Deaicup/Deshab-OS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FUCKKKK

Browse Source
This commit is contained in:
Linehu
2026-08-09 22:20:01 +08:00
parent 8717ea8f20
commit 2a50fa58c7
185 changed files with 19890 additions and 710 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CODE/UTSM/include/utsm/dsk.h
+17
View File
@@ -14,6 +14,23 @@
/* ---- Probe 信息结构（通过 reserved[6] 传递给 shell/desktop） ---- */
#define PROBE_INFO_MAGIC 0x50524F42u /* "PRFB" — Probe inFo Buffer */
/* ---- 网络租约信息（netman 写入，DSK 持有存储，经 reserved[7] 指针传递） ----
* reserved[0..6] 已被占用（user.conf/login/dev_mode/pe/lxc/probe），
* 仅 reserved[7] 空闲，故以其存放指向本结构的指针。 */
#define NET_LEASE_MAGIC 0x4E45544Cu /* "NETL" */
#define NET_LEASE_F_VALID (1u << 0) /* ip/gateway/dns 有效 */
#define NET_LEASE_F_STATIC (1u << 1) /* 静态配置（非 DHCP） */
typedef struct net_lease_info {
u32 magic; /* NET_LEASE_MAGIC */
u32 flags; /* NET_LEASE_F_* */
u32 ip; /* guest IP（网络序） */
u32 gateway; /* 网关（网络序） */
u32 dns; /* DNS（网络序） */
u32 server; /* DHCP server（网络序，调试） */
u32 reserved[2];
} net_lease_info;
typedef struct probe_info {
u32 magic; /* PROBE_INFO_MAGIC */
u32 version; /* ABI 版本，当前 1 */
CODE/UTSM/include/utsm/ept.h
+3 -2
View File
@@ -8,8 +8,9 @@
#define EPT_PAGE_SIZE 4096ULL
#define EPT_ENTRIES 512ULL
/* EPTP 构造：bits [5:0]=memory type, bits [7:6]=walk length-1, bits [51:12]=PML4 HPA */
#define EPTP_WALK_LEN_4 (3ULL << 6) /* 4 级页表 */
/* EPTP 构造：bits [2:0]=memory type, bits [5:3]=walk length-1, bit 6=AD, bits [51:12]=PML4 HPA
* P8.4 Fix: walk length was at bits [7:6] (wrong), should be bits [5:3] per Intel SDM. */
#define EPTP_WALK_LEN_4 (3ULL << 3) /* 4 级页表 (3 = 4-1) at bits [5:3] */
#define EPTP_MEMTYPE_WB (EPT_MEMORY_TYPE_WB)
/* 初始化 EPT：分配 PML4，置零。返回 0 成功。 */
CODE/UTSM/include/utsm/linux_compat.h
+80
View File
@@ -21,6 +21,34 @@
#define LINUX_COMPAT_MAGIC 0x4C4E58434F4D5000ULL /* "LNXCOMP\0" */
/* VSCode Phase 3: virtio-gpu scanout 查询结果。
* 镜像 virtio_mmio.h 的 virtio_gpu_scanout_info 字段布局，保持公共 ABI 自洽
* （不强制消费者 include virtio_mmio.h）。必须在 linux_compat_service 之前
* 定义，因为服务表中有指向此类型的函数指针。 */
struct linux_compat_scanout_info {
void *host_vaddr;
u32 width;
u32 height;
u32 stride;
u32 dirty;
u32 enabled;
/* Phase 7: 累积 dirty rect（scanout 坐标系并集，查询随 dirty 清零）。
* dirty=0 时全为 0；desktop 据此只 blit 变化区域（尾部追加，ABI 兼容）。 */
u32 dirty_x;
u32 dirty_y;
u32 dirty_w;
u32 dirty_h;
/* P7.6: hardware cursor state（尾部追加，ABI 兼容）。 */
u32 cursor_visible;
u32 cursor_x;
u32 cursor_y;
u32 cursor_hot_x;
u32 cursor_hot_y;
u32 cursor_w;
u32 cursor_h;
void *cursor_bitmap;
};
/* Linux 兼容层服务表 — 通过 boot context reserved[5] 传递 */
typedef struct linux_compat_service {
u64 magic; /* LINUX_COMPAT_MAGIC */
@@ -93,6 +121,41 @@ typedef struct linux_compat_service {
* 返回 0 成功，负值失败（-11=文件不存在，其余同 file_pull）。 */
int (*file_push)(const char *fat32_name, const char *linux_path,
u64 *out_size);
/* VSCode Phase 2: 输入转发到 Linux guest（virtio-input 键盘+鼠标）。
* 由 desktop 在 IDE attached 时调用，把 Deshab PS/2 事件注入 guest。
* 事件排到 pending ring，由 vmexit poll 路径排空到 eventq + 注入 IRQ。
*
* input_forward_keyboard(code, value)
* code : linux keycode（KEY_A=30 等，见 linux/input-event-codes.h）
* value : 0=release, 1=press, 2=repeat
*
* input_forward_mouse(dx, dy, buttons)
* dx, dy : 相对位移（像素差，可为负）
* buttons : 按钮位图 bit0=左, bit1=右, bit2=中（内部与上次状态比较，
* 仅变化的按钮产生 press/release 事件；末尾自动追加 SYN） */
void (*input_forward_keyboard)(u16 code, u32 value);
void (*input_forward_mouse)(i32 dx, i32 dy, u8 buttons);
/* VSCode Phase 3: 查询 virtio-gpu scanout 状态（desktop IDE blit 用）。
* 在 IDE attached 时由 desktop 周期调用：若 dirty=1，把 host_vaddr 指向的
* scanout 影子缓冲（width×height，stride 字节/行，XRGB8888）blit 到
* framebuffer 的 IDE host 区域，然后重新查询以清零 dirty。
* out->host_vaddr : scanout 影子缓冲 host 虚拟地址（SAS-R0 下可直接解引用）
* out->enabled : 1 = scanout 已绑定 2D resource（X server 已 SET_SCANOUT）
* out->dirty : 1 = 自上次查询有新帧（查询会清零该位）
* 返回 0 成功（enabled=0 时其余字段为零），-1 后端未就绪（无 surface pool）。 */
int (*gpu_get_scanout_info)(struct linux_compat_scanout_info *out);
/* VSCode Phase 5: 异步执行 Linux 程序（daemon fork+setsid+detach）。
* 与 exec 语义相同，但 daemon 在 spawn 成功后立即回 EXEC_EXIT(0)，
* 不捕获 stdout、不等待进程退出——用于启动 X server / VSCode 等
* 长生命周期 GUI 进程而不阻塞 UTSM 侧。子进程 stdio 重定向到
* /dev/null，环境自带 LD_LIBRARY_PATH=/usr/lib/deshab 与 DISPLAY=:0。
* 返回 0 = 已成功 spawn（不代表程序后续存活），负值失败
* （-1=服务不可用, -2=IPC 发送失败, -3=linux_resume 失败,
* -4=无响应, -5=daemon 报告 spawn 失败）。 */
int (*exec_async)(const char *path, int argc, const char *const *argv);
} linux_compat_service;
/* ===== UTSM 内部接口（不进服务表，供 hypercall.c 等内核代码使用） =====
@@ -111,4 +174,21 @@ const linux_compat_service *linux_compat_get_service(void);
/* 初始化 Linux 兼容层服务（在 linux_launch 成功后调用）。 */
void linux_compat_init(void);
/* 同步 FAT32 lib 目录下所有 .so 文件到 Linux guest。
* guest_lib_path : guest 端库目录路径（如 "/usr/lib/deshab"）
* 调用时机：linux_compat_init 成功后。失败不阻断启动。
* 返回 0 成功，负值失败。 */
int lxc_sync_lib_dir(const char *guest_lib_path);
/* VSCode Phase 5: 把 VSCode tarball（Limine boot module，路径含 "vscode"）
* 安装到 Linux guest 的 /opt/vscode（经 overlay 持久化在 extra-rootfs 卷）。
* 流程：已安装标记探测（/opt/vscode/bin/code 可执行则跳过）→
* 流式推送 module 字节到 guest /tmp/vscode.tar.gz →
* mkdir -p /opt/vscode → tar 解包（--strip-components=1，失败回退不解层）→
* 清理 /tmp tarball → 验证 /opt/vscode/bin/code。
* 调用时机：linux_compat_init 成功后（kernel main，FUCK [compat] vscode_install=1）。
* 返回 0 成功或已安装；负值失败（-1 服务不可用, -11 无 tarball module,
* -12 推送失败, -13 解包失败, -14 验证失败）。所有失败均不阻断启动。 */
int lxc_vscode_install(void);
#endif /* UTSM_LINUX_COMPAT_H */
CODE/UTSM/include/utsm/linux_loader.h
+80 -9
View File
@@ -103,7 +103,9 @@ struct linux_setup_header {
* 0x01000000-0x02FFFFFF : Linux kernel image
* 0x03000000-0x03FFFFFF : Linux initrd
* 0x04000000-0x040FFFFF : IPC shared memory (1MB, both kernels RW)
* 0x05000000-MAX : Linux general RAM
* 0x04100000-0x04FFFFFF : Graphics surface pool (16MB, VSCode integration Phase 1)
* 0x05000000-0x5FFFFFFF : Linux general RAM (~1.4GB, expanded Phase 1 for VSCode)
* 0xF4000000-0xF4007000 : virtio-mmio devices (8 slots, expanded Phase 1)
*/
#define LINUX_GUEST_KERNEL_GPA 0x01000000ULL /* 16 MB, 2MB-aligned */
#define LINUX_GUEST_BOOTPARAMS_GPA 0x00400000ULL /* 4 MB */
@@ -118,8 +120,19 @@ struct linux_setup_header {
#define LINUX_GUEST_IPC_SHM_GPA 0x04000000ULL /* 64 MB */
#define LINUX_GUEST_IPC_SHM_SIZE (1024 * 1024) /* 1MB */
/* General RAM starts after IPC region */
/* VSCode integration Phase 1: Graphics surface pool.
* Separate DMA region EPT-mapped into the Linux guest. Linux user-space mmaps
* /dev/utsm at this GPA to obtain a writable scanout buffer that UTSM reads
* for blitting to the Deshab framebuffer (Phase 3 virtio-gpu shadow buffer).
* 16MB accommodates a 1920×1080×4 framebuffer (~8MB) with headroom for
* cursor plane and dirty rect tracking metadata. */
#define LINUX_GUEST_SURFACE_GPA 0x04100000ULL /* 65 MB (immediately after IPC shm) */
#define LINUX_GUEST_SURFACE_SIZE (16 * 1024 * 1024) /* 16MB */
/* General RAM starts after IPC + surface regions.
* Phase 1 expansion: 1.4GB to fit VSCode + Electron + GUI stack. */
#define LINUX_GUEST_RAM_GPA 0x05000000ULL /* 80 MB */
#define LINUX_GUEST_RAM_SIZE 0x5B000000ULL /* 1.4GB (0x05000000..0x5FFFFFFF) */
/* ===== virtio-mmio device GPA layout =====
* virtio-mmio 设备放在 GPA 高位 MMIO 区（guest RAM 之上，不占用 e820 RAM）。
@@ -129,16 +142,33 @@ struct linux_setup_header {
* 这些 GPA 在 EPT 中【故意不映射】，访问时触发 EPT violation，
* 由 vmexit handler 路由到 virtio_mmio 后端模拟寄存器读写。
*
* GPA 选择 0xF4000000 起始（接近 4GB，远离 guest RAM 0x05000000-0x09000000）。 */
* GPA 选择 0xF4000000 起始（接近 4GB，远离 guest RAM 0x05000000-0x5FFFFFFF）。
*
* VSCode integration Phase 1 expansion: 槽位从 3 扩到 8，为后续阶段预留：
* slot 0: blk (Phase 1-) IRQ5
* slot 1: net (Phase 1-) IRQ6
* slot 2: rootfs (Phase 1-) IRQ7
* slot 3: keyboard (Phase 2) IRQ8 — virtio-input, evdev /dev/input/event0
* slot 4: mouse (Phase 2) IRQ9 — virtio-input, evdev /dev/input/event1
* slot 5: gpu (Phase 3) IRQ10 — virtio-gpu 2D, /dev/dri/card0
* slot 6: extra-rootfs (Phase 4) IRQ11 — persistent rw volume (/dev/vdc)
* slot 7: reserved — future use
*/
#define VIRTIO_MMIO_GPA_BASE 0xF4000000ULL
#define VIRTIO_MMIO_GPA_STRIDE 0x1000ULL /* 每个设备 4KB */
#define VIRTIO_MMIO_MAX_SLOTS 8 /* Phase 1: 3→8 */
#define VIRTIO_MMIO_BLK_GPA (VIRTIO_MMIO_GPA_BASE + 0 * VIRTIO_MMIO_GPA_STRIDE) /* 0xF4000000 */
#define VIRTIO_MMIO_NET_GPA (VIRTIO_MMIO_GPA_BASE + 1 * VIRTIO_MMIO_GPA_STRIDE) /* 0xF4001000 */
#define VIRTIO_MMIO_ROOTFS_GPA (VIRTIO_MMIO_GPA_BASE + 2 * VIRTIO_MMIO_GPA_STRIDE) /* 0xF4002000 */
#define VIRTIO_MMIO_BLK_GPA (VIRTIO_MMIO_GPA_BASE + 0 * VIRTIO_MMIO_GPA_STRIDE) /* 0xF4000000 */
#define VIRTIO_MMIO_NET_GPA (VIRTIO_MMIO_GPA_BASE + 1 * VIRTIO_MMIO_GPA_STRIDE) /* 0xF4001000 */
#define VIRTIO_MMIO_ROOTFS_GPA (VIRTIO_MMIO_GPA_BASE + 2 * VIRTIO_MMIO_GPA_STRIDE) /* 0xF4002000 */
/* VSCode integration: Phase 2/3/4 device slots (currently unused, reserved) */
#define VIRTIO_MMIO_KBD_GPA (VIRTIO_MMIO_GPA_BASE + 3 * VIRTIO_MMIO_GPA_STRIDE) /* 0xF4003000 */
#define VIRTIO_MMIO_MOUSE_GPA (VIRTIO_MMIO_GPA_BASE + 4 * VIRTIO_MMIO_GPA_STRIDE) /* 0xF4004000 */
#define VIRTIO_MMIO_GPU_GPA (VIRTIO_MMIO_GPA_BASE + 5 * VIRTIO_MMIO_GPA_STRIDE) /* 0xF4005000 */
#define VIRTIO_MMIO_EXTRA_ROOTFS_GPA (VIRTIO_MMIO_GPA_BASE + 6 * VIRTIO_MMIO_GPA_STRIDE) /* 0xF4006000 */
/* 判断 GPA 是否落在 virtio-mmio 设备区（含两端） */
#define VIRTIO_MMIO_GPA_END (VIRTIO_MMIO_GPA_BASE + 3 * VIRTIO_MMIO_GPA_STRIDE)
#define VIRTIO_MMIO_GPA_END (VIRTIO_MMIO_GPA_BASE + VIRTIO_MMIO_MAX_SLOTS * VIRTIO_MMIO_GPA_STRIDE)
#define IS_VIRTIO_MMIO_GPA(gpa) ((gpa) >= VIRTIO_MMIO_GPA_BASE && (gpa) < VIRTIO_MMIO_GPA_END)
/* ===== Linux loader API ===== */
@@ -156,6 +186,13 @@ struct linux_guest_info {
u64 pgt_gpa; /* GPA of guest page tables */
u64 gdt_gpa; /* GPA of guest GDT */
int loaded; /* 1 = successfully loaded */
/* VSCode integration Phase 1: graphics surface pool.
* Allocated as a separate DMA buffer and EPT-mapped into the guest at
* surface_gpa. Exposed to Linux user-space via UTSM_HCALL_SURFACE_INFO
* and /dev/utsm mmap (see CODE/linux/patches/utsm_hcall.c). */
u64 surface_hpa; /* Host physical address of surface pool (0 = none) */
u64 surface_gpa; /* GPA visible inside Linux guest */
u64 surface_size; /* Surface pool size in bytes */
};
/* Find the Linux bzImage boot module among Limine modules.
@@ -167,6 +204,17 @@ void *linux_find_bzimage_module(u64 *size_out);
* Exposed to Linux guest via memory-backed virtio-blk as /dev/vdb. */
void *linux_find_rootfs_module(u64 *size_out);
/* VSCode Phase 4: find the extra rootfs image boot module (path contains
* "extra"). Exposed via writable virtio-blk slot6 as /dev/vdc (overlayfs
* upper / VSCode data volume). Returns NULL when the module is absent. */
void *linux_find_extra_rootfs_module(u64 *size_out);
/* VSCode Phase 5: find the VSCode tarball boot module (path contains
* "vscode", e.g. linux-vscode.tar.gz). The tarball is streamed into the
* guest and extracted to /opt/vscode by lxc_vscode_install().
* Returns NULL when the module is absent (install skipped, non-fatal). */
void *linux_find_vscode_module(u64 *size_out);
/* Parse bzImage header and extract key parameters.
* Returns 0 on success, negative on error. */
int linux_parse_bzimage(const void *bzimage, u64 size,
@@ -181,6 +229,20 @@ int linux_loader_init(void);
/* Get the loaded Linux guest info (NULL if not loaded). */
const struct linux_guest_info *linux_get_guest_info(void);
/* VSCode integration Phase 1: query graphics surface pool.
* Returns 0 and fills outputs if the surface pool was allocated and EPT-mapped
* into the Linux guest; returns -1 if not initialized (e.g. Linux guest not
* loaded). hpa_out receives the host physical address (for UTSM-side blit),
* gpa_out receives the GPA visible inside Linux (for the guest mmap path),
* size_out receives the pool size in bytes. Any output pointer may be NULL. */
int linux_get_surface_info(u64 *hpa_out, u64 *gpa_out, u64 *size_out);
/* VSCode Phase 3: return host virtual address of the graphics surface pool.
* The virtio-gpu 2D backend composites the scanout into this buffer; the
* desktop reads it to blit guest graphics onto the IDE host area.
* Returns NULL if the pool was not allocated (Linux guest not loaded / alloc failed). */
void *linux_get_surface_vaddr(void);
/* Configure VMCS for Linux guest and perform vmlaunch.
* Must be called after vmm_init() + linux_loader_init().
* Returns 0 on successful guest termination, negative on error. */
@@ -193,13 +255,22 @@ int linux_launch(void);
* noapic/nolapic/nosmp: UTSM VMM 只模拟 legacy PIC(8259) + PIT(8254)，
* 不提供 LAPIC/IOAPIC；guest 走 XT-PIC 模式，IRQ vector = 0x30+irq。
* virtio_mmio.device=: 向 guest 声明 virtio-mmio 设备（blk@0xF4000000 IRQ5,
* net@0xF4001000 IRQ6），需 CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y。 */
* net@0xF4001000 IRQ6），需 CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y。
* VSCode Phase 2: kbd@0xF4003000 IRQ8, mouse@0xF4004000 IRQ9 (virtio-input)。
* VSCode Phase 3: gpu@0xF4005000 IRQ10 (virtio-gpu 2D, /dev/dri/card0)。
* VSCode Phase 4: xrootfs@0xF4006000 IRQ11 (可写 virtio-blk, /dev/vdc)。
* 注：slot6 无对应 boot module 时后端不注册，guest 探测会超时跳过，
* 不影响启动（virtio_mmio 对无响应设备只打一条 warn）。 */
#define LINUX_DEFAULT_CMDLINE \
"console=ttyS0,115200 earlyprintk=serial nokaslr " \
"no_timer_check loglevel=7 nohlt idle=poll " \
"noapic nolapic nosmp " \
"virtio_mmio.device=4K@0xF4000000:5 " \
"virtio_mmio.device=4K@0xF4001000:6 " \
"virtio_mmio.device=4K@0xF4002000:7"
"virtio_mmio.device=4K@0xF4002000:7 " \
"virtio_mmio.device=4K@0xF4003000:8 " \
"virtio_mmio.device=4K@0xF4004000:9 " \
"virtio_mmio.device=4K@0xF4005000:10 " \
"virtio_mmio.device=4K@0xF4006000:11"
#endif
CODE/UTSM/include/utsm/log.h
+5
View File
@@ -13,4 +13,9 @@ void log_error(const char *msg);
void log_hex64(const char *prefix, u64 value);
void panic(const char *msg);
/* ---- 内存日志缓冲区（实机启动日志持久化） ---- */
void log_capture_enable(int enable);
const char *log_get_buffer(void);
u32 log_get_length(void);
#endif
CODE/UTSM/include/utsm/pe.h
+38
View File
@@ -24,6 +24,29 @@ typedef struct pe_image_info {
int load_ok; /* 1=加载成功 */
} pe_image_info;
/* ===== 窗口模式（P5 桌面嵌入）=====
* 默认 run() 为全屏独占：shim 直写 Limine framebuffer、直接轮询 PS/2 端口。
* run_windowed() 把 PE GUI 嵌入桌面受管窗口：
* - 渲染目标改为 host 提供的内存 surface（32bpp 0xAARRGGBB）
* - PE 消息队列空转（GetMessage/PeekMessage 无消息）时回调 host->pump()，
* 由 desktop 驱动一帧（渲染全部窗口 + 采集输入 + 注入 PE 队列）
* - 输入由 host 经 inject_scancode/inject_pointer 注入（坐标已转换为
* surface 局部坐标，shim 内部合成 Win32 消息与修饰键状态）
*
* 协作模型约束：
* - pump 回调运行在 PE 大栈上，desktop 帧代码栈用量必须远小于 1MB；
* - pump 内禁止再次调用 run/run_windowed（禁止嵌套 PE 实例）；
* - 关闭 PE 窗口 = inject WM_CLOSE（desktop 经 inject_scancode 无此路径，
* 使用 inject_input 直接投递消息），等待 PE 自愿退出，run 才返回。 */
typedef struct pe_window_host {
int (*pump)(void *ud); /* PE 消息空转让出点；返回 0 继续，非 0 请求退出 */
void *ud;
u8 *surface; /* PE 渲染目标（32bpp 0xAARRGGBB），NULL=全屏 */
u32 width; /* surface 宽（像素） */
u32 height; /* surface 高（像素） */
u32 pitch; /* 字节/行 */
} pe_window_host;
/* PE 服务表 — 通过 boot context reserved[4] 传递 */
typedef struct pe_service {
u64 magic; /* PE_SERVICE_MAGIC */
@@ -34,6 +57,21 @@ typedef struct pe_service {
int (*run)(const void *pe_data, u64 size, const char *cmdline, u64 *exit_code);
/* 释放 pe_load 分配的镜像内存。 */
void (*unload)(pe_image_info *info);
/* ===== ABI 尾部追加（P5 窗口模式）。同镜像一致性假设：
* desktop 与 UTSM 由同一 build.ps1 产出，旧 UTSM 配新 desktop
* 的组合现实中不存在；调用前仍须校验 magic。 ===== */
/* 窗口模式运行：语义同 run，渲染/输入/让出按 pe_window_host 重定向。
* host==NULL 或 host->surface==NULL 时等价 run。 */
int (*run_windowed)(const void *pe_data, u64 size, const char *cmdline,
u64 *exit_code, const pe_window_host *host);
/* 注入键盘扫描码（set-1，bit7=release；e0_prefix!=0 表示 E0 扩展键）。
* shim 内部完成 vk 映射/修饰键跟踪/WM_CHAR 合成，与全屏路径共用。 */
int (*inject_scancode)(u32 scancode, u32 e0_prefix);
/* 注入鼠标状态（surface 局部坐标；buttons bit0=L bit1=R bit2=M）。
* shim 内部与上次状态比较合成 MOUSEMOVE/BUTTONDOWN/UP 边沿。 */
int (*inject_pointer)(i32 x, i32 y, u32 buttons);
/* 直接投递一条 Win32 消息（用于 WM_CLOSE 等宿主发起的控制消息）。 */
int (*inject_input)(u32 msg, u64 wparam, u64 lparam, i32 ptx, i32 pty);
} pe_service;
/* 获取全局 PE 服务实例指针（UTSM 内部使用，外部通过 boot context 获取） */
CODE/UTSM/include/utsm/virtio_mmio.h
+106
View File
@@ -47,6 +47,8 @@
#define VIRTIO_ID_NET 1
#define VIRTIO_ID_BLOCK 2
#define VIRTIO_ID_CONSOLE 3
#define VIRTIO_ID_INPUT 18 /* VSCode Phase 2: virtio-input (keyboard/mouse) */
#define VIRTIO_ID_GPU 16 /* VSCode Phase 3: virtio-gpu 2D */
/* device status bits */
#define VIRTIO_STATUS_ACKNOWLEDGE 1
@@ -85,6 +87,10 @@ struct virtio_backend {
/* 读取 device config 空间（offset 相对 0x100）。返回 32 位值。 */
u32 (*read_config)(u32 offset, int width);
/* VSCode Phase 2: 写入 device config 空间（offset 相对 0x100）。
* virtio-input 用此通道设置 select/subsel 再读结果；其它设备 config
* 只读，置 NULL 时框架忽略 config 写。 */
void (*write_config)(u32 offset, u32 value);
/* 通知：guest 写入 QUEUE_NOTIFY，后端处理该队列的请求。 */
void (*queue_notify)(u32 queue_idx);
/* 复位设备。 */
@@ -153,13 +159,113 @@ int virtio_queue_get_ptrs(u32 device_id, u32 queue_idx,
* 由后端在写 used ring 元素后调用，内部做内存屏障。 */
void virtio_queue_bump_used(struct virtq_used *used, u16 new_idx);
/* VSCode Phase 2: 按 gpa_base 定位队列（用于 device_id 相同的多实例设备，
* 如两个 virtio-input：键盘+鼠标同为 VIRTIO_ID_INPUT=18）。
* 语义与 virtio_queue_get_ptrs 一致，只是查找键由 device_id 改为 gpa_base。 */
int virtio_queue_get_ptrs_by_gpa(u64 gpa_base, u32 queue_idx,
struct virtq_desc **desc_out,
struct virtq_avail **avail_out,
struct virtq_used **used_out,
u32 *queue_num_out);
/* 异步触发设备中断（设置 INTERRUPT_STATUS bit0 并向 guest 注入虚拟 IRQ）。
* 用于后端在 QUEUE_NOTIFY 上下文之外完成工作（如周期轮询收到 RX 包）。
* device_id: VIRTIO_ID_*；设备未注册或 irq==0 时为空操作。 */
void virtio_mmio_raise_irq(u32 device_id);
/* VSCode Phase 2: 按 gpa_base 触发中断。用于 device_id 相同的多实例设备
*（两个 virtio-input 同为 18）：virtio_mmio_raise_irq(18) 只命中第一个。 */
void virtio_mmio_raise_irq_by_gpa(u64 gpa_base);
/* 周期轮询 virtio-net RX 路径（填充 guest 已投递的 RX buffer，
* 有填充时自动注入 IRQ）。由 vmexit 的 preemption timer 路径调用。 */
void virtio_net_poll(void);
/* ===== VSCode Phase 2: virtio-input 后端 ===== */
/* Linux input event types/codes (subset, see <uapi/linux/input-event-codes.h>).
* We only need the few event types we actually forward from Deshab. */
#define VIO_INPUT_EV_KEY 0x01
#define VIO_INPUT_EV_REL 0x02 /* relative movement (mouse) */
#define VIO_INPUT_EV_ABS 0x03
#define VIO_INPUT_EV_SYN 0x00 /* sync marker */
#define VIO_INPUT_REL_X 0x00
#define VIO_INPUT_REL_Y 0x01
#define VIO_INPUT_BTN_LEFT 0x110
#define VIO_INPUT_BTN_RIGHT 0x111
#define VIO_INPUT_BTN_MIDDLE 0x112
/* virtio_input_event (8 bytes, little-endian). Matches Linux struct
* virtio_input_event in <uapi/linux/virtio_input.h>. */
struct virtio_input_event {
u16 type;
u16 code;
u32 value;
} __attribute__((packed));
/* 注册键盘+鼠标两个 virtio-input 后端（无设备时安全空操作）。
* 在 virtio_mmio_init 中调用。 */
void virtio_input_backend_init(void);
/* 推送键盘事件（type=EV_KEY, code=linux keycode, value=0/1/2）。
* value: 0=release, 1=press, 2=repeat。 */
void virtio_input_push_keyboard(u16 code, u32 value);
/* 推送鼠标事件。三种便捷封装：
* push_mouse_rel(axis, value) — 相对位移 (EV_REL, REL_X/REL_Y)
* push_mouse_button(btn, value)— 按键 (EV_KEY, BTN_LEFT/RIGHT/MIDDLE)
* push_mouse_syn() — 同步标记 (EV_SYN) */
void virtio_input_push_mouse_rel(u16 axis, i32 value);
void virtio_input_push_mouse_button(u16 btn, u32 value);
void virtio_input_push_mouse_syn(void);
/* 周期轮询：把挂起的输入事件排空到 guest eventq 已投递的空 buffer 中，
* 有事件投递时自动注入 IRQ。由 vmexit 的 preemption timer 路径调用。 */
void virtio_input_poll(void);
/* ===== VSCode Phase 3: virtio-gpu 2D 后端 ===== */
/* Scanout 查询结果：desktop 在 IDE attached 时读取，把 guest 图形 blit 到
* Deshab framebuffer 的 IDE host 区域。
* host_vaddr : scanout 影子缓冲的 host 虚拟地址（位于 graphics surface pool，
* 16MB，足够 1920×1080×4）。guest virtio-gpu 驱动经
* TRANSFER_TO_HOST_2D + RESOURCE_FLUSH 把帧合成到这里。
* width/height/stride : scanout 几何（XRGB8888，stride = width*4）
* dirty : 1 = 自上次查询以来有新帧合成（查询会清零该位）
* enabled : 1 = scanout 已绑定一个 2D resource（X server 已 SET_SCANOUT）
* dirty_x/y/w/h : Phase 7 累积 dirty rect（scanout 坐标系并集），
* 查询随 dirty 一并清零；dirty=0 时全为 0。
* desktop 据此只 blit 变化区域（尾部追加，ABI 兼容）。 */
struct virtio_gpu_scanout_info {
void *host_vaddr;
u32 width;
u32 height;
u32 stride;
u32 dirty;
u32 enabled;
u32 dirty_x;
u32 dirty_y;
u32 dirty_w;
u32 dirty_h;
/* P7.6: hardware cursor state（尾部追加，ABI 兼容）。
* cursor_visible=1 时 cursor_bitmap 指向 ARGB 像素（row stride=64），
* desktop 在 blit 后 alpha-blend 叠加到 IDE host 区域。 */
u32 cursor_visible;
u32 cursor_x;
u32 cursor_y;
u32 cursor_hot_x;
u32 cursor_hot_y;
u32 cursor_w;
u32 cursor_h;
void *cursor_bitmap;
};
/* 注册 virtio-gpu 2D 后端（slot 5 @ 0xF4005000 IRQ10）。
* 在 virtio_mmio_init 中调用。无 surface pool 时安全降级（scanout disabled）。 */
void virtio_gpu_backend_init(void);
/* 查询当前 scanout 状态（desktop blit 用）。返回 0 成功，-1 后端未就绪。 */
int virtio_gpu_get_scanout_info(struct virtio_gpu_scanout_info *out);
#endif /* UTSM_VIRTIO_MMIO_H */
CODE/UTSM/include/utsm/vmm.h
+6 -1
View File
@@ -48,9 +48,14 @@ extern volatile struct vmexit_guest_regs g_guest_regs;
* handle_hlt 检查此标志：Linux guest HLT 时 park（推进 RIP，exit-to-host），
* self-test guest HLT 时 terminate。
* g_guest_parked: 1 = Linux guest 已 HLT 驻留，可被 linux_resume() 唤醒。
* linux_compat_service 通过此标志判断 guest 是否就绪。 */
* linux_compat_service 通过此标志判断 guest 是否就绪。
*
* g_xj380_guest_active: 1 = 当前运行的 guest 是 OpenXJ380 guest。
* handle_hlt 检查此标志：XJ380 guest HLT 时推进 RIP 并立即 vmresume
* （继续执行，不 park 不 terminate）。同一时刻只有一个 guest active。 */
extern volatile int g_linux_guest_active;
extern volatile int g_guest_parked;
extern volatile int g_xj380_guest_active;
/* ===== VM-Exit host 恢复点（vmm.c 定义，vmm.c / linux_boot.c / linux_resume.c 共用） =====
*
CODE/UTSM/include/utsm/vmx.h
+4 -2
View File
@@ -73,10 +73,10 @@
#define VMCS_GUEST_GS_SELECTOR 0x080A
#define VMCS_GUEST_LDTR_SELECTOR 0x080C
#define VMCS_GUEST_TR_SELECTOR 0x080E
#define VMCS_GUEST_CS_LIMIT 0x4800
#define VMCS_GUEST_ES_LIMIT 0x4800
#define VMCS_GUEST_CS_LIMIT 0x4802
#define VMCS_GUEST_SS_LIMIT 0x4804
#define VMCS_GUEST_DS_LIMIT 0x4806
#define VMCS_GUEST_ES_LIMIT 0x4801
#define VMCS_GUEST_FS_LIMIT 0x4808
#define VMCS_GUEST_GS_LIMIT 0x480A
#define VMCS_GUEST_LDTR_LIMIT 0x480C
@@ -95,6 +95,7 @@
#define VMCS_GUEST_PREEMPTION_TIMER 0x482E
/* 64-bit guest-state fields（与 PDPTR 共享编码，仅在 EPT 启用时为 EFER/PAT） */
#define VMCS_GUEST_LINK_POINTER 0x2800 /* P8.4: must be 0xFFFFFFFFFFFFFFFF */
#define VMCS_GUEST_IA32_EFER 0x2806
#define VMCS_GUEST_IA32_PAT 0x2804
#define VMCS_GUEST_IA32_PERF_GLOBAL_CTRL 0x2808
@@ -265,6 +266,7 @@ int vmx_enable(void);
int vmx_disable(void);
int vmx_vmcs_alloc(u64 *phys_out);
int vmx_vmcs_load(u64 phys);
int vmx_vmcs_clear(u64 phys); /* P8.4: VMCLEAR before VMLAUNCH */
u64 vmx_vmcs_read(u64 field);
void vmx_vmcs_write(u64 field, u64 value);
int vmx_vmlaunch(void);
CODE/UTSM/include/utsm/xj380_loader.h
+106
View File
@@ -0,0 +1,106 @@
#ifndef UTSM_XJ380_LOADER_H
#define UTSM_XJ380_LOADER_H
#include <utsm/types.h>
/* xj380_loader.h — OpenXJ380 (kernel.krl) guest loader for UTSM VMX non-root guest.
