ohhhhhhhhhhh (exclude linux-extra-rootfs.img build artifact)

CODE/linux/initramfs/bin/utsm_bindmount.c

@@ -0,0 +1,278 @@
+/*
+ * Static mount(2) helper. Guest vdb util-linux/mount is unreadable
+ * (runtime ext4 checksum) and persist ld.so hits SHSTK (fault at 0).
+ * Built the same way as utsm_exec_daemon, which already runs in-guest.
+ */
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <sched.h>
+#include <string.h>
+#include <sys/mount.h>
+#include <time.h>
+#include <unistd.h>
+
+static void wstr(const char *s)
+{
+    (void)write(2, s, strlen(s));
+}
+
+static int do_mount(const char *src, const char *tgt,
+                    const char *fstype, unsigned long flags, const void *data)
+{
+    if (mount(src, tgt, fstype, flags, data) == 0)
+        return 0;
+    wstr("utsm_bindmount errno=");
+    if (errno >= 10) {
+        char d[2];
+        d[0] = (char)('0' + (errno / 10));
+        d[1] = (char)('0' + (errno % 10));
+        (void)write(2, d, 2);
+    } else {
+        char d = (char)('0' + errno);
+        (void)write(2, &d, 1);
+    }
+    wstr("\n");
+    return 1;
+}
+
+int main(int argc, char **argv)
+{
+    if (argc < 3) {
+        wstr("usage: utsm_bindmount bind|rbind|slave|fstype|msleep|yield|setinterp|umount|nsexec ...\n");
+        return 2;
+    }
+    if (strcmp(argv[1], "bind") == 0 && argc >= 4)
+        return do_mount(argv[2], argv[3], NULL, MS_BIND, NULL);
+    if (strcmp(argv[1], "rbind") == 0 && argc >= 4)
+        return do_mount(argv[2], argv[3], NULL, MS_BIND | MS_REC, NULL);
+    if (strcmp(argv[1], "slave") == 0 && argc >= 3)
+        return do_mount(NULL, argv[2], NULL, MS_SLAVE, NULL);
+    if (strcmp(argv[1], "fstype") == 0 && argc >= 5)
+        return do_mount(argv[3], argv[4], argv[2], 0,
+                        (argc >= 6) ? argv[5] : NULL);
+    if (strcmp(argv[1], "yield") == 0) {
+        sched_yield();
+        return 0;
+    }
+    if (strcmp(argv[1], "tail") == 0 && argc >= 3) {
+        int fd, maxlines = 40, lines = 0, i;
+        off_t sz, start;
+        static char buf[16384];
+        ssize_t n;
+        if (argc >= 4) {
+            const char *p = argv[3];
+            maxlines = 0;
+            while (*p >= '0' && *p <= '9') {
+                maxlines = maxlines * 10 + (*p - '0');
+                p++;
+            }
+            if (maxlines < 1)
+                maxlines = 40;
+        }
+        fd = open(argv[2], O_RDONLY);
+        if (fd < 0)
+            return 1;
+        sz = lseek(fd, 0, SEEK_END);
+        if (sz < 0)
+            sz = 0;
+        start = (sz > (off_t)sizeof(buf)) ? sz - (off_t)sizeof(buf) : 0;
+        if (lseek(fd, start, SEEK_SET) < 0)
+            start = 0;
+        n = read(fd, buf, sizeof(buf));
+        close(fd);
+        if (n <= 0)
+            return 1;
+        for (i = (int)n - 1; i >= 0; i--) {
+            if (buf[i] == '\n')
+                lines++;
+            if (lines > maxlines) {
+                i++;
+                break;
+            }
+        }
+        if (i < 0)
+            i = 0;
+        (void)write(1, buf + i, (size_t)(n - i));
