fault = REAL mapped page; two creates -> distinct queues; bogus-device makes no queue; wrong-size/non-dxg -ENOTTY; wrapper-free) SCOPE=residency-object+fence-page-only-NO-throughput; allocation=R4d\n" as *u8) 129 if lfd >= 0 { 130 fp(lfd, "DXGPQGATE verdict=GREEN rung=R4c-gpu-paging-queue device=discrete-RTX5080 via=raw-/dev/dxg-LX_DXCREATEPAGINGQUEUE(0xC0204707,size32,pq@8,sync@12,fenceVA@16) device_handle=" as *u8); fx(lfd, device) 131 fp(lfd, " pq1=" as *u8); fx(lfd, pq1[0]); fp(lfd, " sync1=" as *u8); fx(lfd, sy1[0]); fp(lfd, " fence_cpu_va=" as *u8); fx(lfd, fv1[0]); fp(lfd, " fence_value=" as *u8); fx(lfd, fence_val) 132 fp(lfd, " pq2=" as *u8); fx(lfd, pq2[0]); fp(lfd, " fence_page_dereferenced_no_fault=1 distinct=1 tamper=rejected(bogus-device-no-queue+wrong-IOC_SIZE-ENOTTY+non-dxg-ENOTTY) wrapper-free scope=residency-object+fence-page-only-NO-throughput next=R4d-LX_DXCREATEALLOCATION\n" as *u8) 133 sys_close(lfd) 134 } 135 sys_exit(0); return 0 136 } 137 p("DXGPQGATE verdict=RED (one of chain/pq1/fence-page/pq2/distinct/tamper not satisfied)\n" as *u8) 138 if lfd >= 0 { fp(lfd, "DXGPQGATE verdict=RED see-console\n" as *u8); sys_close(lfd) } 139 sys_exit(1) 140 return 1 141}