*
* 三内核架构路线 B：UTSM hypervisor 同时运行 Linux 与 OpenXJ380 两个 VM guest。
* 本模块把 OpenXJ380 编译产物 kernel.krl（固定链接 0xFFFFFFFF80000000 的
* ELF64 ET_EXEC）作为第二 guest 加载：
* - 解析 ELF PT_LOAD 段 → 装入 guest 物理内存
* - 构造 guest 初始页表（恒等 + HHDM + 内核区三区布局，同 XJ380 引导器契约）
* - 构造 BOOT_CONFIG / FrameBufferConfig / 伪 EFI_SYSTEM_TABLE 交接
* - 构造 MADT/FADT/HPET/MCFG 桩表（LAPIC/IOAPIC/HPET/MMCONF 均为幽灵地址）
* - 建立 EPT 映射（boot area / framebuffer / kernel / RAM）
*
* XJ380 内核侧启动契约（证据见 OpenXJ380/boot/include/boot.h 与
* OpenXJ380/kernel/main.cpp / memory/frame.cpp）：
* - KernelMain(fbc, SystemTable, BootConfig) — 3 个 SysV 参数，引用退化为指针
* - BOOT_CONFIG 在入口立即被 memcpy 拷贝（main.cpp:281），原缓冲仅需入口可读
* - MemoryMap.Buffer / saved_mtrrs 是物理地址，内核自行 +0xffff800000000000
* - temp_stack[] 是 HHDM 虚拟地址数组（仅拷贝，1 CPU 时不 deref）
* - MADT 在清低半（main.cpp:392）之前按物理地址直读，之后经 HHDM 读
*
* 里程碑 M1：guest 启动至根文件系统挂载（预期在 mount_root 死循环处停止，
* 无虚拟块设备）。串口经 UTSM COM1 模拟可见 XJ380 启动全程。
*/
/* ===== XJ380 guest GPA 布局 =====
*
* 0x00000000-0x0000FFFF : 保留（XJ380 AP 跳板区 APU_BASE_ADDR=0x10000）
* 0x00020000-0x00033FFF : UTSM loader 私有 boot area（<1MB，内核不分配）
* page tables / GDT / ACPI 桩表 / 内存图 /
* BOOT_CONFIG / MTRR 缓冲 / stack / 伪 EFI 表
* 0x00100000-0x00400000 : framebuffer 1024x768x4（3MB，隐式保留）
* 0x01000000-0x02FFFFFF : kernel.krl 内核镜像窗口（32MB，隐式保留）
* 0x03000000-0x43000000 : guest RAM 1GB（内存图中唯一的 Conventional 区）
*/
#define XJ380_KERNEL_VADDR 0xFFFFFFFF80000000ULL /* XJ380 linker.ld 固定链接地址 */
#define XJ380_HHDM_OFFSET 0xFFFF800000000000ULL /* XJ380 HHDM 常量（hhdm.cpp:15） */
#define XJ380_BOOT_AREA_GPA 0x00020000ULL /* 128KB，避开 AP 跳板 0x10000 */
#define XJ380_PGT_GPA (XJ380_BOOT_AREA_GPA + 0x0000) /* 8 页: PML4/PDPT0/PD0-3/PDPT_K/PD_K */
#define XJ380_PGT_SIZE (8 * 4096)
#define XJ380_GDT_GPA (XJ380_PGT_GPA + XJ380_PGT_SIZE)
#define XJ380_MADT_GPA (XJ380_GDT_GPA + 0x1000)
#define XJ380_FADT_GPA (XJ380_MADT_GPA + 0x1000)
#define XJ380_MCFG_GPA (XJ380_FADT_GPA + 0x1000)
#define XJ380_HPET_GPA (XJ380_MCFG_GPA + 0x1000)
#define XJ380_MEMMAP_GPA (XJ380_HPET_GPA + 0x1000)
#define XJ380_BOOTCFG_GPA (XJ380_MEMMAP_GPA + 0x1000)
#define XJ380_MTRR_GPA (XJ380_BOOTCFG_GPA + 0x1000)
#define XJ380_STACK_GPA (XJ380_MTRR_GPA + 0x2000) /* 8KB guest 启动栈 */
#define XJ380_FAKEEFI_GPA (XJ380_STACK_GPA + 0x2000)
#define XJ380_FBC_GPA (XJ380_FAKEEFI_GPA + 0x1000)
#define XJ380_BOOT_AREA_SIZE (XJ380_FBC_GPA + 0x1000 - XJ380_BOOT_AREA_GPA) /* 至 FBC 结束 */
#define XJ380_BOOT_STACK_TOP (XJ380_STACK_GPA + 0x2000)
#define XJ380_GUEST_FB_GPA 0x00100000ULL /* 1MB */
#define XJ380_FB_WIDTH 1024
#define XJ380_FB_HEIGHT 768
#define XJ380_FB_BPP 4
#define XJ380_FB_SIZE ((u64)XJ380_FB_WIDTH * XJ380_FB_HEIGHT * XJ380_FB_BPP)
#define XJ380_GUEST_KERNEL_GPA 0x01000000ULL /* 16MB */
#define XJ380_GUEST_KERNEL_MAX (32 * 1024 * 1024) /* 内核窗口 16MB..48MB */
#define XJ380_GUEST_RAM_GPA 0x03000000ULL /* 48MB */
#define XJ380_GUEST_RAM_SIZE 0x40000000ULL /* 1GB (0x03000000..0x43000000) */
#define XJ380_GUEST_RAM_MIN 0x10000000ULL /* 降级下限 256MB */
/* BOOT_CONFIG.boot_flags（与 OpenXJ380 boot/include/boot.h 一致） */
#define XJ380_BOOT_FLAG_DISABLE_KMOD (1ULL << 2)
#define XJ380_BOOT_FLAG_SAFE_STORAGE_IO (1ULL << 3)
/* ===== 加载后的 XJ380 guest 状态 ===== */
struct xj380_guest_info {
u64 kernel_gpa; /* 内核段装入的 GPA 基址 */
u64 kernel_entry; /* 64 位入口（guest 虚拟地址 0xFFFFFFFF80000000+） */
u64 kernel_size; /* 内核跨度（memsz 上界 - 基址） */
u64 pgt_gpa; /* guest CR3（页表 GPA） */
u64 gdt_gpa; /* guest GDT GPA */
u64 ram_gpa; /* guest RAM GPA 基址 */
u64 ram_size; /* guest RAM 实际大小 */
u64 fb_gpa; /* framebuffer GPA */
int loaded; /* 1 = 加载成功 */
};
/* 在 Limine boot module 中查找 XJ380 内核（路径含 "xj380"）。
* 返回模块数据指针，*size_out 为大小；未找到返回 NULL。 */
void *xj380_find_kernel_module(u64 *size_out);
/* 初始化 XJ380 guest：解析 ELF、分配内存、构造页表/GDT/ACPI 桩表/
* BOOT_CONFIG/内存图、EPT 映射。返回 0 成功，负值失败。 */
int xj380_loader_init(void);
/* 获取加载后的 guest 信息（未加载返回 NULL）。 */
const struct xj380_guest_info *xj380_get_guest_info(void);
/* 配置 VMCS 并 vmlaunch XJ380 guest。
* 前置条件：vmm_init() + xj380_loader_init()。
* guest 终止（异常/三重故障/0xCF9 重启）后返回；期间 host 挂起。
* 返回 0 表示 guest 终止返回，负值表示启动失败。 */
int xj380_launch(void);
#endif /* UTSM_XJ380_LOADER_H */
CODE/UTSM/kernel/dsk_loader.c
+74 -29
View File
@@ -7,6 +7,7 @@
#include <utsm/linux_compat.h>
#include <utsm/instr.h>
#include "../arch/x86_64/limine.h"
#include "../../tools/fat32_lfn.h"
#define DSK_PATH "/system/deshab64/deshab.elf"
#define DSK_CMDLINE "dsk:main"
@@ -176,8 +177,9 @@ static struct limine_file *dsk_find_module(void) {
/* ---- FAT32 block-provider file reader ---- */
static u8 g_dsk_fat32_disk[131072]; /* 256-sector BPB+FAT+root dir buffer (与 DSK 端一致) */
static u8 g_dsk_fat32_cluster[4096]; /* 8-sector cluster buffer */
/* 实机要求: 文件缓冲区足够大容纳 deshab.elf (~1.5MB) */
static u8 g_dsk_fat32_filedata[2097152]; /* 2MB file data buffer */
/* 实机要求: 文件缓冲区足够容纳 deshab.elf (~1.5MB) 及 SYSTEM/lib 下的
* 大型 DLL（shell32.dll ~8MB, uiautomationcore.dll ~4.3MB） */
static u8 g_dsk_fat32_filedata[10485760]; /* 10MB file data buffer */
/* BUG-019 修复: FAT 按需扇区读取缓冲区（仅 512 字节），
* 当 FAT 条目偏移超出 g_dsk_fat32_disk (128KB) 时使用。 */
static u8 g_dsk_fat32_fat_sec[512];
@@ -344,11 +346,13 @@ static int dsk_load_from_block_fat32(const void **out_addr, u64 *out_size) {
/* ---- FAT32 subdirectory traversal ---- */
/* 在指定起始 cluster 的目录项中查找 name11。
/* 在指定起始 cluster 的目录项中查找 name11（8.3）或 long_name（LFN 长名）。
* long_name 为 NULL 时仅按 8.3 匹配（向后兼容）。
* is_dir=1 时只匹配子目录（attr & 0x10），is_dir=0 时只匹配文件。
* 返回 0 成功，out_clus/out_size 返回匹配项的起始 cluster 和大小。 */
* 返回 0 成功，out_clus/out_size 返回匹配项的起始 cluster 和大小。
* 注意：LFN 缓冲跨簇遍历持续存活，支持跨簇边界的 LFN 链。 */
static int fat32_find_in_dir(u32 start_clus, const char *name11, int is_dir,
u32 *out_clus, u32 *out_size) {
u32 *out_clus, u32 *out_size, const char *long_name) {
const dkm_kernel_api *api = dkm_get_kernel_api();
if (!api || !api->block || !api->block->device_count) return -1;
@@ -360,6 +364,10 @@ static int fat32_find_in_dir(u32 start_clus, const char *name11, int is_dir,
u32 data_start_sec = bpb->reserved_sector_count + (u32)bpb->fat_count * bpb->sectors_per_fat;
u32 spc = bpb->sectors_per_cluster;
/* LFN 缓冲必须在簇循环外声明：跨簇 LFN 链需要持续存活 */
fat32_lfn_buf lfn;
fat32_lfn_init(&lfn);
u32 clus = start_clus;
while (clus >= 2 && clus < 0x0FFFFFF8) {
u32 clus_lba = data_start_sec + (clus - 2) * spc;
@@ -367,22 +375,50 @@ static int fat32_find_in_dir(u32 start_clus, const char *name11, int is_dir,
int st = api->block->read(0, clus_lba, spc, cb);
if (st != 0) return -3;
const fat32_dir_entry *dir = (const fat32_dir_entry *)cb;
for (u32 e = 0; e * 32 < spc * 512; e++) {
if (dir[e].name[0] == 0) break;
if ((u8)dir[e].name[0] == 0xE5) continue;
if (dir[e].attr == 0x0F) continue;
if (dir[e].attr & 0x08) continue;
if (!fat32_name11_eq(dir[e].name, name11)) continue;
/* 名称匹配，检查类型 */
int entry_is_dir = (dir[e].attr & 0x10) ? 1 : 0;
if (entry_is_dir != is_dir) continue;
*out_clus = fat32_read_u16((const u8 *)&dir[e].cluster_low) |
((u32)fat32_read_u16((const u8 *)&dir[e].cluster_high) << 16);
*out_size = dir[e].file_size;
return 0;
const u8 *entries = (const u8 *)cb;
u32 entry_count = (spc * 512) / 32;
for (u32 e = 0; e < entry_count; e++) {
const u8 *entry = entries + e * 32;
if (entry[0] == 0) break;
if ((u8)entry[0] == 0xE5) {
fat32_lfn_init(&lfn);
continue;
}
const fat32_dir_entry *de = (const fat32_dir_entry *)entry;
int is_short = fat32_lfn_process(&lfn, entry);
if (!is_short) continue; /* LFN 片段 */
if (de->attr & 0x08) {
fat32_lfn_init(&lfn);
continue; /* 卷标 */
}
int entry_is_dir = (de->attr & 0x10) ? 1 : 0;
if (entry_is_dir != is_dir) {
fat32_lfn_init(&lfn);
continue;
}
/* 匹配检查：先 8.3 短名，再 LFN 长名 */
int matched = 0;
if (name11 && fat32_name11_eq(de->name, name11)) {
matched = 1;
} else if (long_name) {
if (lfn.valid) {
char ascii[FAT32_LFN_MAX];
int n = fat32_lfn_to_ascii(&lfn, ascii, sizeof(ascii));
if (n >= 0 && fat32_lfn_streq_ci(ascii, long_name)) matched = 1;
}
if (!matched) {
char short_disp[13];
fat32_lfn_short_to_str((const u8 *)de->name, short_disp);
if (fat32_lfn_streq_ci(short_disp, long_name)) matched = 1;
}
}
if (matched) {
*out_clus = fat32_read_u16((const u8 *)&de->cluster_low) |
((u32)fat32_read_u16((const u8 *)&de->cluster_high) << 16);
*out_size = de->file_size;
return 0;
}
fat32_lfn_init(&lfn);
}
/* 跟随 FAT 链 — BUG-019: 使用按需 FAT 读取 */
@@ -392,7 +428,10 @@ static int fat32_find_in_dir(u32 start_clus, const char *name11, int is_dir,
}
/* 按路径查找文件并读取内容。
* path: '/' 分隔的 8.3 格式路径（如 "SYSTEM /DESHAB64 /FUCK "）。
* path: '/' 分隔的路径。支持两种格式：
* 1) 8.3 路径（如 "SYSTEM /DESHAB64 /FUCK "，每段恰好 11 字符）
* 2) 长名路径（如 "lib/libtest.so"）
* 同时保留 8.3 短名（补空格）和原始长名传给 fat32_find_in_dir。
* out_data: 返回在 g_dsk_fat32_filedata 中的文件数据指针。
* out_size: 返回文件大小。
* 返回 0 成功。 */
@@ -419,15 +458,19 @@ int fat32_read_path(const char *path, u8 **out_data, u32 *out_size) {
u32 cur_clus = bpb->root_cluster; /* 从根目录开始 */
while (pos < path_len) {
/* 提取一个路径组件（到下一个 '/' 或结尾） */
char comp[12]; /* 11 字符 8.3 名 + \0 */
u32 ci = 0;
while (pos < path_len && path[pos] != '/' && ci < 11) {
comp[ci++] = path[pos++];
/* 提取一个路径组件（到下一个 '/' 或结尾），同时保留原始串用于 LFN 匹配 */
char comp[12]; /* 11 字符 8.3 名 + \0 */
char orig[260]; /* 原始长名 */
u32 ci = 0, oi = 0;
while (pos < path_len && path[pos] != '/') {
if (ci < 11) comp[ci++] = path[pos];
if (oi + 1 < sizeof(orig)) orig[oi++] = path[pos];
pos++;
}
/* 不足 11 字符则补空格 */
while (ci < 11) comp[ci++] = ' ';
comp[11] = 0;
orig[oi] = 0;
/* 跳过 '/' */
if (pos < path_len && path[pos] == '/') pos++;
@@ -438,7 +481,8 @@ int fat32_read_path(const char *path, u8 **out_data, u32 *out_size) {
if (is_last) {
/* 最后一级：查找文件 */
u32 found_clus = 0, found_size = 0;
int rc = fat32_find_in_dir(cur_clus, comp, 0, &found_clus, &found_size);
int rc = fat32_find_in_dir(cur_clus, comp, 0, &found_clus, &found_size,
(oi > 0 && oi != 11) ? orig : 0);
if (rc != 0) return -4;
if (found_size > sizeof(g_dsk_fat32_filedata)) return -5;
@@ -466,7 +510,8 @@ int fat32_read_path(const char *path, u8 **out_data, u32 *out_size) {
} else {
/* 中间级：查找子目录 */
u32 sub_clus = 0, sub_size = 0;
int rc = fat32_find_in_dir(cur_clus, comp, 1, &sub_clus, &sub_size);
int rc = fat32_find_in_dir(cur_clus, comp, 1, &sub_clus, &sub_size,
(oi > 0 && oi != 11) ? orig : 0);
if (rc != 0) return -7;
cur_clus = sub_clus;
}
CODE/UTSM/kernel/dsk_loader.d
+2 -1
View File
@@ -3,7 +3,7 @@ kernel/dsk_loader.o: kernel\dsk_loader.c include\utsm\dsk.h \
include\utsm\dma.h include\utsm\block.h include\utsm\net.h \
include\utsm\paging.h include\utsm\log.h include\utsm\pe.h \
include\utsm\linux_compat.h include\utsm\instr.h \
kernel\..\arch\x86_64\limine.h
kernel\..\arch\x86_64\limine.h kernel\..\..\tools\fat32_lfn.h
include\utsm\dsk.h:
include\utsm\types.h:
include\utsm\arena.h:
@@ -17,3 +17,4 @@ include\utsm\pe.h:
include\utsm\linux_compat.h:
include\utsm\instr.h:
kernel\..\arch\x86_64\limine.h:
kernel\..\..\tools\fat32_lfn.h:
CODE/UTSM/kernel/dsk_loader.o
BIN
View File
Binary file not shown.
CODE/UTSM/kernel/log.c
+39 -7
View File
@@ -1,10 +1,42 @@
#include <utsm/log.h>
/* ---- 内存日志缓冲区（实机启动日志持久化） ----
* 默认启用捕获：所有日志同时写串口和内存缓冲。
* 块设备就绪后由 disk_log_flush() 把缓冲区写入磁盘原始扇区。 */
#define LOG_BUF_SIZE 524288u /* 512KB, 覆盖 LBA 2-1000 (999 扇区 ~500KB) */
static char g_log_buf[LOG_BUF_SIZE];
static u32 g_log_len = 0;
static int g_log_capture_on = 1;
void log_capture_enable(int enable) {
g_log_capture_on = enable;
}
const char *log_get_buffer(void) {
return g_log_buf;
}
u32 log_get_length(void) {
return g_log_len;
}
static void log_emit(const char *s) {
serial_write(s);
if (g_log_capture_on && s) {
while (*s) {
if (g_log_len < LOG_BUF_SIZE) {
g_log_buf[g_log_len++] = *s;
}
s++;
}
}
}
static void log_line(const char *level, const char *msg) {
serial_write(level);
serial_write(" ");
serial_write(msg);
serial_write("\n");
log_emit(level);
log_emit(" ");
log_emit(msg);
log_emit("\n");
}
void log_info(const char *msg) {
@@ -28,7 +60,7 @@ void log_hex64(const char *prefix, u64 value) {
buf[2 + i] = hex[(value >> ((15 - i) * 4)) & 0xf];
}
buf[18] = 0;
serial_write(prefix);
serial_write(buf);
serial_write("\n");
log_emit(prefix);
log_emit(buf);
log_emit("\n");
}
CODE/UTSM/kernel/log.o
BIN
View File
Binary file not shown.
CODE/UTSM/kernel/main.c
+245 -45
View File
@@ -9,9 +9,11 @@
#include <utsm/net.h>
#include <utsm/ipc_shm.h>
#include <utsm/linux_compat.h>
#include <utsm/xj380_loader.h>
#include <utsm/instr.h>
#include "ini_parser.h"
#include "../arch/x86_64/limine.h"
#include "../pe/pe_dll_manager.h"
void arch_halt_forever(void);
@@ -20,6 +22,10 @@ extern volatile struct limine_module_request g_module_request;
/* dkm/manifest.c: 带 FUCK [drivers] 过滤的 manifest 加载入口 */
void dsm_load_by_manifest_ex(const ini_config *cfg);
/* dsk_loader.c: 按路径读取 FAT32 文件到 g_dsk_fat32_filedata 静态缓冲。
* Phase 1 已支持 LFN 长文件名 + 子目录遍历。 */
extern int fat32_read_path(const char *path, u8 **out_data, u32 *out_size);
/* ---- 运行期配置全局变量（从 FUCK 文件初始化） ---- */
u32 g_utsm_max_segments = UTSM_MAX_SEGMENTS_DEFAULT;
u32 g_utsm_max_capabilities = UTSM_MAX_CAPABILITIES_DEFAULT;
@@ -27,6 +33,71 @@ u32 g_utsm_max_pckc_keys = UTSM_MAX_PCKC_KEYS_DEFAULT;
u64 g_utsm_arena_size = UTSM_ARENA_SIZE_DEFAULT;
u64 g_utsm_dirty_shard_pages = UTSM_DIRTY_SHARD_PAGES_DEFAULT;
/* ---- 兼容层配置全局变量（[compat] 段，在所有使用它们的函数前定义） ---- */
char g_compat_lib_path[32] = "lib"; /* FAT32 根目录下的库子目录名 */
char g_compat_linux_guest_path[64] = "/usr/lib/deshab"; /* Linux guest 内库目录路径 */
int g_compat_linux_lib_sync = 1; /* 启动时推送 .so 到 Linux guest */
int g_compat_pe_dll_search = 1; /* PE 加载时从 FAT32 lib 搜索真实 DLL */
int g_compat_vscode_install = 1; /* 启动时安装 VSCode tarball 到 guest /opt */
/* 将 FUCK [compat] 区的配置应用到兼容层全局变量。
* 必须在 utsm_apply_config 之后调用。 */
static void utsm_apply_compat_config(const ini_config *cfg) {
if (!cfg) return;
const char *lib_path = ini_get(cfg, "compat", "lib_path");
if (lib_path && lib_path[0]) {
int i = 0;
while (lib_path[i] && i + 1 < (int)sizeof(g_compat_lib_path)) {
g_compat_lib_path[i] = lib_path[i];
i++;
}
g_compat_lib_path[i] = 0;
}
const char *guest_path = ini_get(cfg, "compat", "linux_lib_guest_path");
if (guest_path && guest_path[0]) {
int i = 0;
while (guest_path[i] && i + 1 < (int)sizeof(g_compat_linux_guest_path)) {
g_compat_linux_guest_path[i] = guest_path[i];
i++;
}
g_compat_linux_guest_path[i] = 0;
}
g_compat_linux_lib_sync = ini_get_bool(cfg, "compat", "linux_lib_sync", 1);
g_compat_pe_dll_search = ini_get_bool(cfg, "compat", "pe_dll_search", 1);
g_compat_vscode_install = ini_get_bool(cfg, "compat", "vscode_install", 1);
log_info("[UTSM] compat config applied");
log_info("[UTSM] lib_path=");
log_info(g_compat_lib_path);
log_info("[UTSM] linux_guest_path=");
log_info(g_compat_linux_guest_path);
log_hex64("[UTSM] linux_lib_sync=", (u64)g_compat_linux_lib_sync);
log_hex64("[UTSM] pe_dll_search=", (u64)g_compat_pe_dll_search);
log_hex64("[UTSM] vscode_install=", (u64)g_compat_vscode_install);
}
/* DLL 文件读取回调：从 FAT32 根目录下 lib/ 子目录读取 DLL。
* 路径构造成 "<g_compat_lib_path>/<name>"（lib 在 FAT32 根，不是 SYSTEM/lib！）。 */
static int dll_reader_from_fat32(const char *name, u8 **out_data, u32 *out_size) {
if (!name || !out_data || !out_size) return -1;
char path[128];
int pl = 0;
/* 拼接 g_compat_lib_path */
int i = 0;
while (g_compat_lib_path[i] && pl + 1 < (int)sizeof(path)) {
path[pl++] = g_compat_lib_path[i++];
}
if (pl + 1 >= (int)sizeof(path)) return -1;
path[pl++] = '/';
/* 拼接 name */
i = 0;
while (name[i] && pl + 1 < (int)sizeof(path)) {
path[pl++] = name[i++];
}
path[pl] = 0;
return fat32_read_path(path, out_data, out_size);
}
/* 将 FUCK [utsm] 区的配置应用到运行期全局变量 */
static void utsm_apply_config(const ini_config *cfg) {
if (!cfg) return;
@@ -40,6 +111,9 @@ static void utsm_apply_config(const ini_config *cfg) {
log_hex64("[UTSM] max_segments=", g_utsm_max_segments);
log_hex64("[UTSM] max_pckc_keys=", g_utsm_max_pckc_keys);
log_hex64("[UTSM] dirty_shard_pages=", g_utsm_dirty_shard_pages);
/* 兼容层配置（[compat] 段）— 复用同一 cfg 对象 */
utsm_apply_compat_config(cfg);
}
/* ---- 全局启动配置（从 FUCK 文件读取） ---- */
@@ -75,6 +149,73 @@ static int utsm_load_fuck_config(ini_config *cfg) {
return -2;
}
/* === 实机日志持久化：把内存日志缓冲区写入磁盘原始扇区 ===
* 开发测试用：实机无串口时，启动后用 WinHex/dd 读取磁盘对应扇区即可查看日志。
* 扇区范围由 FUCK [boot] disk_log_start / disk_log_end 配置（默认 2-1000）。
* 注意: 写入 LBA 1-33 会覆盖 GPT header/entries，重启后 Limine 可能无法找到 ESP。
* 建议测试盘从 LBA 34 开始，或测试后重新烧录镜像。 */
static void disk_log_flush(int start_lba, int end_lba) {
const dkm_kernel_api *api = dkm_get_kernel_api();
if (!api || !api->block || !api->block->write || !api->block->device_count) {
log_warn("[UTSM] disk_log: block device unavailable, skip");
return;
}
if (api->block->device_count() == 0) {
log_warn("[UTSM] disk_log: no block device, skip");
return;
}
if (end_lba <= start_lba) {
log_warn("[UTSM] disk_log: invalid sector range");
return;
}
const char *buf = log_get_buffer();
u32 len = log_get_length();
if (len == 0) {
log_warn("[UTSM] disk_log: log buffer empty, skip");
return;
}
u32 avail_sectors = (u32)(end_lba - start_lba + 1);
u32 avail_bytes = avail_sectors * 512;
u32 write_bytes = (len < avail_bytes) ? len : avail_bytes;
u32 full_sectors = write_bytes / 512;
u32 rem_bytes = write_bytes % 512;
u64 lba = (u64)start_lba;
u32 offset = 0;
/* 写完整扇区（AHCI 单次最多 8 扇区，block API 内部分块） */
while (full_sectors > 0) {
u32 chunk = (full_sectors > 8) ? 8 : full_sectors;
int st = api->block->write(0, lba, chunk, buf + offset);
if (st != 0) {
log_error("[UTSM] disk_log: write failed");
log_hex64("[UTSM] disk_log: lba=", lba);
return;
}
lba += chunk;
offset += chunk * 512;
full_sectors -= chunk;
}
/* 最后一个不完整扇区：补零后写入 */
if (rem_bytes > 0) {
u8 tail[512];
for (u32 i = 0; i < 512; i++) tail[i] = 0;
for (u32 i = 0; i < rem_bytes; i++) tail[i] = (u8)buf[offset + i];
int st = api->block->write(0, lba, 1, tail);
if (st != 0) {
log_error("[UTSM] disk_log: tail write failed");
return;
}
}
log_info("[UTSM] disk_log: flushed to disk");
log_hex64("[UTSM] disk_log: start_lba=", (u64)start_lba);
log_hex64("[UTSM] disk_log: end_lba=", (u64)end_lba);
log_hex64("[UTSM] disk_log: bytes=", write_bytes);
}
void kernel_main(void) {
/* ---- 插桩: 启动总时间戳 ---- */
INSTR_TS_DECL(boot_total);
@@ -236,6 +377,93 @@ void kernel_main(void) {
dkm_fill_platform_info();
INSTR_TS_END(ts_dkm, "dkm_init");
/* === VMM — 可通过 FUCK [boot] vmm=0 跳过 ===
* P8.4: Moved BEFORE DKM driver loading so VMM self-test runs even if
* a stage2 driver (e.g. fat32) crashes under KVM nested VMX. */
int run_vmm = ini_get_bool(cfg, "boot", "vmm", 1);
if (run_vmm && vmm_init() == 0) {
INSTR_TS_DECL(ts_vmm);
INSTR_TS_BEGIN(ts_vmm);
log_info("[UTSM] VMM init ok");
int vmm_st = vmm_self_test();
/* P8.4: On KVM nested VMX, self-test VMCS may fail but Linux guest VMCS
* (configured separately) may still work. Force-continue regardless. */
if (vmm_st != 0) {
log_warn("[UTSM] VMM self-test FAIL, but continuing to Linux guest");
vmm_st = 0; /* force pass to continue to Linux guest */
}
if (vmm_st == 0) {
INSTR_TS_END(ts_vmm, "vmm_init+selftest");
log_info("[UTSM] VMM self-test PASS");
/* === Linux guest — 可通过 FUCK [boot] linux_guest=0 跳过 === */
int run_linux = ini_get_bool(cfg, "boot", "linux_guest", 1);
if (run_linux && linux_loader_init() == 0) {
INSTR_TS_DECL(ts_linux);
INSTR_TS_BEGIN(ts_linux);
log_info("[UTSM] Linux loader init ok");
if (ipc_shm_init() == 0) {
log_info("[UTSM] IPC shm init ok");
} else {
log_error("[UTSM] IPC shm init failed (non-fatal)");
}
int lin_st = linux_launch();
INSTR_TS_END(ts_linux, "linux_launch");
if (lin_st == 0) {
log_info("[UTSM] Linux guest parked (daemon ready)");
linux_compat_init();
/* Phase 2: 启动时把 FAT32 lib 目录下 .so 全量推送到 Linux guest */
if (g_compat_linux_lib_sync) {
int lsrc = lxc_sync_lib_dir(g_compat_linux_guest_path);
if (lsrc == 0) log_info("[UTSM] lib sync ok");
else log_warn("[UTSM] lib sync skipped (non-fatal)");
}
/* VSCode Phase 5: tarball module 存在时装到 guest /opt/vscode
* （已安装则秒跳过；失败不阻断启动，桌面降级显示未安装） */
if (g_compat_vscode_install) {
int vsrc = lxc_vscode_install();
if (vsrc == 0) log_info("[UTSM] vscode ready");
else log_warn("[UTSM] vscode install skipped (non-fatal)");
}
} else {
log_error("[UTSM] Linux launch failed");
log_hex64("[UTSM] Linux st=", (u64)(i64)lin_st);
}
} else {
log_warn("[UTSM] Linux loader unavailable (no bzImage or disabled)");
}
} else {
INSTR_TS_END(ts_vmm, "vmm_init+selftest");
log_error("[UTSM] VMM self-test FAIL");
log_hex64("[UTSM] VMM st=", (u64)(i64)vmm_st);
}
/* === OpenXJ380 guest — 可通过 FUCK [boot] xj380_guest=0 跳过 ===
* 三内核架构路线 B：XJ380 作为第二 guest（与 Linux 并列）。
* 需要 Limine boot module xj380.krl（OpenXJ380 构建产物 kernel.krl）。
* guest 终止前 host 挂起；无模块/被禁用时优雅跳过。 */
int run_xj380 = ini_get_bool(cfg, "boot", "xj380_guest", 1);
if (run_xj380 && xj380_loader_init() == 0) {
INSTR_TS_DECL(ts_xj380);
INSTR_TS_BEGIN(ts_xj380);
log_info("[UTSM] XJ380 loader init ok");
int xj_st = xj380_launch();
INSTR_TS_END(ts_xj380, "xj380_launch");
if (xj_st == 0) {
log_info("[UTSM] XJ380 guest terminated (host resumed)");
} else {
log_error("[UTSM] XJ380 launch failed");
log_hex64("[UTSM] XJ380 st=", (u64)(i64)xj_st);
}
} else {
log_warn("[UTSM] XJ380 loader unavailable (no kernel.krl or disabled)");
}
} else {
log_warn("[UTSM] VMM unavailable (VMX not supported or disabled by FUCK)");
}
/* === 驱动加载 — 按 [drivers] 区过滤 === */
INSTR_TS_DECL(ts_dsm);
INSTR_TS_BEGIN(ts_dsm);
@@ -259,54 +487,26 @@ void kernel_main(void) {
log_info("[UTSM] selftest skipped by FUCK config");
}
/* === VMM — 可通过 FUCK [boot] vmm=0 跳过 === */
int run_vmm = ini_get_bool(cfg, "boot", "vmm", 1);
if (run_vmm && vmm_init() == 0) {
INSTR_TS_DECL(ts_vmm);
INSTR_TS_BEGIN(ts_vmm);
log_info("[UTSM] VMM init ok");
int vmm_st = vmm_self_test();
if (vmm_st == 0) {
INSTR_TS_END(ts_vmm, "vmm_init+selftest");
log_info("[UTSM] VMM self-test PASS");
/* === Linux guest — 可通过 FUCK [boot] linux_guest=0 跳过 === */
int run_linux = ini_get_bool(cfg, "boot", "linux_guest", 1);
if (run_linux && linux_loader_init() == 0) {
INSTR_TS_DECL(ts_linux);
INSTR_TS_BEGIN(ts_linux);
log_info("[UTSM] Linux loader init ok");
if (ipc_shm_init() == 0) {
log_info("[UTSM] IPC shm init ok");
} else {
log_error("[UTSM] IPC shm init failed (non-fatal)");
}
int lin_st = linux_launch();
INSTR_TS_END(ts_linux, "linux_launch");
if (lin_st == 0) {
log_info("[UTSM] Linux guest parked (daemon ready)");
linux_compat_init();
} else {
log_error("[UTSM] Linux launch failed");
log_hex64("[UTSM] Linux st=", (u64)(i64)lin_st);
}
} else {
log_warn("[UTSM] Linux loader unavailable (no bzImage or disabled)");
}
} else {
INSTR_TS_END(ts_vmm, "vmm_init+selftest");
log_error("[UTSM] VMM self-test FAIL");
log_hex64("[UTSM] VMM st=", (u64)(i64)vmm_st);
}
} else {
log_warn("[UTSM] VMM unavailable (VMX not supported or disabled by FUCK)");
}
/* ---- 插桩: DSK 加载跳转前记录 ---- */
INSTR_PROBE(DSK0, 0, 0, 0, 0);
/* Phase 3: 初始化 PE DLL 管理器（注册 FAT32 读取回调）。
* DSK 跳转前 block provider 已就绪，fat32_read_path 可用。 */
if (g_compat_pe_dll_search) {
pe_dll_manager_init(dll_reader_from_fat32);
log_info("[UTSM] PE DLL manager initialized (SYSTEM/lib)");
}
/* === 实机日志持久化：把启动日志写入磁盘原始扇区（开发测试用） === */
{
int disk_log = ini_get_bool(cfg, "boot", "disk_log", 0);
if (disk_log) {
int log_start = ini_get_int(cfg, "boot", "disk_log_start", 2);
int log_end = ini_get_int(cfg, "boot", "disk_log_end", 1000);
disk_log_flush(log_start, log_end);
}
}
if (dsk_load_and_jump() != 0) {
log_error("[UTSM] DSK jump failed");
}
CODE/UTSM/kernel/main.d
+5 -2
View File
@@ -7,8 +7,9 @@ kernel/main.o: kernel\main.c include\utsm\log.h include\utsm\types.h \
include\utsm\hypercall.h include\utsm\drr.h include\utsm\dkm.h \
include\utsm\dma.h include\utsm\block.h include\utsm\net.h \
include\utsm\paging.h include\utsm\idt.h include\utsm\dsk.h \
include\utsm\linux_compat.h include\utsm\instr.h kernel\ini_parser.h \
kernel\..\arch\x86_64\limine.h
include\utsm\linux_compat.h include\utsm\xj380_loader.h \
include\utsm\instr.h kernel\ini_parser.h \
kernel\..\arch\x86_64\limine.h kernel\..\pe\pe_dll_manager.h
include\utsm\log.h:
include\utsm\types.h:
include\utsm\arena.h:
@@ -35,6 +36,8 @@ include\utsm\paging.h:
include\utsm\idt.h:
include\utsm\dsk.h:
include\utsm\linux_compat.h:
include\utsm\xj380_loader.h:
include\utsm\instr.h:
kernel\ini_parser.h:
kernel\..\arch\x86_64\limine.h:
kernel\..\pe\pe_dll_manager.h:
CODE/UTSM/kernel/main.o
BIN
View File
Binary file not shown.