+        return 0;
+    }
+    if (strcmp(argv[1], "msleep") == 0 && argc >= 3) {
+        unsigned long ms = 0;
+        const char *p = argv[2];
+        struct timespec ts;
+        while (*p >= '0' && *p <= '9') {
+            ms = ms * 10ul + (unsigned long)(*p - '0');
+            p++;
+        }
+        ts.tv_sec = (time_t)(ms / 1000ul);
+        ts.tv_nsec = (long)(ms % 1000ul) * 1000000L;
+        (void)nanosleep(&ts, 0);
+        return 0;
+    }
+    if (strcmp(argv[1], "chroot") == 0 && argc >= 4) {
+        int kfd;
+        if (chroot(argv[2]) != 0) {
+            wstr("utsm_bindmount: chroot failed\n");
+            return 1;
+        }
+        if (chdir("/") != 0) {
+            wstr("utsm_bindmount: chdir / failed\n");
+            return 1;
+        }
+        kfd = open("/dev/kmsg", O_WRONLY | O_CLOEXEC);
+        if (kfd >= 0) {
+            const char *m = "[utsm_bindmount] inside chroot, exec next\n";
+            (void)write(kfd, m, strlen(m));
+            close(kfd);
+        }
+        execv(argv[3], argv + 3);
+        wstr("utsm_bindmount: exec after chroot failed path=");
+        wstr(argv[3]);
+        wstr(" errno=");
+        if (errno >= 10) {
+            char d[2];
+            d[0] = (char)('0' + (errno / 10));
+            d[1] = (char)('0' + (errno % 10));
+            (void)write(2, d, 2);
+        } else {
+            char d = (char)('0' + errno);
+            (void)write(2, &d, 1);
+        }
+        wstr("\n");
+        return 127;
+    }
+    if (strcmp(argv[1], "nsexec") == 0 && argc >= 3) {
+        int kfd;
+        int u1, u2, u3, pr;
+        kfd = open("/dev/kmsg", O_WRONLY | O_CLOEXEC);
+        if (unshare(CLONE_NEWNS) != 0) {
+            wstr("nsexec: unshare failed\n");
+            if (kfd >= 0) {
+                const char *m = "[nsexec] unshare failed\n";
+                (void)write(kfd, m, strlen(m));
+                close(kfd);
+            }
+            return 1;
+        }
+        pr = mount((const char *)0, "/", (const char *)0,
+                   MS_REC | MS_PRIVATE, (const void *)0);
+        if (pr != 0) {
+            pr = mount((const char *)0, "/", (const char *)0,
+                       MS_REC | MS_SLAVE, (const void *)0);
+        }
+        /* BUG-XORG-SEGV 根修（2026-09-20）：此处 umount 会把 chroot 里的
+         * vdb ld.so bind 拆掉，Xorg 落回 persist ld.so —— 其 0x15ded 处
+         * NULL+8 segfault（Xorg/dbus 均复现）。12:18 好运行中这些 bind
+         * 全部保持激活（shell umount 均 EBUSY），Xorg 用 vdb ld.so 存活。
+         * 恢复该行为：nsexec 不再卸载 ld.so bind。 */
+        u1 = -1;
+        u2 = -1;
+        u3 = -1;
+        if (kfd >= 0) {
+            const char *m = "[nsexec] umount done, exec Xorg\n";
+            (void)write(kfd, m, strlen(m));
+            if (u1 == 0)
+                m = "[nsexec] umount lib64 ld.so ok\n";
+            else
+                m = "[nsexec] umount lib64 ld.so FAIL\n";
+            (void)write(kfd, m, strlen(m));
+            if (u2 == 0)
+                m = "[nsexec] umount usr/lib ld.so ok\n";
+            else
+                m = "[nsexec] umount usr/lib ld.so FAIL\n";
