_gpu_dxg_r2_recon.nx source

1// _gpu_dxg_r2_recon.nx -- SOVEREIGN-GPU ladder R2 RECON (adapter-open from LUID). 2// R0 enumerated, R1 identified the discrete RTX 5080 by its ADAPTERTYPE bit. R2 takes the IDENTITY 3// (the discrete adapter's LUID) and opens a fresh kernel ADAPTER HANDLE for it through the raw 4// /dev/dxg ioctl LX_DXOPENADAPTERFROMLUID -- the precursor to LX_DXCREATEDEVICE (R3). 5// 6// ABI (WSL2-Linux-Kernel linux-msft-wsl-6.6.y, include/uapi/misc/d3dkmthk.h): 7// #define LX_DXOPENADAPTERFROMLUID _IOWR(0x47, 0x01, struct d3dkmt_openadapterfromluid) 8// = (3<<30)|(12<<16)|(0x47<<8)|0x01 = 0xC00C4701 (recon-pinned in R1 pass) 9// struct winluid { __u32 a; __u32 b; } // 8 bytes 10// struct d3dkmt_openadapterfromluid { struct winluid adapter_luid; d3dkmthandle adapter_handle; } 11// -> luid @0 (8B, IN), adapter_handle @8 (4B, OUT) // 12 bytes 12// 13// This is RECON ONLY: it prints the REAL ioctl return + the opened handle + a tamper matrix so the 14// gate can author a verdict. It writes NOTHING to the status log. raw syscalls only (no libc/vulkan/cuda). 15// license_tier: ORIGINAL 16import "nx_syscalls.nx" 17 18const ENUM2_CODE: i64 = 0xC0104714 // LX_DXENUMADAPTERS2 19const QAI_CODE: i64 = 0xC0184709 // LX_DXQUERYADAPTERINFO (ADAPTERTYPE) 20const OAFL_CODE: i64 = 0xC00C4701 // LX_DXOPENADAPTERFROMLUID 21const OAFL_BOGUS: i64 = 0x990C4701 // magic-0x99 tamper of the open code 22 23func p(s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(1,s,nn); return 0 } 24func n(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 25func x(v: i64) -> i64 { p("0x" as *u8); let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } var i:i64=0; let o:*u8=sys_mmap(20); while i<k{o[i]=bb[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 26 27// query ADAPTERTYPE bitfield for an enum handle (returns ioctl ret; value -> outv[0]). 28func query_type(fd: i64, handle: i64, qtype: i64, psize: i64, outv: *i64) -> i64 { 29 let priv: *u8 = sys_mmap(64); var z: i64 = 0; while z < 64 { priv[z] = 0 as u8; z = z + 1 } 30 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 31 let h: *i64 = (req as i64 + 0) as *i64; h[0] = (handle & 0xffffffff) | ((qtype & 0xffffffff) << 32) 32 let pd: *i64 = (req as i64 + 8) as *i64; pd[0] = priv as i64 33 let pds: *i64 = (req as i64 + 16) as *i64; pds[0] = psize & 0xffffffff 34 let ret: i64 = sys_ioctl(fd, QAI_CODE, req as i64) 35 outv[0] = (priv[0] as i64)|((priv[1] as i64)<<8)|((priv[2] as i64)<<16)|((priv[3] as i64)<<24) 36 return ret 37} 38 39// open an adapter from a raw 8-byte LUID (luid_lo, luid_hi) via OAFL_CODE; opened handle -> outh[0]. 40func open_from_luid(fd: i64, code: i64, luid_lo: i64, luid_hi: i64, outh: *i64) -> i64 { 41 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 42 let lo: *i64 = (req as i64 + 0) as *i64; lo[0] = (luid_lo & 0xffffffff) | ((luid_hi & 0xffffffff) << 32) 43 let ret: i64 = sys_ioctl(fd, code, req as i64) 44 outh[0] = (req[8] as i64)|((req[9] as i64)<<8)|((req[10] as i64)<<16)|((req[11] as i64)<<24) 45 return ret 46} 47 48func main() -> i64 { 49 p("=== R2 RECON: open adapter