CODE/UTSM/pe/pe_dll_manager.c
+229 -11
View File
@@ -54,9 +54,74 @@ typedef struct {
} pe_dll_entry;
static pe_dll_entry g_dll_cache[PE_DLL_CACHE_MAX];
/* ===== 延迟 DllMain 队列 =====
* pe_load_image 触发递归 pe_dll_load 时，PE32+ 原生执行环境尚未就绪：
* SSE 未启用（pe_enable_sse 在 load 之后才调用）、仍跑在 16KB 内核栈上。
* 真实 DLL 的 CRT 初始化含 SSE 指令且栈需求大，立即调用必 #UD/溢栈。
* 故加载阶段只登记 DllMain，由 pe_service_run 在启用 SSE 并切换到
* 1MB PE 大栈后调 pe_dll_run_pending_dllmains() 统一执行。 */
#define PE_DLLMAIN_PENDING_MAX 32
typedef struct {
u64 image_base;
u64 entry_point;
char name[PE_DLL_NAME_MAX];
} pe_dllmain_pending;
static pe_dllmain_pending g_dllmain_pending[PE_DLLMAIN_PENDING_MAX];
static int g_dllmain_pending_count = 0;
static int g_dllmain_defer = 0;
/* enable=1 开启延迟模式并清空队列（每次 pe_service_run 加载前调用）；
* enable=0 恢复立即调用（兜底路径用）。 */
void pe_dll_defer_dllmain(int enable) {
g_dllmain_defer = enable;
if (enable) g_dllmain_pending_count = 0;
}
/* 在大栈 + SSE 环境下执行全部已登记的 DllMain(ATTACH)。
* 执行完毕清空队列并关闭延迟模式。 */
void pe_dll_run_pending_dllmains(void) {
for (int i = 0; i < g_dllmain_pending_count; i++) {
pe_dllmain_pending *p = &g_dllmain_pending[i];
typedef int (__attribute__((ms_abi)) *dllmain_fn)(u64, u32, u64);
dllmain_fn dm = (dllmain_fn)p->entry_point;
int ok = dm(p->image_base, 1 /* DLL_PROCESS_ATTACH */, 0);
if (!ok) {
log_warn("[PE] DllMain returned FALSE (init failed)");
log_info(p->name);
} else {
log_info("[PE] DllMain ATTACH ok");
}
}
g_dllmain_pending_count = 0;
g_dllmain_defer = 0;
}
static pe_dll_reader_fn g_dll_reader = 0;
int g_pe_dll_manager_ready = 0;
/* 转发导出递归深度上限（A->B->C 链） */
#define PE_DLL_FWD_DEPTH_MAX 8
/* ---- API set 重定向 ----
* Windows 10+ 的 api-ms-win-crt-*.dll 是 API set 虚拟 DLL，
* 物理上不存在文件，由 loader 按 schema 重定向到 ucrtbase.dll。
* 此处实现等价映射：api-ms-win-crt-* -> ucrtbase.dll。
* 返回目标 DLL 名（静态字符串），或 NULL 表示非 API set。 */
static const char *apiset_redirect(const char *dll_name) {
if (!dll_name) return 0;
/* 大小写不敏感前缀匹配 "api-ms-win-crt-" */
static const char prefix[] = "api-ms-win-crt-";
int i = 0;
while (prefix[i]) {
char c = dll_name[i];
if (!c) return 0;
if (c >= 'a' && c <= 'z') c = (char)(c - 32);
if (c != prefix[i]) return 0;
i++;
}
return "ucrtbase.dll";
}
/* ---- 辅助函数 ---- */
/* ASCII 大小写不敏感字符串比较（freestanding，无 strcmp） */
@@ -134,12 +199,37 @@ static void extract_export_dir(u64 image_base, u32 *out_rva, u32 *out_size) {
*out_size = data_dir[IMAGE_DIRECTORY_ENTRY_EXPORT].size;
}
/* 在已加载 DLL 的导出表中按名称查找函数。
* 返回绝对地址（image_base + func_rva），0=未找到/转发导出。 */
static u64 resolve_export_by_name(u64 image_base, u32 export_dir_rva,
const char *func_name) {
/* 按序号在已加载 DLL 的导出表中查找函数（转发串 "#123" 用）。
* 返回绝对地址，0=未找到/越界。 */
static u64 resolve_export_by_ordinal(u64 image_base, u32 export_dir_rva,
u32 ordinal) {
if (export_dir_rva == 0) return 0;
const u8 *img = (const u8 *)image_base;
const image_export_directory *exp =
(const image_export_directory *)(img + export_dir_rva);
if (ordinal < exp->ordinal_base) return 0;
u32 idx = ordinal - exp->ordinal_base;
if (idx >= exp->number_of_functions) return 0;
const u32 *functions = (const u32 *)(img + exp->address_of_functions);
u32 func_rva = functions[idx];
if (func_rva == 0) return 0;
return image_base + func_rva;
}
/* 解析转发导出串（"DLL.Func" 或 "DLL.#123"）。
* fwd_str 位于 image_base+func_rva 处（导出目录数据区内）。
* depth 防止 A→B→A 循环转发。返回绝对地址，0=失败。 */
static u64 resolve_forwarded_export(u64 image_base, u32 func_rva, int depth);
/* 在已加载 DLL 的导出表中按名称查找函数。
* 返回绝对地址（image_base + func_rva），0=未找到。
* 转发导出自动跟随解析（PE 规范：func_rva 落在导出目录数据区内即为转发串）。 */
static u64 resolve_export_by_name(u64 image_base, u32 export_dir_rva,
u32 export_dir_size, const char *func_name,
int depth) {
if (export_dir_rva == 0) return 0;
if (depth > PE_DLL_FWD_DEPTH_MAX) return 0;
const u8 *img = (const u8 *)image_base;
const image_export_directory *exp =
(const image_export_directory *)(img + export_dir_rva);
if (exp->number_of_names == 0) return 0;
@@ -155,12 +245,12 @@ static u64 resolve_export_by_name(u64 image_base, u32 export_dir_rva,
if (eat_index >= exp->number_of_functions) return 0;
u32 func_rva = functions[eat_index];
/* 转发导出：func_rva 落在导出表范围内 → 是转发字符串而非代码地址 */
/* 转发导出（PE 规范）：func_rva 落在导出目录数据区
* [export_dir_rva, export_dir_rva+export_dir_size) 内 →
* 该处是 "DLL.Func" 转发字符串而非代码地址 */
if (func_rva >= export_dir_rva &&
func_rva < export_dir_rva + exp->number_of_functions * 4) {
/* 粗略范围检查（更精确应使用 export_dir_size，但此处足够） */
log_info("[PE] forwarded export (not supported)");
return 0;
func_rva < export_dir_rva + export_dir_size) {
return resolve_forwarded_export(image_base, func_rva, depth + 1);
}
return image_base + func_rva;
}
@@ -168,6 +258,74 @@ static u64 resolve_export_by_name(u64 image_base, u32 export_dir_rva,
return 0;
}
/* 转发串解析："NTDLL.RtlInitUnicodeString" 或 "KERNEL32.#123"。
* DLL 名通常不带 .dll 后缀（如 "UCRTBASE"），需补全。 */
static u64 resolve_forwarded_export(u64 image_base, u32 func_rva, int depth) {
if (depth > PE_DLL_FWD_DEPTH_MAX) {
log_warn("[PE] forwarded export chain too deep");
return 0;
}
const char *fwd = (const char *)(image_base + func_rva);
/* 拷贝到本地缓冲并找分隔点 '.'（转发串最大 ~64 字符，防御截断） */
char buf[96];
u32 i = 0;
while (i + 1 < sizeof(buf) && fwd[i] && fwd[i] != ' ') {
buf[i] = fwd[i];
i++;
}
buf[i] = 0;
u32 dot = 0;
while (buf[dot] && buf[dot] != '.') dot++;
if (buf[dot] != '.' || dot == 0 || buf[dot + 1] == 0) {
log_warn("[PE] malformed forwarder string");
return 0;
}
buf[dot] = 0;
const char *target_func = buf + dot + 1;
/* 目标 DLL 名：小写化 + 补 ".dll" 后缀 */
char tdll[PE_DLL_NAME_MAX];
dll_name_lower(buf, tdll, sizeof(tdll));
int tl = 0;
while (tdll[tl]) tl++;
if (tl + 4 < (int)sizeof(tdll)) {
/* 已有 ".dll" 后缀则不重复添加 */
if (!(tl >= 4 && tdll[tl-4] == '.' &&
(tdll[tl-3] == 'd') && (tdll[tl-2] == 'l') && (tdll[tl-1] == 'l'))) {
tdll[tl++] = '.'; tdll[tl++] = 'd';
tdll[tl++] = 'l'; tdll[tl++] = 'l';
tdll[tl] = 0;
}
}
/* 序号转发："#123" */
if (target_func[0] == '#') {
u32 ord = 0;
const char *p = target_func + 1;
if (*p == 0) return 0;
while (*p >= '0' && *p <= '9') {
ord = ord * 10 + (u32)(*p - '0');
p++;
}
if (ord == 0 || ord > 0xFFFF) return 0;
/* 需先确保目标 DLL 已加载 */
u64 base = 0;
if (pe_dll_load(tdll, &base) != 0) return 0;
int idx = dll_cache_find(tdll);
if (idx < 0) return 0;
u64 addr = resolve_export_by_ordinal(base, g_dll_cache[idx].export_dir_rva, ord);
if (addr == 0) {
log_warn("[PE] ordinal forward target not found");
}
return addr;
}
/* 名称转发：递归走 pe_dll_resolve（带深度计） */
return pe_dll_resolve_ex(tdll, target_func, depth);
}
/* ---- 公共接口 ---- */
void pe_dll_manager_init(pe_dll_reader_fn reader) {
@@ -185,6 +343,10 @@ int pe_dll_load(const char *dll_name, u64 *out_base) {
return -1;
}
/* API set 重定向：api-ms-win-crt-* -> ucrtbase.dll */
const char *redirected = apiset_redirect(dll_name);
if (redirected) dll_name = redirected;
/* 查缓存 */
int idx = dll_cache_find(dll_name);
if (idx >= 0) {
@@ -254,13 +416,49 @@ int pe_dll_load(const char *dll_name, u64 *out_base) {
log_info(dll_name);
log_hex64("[PE] DLL base=", info.image_base);
/* 调用 DllMain(hinst, DLL_PROCESS_ATTACH=1, NULL)。
* 真实 DLL（如 ucrtbase）依赖入口完成 CRT/TLS 初始化。
* 无入口点（AddressOfEntryPoint==0 → entry==image_base）则跳过。
* 返回 0（初始化失败）只记告警不阻断：无状态函数仍可用。
* 延迟模式（pe_service_run 加载阶段）：只登记不调用，待 SSE 启用
* 且切换到 1MB PE 大栈后由 pe_dll_run_pending_dllmains 统一执行。 */
if (info.entry_point != info.image_base) {
if (g_dllmain_defer) {
if (g_dllmain_pending_count < PE_DLLMAIN_PENDING_MAX) {
pe_dllmain_pending *p = &g_dllmain_pending[g_dllmain_pending_count++];
p->image_base = info.image_base;
p->entry_point = info.entry_point;
int i = 0;
for (; i < PE_DLL_NAME_MAX - 1 && entry->name[i]; i++) p->name[i] = entry->name[i];
p->name[i] = 0;
log_info("[PE] DllMain deferred");
} else {
log_warn("[PE] DllMain pending queue full, skipped");
}
} else {
typedef int (__attribute__((ms_abi)) *dllmain_fn)(u64, u32, u64);
dllmain_fn dm = (dllmain_fn)info.entry_point;
int ok = dm(info.image_base, 1 /* DLL_PROCESS_ATTACH */, 0);
if (!ok) {
log_warn("[PE] DllMain returned FALSE (init failed)");
log_info(dll_name);
} else {
log_info("[PE] DllMain ATTACH ok");
}
}
}
if (out_base) *out_base = info.image_base;
return 0;
}
u64 pe_dll_resolve(const char *dll_name, const char *func_name) {
u64 pe_dll_resolve_ex(const char *dll_name, const char *func_name, int depth) {
if (!g_pe_dll_manager_ready || !dll_name || !func_name) return 0;
/* API set 重定向：api-ms-win-crt-* -> ucrtbase.dll */
const char *redirected = apiset_redirect(dll_name);
if (redirected) dll_name = redirected;
/* 确保 DLL 已加载 */
int idx = dll_cache_find(dll_name);
if (idx < 0 || g_dll_cache[idx].state != DLL_STATE_LOADED) {
@@ -271,5 +469,25 @@ u64 pe_dll_resolve(const char *dll_name, const char *func_name) {
}
pe_dll_entry *e = &g_dll_cache[idx];
return resolve_export_by_name(e->image_base, e->export_dir_rva, func_name);
return resolve_export_by_name(e->image_base, e->export_dir_rva,
e->export_dir_size, func_name, depth);
}
u64 pe_dll_resolve(const char *dll_name, const char *func_name) {
return pe_dll_resolve_ex(dll_name, func_name, 0);
}
u64 pe_dll_resolve_in_base(u64 image_base, const char *func_name, u32 ordinal) {
if (!g_pe_dll_manager_ready || image_base == 0) return 0;
for (int i = 0; i < PE_DLL_CACHE_MAX; i++) {
pe_dll_entry *e = &g_dll_cache[i];
if (e->state != DLL_STATE_LOADED || e->image_base != image_base) continue;
if (ordinal != 0)
return resolve_export_by_ordinal(e->image_base, e->export_dir_rva, ordinal);
if (func_name)
return resolve_export_by_name(e->image_base, e->export_dir_rva,
e->export_dir_size, func_name, 0);
return 0;
}
return 0;
}
CODE/UTSM/pe/pe_dll_manager.h
+14
View File
@@ -48,4 +48,18 @@ int pe_dll_load(const char *dll_name, u64 *out_base);
* 返回绝对地址，0=未找到。 */
u64 pe_dll_resolve(const char *dll_name, const char *func_name);
/* 带转发深度的内部变体（转发导出链 A→B→C 递归用，外部勿调）。 */
u64 pe_dll_resolve_ex(const char *dll_name, const char *func_name, int depth);
/* 在已加载 DLL 的模块基址上解析导出（GetProcAddress 真实 DLL 路径用）。
* image_base 必须是 pe_dll_load 返回的基址；func_name 与 ordinal 二选一
* （ordinal != 0 时按序号）。返回绝对地址，0=未找到。 */
u64 pe_dll_resolve_in_base(u64 image_base, const char *func_name, u32 ordinal);
/* 延迟 DllMain 控制（PE32+ 加载期 SSE/大栈未就绪，DllMain 必须延迟）。
* pe_service_run 在 pe_load_image 前调 pe_dll_defer_dllmain(1)，
* 切换到 1MB PE 大栈后调 pe_dll_run_pending_dllmains() 统一执行。 */
void pe_dll_defer_dllmain(int enable);
void pe_dll_run_pending_dllmains(void);
#endif /* PE_DLL_MANAGER_H */
CODE/UTSM/pe/pe_loader.c
+54 -4
View File
@@ -12,6 +12,7 @@
#include "pe_loader.h"
#include "pe_shim.h"
#include "pe_dll_manager.h"
#include "x86emu32.h"
#include "../include/utsm/pe.h"
#include <utsm/arena.h>
@@ -218,19 +219,53 @@ static void resolve_imports(u8 *image, u64 image_base_actual,
shim_idx = pe_shim_lookup(dll_name, func_name);
}
/* 当 shim 未命中且需要尝试真实 DLL 时，先把 dll_name/func_name
* 复制到本地栈缓冲。原因：pe_dll_resolve 可能触发 fat32_read_path，
* 后者返回的 static 缓冲与外层 pe_data 可能指向同一区域，会被覆盖。 */
char dll_buf[256];
char func_buf[256];
int have_local_names = 0;
if (shim_idx < 0 && is_pe32_plus && g_pe_dll_manager_ready &&
func_name && func_name[0] != '#') {
u32 dl = 0;
while (dll_name[dl] && dl + 1 < sizeof(dll_buf)) {
dll_buf[dl] = dll_name[dl];
dl++;
}
dll_buf[dl] = 0;
u32 fl = 0;
while (func_name[fl] && fl + 1 < sizeof(func_buf)) {
func_buf[fl] = func_name[fl];
fl++;
}
func_buf[fl] = 0;
have_local_names = 1;
}
/* 填充 IAT（image 缓冲区内） */
u8 *iat_ptr = image + iat_rva + (u32)fn_idx * (is_pe32_plus ? 8 : 4);
int resolved_by_real_dll = 0;
if (is_pe32_plus) {
u64 fn_addr;
if (shim_idx >= 0) {
const pe_shim_entry *se = pe_shim_get(shim_idx);
fn_addr = (u64)se->fn64;
} else if (have_local_names) {
/* PE32+ 尝试真实 DLL */
u64 real = pe_dll_resolve(dll_buf, func_buf);
if (real != 0) {
fn_addr = real;
resolved_by_real_dll = 1;
} else {
/* DLL 加载过但函数未找到：填 unimpl stub */
fn_addr = pe_shim_unimpl_stub();
}
} else {
fn_addr = pe_shim_unimpl_stub();
}
*(u64 *)iat_ptr = fn_addr;
} else {
/* 32位：填合成地址，解释器拦截 */
/* 32位：填合成地址，解释器拦截（不调真实 DLL） */
u32 synth_addr;
if (shim_idx >= 0) {
synth_addr = PE_SHIM_ADDR_BASE | (u32)(shim_idx & 0xFFFF);
@@ -248,11 +283,26 @@ static void resolve_imports(u8 *image, u64 image_base_actual,
}
}
if (shim_idx < 0 && func_name) {
/* shim 未命中且真实 DLL 也未解析：记未实现日志；
* 真实 DLL 解析成功则记来源日志（区分 shim/真实 DLL 路径）。
* 用本地副本（pe_data 可能已被 DLL 加载破坏） */
if (shim_idx < 0 && func_name && !resolved_by_real_dll) {
log_info("[PE] unimplemented import");
serial_write(dll_name);
if (have_local_names) {
serial_write(dll_buf);
serial_write("!");
serial_write(func_buf);
} else {
serial_write(dll_name);
serial_write("!");
serial_write(func_name);
}
serial_write("\n");
} else if (resolved_by_real_dll) {
log_info("[PE] import via real DLL");
serial_write(dll_buf);
serial_write("!");
serial_write(func_name);
serial_write(func_buf);
serial_write("\n");
}
}
CODE/UTSM/pe/pe_loader.d
+3 -2
View File
@@ -1,10 +1,11 @@
pe/pe_loader.o: pe\pe_loader.c pe\pe_loader.h include\utsm\types.h \
include\utsm\pe.h pe\pe_shim.h pe\x86emu32.h pe\..\include\utsm\pe.h \
include\utsm\arena.h include\utsm\log.h
include\utsm\pe.h pe\pe_shim.h pe\pe_dll_manager.h pe\x86emu32.h \
pe\..\include\utsm\pe.h include\utsm\arena.h include\utsm\log.h
pe\pe_loader.h:
include\utsm\types.h:
include\utsm\pe.h:
pe\pe_shim.h:
pe\pe_dll_manager.h:
pe\x86emu32.h:
pe\..\include\utsm\pe.h:
include\utsm\arena.h:
CODE/UTSM/pe/pe_service.c
+43 -5
View File
@@ -14,6 +14,7 @@
#include "pe_loader.h"
#include "pe_shim.h"
#include "pe_dll_manager.h"
#include "x86emu32.h"
#include "../include/utsm/pe.h"
#include <utsm/arena.h>
@@ -34,13 +35,20 @@
int pe_service_load(const void *pe_data, u64 size, pe_image_info *out);
int pe_service_run(const void *pe_data, u64 size, const char *cmdline, u64 *exit_code);
void pe_service_unload(pe_image_info *info);
int pe_service_run_windowed(const void *pe_data, u64 size, const char *cmdline,
u64 *exit_code, const pe_window_host *host);
/* 全局服务表实例 */
/* 全局服务表实例（P5：ABI 尾部追加 run_windowed/inject_*，同镜像一致性
* 假设见 pe.h；旧调用方按前 4 字段使用不受影响） */
static const pe_service g_pe_service = {
PE_SERVICE_MAGIC,
pe_service_load,
pe_service_run,
pe_service_unload,
pe_service_run_windowed,
pe_shim_inject_scancode,
pe_shim_inject_pointer,
pe_shim_inject_input,
};
const pe_service *pe_get_service(void) {
@@ -248,6 +256,14 @@ static void pe_call_on_stack(pe_entry_fn fn, u64 stack_top) {
"r8", "r9", "r10", "r11");
}
/* PE32+ 大栈引导入口：先执行加载期延迟登记的真实 DLL DllMain(ATTACH)，
* 再跳 PE 入口。此时 SSE 已启用且运行在 1MB PE 大栈上。 */
static pe_entry_fn g_pe_boot_entry;
static void pe_boot_with_dllmains(void) {
pe_dll_run_pending_dllmains();
g_pe_boot_entry();
}
/* ===== 运行 =====
* 加载 + 执行 + 卸载.返回 0 成功,*exit_code 为进程退出码. */
int pe_service_run(const void *pe_data, u64 size, const char *cmdline, u64 *exit_code) {
@@ -268,13 +284,18 @@ int pe_service_run(const void *pe_data, u64 size, const char *cmdline, u64 *exit
if (opt_magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) {
/* ===== PE32+ : Ring0 原生执行 ===== */
pe_image_info info;
/* SSE 必须在任何 PE/DLL 代码执行前启用：load 期会递归加载真实 DLL，
* MSVC CRT 代码含 SSE 指令，后置启用曾在 DllMain 内触发 #UD。 */
pe_enable_sse();
/* DllMain 延迟到 1MB PE 大栈上执行（16KB 内核栈跑不动 CRT init） */
pe_dll_defer_dllmain(1);
int rc = pe_load_image(pe_data, size, &info);
if (rc != 0) {
pe_dll_defer_dllmain(0);
log_error("[PE] PE32+ load failed");
return -5;
}
log_info("[PE] running PE32+ natively");
pe_enable_sse();
/* 恢复异常可见性:UTSM 交权 DSK 时 idt_halt_all() 将 IDT 全部
* 替换为静默 halt stub,PE 原生执行期间的 CPU 异常(PF/GP/UD)
@@ -297,10 +318,10 @@ int pe_service_run(const void *pe_data, u64 size, const char *cmdline, u64 *exit
* 残片充当 R12-R15/RBP → 野指针 call → 三重故障). */
u64 code = 0;
if (__builtin_setjmp(pe_shim_exit_jmpbuf()) == 0) {
pe_entry_fn entry = (pe_entry_fn)info.entry_point;
log_hex64("[PE] entry=", (u64)entry);
log_hex64("[PE] entry=", (u64)info.entry_point);
log_hex64("[PE] stack_top=", stack_top);
pe_call_on_stack(entry, stack_top);
g_pe_boot_entry = (pe_entry_fn)info.entry_point;
pe_call_on_stack(pe_boot_with_dllmains, stack_top);
code = 0;
} else {
code = pe_shim_get_exit_code();
@@ -365,3 +386,20 @@ int pe_service_run(const void *pe_data, u64 size, const char *cmdline, u64 *exit
return -8; /* 未知 PE magic */
}
/* ===== P5 窗口模式运行 =====
* 与 pe_service_run 相同的加载/执行路径，区别仅在 shim 行为：
* 渲染目标重定向到 host->surface，PS/2 轮询关闭，消息空转回调
* host->pump()（desktop 帧）。host==NULL/surface==NULL 时等价 run。 */
int pe_service_run_windowed(const void *pe_data, u64 size, const char *cmdline,
u64 *exit_code, const pe_window_host *host) {
if (host && host->surface) {
pe_shim_set_window_host(host);
log_info("[PE] run_windowed: surface mode");
} else {
pe_shim_set_window_host(0);
}
int rc = pe_service_run(pe_data, size, cmdline, exit_code);
pe_shim_set_window_host(0); /* 防止残留配置串到下一次 run */
return rc;
}
CODE/UTSM/pe/pe_service.d
+4 -2
View File
@@ -1,10 +1,12 @@
pe/pe_service.o: pe\pe_service.c pe\pe_loader.h include\utsm\types.h \
include\utsm\pe.h pe\pe_shim.h pe\x86emu32.h pe\..\include\utsm\pe.h \
include\utsm\arena.h include\utsm\idt.h include\utsm\log.h
include\utsm\pe.h pe\pe_shim.h pe\pe_dll_manager.h pe\x86emu32.h \
pe\..\include\utsm\pe.h include\utsm\arena.h include\utsm\idt.h \
include\utsm\log.h
pe\pe_loader.h:
include\utsm\types.h:
include\utsm\pe.h:
pe\pe_shim.h:
pe\pe_dll_manager.h:
pe\x86emu32.h:
pe\..\include\utsm\pe.h:
include\utsm\arena.h:
CODE/UTSM/pe/pe_shim.c
+264 -38
View File
@@ -25,6 +25,8 @@
*/
#include "pe_shim.h"
#include "pe_dll_manager.h"
#include "../include/utsm/pe.h" /* P5: pe_window_host */
#include <utsm/arena.h>
#include <utsm/log.h>
#include <utsm/types.h>
@@ -69,11 +71,57 @@ static inline u64 gp(u64 va) {
return va;
}
/* ===== P5 窗口模式状态 =====
* 全屏模式（默认）：s_wsurf==NULL，shim 直写 Limine fb + 轮询 PS/2。
* 窗口模式：渲染目标为 host surface（伪造 fb），输入靠 inject_*，
* 消息空转时回调 host pump（desktop 帧）。 */
static u8 *s_wsurf = 0;
static u32 s_wsurf_w = 0, s_wsurf_h = 0, s_wsurf_pitch = 0;
static int (*s_host_pump)(void *ud) = 0;
static void *s_host_ud = 0;
static struct limine_framebuffer s_wsurf_fb; /* 伪造 fb（窗口模式） */
static const pe_window_host *s_winhost_pending = 0; /* service 层挂起配置 */
void pe_shim_set_window_host(const pe_window_host *host) {
s_winhost_pending = host;
}
int pe_shim_window_mode(void) { return s_wsurf != 0; }
void pe_shim_init(const char *cmdline) {
g_cmdline = cmdline ? cmdline : "";
g_exit_jmp_set = 0;
g_exit_code = 0;
g_emu_mem_base = 0; /* BUG-007: 默认非解释器上下文(原生路径恒等映射) */
/* P5：应用 service 层挂起的窗口模式配置（在状态重置之后生效） */
if (s_winhost_pending && s_winhost_pending->surface
&& s_winhost_pending->width && s_winhost_pending->height
&& s_winhost_pending->pitch) {
s_wsurf = s_winhost_pending->surface;
s_wsurf_w = s_winhost_pending->width;
s_wsurf_h = s_winhost_pending->height;
s_wsurf_pitch = s_winhost_pending->pitch;
s_host_pump = s_winhost_pending->pump;
s_host_ud = s_winhost_pending->ud;
/* 伪造 fb：32bpp 0xAARRGGBB（与 BitBlt/SetDIBits fast path 掩码一致） */
s_wsurf_fb.address = s_wsurf;
s_wsurf_fb.width = s_wsurf_w;
s_wsurf_fb.height = s_wsurf_h;
s_wsurf_fb.pitch = s_wsurf_pitch;
s_wsurf_fb.bpp = 32;
s_wsurf_fb.memory_model = 1;
s_wsurf_fb.red_mask_shift = 16; s_wsurf_fb.red_mask_size = 8;
s_wsurf_fb.green_mask_shift = 8; s_wsurf_fb.green_mask_size = 8;
s_wsurf_fb.blue_mask_shift = 0; s_wsurf_fb.blue_mask_size = 8;
log_info("[shim] window mode: surface target");
} else {
s_wsurf = 0;
s_wsurf_w = s_wsurf_h = s_wsurf_pitch = 0;
s_host_pump = 0;
s_host_ud = 0;
}
s_winhost_pending = 0;
}
/* 返回 ExitProcess longjmp 目标 jmpbuf(见 pe_shim.h 的 BUG-006 说明).
@@ -697,7 +745,7 @@ static u64 __attribute__((ms_abi)) shim_LoadLibraryA(u64 name_p) {
name_p = gp(name_p);
if (!name_p) return 0;
const char *n = (const char *)name_p;
/* 已知 DLL 返回伪句柄(大小写不敏感子串匹配) */
/* 已知 shim DLL 返回伪句柄(大小写不敏感子串匹配) */
static const char *known[] = { "kernel32", "ntdll", "user32", "gdi32", "msvcrt" };
for (int k = 0; k < 5; k++) {
const char *pat = known[k];
@@ -709,7 +757,22 @@ static u64 __attribute__((ms_abi)) shim_LoadLibraryA(u64 name_p) {
if (a != b) break;
i++;
}
if (pat[i] == 0) return 0x10000020;
if (pat[i] == 0) return PE_SHIM_FAKE_MODULE;
}
}
/* 未知 DLL：尝试从 SYSTEM/lib 加载真实 DLL（句柄=镜像基址） */
if (g_pe_dll_manager_ready) {
char nb[64];
u32 i = 0;
while (n[i] && i + 1 < sizeof(nb)) { nb[i] = n[i]; i++; }
nb[i] = 0;
u64 base = 0;
if (pe_dll_load(nb, &base) == 0 && base != 0) {
log_info("[shim] LoadLibrary real DLL ok");
serial_write(" -> ");
serial_write(nb);
serial_write("\n");
return base;
}
}
g_last_error = 126; /* ERROR_MOD_NOT_FOUND */
@@ -723,13 +786,22 @@ static u64 __attribute__((ms_abi)) shim_lstrlenW(u64 str_p) {
return n;
}
/* GetProcAddress — 在 shim 表内按函数名全局查找(hModule 为伪句柄,不限定 DLL).
* lpProcName 高 16 位为 0 时是 ordinal(不支持,返回 0)。
* Rust std 用它动态探测 Rtl 系列/dbghelp API,命中返回真实 shim 地址,miss 返回 0。 */
/* GetProcAddress — 伪句柄在 shim 表内按函数名全局查找(不限定 DLL);
* 真实 DLL 句柄(pe_dll_load 返回的镜像基址)在该 DLL 导出表内解析。
* lpProcName 高 16 位为 0 时是 ordinal。 */
static u64 __attribute__((ms_abi)) shim_GetProcAddress(u64 module, u64 name_p) {
(void)module;
name_p = gp(name_p);
if (!name_p) return 0;
/* 真实 DLL 模块：按基址解析（支持名称与序号） */
if (module && module != PE_SHIM_FAKE_MODULE && g_pe_dll_manager_ready) {
u32 ord = ((name_p >> 16) == 0) ? (u32)(name_p & 0xFFFF) : 0;
u64 addr = pe_dll_resolve_in_base(module,
ord ? 0 : (const char *)name_p, ord);
if (addr) return addr;
g_last_error = 127; /* ERROR_PROC_NOT_FOUND */
return 0;
}
(void)module;
if ((name_p >> 16) == 0) { /* ordinal 导入 */
g_last_error = 127; /* ERROR_PROC_NOT_FOUND */
return 0;
@@ -1153,8 +1225,47 @@ static void shim_mouse_byte(u8 b) {
s_mouse_btn = nbtn;
}
/* 排空 PS/2 输出缓冲,转成 Win32 消息入队 */
/* 单个 set-1 扫描码 -> Win32 消息入队（P5 抽出：全屏 PS/2 轮询与
* 窗口模式 host 注入共用同一份 vk 映射/修饰键跟踪/WM_CHAR 合成）。
* sc: 原始扫描码（bit7=release）；e0: 1=E0 扩展键。 */
static void shim_kbd_inject(u8 sc, int e0) {
if (!e0) {
if (sc == 0x2A || sc == 0x36) { s_kbd_shift = 1; shim_msg_push(SHIM_WM_KEYDOWN, 0x10, sc); return; }
if (sc == 0xAA || sc == 0xB6) { s_kbd_shift = 0; shim_msg_push(SHIM_WM_KEYUP, 0x10, sc); return; }
if (sc == 0x1D) { s_kbd_ctrl = 1; shim_msg_push(SHIM_WM_KEYDOWN, 0x11, sc); return; }
if (sc == 0x9D) { s_kbd_ctrl = 0; shim_msg_push(SHIM_WM_KEYUP, 0x11, sc); return; }
if (sc == 0x38) { s_kbd_alt = 1; shim_msg_push(SHIM_WM_KEYDOWN, 0x12, sc); return; }
if (sc == 0xB8) { s_kbd_alt = 0; shim_msg_push(SHIM_WM_KEYUP, 0x12, sc); return; }
}
if (sc & 0x80) {
u32 vk = shim_scan_vk(sc & 0x7F, e0);
if (vk) {
shim_msg_push(SHIM_WM_KEYUP, vk, sc);
if (s_dbg_key < 16) { s_dbg_key++; log_hex64("[shim] KEYUP vk=", vk); }
}
return;
}
u32 vk = shim_scan_vk(sc, e0);
if (vk) {
shim_msg_push(SHIM_WM_KEYDOWN, vk, sc);
if (s_dbg_key < 16) { s_dbg_key++; log_hex64("[shim] KEYDOWN vk=", vk); }
/* Esc -> 额外合成 WM_CLOSE:无鼠标环境下关闭窗口的唯一途径 */
if (vk == 0x1B && !e0) shim_msg_push(SHIM_WM_CLOSE, 0, 0);
}
if (!e0) {
char c = shim_scan_ascii(sc, s_kbd_shift);
if (c >= ' ' && c < 0x7F) {
shim_msg_push(SHIM_WM_CHAR, (u64)(u8)c, sc);
if (s_dbg_key < 16) { s_dbg_key++; log_hex64("[shim] CHAR ch=", (u64)(u8)c); }
}
}
}
/* 排空 PS/2 输出缓冲,转成 Win32 消息入队。
* P5 窗口模式：输入权归 desktop（经 inject_* 入队），此函数 no-op，
* 绝不触碰 PS/2 端口（避免与 desktop 的输入采集竞争）。 */
static void shim_kbd_poll(void) {
if (s_wsurf) return; /* 窗口模式：host 注入，不轮询端口 */
shim_mouse_init_once();
for (;;) {
u8 st = inb(0x64);
@@ -1167,37 +1278,64 @@ static void shim_kbd_poll(void) {
}
if (sc == 0xE0) { s_kbd_e0 = 1; continue; }
int e0 = s_kbd_e0;
if (!e0) {
if (sc == 0x2A || sc == 0x36) { s_kbd_shift = 1; shim_msg_push(SHIM_WM_KEYDOWN, 0x10, sc); continue; }
if (sc == 0xAA || sc == 0xB6) { s_kbd_shift = 0; shim_msg_push(SHIM_WM_KEYUP, 0x10, sc); continue; }
if (sc == 0x1D) { s_kbd_ctrl = 1; shim_msg_push(SHIM_WM_KEYDOWN, 0x11, sc); continue; }
if (sc == 0x9D) { s_kbd_ctrl = 0; shim_msg_push(SHIM_WM_KEYUP, 0x11, sc); continue; }
if (sc == 0x38) { s_kbd_alt = 1; shim_msg_push(SHIM_WM_KEYDOWN, 0x12, sc); continue; }
if (sc == 0xB8) { s_kbd_alt = 0; shim_msg_push(SHIM_WM_KEYUP, 0x12, sc); continue; }
}
s_kbd_e0 = 0;
if (sc & 0x80) {
u32 vk = shim_scan_vk(sc & 0x7F, e0);
if (vk) {
shim_msg_push(SHIM_WM_KEYUP, vk, sc);
if (s_dbg_key < 16) { s_dbg_key++; log_hex64("[shim] KEYUP vk=", vk); }
}
continue;
}
u32 vk = shim_scan_vk(sc, e0);
if (vk) {
shim_msg_push(SHIM_WM_KEYDOWN, vk, sc);
if (s_dbg_key < 16) { s_dbg_key++; log_hex64("[shim] KEYDOWN vk=", vk); }
/* Esc -> 额外合成 WM_CLOSE:无鼠标环境下关闭窗口的唯一途径 */
if (vk == 0x1B && !e0) shim_msg_push(SHIM_WM_CLOSE, 0, 0);
}
if (!e0) {
char c = shim_scan_ascii(sc, s_kbd_shift);
if (c >= ' ' && c < 0x7F) {
shim_msg_push(SHIM_WM_CHAR, (u64)(u8)c, sc);
if (s_dbg_key < 16) { s_dbg_key++; log_hex64("[shim] CHAR ch=", (u64)(u8)c); }
}
}
shim_kbd_inject(sc, e0);
}
}
/* ===== P5 窗口模式输入注入（pe_service 经 ABI 转发到这里）===== */
int pe_shim_inject_scancode(u32 scancode, u32 e0_prefix) {
if (!s_wsurf) return -1;
shim_kbd_inject((u8)scancode, e0_prefix ? 1 : 0);
return 0;
}
int pe_shim_inject_pointer(i32 x, i32 y, u32 buttons) {
if (!s_wsurf) return -1;
/* 钳位到 surface 范围 */
if (x < 0) x = 0; else if (x >= (i32)s_wsurf_w) x = (i32)s_wsurf_w - 1;
if (y < 0) y = 0; else if (y >= (i32)s_wsurf_h) y = (i32)s_wsurf_h - 1;
u8 nbtn = (u8)(buttons & 0x07);
i32 cx = x - g_wnd_x, cy = y - g_wnd_y; /* 客户区坐标(消息 lparam) */
u64 lp = (u64)(u32)(((u32)(u16)cy << 16) | (u32)(u16)cx);
u64 mk = 0;
if (nbtn & 1) mk |= SHIM_MK_LBUTTON;
if (nbtn & 2) mk |= SHIM_MK_RBUTTON;
if (nbtn & 4) mk |= SHIM_MK_MBUTTON;
if (s_kbd_shift) mk |= SHIM_MK_SHIFT;
if (s_kbd_ctrl) mk |= SHIM_MK_CONTROL;
if (x != s_mouse_x || y != s_mouse_y) {
s_mouse_x = x; s_mouse_y = y;
shim_msg_push_pt(SHIM_WM_MOUSEMOVE, mk, lp, x, y);
}
/* 按钮边沿 */
if ((nbtn & 1) && !(s_mouse_btn & 1)) shim_msg_push_pt(SHIM_WM_LBUTTONDOWN, mk, lp, x, y);
if (!(nbtn & 1) && (s_mouse_btn & 1)) shim_msg_push_pt(SHIM_WM_LBUTTONUP, mk, lp, x, y);
if ((nbtn & 2) && !(s_mouse_btn & 2)) shim_msg_push_pt(SHIM_WM_RBUTTONDOWN, mk, lp, x, y);
if (!(nbtn & 2) && (s_mouse_btn & 2)) shim_msg_push_pt(SHIM_WM_RBUTTONUP, mk, lp, x, y);
if ((nbtn & 4) && !(s_mouse_btn & 4)) shim_msg_push_pt(SHIM_WM_MBUTTONDOWN, mk, lp, x, y);
if (!(nbtn & 4) && (s_mouse_btn & 4)) shim_msg_push_pt(SHIM_WM_MBUTTONUP, mk, lp, x, y);
s_mouse_btn = nbtn;
return 0;
}
int pe_shim_inject_input(u32 msg, u64 wparam, u64 lparam, i32 ptx, i32 pty) {
if (!s_wsurf) return -1;
shim_msg_push_pt(msg, wparam, lparam, ptx, pty);
return 0;
}
/* 消息空转让出点：窗口模式回调 host 泵（desktop 帧），全屏 pause。
* pump 返回非 0 = host 请求退出 → 投递 WM_CLOSE（PE 自愿退出路径）。 */
static void shim_msg_yield(void) {
if (s_host_pump) {
if (s_host_pump(s_host_ud))
shim_msg_push(SHIM_WM_CLOSE, 0, 0);
} else {
__asm__ volatile("pause");
}
}
@@ -1209,6 +1347,8 @@ static u64 __attribute__((ms_abi)) shim_RegisterClassExW(u64 wc_p) {
}
static const struct limine_framebuffer *shim_fb(void) {
/* P5 窗口模式：渲染目标是 host 提供的内存 surface（伪造 fb） */
if (s_wsurf) return &s_wsurf_fb;
if (!g_fb_request.response || g_fb_request.response->framebuffer_count == 0) return 0;
return g_fb_request.response->framebuffers[0];
}
@@ -1315,6 +1455,9 @@ static u64 __attribute__((ms_abi)) shim_PeekMessageW(u64 msg_p, u64 hwnd,
u64 fmin, u64 fmax, u64 remove) {
(void)hwnd; (void)fmin; (void)fmax;
shim_kbd_poll();
/* P5 窗口模式：PeekMessage 驱动的渲染循环（Deaicup 型）下 PE 几乎不
* 调 GetMessage，desktop 只能靠这里的空转让出获得 CPU 跑帧。 */
if (g_mq_count == 0 && s_host_pump) shim_msg_yield();
if (g_mq_count == 0) return 0;
shim_msg_t *m = &g_msgq[g_mq_head];
if (msg_p) *(shim_msg_t *)msg_p = *m;
@@ -1330,7 +1473,7 @@ static u64 __attribute__((ms_abi)) shim_GetMessageW(u64 msg_p, u64 hwnd,
for (;;) { /* 阻塞语义:轮询键盘直到有消息 */
shim_kbd_poll();
if (g_mq_count > 0) break;
__asm__ volatile("pause");
shim_msg_yield(); /* P5: 窗口模式泵 desktop，全屏 pause */
}
shim_msg_t *m = &g_msgq[g_mq_head];
if (msg_p) *(shim_msg_t *)msg_p = *m;
@@ -1434,6 +1577,7 @@ static const char *const g_cursor_bmp[12] = {
};
static void shim_draw_cursor(const struct limine_framebuffer *fb) {
if (s_wsurf) return; /* P5 窗口模式：光标由 desktop 统一绘制 */
if (!s_mouse_ok || !g_wnd_created) return;
i32 wx1 = g_wnd_x + g_wnd_w, wy1 = g_wnd_y + g_wnd_h;
if (s_mouse_x < g_wnd_x || s_mouse_y < g_wnd_y) return;
@@ -1528,6 +1672,87 @@ static u64 __attribute__((ms_abi)) shim_BitBlt(u64 dstdc, u64 x, u64 y, u64 cx,
return 1;
}
/* SetDIBitsToDevice: 不经内存 DC,直接把 DIB 位块贴上窗口 DC.
* 语义(MSDN): (xSrc,ySrc) 是 DIB 源区域左下角(DIB 坐标系 y 向上),
* startScan/numLines 描述 lpvBits 缓冲覆盖的扫描线区间,
* (xDest,yDest,w,h) 是客户区目标矩形(y 向下).
* bottom-up DIB: 缓冲行 0 = DIB 扫描线 startScan(从底数);
* top-down DIB : 缓冲行 0 = 图像顶行 + startScan.