+            (void)write(kfd, m, strlen(m));
+            (void)pr;
+            (void)u3;
+            close(kfd);
+        }
+        execv(argv[2], argv + 2);
+        wstr("nsexec: exec failed\n");
+        return 127;
+    }
+    if (strcmp(argv[1], "umount") == 0 && argc >= 3) {
+        if (umount(argv[2]) == 0)
+            return 0;
+        wstr("umount errno=");
+        if (errno >= 10) {
+            char d[2];
+            d[0] = (char)('0' + (errno / 10));
+            d[1] = (char)('0' + (errno % 10));
+            (void)write(2, d, 2);
+        } else {
+            char d = (char)('0' + errno);
+            (void)write(2, &d, 1);
+        }
+        wstr("\n");
+        return 1;
+    }
+    if (strcmp(argv[1], "setinterp") == 0 && argc >= 4) {
+        int fd;
+        unsigned char eh[64];
+        unsigned long phoff = 0, nlen;
+        unsigned short phentsize = 0, phnum = 0, i;
+        const char *ni = argv[3];
+        nlen = strlen(ni) + 1;
+        fd = open(argv[2], O_RDWR);
+        if (fd < 0) {
+            wstr("setinterp: open failed\n");
+            return 1;
+        }
+        if (read(fd, eh, 64) != 64 || eh[0] != 0x7f || eh[4] != 2) {
+            wstr("setinterp: not elf64\n");
+            close(fd);
+            return 1;
+        }
+        memcpy(&phoff, eh + 32, 8);
+        memcpy(&phentsize, eh + 54, 2);
+        memcpy(&phnum, eh + 56, 2);
+        for (i = 0; i < phnum; i++) {
+            unsigned char ph[56];
+            unsigned int type = 0;
+            unsigned long off = 0, filesz = 0;
+            if (lseek(fd, (off_t)(phoff + (unsigned long)i * phentsize),
+                      SEEK_SET) < 0)
+                break;
+            if (read(fd, ph, 56) != 56)
+                break;
+            memcpy(&type, ph, 4);
+            if (type != 3)
+                continue;
+            memcpy(&off, ph + 8, 8);
+            memcpy(&filesz, ph + 32, 8);
+            if (nlen > filesz) {
+                wstr("setinterp: path too long\n");
+                close(fd);
+                return 1;
+            }
+            if (lseek(fd, (off_t)off, SEEK_SET) < 0) {
+                close(fd);
+                return 1;
+            }
+            if (write(fd, ni, nlen) != (ssize_t)nlen) {
+                close(fd);
+                return 1;
+            }
+            if (filesz > nlen) {
+                unsigned char z[32];
+                unsigned long pad = filesz - nlen;
+                memset(z, 0, sizeof z);
+                while (pad) {
+                    unsigned long c = pad > sizeof z ? sizeof z : pad;
+                    if (write(fd, z, c) != (ssize_t)c) {
+                        close(fd);
+                        return 1;
+                    }
+                    pad -= c;
+                }
+            }
+            close(fd);
+            wstr("setinterp: ok\n");
+            return 0;
+        }
+        wstr("setinterp: no PT_INTERP\n");
+        close(fd);
+        return 1;
+    }
+    wstr("utsm_bindmount: bad args\n");
+    return 2;
+}

