`nx_gpu_ring.nx` source

↩ module page · 147 lines · 11357 B
1// nx_gpu_ring.nx -- GATE: a GPU BAR/MMIO COMMAND-RING SUBMISSION MODEL (deepens GPU-DRIVER toward the real-hw BAR/ring
2// gap). Where nx_gpu_driver has the vendor table + safe opcode set, THIS models the actual submission MECHANISM real
3// GPUs use: a device with BAR-mapped MMIO registers (ring base/size/head/tail, doorbell, fence, status) over an
4// mmap'd 'device memory', a command ring the host fills, a DOORBELL write that makes the device consume the ring, and
5// a FENCE the device writes on completion that the host waits on. The rung before a real PCIe BAR submission.
6// ★ NEVER-BRICK (cardinal 26) BY CONSTRUCTION: pure in-memory model over mmap'd 'BAR' memory -- touches NO real PCI
7//   device, NO firmware. The device's dispatch has ZERO firmware/vBIOS/flash-write opcodes and REFUSES (halts the
8//   ring, STATUS=ERR) any opcode outside the safe set -- the firmware-write path does not execute. The real-BAR
9//   activation (gpu_activate_real_bar) is REFUSED by construction. Proven mechanically in T4/T5, not asserted.
10//   T1 MMIO register read/write roundtrip (the BAR register file).  T2 submit a frame: doorbell -> device consumes
11//   ring -> framebuffer reflects the commands -> fence signals completion (head advances to tail).
12//   T3 NEVER-BRICK: a normal frame has 0 firmware-write opcodes; the device runs it fully.
13//   T4 teeth: a firmware-write opcode in the ring is REFUSED -- device HALTS at it, fence not signalled, it never runs.
14//   T5 real-BAR activation refused by construction + determinism (process twice -> identical device memory).
15// expect_exit: 0   Sovereign: nx_syscalls.
16import "nx_syscalls.nx"
17import "nx_itoa_lib.nx"   // shared MSB-first emitter (zero-alloc)
18const REG_MAGIC_5381: i64 = 5381
19
20func g_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
21// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer
22// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the
23// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls).
24// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign.
25func g_pn(v: i64) -> i64 { nxi_out(v); return 0 }
26func ck(name: *u8, c: i64) -> i64 { if c==1 { g_puts("  PASS " as *u8) } else { g_puts("  FAIL " as *u8) } g_puts(name); g_puts("\n" as *u8); return c }
27
28// BAR register file (word offsets into device memory) -- the MMIO registers a real GPU exposes.
29const REG_RING_BASE: i64 = 0
30const REG_RING_SIZE: i64 = 1
31const REG_HEAD: i64 = 2         // consumer index (device-owned)
32const REG_TAIL: i64 = 3         // producer index (host-owned)
33const REG_DOORBELL: i64 = 4     // host writes -> device consumes
34const REG_FENCE: i64 = 5        // device writes completion value; host polls (read-only to host)
35const REG_STATUS: i64 = 6       // 0=idle 1=ok 2=ERROR(refused)
36const REG_DRAWS: i64 = 7        // draws executed (a visible side effect)
37const RING_BASE: i64 = 64       // ring slots start here; each slot = 3 words (op,a0,a1)
38const FB_BASE: i64 = 512        // simulated framebuffer
39const DEVWORDS: i64 = 4096
40const ST_OK: i64 = 1
41const ST_ERR: i64 = 2
42// safe opcode set (submission + read ONLY). Firmware/flash/vBIOS-write opcodes are DELIBERATELY ABSENT.
43const OP_CLEAR: i64 = 1
44const OP_DRAW: i64 = 2
45const OP_COPY: i64 = 3
46const OP_COMPUTE: i64 = 4
47const OP_FENCE: i64 = 5
48const OP_FW_WRITE: i64 = 100    // firmware write -- the brick risk; NOT safe, used only to PROVE refusal
49func op_safe(op: i64) -> i64 { if op>=1 { if op<=5 { return 1 } } return 0 }
50
51// MMIO accessors -- model BAR-mapped register/memory access.
52func mmio_w(dev: *i64, off: i64, val: i64) -> i64 { dev[off]=val; return 0 }
53func mmio_r(dev: *i64, off: i64) -> i64 { return dev[off] }
54
55func dev_new() -> *i64 {
56    let dev: *i64 = sys_mmap(DEVWORDS*8) as *i64
57    var i: i64=0; while i<DEVWORDS { dev[i]=0; i=i+1 }
58    mmio_w(dev, REG_RING_BASE, RING_BASE); mmio_w(dev, REG_RING_SIZE, 32)
59    mmio_w(dev, REG_HEAD, 0); mmio_w(dev, REG_TAIL, 0); mmio_w(dev, REG_FENCE, 0); mmio_w(dev, REG_STATUS, 0)
60    return dev
61}
62// host enqueues a command into the ring at TAIL (producer).