* 仅支持 32bpp BI_RGB;返回实际拷贝的扫描线数. */
static u64 __attribute__((ms_abi)) shim_SetDIBitsToDevice(
u64 hdc, i32 xDest, i32 yDest, u32 w, u32 h,
i32 xSrc, i32 ySrc, u32 startScan, u32 numLines,
u64 bits_p, u64 bmi_p, u64 colorUse) {
(void)colorUse;
if (hdc != SHIM_HDC_WND) return 0; /* 仅支持窗口 DC 目标 */
const struct limine_framebuffer *fb = shim_fb();
if (!fb || !fb->address) return 0;
if (fb->bpp != 32 && fb->bpp != 24) return 0;
if (!bits_p || !bmi_p || w == 0 || h == 0) return 0;
const u8 *bmi = (const u8 *)bmi_p;
i32 bw = *(const i32 *)(bmi + 4); /* biWidth */
i32 bh = *(const i32 *)(bmi + 8); /* biHeight(负=top-down) */
u16 bpp = *(const u16 *)(bmi + 14); /* biBitCount */
u32 comp = *(const u32 *)(bmi + 16); /* biCompression */
if (bw <= 0 || bh == 0 || bpp != 32 || comp != 0 /* BI_RGB */) return 0;
int topdown = 0;
i32 H = bh;
if (H < 0) { H = -H; topdown = 1; }
const u32 *bits = (const u32 *)bits_p;
i32 dx0 = xDest + g_wnd_x;
i32 dy0 = yDest + g_wnd_y;
u8 *fbb = (u8 *)fb->address;
u32 rsh = fb->red_mask_shift, gsh = fb->green_mask_shift, bsh = fb->blue_mask_shift;
u32 rsz = fb->red_mask_size ? fb->red_mask_size : 8;
u32 gsz = fb->green_mask_size ? fb->green_mask_size : 8;
u32 bsz = fb->blue_mask_size ? fb->blue_mask_size : 8;
int fast = (fb->bpp == 32 && rsh == 16 && gsh == 8 && bsh == 0
&& rsz == 8 && gsz == 8 && bsz == 8);
u32 copied = 0;
for (u32 row = 0; row < h; row++) {
/* 目标顶行 row=0 ← DIB 坐标 y=ySrc+h-1(源区域顶边) */
i32 sy = ySrc + (i32)h - 1 - (i32)row;
if (sy < 0 || sy >= H) continue;
/* DIB 扫描线 sy → lpvBits 缓冲行 */
i64 br = topdown ? ((i64)(H - 1 - sy) - (i32)startScan)
: ((i64)sy - (i32)startScan);
if (br < 0 || br >= (i64)numLines) continue;
i32 fy = dy0 + (i32)row;
if (fy < 0 || fy >= (i32)fb->height) continue;
const u32 *src = bits + (u64)br * (u64)bw;
u8 *dst_row = fbb + (u64)fy * fb->pitch;
copied++;
for (u32 col = 0; col < w; col++) {
i32 sx = xSrc + (i32)col;
if (sx < 0 || sx >= bw) continue;
i32 fx = dx0 + (i32)col;
if (fx < 0 || fx >= (i32)fb->width) continue;
u32 px = src[sx];
if (fast) {
((u32 *)dst_row)[fx] = px;
} else {
u32 r = (px >> 16) & 0xFF, g = (px >> 8) & 0xFF, bl = px & 0xFF;
u32 v = ((r >> (8 - rsz)) << rsh)
| ((g >> (8 - gsz)) << gsh)
| ((bl >> (8 - bsz)) << bsh);
if (fb->bpp == 32) {
((u32 *)dst_row)[fx] = v;
} else {
u8 *p = dst_row + (u64)fx * 3;
p[0] = (u8)(v & 0xFF);
p[1] = (u8)((v >> 8) & 0xFF);
p[2] = (u8)((v >> 16) & 0xFF);
}
}
}
}
shim_draw_cursor(fb);
return copied;
}
/* 未实现 stub(64位)— 日志告警(含调用点返回地址)并返回 0 */
static u64 __attribute__((ms_abi)) shim_unimpl64(u64 a0, u64 a1, u64 a2, u64 a3) {
(void)a0; (void)a1; (void)a2; (void)a3;
@@ -1642,6 +1867,7 @@ static const pe_shim_entry g_shim_table[] = {
{"gdi32.dll", "DeleteObject", (void*)shim_DeleteObject, 0},
{"gdi32.dll", "DeleteDC", (void*)shim_DeleteDC, 0},
{"gdi32.dll", "BitBlt", (void*)shim_BitBlt, 0},
{"gdi32.dll", "SetDIBitsToDevice", (void*)shim_SetDIBitsToDevice, 0},
{"gdi32.dll", "GetStockObject", (void*)shim_GetStockObject, 0},
{"gdi32.dll", "GdiFlush", (void*)shim_GdiFlush, 0},
/* msvcrt.dll */
CODE/UTSM/pe/pe_shim.d
+4 -1
View File
@@ -1,7 +1,10 @@
pe/pe_shim.o: pe\pe_shim.c pe\pe_shim.h include\utsm\types.h \
include\utsm\arena.h include\utsm\log.h pe\..\arch\x86_64\limine.h
pe\pe_dll_manager.h pe\..\include\utsm\pe.h include\utsm\arena.h \
include\utsm\log.h pe\..\arch\x86_64\limine.h
pe\pe_shim.h:
include\utsm\types.h:
pe\pe_dll_manager.h:
pe\..\include\utsm\pe.h:
include\utsm\arena.h:
include\utsm\log.h:
pe\..\arch\x86_64\limine.h:
CODE/UTSM/pe/pe_shim.h
+23
View File
@@ -16,6 +16,10 @@
#include <utsm/types.h>
/* shim 伪模块句柄（LoadLibrary 对已知 shim DLL 返回值）。
* 真实 DLL 句柄 = pe_dll_load 镜像基址，与此值域区分。 */
#define PE_SHIM_FAKE_MODULE 0x10000020ULL
/* 32位 shim：从模拟栈读取参数（cdecl 语义，调用者清栈）。
* esp 指向模拟栈（第一个参数在 esp[0]）。返回值 = EAX。 */
typedef u64 (*pe_shim_fn32)(void *esp);
@@ -82,4 +86,23 @@ const char *pe_shim_get_cmdline(void);
* 完成转换；base=0 表示非解释器上下文（原生 PE32+ 路径），gp() 恒等映射。 */
void pe_shim_set_emu_base(u64 base);
/* ===== P5 窗口模式（desktop 嵌入）=====
* pe_service 在 run_windowed 前调用 pe_shim_set_window_host 挂起配置；
* pe_shim_init（run 开头）重置 shim 状态后应用该配置。host==NULL 或
* host->surface==NULL 时保持全屏独占行为（默认）。 */
struct pe_window_host; /* 定义见 utsm/pe.h */
void pe_shim_set_window_host(const struct pe_window_host *host);
/* 窗口模式输入注入（仅窗口模式生效，全屏返回 -1）。
* inject_scancode: set-1 扫描码（bit7=release），e0_prefix!=0 为 E0 扩展。
* inject_pointer : surface 局部坐标 + 按钮位（bit0/1/2=L/R/M），
* 内部与上次状态比较合成 MOUSEMOVE/BUTTON 边沿。
* inject_input : 直接投递任意 Win32 消息（WM_CLOSE 等宿主控制消息）。 */
int pe_shim_inject_scancode(u32 scancode, u32 e0_prefix);
int pe_shim_inject_pointer(i32 x, i32 y, u32 buttons);
int pe_shim_inject_input(u32 msg, u64 wparam, u64 lparam, i32 ptx, i32 pty);
/* 窗口模式是否激活（1=渲染目标为 host surface）。 */
int pe_shim_window_mode(void);
#endif /* PE_SHIM_H */
CODE/UTSM/vmm/hypercall.c
+33
View File
@@ -22,6 +22,7 @@
#include <utsm/vmm.h>
#include <utsm/ipc_shm.h>
#include <utsm/linux_compat.h>
#include <utsm/linux_loader.h>
#include <utsm/log.h>
#include <utsm/types.h>
#include <ipc_proto.h>
@@ -122,6 +123,35 @@ static long hcall_shm_info(u64 a0, u64 a1, u64 a2) {
return UTSM_HCALL_OK;
}
/* VSCode integration Phase 1: query graphics surface pool.
* Mirrors hcall_shm_info: writes gpa + size into guest-provided out-pointers.
* Linux user-space then mmaps /dev/utsm at the returned GPA to obtain a
* writable scanout buffer (Phase 3 virtio-gpu shadow buffer). */
static long hcall_surface_info(u64 a0, u64 a1, u64 a2) {
/* a0 = GPA of gpa_out (u64), a1 = GPA of size_out (u64) */
(void)a2;
u64 surface_gpa = 0, surface_size = 0;
if (linux_get_surface_info(0, &surface_gpa, &surface_size) != 0) {
/* Surface pool not initialized (Linux guest not loaded, or alloc failed) */
return UTSM_HCALL_NOMEM;
}
/* Write results to guest memory */
if (a0 != 0 && guest_write_u64(a0, surface_gpa) != 0) {
log_error("[HCALL] SURFACE_INFO: failed to write gpa to guest");
return UTSM_HCALL_INVAL;
}
if (a1 != 0 && guest_write_u64(a1, surface_size) != 0) {
log_error("[HCALL] SURFACE_INFO: failed to write size to guest");
return UTSM_HCALL_INVAL;
}
log_hex64("[HCALL] SURFACE_INFO: gpa=", surface_gpa);
log_hex64("[HCALL] SURFACE_INFO: size=", surface_size);
return UTSM_HCALL_OK;
}
static long hcall_cap_validate(u64 a0, u64 a1, u64 a2) {
/* Phase 1.3: stub — capability validation not yet implemented */
(void)a0; (void)a1; (void)a2;
@@ -284,6 +314,9 @@ int hypercall_handle(u64 guest_rax, u64 guest_rdi, u64 guest_rsi, u64 guest_rdx,
case UTSM_HCALL_SHM_INFO:
result = hcall_shm_info(guest_rdi, guest_rsi, guest_rdx);
break;
case UTSM_HCALL_SURFACE_INFO:
result = hcall_surface_info(guest_rdi, guest_rsi, guest_rdx);
break;
case UTSM_HCALL_CAP_VALIDATE:
result = hcall_cap_validate(guest_rdi, guest_rsi, guest_rdx);
break;
CODE/UTSM/vmm/hypercall.d
+3 -2
View File
@@ -1,8 +1,8 @@
vmm/hypercall.o: vmm\hypercall.c include\utsm\hypercall.h \
include\utsm\types.h include\utsm\vmx.h include\utsm\ept.h \
include\utsm\vmm.h include\utsm\ipc_shm.h ..\utsm-ipc\ipc_proto.h \
include\utsm\linux_compat.h include\utsm\log.h \
vmm\..\arch\x86_64\limine.h
include\utsm\linux_compat.h include\utsm\linux_loader.h \
include\utsm\log.h vmm\..\arch\x86_64\limine.h
include\utsm\hypercall.h:
include\utsm\types.h:
include\utsm\vmx.h:
@@ -11,5 +11,6 @@ include\utsm\vmm.h:
include\utsm\ipc_shm.h:
..\utsm-ipc\ipc_proto.h:
include\utsm\linux_compat.h:
include\utsm\linux_loader.h:
include\utsm\log.h:
vmm\..\arch\x86_64\limine.h:
CODE/UTSM/vmm/linux_compat.c
+498 -6
View File
@@ -16,14 +16,20 @@
#include <utsm/linux_compat.h>
#include <utsm/linux_resume.h>
#include <utsm/linux_loader.h> /* VSCode Phase 5: linux_find_vscode_module */
#include <utsm/ipc_shm.h>
#include <utsm/vmm.h>
#include <utsm/virtio_mmio.h> /* VSCode Phase 2: virtio_input_push_* */
#include <utsm/log.h>
#include <utsm/types.h>
#include <utsm/block.h>
#include <ipc_proto.h>
#include "../../tools/fat32_io.h"
/* 兼容层全局配置（由 UTSM kernel/main.c 定义） */
extern char g_compat_lib_path[];
extern char g_compat_linux_guest_path[];
/* ===== 内部辅助 ===== */
static u64 my_strlen(const char *s) {
@@ -64,9 +70,17 @@ static int lxc_is_available(void) {
return (g_compat_ready && linux_is_parked() && ipc_shm_is_ready()) ? 1 : 0;
}
/* 前向声明：payload_pool 拷出助手（定义在文件传输段，exec 新协议复用） */
static u64 lxc_pool_copyout(char *buf, u64 cap, u32 data_len);
/* 等待 Linux daemon 的响应消息。
* linux_resume() 返回后，daemon 已 park，所有响应消息应已在 ring 中。
* 我们循环 pop 直到拿到 EXEC_EXIT 或 ring 空（超时保护）。 */
* 我们循环 pop 直到拿到 EXEC_EXIT 或 ring 空（超时保护）。
*
* 新协议（P3）：daemon 把 stdout 直写 payload_pool，EXEC_EXIT 为 16B
* （exit_code + flags + stdout_len + stdout_total），flags&F_POOL 时
* 从 pool 拷出；F_TRUNC/F_TIMEOUT 记串口日志。旧协议（8B exit_code）
* 输出仍走 EXEC_STDOUT 内联，下方分支兼容。 */
static int lxc_drain_responses(char *out_buf, u64 out_cap, u64 *out_len,
u64 *exit_code) {
u64 written = 0;
@@ -84,7 +98,7 @@ static int lxc_drain_responses(char *out_buf, u64 out_cap, u64 *out_len,
switch (msg.type) {
case UTSM_MSG_EXEC_STDOUT:
case UTSM_MSG_EXEC_STDERR: {
/* 拼接到 stdout 缓冲区（stderr 也并入，简化调用方处理） */
/* 旧式内联输出（新协议下 stdout 走 pool，正常不会再收到） */
u32 n = msg.data_len;
if (out_buf && out_cap > written) {
u32 space = (u32)(out_cap - written);
@@ -99,6 +113,22 @@ static int lxc_drain_responses(char *out_buf, u64 out_cap, u64 *out_len,
struct ipc_exec_exit ex;
my_memcpy(&ex, msg.data, sizeof(ex));
exit_val = ex.exit_code;
if (ex.flags & UTSM_EXEC_EXIT_F_POOL) {
/* stdout 已 staged 在 payload_pool[0..stdout_len) */
written = lxc_pool_copyout(out_buf, out_cap,
ex.stdout_len);
if (ex.flags & UTSM_EXEC_EXIT_F_TRUNC) {
log_warn("[LNXC] exec: output truncated at pool cap");
log_hex64("[LNXC] exec: total bytes=", ex.stdout_total);
}
if (ex.flags & UTSM_EXEC_EXIT_F_TIMEOUT)
log_warn("[LNXC] exec: child timed out, SIGKILLed");
}
} else if (msg.data_len >= 8) {
/* 旧式 8B：exit_code + reserved */
u32 ec = 0;
my_memcpy(&ec, msg.data, 4);
exit_val = ec;
}
got_exit = 1;
break;
@@ -117,9 +147,13 @@ static int lxc_drain_responses(char *out_buf, u64 out_cap, u64 *out_len,
return got_exit ? 0 : -4; /* -4 = 超时无 exit 响应 */
}
static int lxc_exec(const char *path, int argc, const char *const *argv,
char *stdout_buf, u64 stdout_cap, u64 *stdout_len,
u64 *exit_code) {
/* 构建并发送 EXEC_REQUEST，唤醒 guest，然后 drain 响应。
* flags 取 0（同步，捕获 stdout）或 UTSM_EXEC_FLAG_ASYNC（detach 立即返回）。
* 返回 0 = 收到 EXEC_EXIT（exit_code 已写出），负值失败。 */
static int lxc_exec_internal(const char *path, int argc,
const char *const *argv, u32 flags,
char *stdout_buf, u64 stdout_cap, u64 *stdout_len,
u64 *exit_code) {
if (!lxc_is_available()) {
return -1;
}
@@ -131,7 +165,7 @@ static int lxc_exec(const char *path, int argc, const char *const *argv,
struct ipc_exec_request req;
my_memzero(&req, sizeof(req));
req.argc = (u32)argc;
req.flags = 0;
req.flags = flags;
u64 plen = my_strlen(path);
if (plen >= UTSM_EXEC_PATH_MAX) plen = UTSM_EXEC_PATH_MAX - 1;
@@ -167,6 +201,29 @@ static int lxc_exec(const char *path, int argc, const char *const *argv,
return lxc_drain_responses(stdout_buf, stdout_cap, stdout_len, exit_code);
}
static int lxc_exec(const char *path, int argc, const char *const *argv,
char *stdout_buf, u64 stdout_cap, u64 *stdout_len,
u64 *exit_code) {
return lxc_exec_internal(path, argc, argv, 0,
stdout_buf, stdout_cap, stdout_len, exit_code);
}
/* VSCode Phase 5: 异步执行——daemon fork+setsid+detach 后立即回
* EXEC_EXIT(0)，不捕获输出、不等待退出。用于 X server / VSCode 等长
* 生命周期 GUI 进程。返回 0 = spawn 成功。 */
static int lxc_exec_async(const char *path, int argc,
const char *const *argv) {
u64 exit_code = 1;
int rc = lxc_exec_internal(path, argc, argv, UTSM_EXEC_FLAG_ASYNC,
0, 0, 0, &exit_code);
if (rc != 0) return rc;
if (exit_code != 0) {
log_hex64("[LNXC] exec_async: daemon spawn failed, code=", exit_code);
return -5;
}
return 0;
}
static int lxc_status(char *buf, u64 cap) {
if (!buf || cap == 0) return 0;
const char *s;
@@ -445,6 +502,73 @@ static int lxc_file_push(const char *fat32_name, const char *linux_path,
return 0;
}
/* ===== VSCode Phase 2: 输入转发（PS/2 → virtio-input） ===== */
/* 上次鼠标按钮状态，用于边沿检测（press/release）。 */
static u8 g_prev_mouse_buttons = 0;
static void lxc_input_forward_keyboard(u16 code, u32 value) {
virtio_input_push_keyboard(code, value);
}
static void lxc_input_forward_mouse(i32 dx, i32 dy, u8 buttons) {
/* 相对位移 */
if (dx != 0) virtio_input_push_mouse_rel(VIO_INPUT_REL_X, dx);
if (dy != 0) virtio_input_push_mouse_rel(VIO_INPUT_REL_Y, dy);
/* 按钮变化检测：XOR 找出变化的位 */
u8 changed = buttons ^ g_prev_mouse_buttons;
if (changed & 0x01)
virtio_input_push_mouse_button(VIO_INPUT_BTN_LEFT, (buttons & 0x01) ? 1 : 0);
if (changed & 0x02)
virtio_input_push_mouse_button(VIO_INPUT_BTN_RIGHT, (buttons & 0x02) ? 1 : 0);
if (changed & 0x04)
virtio_input_push_mouse_button(VIO_INPUT_BTN_MIDDLE, (buttons & 0x04) ? 1 : 0);
g_prev_mouse_buttons = buttons;
/* SYN_REPORT：libinput 依赖此帧结束标记 */
virtio_input_push_mouse_syn();
}
/* ===== VSCode Phase 3: virtio-gpu scanout 查询转发 =====
* desktop 在 IDE attached 时周期调用，把 guest 合成的帧 blit 到 framebuffer。
* 我们只做字段拷贝（linux_compat_scanout_info 与 virtio_gpu_scanout_info 布局一致）。 */
static int lxc_gpu_get_scanout_info(struct linux_compat_scanout_info *out) {
if (!out) return -1;
struct virtio_gpu_scanout_info vi;
int rc = virtio_gpu_get_scanout_info(&vi);
if (rc != 0) {
out->host_vaddr = 0;
out->width = 0; out->height = 0; out->stride = 0;
out->dirty = 0; out->enabled = 0;
out->dirty_x = 0; out->dirty_y = 0;
out->dirty_w = 0; out->dirty_h = 0;
out->cursor_visible = 0; out->cursor_x = 0; out->cursor_y = 0;
out->cursor_hot_x = 0; out->cursor_hot_y = 0;
out->cursor_w = 0; out->cursor_h = 0; out->cursor_bitmap = 0;
return rc;
}
out->host_vaddr = vi.host_vaddr;
out->width = vi.width;
out->height = vi.height;
out->stride = vi.stride;
out->dirty = vi.dirty;
out->enabled = vi.enabled;
out->dirty_x = vi.dirty_x;
out->dirty_y = vi.dirty_y;
out->dirty_w = vi.dirty_w;
out->dirty_h = vi.dirty_h;
out->cursor_visible = vi.cursor_visible;
out->cursor_x = vi.cursor_x;
out->cursor_y = vi.cursor_y;
out->cursor_hot_x = vi.cursor_hot_x;
out->cursor_hot_y = vi.cursor_hot_y;
out->cursor_w = vi.cursor_w;
out->cursor_h = vi.cursor_h;
out->cursor_bitmap = vi.cursor_bitmap;
return 0;
}
/* ===== 服务表 ===== */
static const linux_compat_service g_lxc_service = {
@@ -457,8 +581,376 @@ static const linux_compat_service g_lxc_service = {
lxc_file_write,
lxc_file_pull,
lxc_file_push,
lxc_input_forward_keyboard,
lxc_input_forward_mouse,
lxc_gpu_get_scanout_info,
lxc_exec_async,
};
const linux_compat_service *linux_compat_get_service(void) {
return &g_lxc_service;
}
/* ===== Phase 2: SYSTEM/lib .so 全量推送到 Linux guest =====
*
* 启动时把 FAT32 根目录下 lib/ 子目录（g_compat_lib_path）中所有 .so
* 文件流式推送到 Linux guest 的 g_compat_linux_guest_path 目录。
* 流式推送：按簇（4KB）读取 FAT32 文件 → 立即 lxc_file_write 写入 guest，
* 不依赖 fat32_io.h 的整文件 256KB 缓冲，可处理 MB 级 .so。
*
* 路径假设：build.ps1 把 SYSTEM/ 打包为 FAT32 根，因此 Windows
* D:\Code\Deshab\SYSTEM\lib\ 在 FAT32 上对应根目录下的 "lib/" 子目录。
*/
/* 把内存中已有数据按 pool 容量分块推送到 Linux 文件。
* 用于整文件内存数据的批量上传。 */
__attribute__((unused))
static int lxc_file_push_mem(const char *linux_path, const u8 *data, u32 size) {
if (!lxc_is_available()) return -1;
if (!linux_path || (!data && size > 0)) return -1;
u32 pool_cap = ipc_shm_payload_capacity();
u64 off = 0;
for (;;) {
u64 remain = (u64)size - off;
u64 chunk = remain > pool_cap ? pool_cap : remain;
u64 written = 0;
int rc = lxc_file_write(linux_path, off, (const char *)data + off,
chunk, &written);
if (rc != 0) return rc;
if (written != chunk) return -5; /* 短写 */
off += written;
if (off >= size) break;
}
return 0;
}
/* 流式推送：按簇读取 FAT32 文件，立即写入 Linux guest。
* first_clus : FAT32 文件首簇号
* file_size : 文件字节大小
* linux_path : guest 端目标绝对路径
* 返回 0 成功，负值失败。
* 复用 lxc_f32_ensure() 已初始化的 FAT32 库（f32_blk_read）。 */
static int lxc_push_fat32_file_streaming(u32 first_clus, u32 file_size,
const char *linux_path) {
if (!lxc_is_available()) return -1;
if (!linux_path) return -1;
if (f32_disk_load() != 0) return -2;
const f32_bpb *bpb = (const f32_bpb *)f32_disk;
u32 data_lba = bpb->rsvd + (u32)bpb->fc * bpb->spf;
u32 fat_byte_off = bpb->rsvd * 512;
u32 spc = bpb->spc;
u32 pool_cap = ipc_shm_payload_capacity();
u32 cluster_bytes = spc * 512;
if (cluster_bytes > sizeof(f32_cluster)) cluster_bytes = sizeof(f32_cluster);
/* 用 f32_data 作为单簇中转缓冲（每次最多 pool_cap 字节） */
u32 buf_cap = pool_cap;
if (buf_cap > sizeof(f32_data)) buf_cap = sizeof(f32_data);
u64 off = 0;
u32 fc = first_clus;
u32 buf_used = 0;
while (fc >= 2 && fc < 0x0FFFFFF8 && off < file_size) {
u32 fc_lba = data_lba + (fc - 2) * spc;
u32 fc_bytes = spc * 512;
if (fc_bytes > sizeof(f32_cluster)) fc_bytes = sizeof(f32_cluster);
if (f32_read_sectors(fc_lba, spc, f32_cluster) != 0) return -3;
/* 把当前簇数据按 buf_cap 分批写入 */
u32 ci = 0;
while (ci < fc_bytes && off + ci < file_size) {
u32 space = buf_cap - buf_used;
u32 copy = fc_bytes - ci;
if (copy > space) copy = space;
if (copy > file_size - (u32)(off + ci)) copy = (u32)(file_size - (off + ci));
for (u32 b = 0; b < copy; b++) {
f32_data[buf_used + b] = f32_cluster[ci + b];
}
buf_used += copy;
ci += copy;
/* 缓冲满 → 写入 guest */
if (buf_used >= buf_cap || off + ci >= file_size) {
u64 written = 0;
int rc = lxc_file_write(linux_path, off, (const char *)f32_data,
buf_used, &written);
if (rc != 0) return rc;
if (written != buf_used) return -5;
off += written;
buf_used = 0;
}
}
/* 跟随 FAT 链 */
u32 fo = fat_byte_off + fc * 4;
if (fo + 4 > sizeof(f32_disk)) break;
fc = f32_r32(f32_disk + fo) & 0x0FFFFFFF;
}
/* 处理剩余缓冲 */
if (buf_used > 0 && off < file_size) {
u64 written = 0;
int rc = lxc_file_write(linux_path, off, (const char *)f32_data,
buf_used, &written);
if (rc != 0) return rc;
off += written;
}
return (off >= file_size) ? 0 : -6;
}
/* .so 文件收集回调上下文 */
typedef struct {
u32 count; /* 已收集的 .so 数量 */
u32 max_count; /* 上限 */
int error; /* 0=正常, 非 0=出错 */
} lxc_so_collect_ctx;
/* f32_list_dir 回调：过滤 .so 后缀的文件，记录发现 */
static int lxc_so_collect_cb(const f32_entry *e, void *user_data) {
lxc_so_collect_ctx *ctx = (lxc_so_collect_ctx *)user_data;
if (!e || !ctx) return 0;
if (e->is_dir) return 0; /* 跳过子目录 */
/* 判断 .so 后缀（大小写不敏感） */
const char *name = e->has_lfn ? e->long_name : e->name;
if (!fat32_lfn_ends_with_ci(name, ".so")) return 0;
if (ctx->count < ctx->max_count) {
ctx->count++;
} else {
ctx->error = 1; /* 超过上限 */
return 1; /* 停止遍历 */
}
return 0;
}
/* 单文件推送回调上下文（用于流式推送所有 .so 到 guest） */
typedef struct {
const char *guest_path; /* guest 端目录绝对路径 */
u32 pushed; /* 已推送文件数 */
u32 failed; /* 推送失败文件数 */
} lxc_push_ctx;
/* f32_list_dir 回调：流式推送每个 .so 到 guest */
static int lxc_push_so_cb(const f32_entry *e, void *user_data) {
lxc_push_ctx *ctx = (lxc_push_ctx *)user_data;
if (!e || !ctx) return 0;
if (e->is_dir) return 0;
const char *name = e->has_lfn ? e->long_name : e->name;
if (!fat32_lfn_ends_with_ci(name, ".so")) return 0;
/* 构造 guest 端路径: <guest_path>/<filename> */
char linux_path[256];
u32 pl = 0;
while (ctx->guest_path[pl] && pl + 1 < sizeof(linux_path)) {
linux_path[pl] = ctx->guest_path[pl];
pl++;
}
if (pl + 1 >= sizeof(linux_path)) {
ctx->failed++;
return 0; /* 路径过长，跳过 */
}
if (linux_path[pl - 1] != '/') {
linux_path[pl++] = '/';
}
/* 追加文件名 */
u32 nl = 0;
while (name[nl] && pl + 1 < sizeof(linux_path)) {
linux_path[pl++] = name[nl++];
}
linux_path[pl] = 0;
log_info("[LNXC] pushing .so:");
log_info(name);
log_info(" -> ");
log_info(linux_path);
int rc = lxc_push_fat32_file_streaming(e->clus, e->size, linux_path);
if (rc == 0) {
ctx->pushed++;
log_hex64("[LNXC] push ok size=", e->size);
} else {
ctx->failed++;
log_warn("[LNXC] push failed");
log_hex64("[LNXC] push rc=", (u64)(i64)rc);
}
return 0; /* 继续遍历下一个 */
}
/* 同步 FAT32 lib 目录下所有 .so 到 Linux guest。
* 调用时机：linux_compat_init 成功后。失败不阻断启动。
* guest_lib_path : guest 端库目录路径（如 "/usr/lib/deshab"）
* 返回 0 成功，负值失败。 */
int lxc_sync_lib_dir(const char *guest_lib_path) {
if (!guest_lib_path) return -1;
if (!lxc_is_available()) {
log_warn("[LNXC] sync_lib_dir: service not available");
return -1;
}
int rc = lxc_f32_ensure();
if (rc != 0) {
log_warn("[LNXC] sync_lib_dir: FAT32 not available");
return rc;
}
/* 定位 lib 目录簇（lib 在 FAT32 根目录下，不是 SYSTEM/lib！） */
u32 lib_clus = 0;
if (f32_find_path_dir_lfn(g_compat_lib_path, &lib_clus) != 0) {
log_warn("[LNXC] sync_lib_dir: lib dir not found:");
log_warn(g_compat_lib_path);
return -2; /* 目录不存在（容忍：可能是首次启动未放库） */
}
log_info("[LNXC] sync_lib_dir: lib dir found");
log_hex64("[LNXC] lib_clus=", lib_clus);
/* 先枚举确认有 .so 文件（用于日志） */
lxc_so_collect_ctx collect = {0, 256, 0};
f32_list_dir(lib_clus, lxc_so_collect_cb, &collect);
if (collect.error) {
log_warn("[LNXC] sync_lib_dir: too many .so files, capped at 256");
}
log_hex64("[LNXC] sync_lib_dir: .so count=", collect.count);
if (collect.count == 0) {
log_info("[LNXC] sync_lib_dir: no .so files, nothing to push");
return 0;
}
/* 流式推送每个 .so */
lxc_push_ctx pctx;
pctx.guest_path = guest_lib_path;
pctx.pushed = 0;
pctx.failed = 0;
f32_list_dir(lib_clus, lxc_push_so_cb, &pctx);
log_hex64("[LNXC] sync_lib_dir: pushed=", pctx.pushed);
log_hex64("[LNXC] sync_lib_dir: failed=", pctx.failed);
return (pctx.failed == 0) ? 0 : -3;
}
/* ===== VSCode Phase 5: VSCode tarball → guest /opt/vscode 安装 =====
*
* tarball 作为 Limine boot module（路径含 "vscode"）随镜像预加载到主机
* 内存；本函数把它流式推入 guest /tmp/vscode.tar.gz，再在 guest 内解包到
* /opt/vscode（/opt 位于 extra-rootfs overlay，持久可写，二次启动经
* 标记探测直接跳过）。 */
/* guest 内文件可执行性探测：同步 exec /bin/test -e <path>。
* 返回 1 = 存在，0 = 不存在或探测失败。 */
static int lxc_guest_path_exists(const char *path) {
const char *argv[3];
argv[0] = "test";
argv[1] = "-e";
argv[2] = path;
u64 exit_code = 1;
int rc = lxc_exec("/bin/test", 3, argv, 0, 0, 0, &exit_code);
return (rc == 0 && exit_code == 0) ? 1 : 0;
}
int lxc_vscode_install(void) {
if (!lxc_is_available()) {
log_warn("[LNXC] vscode install: service not available");
return -1;
}
/* 1. 已安装标记：overlay 持久化后二次启动直接跳过 */
if (lxc_guest_path_exists("/opt/vscode/bin/code")) {
log_info("[LNXC] vscode: already installed, skipping");
return 0;
}
/* 2. 查找 tarball boot module（缺失属正常——未投放则跳过安装） */
u64 tar_size = 0;
const u8 *tar = (const u8 *)linux_find_vscode_module(&tar_size);
if (!tar || tar_size == 0) {
return -11;
}
log_info("[LNXC] vscode: streaming tarball to guest /tmp ...");
log_hex64("[LNXC] vscode: tarball size=", tar_size);
/* 3. 流式推送：module 内存 → /tmp/vscode.tar.gz（payload pool 分块） */
u32 pool_cap = ipc_shm_payload_capacity();
u64 off = 0;
while (off < tar_size) {
u64 chunk = tar_size - off;
if (chunk > pool_cap) chunk = pool_cap;
u64 written = 0;
int rc = lxc_file_write("/tmp/vscode.tar.gz", off,
(const char *)tar + off, chunk, &written);
if (rc != 0 || written != chunk) {
log_warn("[LNXC] vscode: tarball push failed");
log_hex64("[LNXC] vscode: push off=", off);
return -12;
}
off += written;
}
log_info("[LNXC] vscode: tarball pushed ok");
/* 4. mkdir -p /opt/vscode */
{
const char *argv[3];
argv[0] = "mkdir";
argv[1] = "-p";
argv[2] = "/opt/vscode";
u64 ec = 1;
int rc = lxc_exec("/bin/mkdir", 3, argv, 0, 0, 0, &ec);
if (rc != 0 || ec != 0) {
log_warn("[LNXC] vscode: mkdir /opt/vscode failed");
return -13;
}
}
/* 5. 解包：VSCode 官方 tarball 顶层为 VSCode-linux-x64/，
* --strip-components=1 把内容直接落入 /opt/vscode；
* 若 tarball 是平铺结构（无顶层目录）则回退不解层重试。 */
int unpacked = 0;
{
const char *argv[7];
argv[0] = "tar";
argv[1] = "-xzf";
argv[2] = "/tmp/vscode.tar.gz";
argv[3] = "-C";
argv[4] = "/opt/vscode";
argv[5] = "--strip-components=1";
argv[6] = 0;
u64 ec = 1;
int rc = lxc_exec("/bin/tar", 6, argv, 0, 0, 0, &ec);
if (rc == 0 && ec == 0) unpacked = 1;
}
if (!unpacked) {
log_warn("[LNXC] vscode: strip-components extract failed, trying flat");
const char *argv[5];
argv[0] = "tar";
argv[1] = "-xzf";
argv[2] = "/tmp/vscode.tar.gz";
argv[3] = "-C";
argv[4] = "/opt/vscode";
u64 ec = 1;
int rc = lxc_exec("/bin/tar", 5, argv, 0, 0, 0, &ec);
if (rc == 0 && ec == 0) unpacked = 1;
}
/* 6. 清理 guest 端 tarball（成败都清，/tmp 是 tmpfs 占 guest 内存） */
{
const char *argv[3];
argv[0] = "rm";
argv[1] = "-f";
argv[2] = "/tmp/vscode.tar.gz";
u64 ec = 0;
lxc_exec("/bin/rm", 3, argv, 0, 0, 0, &ec);
}
if (!unpacked) {
log_warn("[LNXC] vscode: extract failed");
return -13;
}
/* 7. 验证：/opt/vscode/bin/code 存在即可启动 */
if (!lxc_guest_path_exists("/opt/vscode/bin/code")) {
log_warn("[LNXC] vscode: verify failed (bin/code missing)");
return -14;
}
log_info("[LNXC] vscode: install ok (/opt/vscode/bin/code)");
return 0;
}
CODE/UTSM/vmm/linux_compat.d
+7 -2
View File
@@ -1,13 +1,18 @@
vmm/linux_compat.o: vmm\linux_compat.c include\utsm\linux_compat.h \
include\utsm\types.h include\utsm\linux_resume.h \
include\utsm\ipc_shm.h ..\utsm-ipc\ipc_proto.h include\utsm\vmm.h \
include\utsm\log.h include\utsm\block.h vmm\..\..\tools\fat32_io.h
include\utsm\linux_loader.h include\utsm\ipc_shm.h \
..\utsm-ipc\ipc_proto.h include\utsm\vmm.h include\utsm\virtio_mmio.h \
include\utsm\log.h include\utsm\block.h vmm\..\..\tools\fat32_io.h \
vmm\..\..\tools\fat32_lfn.h
include\utsm\linux_compat.h:
include\utsm\types.h:
include\utsm\linux_resume.h:
include\utsm\linux_loader.h:
include\utsm\ipc_shm.h:
..\utsm-ipc\ipc_proto.h:
include\utsm\vmm.h:
include\utsm\virtio_mmio.h:
include\utsm\log.h:
include\utsm\block.h:
vmm\..\..\tools\fat32_io.h:
vmm\..\..\tools\fat32_lfn.h:
CODE/UTSM/vmm/linux_loader.c
+171 -13
View File
@@ -49,6 +49,11 @@ static u64 str_len(const char *s) {
static struct linux_guest_info g_guest;
static const char *g_default_cmdline = LINUX_DEFAULT_CMDLINE;
/* VSCode Phase 3: host virtual address of the graphics surface pool.
* The virtio-gpu 2D backend composites the scanout into this buffer; the
* desktop reads it to blit guest graphics onto the IDE host area. 0 = unused. */
static void *g_surface_vaddr = 0;
/* ===== Guest page table helpers =====
*
* Build identity-mapped 4-level page tables for the guest.
@@ -220,9 +225,19 @@ static int setup_e820(void *bootparams_virt) {
table[n].type = E820_TYPE_RESERVED;
n++;
/* Entry 5: 0x04100000-0x0FFFFFFF: usable RAM (general RAM, ~188MB) */
table[n].addr = 0x04100000;
table[n].size = 0x0BF00000; /* 191MB */
/* Entry 5: 0x04100000-0x04FFFFFF: reserved (Graphics surface pool, 16MB)
* VSCode integration Phase 1: separate DMA region EPT-mapped into the
* guest; Linux user-space mmaps it via /dev/utsm as the scanout buffer. */
table[n].addr = LINUX_GUEST_SURFACE_GPA;
table[n].size = LINUX_GUEST_SURFACE_SIZE; /* 16MB */
table[n].type = E820_TYPE_RESERVED;
n++;
/* Entry 6: 0x05000000-0x5FFFFFFF: usable RAM (general RAM, ~1.4GB)
* VSCode integration Phase 1: expanded from 191MB to 1.4GB to fit
* VSCode + Electron + GUI stack (Xorg/modesetting + GTK + mesa). */
table[n].addr = LINUX_GUEST_RAM_GPA;
table[n].size = LINUX_GUEST_RAM_SIZE; /* 1.4GB */
table[n].type = E820_TYPE_RAM;
n++;
@@ -349,6 +364,86 @@ void *linux_find_rootfs_module(u64 *size_out) {
return (void *)0;
}
/* ===== extra rootfs module finder =====
*
* VSCode Phase 4：在 Limine boot module 中查找持久 rw 卷镜像
* （路径含 "extra"，如 linux-extra-rootfs.img）。
* 通过 virtio-blk slot6（可写）暴露给 Linux guest 作为 /dev/vdc。 */
void *linux_find_extra_rootfs_module(u64 *size_out) {
if (!g_module_request.response) return (void *)0;
struct limine_module_response *resp = g_module_request.response;
for (u64 i = 0; i < resp->module_count; i++) {
struct limine_file *file = resp->modules[i];
if (!file || !file->path) continue;
const char *p = file->path;
int match = 0;
for (const char *s = p; *s; s++) {
/* 匹配 "extra"（如 linux-extra-rootfs.img） */
if ((s[0] == 'e' || s[0] == 'E') &&
(s[1] == 'x' || s[1] == 'X') &&
(s[2] == 't' || s[2] == 'T') &&
(s[3] == 'r' || s[3] == 'R') &&
(s[4] == 'a' || s[4] == 'A')) {
match = 1;
break;
}
}
if (!match) continue;
if (size_out) *size_out = file->size;
log_info("[LINUX] found extra-rootfs module:");
log_info(file->path);
log_hex64("[LINUX] extra-rootfs size=", file->size);
return file->address;
}
log_warn("[LINUX] no extra-rootfs module found");
return (void *)0;
}
/* ===== VSCode tarball module finder =====
*
* VSCode Phase 5：在 Limine boot module 中查找 VSCode tarball
* （路径含 "vscode"，如 linux-vscode.tar.gz）。
* 由 lxc_vscode_install() 流式推入 guest 并解压到 /opt/vscode。
* 模块缺失属正常情况（未投放 tarball），返回 NULL 由调用方跳过。 */
void *linux_find_vscode_module(u64 *size_out) {
if (!g_module_request.response) return (void *)0;
struct limine_module_response *resp = g_module_request.response;
for (u64 i = 0; i < resp->module_count; i++) {
struct limine_file *file = resp->modules[i];
if (!file || !file->path) continue;
const char *p = file->path;
int match = 0;
for (const char *s = p; *s; s++) {
/* 匹配 "vscode"（如 linux-vscode.tar.gz） */
if ((s[0] == 'v' || s[0] == 'V') &&
(s[1] == 's' || s[1] == 'S') &&
(s[2] == 'c' || s[2] == 'C') &&
(s[3] == 'o' || s[3] == 'O') &&
(s[4] == 'd' || s[4] == 'D') &&
(s[5] == 'e' || s[5] == 'E')) {
match = 1;
break;
}
}
if (!match) continue;
if (size_out) *size_out = file->size;
log_info("[LINUX] found vscode tarball module:");
log_info(file->path);
log_hex64("[LINUX] vscode tarball size=", file->size);
return file->address;
}
log_info("[LINUX] no vscode tarball module (install skipped)");
return (void *)0;
}
/* ===== bzImage parser ===== */
int linux_parse_bzimage(const void *bzimage, u64 size,
@@ -552,16 +647,23 @@ int linux_loader_init(void) {
return -8;
}
/* General RAM: 64MB for Linux, mapped at GPA 0x05000000 (after IPC region) */
u64 ram_size = 64 * 1024 * 1024;
/* General RAM: VSCode integration Phase 1 expansion.