CODE/linux/initramfs/bin/utsm_exec_daemon.c

@@ -29,6 +29,8 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <signal.h>
+#include <sched.h>
+#include <poll.h>
 
 /* Shared IPC protocol — must match UTSM side */
 #include "../../../utsm-ipc/ipc_proto.h"
@@ -57,6 +59,7 @@ struct utsm_ioctl_pool {
 };
 
 static int g_utsm_fd = -1;
+static volatile sig_atomic_t g_async_live;
 
 /* pool_write 定义在文件传输段（下文），exec 同步路径复用同一通道 */
 static int pool_write(unsigned int offset, const void *buf, unsigned int len);
@@ -129,6 +132,48 @@ static void err_write(const char *s, unsigned int len)
     (void)n;
 }
 
+static void kmsg_write(const char *s)
+{
+    int fd;
+    if (!s) return;
+    fd = open("/dev/kmsg", O_WRONLY | O_CLOEXEC);
+    if (fd < 0) return;
+    (void)write(fd, s, strlen(s));
+    close(fd);
+}
+
+static int path_needs_deshab_libs(const char *path)
+{
+    if (!path || !path[0])
+        return 0;
+    if (strstr(path, "deshab-kde-session"))
+        return 0;
+    if (strstr(path, "/bin/sh") || strstr(path, "/bin/bash") ||
+        strstr(path, "/usr/bin/bash") || strstr(path, "/usr/bin/env"))
+        return 0;
+    return 1;
+}
+
+/* Nested TSC is often marked unstable, so usleep() returns immediately
+ * and async children never run on the only vCPU. A yield loop also
+ * starves D-state I/O: PID 1 stays runnable and idle never runs.
+ * poll(POLLIN, 10ms) on /dev/utsm sleeps interruptibly so Plasma/session
+ * and virtio completions can run. Driver poll does not wait-queue, so
+ * a new EXEC_REQUEST is seen at the next timeout. */
+static void donate_cpu(void)
+{
+    struct pollfd pfd;
+
+    memset(&pfd, 0, sizeof(pfd));
+    pfd.fd = g_utsm_fd;
+    pfd.events = POLLIN;
+    if (poll(&pfd, 1, 10) < 0) {
+        unsigned i;
+        for (i = 0; i < 64u; i++)
+            sched_yield();
+    }
+}
+
 /* ===== Exec request handler =====
  *
  * Fork a child to exec the requested program. Parent reads stdout/stderr
@@ -178,6 +223,7 @@ static void handle_exec_request(const struct ipc_exec_request *req)
             return;
         }
         if (pid == 0) {
+            char line[192];
             /* Child: new session, no controlling tty, stdio → /dev/null */
             setsid();
             int nullfd = open("/dev/null", O_RDWR);
@@ -187,13 +233,29 @@ static void handle_exec_request(const struct ipc_exec_request *req)
                 dup2(nullfd, STDERR_FILENO);
                 if (nullfd > STDERR_FILENO) close(nullfd);
             }
-            /* 与同步路径一致的库搜索路径；DISPLAY 指向 virtio-gpu X server */
-            setenv("LD_LIBRARY_PATH", "/usr/lib/deshab", 1);
+            /* DISPLAY 指向 virtio-gpu X server。不要把 LD_LIBRARY_PATH
+             * 套到 bash/session：/usr/lib/deshab 会劫持 glibc。 */
+            if (path_needs_deshab_libs(req->path))
+                setenv("LD_LIBRARY_PATH", "/usr/lib/deshab", 1);
             setenv("DISPLAY", ":0", 1);
+            snprintf(line, sizeof(line),
+                     "[deshab-kde] async exec %s\n", req->path);
+            kmsg_write(line);
             execv(req->path, argv);
+            snprintf(line, sizeof(line),
+                     "[deshab-kde] execv failed errno=%d path=%s\n",
+                     errno, req->path);
+            kmsg_write(line);
             _exit(127);  /* execv 仅失败时返回 */
         }
         /* Parent: report successful spawn immediately */
+        g_async_live = 1;
+        {
+            char line[128];
+            snprintf(line, sizeof(line),
+                     "[deshab-kde] async spawn pid=%d\n", (int)pid);
+            kmsg_write(line);
+        }
         struct ipc_exec_exit ex = { .exit_code = 0, .flags = 0,
                                     .stdout_len = 0, .stdout_total = 0 };
         send_exit_msg(&ex);
@@ -227,8 +289,8 @@ static void handle_exec_request(const struct ipc_exec_request *req)
         dup2(pipefd[1], STDERR_FILENO);
         close(pipefd[1]);
 
-        /* 设置 LD_LIBRARY_PATH，让 ld-linux.so 在 /usr/lib/deshab 查找 .so */
-        setenv("LD_LIBRARY_PATH", "/usr/lib/deshab", 1);
+        if (path_needs_deshab_libs(req->path))
+            setenv("LD_LIBRARY_PATH", "/usr/lib/deshab", 1);
 
         execv(req->path, argv);
         /* execv only returns on failure */
@@ -589,6 +651,16 @@ int main(void)
             /* Ignore other message types (HELLO, PING, etc.) */
         }
 
+        /* Single vCPU: PARK/HLT freezes the whole VM, including async
+         * children and in-flight virtio-blk. Yields return immediately
+         * when the child is in D-state, so a yield-then-HLT loop parks
+         * before the virtio IRQ can be injected. Stay runnable; the
+         * host returns from linux_resume() on a preemption timeslice. */
+        if (g_async_live) {
+            donate_cpu();
+            continue;
+        }
+
         /* Responses (if any) are already queued. Park to let UTSM read
          * them and return to the shell; a spurious wakeup with no
          * request simply parks again. */