handle from the discrete RTX 5080 LUID (raw /dev/dxg) ===\n" as *u8) 50 let fd: i64 = sys_openat_rd("/dev/dxg" as *u8) 51 if fd < 0 { p("open(/dev/dxg) failed\n" as *u8); sys_exit(1); return 1 } 52 53 let ainfo: *u8 = sys_mmap(4096); var z: i64 = 0; while z < 4096 { ainfo[z] = 0 as u8; z = z + 1 } 54 let ereq: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { ereq[y] = 0 as u8; y = y + 1 } 55 ereq[0] = 8 as u8; let r8: *i64 = (ereq as i64 + 8) as *i64; r8[0] = ainfo as i64 56 sys_ioctl(fd, ENUM2_CODE, ereq as i64) 57 let nc: i64 = (ereq[0] as i64)|((ereq[1] as i64)<<8)|((ereq[2] as i64)<<16)|((ereq[3] as i64)<<24) 58 p(" enum num_adapters=" as *u8); n(nc); p("\n" as *u8) 59 60 // find the discrete adapter (adaptertype bit4) and capture its 8-byte LUID. 61 let v: *i64 = sys_mmap(16) 62 var disc_lo: i64 = 0; var disc_hi: i64 = 0; var found: i64 = 0 63 var ai: i64 = 0 64 while ai < nc { 65 let base: i64 = ai * 20 66 let eh: i64 = (ainfo[base] as i64)|((ainfo[base+1] as i64)<<8)|((ainfo[base+2] as i64)<<16)|((ainfo[base+3] as i64)<<24) 67 let lo: i64 = (ainfo[base+4] as i64)|((ainfo[base+5] as i64)<<8)|((ainfo[base+6] as i64)<<16)|((ainfo[base+7] as i64)<<24) 68 let hi: i64 = (ainfo[base+8] as i64)|((ainfo[base+9] as i64)<<8)|((ainfo[base+10] as i64)<<16)|((ainfo[base+11] as i64)<<24) 69 let qret: i64 = query_type(fd, eh, 15, 4, v); let t: i64 = v[0] 70 let disc: i64 = (t>>4)&1; let sw: i64 = (t>>2)&1 71 p(" adapter[" as *u8); n(ai); p("] luid=" as *u8); x(hi); x(lo); p(" type=" as *u8); x(t); p(" discrete=" as *u8); n(disc); p("\n" as *u8) 72 if disc == 1 { if sw == 0 { if found == 0 { disc_lo = lo; disc_hi = hi; found = 1 } } } 73 ai = ai + 1 74 } 75 p(" discrete LUID = " as *u8); x(disc_hi); x(disc_lo); p(" found=" as *u8); n(found); p("\n" as *u8) 76 77 // REAL CALL: open adapter from the discrete LUID. 78 let oh: *i64 = sys_mmap(16) 79 let r_real: i64 = open_from_luid(fd, OAFL_CODE, disc_lo, disc_hi, oh) 80 p(" REAL open_from_luid ret=" as *u8); n(r_real); p(" opened_handle=" as *u8); x(oh[0]); p("\n" as *u8) 81 82 p("\n-- tamper matrix (all MUST be != 0 = a real errno; opened handle MUST be 0) --\n" as *u8) 83 let th: *i64 = sys_mmap(16) 84 let t1: i64 = open_from_luid(fd, OAFL_CODE, 0xdeadbeef, 0xdeadbeef, th) 85 p(" T1 bogus-LUID ret=" as *u8); n(t1); p(" handle=" as *u8); x(th[0]); p("\n" as *u8) 86 let t2: i64 = open_from_luid(fd, OAFL_BOGUS, disc_lo, disc_hi, th) 87 p(" T2 bogus-ioctl-code ret=" as *u8); n(t2); p(" handle=" as *u8); x(th[0]); p("\n" as *u8) 88 let nfd: i64 = sys_openat_rd("/dev/null" as *u8) 89 let t3: i64 = open_from_luid(nfd, OAFL_CODE, disc_lo, disc_hi, th) 90 p(" T3 non-dxg-fd ret=" as *u8); n(t3); p(" handle=" as *u8); x(th[0]); p("\n" as *u8) 91 if nfd >= 0 { sys_close(nfd) } 92 93 var rok: i64 = 0; if r_real == 0 { if oh[0] != 0 { rok = 1 } } 94 var tamper_ok: i64 = 0; if t1 != 0 { if t2 != 0 { if t3 != 0 { tamper_ok = 1 } } } 95 p("\nGATE-INPUT: real_open_ok=" as *u8); n(rok); p(" tampers_all_fail=" as *u8); n(tamper_ok); p("\n" as *u8) 96 97 sys_close(fd) 98 p("=== R2 RECON DONE ===\n" as *u8) 99 return 0 100}