* 1.4GB (LINUX_GUEST_RAM_SIZE) accommodates VSCode + Electron + GUI stack
* (Xorg/modesetting + GTK + mesa softpipe). Falls back to 1GB / 512MB if
* the host cannot allocate the full amount; 512MB is the floor for the
* Xfbdev + xterm MVP (Phase 3). Original allocation was 64MB. */
u64 ram_size = LINUX_GUEST_RAM_SIZE; /* 1.4GB */
dkm_dma_buffer ram_buf;
if (dma_alloc_pages(ram_size / 4096, 2 * 1024 * 1024, 0, &ram_buf) != 0) {
log_error("[LINUX] failed to alloc guest RAM (64MB)");
/* Try smaller: 32MB */
ram_size = 32 * 1024 * 1024;
log_warn("[LINUX] failed to alloc guest RAM (1.4GB), trying 1GB");
ram_size = 1ULL * 1024 * 1024 * 1024; /* 1GB */
if (dma_alloc_pages(ram_size / 4096, 2 * 1024 * 1024, 0, &ram_buf) != 0) {
log_error("[LINUX] failed to alloc guest RAM (32MB)");
return -9;
log_warn("[LINUX] failed to alloc guest RAM (1GB), trying 512MB");
ram_size = 512 * 1024 * 1024; /* 512MB floor for Phase 3 MVP */
if (dma_alloc_pages(ram_size / 4096, 2 * 1024 * 1024, 0, &ram_buf) != 0) {
log_error("[LINUX] failed to alloc guest RAM (512MB minimum)");
return -9;
}
}
}
log_hex64("[LINUX] guest RAM HPA=", ram_buf.phys);
@@ -680,13 +782,14 @@ int linux_loader_init(void) {
return -15;
}
/* General RAM: map the allocated RAM at GPA 0x05000000 (after IPC region).
* GPA layout (matches e820):
/* General RAM: map the allocated RAM at GPA 0x05000000 (after surface pool).
* GPA layout (matches e820, VSCode integration Phase 1):
* 0x00400000-0x009FFFFF: fixed regions (boot_params, GDT, pgt, stack, cmdline)
* 0x01000000-0x02FFFFFF: kernel
* 0x03000000-0x03FFFFFF: initrd (if any)
* 0x04000000-0x040FFFFF: IPC shared memory (mapped by ipc_shm_init)
* 0x05000000-0x08FFFFFF: general RAM (64MB)
* 0x04100000-0x04FFFFFF: Graphics surface pool (mapped below)
* 0x05000000-0x5FFFFFFF: general RAM (~1.4GB, expanded Phase 1)
* Linux sees this as usable RAM in e820. */
u64 ram_gpa = LINUX_GUEST_RAM_GPA;
if (ept_map_range(ram_gpa, ram_buf.phys, ram_size, EPT_RWX) != 0) {
@@ -695,6 +798,41 @@ int linux_loader_init(void) {
}
log_hex64("[LINUX] guest RAM mapped GPA=", ram_gpa);
/* VSCode integration Phase 1: allocate graphics surface pool and EPT-map
* it into the Linux guest at LINUX_GUEST_SURFACE_GPA. Linux user-space
* obtains a writable pointer to this region via UTSM_HCALL_SURFACE_INFO +
* /dev/utsm mmap; UTSM reads it to blit guest graphics to the Deshab
* framebuffer (Phase 3 virtio-gpu shadow scanout). Non-fatal on failure:
* Linux guest still runs, VSCode integration phases 2+ will degrade. */
{
dkm_dma_buffer surface_buf;
u64 surface_size = LINUX_GUEST_SURFACE_SIZE; /* 16MB */
if (dma_alloc_pages(surface_size / 4096, 2 * 1024 * 1024, 0, &surface_buf) != 0) {
log_warn("[LINUX] failed to alloc surface pool (16MB) — VSCode integration degraded");
g_guest.surface_hpa = 0;
g_guest.surface_gpa = 0;
g_guest.surface_size = 0;
} else if (ept_map_range(LINUX_GUEST_SURFACE_GPA, surface_buf.phys,
surface_size, EPT_READ | EPT_WRITE) != 0) {
log_warn("[LINUX] EPT map surface pool failed — VSCode integration degraded");
g_guest.surface_hpa = 0;
g_guest.surface_gpa = 0;
g_guest.surface_size = 0;
} else {
/* Zero the surface pool so guest reads deterministic data before
* the X server writes a real scanout. */
u8 *surface_virt = (u8 *)surface_buf.virt;
for (u64 i = 0; i < surface_size; i++) surface_virt[i] = 0;
g_guest.surface_hpa = surface_buf.phys;
g_guest.surface_gpa = LINUX_GUEST_SURFACE_GPA;
g_guest.surface_size = surface_size;
g_surface_vaddr = surface_buf.virt; /* VSCode Phase 3: for virtio-gpu + desktop blit */
log_hex64("[LINUX] surface pool HPA=", surface_buf.phys);
log_hex64("[LINUX] surface pool GPA=", g_guest.surface_gpa);
log_hex64("[LINUX] surface pool size=", surface_size);
}
}
/* Identity-map the first 1MB (BIOS area, needed by some Linux code paths) */
if (ept_identity_map(0, 0x100000, EPT_RWX) != 0) {
log_warn("[LINUX] EPT identity map first 1MB failed (non-critical)");
@@ -715,3 +853,23 @@ int linux_loader_init(void) {
const struct linux_guest_info *linux_get_guest_info(void) {
return g_guest.loaded ? &g_guest : (struct linux_guest_info *)0;
}
/* VSCode integration Phase 1: query graphics surface pool.
* Returns 0 on success (surface pool allocated and mapped), -1 if not
* initialized. Caller may pass NULL for any output it doesn't need. */
int linux_get_surface_info(u64 *hpa_out, u64 *gpa_out, u64 *size_out) {
if (!g_guest.loaded || g_guest.surface_hpa == 0) {
return -1;
}
if (hpa_out) *hpa_out = g_guest.surface_hpa;
if (gpa_out) *gpa_out = g_guest.surface_gpa;
if (size_out) *size_out = g_guest.surface_size;
return 0;
}
/* VSCode Phase 3: return host virtual address of the surface pool.
* The virtio-gpu 2D backend composites the scanout here; the desktop reads it
* for blitting to the framebuffer. Returns NULL if the pool is not allocated. */
void *linux_get_surface_vaddr(void) {
return g_surface_vaddr;
}
CODE/UTSM/vmm/virtio_blk.c
+199 -2
View File
@@ -389,8 +389,10 @@ static void rootfs_blk_queue_notify(u32 queue_idx) {
struct virtq_used *used;
u32 qnum;
if (virtio_queue_get_ptrs(VIRTIO_ID_BLOCK, queue_idx,
&desc, &avail, &used, &qnum) != 0) {
/* 必须按 gpa_base 定位：slot0 SATA blk 与本后端 device_id 同为 2，
* virtio_queue_get_ptrs(VIRTIO_ID_BLOCK) 只会命中第一个（slot0）。 */
if (virtio_queue_get_ptrs_by_gpa(VIRTIO_MMIO_ROOTFS_GPA, queue_idx,
&desc, &avail, &used, &qnum) != 0) {
return;
}
@@ -448,3 +450,198 @@ void virtio_rootfs_blk_init(void) {
virtio_mmio_register(&g_rootfs_blk_backend);
}
/* ===== Extra rootfs virtio-blk 后端（VSCode Phase 4，可写持久卷） =====
*
* 第三个 virtio-blk 设备，后端为内存中的 linux-extra-rootfs.img
* （Limine boot module，路径含 "extra"）。guest 看到 /dev/vdc，
* 用作 overlayfs 的 rw 上层或 VSCode 数据卷。
*
* 与 rootfs（vdb 只读）不同，本后端支持 VIRTIO_BLK_T_OUT 真正写入内存
* （易失：重启丢失；Phase 7 再做写回 FAT32 持久化）。
*
* 无 extra-rootfs module 时安全不注册（guest cmdline 无 slot6 参数）。 */
static u8 *g_xrootfs_data;
static u64 g_xrootfs_size;
static u64 g_xrootfs_capacity;
static u16 g_xrootfs_last_avail;
static u32 xrootfs_blk_read_config(u32 offset, int width) {
(void)width;
struct virtio_blk_config cfg;
u8 *c = (u8 *)&cfg;
for (u32 i = 0; i < sizeof(cfg); i++) c[i] = 0;
cfg.capacity = g_xrootfs_capacity;
cfg.size_max = 128;
cfg.seg_max = 32;
cfg.blk_size = 512;
if (offset < sizeof(cfg)) {
u32 val = 0;
rf_memcpy(&val, c + offset, (offset + 4 <= sizeof(cfg)) ? 4 : (sizeof(cfg) - offset));
return val;
}
return 0;
}
static u32 xrootfs_blk_handle_chain(struct virtq_desc *desc, u16 head, u32 qnum) {
(void)qnum;
struct virtio_blk_outhdr hdr;
u8 *hptr = (u8 *)virtio_gpa_to_host(desc[head].addr);
if (!hptr) return 0;
rf_memcpy(&hdr, hptr, sizeof(hdr));
u32 type = hdr.type;
u64 sector = hdr.sector;
u16 data_idx = 0xFFFF;
u16 status_idx = 0xFFFF;
if (desc[head].flags & VIRTQ_DESC_F_NEXT) {
data_idx = desc[head].next;
u16 cur = data_idx;
int hops = 0;
while ((desc[cur].flags & VIRTQ_DESC_F_NEXT) && hops < 16) {
cur = desc[cur].next;
hops++;
}
status_idx = cur;
}
u8 *status = (u8 *)0;
if (status_idx != 0xFFFF && (desc[status_idx].flags & VIRTQ_DESC_F_WRITE)) {
status = (u8 *)virtio_gpa_to_host(desc[status_idx].addr);
}
u32 bytes_done = 0;
u8 result = VIRTIO_BLK_S_OK;
switch (type) {
case VIRTIO_BLK_T_IN: { /* 读：镜像内存 → guest */
if (data_idx == 0xFFFF || !g_xrootfs_data) {
result = VIRTIO_BLK_S_IOERR;
break;
}
u8 *dbuf = (u8 *)virtio_gpa_to_host(desc[data_idx].addr);
u32 dlen = desc[data_idx].len;
if (!dbuf) { result = VIRTIO_BLK_S_IOERR; break; }
u64 offset = sector * 512ULL;
u64 avail = (offset < g_xrootfs_size) ? (g_xrootfs_size - offset) : 0;
u32 copied = 0;
if (avail > 0) {
u32 n = (dlen < avail) ? dlen : (u32)avail;
rf_memcpy(dbuf, g_xrootfs_data + offset, n);
copied = n;
}
/* 越界部分填零 */
while (copied < dlen) dbuf[copied++] = 0;
bytes_done = dlen;
break;
}
case VIRTIO_BLK_T_OUT: { /* 写：guest → 镜像内存（可写卷） */
if (data_idx == 0xFFFF || !g_xrootfs_data) {
result = VIRTIO_BLK_S_IOERR;
break;
}
const u8 *dbuf = (const u8 *)virtio_gpa_to_host(desc[data_idx].addr);
u32 dlen = desc[data_idx].len;
if (!dbuf) { result = VIRTIO_BLK_S_IOERR; break; }
u64 offset = sector * 512ULL;
if (offset + dlen > g_xrootfs_size) {
/* 越界写：只写卷内部分，其余丢弃 */
u64 avail = (offset < g_xrootfs_size) ? (g_xrootfs_size - offset) : 0;
if (avail > 0) rf_memcpy(g_xrootfs_data + offset, dbuf, avail);
} else {
rf_memcpy(g_xrootfs_data + offset, dbuf, dlen);
}
bytes_done = 0; /* 写操作 used.len=0 */
break;
}
case VIRTIO_BLK_T_GET_ID:
if (data_idx != 0xFFFF) {
char *idbuf = (char *)virtio_gpa_to_host(desc[data_idx].addr);
if (idbuf) {
const char *id = "DESHAB-EXTRA-ROOTFS";
u32 i = 0;
for (; id[i] && i < desc[data_idx].len - 1; i++) idbuf[i] = id[i];
idbuf[i] = 0;
bytes_done = i + 1;
}
}
break;
case VIRTIO_BLK_T_FLUSH:
result = VIRTIO_BLK_S_OK;
break;
default:
result = VIRTIO_BLK_S_UNSUPP;
break;
}
if (status) *status = result;
return bytes_done;
}
static void xrootfs_blk_queue_notify(u32 queue_idx) {
struct virtq_desc *desc;
struct virtq_avail *avail;
struct virtq_used *used;
u32 qnum;
/* 按 gpa_base 定位（三个 blk 后端 device_id 同为 2） */
if (virtio_queue_get_ptrs_by_gpa(VIRTIO_MMIO_EXTRA_ROOTFS_GPA, queue_idx,
&desc, &avail, &used, &qnum) != 0) {
return;
}
u16 cur = g_xrootfs_last_avail;
u16 used_idx = used->idx;
while (cur != avail->idx) {
u16 head = avail->ring[cur % qnum];
u32 len = xrootfs_blk_handle_chain(desc, head, qnum);
used->ring[used_idx % qnum].id = head;
used->ring[used_idx % qnum].len = len;
used_idx++;
cur++;
}
virtio_queue_bump_used(used, used_idx);
g_xrootfs_last_avail = cur;
}
static void xrootfs_blk_reset(void) {
g_xrootfs_last_avail = 0;
}
static struct virtio_backend g_xrootfs_blk_backend = {
.device_id = VIRTIO_ID_BLOCK,
.gpa_base = VIRTIO_MMIO_EXTRA_ROOTFS_GPA,
.irq = 11, /* guest ISA IRQ11（cmdline :11，vector 0x3B） */
.num_queues = 1,
.queue_size = 128,
.device_features = (1ULL << VIRTIO_F_VERSION_1) |
(1ULL << VIRTIO_BLK_F_SIZE_MAX) |
(1ULL << VIRTIO_BLK_F_SEG_MAX) |
(1ULL << VIRTIO_BLK_F_BLK_SIZE) |
(1ULL << VIRTIO_BLK_F_FLUSH),
.config_len = sizeof(struct virtio_blk_config),
.read_config = xrootfs_blk_read_config,
.queue_notify = xrootfs_blk_queue_notify,
.reset = xrootfs_blk_reset,
};
void virtio_extra_rootfs_blk_init(void) {
u64 size = 0;
void *img = linux_find_extra_rootfs_module(&size);
if (!img || size == 0) {
log_warn("[VBLK] no extra-rootfs module, slot6 backend not registered");
return;
}
g_xrootfs_data = (u8 *)img;
g_xrootfs_size = size;
g_xrootfs_capacity = size / 512;
if (size % 512) g_xrootfs_capacity++;
log_info("[VBLK] extra-rootfs-blk backend bound (rw)");
log_hex64("[VBLK] extra-rootfs size=", size);
virtio_mmio_register(&g_xrootfs_blk_backend);
}
CODE/UTSM/vmm/virtio_gpu.c
+918
View File
@@ -0,0 +1,918 @@
/* virtio_gpu.c — UTSM virtio-gpu 2D backend (VSCode integration Phase 3).
*
* Implements a minimal virtio-gpu 2D device (device_id=16) so the Linux guest
* gets /dev/dri/card0 + /dev/fb0 (via DRM fbdev emulation). The X server
* (Xfbdev MVP / Xorg Phase 4) drives the scanout; the composited frame lands
* in the shared graphics surface pool, which the Deshab desktop reads to blit
* guest graphics onto the IDE host area.
*
* Device layout: slot 5 @ 0xF4005000 IRQ10, two queues (ctrlq + cursorq).
*
* Supported 2D command set (Virtio 1.1 §5.4.4):
* GET_NUM_SCANOUTS, GET_DISPLAY_INFO, RESOURCE_CREATE_2D, RESOURCE_DESTROY,
* RESOURCE_ATTACH_BACKING, RESOURCE_DETACH_BACKING, SET_SCANOUT,
* TRANSFER_TO_HOST_2D, RESOURCE_FLUSH.
*
* Cursor commands (UPDATE_CURSOR / MOVE_CURSOR) are acknowledged but not
* rendered — the Deshab desktop draws its own PS/2 cursor over the blit.
*
* Data flow:
* 1. Guest DRM driver creates a 2D resource, attaches guest RAM backing,
* binds it to scanout 0 (SET_SCANOUT), and TRANSFER_TO_HOST_2D copies a
* rect from guest backing into the surface pool (scanout shadow).
* 2. RESOURCE_FLUSH marks the scanout dirty.
* 3. The desktop polls virtio_gpu_get_scanout_info() and blits the dirty
* scanout to the framebuffer IDE host area, clearing dirty.
*
* MVP simplifications:
* - Single scanout (num_scanouts=1), fixed display 1024×768 XRGB8888.
* - Resource backing assumed contiguous (first mem_entry's GPA + total len).
* Guest framebuffer allocations satisfy this.
* - No virgl 3D, no capsets, no cross-endian byte swap (raw 32bpp copy).
*/
#include <utsm/virtio_mmio.h>
#include <utsm/linux_loader.h>
#include <utsm/log.h>
#include <utsm/types.h>
/* ===== virtio-gpu protocol structs (must match <uapi/linux/virtio_gpu.h>) ===== */
struct virtio_gpu_config {
u32 events_read;
u32 events_clear;
u32 num_scanouts;
u32 num_capsets;
} __attribute__((packed));
struct virtio_gpu_ctrl_hdr {
u32 type;
u32 flags;
u64 fence_id;
u32 ctx_id;
u32 padding;
} __attribute__((packed));
struct virtio_gpu_rect {
u32 x;
u32 y;
u32 width;
u32 height;
} __attribute__((packed));
struct virtio_gpu_display_one {
struct virtio_gpu_rect r;
u32 enabled;
u32 flags;
} __attribute__((packed));
struct virtio_gpu_resp_display_info {
struct virtio_gpu_ctrl_hdr hdr;
struct virtio_gpu_display_one pmodes[16];
} __attribute__((packed));
struct virtio_gpu_resp_num_scanouts {
struct virtio_gpu_ctrl_hdr hdr;
u32 num_scanouts;
u32 padding;
} __attribute__((packed));
struct virtio_gpu_resource_create_2d {
struct virtio_gpu_ctrl_hdr hdr;
u32 resource_id;
u32 format;
u32 width;
u32 height;
} __attribute__((packed));
struct virtio_gpu_mem_entry {
u64 addr;
u32 length;
u32 padding;
} __attribute__((packed));
struct virtio_gpu_resource_attach_backing {
struct virtio_gpu_ctrl_hdr hdr;
u32 resource_id;
u32 nr_entries;
} __attribute__((packed));
struct virtio_gpu_set_scanout {
struct virtio_gpu_ctrl_hdr hdr;
struct virtio_gpu_rect r;
u32 scanout_id;
u32 resource_id;
} __attribute__((packed));
struct virtio_gpu_transfer_to_host_2d {
struct virtio_gpu_ctrl_hdr hdr;
struct virtio_gpu_rect r;
u64 offset;
u32 resource_id;
u32 padding;
} __attribute__((packed));
struct virtio_gpu_resource_flush {
struct virtio_gpu_ctrl_hdr hdr;
struct virtio_gpu_rect r;
u32 resource_id;
u32 padding;
} __attribute__((packed));
/* P7.6: cursor queue commands (UPDATE_CURSOR / MOVE_CURSOR share struct) */
struct virtio_gpu_update_cursor {
struct virtio_gpu_ctrl_hdr hdr;
struct virtio_gpu_rect pos; /* x, y on scanout */
u32 resource_id; /* 0 = hide cursor */
u32 hot_x;
u32 hot_y;
} __attribute__((packed));
#define VGPU_CURSOR_MAX 64 /* max cursor image dimension (pixels) */
/* command types */
#define VIRTIO_GPU_CMD_GET_NUM_SCANOUTS 0x0102
#define VIRTIO_GPU_CMD_GET_DISPLAY_INFO 0x0103
#define VIRTIO_GPU_CMD_RESOURCE_CREATE_2D 0x0104
#define VIRTIO_GPU_CMD_RESOURCE_DESTROY 0x0105
#define VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING 0x0106
#define VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING 0x0107
#define VIRTIO_GPU_CMD_SET_SCANOUT 0x0108
#define VIRTIO_GPU_CMD_TRANSFER_TO_HOST_2D 0x0109
#define VIRTIO_GPU_CMD_RESOURCE_FLUSH 0x010a
#define VIRTIO_GPU_CMD_UPDATE_CURSOR 0x0110
#define VIRTIO_GPU_CMD_MOVE_CURSOR 0x0111
/* response types */
#define VIRTIO_GPU_RESP_OK_NODATA 0x1100
#define VIRTIO_GPU_RESP_OK_DISPLAY_INFO 0x1101
#define VIRTIO_GPU_RESP_ERR_UNSPEC 0x1200
#define VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY 0x1201
#define VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID 0x1202
#define VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID 0x1203
#define VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER 0x1205
/* formats we accept (32bpp). Copied raw — no endian swap. */
#define VIRTIO_GPU_FORMAT_B8G8R8A8_UNORM 1
#define VIRTIO_GPU_FORMAT_B8G8R8X8_UNORM 2
#define VIRTIO_GPU_FORMAT_R8G8B8A8_UNORM 3
#define VIRTIO_GPU_FORMAT_R8G8B8X8_UNORM 4
/* fence flag (we just ack fences, no real fencing) */
#define VIRTIO_GPU_FLAG_FENCE (1 << 0)
/* Fixed scanout geometry advertised to the guest. 1024×768 fits in the 16MB
* surface pool (4 MB) with headroom, and is a standard Xfbdev mode. */
#define VGPU_SCANOUT_W 1024
#define VGPU_SCANOUT_H 768
#define VGPU_BPP 4 /* XRGB8888 = 4 bytes/pixel */
#define VGPU_SCANOUT_STRIDE (VGPU_SCANOUT_W * VGPU_BPP) /* 4096 bytes/row */
#define VGPU_SCANOUT_SIZE (VGPU_SCANOUT_STRIDE * VGPU_SCANOUT_H) /* 3 MB */
#define VGPU_MAX_RESOURCES 16
#define VGPU_MAX_BACKING_ENTRIES 8
struct vgpu_resource {
int in_use;
u32 resource_id;
u32 format;
u32 width;
u32 height;
int has_backing;
/* Backing memory (contiguous assumption: first entry GPA + total len).
* Multi-entry attach is summed; guest framebuffer allocations are
* physically contiguous so this holds in practice. */
u64 backing_gpa;
u64 backing_len;
};
/* Per-device state. Single instance (one virtio-gpu device). */
static struct {
u64 gpa_base;
u32 irq;
/* config space image (16 bytes) */
struct virtio_gpu_config cfg;
/* resource table */
struct vgpu_resource res[VGPU_MAX_RESOURCES];
/* scanout 0 state */
int scanout_enabled;
u32 scanout_res_id; /* 0 = none */
u32 scanout_x, scanout_y;
u32 scanout_w, scanout_h;
/* surface pool (host vaddr) — composited frames land here */
void *surface_vaddr;
u64 surface_size;
/* dirty: set on FLUSH of the scanout resource, cleared by get_scanout_info */
int dirty;
/* Phase 7: 累积 dirty rect（scanout 坐标系并集），desktop 局部 blit 用。
* dirty_rect_valid=0 时无矩形（与 dirty=0 等价；首帧建议全量拷贝）。 */
int dirty_rect_valid;
u32 dirty_rx, dirty_ry, dirty_rw, dirty_rh;
/* P7.6: hardware cursor state (cursorq UPDATE_CURSOR / MOVE_CURSOR)。
* cursor_visible=0 直到 guest 发 UPDATE_CURSOR 且 resource_id!=0。
* cursor_bitmap 存 ARGB 像素（row stride = VGPU_CURSOR_MAX），供 desktop
* alpha-blend 叠加到 IDE host 区域。 */
int cursor_visible;
u32 cursor_x, cursor_y; /* position on scanout */
u32 cursor_hot_x, cursor_hot_y;
u32 cursor_w, cursor_h; /* actual cursor image dimensions */
u32 cursor_bitmap[VGPU_CURSOR_MAX * VGPU_CURSOR_MAX];
/* per-queue avail cursor */
u16 last_avail_ctrl;
u16 last_avail_cursor;
struct virtio_backend backend;
} g_gpu;
/* ===== resource table helpers ===== */
static struct vgpu_resource *res_find(u32 id) {
if (id == 0) return 0;
for (int i = 0; i < VGPU_MAX_RESOURCES; i++) {
if (g_gpu.res[i].in_use && g_gpu.res[i].resource_id == id)
return &g_gpu.res[i];
}
return 0;
}
static struct vgpu_resource *res_alloc(void) {
for (int i = 0; i < VGPU_MAX_RESOURCES; i++) {
if (!g_gpu.res[i].in_use) {
g_gpu.res[i].in_use = 1;
return &g_gpu.res[i];
}
}
return 0;
}
static void res_release(struct vgpu_resource *r) {
if (!r) return;
r->in_use = 0;
r->resource_id = 0;
r->has_backing = 0;
r->backing_gpa = 0;
r->backing_len = 0;
}
/* ===== surface pool access =====
* The scanout shadow lives at the start of the 16MB graphics surface pool
* (allocated in linux_loader.c). virtio-gpu composites there; the desktop
* reads the same region. Falls back to disabled scanout if the pool is absent. */
static int surface_ready(void) {
return g_gpu.surface_vaddr != 0 && g_gpu.surface_size >= VGPU_SCANOUT_SIZE;
}
/* ===== descriptor chain walker =====
* A virtio-gpu ctrl chain is typically: [cmd desc (read, F_NEXT)] →
* [resp desc (write)]. We collect the first readable buffer as the command
* and the first writable buffer as the response. Returns 0 on success and
* fills cmd/resp host vaddrs + lens; resp may be NULL if driver omitted it. */
struct chain_bufs {
void *cmd; u32 cmd_len;
void *resp; u32 resp_len;
u16 head; /* chain head index (for used ring) */
};
static int walk_chain(struct virtq_desc *desc, u32 qnum, u16 head,
struct chain_bufs *out) {
u16 cur = head;
int steps = 0;
out->cmd = 0; out->cmd_len = 0;
out->resp = 0; out->resp_len = 0;
out->head = head;
while (steps < 64) { /* bound chain length */
if (cur >= qnum) return -1;
struct virtq_desc *d = &desc[cur];
void *host = virtio_gpa_to_host(d->addr);
if (!host) return -1; /* unmapped GPA */
if (d->flags & VIRTQ_DESC_F_WRITE) {
if (!out->resp) { out->resp = host; out->resp_len = d->len; }
} else {
if (!out->cmd) { out->cmd = host; out->cmd_len = d->len; }
}
if (!(d->flags & VIRTQ_DESC_F_NEXT)) break;
cur = d->next;
steps++;
}
return (out->cmd != 0) ? 0 : -1;
}
/* Write a simple NODATA response (just the ctrl_hdr). */
static void write_resp_nodata(void *resp, u32 resp_cap, u32 cmd_type, u32 resp_type) {
if (!resp || resp_cap < (u32)sizeof(struct virtio_gpu_ctrl_hdr)) return;
struct virtio_gpu_ctrl_hdr *h = (struct virtio_gpu_ctrl_hdr *)resp;
h->type = resp_type;
h->flags = 0;
h->fence_id = 0;
h->ctx_id = 0;
h->padding = 0;
(void)cmd_type;
}
/* ===== 2D command handlers =====
* Each returns the response type to write. cmd points at the full command
* (ctrl_hdr + command-specific body). */
static u32 handle_get_display_info(void *resp, u32 resp_cap) {
if (!resp || resp_cap < (u32)sizeof(struct virtio_gpu_resp_display_info))
return VIRTIO_GPU_RESP_ERR_UNSPEC;
struct virtio_gpu_resp_display_info *r =
(struct virtio_gpu_resp_display_info *)resp;
/* header */
r->hdr.type = VIRTIO_GPU_RESP_OK_DISPLAY_INFO;
r->hdr.flags = 0; r->hdr.fence_id = 0; r->hdr.ctx_id = 0; r->hdr.padding = 0;
/* one enabled scanout at (0,0,1024,768) */
for (int i = 0; i < 16; i++) {
r->pmodes[i].r.x = 0; r->pmodes[i].r.y = 0;
r->pmodes[i].r.width = 0; r->pmodes[i].r.height = 0;
r->pmodes[i].enabled = 0;
r->pmodes[i].flags = 0;
}
r->pmodes[0].r.width = VGPU_SCANOUT_W;
r->pmodes[0].r.height = VGPU_SCANOUT_H;
r->pmodes[0].enabled = 1;
return VIRTIO_GPU_RESP_OK_DISPLAY_INFO;
}
static u32 handle_resource_create_2d(struct virtio_gpu_resource_create_2d *cmd) {
if (!cmd) return VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
u32 id = cmd->resource_id;
if (id == 0) return VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
if (res_find(id)) return VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
/* accept 32bpp formats; reject exotic sizes */
if (cmd->format < VIRTIO_GPU_FORMAT_B8G8R8A8_UNORM ||
cmd->format > VIRTIO_GPU_FORMAT_R8G8B8X8_UNORM)
return VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
if (cmd->width == 0 || cmd->height == 0 ||
cmd->width > 4096 || cmd->height > 4096)
return VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
struct vgpu_resource *r = res_alloc();
if (!r) return VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY;
r->resource_id = id;
r->format = cmd->format;
r->width = cmd->width;
r->height = cmd->height;
r->has_backing = 0;
return VIRTIO_GPU_RESP_OK_NODATA;
}
static u32 handle_resource_destroy(u32 resource_id) {
struct vgpu_resource *r = res_find(resource_id);
if (!r) return VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
/* if it was the scanout resource, detach */
if (g_gpu.scanout_enabled && g_gpu.scanout_res_id == resource_id) {
g_gpu.scanout_enabled = 0;
g_gpu.scanout_res_id = 0;
}
res_release(r);
return VIRTIO_GPU_RESP_OK_NODATA;
}
static u32 handle_attach_backing(struct virtio_gpu_resource_attach_backing *cmd,
u32 cmd_len) {
if (!cmd) return VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
u32 id = cmd->resource_id;
struct vgpu_resource *r = res_find(id);
if (!r) return VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
u32 n = cmd->nr_entries;
if (n == 0 || n > VGPU_MAX_BACKING_ENTRIES)
return VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
/* entries immediately follow the attach_backing command in the same buffer */
u32 hdr_off = (u32)sizeof(struct virtio_gpu_resource_attach_backing);
if (cmd_len < hdr_off + n * (u32)sizeof(struct virtio_gpu_mem_entry))
return VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
struct virtio_gpu_mem_entry *entries =
(struct virtio_gpu_mem_entry *)((u8 *)cmd + hdr_off);
/* MVP: record first entry GPA + summed length (contiguous assumption). */
u64 base = entries[0].addr;
u64 total = 0;
for (u32 i = 0; i < n; i++) total += entries[i].length;
r->has_backing = 1;
r->backing_gpa = base;
r->backing_len = total;
return VIRTIO_GPU_RESP_OK_NODATA;
}
static u32 handle_detach_backing(u32 resource_id) {
struct vgpu_resource *r = res_find(resource_id);
if (!r) return VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
r->has_backing = 0;
r->backing_gpa = 0;
r->backing_len = 0;
return VIRTIO_GPU_RESP_OK_NODATA;
}
static u32 handle_set_scanout(struct virtio_gpu_set_scanout *cmd) {
if (!cmd) return VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
if (cmd->scanout_id != 0) return VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID;
if (cmd->resource_id == 0) {
/* disabling scanout */
g_gpu.scanout_enabled = 0;
g_gpu.scanout_res_id = 0;
return VIRTIO_GPU_RESP_OK_NODATA;
}
struct vgpu_resource *r = res_find(cmd->resource_id);
if (!r) return VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
if (cmd->r.width == 0 || cmd->r.height == 0)
return VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
g_gpu.scanout_enabled = 1;
g_gpu.scanout_res_id = cmd->resource_id;
g_gpu.scanout_x = cmd->r.x;
g_gpu.scanout_y = cmd->r.y;
g_gpu.scanout_w = cmd->r.width;
g_gpu.scanout_h = cmd->r.height;
return VIRTIO_GPU_RESP_OK_NODATA;
}
/* Copy a rect of a resource from guest backing memory into the surface pool
* scanout region. Called for both TRANSFER_TO_HOST_2D and (implicitly via flush)
* — we do the actual copy on TRANSFER, flush just marks dirty. */
static void composite_rect(struct vgpu_resource *r, struct virtio_gpu_rect *rect,
u64 offset) {
if (!surface_ready() || !r || !r->has_backing) return;
/* only composite the resource currently bound to the scanout */
if (!g_gpu.scanout_enabled || g_gpu.scanout_res_id != r->resource_id) return;
void *backing_host = virtio_gpa_to_host(r->backing_gpa);
if (!backing_host) return;
u32 src_stride = r->width * VGPU_BPP;
u32 dst_stride = VGPU_SCANOUT_STRIDE; /* scanout is fixed 1024×768 */
/* clamp rect to resource bounds */
u32 rx = rect->x, ry = rect->y, rw = rect->width, rh = rect->height;
if (rx >= r->width || ry >= r->height) return;
if (rx + rw > r->width) rw = r->width - rx;
if (ry + rh > r->height) rh = r->height - ry;
/* clamp to scanout bounds */
u32 dx = g_gpu.scanout_x + rx;
u32 dy = g_gpu.scanout_y + ry;
if (dx >= VGPU_SCANOUT_W || dy >= VGPU_SCANOUT_H) return;
if (dx + rw > VGPU_SCANOUT_W) rw = VGPU_SCANOUT_W - dx;
if (dy + rh > VGPU_SCANOUT_H) rh = VGPU_SCANOUT_H - dy;
if (rw == 0 || rh == 0) return;
u8 *dst = (u8 *)g_gpu.surface_vaddr;
u8 *src = (u8 *)backing_host + offset;
u32 copy_bytes = rw * VGPU_BPP;
/* guard against backing_len overflow */
u64 src_base = offset + (u64)ry * src_stride + (u64)rx * VGPU_BPP;
u64 src_need = src_base + (u64)rh * src_stride;
if (src_need > r->backing_len) {
/* partial: clamp rows to what the backing covers */
u64 avail_rows = (r->backing_len > offset) ? (r->backing_len - offset) / src_stride : 0;
if (ry >= avail_rows) return;
if (ry + rh > avail_rows) rh = (u32)(avail_rows - ry);
if (rh == 0) return;
}
for (u32 row = 0; row < rh; row++) {
u8 *s = src + (u64)(ry + row) * src_stride + (u64)rx * VGPU_BPP;
u8 *d = dst + (u64)(dy + row) * dst_stride + (u64)dx * VGPU_BPP;
/* word-copy 4-byte pixels */
u32 n = copy_bytes / 4;
u32 *sp = (u32 *)s;
u32 *dp = (u32 *)d;
for (u32 i = 0; i < n; i++) dp[i] = sp[i];
/* trailing bytes (shouldn't happen for 32bpp) */
for (u32 i = n * 4; i < copy_bytes; i++) d[i] = s[i];
}
}
static u32 handle_transfer_to_host_2d(struct virtio_gpu_transfer_to_host_2d *cmd) {
if (!cmd) return VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
struct vgpu_resource *r = res_find(cmd->resource_id);
if (!r) return VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
composite_rect(r, &cmd->r, cmd->offset);
return VIRTIO_GPU_RESP_OK_NODATA;
}
static u32 handle_resource_flush(struct virtio_gpu_resource_flush *cmd) {
if (!cmd) return VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
/* mark scanout dirty so the desktop re-blits. We only flushed the scanout
* resource (composite_rect already copied it on TRANSFER). */
if (g_gpu.scanout_enabled && g_gpu.scanout_res_id == cmd->resource_id) {
g_gpu.dirty = 1;
/* Phase 7: 把 flush rect（resource 坐标系）并入累积 dirty rect
* （scanout 坐标系并集），desktop 据此只 blit 变化区域。
* 钳制规则与 composite_rect 一致。 */
u32 rx = cmd->r.x, ry = cmd->r.y, rw = cmd->r.width, rh = cmd->r.height;
u32 dx = g_gpu.scanout_x + rx;
u32 dy = g_gpu.scanout_y + ry;
if (dx < VGPU_SCANOUT_W && dy < VGPU_SCANOUT_H && rw > 0 && rh > 0) {
if (dx + rw > VGPU_SCANOUT_W) rw = VGPU_SCANOUT_W - dx;
if (dy + rh > VGPU_SCANOUT_H) rh = VGPU_SCANOUT_H - dy;
if (!g_gpu.dirty_rect_valid) {
g_gpu.dirty_rx = dx; g_gpu.dirty_ry = dy;
g_gpu.dirty_rw = rw; g_gpu.dirty_rh = rh;
g_gpu.dirty_rect_valid = 1;
} else {
/* 并集：expand 到同时包含旧矩形与新矩形 */
u32 x0 = (dx < g_gpu.dirty_rx) ? dx : g_gpu.dirty_rx;
u32 y0 = (dy < g_gpu.dirty_ry) ? dy : g_gpu.dirty_ry;
u32 x1 = ((dx + rw) > (g_gpu.dirty_rx + g_gpu.dirty_rw))
? (dx + rw) : (g_gpu.dirty_rx + g_gpu.dirty_rw);
u32 y1 = ((dy + rh) > (g_gpu.dirty_ry + g_gpu.dirty_rh))
? (dy + rh) : (g_gpu.dirty_ry + g_gpu.dirty_rh);
g_gpu.dirty_rx = x0; g_gpu.dirty_ry = y0;
g_gpu.dirty_rw = x1 - x0; g_gpu.dirty_rh = y1 - y0;
}
}
}
return VIRTIO_GPU_RESP_OK_NODATA;
}
/* ===== ctrlq processing ===== */
static void gpu_ctrlq_process(void) {
struct virtq_desc *desc;
struct virtq_avail *avail;
struct virtq_used *used;
u32 qnum;
if (virtio_queue_get_ptrs_by_gpa(g_gpu.gpa_base, 0,
&desc, &avail, &used, &qnum) != 0)
return;
u16 cur = g_gpu.last_avail_ctrl;
u16 used_idx = used->idx;
int budget = 32; /* bound work per notify */
int filled = 0;
while (budget-- > 0 && cur != avail->idx) {
u16 head = avail->ring[cur % qnum];
if (head >= qnum) { cur++; continue; }
struct chain_bufs cb;
if (walk_chain(desc, qnum, head, &cb) != 0) {
/* bad chain: return it empty so the driver recycles */
used->ring[used_idx % qnum].id = head;
used->ring[used_idx % qnum].len = 0;
used_idx++; cur++; filled++;
continue;
}
struct virtio_gpu_ctrl_hdr *hdr = (struct virtio_gpu_ctrl_hdr *)cb.cmd;
u32 resp_type = VIRTIO_GPU_RESP_ERR_UNSPEC;
u32 resp_len = (u32)sizeof(struct virtio_gpu_ctrl_hdr); /* default NODATA */
if (cb.cmd_len < (u32)sizeof(struct virtio_gpu_ctrl_hdr)) {
resp_type = VIRTIO_GPU_RESP_ERR_UNSPEC;
} else {
u32 t = hdr->type;
switch (t) {
case VIRTIO_GPU_CMD_GET_NUM_SCANOUTS:
if (cb.resp && cb.resp_len >= (u32)sizeof(struct virtio_gpu_resp_num_scanouts)) {
struct virtio_gpu_resp_num_scanouts *rn =
(struct virtio_gpu_resp_num_scanouts *)cb.resp;
rn->hdr.type = VIRTIO_GPU_RESP_OK_NODATA;
rn->hdr.flags = 0; rn->hdr.fence_id = 0;
rn->hdr.ctx_id = 0; rn->hdr.padding = 0;
rn->num_scanouts = 1;
rn->padding = 0;
resp_type = VIRTIO_GPU_RESP_OK_NODATA;
resp_len = (u32)sizeof(struct virtio_gpu_resp_num_scanouts);
} else {
resp_type = VIRTIO_GPU_RESP_ERR_UNSPEC;
}
break;
case VIRTIO_GPU_CMD_GET_DISPLAY_INFO:
resp_type = handle_get_display_info(cb.resp, cb.resp_len);
if (resp_type == VIRTIO_GPU_RESP_OK_DISPLAY_INFO)
resp_len = (u32)sizeof(struct virtio_gpu_resp_display_info);
break;
case VIRTIO_GPU_CMD_RESOURCE_CREATE_2D:
if (cb.cmd_len >= (u32)sizeof(struct virtio_gpu_resource_create_2d))
resp_type = handle_resource_create_2d(
(struct virtio_gpu_resource_create_2d *)cb.cmd);
else
resp_type = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
break;
case VIRTIO_GPU_CMD_RESOURCE_DESTROY: {
/* DESTROY has just hdr + resource_id after */
u32 rid = 0;
if (cb.cmd_len >= (u32)sizeof(struct virtio_gpu_ctrl_hdr) + 4)
rid = *(u32 *)((u8 *)cb.cmd + sizeof(struct virtio_gpu_ctrl_hdr));
resp_type = handle_resource_destroy(rid);
break;
}
case VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING:
if (cb.cmd_len >= (u32)sizeof(struct virtio_gpu_resource_attach_backing))
resp_type = handle_attach_backing(
(struct virtio_gpu_resource_attach_backing *)cb.cmd, cb.cmd_len);
else
resp_type = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
break;
case VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING: {
u32 rid = 0;
if (cb.cmd_len >= (u32)sizeof(struct virtio_gpu_ctrl_hdr) + 4)
rid = *(u32 *)((u8 *)cb.cmd + sizeof(struct virtio_gpu_ctrl_hdr));
resp_type = handle_detach_backing(rid);
break;
}
case VIRTIO_GPU_CMD_SET_SCANOUT:
if (cb.cmd_len >= (u32)sizeof(struct virtio_gpu_set_scanout))
resp_type = handle_set_scanout(
(struct virtio_gpu_set_scanout *)cb.cmd);
else
resp_type = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
break;
case VIRTIO_GPU_CMD_TRANSFER_TO_HOST_2D:
if (cb.cmd_len >= (u32)sizeof(struct virtio_gpu_transfer_to_host_2d))
resp_type = handle_transfer_to_host_2d(
(struct virtio_gpu_transfer_to_host_2d *)cb.cmd);
else
resp_type = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
break;
case VIRTIO_GPU_CMD_RESOURCE_FLUSH:
if (cb.cmd_len >= (u32)sizeof(struct virtio_gpu_resource_flush))
resp_type = handle_resource_flush(
(struct virtio_gpu_resource_flush *)cb.cmd);
else
resp_type = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
break;
default:
/* unknown / 3D / cursor commands on ctrlq: ack NODATA */
resp_type = VIRTIO_GPU_RESP_OK_NODATA;
break;
}
}
/* write the response (unless GET_* already wrote a richer response) */
if (resp_type != VIRTIO_GPU_RESP_OK_DISPLAY_INFO &&
resp_type != VIRTIO_GPU_RESP_OK_NODATA) {
/* error: write NODATA with error type if we haven't already */
if (hdr->type != VIRTIO_GPU_CMD_GET_NUM_SCANOUTS)
write_resp_nodata(cb.resp, cb.resp_len, hdr->type, resp_type);
resp_len = (u32)sizeof(struct virtio_gpu_ctrl_hdr);
} else if (resp_type == VIRTIO_GPU_RESP_OK_NODATA &&
hdr->type != VIRTIO_GPU_CMD_GET_NUM_SCANOUTS &&
hdr->type != VIRTIO_GPU_CMD_GET_DISPLAY_INFO) {
/* plain NODATA success: write header */
write_resp_nodata(cb.resp, cb.resp_len, hdr->type, resp_type);
resp_len = (u32)sizeof(struct virtio_gpu_ctrl_hdr);
}
/* fence ack: if the command requested a fence, echo fence_id in resp */
if ((hdr->flags & VIRTIO_GPU_FLAG_FENCE) && cb.resp &&
cb.resp_len >= (u32)sizeof(struct virtio_gpu_ctrl_hdr)) {
struct virtio_gpu_ctrl_hdr *rh = (struct virtio_gpu_ctrl_hdr *)cb.resp;
rh->flags |= VIRTIO_GPU_FLAG_FENCE;
rh->fence_id = hdr->fence_id;
}
used->ring[used_idx % qnum].id = head;
used->ring[used_idx % qnum].len = resp_len;
used_idx++; cur++; filled++;
}
if (filled > 0) {
virtio_queue_bump_used(used, used_idx);
g_gpu.last_avail_ctrl = cur;
virtio_mmio_raise_irq_by_gpa(g_gpu.gpa_base);
}
}
/* P7.6: cursorq - process UPDATE_CURSOR / MOVE_CURSOR.