CODE/linux/initramfs/bin/utsm_run.c

@@ -0,0 +1,116 @@
+/*
+ * Shebang trampoline: run a script with persist bash + persist glibc.
+ * vdb /usr/bin/bash needs libreadline, and virtio often returns a bad
+ * ext4 inode checksum for that file. persist userland is on vdc.
+ *
+ * Built like utsm_exec_daemon: -static -fcf-protection=none.
+ */
+#define _GNU_SOURCE
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+extern char **environ;
+
+static void kmsg(const char *s)
+{
+    int fd = open("/dev/kmsg", O_WRONLY | O_CLOEXEC);
+    if (fd < 0)
+        return;
+    (void)write(fd, s, strlen(s));
+    close(fd);
+}
+
+static int exists(const char *p)
+{
+    return p && access(p, X_OK) == 0;
+}
+
+int main(int argc, char **argv)
+{
+    static const char *ld_cands[] = {
+        "/mnt/persist/usr/lib/ld-linux-x86-64.so.2",
+        "/mnt/persist/lib64/ld-linux-x86-64.so.2",
+        "/mnt/persist/lib/ld-linux-x86-64.so.2",
+        0
+    };
+    static const char *bash_cands[] = {
+        "/mnt/persist/usr/bin/bash",
+        "/mnt/persist/bin/bash",
+        0
+    };
+    const char *libpath =
+        "/mnt/persist/usr/lib:/mnt/persist/lib64:/mnt/persist/lib";
+    const char *path =
+        "/mnt/persist/usr/bin:/mnt/persist/bin:/usr/local/bin:/usr/bin:/bin";
+    const char *ld = 0;
+    const char *bash = 0;
+    char *nargv[64];
+    int n = 0;
+    int i;
+    char line[192];
+
+    kmsg("[utsm_run] start\n");
+    if (argc < 2) {
+        kmsg("[utsm_run] usage: utsm_run script [args]\n");
+        return 2;
+    }
+
+    /* Already inside persist chroot: /mnt/persist is gone, bash is local. */
+    if (access("/etc/deshab-kde-root", F_OK) == 0 ||
+        access("/mnt/persist/usr/bin/bash", X_OK) != 0) {
+        kmsg("[utsm_run] inside persist, exec /usr/bin/bash\n");
+        nargv[n++] = "/usr/bin/bash";
+        for (i = 1; i < argc && n < 62; i++)
+            nargv[n++] = argv[i];
+        nargv[n] = 0;
+        execv("/usr/bin/bash", nargv);
+        kmsg("[utsm_run] inside bash execv failed\n");
+        return 127;
+    }
+
+    setenv("PATH", path, 1);
+    setenv("LD_LIBRARY_PATH", libpath, 1);
+    setenv("GLIBC_TUNABLES", "glibc.cpu.hwcaps=-IBT,-SHSTK", 1);
+
+    for (i = 0; ld_cands[i]; i++) {
+        if (exists(ld_cands[i])) {
+            ld = ld_cands[i];
+            break;
+        }
+    }
+    for (i = 0; bash_cands[i]; i++) {
+        if (exists(bash_cands[i])) {
+            bash = bash_cands[i];
+            break;
+        }
+    }
+
+    /* persist ld.so (as program or as PT_INTERP) SIGSEGVs at -40 in
+     * _dl_find_dso_for_object. Use vdb's RAM-backed interpreter with
+     * persist libraries via LD_LIBRARY_PATH. */
+    (void)ld;
+
+    if (bash) {
+        snprintf(line, sizeof(line), "[utsm_run] persist bash %s\n", bash);
+        kmsg(line);
+        nargv[n++] = (char *)bash;
+        for (i = 1; i < argc && n < 62; i++)
+            nargv[n++] = argv[i];
+        nargv[n] = 0;
+        execve(bash, nargv, environ);
+        kmsg("[utsm_run] persist bash execve failed\n");
+    }
+
+    kmsg("[utsm_run] fallback /usr/bin/bash\n");
+    n = 0;
+    nargv[n++] = "/usr/bin/bash";
+    for (i = 1; i < argc && n < 62; i++)
+        nargv[n++] = argv[i];
+    nargv[n] = 0;
+    execv("/usr/bin/bash", nargv);
+    kmsg("[utsm_run] fallback execv failed\n");
+    return 127;
+}