nx_gpu_dxg_probe.nx source

1// nx_gpu_dxg_probe.nx -- SOVEREIGN-GPU foundation organ (R0): reach the REAL RTX 5080 through 2// its actual device interface, /dev/dxg (the WSL dxgkrnl GPU-paravirt thunk), with RAW syscalls 3// ONLY. NO libvulkan / libcuda / libdxcore / libd3d12 / libc -- the emitted elf links NOTHING. 4// Every byte here is open(2) / ioctl(2) / close(2) / write(2) directly via __syscall. 5// 6// This is the productionized form of the recon _dxg_enum_probe: a reusable probe FUNCTION 7// (dxg_enumadapters) that the gate (_gpu_dxg_gate.nx) calls, plus a standalone main() so the 8// organ can be run on its own. It performs the MINIMAL real call -- LX_DXENUMADAPTERS2 -- and 9// reads back the REAL adapter count + adapter[0] handle + LUID from the 5080. 10// 11// ABI (pinned from WSL2-Linux-Kernel linux-msft-wsl-6.6.y, include/uapi/misc/d3dkmthk.h; 12// CONFIRMED live: the kernel accepted exactly 0xC0104714 and returned ret=0, num_adapters=2): 13// #define LX_DXENUMADAPTERS2 _IOWR(0x47, 0x14, struct d3dkmt_enumadapters2) 14// = (dir _IOWR=3 <<30) | (size 16 <<16) | (magic 0x47 <<8) | (nr 0x14) = 0xC0104714 15// struct d3dkmt_enumadapters2 { __u32 num_adapters; __u32 reserved; __u64 *adapters; } // 16B 16// struct d3dkmt_adapterinfo { d3dkmthandle handle(4); winluid luid(8); u32 num_sources; 17// u32 present_move_regions_preferred; } // 20B 18// 19// PROTOCOL: set num_adapters = capacity, adapters = ptr to an array of d3dkmt_adapterinfo; the 20// kernel writes the REAL count back into num_adapters and fills the array. 21// NO-FALSE-GREEN: the gate also issues a TAMPER (magic-0x99 ioctl) which the real device rejects 22// with a real errno (-ENOTTY=-25) != the real ret=0; that distinguishes a real device response 23// from a no-op. (The gate owns the verdict; this organ exposes the raw mechanism + a result 24// struct it can inspect.) 25// 26// SCOPE (NO-WAVE): this rung proves ONLY "Nishi reaches the real RTX 5080 sovereignly via the 27// /dev/dxg last-mile". It claims NO throughput / speedup / exceed -- that is R7 (a real cuBLAS 28// head-to-head, many rungs up). Do NOT read a perf number out of this. 29// license_tier: ORIGINAL 30import "nx_syscalls.nx" 31const DXG_MAGIC_4096: i64 = 4096 32 33// LX_DXENUMADAPTERS2 ioctl code (see derivation above). Sovereignly a plain constant. 34const DXG_LX_DXENUMADAPTERS2: i64 = 0xC0104714 35// A non-dxg magic used as the no-false-green tamper. The real device rejects it (-ENOTTY). 36const DXG_TAMPER_MAGIC: i64 = 0x99000000 37 38// dxg_result layout (a sovereign 64-byte struct the probe fills so the gate can read it back): 39// off 0 i64 fd (the raw fd from openat; <0 = open failed) 40// off 8 i64 ioctl_ret (LX_DXENUMADAPTERS2 return; 0 = kernel accepted) 41// off 16 i64 num_adapters (REAL count the kernel wrote back) 42// off 24 i64 handle0 (adapter[0] packed d3dkmthandle) 43// off 32 i64 luid_a (adapter[0] winluid low -- a REAL non-zero LUID on success) 44// off 40 i64 luid_b (adapter[0] winluid high) 45// off 48 i64 tamper_ret (magic-0x99 ioctl return; expect a real errno, e.g. -25) 46const DXR_FD: i64 = 0 47const DXR_IOCTL_RET: i64 = 8 48const DXR_NUM_ADAPTERS: i64 = 16 49const DXR_HANDLE0: i64 = 24 50const DXR_LUID_A: i64 = 32 51const DXR_LUID_B: i64 = 40 52const DXR_TAMPER_RET: i64 = 48 53 54func dxr_set(res: *u8, off: i64, v: i64) -> i64 { let p: *i64 = (res as i64 + off) as *i64; p[0] = v; return 0 } 55func dxr_get(res: *u8, off: i64) -> i64 { let p: *i64 = (res as i64 + off) as *i64; return p[0] } 56 57// Open a path (raw openat) and immediately issue LX_DXENUMADAPTERS2 + the tamper control, writing 58// every real value into `res`. `path` is parametric so the gate can also point it at a NON-dxg fd 59// (e.g. /dev/null) to prove the green depends on the REAL dxgkrnl device, not any open fd. 60// Returns the LX_DXENUMADAPTERS2 ioctl return (0 = accepted), or the open errno if open failed. 