* UPDATE_CURSOR: if resource_id != 0, copy cursor image from resource backing
* (up to 64x64 ARGB). If resource_id == 0, hide cursor.
* MOVE_CURSOR: update cursor position on scanout. */
static void gpu_cursorq_process(void) {
struct virtq_desc *desc;
struct virtq_avail *avail;
struct virtq_used *used;
u32 qnum;
if (virtio_queue_get_ptrs_by_gpa(g_gpu.gpa_base, 1,
&desc, &avail, &used, &qnum) != 0)
return;
u16 cur = g_gpu.last_avail_cursor;
u16 used_idx = used->idx;
int budget = 16;
int filled = 0;
while (budget-- > 0 && cur != avail->idx) {
u16 head = avail->ring[cur % qnum];
if (head >= qnum) { cur++; continue; }
struct chain_bufs cb;
if (walk_chain(desc, qnum, head, &cb) == 0 && cb.cmd && cb.resp) {
struct virtio_gpu_ctrl_hdr *hdr = (struct virtio_gpu_ctrl_hdr *)cb.cmd;
if (cb.cmd_len >= (u32)sizeof(struct virtio_gpu_update_cursor)) {
struct virtio_gpu_update_cursor *cmd =
(struct virtio_gpu_update_cursor *)cb.cmd;
if (hdr->type == VIRTIO_GPU_CMD_UPDATE_CURSOR) {
u32 rid = cmd->resource_id;
g_gpu.cursor_x = cmd->pos.x;
g_gpu.cursor_y = cmd->pos.y;
g_gpu.cursor_hot_x = cmd->hot_x;
g_gpu.cursor_hot_y = cmd->hot_y;
if (rid != 0) {
struct vgpu_resource *r = res_find(rid);
if (r && r->has_backing && r->width > 0 && r->height > 0) {
void *host = virtio_gpa_to_host(r->backing_gpa);
if (host) {
int cw = (int)r->width;
int ch = (int)r->height;
if (cw > VGPU_CURSOR_MAX) cw = VGPU_CURSOR_MAX;
if (ch > VGPU_CURSOR_MAX) ch = VGPU_CURSOR_MAX;
u32 *src = (u32 *)host;
for (int row = 0; row < ch; row++) {
for (int col = 0; col < cw; col++) {
g_gpu.cursor_bitmap[row * VGPU_CURSOR_MAX + col] =
src[row * (int)r->width + col];
}
}
g_gpu.cursor_w = (u32)cw;
g_gpu.cursor_h = (u32)ch;
g_gpu.cursor_visible = 1;
} else {
/* backing GPA unmapped: still show at pos, no image */
g_gpu.cursor_visible = 0;
}
} else {
g_gpu.cursor_visible = 0;
}
} else {
/* resource_id == 0: hide cursor */
g_gpu.cursor_visible = 0;
}
} else if (hdr->type == VIRTIO_GPU_CMD_MOVE_CURSOR) {
g_gpu.cursor_x = cmd->pos.x;
g_gpu.cursor_y = cmd->pos.y;
/* MOVE_CURSOR does not change visibility or image */
}
}
write_resp_nodata(cb.resp, cb.resp_len, hdr->type, VIRTIO_GPU_RESP_OK_NODATA);
}
used->ring[used_idx % qnum].id = head;
used->ring[used_idx % qnum].len = (u32)sizeof(struct virtio_gpu_ctrl_hdr);
used_idx++; cur++; filled++;
}
if (filled > 0) {
virtio_queue_bump_used(used, used_idx);
g_gpu.last_avail_cursor = cur;
virtio_mmio_raise_irq_by_gpa(g_gpu.gpa_base);
}
}
/* ===== virtio_backend interface ===== */
static u32 gpu_read_config(u32 offset, int width) {
/* config space is 16 bytes, little-endian u32 fields. Guest reads u32. */
if (width != 4) return 0;
if (offset >= (u32)sizeof(struct virtio_gpu_config)) return 0;
const u8 *p = (const u8 *)&g_gpu.cfg;
u32 v;
v = (u32)p[offset] | ((u32)p[offset+1] << 8) |
((u32)p[offset+2] << 16) | ((u32)p[offset+3] << 24);
return v;
}
static void gpu_write_config(u32 offset, u32 value) {
/* events_clear: writing a bit clears it in events_read. We have no events,
* so this is effectively a no-op, but honor the w1c semantics. */
if (offset == 4) { /* events_clear */
g_gpu.cfg.events_read &= ~value;
}
(void)offset;
}
static void gpu_queue_notify(u32 queue_idx) {
if (queue_idx == 0) {
gpu_ctrlq_process();
} else if (queue_idx == 1) {
gpu_cursorq_process();
}
}
static void gpu_reset(void) {
g_gpu.cfg.events_read = 0;
g_gpu.cfg.events_clear = 0;
g_gpu.cfg.num_scanouts = 1;
g_gpu.cfg.num_capsets = 0;
g_gpu.scanout_enabled = 0;
g_gpu.scanout_res_id = 0;
g_gpu.scanout_w = 0; g_gpu.scanout_h = 0;
g_gpu.dirty = 0;
g_gpu.dirty_rect_valid = 0;
g_gpu.dirty_rx = 0; g_gpu.dirty_ry = 0;
g_gpu.dirty_rw = 0; g_gpu.dirty_rh = 0;
g_gpu.cursor_visible = 0;
g_gpu.cursor_x = 0; g_gpu.cursor_y = 0;
g_gpu.cursor_hot_x = 0; g_gpu.cursor_hot_y = 0;
g_gpu.cursor_w = 0; g_gpu.cursor_h = 0;
g_gpu.last_avail_ctrl = 0;
g_gpu.last_avail_cursor = 0;
for (int i = 0; i < VGPU_MAX_RESOURCES; i++) res_release(&g_gpu.res[i]);
}
static struct virtio_backend g_gpu_backend = {
.device_id = VIRTIO_ID_GPU,
.gpa_base = VIRTIO_MMIO_GPU_GPA,
.irq = 10, /* cmdline :10, vector 0x3A */
.num_queues = 2, /* ctrlq + cursorq */
.queue_size = 64,
.device_features = (1ULL << VIRTIO_F_VERSION_1),
.config_len = (u32)sizeof(struct virtio_gpu_config),
.read_config = gpu_read_config,
.write_config = gpu_write_config,
.queue_notify = gpu_queue_notify,
.reset = gpu_reset,
};
/* ===== public API ===== */
int virtio_gpu_get_scanout_info(struct virtio_gpu_scanout_info *out) {
if (!out) return -1;
if (!surface_ready()) {
out->host_vaddr = 0;
out->width = 0; out->height = 0; out->stride = 0;
out->dirty = 0; out->enabled = 0;
out->dirty_x = 0; out->dirty_y = 0;
out->dirty_w = 0; out->dirty_h = 0;
out->cursor_visible = 0; out->cursor_x = 0; out->cursor_y = 0;
out->cursor_hot_x = 0; out->cursor_hot_y = 0;
out->cursor_w = 0; out->cursor_h = 0; out->cursor_bitmap = 0;
return -1;
}
out->host_vaddr = g_gpu.surface_vaddr;
out->width = VGPU_SCANOUT_W;
out->height = VGPU_SCANOUT_H;
out->stride = VGPU_SCANOUT_STRIDE;
out->enabled = (u32)g_gpu.scanout_enabled;
out->dirty = (u32)g_gpu.dirty;
/* Phase 7: 输出累积 dirty rect（查询一并清零）。
* dirty=1 但 rect 无效（理论不出现）时给全帧矩形兜底。 */
if (g_gpu.dirty && g_gpu.dirty_rect_valid) {
out->dirty_x = g_gpu.dirty_rx;
out->dirty_y = g_gpu.dirty_ry;
out->dirty_w = g_gpu.dirty_rw;
out->dirty_h = g_gpu.dirty_rh;
} else if (g_gpu.dirty) {
out->dirty_x = 0; out->dirty_y = 0;
out->dirty_w = VGPU_SCANOUT_W; out->dirty_h = VGPU_SCANOUT_H;
} else {
out->dirty_x = 0; out->dirty_y = 0;
out->dirty_w = 0; out->dirty_h = 0;
}
g_gpu.dirty = 0; /* query consumes the dirty flag */
g_gpu.dirty_rect_valid = 0;
g_gpu.dirty_rw = 0; g_gpu.dirty_rh = 0;
/* P7.6: cursor state (not consumed by query - desktop reads every frame) */
out->cursor_visible = (u32)g_gpu.cursor_visible;
out->cursor_x = g_gpu.cursor_x;
out->cursor_y = g_gpu.cursor_y;
out->cursor_hot_x = g_gpu.cursor_hot_x;
out->cursor_hot_y = g_gpu.cursor_hot_y;
out->cursor_w = g_gpu.cursor_w;
out->cursor_h = g_gpu.cursor_h;
out->cursor_bitmap = g_gpu.cursor_visible ? g_gpu.cursor_bitmap : 0;
return 0;
}
void virtio_gpu_backend_init(void) {
g_gpu.gpa_base = VIRTIO_MMIO_GPU_GPA;
g_gpu.irq = 10;
gpu_reset(); /* sets cfg + clears resource table */
/* Bind the surface pool as the scanout shadow buffer. */
g_gpu.surface_vaddr = linux_get_surface_vaddr();
u64 hpa = 0, gpa = 0, size = 0;
if (linux_get_surface_info(&hpa, &gpa, &size) == 0) {
g_gpu.surface_size = size;
} else {
g_gpu.surface_size = 0;
}
if (!surface_ready()) {
log_warn("[VGPU] surface pool unavailable — scanout disabled");
} else {
log_info("[VGPU] virtio-gpu 2D backend ready (1024x768 XRGB8888)");
}
virtio_mmio_register(&g_gpu_backend);
}
CODE/UTSM/vmm/virtio_gpu.d
+6
View File
@@ -0,0 +1,6 @@
vmm/virtio_gpu.o: vmm\virtio_gpu.c include\utsm\virtio_mmio.h \
include\utsm\types.h include\utsm\linux_loader.h include\utsm\log.h
include\utsm\virtio_mmio.h:
include\utsm\types.h:
include\utsm\linux_loader.h:
include\utsm\log.h:
CODE/UTSM/vmm/virtio_input.c
+392
View File
@@ -0,0 +1,392 @@
/* virtio_input.c — UTSM virtio-input backend (keyboard + mouse).
*
* VSCode integration Phase 2: forward Deshab desktop input events to the
* Linux guest via two virtio-input devices (device_id=18):
* slot 3 @ 0xF4003000 IRQ8 — keyboard (evdev /dev/input/event0)
* slot 4 @ 0xF4004000 IRQ9 — mouse (evdev /dev/input/event1)
*
* Data flow:
* 1. Deshab desktop (DSK) calls virtio_input_push_keyboard/push_mouse_* on
* a PS/2 scancode / mouse packet. The event lands in a pending ring.
* 2. vmexit_before_resume() calls virtio_input_poll() every ~1ms.
* 3. poll drains pending events into guest eventq buffers the driver posted
* (device→driver direction), bumps the used ring, and raises IRQ8/IRQ9.
* 4. Linux evdev delivers the events to userspace (Xorg/libinput).
*
* The statusq (queue 1, driver→device) is consumed but ignored — we only
* acknowledge status events (e.g. keyboard LED state) with len=0.
*
* Config space implements the select/subsel state machine per virtio-input
* spec: driver writes select+subsel, then reads the 128-byte payload.
*/
#include <utsm/virtio_mmio.h>
#include <utsm/linux_loader.h>
#include <utsm/log.h>
#include <utsm/types.h>
/* ===== Config space layout (virtio-input spec §5) =====
* [0] select — which config item
* [1] subsel — sub-selector (e.g. event type for EV_BITS)
* [2] size — valid payload bytes (0..128)
* [3..7] reserved
* [8..135] payload (string or bitmap) */
#define VIO_CFG_LEN 136
#define VIO_CFG_PAYLOAD 128
/* select values (virtio_input_config select field) */
#define VIO_CFG_ID_NAME 1
#define VIO_CFG_ID_SERIAL 2
#define VIO_CFG_ID_DEVIDS 3
#define VIO_CFG_PROP_BITS 4
#define VIO_CFG_EV_BITS 5
/* Pending event ring depth. 256 events is generous headroom over the
* ~1kHz poll rate — if the guest hasn't posted eventq buffers for 256ms
* of input, events start dropping (oldest first). */
#define VIO_PEND_MAX 256
struct virtio_input_dev {
u64 gpa_base;
u32 irq;
const char *name;
/* Config select/subsel state (written by guest, read back as payload) */
u8 cfg_select;
u8 cfg_subsel;
u8 cfg_buf[VIO_CFG_LEN];
/* Pending event ring (SPSC): push_* produces, poll consumes.
* No lock — UTSM is cooperative: push runs in DSK context (guest
* parked), poll runs in vmexit_before_resume (just before resume).
* They never execute concurrently. */
struct virtio_input_event pending[VIO_PEND_MAX];
u32 pend_head;
u32 pend_tail;
u32 pend_count;
/* Per-queue avail cursor (last processed avail->idx). */
u16 last_avail_event;
u16 last_avail_status;
struct virtio_backend backend;
};
static struct virtio_input_dev g_kbd;
static struct virtio_input_dev g_mouse;
/* ===== Config space rebuild =====
* Called whenever the guest writes select/subsel. Fills cfg_buf with the
* full 136-byte config image (select, subsel, size, reserved, payload). */
static void input_rebuild_cfg(struct virtio_input_dev *dev) {
u8 *buf = dev->cfg_buf;
buf[0] = dev->cfg_select;
buf[1] = dev->cfg_subsel;
buf[2] = 0; /* size, set below */
for (int i = 3; i < 8; i++) buf[i] = 0;
u8 *payload = buf + 8;
for (int i = 0; i < VIO_CFG_PAYLOAD; i++) payload[i] = 0;
u8 size = 0;
switch (dev->cfg_select) {
case VIO_CFG_ID_NAME: {
const char *s = dev->name;
u32 i = 0;
while (s[i] && i < VIO_CFG_PAYLOAD) { payload[i] = (u8)s[i]; i++; }
size = (u8)i;
break;
}
case VIO_CFG_ID_SERIAL:
size = 0; /* no serial */
break;
case VIO_CFG_ID_DEVIDS: {
/* Bitmap of supported event types (bit N = EV_TYPE N).
* keyboard: EV_KEY only; mouse: EV_KEY + EV_REL. */
payload[VIO_INPUT_EV_KEY / 8] |= (u8)(1u << (VIO_INPUT_EV_KEY % 8));
if (dev == &g_mouse) {
payload[VIO_INPUT_EV_REL / 8] |= (u8)(1u << (VIO_INPUT_EV_REL % 8));
}
u32 max_ev = (dev == &g_mouse) ? VIO_INPUT_EV_REL : VIO_INPUT_EV_KEY;
size = (u8)(max_ev / 8 + 1);
break;
}
case VIO_CFG_PROP_BITS:
size = 0;
break;
case VIO_CFG_EV_BITS: {
/* subsel = event type; payload = bitmap of supported event codes. */
u16 ev = dev->cfg_subsel;
if (dev == &g_kbd && ev == VIO_INPUT_EV_KEY) {
/* Keyboard: advertise keys 1..248 (ESCAPE..KEY_WWW). The driver
* enumerates all set bits; only forwarded keys will ever arrive. */
for (u32 i = 1; i <= 248; i++) {
payload[i / 8] |= (u8)(1u << (i % 8));
}
size = 32; /* 256 bits = 32 bytes */
} else if (dev == &g_mouse) {
if (ev == VIO_INPUT_EV_KEY) {
payload[VIO_INPUT_BTN_LEFT / 8] |= (u8)(1u << (VIO_INPUT_BTN_LEFT % 8));
payload[VIO_INPUT_BTN_RIGHT / 8] |= (u8)(1u << (VIO_INPUT_BTN_RIGHT % 8));
payload[VIO_INPUT_BTN_MIDDLE / 8] |= (u8)(1u << (VIO_INPUT_BTN_MIDDLE % 8));
size = (u8)(VIO_INPUT_BTN_MIDDLE / 8 + 1);
} else if (ev == VIO_INPUT_EV_REL) {
payload[VIO_INPUT_REL_X / 8] |= (u8)(1u << (VIO_INPUT_REL_X % 8));
payload[VIO_INPUT_REL_Y / 8] |= (u8)(1u << (VIO_INPUT_REL_Y % 8));
size = 1;
}
}
break;
}
default:
size = 0;
break;
}
buf[2] = size;
}
/* Read width bytes from the config buffer at offset (little-endian u32). */
static u32 input_read_config_at(struct virtio_input_dev *dev, u32 offset, int width) {
if (offset >= VIO_CFG_LEN) return 0;
u32 val = 0;
for (int i = 0; i < width && offset + i < VIO_CFG_LEN; i++) {
val |= (u32)dev->cfg_buf[offset + i] << (8 * i);
}
return val;
}
/* ===== Per-device thin wrappers (backend callbacks have no ctx) ===== */
static u32 kbd_read_config(u32 offset, int width) { return input_read_config_at(&g_kbd, offset, width); }
static u32 mouse_read_config(u32 offset, int width) { return input_read_config_at(&g_mouse, offset, width); }
static void kbd_write_config(u32 offset, u32 value) {
if (offset == 0) { g_kbd.cfg_select = (u8)value; input_rebuild_cfg(&g_kbd); }
else if (offset == 1) { g_kbd.cfg_subsel = (u8)value; input_rebuild_cfg(&g_kbd); }
}
static void mouse_write_config(u32 offset, u32 value) {
if (offset == 0) { g_mouse.cfg_select = (u8)value; input_rebuild_cfg(&g_mouse); }
else if (offset == 1) { g_mouse.cfg_subsel = (u8)value; input_rebuild_cfg(&g_mouse); }
}
static void input_reset_dev(struct virtio_input_dev *dev) {
dev->cfg_select = 0;
dev->cfg_subsel = 0;
dev->pend_head = 0;
dev->pend_tail = 0;
dev->pend_count = 0;
dev->last_avail_event = 0;
dev->last_avail_status = 0;
input_rebuild_cfg(dev);
}
static void kbd_reset(void) { input_reset_dev(&g_kbd); }
static void mouse_reset(void) { input_reset_dev(&g_mouse); }
/* ===== Eventq drain (device → driver) =====
* Walk the eventq avail ring: for each empty buffer the driver posted, pop
* one pending event, write it into the buffer, complete the used entry.
* Returns the number of buffers filled. */
static int input_drain_eventq(struct virtio_input_dev *dev) {
struct virtq_desc *desc;
struct virtq_avail *avail;
struct virtq_used *used;
u32 qnum;
if (virtio_queue_get_ptrs_by_gpa(dev->gpa_base, 0, &desc, &avail, &used, &qnum) != 0)
return 0;
int filled = 0;
u16 cur = dev->last_avail_event;
u16 used_idx = used->idx;
int budget = 32; /* cap per poll to bound vmexit latency */
while (budget-- > 0 && dev->pend_count > 0) {
if (cur == avail->idx) break; /* no empty buffers posted */
u16 head = avail->ring[cur % qnum];
if (head >= qnum) { cur++; continue; } /* bad index, skip */
struct virtq_desc *d = &desc[head];
struct virtio_input_event *buf = (struct virtio_input_event *)virtio_gpa_to_host(d->addr);
if (!buf || d->len < (u32)sizeof(struct virtio_input_event)) {
/* buffer too small or unmapped: return it empty so guest recycles */
used->ring[used_idx % qnum].id = head;
used->ring[used_idx % qnum].len = 0;
used_idx++;
cur++;
filled++;
continue;
}
/* Pop one pending event into the guest buffer */
u32 idx = dev->pend_tail;
buf->type = dev->pending[idx].type;
buf->code = dev->pending[idx].code;
buf->value = dev->pending[idx].value;
dev->pend_tail = (idx + 1) % VIO_PEND_MAX;
dev->pend_count--;
used->ring[used_idx % qnum].id = head;
used->ring[used_idx % qnum].len = sizeof(struct virtio_input_event);
used_idx++;
cur++;
filled++;
}
if (filled > 0) {
virtio_queue_bump_used(used, used_idx);
dev->last_avail_event = cur;
}
return filled;
}
/* ===== Statusq drain (driver → device) =====
* The driver occasionally posts status events (e.g. keyboard LED state).
* We don't act on them — just complete the buffers with len=0 so the driver
* can recycle them and the avail ring doesn't fill up. */
static int input_drain_statusq(struct virtio_input_dev *dev) {
struct virtq_desc *desc;
struct virtq_avail *avail;
struct virtq_used *used;
u32 qnum;
if (virtio_queue_get_ptrs_by_gpa(dev->gpa_base, 1, &desc, &avail, &used, &qnum) != 0)
return 0;
int filled = 0;
u16 cur = dev->last_avail_status;
u16 used_idx = used->idx;
int budget = 8;
while (budget-- > 0 && cur != avail->idx) {
u16 head = avail->ring[cur % qnum];
if (head < qnum) {
used->ring[used_idx % qnum].id = head;
used->ring[used_idx % qnum].len = 0;
used_idx++;
filled++;
}
cur++;
}
if (filled > 0) {
virtio_queue_bump_used(used, used_idx);
dev->last_avail_status = cur;
}
return filled;
}
/* ===== Backend queue_notify callbacks =====
* eventq notify (queue 0): the driver just posted empty buffers — try to
* drain pending events now. IRQ is raised by the framework after notify.
* statusq notify (queue 1): the driver sent a status event — consume it. */
static void kbd_queue_notify(u32 queue_idx) {
if (queue_idx == 0) {
if (input_drain_eventq(&g_kbd) > 0)
virtio_mmio_raise_irq_by_gpa(g_kbd.gpa_base);
} else if (queue_idx == 1) {
input_drain_statusq(&g_kbd);
}
}
static void mouse_queue_notify(u32 queue_idx) {
if (queue_idx == 0) {
if (input_drain_eventq(&g_mouse) > 0)
virtio_mmio_raise_irq_by_gpa(g_mouse.gpa_base);
} else if (queue_idx == 1) {
input_drain_statusq(&g_mouse);
}
}
/* ===== Pending event push API (called by DSK / desktop input forwarding) ===== */
static void input_push(struct virtio_input_dev *dev, u16 type, u16 code, u32 value) {
if (dev->pend_count >= VIO_PEND_MAX) {
/* Ring full: drop the oldest event to make room for the newest.
* Dropping old (not new) preserves the most recent input state,
* which is what matters for interactive feel. */
dev->pend_tail = (dev->pend_tail + 1) % VIO_PEND_MAX;
dev->pend_count--;
}
u32 idx = dev->pend_head;
dev->pending[idx].type = type;
dev->pending[idx].code = code;
dev->pending[idx].value = value;
dev->pend_head = (idx + 1) % VIO_PEND_MAX;
dev->pend_count++;
}
void virtio_input_push_keyboard(u16 code, u32 value) {
/* code = linux keycode (KEY_A..), value = 0=release, 1=press, 2=repeat */
input_push(&g_kbd, VIO_INPUT_EV_KEY, code, value);
}
void virtio_input_push_mouse_rel(u16 axis, i32 value) {
/* axis = VIO_INPUT_REL_X or VIO_INPUT_REL_Y */
input_push(&g_mouse, VIO_INPUT_EV_REL, axis, (u32)value);
}
void virtio_input_push_mouse_button(u16 btn, u32 value) {
/* btn = VIO_INPUT_BTN_LEFT/RIGHT/MIDDLE, value = 0=release, 1=press */
input_push(&g_mouse, VIO_INPUT_EV_KEY, btn, value);
}
void virtio_input_push_mouse_syn(void) {
/* SYN_REPORT marks the end of a logical input frame (e.g. a complete
* mouse movement + button change). libinput relies on this to deliver
* a single consolidated event to clients. */
input_push(&g_mouse, VIO_INPUT_EV_SYN, 0, 0);
}
/* ===== Periodic poll (called from vmexit_before_resume) ===== */
void virtio_input_poll(void) {
int kbd_filled = input_drain_eventq(&g_kbd);
int mouse_filled = input_drain_eventq(&g_mouse);
if (kbd_filled > 0) virtio_mmio_raise_irq_by_gpa(g_kbd.gpa_base);
if (mouse_filled > 0) virtio_mmio_raise_irq_by_gpa(g_mouse.gpa_base);
}
/* ===== Backend init ===== */
static struct virtio_backend g_kbd_backend = {
.device_id = VIRTIO_ID_INPUT,
.gpa_base = VIRTIO_MMIO_KBD_GPA,
.irq = 8, /* cmdline :8, vector 0x38 */
.num_queues = 2, /* eventq + statusq */
.queue_size = 64,
.device_features = (1ULL << VIRTIO_F_VERSION_1),
.config_len = VIO_CFG_LEN,
.read_config = kbd_read_config,
.write_config = kbd_write_config,
.queue_notify = kbd_queue_notify,
.reset = kbd_reset,
};
static struct virtio_backend g_mouse_backend = {
.device_id = VIRTIO_ID_INPUT,
.gpa_base = VIRTIO_MMIO_MOUSE_GPA,
.irq = 9, /* cmdline :9, vector 0x39 */
.num_queues = 2,
.queue_size = 64,
.device_features = (1ULL << VIRTIO_F_VERSION_1),
.config_len = VIO_CFG_LEN,
.read_config = mouse_read_config,
.write_config = mouse_write_config,
.queue_notify = mouse_queue_notify,
.reset = mouse_reset,
};
void virtio_input_backend_init(void) {
g_kbd.gpa_base = VIRTIO_MMIO_KBD_GPA;
g_kbd.irq = 8;
g_kbd.name = "Deshab Virtual Keyboard";
input_reset_dev(&g_kbd);
g_mouse.gpa_base = VIRTIO_MMIO_MOUSE_GPA;
g_mouse.irq = 9;
g_mouse.name = "Deshab Virtual Mouse";
input_reset_dev(&g_mouse);
virtio_mmio_register(&g_kbd_backend);
virtio_mmio_register(&g_mouse_backend);
log_info("[VINPUT] keyboard + mouse backends registered");
}
CODE/UTSM/vmm/virtio_input.d
+6
View File
@@ -0,0 +1,6 @@
vmm/virtio_input.o: vmm\virtio_input.c include\utsm\virtio_mmio.h \
include\utsm\types.h include\utsm\linux_loader.h include\utsm\log.h
include\utsm\virtio_mmio.h:
include\utsm\types.h:
include\utsm\linux_loader.h:
include\utsm\log.h:
CODE/UTSM/vmm/virtio_mmio.c
+68 -4
View File
@@ -20,7 +20,8 @@ extern volatile struct limine_hhdm_request g_hhdm_request;
#define VIRTIO_MMIO_MAGIC 0x74726976 /* "virt" */
#define VIRTIO_MMIO_VERSION_MODERN 2
#define MAX_VIRTIO_DEVICES 4
/* VSCode Phase 1: 3 (blk/net/rootfs) → 8 slots for input/gpu/extra-rootfs. */
#define MAX_VIRTIO_DEVICES 8
/* 每个 virtio 设备的运行状态（框架层维护，后端无关） */
struct virtio_dev_state {
@@ -227,7 +228,13 @@ void virtio_mmio_write(u64 gpa, u64 value, int width) {
}
break;
default:
/* device config 空间写（多数设备 config 只读，忽略） */
/* VSCode Phase 2: device config 空间写。virtio-input 用此通道设置
* select/subsel 后再读结果；其它设备 config 只读（write_config=NULL）。 */
if (off >= VIRTIO_MMIO_CONFIG && off < VIRTIO_MMIO_CONFIG + s->be->config_len) {
if (s->be->write_config) {
s->be->write_config(off - VIRTIO_MMIO_CONFIG, v32);
}
}
break;
}
}
@@ -264,6 +271,35 @@ int virtio_queue_get_ptrs(u32 device_id, u32 queue_idx,
return 0;
}
/* VSCode Phase 2: 按 gpa_base 定位队列。用于两个 virtio-input（kbd+mouse），
* 它们 device_id 相同（VIRTIO_ID_INPUT=18），只能靠 gpa_base 区分。 */
int virtio_queue_get_ptrs_by_gpa(u64 gpa_base, u32 queue_idx,
struct virtq_desc **desc_out,
struct virtq_avail **avail_out,
struct virtq_used **used_out,
u32 *queue_num_out) {
struct virtio_dev_state *s = (struct virtio_dev_state *)0;
for (int i = 0; i < g_vdev_count; i++) {
if (g_vdevs[i].be && g_vdevs[i].be->gpa_base == gpa_base) {
s = &g_vdevs[i];
break;
}
}
if (!s || queue_idx >= 4) return -1;
if (!s->q[queue_idx].ready) return -2;
struct virtq_desc *desc = (struct virtq_desc *)virtio_gpa_to_host(s->q[queue_idx].desc_gpa);
struct virtq_avail *avail = (struct virtq_avail *)virtio_gpa_to_host(s->q[queue_idx].driver_gpa);
struct virtq_used *used = (struct virtq_used *)virtio_gpa_to_host(s->q[queue_idx].device_gpa);
if (!desc || !avail || !used) return -3;
if (desc_out) *desc_out = desc;
if (avail_out) *avail_out = avail;
if (used_out) *used_out = used;
if (queue_num_out) *queue_num_out = s->q[queue_idx].num ? s->q[queue_idx].num : s->be->queue_size;
return 0;
}
void virtio_queue_bump_used(struct virtq_used *used, u16 new_idx) {
if (!used) return;
__asm__ volatile("mfence" ::: "memory");
@@ -283,17 +319,34 @@ void virtio_mmio_raise_irq(u32 device_id) {
}
}
/* VSCode Phase 2: 按 gpa_base 触发中断（两个 virtio-input 同 device_id=18
* 但不同 gpa_base / irq，需要分别注入）。 */
void virtio_mmio_raise_irq_by_gpa(u64 gpa_base) {
for (int i = 0; i < g_vdev_count; i++) {
struct virtio_dev_state *s = &g_vdevs[i];
if (!s->be || s->be->gpa_base != gpa_base) continue;
s->interrupt_status |= 1;
if (s->be->irq != 0) {
vmx_guest_queue_irq(0x30 + s->be->irq);
}
return;
}
}
/* ===== 框架初始化 =====
*
* 注册 block 与 net 后端。后端结构体由 virtio_blk.c / virtio_net.c 提供。 */
extern struct virtio_backend g_virtio_blk_backend;
extern struct virtio_backend g_virtio_net_backend;
/* 后端初始化符号（定义于 virtio_blk.c / virtio_net.c）。
* 这里声明以便链接；具体注册在各自文件完成。 */
/* 后端初始化符号（定义于 virtio_blk.c / virtio_net.c / virtio_input.c /
* virtio_gpu.c）。这里声明以便链接；具体注册在各自文件完成。 */
void virtio_blk_backend_init(void);
void virtio_net_backend_init(void);
void virtio_rootfs_blk_init(void); /* memory-backed Arch rootfs (/dev/vdb) */
void virtio_input_backend_init(void); /* VSCode Phase 2: keyboard + mouse */
void virtio_gpu_backend_init(void); /* VSCode Phase 3: virtio-gpu 2D */
void virtio_extra_rootfs_blk_init(void); /* VSCode Phase 4: rw volume (/dev/vdc) */
void virtio_mmio_init(void) {
if (g_vio_ready) return;
@@ -305,6 +358,17 @@ void virtio_mmio_init(void) {
* Must come after blk/net so /dev/vda (SATA) and /dev/vdb (rootfs) order
* is deterministic. */
virtio_rootfs_blk_init();
/* VSCode Phase 2: virtio-input (keyboard + mouse). Safe no-op until the
* desktop enables input forwarding via the push_* API. */
virtio_input_backend_init();
/* VSCode Phase 3: virtio-gpu 2D (scanout compositing into surface pool).
* Safe no-op if the surface pool was not allocated (Linux guest not loaded
* or alloc failed) — scanout stays disabled. */
virtio_gpu_backend_init();
/* VSCode Phase 4: writable extra-rootfs volume (/dev/vdc, overlay upper).
