_gpu_dxg_r4d_probe2.nx source

1// _gpu_dxg_r4d_probe2.nx -- SOVEREIGN-GPU ladder R4d PROBE pass 2: locate the allocation_info pointer. 2// 3// Probe-1 found alloc_count @44 (set @44=1 -> kernel reads the NULL allocation_info array -> -EFAULT(-14)). 4// Now, with device@0 + alloc_count@44=1, point each 8-aligned u64 offset at a VALID readable buffer: the 5// offset that makes the -14 EFAULT go AWAY (kernel successfully reads the d3dkmt_allocationinfo2 entry, then 6// fails later with -EINVAL etc.) IS `allocation_info`. (@40 is skipped: a u64 there would clobber 7// alloc_count@44.) raw syscalls only. No log writes. license_tier: ORIGINAL 8import "nx_syscalls.nx" 9 10const ENUM2_CODE: i64 = 0xC0104714 11const QAI_CODE: i64 = 0xC0184709 12const OAFL_CODE: i64 = 0xC00C4701 13const CDEV_CODE: i64 = 0xC0404702 14const CALLOC_CODE: i64 = 0xC0484706 15 16func p(s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(1,s,nn); return 0 } 17func n(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 18func x(v: i64) -> i64 { p("0x" as *u8); let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } var i:i64=0; let o:*u8=sys_mmap(20); while i<k{o[i]=bb[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 19func rd32(buf: *u8, off: i64) -> i64 { return (buf[off] as i64)|((buf[off+1] as i64)<<8)|((buf[off+2] as i64)<<16)|((buf[off+3] as i64)<<24) } 20 21func query_type(fd: i64, handle: i64, qtype: i64, psize: i64, outv: *i64) -> i64 { 22 let priv: *u8 = sys_mmap(64); var zz: i64 = 0; while zz < 64 { priv[zz] = 0 as u8; zz = zz + 1 } 23 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 24 let h: *i64 = (req as i64 + 0) as *i64; h[0] = (handle & 0xffffffff) | ((qtype & 0xffffffff) << 32) 25 let pd: *i64 = (req as i64 + 8) as *i64; pd[0] = priv as i64 26 let pds: *i64 = (req as i64 + 16) as *i64; pds[0] = psize & 0xffffffff 27 let ret: i64 = sys_ioctl(fd, QAI_CODE, req as i64); outv[0] = rd32(priv, 0); return ret 28} 29func open_from_luid(fd: i64, luid_lo: i64, luid_hi: i64, outh: *i64) -> i64 { 30 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 31 let lo: *i64 = (req as i64 + 0) as *i64; lo[0] = (luid_lo & 0xffffffff) | ((luid_hi & 0xffffffff) << 32) 32 let ret: i64 = sys_ioctl(fd, OAFL_CODE, req as i64); outh[0] = rd32(req, 8); return ret 33} 34func create_device(fd: i64, adapter: i64, outd: *i64) -> i64 { 35 let buf: *u8 = sys_mmap(512); var bz: i64 = 0; while bz < 512 { buf[bz] = 0 as u8; bz = bz + 1 } 36 let a0: *i64 = (buf as i64) as *i64; a0[0] = adapter & 0xffffffff 37 let ret: i64 = sys_ioctl(fd, CDEV_CODE, buf as i64); outd[0] = rd32(buf, 12); return ret 38} 39// fire with device@0, alloc_count@44=cnt, and an optional u64 pointer at `ptroff`. 40func fire_ptr(fd: i64, device: i64, cnt: i64, ptroff: i64, ptrval: i64) -> i64 { 41 let buf: *u8 = sys_mmap(512); var bz: i64 = 0; while bz < 512 { buf[bz] = 0 as u8; bz = bz + 1 } 42 let d0: *i64 = (buf as i64) as *i64; d0[0] = device & 0xffffffff 43 let ac: *i64 = (buf as i64 + 44) as *i64; ac[0] = cnt & 0xffffffff // NB writes bytes 44..51 low; high cleared next 44 let acw: *u8 = (buf as i64 + 44) as *u8; acw[4]=0 as u8; acw[5]=0 as u8; acw[6]=0 as u8; acw[7]=0 as u8 45 if ptroff > 0 { let pp: *i64 = (buf as i64 + ptroff) as *i64; pp[0] = ptrval } 46 return sys_ioctl(fd, CALLOC_CODE, buf as i64) 47} 48 49func main() -> i64 { 50 p("=== R4d PROBE-2: locate allocation_info pointer (alloc_count@44=1) ===\n" as *u8) 51 let fd: i64 = sys_openat_rd("/dev/dxg" as *u8) 52 if fd < 0 { p("open(/dev/dxg) failed\n" as *u8); sys_exit(1); return 1 } 53 let ainfo: *u8 = sys_mmap(4096); var z: i64 = 0; while z < 4096 { ainfo[z] = 0 as u8; z = z + 1 } 54 let ereq: *u8 = sys_mmap(64); ereq[0] = 8 as u8; let r8: *i64 = (ereq as i64 + 8) as *i64; r8[0] = ainfo as i64 55 sys_ioctl(fd, ENUM2_CODE, ereq as i64); let nc: i64 = rd32(ereq, 0) 56 let v: *i64 = sys_mmap(16); var disc_lo: i64 = 0; var disc_hi: i64 = 0 57 var ai: i64 = 0 58 while ai < nc { 59 let base: i64 = ai * 20; let eh: i64 = rd32(ainfo, base) 60 let qret: i64 = query_type(fd, eh, 15, 4, v); let t: i64 = v[0] 61 if qret == 0 { if ((t>>4)&1) == 1 { if ((t>>2)&1) == 0 { disc_lo = rd32(ainfo, base+4); disc_hi = rd32(ainfo, base+8) } } } 62 ai = ai + 1 63 } 64 let ah: *i64 = sys_mmap(16); open_from_luid(fd, disc_lo, disc_hi, ah) 65 let dh: *i64 = sys_mmap(16); create_device(fd, ah[0], dh); let device: i64 = dh[0] 66 67 // valid readable+writable buffer for the allocationinfo2 entry (zeroed, page-sized). 68 let aibuf: *u8 = sys_mmap(4096); var bz: i64 = 0; while bz < 4096 { aibuf[bz] = 0 as u8; bz = bz + 1 } 69 70 let efault_baseline: i64 = fire_ptr(fd, device, 1, 0, 0) // count=1, no ptr -> expect -14 71 p(" count=1, allocation_info=NULL -> ret=" as *u8); n(efault_baseline); p(" (expect -14 EFAULT)\n\n" as *u8) 72 p(" ptr offset : ret <- offset where -14 RESOLVES = allocation_info\n" as *u8) 73 let offs: *i64 = sys_mmap(256) 74 offs[0]=8; offs[1]=16; offs[2]=24; offs[3]=32; offs[4]=48; offs[5]=56; offs[6]=64; offs[7]=0 75 var oi: i64 = 0 76 while offs[oi] != 0 { 77 let o: i64 = offs[oi] 78 let r: i64 = fire_ptr(fd, device, 1, o, aibuf as i64) 79 p(" @" as *u8); n(o); p(" : ret=" as *u8); n(r) 80 if r != 0 - 14 { p(" <== NOT EFAULT (candidate allocation_info)" as *u8) } 81 p("\n" as *u8) 82 oi = oi + 1 83 } 84 sys_close(fd) 85 p("=== R4d PROBE-2 DONE ===\n" as *u8) 86 return 0 87}