63func ring_push(dev: *i64, op: i64, a0: i64, a1: i64) -> i64 {
64    let tail: i64 = mmio_r(dev, REG_TAIL); let base: i64 = mmio_r(dev, REG_RING_BASE)
65    let slot: i64 = base + tail*3
66    dev[slot]=op; dev[slot+1]=a0; dev[slot+2]=a1
67    mmio_w(dev, REG_TAIL, tail+1)
68    return 0
69}
70// DEVICE side: on doorbell, consume the ring from HEAD to TAIL. The never-brick guard REFUSES any unsafe opcode
71// (halts, STATUS=ERR) BEFORE executing it -- the firmware-write path does not run. Returns final HEAD.
72func dev_process(dev: *i64) -> i64 {
73    let tail: i64 = mmio_r(dev, REG_TAIL); let base: i64 = mmio_r(dev, REG_RING_BASE)
74    var head: i64 = mmio_r(dev, REG_HEAD)
75    while head < tail {
76        let slot: i64 = base + head*3
77        let op: i64 = dev[slot]; let a0: i64 = dev[slot+1]; let a1: i64 = dev[slot+2]
78        if op_safe(op)==0 { mmio_w(dev, REG_STATUS, ST_ERR); mmio_w(dev, REG_HEAD, head); return head }   // REFUSE + halt
79        if op==OP_CLEAR { var k: i64=0; while k<64 { dev[FB_BASE+k]=a0; k=k+1 } }
80        if op==OP_DRAW { dev[FB_BASE + (a0%64)] = a1; mmio_w(dev, REG_DRAWS, mmio_r(dev,REG_DRAWS)+1) }
81        if op==OP_COPY { dev[FB_BASE + (a1%64)] = dev[FB_BASE + (a0%64)] }
82        if op==OP_COMPUTE { dev[FB_BASE + (a0%64)] = dev[FB_BASE+(a0%64)] + a1 }
83        if op==OP_FENCE { mmio_w(dev, REG_FENCE, a0) }
84        head = head + 1
85    }
86    mmio_w(dev, REG_HEAD, head); mmio_w(dev, REG_STATUS, ST_OK)
87    return head
88}
89func ring_doorbell(dev: *i64) -> i64 { mmio_w(dev, REG_DOORBELL, 1); return dev_process(dev) }
90// host waits on the fence (polls the MMIO fence register).
91func fence_reached(dev: *i64, want: i64) -> i64 { if mmio_r(dev, REG_FENCE) >= want { return 1 } return 0 }
92func dev_cksum(dev: *i64) -> i64 { var h: i64=REG_MAGIC_5381; var i: i64=0; while i<DEVWORDS { h=((h<<5)+h)+dev[i]; i=i+1 } return h }
93// ★ real PCIe BAR activation -- REFUSED BY CONSTRUCTION (no real device write exists here).
94func gpu_activate_real_bar(neverbrick_hw_proof: i64) -> i64 { if neverbrick_hw_proof==0 { return 0-1 } return 0-1 }
95
96func main() -> i64 {
97    g_puts("nx_gpu_ring (GPU BAR/MMIO command-ring submission MODEL: ring+doorbell+fence; MODEL only, never touches a real PCI device)\n" as *u8)
98    var pass: i64=0; var total: i64=0
99
100    // T1: MMIO register roundtrip
101    let dev: *i64 = dev_new()
102    mmio_w(dev, REG_RING_BASE, RING_BASE); mmio_w(dev, REG_RING_SIZE, 16)
103    var t1: i64=0; if mmio_r(dev, REG_RING_BASE)==RING_BASE { if mmio_r(dev, REG_RING_SIZE)==16 { if mmio_r(dev, REG_HEAD)==0 { t1=1 } } }
104    g_puts("  T1 MMIO BAR regs: ring_base="); g_pn(mmio_r(dev,REG_RING_BASE)); g_puts(" ring_size="); g_pn(mmio_r(dev,REG_RING_SIZE)); g_puts(" head="); g_pn(mmio_r(dev,REG_HEAD)); g_puts("\n" as *u8)
105    pass=pass+ck("T1: BAR-mapped MMIO register file reads/writes back (ring base/size/head)" as *u8, t1); total=total+1
106
107    // T2: submit a frame -- clear(0x11) -> draw(pixel3=0xAB) -> draw(pixel7=0xCD) -> fence(1); doorbell -> device runs it
108    let dev2: *i64 = dev_new()
109    ring_push(dev2, OP_CLEAR, 0x11, 0); ring_push(dev2, OP_DRAW, 3, 0xAB); ring_push(dev2, OP_DRAW, 7, 0xCD); ring_push(dev2, OP_FENCE, 1, 0)
110    let finalhead: i64 = ring_doorbell(dev2)
111    let px3: i64 = dev2[FB_BASE+3]; let px7: i64 = dev2[FB_BASE+7]; let px0: i64 = dev2[FB_BASE+0]
112    var t2: i64=0; if finalhead==4 { if mmio_r(dev2,REG_TAIL)==4 { if px0==0x11 { if px3==0xAB { if px7==0xCD { if fence_reached(dev2,1)==1 { if mmio_r(dev2,REG_DRAWS)==2 { t2=1 } } } } } } }