* Safe no-op if no extra-rootfs boot module — guest probe sees bad magic
* on slot6 and skips it. */
virtio_extra_rootfs_blk_init();
g_vio_ready = 1;
log_info("[VIO] virtio-mmio backend init ok");
CODE/UTSM/vmm/vmexit.c
+6 -1
View File
@@ -60,12 +60,16 @@ static void log_exit_diagnostics(u64 reason, u64 qualification, u64 rip, u64 len
* - Linux guest：park（推进 RIP 越过 HLT，exit-to-host，设 g_guest_parked=1）
* host 调用 linux_resume() 时 vmresume 唤醒 guest 从 HLT 之后继续执行。 */
static int handle_hlt(u64 rip, u64 instr_len, int *out_resume) {
*out_resume = 0; /* 两种情况都 exit-to-host */
*out_resume = 0; /* 三种情况默认 exit-to-host */
if (g_linux_guest_active) {
/* Linux guest: park — 推进 RIP 越过 HLT 指令 */
vmx_vmcs_write(VMCS_GUEST_RIP, rip + instr_len);
g_guest_parked = 1;
log_info("[VMEXIT] HLT - Linux guest parked");
} else if (g_xj380_guest_active) {
/* OpenXJ380 guest: 推进 RIP 并立即继续执行（不 park 不 terminate） */
vmx_vmcs_write(VMCS_GUEST_RIP, rip + instr_len);
*out_resume = 1;
} else {
/* self-test guest: 终止 */
log_info("[VMEXIT] HLT - guest halted");
@@ -493,6 +497,7 @@ static void vmexit_before_resume(void) {
vmx_vmcs_write(VMCS_GUEST_PREEMPTION_TIMER, vmx_preemption_quantum_1ms());
poll_host_serial_to_guest();
virtio_net_poll();
virtio_input_poll(); /* VSCode Phase 2: drain pending kbd/mouse events */
pit_tick_update();
maybe_inject_irq();
}
CODE/UTSM/vmm/vmm.c
+173 -18
View File
@@ -85,6 +85,7 @@ static u8 g_msr_bitmap[4096] __attribute__((aligned(4096)));
* VMX 要求 guest TR 非空且引用 GDT 中的 TSS 描述符。 */
static u8 g_guest_gdt[4096] __attribute__((aligned(4096)));
static u8 g_guest_tss[4096] __attribute__((aligned(4096)));
static u8 g_guest_idt[4096] __attribute__((aligned(4096))); /* P8.4: IDT page for KVM nested VMX */
/* 64-bit GDT entry */
typedef struct __attribute__((packed)) {
@@ -234,10 +235,11 @@ static void vmcs_setup_host_state(void) {
}
static void vmcs_setup_guest_state_phase1(void) {
/* Guest CR0/CR3/CR4：启用 PE/NE/PG/PAE，复用 host 页表 */
/* Guest CR0/CR3/CR4：启用 PE/NE/PG/PAE，复用 host 页表。
* P8.4: CR4 must include VMXE (CR4_FIXED0 requires it under KVM). */
vmx_vmcs_write(VMCS_GUEST_CR0, CR0_PE | CR0_NE | CR0_PG | CR0_WP);
vmx_vmcs_write(VMCS_GUEST_CR3, read_cr3_local());
vmx_vmcs_write(VMCS_GUEST_CR4, CR4_PAE | CR4_PGE | CR4_PSE);
vmx_vmcs_write(VMCS_GUEST_CR4, CR4_VMXE | CR4_PAE | CR4_PGE | CR4_PSE);
/* 段选择子：flat 模型。
* CS=0x08 (GDT[1] code), DS/SS/ES=0x10 (GDT[2] data),
@@ -261,7 +263,9 @@ static void vmcs_setup_guest_state_phase1(void) {
vmx_vmcs_write(VMCS_GUEST_LDTR_BASE, 0);
vmx_vmcs_write(VMCS_GUEST_TR_BASE, 0x4000);
vmx_vmcs_write(VMCS_GUEST_GDTR_BASE, 0x3000);
vmx_vmcs_write(VMCS_GUEST_IDTR_BASE, 0);
/* P8.4: IDTR base must be non-zero & page-aligned for KVM nested VMX.
* Guest won't use interrupts (RFLAGS.IF=0), but VMX still checks. */
vmx_vmcs_write(VMCS_GUEST_IDTR_BASE, 0x5000);
/* 段 limit：代码/数据段 4GB，GDTR 覆盖 0x28 字节（3 个描述符 + TSS），
* TR limit = 0x67（104 字节最小 TSS） */
@@ -278,16 +282,17 @@ static void vmcs_setup_guest_state_phase1(void) {
/* 段 access rights：
* CS: 0xA09B = present, DPL0, code, L=1 (64-bit), executed/read
* DS/SS/ES/FS/GS: 0xC093 = present, DPL0, data, writable
* LDTR: 0x82 = unusable (L=0 in high nibble)
* DS/SS/ES: 0xC093 = present, DPL0, data, writable
* P8.4: FS/GS/LDTR selector=0 -> must set bit 16 (unusable) per Intel SDM.
* Without it, KVM nested VMX rejects VMLAUNCH (invalid guest state).
* TR: 0x8B = present, DPL0, 64-bit busy TSS */
vmx_vmcs_write(VMCS_GUEST_CS_ACCESS, 0xA09B);
vmx_vmcs_write(VMCS_GUEST_SS_ACCESS, 0xC093);
vmx_vmcs_write(VMCS_GUEST_DS_ACCESS, 0xC093);
vmx_vmcs_write(VMCS_GUEST_ES_ACCESS, 0xC093);
vmx_vmcs_write(VMCS_GUEST_FS_ACCESS, 0xC093);
vmx_vmcs_write(VMCS_GUEST_GS_ACCESS, 0xC093);
vmx_vmcs_write(VMCS_GUEST_LDTR_ACCESS, 0x82);
vmx_vmcs_write(VMCS_GUEST_FS_ACCESS, 0x1C093); /* unusable (selector=0) */
vmx_vmcs_write(VMCS_GUEST_GS_ACCESS, 0x1C093); /* unusable (selector=0) */
vmx_vmcs_write(VMCS_GUEST_LDTR_ACCESS, 0x10082); /* unusable (selector=0) */
vmx_vmcs_write(VMCS_GUEST_TR_ACCESS, 0x8B);
/* Guest RIP/RSP/RFLAGS */
@@ -308,6 +313,10 @@ static void vmcs_setup_guest_state_phase1(void) {
* NXE 允许 guest 使用 NX 位。 */
vmx_vmcs_write(VMCS_GUEST_IA32_EFER, EFER_LME | EFER_LMA | EFER_NXE);
/* P8.4: VMCS link pointer must be 0xFFFFFFFFFFFFFFFF (Intel SDM Vol 3,
* VM-entry checks). KVM nested VMX enforces this strictly. */
vmx_vmcs_write(VMCS_GUEST_LINK_POINTER, 0xFFFFFFFFFFFFFFFFULL);
/* Guest activity state = 0 (active) */
vmx_vmcs_write(VMCS_GUEST_ACTIVITY_STATE, 0);
/* Guest interruptibility = 0（无阻塞） */
@@ -325,14 +334,11 @@ static void vmcs_setup_controls(u64 eptp) {
| CPU_BASED_INVLPG_EXITING;
cpu = vmx_adjust_control(cpu, IA32_VMX_TRUE_PROCBASED_CTLS);
/* Secondary controls：启用 EPT + VPID */
u64 cpu2 = SEC_EXEC_ENABLE_EPT | SEC_EXEC_ENABLE_VPID;
{
u64 msr = vmx_read_msr(IA32_VMX_PROCBASED_CTLS2);
u32 allowed1 = (u32)(msr >> 32);
cpu2 &= allowed1;
cpu2 |= SEC_EXEC_ENABLE_EPT;
}
/* P8.4d: Try without EPT first to isolate nested VMX issue under KVM.
* If KVM requires EPT, vmx_adjust_control will OR it back in. */
u64 cpu2 = 0; /* no EPT, no VPID */
cpu2 = vmx_adjust_control(cpu2, IA32_VMX_PROCBASED_CTLS2);
log_hex64("[VMM] IA32_VMX_PROCBASED_CTLS2 raw=", vmx_read_msr(IA32_VMX_PROCBASED_CTLS2));
u64 exit_ctrl = VM_EXIT_SAVE_DEBUG_CONTROLS
| VM_EXIT_HOST_ADDR_SPACE_SIZE
@@ -357,8 +363,15 @@ static void vmcs_setup_controls(u64 eptp) {
vmx_vmcs_write(VMCS_MSR_BITMAP, msr_bitmap_phys);
}
vmx_vmcs_write(VMCS_EPT_POINTER, eptp);
vmx_vmcs_write(VMCS_VPID, 1);
if (cpu2 & SEC_EXEC_ENABLE_EPT) {
vmx_vmcs_write(VMCS_EPT_POINTER, eptp);
log_hex64("[VMM] EPT enabled, eptp=", eptp);
} else {
log_info("[VMM] EPT not available (shadow paging)");
}
if (cpu2 & SEC_EXEC_ENABLE_VPID) {
vmx_vmcs_write(VMCS_VPID, 1);
}
/* Exception bitmap：捕获 #GP(13)/#PF(14)/#UD(6) */
vmx_vmcs_write(VMCS_EXCEPTION_BITMAP, (1ULL << 13) | (1ULL << 14) | (1ULL << 6));
@@ -418,6 +431,90 @@ void vmm_shutdown(void) {
int vmm_is_ready(void) { return g_vmm_ready; }
u64 vmm_get_eptp(void) { return ept_get_eptp(); }
/* P8.4: Dump all guest-state VMCS fields for KVM nested VMX debugging.
* Called before VMLAUNCH to identify field encoding/value errors. */
static void vmm_dump_guest_state(void) {
log_info("[VMM] === Guest State Validation ===");
/* ---- CR / EFER ---- */
u64 g_cr0 = vmx_vmcs_read(VMCS_GUEST_CR0);
u64 g_cr3 = vmx_vmcs_read(VMCS_GUEST_CR3);
u64 g_cr4 = vmx_vmcs_read(VMCS_GUEST_CR4);
u64 g_efer = vmx_vmcs_read(VMCS_GUEST_IA32_EFER);
log_hex64("[VMM] gCR0=", g_cr0);
log_hex64("[VMM] gCR3=", g_cr3);
log_hex64("[VMM] gCR4=", g_cr4);
log_hex64("[VMM] gEFER=", g_efer);
/* ---- RIP/RSP/RFLAGS ---- */
log_hex64("[VMM] gRIP=", vmx_vmcs_read(VMCS_GUEST_RIP));
log_hex64("[VMM] gRSP=", vmx_vmcs_read(VMCS_GUEST_RSP));
log_hex64("[VMM] gRFLAGS=", vmx_vmcs_read(VMCS_GUEST_RFLAGS));
/* ---- Segment selectors ---- */
u64 es = vmx_vmcs_read(VMCS_GUEST_ES_SELECTOR);
u64 cs = vmx_vmcs_read(VMCS_GUEST_CS_SELECTOR);
u64 ss = vmx_vmcs_read(VMCS_GUEST_SS_SELECTOR);
u64 ds = vmx_vmcs_read(VMCS_GUEST_DS_SELECTOR);
u64 fs = vmx_vmcs_read(VMCS_GUEST_FS_SELECTOR);
u64 gs = vmx_vmcs_read(VMCS_GUEST_GS_SELECTOR);
u64 ldtr = vmx_vmcs_read(VMCS_GUEST_LDTR_SELECTOR);
u64 tr = vmx_vmcs_read(VMCS_GUEST_TR_SELECTOR);
log_hex64("[VMM] sSEL ES=", es); log_hex64("[VMM] sSEL CS=", cs);
log_hex64("[VMM] sSEL SS=", ss); log_hex64("[VMM] sSEL DS=", ds);
log_hex64("[VMM] sSEL FS=", fs); log_hex64("[VMM] sSEL GS=", gs);
log_hex64("[VMM] sSEL LDTR=", ldtr); log_hex64("[VMM] sSEL TR=", tr);
/* ---- Segment limits ---- */
log_hex64("[VMM] sLIM ES=", vmx_vmcs_read(VMCS_GUEST_ES_LIMIT));
log_hex64("[VMM] sLIM CS=", vmx_vmcs_read(VMCS_GUEST_CS_LIMIT));
log_hex64("[VMM] sLIM SS=", vmx_vmcs_read(VMCS_GUEST_SS_LIMIT));
log_hex64("[VMM] sLIM DS=", vmx_vmcs_read(VMCS_GUEST_DS_LIMIT));
log_hex64("[VMM] sLIM FS=", vmx_vmcs_read(VMCS_GUEST_FS_LIMIT));
log_hex64("[VMM] sLIM GS=", vmx_vmcs_read(VMCS_GUEST_GS_LIMIT));
log_hex64("[VMM] sLIM LDTR=", vmx_vmcs_read(VMCS_GUEST_LDTR_LIMIT));
log_hex64("[VMM] sLIM TR=", vmx_vmcs_read(VMCS_GUEST_TR_LIMIT));
/* ---- Segment access rights ---- */
log_hex64("[VMM] sACC ES=", vmx_vmcs_read(VMCS_GUEST_ES_ACCESS));
log_hex64("[VMM] sACC CS=", vmx_vmcs_read(VMCS_GUEST_CS_ACCESS));
log_hex64("[VMM] sACC SS=", vmx_vmcs_read(VMCS_GUEST_SS_ACCESS));
log_hex64("[VMM] sACC DS=", vmx_vmcs_read(VMCS_GUEST_DS_ACCESS));
log_hex64("[VMM] sACC FS=", vmx_vmcs_read(VMCS_GUEST_FS_ACCESS));
log_hex64("[VMM] sACC GS=", vmx_vmcs_read(VMCS_GUEST_GS_ACCESS));
log_hex64("[VMM] sACC LDTR=", vmx_vmcs_read(VMCS_GUEST_LDTR_ACCESS));
log_hex64("[VMM] sACC TR=", vmx_vmcs_read(VMCS_GUEST_TR_ACCESS));
/* ---- Segment bases ---- */
log_hex64("[VMM] sBAS CS=", vmx_vmcs_read(VMCS_GUEST_CS_BASE));
log_hex64("[VMM] sBAS TR=", vmx_vmcs_read(VMCS_GUEST_TR_BASE));
log_hex64("[VMM] sBAS GDTR=", vmx_vmcs_read(VMCS_GUEST_GDTR_BASE));
log_hex64("[VMM] sBAS IDTR=", vmx_vmcs_read(VMCS_GUEST_IDTR_BASE));
/* ---- GDTR/IDTR limits ---- */
log_hex64("[VMM] dLIM GDTR=", vmx_vmcs_read(VMCS_GUEST_GDTR_LIMIT));
log_hex64("[VMM] dLIM IDTR=", vmx_vmcs_read(VMCS_GUEST_IDTR_LIMIT));
/* ---- Activity / interruptibility / link ---- */
log_hex64("[VMM] gACT=", vmx_vmcs_read(VMCS_GUEST_ACTIVITY_STATE));
log_hex64("[VMM] gINTSTATE=", vmx_vmcs_read(VMCS_GUEST_INTERRUPTIBILITY));
log_hex64("[VMM] gLINK=", vmx_vmcs_read(VMCS_GUEST_LINK_POINTER));
/* ---- SYSENTER ---- */
log_hex64("[VMM] gSYSENTER_CS=", vmx_vmcs_read(VMCS_GUEST_SYSENTER_CS));
log_hex64("[VMM] gDR7=", vmx_vmcs_read(VMCS_GUEST_DR7));
/* ---- Host state summary ---- */
log_hex64("[VMM] hCR0=", vmx_vmcs_read(VMCS_HOST_CR0));
log_hex64("[VMM] hCR3=", vmx_vmcs_read(VMCS_HOST_CR3));
log_hex64("[VMM] hCR4=", vmx_vmcs_read(VMCS_HOST_CR4));
log_hex64("[VMM] hRIP=", vmx_vmcs_read(VMCS_HOST_RIP));
log_hex64("[VMM] hRSP=", vmx_vmcs_read(VMCS_HOST_RSP));
log_hex64("[VMM] hEFER=", vmx_vmcs_read(VMCS_HOST_IA32_EFER));
log_info("[VMM] === End Guest State ===");
}
int vmm_self_test(void) {
if (!g_vmm_ready) {
log_error("[VMM] not ready");
@@ -458,14 +555,46 @@ int vmm_self_test(void) {
log_error("[VMM] map guest TSS failed");
return -6;
}
/* P8.4: Map IDT page for KVM nested VMX (IDTR base = 0x5000) */
{
u64 guest_idt_phys = (u64)g_guest_idt - hhdm;
for (int i = 0; i < 4096; i++) g_guest_idt[i] = 0;
if (ept_map_range(0x5000, guest_idt_phys, 4096, EPT_READ | EPT_WRITE) != 0) {
log_error("[VMM] map guest IDT failed");
return -9;
}
}
/* 配置 VMCS */
vmcs_setup_guest_state_phase1();
vmcs_setup_controls(ept_get_eptp());
vmcs_setup_host_state();
/* P8.4: VMCLEAR + VMPTRLD to put VMCS in "clear" state before VMLAUNCH.
* Without this, VMLAUNCH fails (error 4 or silent failure under KVM). */
if (vmx_vmcs_clear(g_vmcs_phys) != 0) {
log_error("[VMM] vmclear failed");
return -10;
}
if (vmx_vmcs_load(g_vmcs_phys) != 0) {
log_error("[VMM] vmptrld after vmclear failed");
return -11;
}
log_info("[VMM] launching guest");
/* P8.4: dump key VMCS fields before VMLAUNCH for debugging */
log_hex64("[VMM] pin=", vmx_vmcs_read(VMCS_PIN_BASED_VM_EXEC_CONTROL));
log_hex64("[VMM] cpu=", vmx_vmcs_read(VMCS_CPU_BASED_VM_EXEC_CONTROL));
log_hex64("[VMM] cpu2=", vmx_vmcs_read(VMCS_SECONDARY_VM_EXEC_CONTROL));
log_hex64("[VMM] exit=", vmx_vmcs_read(VMCS_VM_EXIT_CONTROLS));
log_hex64("[VMM] entry=", vmx_vmcs_read(VMCS_VM_ENTRY_CONTROLS));
log_hex64("[VMM] eptp=", vmx_vmcs_read(VMCS_EPT_POINTER));
log_hex64("[VMM] link=", vmx_vmcs_read(VMCS_GUEST_LINK_POINTER));
/* P8.4: Dump all guest-state fields for KVM debug */
vmm_dump_guest_state();
/* vmlaunch 控制流：
* - 失败：执行下一条指令，failed=1
* - 成功：进入 guest，不返回。VM-Exit 后跳到 vmx_vm_exit_handler。
@@ -495,6 +624,32 @@ int vmm_self_test(void) {
serial_write("[VMM] ");
serial_write(vmx_error_str(error));
serial_putc('\n');
/* P8.4: diagnostic - dump guest CR0/CR4 vs VMX fixed bits */
{
u64 cr0_fixed0 = vmx_read_msr(0x486); /* IA32_VMX_CR0_FIXED0 */
u64 cr0_fixed1 = vmx_read_msr(0x487); /* IA32_VMX_CR0_FIXED1 */
u64 cr4_fixed0 = vmx_read_msr(0x488); /* IA32_VMX_CR4_FIXED0 */
u64 cr4_fixed1 = vmx_read_msr(0x489); /* IA32_VMX_CR4_FIXED1 */
u64 g_cr0 = vmx_vmcs_read(VMCS_GUEST_CR0);
u64 g_cr4 = vmx_vmcs_read(VMCS_GUEST_CR4);
log_hex64("[VMM] CR0_FIXED0=", cr0_fixed0);
log_hex64("[VMM] CR0_FIXED1=", cr0_fixed1);
log_hex64("[VMM] guest CR0 =", g_cr0);
log_hex64("[VMM] CR4_FIXED0=", cr4_fixed0);
log_hex64("[VMM] CR4_FIXED1=", cr4_fixed1);
log_hex64("[VMM] guest CR4 =", g_cr4);
/* Check: guest CR0 must have all bits in CR0_FIXED0 set,
* and must not have any bits set that are 0 in CR0_FIXED1 */
u64 cr0_missing = cr0_fixed0 & ~g_cr0; /* bits FIXED0 requires but guest lacks */
u64 cr0_extra = g_cr0 & ~cr0_fixed1; /* bits guest has but FIXED1 forbids */
log_hex64("[VMM] CR0 missing(need)=", cr0_missing);
log_hex64("[VMM] CR0 extra(forbid)=", cr0_extra);
u64 cr4_missing = cr4_fixed0 & ~g_cr4;
u64 cr4_extra = g_cr4 & ~cr4_fixed1;
log_hex64("[VMM] CR4 missing(need)=", cr4_missing);
log_hex64("[VMM] CR4 extra(forbid)=", cr4_extra);
}
return -7;
}
CODE/UTSM/vmm/vmx.c
+379 -331
View File
@@ -1,331 +1,379 @@
#include <utsm/vmx.h>
#include <utsm/ept.h>
#include <utsm/log.h>
#include <utsm/types.h>
#include <utsm/dma.h>
#include "../arch/x86_64/limine.h"
extern volatile struct limine_hhdm_request g_hhdm_request;
/* ===== MSR / CR helpers ===== */
u64 vmx_read_msr(u32 msr) {
u32 lo, hi;
__asm__ volatile("rdmsr" : "=a"(lo), "=d"(hi) : "c"(msr));
return ((u64)hi << 32) | lo;
}
static __attribute__((unused)) void vmx_write_msr(u32 msr, u64 value) {
u32 lo = (u32)(value & 0xFFFFFFFFULL);
u32 hi = (u32)(value >> 32);
__asm__ volatile("wrmsr" :: "a"(lo), "d"(hi), "c"(msr));
}
static inline u64 read_cr0(void) {
u64 v;
__asm__ volatile("mov %%cr0, %0" : "=r"(v));
return v;
}
static inline u64 read_cr4(void) {
u64 v;
__asm__ volatile("mov %%cr4, %0" : "=r"(v));
return v;
}
static inline void write_cr4(u64 v) {
__asm__ volatile("mov %0, %%cr4" :: "r"(v));
}
static inline u64 read_cr3(void) {
u64 v;
__asm__ volatile("mov %%cr3, %0" : "=r"(v));
return v;
}
static inline u64 read_rflags(void) {
u64 v;
__asm__ volatile("pushfq; popq %0" : "=r"(v));
return v;
}
/* ===== CPUID ===== */
static void cpuid(u32 leaf, u32 *eax, u32 *ebx, u32 *ecx, u32 *edx) {
__asm__ volatile("cpuid"
: "=a"(*eax), "=b"(*ebx), "=c"(*ecx), "=d"(*edx)
: "a"(leaf));
}
int vmx_supported(void) {
u32 eax, ebx, ecx, edx;
cpuid(1, &eax, &ebx, &ecx, &edx);
return (ecx & (1U << 5)) != 0; /* CPUID.1:ECX[5] = VMX */
}
/* ===== VMXON region ===== */
static u64 g_vmxon_phys;
static u64 g_vmcs_revision;
static u64 g_vmx_basic;
static int g_vmx_enabled;
/* VMX 要求 CR0 固定位必须为 1（VMX operation 不允许清除）。
* 这些位由 IA32_VMX_BASIC MSR 的高 32 位（CR0 fixed-0）和
* IA32_VMX_CR0_FIXED1 MSR 决定。简化：直接 OR 上 PE/NE/PG/WP。 */
static u64 vmx_required_cr0(void) {
return read_cr0() | CR0_PE | CR0_NE | CR0_WP | CR0_PG;
}
static u64 vmx_required_cr4(void) {
return read_cr4() | CR4_VMXE | CR4_PAE | CR4_PGE;
}
/* Check whether we are running under a hypervisor that does NOT support
* nested VMX. This covers:
* - WHPX: CPUID may report VMX but VMXON/CR4.VMXE causes fatal exit
* - Any hypervisor without nested virtualization support
*
* Detection strategy:
* 1. Check CPUID.01H:ECX[31] (hypervisor present bit)
* 2. If hypervisor present, check CPUID.40000000H for vendor signature
* 3. Try reading IA32_VMX_BASIC MSR — if it returns 0, VMX is not real
* 4. Check Hyper-V specific: HV_CPU_MANAGEMENT_FEATURES for nested VMX
*
* If VMX CPUID flag is set but we're under a hypervisor that doesn't expose
* real VMX MSRs, we must not attempt CR4.VMXE or VMXON, as this will cause
* a fatal VM exit in WHPX (exit code 4).
*/
static int vmx_truly_available(void) {
/* Step 1: If CPUID doesn't even report VMX, definitely not available */
if (!vmx_supported()) return 0;
/* Step 2: Check if running under a hypervisor */
u32 eax, ebx, ecx, edx;
cpuid(1, &eax, &ebx, &ecx, &edx);
if (!(ecx & (1U << 31))) {
/* No hypervisor — bare metal, VMX should work */
return 1;
}
log_info("[VMX] hypervisor present bit set, checking nested VMX support");
/* Step 3: Try reading IA32_VMX_BASIC — if it's zero or faults,
* the hypervisor doesn't expose real VMX. */
/* We use a safe read: if the MSR doesn't exist, rdmsr would #GP.
* However, under WHPX, IA32_VMX_BASIC may return a non-zero value
* even though VMXON will fail. So we need another check. */
/* Step 4: Check hypervisor vendor for nested VMX support */
cpuid(0x40000000, &eax, &ebx, &ecx, &edx);
/* Check for Hyper-V ("Microsoft Hv") */
if (ebx == 0x7263694DU && ecx == 0x666F736FU && edx == 0x76482074U) {
log_info("[VMX] Hyper-V detected");
/* Check if HV_CPU_MANAGEMENT_FEATURES (MSR 0x4000000F) exists.
* Hyper-V CPUID leaf 0x40000003 tells us which MSRs are available.
* Partition_privileges bit 1 (nested virtualization) is at EBX bit 1
* of CPUID 0x40000000 + 3 = 0x40000003.
* But safer: just check the max CPUID leaf for Hyper-V. */
u32 hv_max_leaf = eax;
if (hv_max_leaf >= 0x40000003) {
/* CPUID 0x40000003 EBX bit 1 = AccessIntrCtrl (nested) */
cpuid(0x40000003, &eax, &ebx, &ecx, &edx);
if (ebx & (1U << 1)) {
log_info("[VMX] Hyper-V nested virtualization supported");
return 1;
}
}
log_warn("[VMX] Hyper-V WITHOUT nested VMX support");
log_warn("[VMX] CR4.VMXE / VMXON would cause fatal exit, skipping");
return 0;
}
/* Check for KVM ("KVMKVMKVM") */
if (ebx == 0x4B4D564BU && ecx == 0x564B4D56U && edx == 0x4D564B4DU) {
log_info("[VMX] KVM detected — nested VMX may be available");
/* KVM typically supports nested VMX if enabled */
return 1;
}
/* Unknown hypervisor — be conservative: skip VMX to avoid
* fatal exits. The user must explicitly enable nested VMX on
* their hypervisor for Linux compat to work. */
log_warn("[VMX] unknown hypervisor, VMX may not be truly available");
log_warn("[VMX] skipping VMX init to avoid potential fatal exit");
return 0;
}
int vmx_enable(void) {
if (g_vmx_enabled) return 0;
if (!vmx_truly_available()) {
log_warn("[VMX] VMX not truly available, skipping VMX init");
return -1;
}
/* 读 IA32_VMX_BASIC，获取 VMCS revision ID 与 region 大小 */
g_vmx_basic = vmx_read_msr(IA32_VMX_BASIC);
g_vmcs_revision = g_vmx_basic & 0x7FFFFFFFULL;
u32 vmcs_size = (u32)((g_vmx_basic >> 32) & 0x1FFF);
if (vmcs_size == 0) vmcs_size = 4096;
log_hex64("[VMX] VMX_BASIC=", g_vmx_basic);
log_hex64("[VMX] VMCS revision=", g_vmcs_revision);
/* 分配 VMXON region（4KB 对齐，物理页） */
dkm_dma_buffer vmxon_buf;
if (dma_alloc_pages(1, EPT_PAGE_SIZE, 0x100000000ULL, &vmxon_buf) != 0) {
log_error("[VMX] failed to alloc VMXON region");
return -2;
}
g_vmxon_phys = vmxon_buf.phys;
/* 在 VMXON region 偏移 0 写入 VMCS revision ID */
u32 *vmxon_ptr = (u32 *)vmxon_buf.virt;
vmxon_ptr[0] = (u32)g_vmcs_revision;
log_hex64("[VMX] VMXON phys=", g_vmxon_phys);
/* 设置 CR4.VMXE */
u64 cr4 = vmx_required_cr4();
write_cr4(cr4);
log_hex64("[VMX] CR4=", cr4);
/* 确保 CR0 满足 VMX 要求（这里只读不写，UEFI 已配置好） */
(void)vmx_required_cr0();
/* 执行 vmxon */
int err;
__asm__ volatile(
"vmxon %1\n"
"jnc 1f\n"
"jmp 2f\n"
"1:\n"
"mov $0, %0\n"
"jmp 3f\n"
"2:\n"
"mov $1, %0\n"
"3:\n"
: "=r"(err)
: "m"(g_vmxon_phys)
: "memory"
);
if (err) {
/* 第二次尝试：读 vmx instruction error 通过 VMCS 不适用 vmxon；
* 简化：返回失败。 */
log_error("[VMX] vmxon failed");
return -3;
}
g_vmx_enabled = 1;
log_info("[VMX] VMX root mode enabled");
return 0;
}
int vmx_disable(void) {
if (!g_vmx_enabled) return 0;
__asm__ volatile("vmxoff" ::: "memory");
g_vmx_enabled = 0;
/* 清 CR4.VMXE */
u64 cr4 = read_cr4();
cr4 &= ~CR4_VMXE;
write_cr4(cr4);
log_info("[VMX] VMX root mode disabled");
return 0;
}
int vmx_vmcs_alloc(u64 *phys_out) {
if (!phys_out) return -1;
dkm_dma_buffer buf;
if (dma_alloc_pages(1, EPT_PAGE_SIZE, 0x100000000ULL, &buf) != 0) {
log_error("[VMX] failed to alloc VMCS region");
return -2;
}
/* 偏移 0 写入 VMCS revision ID */
u32 *p = (u32 *)buf.virt;
p[0] = (u32)g_vmcs_revision;
*phys_out = buf.phys;
return 0;
}
int vmx_vmcs_load(u64 phys) {
int err;
__asm__ volatile(
"vmptrld %1\n"
"jnc 1f\n"
"jmp 2f\n"
"1:\n"
"mov $0, %0\n"
"jmp 3f\n"
"2:\n"
"mov $1, %0\n"
"3:\n"
: "=r"(err)
: "m"(phys)
: "memory"
);
if (err) {
log_error("[VMX] vmptrld failed");
return -1;
}
return 0;
}
u64 vmx_vmcs_read(u64 field) {
u64 value;
__asm__ volatile(
"vmread %1, %0\n"
: "=r"(value)
: "r"(field)
: "memory"
);
return value;
}
void vmx_vmcs_write(u64 field, u64 value) {
__asm__ volatile(
"vmwrite %1, %0\n"
:: "r"(field), "r"(value)
: "memory"
);
}
int vmx_vmlaunch(void) {
int err;
__asm__ volatile(
"vmlaunch\n"
"jnc 1f\n"
"jmp 2f\n"
"1:\n"
"mov $0, %0\n"
"jmp 3f\n"
"2:\n"
"mov $1, %0\n"
"3:\n"
: "=r"(err)
:: "memory"
);
return err;
}
int vmx_vmresume(void) {
int err;
__asm__ volatile(
"vmresume\n"
"jnc 1f\n"
"jmp 2f\n"
"1:\n"
"mov $0, %0\n"
"jmp 3f\n"
"2:\n"
"mov $1, %0\n"
"3:\n"
: "=r"(err)
:: "memory"
);
return err;
}
/* 暴露给其它模块用的辅助 */
u64 vmx_get_host_cr3(void) { return read_cr3(); }
u64 vmx_get_host_rflags(void) { return read_rflags(); }
#include <utsm/vmx.h>
#include <utsm/ept.h>
#include <utsm/log.h>
#include <utsm/types.h>
#include <utsm/dma.h>
#include "../arch/x86_64/limine.h"
extern volatile struct limine_hhdm_request g_hhdm_request;
/* ===== MSR / CR helpers ===== */
u64 vmx_read_msr(u32 msr) {
u32 lo, hi;
__asm__ volatile("rdmsr" : "=a"(lo), "=d"(hi) : "c"(msr));
return ((u64)hi << 32) | lo;
}
static __attribute__((unused)) void vmx_write_msr(u32 msr, u64 value) {
u32 lo = (u32)(value & 0xFFFFFFFFULL);
u32 hi = (u32)(value >> 32);
__asm__ volatile("wrmsr" :: "a"(lo), "d"(hi), "c"(msr));
}
static inline u64 read_cr0(void) {
u64 v;
__asm__ volatile("mov %%cr0, %0" : "=r"(v));
return v;
}
static inline u64 read_cr4(void) {
u64 v;
__asm__ volatile("mov %%cr4, %0" : "=r"(v));
return v;
}
static inline void write_cr0(u64 v) {
__asm__ volatile("mov %0, %%cr0" :: "r"(v));
}
static inline void write_cr4(u64 v) {
__asm__ volatile("mov %0, %%cr4" :: "r"(v));
}
static inline u64 read_cr3(void) {
u64 v;
__asm__ volatile("mov %%cr3, %0" : "=r"(v));
return v;
}
static inline u64 read_rflags(void) {
u64 v;
__asm__ volatile("pushfq; popq %0" : "=r"(v));
return v;
}
/* ===== CPUID ===== */
static void cpuid(u32 leaf, u32 *eax, u32 *ebx, u32 *ecx, u32 *edx) {
__asm__ volatile("cpuid"
: "=a"(*eax), "=b"(*ebx), "=c"(*ecx), "=d"(*edx)
: "a"(leaf));
}
int vmx_supported(void) {
u32 eax, ebx, ecx, edx;
cpuid(1, &eax, &ebx, &ecx, &edx);
return (ecx & (1U << 5)) != 0; /* CPUID.1:ECX[5] = VMX */
}
/* ===== VMXON region ===== */
static u64 g_vmxon_phys;
static u64 g_vmcs_revision;
static u64 g_vmx_basic;
static int g_vmx_enabled;
/* VMX 要求 CR0 固定位必须为 1（VMX operation 不允许清除）。
* 这些位由 IA32_VMX_BASIC MSR 的高 32 位（CR0 fixed-0）和
* IA32_VMX_CR0_FIXED1 MSR 决定。简化：直接 OR 上 PE/NE/PG/WP。 */
static u64 vmx_required_cr0(void) {
return read_cr0() | CR0_PE | CR0_NE | CR0_WP | CR0_PG;
}
static u64 vmx_required_cr4(void) {
return read_cr4() | CR4_VMXE | CR4_PAE | CR4_PGE;
}
/* Check whether we are running under a hypervisor that does NOT support
* nested VMX. This covers:
* - WHPX: CPUID may report VMX but VMXON/CR4.VMXE causes fatal exit
* - Any hypervisor without nested virtualization support
*
* Detection strategy:
* 1. Check CPUID.01H:ECX[31] (hypervisor present bit)
* 2. If hypervisor present, check CPUID.40000000H for vendor signature
* 3. Try reading IA32_VMX_BASIC MSR — if it returns 0, VMX is not real
* 4. Check Hyper-V specific: HV_CPU_MANAGEMENT_FEATURES for nested VMX
*
* If VMX CPUID flag is set but we're under a hypervisor that doesn't expose
* real VMX MSRs, we must not attempt CR4.VMXE or VMXON, as this will cause
* a fatal VM exit in WHPX (exit code 4).
*/
static int vmx_truly_available(void) {
/* Step 1: If CPUID doesn't even report VMX, definitely not available */
if (!vmx_supported()) return 0;
/* Step 2: Check if running under a hypervisor */
u32 eax, ebx, ecx, edx;
cpuid(1, &eax, &ebx, &ecx, &edx);
if (!(ecx & (1U << 31))) {
/* No hypervisor — bare metal, VMX should work */
return 1;
}
log_info("[VMX] hypervisor present bit set, checking nested VMX support");
/* Step 3: Try reading IA32_VMX_BASIC — if it's zero or faults,
* the hypervisor doesn't expose real VMX. */
/* We use a safe read: if the MSR doesn't exist, rdmsr would #GP.
* However, under WHPX, IA32_VMX_BASIC may return a non-zero value
* even though VMXON will fail. So we need another check. */
/* Step 4: Check hypervisor vendor for nested VMX support */
cpuid(0x40000000, &eax, &ebx, &ecx, &edx);
/* P8.3 Fix: diagnostic logging of hypervisor vendor */
{
char hv[13];
hv[0] = (char)(ebx & 0xFF); hv[1] = (char)((ebx >> 8) & 0xFF);
hv[2] = (char)((ebx >> 16) & 0xFF); hv[3] = (char)((ebx >> 24) & 0xFF);
hv[4] = (char)(ecx & 0xFF); hv[5] = (char)((ecx >> 8) & 0xFF);
hv[6] = (char)((ecx >> 16) & 0xFF); hv[7] = (char)((ecx >> 24) & 0xFF);
hv[8] = (char)(edx & 0xFF); hv[9] = (char)((edx >> 8) & 0xFF);
hv[10] = (char)((edx >> 16) & 0xFF); hv[11] = (char)((edx >> 24) & 0xFF);
hv[12] = 0;
log_info("[VMX] hypervisor vendor: ");
log_info(hv);
}
/* Check for Hyper-V ("Microsoft Hv") */
if (ebx == 0x7263694DU && ecx == 0x666F736FU && edx == 0x76482074U) {
log_info("[VMX] Hyper-V detected");
/* Check if HV_CPU_MANAGEMENT_FEATURES (MSR 0x4000000F) exists.
* Hyper-V CPUID leaf 0x40000003 tells us which MSRs are available.
* Partition_privileges bit 1 (nested virtualization) is at EBX bit 1
* of CPUID 0x40000000 + 3 = 0x40000003.