61func dxg_enumadapters(path: *u8, res: *u8) -> i64 { 62 var z0: i64 = 0; while z0 < 56 { let b: *u8 = (res as i64 + z0) as *u8; b[0] = 0 as u8; z0 = z0 + 1 } 63 64 let fd: i64 = sys_openat_rd(path) 65 dxr_set(res, DXR_FD, fd) 66 if fd < 0 { return fd } 67 68 // adapter-info output buffer: capacity 8 entries * 20 bytes = 160B; page-mmap'd + zeroed. 69 let ainfo: *u8 = sys_mmap(DXG_MAGIC_4096) 70 var z: i64 = 0; while z < DXG_MAGIC_4096 { ainfo[z] = 0 as u8; z = z + 1 } 71 72 // struct d3dkmt_enumadapters2 (16B): [0]=u32 num_adapters(IN cap=8) [4]=u32 reserved [8]=u64 *adapters 73 let req: *u8 = sys_mmap(64) 74 var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 75 req[0] = 8 as u8; req[1] = 0 as u8; req[2] = 0 as u8; req[3] = 0 as u8 76 let r8: *i64 = (req as i64 + 8) as *i64 77 r8[0] = ainfo as i64 78 79 // no-false-green control: magic-0x99 ioctl -> the real device rejects with a real errno. 80 let tamper: i64 = sys_ioctl(fd, DXG_TAMPER_MAGIC, req as i64) 81 dxr_set(res, DXR_TAMPER_RET, tamper) 82 83 // REAL CALL: LX_DXENUMADAPTERS2 -> kernel fills the array + writes the real count back. 84 let ret: i64 = sys_ioctl(fd, DXG_LX_DXENUMADAPTERS2, req as i64) 85 dxr_set(res, DXR_IOCTL_RET, ret) 86 87 let nc: i64 = (req[0] as i64)|((req[1] as i64)<<8)|((req[2] as i64)<<16)|((req[3] as i64)<<24) 88 dxr_set(res, DXR_NUM_ADAPTERS, nc) 89 90 let h0: i64 = (ainfo[0] as i64)|((ainfo[1] as i64)<<8)|((ainfo[2] as i64)<<16)|((ainfo[3] as i64)<<24) 91 let la: i64 = (ainfo[4] as i64)|((ainfo[5] as i64)<<8)|((ainfo[6] as i64)<<16)|((ainfo[7] as i64)<<24) 92 let lb: i64 = (ainfo[8] as i64)|((ainfo[9] as i64)<<8)|((ainfo[10] as i64)<<16)|((ainfo[11] as i64)<<24) 93 dxr_set(res, DXR_HANDLE0, h0) 94 dxr_set(res, DXR_LUID_A, la) 95 dxr_set(res, DXR_LUID_B, lb) 96 97 sys_close(fd) 98 return ret 99} 100 101// ---- standalone print helpers + main (the organ also runs on its own) ---- 102func gp_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 103func gp_n(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 104func gp_x(v: i64) -> i64 { gp_p("0x" as *u8); let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } var i:i64=0; let o:*u8=sys_mmap(20); while i<k{o[i]=bb[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 105 106func main() -> i64 { 107 let res: *u8 = sys_mmap(64) 108 let ret: i64 = dxg_enumadapters("/dev/dxg" as *u8, res) 109 110 gp_p("DXGPROBE open(/dev/dxg) fd=" as *u8); gp_n(dxr_get(res, DXR_FD)); gp_p("\n" as *u8) 111 if dxr_get(res, DXR_FD) < 0 { gp_p("DXGPROBE verdict=RED reason=open-failed\n" as *u8); sys_exit(1); return 1 } 112 gp_p("DXGPROBE tamper(magic=0x99) ret=" as *u8); gp_n(dxr_get(res, DXR_TAMPER_RET)); gp_p("\n" as *u8) 113 gp_p("DXGPROBE ioctl LX_DXENUMADAPTERS2 code=" as *u8); gp_x(DXG_LX_DXENUMADAPTERS2) 114 gp_p(" ret=" as *u8); gp_n(ret); gp_p("\n" as *u8) 115 gp_p("DXGPROBE num_adapters(after)=" as *u8); gp_n(dxr_get(res, DXR_NUM_ADAPTERS)); gp_p("\n" as *u8) 116 gp_p("DXGPROBE adapter[0] handle=" as *u8); gp_x(dxr_get(res, DXR_HANDLE0)) 117 gp_p(" luid.a=" as *u8); gp_x(dxr_get(res, DXR_LUID_A)) 118 gp_p(" luid.b=" as *u8); gp_x(dxr_get(res, DXR_LUID_B)); gp_p("\n" as *u8) 119 120 if ret == 0 { gp_p("DXGPROBE verdict=GREEN reason=real-adapter-data-from-5080\n" as *u8) } 121 else { gp_p("DXGPROBE verdict=PARTIAL reason=ioctl-reached-device-nonzero-ret\n" as *u8) } 122 return 0 123}