nx_gpu_dxg_inventory_candidate_t366.nx source
↩ module page · 181 lines · 10811 B
1// nx_gpu_dxg_probe.nx -- SOVEREIGN-GPU foundation organ (R0): reach the REAL RTX 5080 through
2// its actual device interface, /dev/dxg (the WSL dxgkrnl GPU-paravirt thunk), with RAW syscalls
3// ONLY. NO libvulkan / libcuda / libdxcore / libd3d12 / libc -- the emitted elf links NOTHING.
4// Every byte here is open(2) / ioctl(2) / close(2) / write(2) directly via __syscall.
5//
6// This is the productionized form of the recon _dxg_enum_probe: a reusable probe FUNCTION
7// (dxg_enumadapters) that the gate (_gpu_dxg_gate.nx) calls, plus a standalone main() so the
8// organ can be run on its own. It performs the MINIMAL real call -- LX_DXENUMADAPTERS2 -- and
9// reads back the REAL adapter count + adapter[0] handle + LUID from the 5080.
10//
11// ABI (pinned from WSL2-Linux-Kernel linux-msft-wsl-6.6.y, include/uapi/misc/d3dkmthk.h;
12// CONFIRMED live: the kernel accepted exactly 0xC0104714 and returned ret=0, num_adapters=2):
13// #define LX_DXENUMADAPTERS2 _IOWR(0x47, 0x14, struct d3dkmt_enumadapters2)
14// = (dir _IOWR=3 <<30) | (size 16 <<16) | (magic 0x47 <<8) | (nr 0x14) = 0xC0104714
15// struct d3dkmt_enumadapters2 { __u32 num_adapters; __u32 reserved; __u64 *adapters; } // 16B
16// struct d3dkmt_adapterinfo { d3dkmthandle handle(4); winluid luid(8); u32 num_sources;
17// u32 present_move_regions_preferred; } // 20B
18//
19// PROTOCOL: set num_adapters = capacity, adapters = ptr to an array of d3dkmt_adapterinfo; the
20// kernel writes the REAL count back into num_adapters and fills the array.
21// NO-FALSE-GREEN: the gate also issues a TAMPER (magic-0x99 ioctl) which the real device rejects
22// with a real errno (-ENOTTY=-25) != the real ret=0; that distinguishes a real device response
23// from a no-op. (The gate owns the verdict; this organ exposes the raw mechanism + a result
24// struct it can inspect.)
25//
26// SCOPE (NO-WAVE): this rung proves ONLY "Nishi reaches the real RTX 5080 sovereignly via the
27// /dev/dxg last-mile". It claims NO throughput / speedup / exceed -- that is R7 (a real cuBLAS
28// head-to-head, many rungs up). Do NOT read a perf number out of this.
29// license_tier: ORIGINAL
30import "nx_syscalls.nx"
31const DXG_MAGIC_4096: i64 = 4096
32
33// LX_DXENUMADAPTERS2 ioctl code (see derivation above). Sovereignly a plain constant.
34const DXG_LX_DXENUMADAPTERS2: i64 = 0xC0104714
35// A non-dxg magic used as the no-false-green tamper. The real device rejects it (-ENOTTY).
36const DXG_TAMPER_MAGIC: i64 = 0x99000000
37
38// dxg_result layout (a sovereign 64-byte struct the probe fills so the gate can read it back):
39// off 0 i64 fd (the raw fd from openat; <0 = open failed)
40// off 8 i64 ioctl_ret (LX_DXENUMADAPTERS2 return; 0 = kernel accepted)
41// off 16 i64 num_adapters (REAL count the kernel wrote back)
42// off 24 i64 handle0 (adapter[0] packed d3dkmthandle)
43// off 32 i64 luid_a (adapter[0] winluid low -- a REAL non-zero LUID on success)
44// off 40 i64 luid_b (adapter[0] winluid high)
45// off 48 i64 tamper_ret (magic-0x99 ioctl return; expect a real errno, e.g. -25)
46const DXR_FD: i64 = 0
47const DXR_IOCTL_RET: i64 = 8
48const DXR_NUM_ADAPTERS: i64 = 16
49const DXR_HANDLE0: i64 = 24
50const DXR_LUID_A: i64 = 32
51const DXR_LUID_B: i64 = 40
52const DXR_TAMPER_RET: i64 = 48
53
54func dxr_set(res: *u8, off: i64, v: i64) -> i64 { let p: *i64 = (res as i64 + off) as *i64; p[0] = v; return 0 }
55func dxr_get(res: *u8, off: i64) -> i64 { let p: *i64 = (res as i64 + off) as *i64; return p[0] }
56
57// Open a path (raw openat) and immediately issue LX_DXENUMADAPTERS2 + the tamper control, writing
58// every real value into `res`. `path` is parametric so the gate can also point it at a NON-dxg fd
59// (e.g. /dev/null) to prove the green depends on the REAL dxgkrnl device, not any open fd.