113    g_puts("  T2 frame: head->"); g_pn(finalhead); g_puts("/tail "); g_pn(mmio_r(dev2,REG_TAIL)); g_puts("; fb[0]="); g_pn(px0); g_puts(" fb[3]="); g_pn(px3); g_puts(" fb[7]="); g_pn(px7); g_puts(" fence="); g_pn(mmio_r(dev2,REG_FENCE)); g_puts(" draws="); g_pn(mmio_r(dev2,REG_DRAWS)); g_puts("\n" as *u8)
114    pass=pass+ck("T2: doorbell -> device consumes the ring -> framebuffer reflects clear/draw -> fence signals completion" as *u8, t2); total=total+1
115
116    // T3: never-brick scan -- the frame's opcodes are all in the safe set (0 firmware-write)
117    var unsafe: i64=0; var s: i64=0; while s<4 { let op: i64=dev2[RING_BASE+s*3]; if op_safe(op)==0 { unsafe=unsafe+1 } s=s+1 }
118    var t3: i64=0; if unsafe==0 { t3=1 }
119    g_puts("  T3 never-brick scan: firmware/vBIOS/flash-write opcodes in the frame = "); g_pn(unsafe); g_puts(" (MUST be 0)\n" as *u8)
120    pass=pass+ck("T3 (NEVER-BRICK, cardinal 26): a normal frame has 0 firmware-write opcodes -- the write path does not exist" as *u8, t3); total=total+1
121
122    // T4 teeth: inject a firmware-write opcode -> device REFUSES at it, HALTS, fence never signalled, it never runs
123    let dev3: *i64 = dev_new()
124    ring_push(dev3, OP_CLEAR, 0x22, 0); ring_push(dev3, OP_DRAW, 5, 0x99); ring_push(dev3, OP_FW_WRITE, 0xDEAD, 0xBEEF); ring_push(dev3, OP_FENCE, 1, 0)
125    let fb5_before: i64 = dev3[FB_BASE+5]
126    let haltedhead: i64 = ring_doorbell(dev3)
127    var t4: i64=0; if mmio_r(dev3,REG_STATUS)==ST_ERR { if haltedhead==2 { if mmio_r(dev3,REG_FENCE)==0 { if op_safe(OP_FW_WRITE)==0 { t4=1 } } } }
128    g_puts("  T4 firmware-write in ring: STATUS="); g_pn(mmio_r(dev3,REG_STATUS)); g_puts(" (2=ERR) halted-head="); g_pn(haltedhead); g_puts(" (stops at the FW op idx 2) fence="); g_pn(mmio_r(dev3,REG_FENCE)); g_puts(" (0=never signalled)\n" as *u8)
129    pass=pass+ck("T4 (teeth): a firmware-write opcode is REFUSED -- device halts at it, fence not signalled, it never executes" as *u8, t4); total=total+1
130
131    // T5: real-BAR activation refused by construction + determinism (process an identical frame twice -> same device memory)
132    let act: i64 = gpu_activate_real_bar(0)
133    let da: *i64 = dev_new(); ring_push(da,OP_CLEAR,7,0); ring_push(da,OP_DRAW,2,55); ring_push(da,OP_FENCE,1,0); ring_doorbell(da)
134    let db: *i64 = dev_new(); ring_push(db,OP_CLEAR,7,0); ring_push(db,OP_DRAW,2,55); ring_push(db,OP_FENCE,1,0); ring_doorbell(db)
135    var t5: i64=0; if act==(0-1) { if dev_cksum(da)==dev_cksum(db) { t5=1 } }
136    g_puts("  T5 never-brick: gpu_activate_real_bar(no-proof)="); g_pn(act); g_puts(" (-1=REFUSED by construction); determinism cksum-equal="); g_pn(dev_cksum(da)==dev_cksum(db)); g_puts("\n" as *u8)
137    pass=pass+ck("T5 (NEVER-BRICK): real-BAR activation REFUSED by construction (no PCI write path) + deterministic submission" as *u8, t5); total=total+1
138
139    var okall: i64=0; if pass==total { okall=1 }
140    g_puts("---- nx_gpu_ring: passed "); g_pn(pass); g_puts(" / "); g_pn(total); g_puts(" ----\n" as *u8)
141    if okall==1 {
142        let logf: i64=sys_openat_append("knowledge/status/gpu_ring.log" as *u8, 420)
143        if logf>=0 { let z: i64=sys_write(logf,"NXGPURING GREEN: GPU BAR/MMIO ring submission MODEL (ring+doorbell+fence); NEVER-BRICK -- fw-write opcode refused+halts, real-BAR activation refused by construction\n" as *u8,158); sys_close(logf) }
144        g_puts("verdict=GREEN (GPU BAR/MMIO ring submission model: MMIO regs + ring + doorbell + fence; MODEL only -- never touches a real PCI device, firmware-write refused, activation refused by construction; deepens GPU-DRIVER)\n" as *u8); sys_exit(0); return 0
145    }
146    g_puts("verdict=RED\n" as *u8); sys_exit(1); return 1
147}
nx_gpu_ring.nx source

`nx_gpu_ring.nx` source
