_gpu_dxg_r1_recon5.nx source

1// _gpu_dxg_r1_recon5.nx -- R1 recon pass 5: confirm the NO-FALSE-GREEN tamper behavior for the 2// ADAPTERTYPE(15) query so a real gate can author a verdict, and re-confirm the differentiated 3// real values. Tampers that MUST go to a real errno (not ret=0, not the real value): 4// (T1) bogus adapter handle 0xdeadbeef, type=15, size=4 -> expect -EINVAL (handle resolves NULL) 5// (T2) valid handle, size=0 -> expect -EINVAL (size==0 check) 6// (T3) valid handle, bogus type=999 -> host rejects (expect != 0) 7// (T4) same ioctl on a NON-dxg fd (/dev/null) -> expect -ENOTTY 8// Plus prints the two REAL adaptertype values so the gate can assert they differ + match the 9// discrete/integrated bits. raw syscalls only. license_tier: ORIGINAL 10import "nx_syscalls.nx" 11 12const DXG_LX_DXENUMADAPTERS2: i64 = 0xC0104714 13const QAI_CODE: i64 = 0xC0184709 14 15func p(s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(1,s,nn); return 0 } 16func n(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 17func x(v: i64) -> i64 { p("0x" as *u8); let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } var i:i64=0; let o:*u8=sys_mmap(20); while i<k{o[i]=bb[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 18 19func query_on(fd: i64, handle: i64, qtype: i64, psize: i64, outv: *i64) -> i64 { 20 let priv: *u8 = sys_mmap(64); var z: i64 = 0; while z < 64 { priv[z] = 0 as u8; z = z + 1 } 21 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 22 let h: *i64 = (req as i64 + 0) as *i64; h[0] = (handle & 0xffffffff) | ((qtype & 0xffffffff) << 32) 23 let pd: *i64 = (req as i64 + 8) as *i64; pd[0] = priv as i64 24 let pds: *i64 = (req as i64 + 16) as *i64; pds[0] = psize & 0xffffffff 25 let ret: i64 = sys_ioctl(fd, QAI_CODE, req as i64) 26 outv[0] = (priv[0] as i64)|((priv[1] as i64)<<8)|((priv[2] as i64)<<16)|((priv[3] as i64)<<24) 27 return ret 28} 29 30func main() -> i64 { 31 p("=== R1 RECON pass5: tamper matrix + differentiated real values ===\n" as *u8) 32 let fd: i64 = sys_openat_rd("/dev/dxg" as *u8) 33 if fd < 0 { p("open fail\n" as *u8); sys_exit(1); return 1 } 34 let ainfo: *u8 = sys_mmap(4096); var z: i64 = 0; while z < 4096 { ainfo[z] = 0 as u8; z = z + 1 } 35 let ereq: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { ereq[y] = 0 as u8; y = y + 1 } 36 ereq[0] = 8 as u8; let r8: *i64 = (ereq as i64 + 8) as *i64; r8[0] = ainfo as i64 37 sys_ioctl(fd, DXG_LX_DXENUMADAPTERS2, ereq as i64) 38 let nc: i64 = (ereq[0] as i64)|((ereq[1] as i64)<<8)|((ereq[2] as i64)<<16)|((ereq[3] as i64)<<24) 39 let h0: i64 = (ainfo[0] as i64)|((ainfo[1] as i64)<<8)|((ainfo[2] as i64)<<16)|((ainfo[3] as i64)<<24) 40 let h1: i64 = (ainfo[20] as i64)|((ainfo[21] as i64)<<8)|((ainfo[22] as i64)<<16)|((ainfo[23] as i64)<<24) 41 42 let v: *i64 = sys_mmap(16) 43 let r0: i64 = query_on(fd, h0, 15, 4, v); let val0: i64 = v[0] 44 let r1: i64 = query_on(fd, h1, 15, 4, v); let val1: i64 = v[0] 45 p("REAL adapter[0] type=15 ret=" as *u8); n(r0); p(" value=" as *u8); x(val0); p(" hybrid_discrete=" as *u8); n((val0>>4)&1); p("\n" as *u8) 46 p("REAL adapter[1] type=15 ret=" as *u8); n(r1); p(" value=" as *u8); x(val1); p(" hybrid_integrated=" as *u8); n((val1>>5)&1); p("\n" as *u8) 47 var differ: i64 = 0; if val0 != val1 { differ = 1 } 48 p("values_differ=" as *u8); n(differ); p("\n" as *u8) 49 50 p("\n-- tamper matrix (all MUST be != 0 = a real errno) --\n" as *u8) 51 let t1: i64 = query_on(fd, 0xdeadbeef, 15, 4, v); p(" T1 bogus-handle ret=" as *u8); n(t1); p("\n" as *u8) 52 let t2: i64 = query_on(fd, h0, 15, 0, v); p(" T2 size=0 ret=" as *u8); n(t2); p("\n" as *u8) 53 let t3: i64 = query_on(fd, h0, 999, 4, v); p(" T3 bogus-type=999 ret=" as *u8); n(t3); p("\n" as *u8) 54 let nfd: i64 = sys_openat_rd("/dev/null" as *u8) 55 let t4: i64 = query_on(nfd, h0, 15, 4, v); p(" T4 non-dxg-fd(/dev/null) ret=" as *u8); n(t4); p("\n" as *u8) 56 sys_close(nfd) 57 58 var tamper_all_fail: i64 = 0 59 if t1 != 0 { if t2 != 0 { if t4 != 0 { tamper_all_fail = 1 } } } 60 p("\nGATE-INPUT: real_call_ok=" as *u8); var rok: i64=0; if r0==0 { if r1==0 { rok=1 } } n(rok) 61 p(" values_differ=" as *u8); n(differ) 62 p(" tampers_T1_T2_T4_fail=" as *u8); n(tamper_all_fail) 63 p(" T3_bogustype=" as *u8); n(t3); p("\n" as *u8) 64 65 sys_close(fd) 66 p("=== R1 RECON pass5 DONE ===\n" as *u8) 67 return 0 68}