60// Returns the LX_DXENUMADAPTERS2 ioctl return (0 = accepted), or the open errno if open failed.
61func dxg_enumadapters(path: *u8, res: *u8) -> i64 {
62 var z0: i64 = 0; while z0 < 56 { let b: *u8 = (res as i64 + z0) as *u8; b[0] = 0 as u8; z0 = z0 + 1 }
63
64 let fd: i64 = sys_openat_rd(path)
65 dxr_set(res, DXR_FD, fd)
66 if fd < 0 { return fd }
67
68 // adapter-info output buffer: capacity 8 entries * 20 bytes = 160B; page-mmap'd + zeroed.
69 let ainfo: *u8 = sys_mmap(DXG_MAGIC_4096)
70 var z: i64 = 0; while z < DXG_MAGIC_4096 { ainfo[z] = 0 as u8; z = z + 1 }
71
72 // struct d3dkmt_enumadapters2 (16B): [0]=u32 num_adapters(IN cap=8) [4]=u32 reserved [8]=u64 *adapters
73 let req: *u8 = sys_mmap(64)
74 var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 }
75 req[0] = 8 as u8; req[1] = 0 as u8; req[2] = 0 as u8; req[3] = 0 as u8
76 let r8: *i64 = (req as i64 + 8) as *i64
77 r8[0] = ainfo as i64
78
79 // no-false-green control: magic-0x99 ioctl -> the real device rejects with a real errno.
80 let tamper: i64 = sys_ioctl(fd, DXG_TAMPER_MAGIC, req as i64)
81 dxr_set(res, DXR_TAMPER_RET, tamper)
82
83 // REAL CALL: LX_DXENUMADAPTERS2 -> kernel fills the array + writes the real count back.
84 let ret: i64 = sys_ioctl(fd, DXG_LX_DXENUMADAPTERS2, req as i64)
85 dxr_set(res, DXR_IOCTL_RET, ret)
86
87 let nc: i64 = (req[0] as i64)|((req[1] as i64)<<8)|((req[2] as i64)<<16)|((req[3] as i64)<<24)
88 dxr_set(res, DXR_NUM_ADAPTERS, nc)
89
90 let h0: i64 = (ainfo[0] as i64)|((ainfo[1] as i64)<<8)|((ainfo[2] as i64)<<16)|((ainfo[3] as i64)<<24)
91 let la: i64 = (ainfo[4] as i64)|((ainfo[5] as i64)<<8)|((ainfo[6] as i64)<<16)|((ainfo[7] as i64)<<24)
92 let lb: i64 = (ainfo[8] as i64)|((ainfo[9] as i64)<<8)|((ainfo[10] as i64)<<16)|((ainfo[11] as i64)<<24)
93 dxr_set(res, DXR_HANDLE0, h0)
94 dxr_set(res, DXR_LUID_A, la)
95 dxr_set(res, DXR_LUID_B, lb)
96
97 sys_close(fd)
98 return ret
99}
100
101// ---- standalone print helpers + main (the organ also runs on its own) ----
102func gp_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
103func gp_n(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
104func gp_x(v: i64) -> i64 { gp_p("0x" as *u8); let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } var i:i64=0; let o:*u8=sys_mmap(20); while i<k{o[i]=bb[k-1-i];i=i+1} sys_write(1,o,k); return 0 }
105
106func main() -> i64 {
107 let res: *u8 = sys_mmap(64)
108 let ret: i64 = dxg_enumadapters("/dev/dxg" as *u8, res)
109
110 gp_p("DXGPROBE open(/dev/dxg) fd=" as *u8); gp_n(dxr_get(res, DXR_FD)); gp_p("\n" as *u8)
111 if dxr_get(res, DXR_FD) < 0 { gp_p("DXGPROBE verdict=RED reason=open-failed\n" as *u8); sys_exit(1); return 1 }
112 gp_p("DXGPROBE tamper(magic=0x99) ret=" as *u8); gp_n(dxr_get(res, DXR_TAMPER_RET)); gp_p("\n" as *u8)
113 gp_p("DXGPROBE ioctl LX_DXENUMADAPTERS2 code=" as *u8); gp_x(DXG_LX_DXENUMADAPTERS2)
114 gp_p(" ret=" as *u8); gp_n(ret); gp_p("\n" as *u8)
115 gp_p("DXGPROBE num_adapters(after)=" as *u8); gp_n(dxr_get(res, DXR_NUM_ADAPTERS)); gp_p("\n" as *u8)
116 gp_p("DXGPROBE adapter[0] handle=" as *u8); gp_x(dxr_get(res, DXR_HANDLE0))
117 gp_p(" luid.a=" as *u8); gp_x(dxr_get(res, DXR_LUID_A))
118 gp_p(" luid.b=" as *u8); gp_x(dxr_get(res, DXR_LUID_B)); gp_p("\n" as *u8)
119
120 if ret == 0 { gp_p("DXGPROBE verdict=GREEN reason=real-adapter-data-from-5080\n" as *u8) }
121 else { gp_p("DXGPROBE verdict=PARTIAL reason=ioctl-reached-device-nonzero-ret\n" as *u8) }
122 return 0
123}
124
125// Additive caller-capacity inventory API. Legacy dxg_enumadapters remains limited to adapter0.
126// ABI constants describe d3dkmt_adapterinfo, not an estate capacity policy.
127const DXI_ABI_BYTES:i64=20
128const DXI_U32_MAX:i64=4294967295
129const DXI_BAD_CAPACITY:i64=-801
130const DXI_BAD_COUNT:i64=-802
131const DXI_SHORT_INPUT:i64=-803
132const DXI_SHORT_OUTPUT:i64=-804
133const DXI_ALLOCATION:i64=-805
134struct DxgAdapterRecord {handle:i64,luid_low:i64,luid_high:i64,sources:i64,present_move_regions:i64}
135func dxi_u32(b:*u8,o:i64)->i64{return (b[o] as i64)|((b[o+1] as i64)<<8)|((b[o+2] as i64)<<16)|((b[o+3] as i64)<<24)}
136func dxi_extent(capacity:i64)->i64{
137 if capacity<=0||capacity>DXI_U32_MAX{return DXI_BAD_CAPACITY}
138 if capacity>9223372036854775807/DXI_ABI_BYTES{return DXI_BAD_CAPACITY}
139 return capacity*DXI_ABI_BYTES
140}
141// Validate every extent before touching destination. Count zero is a valid empty observation.
142func dxi_decode(raw:*u8,raw_bytes:i64,count:i64,capacity:i64,out:*DxgAdapterRecord,out_bytes:i64)->i64{
143 let extent:i64=dxi_extent(capacity);if extent<0{return extent}
144 if count<0||count>capacity{return DXI_BAD_COUNT}
145 if raw_bytes<extent{return DXI_SHORT_INPUT}
146 if count>9223372036854775807/__size_of(DxgAdapterRecord){return DXI_SHORT_OUTPUT}
147 let needed:i64=count*__size_of(DxgAdapterRecord)
148 if out_bytes<needed{return DXI_SHORT_OUTPUT}
149 if count==0{return 0}
150 if (raw as i64)<=0{return DXI_SHORT_INPUT}
151 if (out as i64)<=0{return DXI_SHORT_OUTPUT}
152 var i:i64=0
153 while i<count{
154 let p:*DxgAdapterRecord=((out as i64)+i*__size_of(DxgAdapterRecord)) as *DxgAdapterRecord
155 let o:i64=i*DXI_ABI_BYTES
156 p.handle=dxi_u32(raw,o);p.luid_low=dxi_u32(raw,o+4);p.luid_high=dxi_u32(raw,o+8)
157 p.sources=dxi_u32(raw,o+12);p.present_move_regions=dxi_u32(raw,o+16)
158 i=i+1
159 };return count
160}
161// A single standard enumeration query; no tamper or device-state writes.
162// Caller owns out and selects capacity from its admission policy. Negative rc leaves out unchanged.
163func dxg_enumadapters_into(path:*u8,capacity:i64,out:*DxgAdapterRecord,out_bytes:i64)->i64{
164 let extent:i64=dxi_extent(capacity);if extent<0{return extent}
165 if capacity>9223372036854775807/__size_of(DxgAdapterRecord){return DXI_SHORT_OUTPUT}
166 if out_bytes<capacity*__size_of(DxgAdapterRecord)||(out as i64)<=0{return DXI_SHORT_OUTPUT}
167 let fd:i64=sys_openat_rd(path);if fd<0{return fd}
168 let raw:*u8=sys_mmap_try(extent)
169 if (raw as i64)<=0{sys_close(fd);return DXI_ALLOCATION}
170 let req:*u8=sys_mmap_try(16)
171 if (req as i64)<=0{sys_munmap_direct(raw,extent);sys_close(fd);return DXI_ALLOCATION}
172 let words:*i64=req as *i64;words[0]=capacity;words[1]=raw as i64
173 let queried:i64=sys_ioctl(fd,DXG_LX_DXENUMADAPTERS2,req as i64)
174 let count:i64=dxi_u32(req,0)
175 let closed:i64=sys_close(fd)
176 var rc:i64=queried
177 if queried==0{if closed!=0{rc=closed}else{rc=dxi_decode(raw,extent,count,capacity,out,out_bytes)}}
178 let clean_req:i64=sys_munmap_direct(req,16);let clean_raw:i64=sys_munmap_direct(raw,extent)
179 // Cleanup failure is reported; successfully decoded records may already be present in that case.
180 if clean_req!=0{return clean_req};if clean_raw!=0{return clean_raw};return rc
181}