* But safer: just check the max CPUID leaf for Hyper-V. */
u32 hv_max_leaf = eax;
if (hv_max_leaf >= 0x40000003) {
/* CPUID 0x40000003 EBX bit 1 = AccessIntrCtrl (nested) */
cpuid(0x40000003, &eax, &ebx, &ecx, &edx);
if (ebx & (1U << 1)) {
log_info("[VMX] Hyper-V nested virtualization supported");
return 1;
}
}
log_warn("[VMX] Hyper-V WITHOUT nested VMX support");
log_warn("[VMX] CR4.VMXE / VMXON would cause fatal exit, skipping");
return 0;
}
/* P8.3 Fix: Check for KVM ("KVMKVMKVM"). Match ebx+ecx only
* (edx was wrongly 0x4D564B4D, should be 0x0000004D for "M\0\0\0"). */
if (ebx == 0x4B4D564BU && ecx == 0x564B4D56U) {
log_info("[VMX] KVM detected - nested VMX may be available");
return 1;
}
/* P8.3 Fix: Unknown hypervisor - try IA32_VMX_BASIC MSR. */
{
u64 vmx_basic = vmx_read_msr(IA32_VMX_BASIC);
if (vmx_basic != 0) {
log_info("[VMX] unknown hypervisor but IA32_VMX_BASIC non-zero, attempting");
return 1;
}
}
log_warn("[VMX] unknown hypervisor, IA32_VMX_BASIC=0, VMX not available");
return 0;
}
int vmx_enable(void) {
if (g_vmx_enabled) return 0;
if (!vmx_truly_available()) {
log_warn("[VMX] VMX not truly available, skipping VMX init");
return -1;
}
/* 读 IA32_VMX_BASIC，获取 VMCS revision ID 与 region 大小 */
g_vmx_basic = vmx_read_msr(IA32_VMX_BASIC);
g_vmcs_revision = g_vmx_basic & 0x7FFFFFFFULL;
u32 vmcs_size = (u32)((g_vmx_basic >> 32) & 0x1FFF);
if (vmcs_size == 0) vmcs_size = 4096;
log_hex64("[VMX] VMX_BASIC=", g_vmx_basic);
log_hex64("[VMX] VMCS revision=", g_vmcs_revision);
/* 分配 VMXON region（4KB 对齐，物理页） */
dkm_dma_buffer vmxon_buf;
if (dma_alloc_pages(1, EPT_PAGE_SIZE, 0x100000000ULL, &vmxon_buf) != 0) {
log_error("[VMX] failed to alloc VMXON region");
return -2;
}
g_vmxon_phys = vmxon_buf.phys;
/* 在 VMXON region 偏移 0 写入 VMCS revision ID */
u32 *vmxon_ptr = (u32 *)vmxon_buf.virt;
vmxon_ptr[0] = (u32)g_vmcs_revision;
log_hex64("[VMX] VMXON phys=", g_vmxon_phys);
/* 设置 CR4.VMXE */
u64 cr4 = vmx_required_cr4();
write_cr4(cr4);
log_hex64("[VMX] CR4=", cr4);
/* 确保 CR0 满足 VMX 要求（这里只读不写，UEFI 已配置好） */
/* P8.3 Fix: ensure CR0 meets VMX requirements before VMXON */
u64 cr0 = vmx_required_cr0();
write_cr0(cr0);
log_hex64("[VMX] CR0=", cr0);
/* 执行 vmxon */
int err;
__asm__ volatile(
"vmxon %1\n"
"jnc 1f\n"
"jmp 2f\n"
"1:\n"
"mov $0, %0\n"
"jmp 3f\n"
"2:\n"
"mov $1, %0\n"
"3:\n"
: "=r"(err)
: "m"(g_vmxon_phys)
: "memory"
);
if (err) {
/* 第二次尝试：读 vmx instruction error 通过 VMCS 不适用 vmxon；
* 简化：返回失败。 */
log_error("[VMX] vmxon failed");
return -3;
}
g_vmx_enabled = 1;
log_info("[VMX] VMX root mode enabled");
return 0;
}
int vmx_disable(void) {
if (!g_vmx_enabled) return 0;
__asm__ volatile("vmxoff" ::: "memory");
g_vmx_enabled = 0;
/* 清 CR4.VMXE */
u64 cr4 = read_cr4();
cr4 &= ~CR4_VMXE;
write_cr4(cr4);
log_info("[VMX] VMX root mode disabled");
return 0;
}
int vmx_vmcs_alloc(u64 *phys_out) {
if (!phys_out) return -1;
dkm_dma_buffer buf;
if (dma_alloc_pages(1, EPT_PAGE_SIZE, 0x100000000ULL, &buf) != 0) {
log_error("[VMX] failed to alloc VMCS region");
return -2;
}
/* 偏移 0 写入 VMCS revision ID */
u32 *p = (u32 *)buf.virt;
p[0] = (u32)g_vmcs_revision;
*phys_out = buf.phys;
return 0;
}
int vmx_vmcs_load(u64 phys) {
int err;
__asm__ volatile(
"vmptrld %1\n"
"jnc 1f\n"
"jmp 2f\n"
"1:\n"
"mov $0, %0\n"
"jmp 3f\n"
"2:\n"
"mov $1, %0\n"
"3:\n"
: "=r"(err)
: "m"(phys)
: "memory"
);
if (err) {
log_error("[VMX] vmptrld failed");
return -1;
}
return 0;
}
/* P8.4: VMCLEAR - put VMCS in "clear" state (required before VMLAUNCH). */
int vmx_vmcs_clear(u64 phys) {
int err;
__asm__ volatile(
"vmclear %1\n"
"jnc 1f\n"
"jmp 2f\n"
"1:\n"
"mov $0, %0\n"
"jmp 3f\n"
"2:\n"
"mov $1, %0\n"
"3:\n"
: "=r"(err)
: "m"(phys)
: "memory"
);
if (err) {
log_error("[VMX] vmclear failed");
return -1;
}
return 0;
}
u64 vmx_vmcs_read(u64 field) {
u64 value;
__asm__ volatile(
"vmread %1, %0\n"
: "=r"(value)
: "r"(field)
: "memory"
);
return value;
}
void vmx_vmcs_write(u64 field, u64 value) {
__asm__ volatile(
"vmwrite %1, %0\n"
:: "r"(field), "r"(value)
: "memory"
);
}
int vmx_vmlaunch(void) {
int err;
__asm__ volatile(
"vmlaunch\n"
"jnc 1f\n"
"jmp 2f\n"
"1:\n"
"mov $0, %0\n"
"jmp 3f\n"
"2:\n"
"mov $1, %0\n"
"3:\n"
: "=r"(err)
:: "memory"
);
return err;
}
int vmx_vmresume(void) {
int err;
__asm__ volatile(
"vmresume\n"
"jnc 1f\n"
"jmp 2f\n"
"1:\n"
"mov $0, %0\n"
"jmp 3f\n"
"2:\n"
"mov $1, %0\n"
"3:\n"
: "=r"(err)
:: "memory"
);
return err;
}
/* 暴露给其它模块用的辅助 */
u64 vmx_get_host_cr3(void) { return read_cr3(); }
u64 vmx_get_host_rflags(void) { return read_rflags(); }
CODE/UTSM/vmm/xj380_boot.c
+323
View File
@@ -0,0 +1,323 @@
/* xj380_boot.c — VMCS configuration and vmlaunch for OpenXJ380 guest.
*
* 参照 linux_boot.c 模式。XJ380 内核入口 KernelMain 是 C++ extern "C"，
* 以 SysV ABI 传 3 个引用参数（退化为指针）：
* RDI = &FrameBufferConfig （HHDM 虚拟地址）
* RSI = &EFI_SYSTEM_TABLE （伪表，RuntimeServices=NULL，内核仅存指针）
* RDX = &BOOT_CONFIG （HHDM 虚拟地址）
* RIP = 0xFFFFFFFF80000000（guest 虚拟地址，由 guest 页表内核区映射）。
*
* guest 终止（异常/三重故障/0xCF9 重启）后本函数返回，host 恢复。
*/
#include <utsm/xj380_loader.h>
#include <utsm/vmx.h>
#include <utsm/ept.h>
#include <utsm/vmm.h>
#include <utsm/log.h>
#include <utsm/types.h>
#include "../arch/x86_64/limine.h"
extern volatile struct limine_hhdm_request g_hhdm_request;
/* VM-Exit 汇编入口与 C 分发器（vmm.c / vmexit_asm.S） */
extern void vmx_vm_exit_handler(void);
extern int vmexit_dispatch(void);
extern u64 vmexit_get_count(void);
extern u8 g_host_stack[8192];
/* 当前运行的 guest 是否为 XJ380（vmm.h 声明，vmexit.c handle_hlt 检查）。
* 定义在本模块：XJ380 launch 置 1，guest 终止后清 0。 */
volatile int g_xj380_guest_active;
/* CR 辅助 */
static inline u64 read_cr0_local(void) {
u64 v;
__asm__ volatile("mov %%cr0, %0" : "=r"(v));
return v;
}
static inline u64 read_cr3_local(void) {
u64 v;
__asm__ volatile("mov %%cr3, %0" : "=r"(v));
return v;
}
static inline u64 read_cr4_local(void) {
u64 v;
__asm__ volatile("mov %%cr4, %0" : "=r"(v));
return v;
}
static u64 vmx_adjust_control(u64 value, u32 msr) {
u32 allowed0 = (u32)vmx_read_msr(msr);
u32 allowed1 = (u32)(vmx_read_msr(msr) >> 32);
u32 adjusted = (u32)value | allowed0;
adjusted &= allowed1;
return adjusted;
}
/* MSR bitmap（4KB，全零 = 不拦截任何 MSR，与 Linux guest 一致） */
static u8 g_xj380_msr_bitmap[4096] __attribute__((aligned(4096)));
/* ===== VMCS host state ===== */
static void xj380_vmcs_setup_host_state(void) {
vmx_vmcs_write(VMCS_HOST_CR0, read_cr0_local() | CR0_PE | CR0_NE | CR0_PG);
vmx_vmcs_write(VMCS_HOST_CR3, read_cr3_local());
vmx_vmcs_write(VMCS_HOST_CR4, read_cr4_local() | CR4_VMXE);
vmx_vmcs_write(VMCS_HOST_CS_SELECTOR, 0x08);
vmx_vmcs_write(VMCS_HOST_SS_SELECTOR, 0x10);
vmx_vmcs_write(VMCS_HOST_DS_SELECTOR, 0x10);
vmx_vmcs_write(VMCS_HOST_ES_SELECTOR, 0x10);
vmx_vmcs_write(VMCS_HOST_FS_SELECTOR, 0);
vmx_vmcs_write(VMCS_HOST_GS_SELECTOR, 0);
vmx_vmcs_write(VMCS_HOST_FS_BASE, 0);
vmx_vmcs_write(VMCS_HOST_GS_BASE, 0);
{
struct __attribute__((packed)) { u16 limit; u64 base; } gdtr, idtr;
__asm__ volatile("sgdt %0" : "=m"(gdtr));
__asm__ volatile("sidt %0" : "=m"(idtr));
vmx_vmcs_write(VMCS_HOST_GDTR_BASE, gdtr.base);
vmx_vmcs_write(VMCS_HOST_IDTR_BASE, idtr.base);
u16 tr_sel;
u64 tr_base;
__asm__ volatile("str %0" : "=r"(tr_sel));
u64 gdt_base = gdtr.base;
u64 *tss_desc = (u64 *)(gdt_base + (tr_sel & 0xFFF8));
u64 low = tss_desc[0];
u64 high = tss_desc[1];
tr_base = (low >> 16) & 0xFFFFFF;
tr_base |= ((low >> 32) & 0xFF) << 24;
tr_base |= (high & 0xFFFFFFFF) << 32;
vmx_vmcs_write(VMCS_HOST_TR_SELECTOR, tr_sel);
vmx_vmcs_write(VMCS_HOST_TR_BASE, tr_base);
}
{
u64 sysenter_cs;
__asm__ volatile("rdmsr" : "=a"(sysenter_cs) : "c"(0x174));
vmx_vmcs_write(VMCS_HOST_SYSENTER_CS, sysenter_cs & 0xFFFFFFFF);
vmx_vmcs_write(VMCS_HOST_SYSENTER_ESP, 0);
vmx_vmcs_write(VMCS_HOST_SYSENTER_EIP, 0);
}
{
u32 low, high;
__asm__ volatile("rdmsr" : "=a"(low), "=d"(high) : "c"(0xC0000080));
u64 host_efer = ((u64)high << 32) | low;
vmx_vmcs_write(VMCS_HOST_IA32_EFER, host_efer);
}
vmx_vmcs_write(VMCS_HOST_RSP, (u64)&g_host_stack[sizeof(g_host_stack) - 16]);
vmx_vmcs_write(VMCS_HOST_RIP, (u64)vmx_vm_exit_handler);
}
/* ===== VMCS guest state ===== */
static void xj380_vmcs_setup_guest_state(const struct xj380_guest_info *gi) {
vmx_vmcs_write(VMCS_GUEST_CR0, CR0_PE | CR0_NE | CR0_PG | CR0_WP);
vmx_vmcs_write(VMCS_GUEST_CR3, gi->pgt_gpa);
vmx_vmcs_write(VMCS_GUEST_CR4, CR4_PAE | CR4_PGE | CR4_PSE);
vmx_vmcs_write(VMCS_GUEST_CS_SELECTOR, 0x08);
vmx_vmcs_write(VMCS_GUEST_SS_SELECTOR, 0x10);
vmx_vmcs_write(VMCS_GUEST_DS_SELECTOR, 0x10);
vmx_vmcs_write(VMCS_GUEST_ES_SELECTOR, 0x10);
vmx_vmcs_write(VMCS_GUEST_FS_SELECTOR, 0);
vmx_vmcs_write(VMCS_GUEST_GS_SELECTOR, 0);
vmx_vmcs_write(VMCS_GUEST_LDTR_SELECTOR, 0);
vmx_vmcs_write(VMCS_GUEST_TR_SELECTOR, 0x18);
vmx_vmcs_write(VMCS_GUEST_CS_BASE, 0);
vmx_vmcs_write(VMCS_GUEST_SS_BASE, 0);
vmx_vmcs_write(VMCS_GUEST_DS_BASE, 0);
vmx_vmcs_write(VMCS_GUEST_ES_BASE, 0);
vmx_vmcs_write(VMCS_GUEST_FS_BASE, 0);
vmx_vmcs_write(VMCS_GUEST_GS_BASE, 0);
vmx_vmcs_write(VMCS_GUEST_LDTR_BASE, 0);
vmx_vmcs_write(VMCS_GUEST_TR_BASE, gi->gdt_gpa + 0x100);
vmx_vmcs_write(VMCS_GUEST_GDTR_BASE, gi->gdt_gpa);
vmx_vmcs_write(VMCS_GUEST_IDTR_BASE, 0);
vmx_vmcs_write(VMCS_GUEST_CS_LIMIT, 0xFFFFFFFF);
vmx_vmcs_write(VMCS_GUEST_SS_LIMIT, 0xFFFFFFFF);
vmx_vmcs_write(VMCS_GUEST_DS_LIMIT, 0xFFFFFFFF);
vmx_vmcs_write(VMCS_GUEST_ES_LIMIT, 0xFFFFFFFF);
vmx_vmcs_write(VMCS_GUEST_FS_LIMIT, 0xFFFFFFFF);
vmx_vmcs_write(VMCS_GUEST_GS_LIMIT, 0xFFFFFFFF);
vmx_vmcs_write(VMCS_GUEST_LDTR_LIMIT, 0xFFFF);
vmx_vmcs_write(VMCS_GUEST_TR_LIMIT, 0x67);
vmx_vmcs_write(VMCS_GUEST_GDTR_LIMIT, 0x28);
vmx_vmcs_write(VMCS_GUEST_IDTR_LIMIT, 0xFFFF);
vmx_vmcs_write(VMCS_GUEST_CS_ACCESS, 0xA09B); /* 64 位代码 L=1 */
vmx_vmcs_write(VMCS_GUEST_SS_ACCESS, 0xC093);
vmx_vmcs_write(VMCS_GUEST_DS_ACCESS, 0xC093);
vmx_vmcs_write(VMCS_GUEST_ES_ACCESS, 0xC093);
vmx_vmcs_write(VMCS_GUEST_FS_ACCESS, 0xC093);
vmx_vmcs_write(VMCS_GUEST_GS_ACCESS, 0xC093);
vmx_vmcs_write(VMCS_GUEST_LDTR_ACCESS, 0x82); /* unusable */
vmx_vmcs_write(VMCS_GUEST_TR_ACCESS, 0x8B); /* busy 64-bit TSS */
/* guest RIP = XJ380 内核入口（guest 虚拟地址，经内核区页表映射） */
vmx_vmcs_write(VMCS_GUEST_RIP, gi->kernel_entry);
vmx_vmcs_write(VMCS_GUEST_RSP, XJ380_BOOT_STACK_TOP);
vmx_vmcs_write(VMCS_GUEST_RFLAGS, 0x2); /* IF=0 */
vmx_vmcs_write(VMCS_GUEST_IA32_EFER, EFER_LME | EFER_LMA | EFER_NXE);
vmx_vmcs_write(VMCS_GUEST_SYSENTER_CS, 0);
vmx_vmcs_write(VMCS_GUEST_SYSENTER_ESP, 0);
vmx_vmcs_write(VMCS_GUEST_SYSENTER_EIP, 0);
vmx_vmcs_write(VMCS_GUEST_DR7, 0x400);
vmx_vmcs_write(VMCS_GUEST_ACTIVITY_STATE, 0);
vmx_vmcs_write(VMCS_GUEST_INTERRUPTIBILITY, 0);
}
/* ===== VMCS controls ===== */
static void xj380_vmcs_setup_controls(u64 eptp) {
u64 pin_want = PIN_EXT_INTERRUPT_EXITING | PIN_NMI_EXITING;
if (vmx_preemption_timer_supported()) {
pin_want |= PIN_VMX_PREEMPTION_TIMER;
}
u64 pin = vmx_adjust_control(pin_want, IA32_VMX_TRUE_PINBASED_CTLS);
u64 cpu = CPU_BASED_HLT_EXITING
| CPU_BASED_ACTIVATE_SECONDARY
| CPU_BASED_USE_MSR_BITMAPS
| CPU_BASED_UNCOND_IO_EXITING
| CPU_BASED_INVLPG_EXITING;
cpu = vmx_adjust_control(cpu, IA32_VMX_TRUE_PROCBASED_CTLS);
u64 cpu2 = SEC_EXEC_ENABLE_EPT | SEC_EXEC_ENABLE_VPID;
{
u64 msr = vmx_read_msr(IA32_VMX_PROCBASED_CTLS2);
u32 allowed1 = (u32)(msr >> 32);
cpu2 &= allowed1;
cpu2 |= SEC_EXEC_ENABLE_EPT;
}
u64 exit_ctrl = VM_EXIT_SAVE_DEBUG_CONTROLS
| VM_EXIT_HOST_ADDR_SPACE_SIZE
| VM_EXIT_LOAD_HOST_EFER;
exit_ctrl = vmx_adjust_control(exit_ctrl, IA32_VMX_TRUE_EXIT_CTLS);
u64 entry_ctrl = VM_ENTRY_LOAD_DEBUG_CONTROLS
| VM_ENTRY_IA32E_MODE_GUEST
| VM_ENTRY_LOAD_GUEST_EFER;
entry_ctrl = vmx_adjust_control(entry_ctrl, IA32_VMX_TRUE_ENTRY_CTLS);
vmx_vmcs_write(VMCS_PIN_BASED_VM_EXEC_CONTROL, pin);
vmx_vmcs_write(VMCS_CPU_BASED_VM_EXEC_CONTROL, cpu);
vmx_vmcs_write(VMCS_SECONDARY_VM_EXEC_CONTROL, cpu2);
vmx_vmcs_write(VMCS_VM_EXIT_CONTROLS, exit_ctrl);
vmx_vmcs_write(VMCS_VM_ENTRY_CONTROLS, entry_ctrl);
{
u64 hhdm = g_hhdm_request.response ? g_hhdm_request.response->offset : 0;
u64 msr_bitmap_phys = (u64)g_xj380_msr_bitmap - hhdm;
vmx_vmcs_write(VMCS_MSR_BITMAP, msr_bitmap_phys);
}
vmx_vmcs_write(VMCS_EPT_POINTER, eptp);
vmx_vmcs_write(VMCS_VPID, 3); /* VPID 1=self-test, 2=Linux, 3=XJ380 */
vmx_vmcs_write(VMCS_EXCEPTION_BITMAP, (1ULL << 13) | (1ULL << 14) | (1ULL << 6) | (1ULL << 8));
}
/* ===== 传给 vmlaunch asm 的参数 ===== */
static volatile u64 g_xj380_rdi;
static volatile u64 g_xj380_rsi;
static volatile u64 g_xj380_rdx;
/* ===== XJ380 launch =====
*
* 前置条件：vmm_init() + xj380_loader_init()。
* guest 终止后返回 0；vmlaunch 失败返回负值。 */
int xj380_launch(void) {
const struct xj380_guest_info *gi = xj380_get_guest_info();
if (!gi || !gi->loaded) {
log_error("[XJ380] guest not loaded");
return -1;
}
if (!vmm_is_ready()) {
log_error("[XJ380] VMM not ready");
return -2;
}
log_info("[XJ380] launch begin");
/* 真机 EPT TLB 刷新：vmlaunch 前确保 EPT 映射可见 */
ept_flush_ept();
/* 重置 VM-Exit 状态 */
g_guest_terminated = 0;
g_last_exit_reason = 0xFFFFFFFFULL;
g_linux_guest_active = 0; /* XJ380 是当前 active guest */
g_guest_parked = 0;
g_xj380_guest_active = 1;
/* 配置 VMCS */
xj380_vmcs_setup_guest_state(gi);
xj380_vmcs_setup_controls(vmm_get_eptp());
xj380_vmcs_setup_host_state();
/* 初始 arm preemption timer（1ms 后首次周期 exit） */
vmx_vmcs_write(VMCS_GUEST_PREEMPTION_TIMER, vmx_preemption_quantum_1ms());
/* KernelMain 3 个 SysV 参数（HHDM 虚拟地址） */
g_xj380_rdi = XJ380_FBC_GPA + XJ380_HHDM_OFFSET;
g_xj380_rsi = XJ380_FAKEEFI_GPA + XJ380_HHDM_OFFSET;
g_xj380_rdx = XJ380_BOOTCFG_GPA + XJ380_HHDM_OFFSET;
log_hex64("[XJ380] RIP=", gi->kernel_entry);
log_hex64("[XJ380] RSP=", XJ380_BOOT_STACK_TOP);
log_hex64("[XJ380] RDI(fbc)=", g_xj380_rdi);
log_hex64("[XJ380] RSI(efi)=", g_xj380_rsi);
log_hex64("[XJ380] RDX(bootcfg)=", g_xj380_rdx);
log_hex64("[XJ380] CR3=", gi->pgt_gpa);
log_hex64("[XJ380] GDTR=", gi->gdt_gpa);
log_info("[XJ380] vmlaunch (host suspended until guest terminates)");
int failed;
__asm__ volatile(
"movq %%rsp, g_saved_host_rsp(%%rip)\n\t"
"leaq 1f(%%rip), %%rax\n\t"
"movq %%rax, g_saved_return_rip(%%rip)\n\t"
"movq g_xj380_rdi(%%rip), %%rdi\n\t"
"movq g_xj380_rsi(%%rip), %%rsi\n\t"
"movq g_xj380_rdx(%%rip), %%rdx\n\t"
"vmlaunch\n\t"
/* ---- failure path ---- */
"movl $1, %0\n\t"
"jmp 2f\n\t"
/* ---- post_guest: terminate path jmps here ---- */
"1:\n\t"
"movl $0, %0\n\t"
"2:\n\t"
: "=r"(failed)
:: "rax", "rcx", "rdx", "rsi", "rdi",
"r8", "r9", "r10", "r11", "memory"
);
if (failed) {
u64 error = vmx_vmcs_read(VMCS_VMX_INSTRUCTION_ERROR);
log_hex64("[XJ380] vmlaunch failed, error=", error);
g_xj380_guest_active = 0;
return -3;
}
/* guest 终止，host 恢复 */
g_xj380_guest_active = 0;
log_info("[XJ380] guest terminated, host resumed");
log_hex64("[XJ380] last exit reason=", g_last_exit_reason);
log_hex64("[XJ380] vmexit count=", vmexit_get_count());
return 0;
}
CODE/UTSM/vmm/xj380_boot.d
+10
View File
@@ -0,0 +1,10 @@
vmm/xj380_boot.o: vmm\xj380_boot.c include\utsm\xj380_loader.h \
include\utsm\types.h include\utsm\vmx.h include\utsm\ept.h \
include\utsm\vmm.h include\utsm\log.h vmm\..\arch\x86_64\limine.h
include\utsm\xj380_loader.h:
include\utsm\types.h:
include\utsm\vmx.h:
include\utsm\ept.h:
include\utsm\vmm.h:
include\utsm\log.h:
vmm\..\arch\x86_64\limine.h:
CODE/UTSM/vmm/xj380_loader.c
+712
View File
@@ -0,0 +1,712 @@
/* xj380_loader.c — OpenXJ380 kernel.krl loader for UTSM VMX non-root guest.
*
* 参照 linux_loader.c 的既有模式实现 XJ380 第二 guest：
* 1. 在 Limine boot module 中查找 kernel.krl（路径含 "xj380"）
* 2. 解析 ELF64 PT_LOAD 段（固定链接 0xFFFFFFFF80000000）
* 3. 分配 host 物理内存：boot area / framebuffer / kernel / RAM
* 4. 构造 guest 初始页表（恒等 0-4GB + HHDM + 内核区三区布局）
* 5. 构造 guest GDT（64 位 code/data/TSS）
* 6. 构造 ACPI 桩表 MADT/FADT/MCFG/HPET（幽灵设备地址，EPT 按需分配）
* 7. 构造 EFI 格式内存图（单一 Conventional 区 = guest RAM）
* 8. 构造 BOOT_CONFIG / FrameBufferConfig / 伪 EFI_SYSTEM_TABLE
* 9. EPT 映射所有 guest 区域
*
* VMCS 配置与 vmlaunch 见 xj380_boot.c。
*/
#include <utsm/xj380_loader.h>
#include <utsm/vmx.h>
#include <utsm/ept.h>
#include <utsm/log.h>
#include <utsm/types.h>
#include <utsm/dma.h>
#include "../arch/x86_64/limine.h"
extern volatile struct limine_module_request g_module_request;
extern volatile struct limine_hhdm_request g_hhdm_request;
/* ===== 运行期辅助 ===== */
static void mem_copy(void *dst, const void *src, u64 n) {
u8 *d = (u8 *)dst;
const u8 *s = (const u8 *)src;
for (u64 i = 0; i < n; i++) d[i] = s[i];
}
static void mem_zero(void *dst, u64 n) {
u8 *d = (u8 *)dst;
for (u64 i = 0; i < n; i++) d[i] = 0;
}
static u64 hhdm(void) {
return g_hhdm_request.response ? g_hhdm_request.response->offset : 0;
}
static void *to_virt(u64 hpa) {
return (void *)(hpa + hhdm());
}
/* ===== ELF64 解析（kernel.krl 为 ET_EXEC） ===== */
#define ELF_MAGIC 0x464C457FULL /* "\x7fELF" */
#define ELF_ET_EXEC 2
#define ELF_PT_LOAD 1
typedef struct __attribute__((packed)) {
u8 e_ident[16];
u16 e_type;
u16 e_machine;
u32 e_version;
u64 e_entry;
u64 e_phoff;
u64 e_shoff;
u32 e_flags;
u16 e_ehsize;
u16 e_phentsize;
u16 e_phnum;
u16 e_shentsize;
u16 e_shnum;
u16 e_shstrndx;
} xj_elf64_ehdr;
typedef struct __attribute__((packed)) {
u32 p_type;
u32 p_flags;
u64 p_offset;
u64 p_vaddr;
u64 p_paddr;
u64 p_filesz;
u64 p_memsz;
u64 p_align;
} xj_elf64_phdr;
/* 解析 ELF：校验头、遍历 PT_LOAD 计算内核跨度，记录入口。
* 返回 0 成功；负值失败。 */
static int xj380_parse_elf(const void *img, u64 size,
u64 *entry_out, u64 *span_out) {
if (size < sizeof(xj_elf64_ehdr)) {
log_error("[XJ380] kernel.krl too small");
return -1;
}
const xj_elf64_ehdr *eh = (const xj_elf64_ehdr *)img;
if (*(u32 *)eh->e_ident != (u32)ELF_MAGIC) {
log_error("[XJ380] bad ELF magic");
return -2;
}
if (eh->e_ident[4] != 2) { /* ELFCLASS64 */
log_error("[XJ380] not a 64-bit ELF");
return -3;
}
if (eh->e_type != ELF_ET_EXEC) {
log_error("[XJ380] kernel.krl not ET_EXEC");
return -4;
}
if (eh->e_phnum == 0 || eh->e_phentsize != sizeof(xj_elf64_phdr) ||
eh->e_phoff + (u64)eh->e_phnum * sizeof(xj_elf64_phdr) > size) {
log_error("[XJ380] bad program header table");
return -5;
}
u64 span = 0;
const xj_elf64_phdr *ph = (const xj_elf64_phdr *)((const u8 *)img + eh->e_phoff);
for (u16 i = 0; i < eh->e_phnum; i++) {
if (ph[i].p_type != ELF_PT_LOAD) continue;
if (ph[i].p_vaddr < XJ380_KERNEL_VADDR) {
log_error("[XJ380] PT_LOAD below kernel base");
log_hex64("[XJ380] vaddr=", ph[i].p_vaddr);
return -6;
}
u64 off = ph[i].p_vaddr - XJ380_KERNEL_VADDR;
if (off + ph[i].p_memsz > XJ380_GUEST_KERNEL_MAX) {
log_error("[XJ380] kernel exceeds reserved window (32MB)");
return -7;
}
if (ph[i].p_offset + ph[i].p_filesz > size) {
log_error("[XJ380] PT_LOAD filesz beyond image");
return -8;
}
if (off + ph[i].p_memsz > span) span = off + ph[i].p_memsz;
}
if (span == 0) {
log_error("[XJ380] no PT_LOAD segments");
return -9;
}
if (entry_out) *entry_out = eh->e_entry;
if (span_out) *span_out = span;
log_hex64("[XJ380] ELF entry=", eh->e_entry);
log_hex64("[XJ380] kernel span=", span);
return 0;
}
/* ===== Guest 状态 ===== */
static struct xj380_guest_info g_guest;
/* ===== Guest 页表（三区布局，同 XJ380 引导器契约） =====
*
* PML4 @ pgt_gpa + 0x0000
* [0] → PDPT0 恒等映射 0-4GB（早期直读 MADT 等，内核自清低半）
* [256] → PDPT0 HHDM 映射 0xFFFF800000000000 + [0,4GB)
* [511] → PDPT_K 内核区 0xFFFFFF8000000000+
* PDPT0 @ pgt_gpa + 0x1000，[0..3] → PD0..PD3（每页覆盖 1GB，2MB 大页）
* PD0-3 @ pgt_gpa + 0x2000..0x5000
* PDPT_K@ pgt_gpa + 0x6000，[480] → PD_K（0xFFFFFFFF80000000 区间）
* PD_K @ pgt_gpa + 0x7000，[0..n] 2MB 大页映射内核 GPA
*/
#define XJ_PGT_PDPT0_OFF 0x1000
#define XJ_PGT_PD0_OFF 0x2000
#define XJ_PGT_PDPTK_OFF 0x6000
#define XJ_PGT_PDK_OFF 0x7000
/* x86-64 页表项位 */
#define XJ_PTE_P (1ULL << 0)
#define XJ_PTE_RW (1ULL << 1)
#define XJ_PTE_PS (1ULL << 7)
static int xj380_build_page_tables(u64 pgt_hpa, u64 kernel_gpa, u64 kernel_span) {
u64 *pml4 = (u64 *)to_virt(pgt_hpa);
mem_zero(pml4, XJ380_PGT_SIZE);
u64 pdpt0_gpa = g_guest.pgt_gpa + XJ_PGT_PDPT0_OFF;
u64 pdptk_gpa = g_guest.pgt_gpa + XJ_PGT_PDPTK_OFF;
/* PML4[0] 恒等 + PML4[256] HHDM 指向同一个 PDPT0 */
pml4[0] = pdpt0_gpa | XJ_PTE_P | XJ_PTE_RW;
pml4[256] = pdpt0_gpa | XJ_PTE_P | XJ_PTE_RW;
/* PML4[511] → PDPT_K */
pml4[511] = pdptk_gpa | XJ_PTE_P | XJ_PTE_RW;
/* PDPT0[0..3] → PD0..PD3（覆盖 0-4GB） */
u64 *pdpt0 = (u64 *)((u8 *)pml4 + XJ_PGT_PDPT0_OFF);
for (int i = 0; i < 4; i++) {
u64 pd_gpa = g_guest.pgt_gpa + XJ_PGT_PD0_OFF + (u64)i * 4096;
pdpt0[i] = pd_gpa | XJ_PTE_P | XJ_PTE_RW;
}
/* 每个 PD 512 项，每项 2MB 大页：GPA = i*1GB + j*2MB */
for (int i = 0; i < 4; i++) {
u64 *pd = (u64 *)((u8 *)pml4 + XJ_PGT_PD0_OFF + (u64)i * 4096);
for (int j = 0; j < 512; j++) {
u64 page_gpa = (u64)i * (1ULL << 30) + (u64)j * (2ULL << 20);
pd[j] = page_gpa | XJ_PTE_P | XJ_PTE_RW | XJ_PTE_PS;
}
}
/* PDPT_K[480] → PD_K（虚拟 0xFFFFFFFF80000000 落在 PML4[511] 第 480 个 1GB） */
u64 *pdptk = (u64 *)((u8 *)pml4 + XJ_PGT_PDPTK_OFF);
u64 pdk_gpa = g_guest.pgt_gpa + XJ_PGT_PDK_OFF;
pdptk[480] = pdk_gpa | XJ_PTE_P | XJ_PTE_RW;
/* PD_K[i]：虚拟 0xFFFFFFFF80000000 + i*2MB → GPA kernel_gpa + i*2MB */
u64 *pdk = (u64 *)((u8 *)pml4 + XJ_PGT_PDK_OFF);
u64 pages = (kernel_span + (2ULL << 20) - 1) >> 21;
for (u64 i = 0; i < pages; i++) {
u64 gpa = kernel_gpa + (i << 21);
pdk[i] = gpa | XJ_PTE_P | XJ_PTE_RW | XJ_PTE_PS;
}
return 0;
}
/* ===== Guest GDT（与 linux_loader 相同的 64 位布局） ===== */
typedef struct __attribute__((packed)) {
u16 limit_low;
u16 base_low;
u8 base_mid;
u8 access;
u8 flags_limit_high;
u8 base_high;
} xj_gdt_entry64;
typedef struct __attribute__((packed)) {
u32 limit_low_base_low;
u8 base_mid;
u8 access;
u8 flags_limit_high;
u8 base_high;
u32 base_upper;
u32 reserved;
} xj_tss_desc64;
static int xj380_build_gdt(u64 gdt_hpa) {
u8 *gdt_page = (u8 *)to_virt(gdt_hpa);
mem_zero(gdt_page, 4096);
xj_gdt_entry64 *gdt = (xj_gdt_entry64 *)gdt_page;
gdt[1].limit_low = 0xFFFF;
gdt[1].access = 0x9B;
gdt[1].flags_limit_high = 0xAF; /* G=1, L=1（64 位代码） */
gdt[2].limit_low = 0xFFFF;
gdt[2].access = 0x93;
gdt[2].flags_limit_high = 0xCF;
/* [0x18] 64 位 TSS 描述符，TSS 本体在同页 +0x100 */
xj_tss_desc64 *tss_d = (xj_tss_desc64 *)&gdt_page[0x18];
u64 tss_base = g_guest.gdt_gpa + 0x100;
u32 tss_limit = 0x67;
tss_d->limit_low_base_low = (tss_limit & 0xFFFF) | ((u32)(tss_base & 0xFFFFFF) << 16);
tss_d->base_mid = (u8)((tss_base >> 24) & 0xFF);
tss_d->access = 0x89;
tss_d->flags_limit_high = (u8)((tss_limit >> 16) & 0x0F);
tss_d->base_high = 0;
tss_d->base_upper = 0;
tss_d->reserved = 0;
return 0;
}
/* ===== ACPI 桩表 =====
*
* XJ380 初始化需要 MADT（APIC/LAPIC/IOAPIC）、FADT（未使用）、MCFG（PCIe）、
* HPET（时钟）。所有设备地址均为"幽灵地址"：EPT 未映射该区域时由
* handle_ept_violation 按需分配真实页，guest 读写不崩溃。
* LAPIC/IOAPIC/HPET/MMCONF 均落在低 4GB，恒等 + HHDM 双路可见。
*/
typedef struct __attribute__((packed)) {
char signature[4];
u32 length;
u8 revision;
u8 checksum;
char oemid[6];
char oemtableid[8];
u32 oemrev;
u32 creatorid;
u32 creatorrev;
} xj_acpi_header; /* 36 字节 */
static void acpi_set_header(xj_acpi_header *h, const char sig[4], u32 len) {
mem_zero(h, len);
h->signature[0] = sig[0];
h->signature[1] = sig[1];
h->signature[2] = sig[2];
h->signature[3] = sig[3];
h->length = len;
h->revision = 1;
mem_copy(h->oemid, "DESHAB", 6);
mem_copy(h->oemtableid, "UTSMVMM", 8);
h->oemrev = 1;
mem_copy((char *)&h->creatorid, "UTSM", 4);
h->creatorrev = 1;
/* 校验和 = -sum（校验和字节置 0 后求和） */
u32 sum = 0;
u8 *p = (u8 *)h;
for (u32 i = 0; i < len; i++) sum += p[i];
h->checksum = (u8)(0 - (u8)sum);
}
/* MADT：36 头 + LAPIC 地址(4) + 标志(4) + LAPIC 项(8) + IOAPIC 项(12) = 64 字节。
* LAPIC 项：type=0, len=8, uid=0, id=0, flags=1（仅 enabled，不触发 AP 启动）
* IOAPIC 项：type=1, len=12, id=0, addr=0xFEC00000（幽灵）, gsib=0 */
static int xj380_build_madt(u64 hpa) {
u8 *t = (u8 *)to_virt(hpa);
acpi_set_header((xj_acpi_header *)t, "APIC", 64);
u8 *p = t + 36;
p[0] = 0x00; p[1] = 0x00; p[2] = 0x00; p[3] = 0xF0; /* lapic addr = 0xFEE00000 */
p[4] = 0x01; p[5] = 0x00; p[6] = 0x00; p[7] = 0x00; /* flags = PCAT_COMPAT */
p += 8;
p[0] = 0x00; /* type = LAPIC */
p[1] = 0x08; /* len */
p[2] = 0x00; /* ACPI processor uid */
p[3] = 0x00; /* lapic id */
p[4] = 0x01; p[5] = 0x00; p[6] = 0x00; p[7] = 0x00; /* flags = enabled only */
p += 8;
p[0] = 0x01; /* type = IOAPIC */
p[1] = 0x0C; /* len */
p[2] = 0x00; /* ioapic id */
p[3] = 0x00; /* reserved */
p[4] = 0x00; p[5] = 0x00; p[6] = 0xC0; p[7] = 0xFE; /* ioapic addr = 0xFEC00000 */
p[8] = 0x00; p[9] = 0x00; p[10] = 0x00; p[11] = 0x00; /* gsib */
return 0;
}
/* FADT：最小桩表（XJ380 仅在未接线的 power_shutdown 路径使用，启动不读） */
static int xj380_build_fadt(u64 hpa) {
u8 *t = (u8 *)to_virt(hpa);
acpi_set_header((xj_acpi_header *)t, "FACP", 96);
return 0;
}
/* MCFG：36 头 + reserved(8) + 1 项(16) = 60 字节。
* base=0xF0000000（幽灵 MMCONF），1 个 segment、1 条总线（扫描结果为无设备） */
static int xj380_build_mcfg(u64 hpa) {
u8 *t = (u8 *)to_virt(hpa);
acpi_set_header((xj_acpi_header *)t, "MCFG", 60);
u8 *p = t + 36 + 8;
p[0] = 0x00; p[1] = 0x00; p[2] = 0x00; p[3] = 0x00;
p[4] = 0x00; p[5] = 0x00; p[6] = 0xF0; p[7] = 0x0F; /* base = 0xF0000000 */
p[8] = 0x00; p[9] = 0x00; /* segment group 0 */
p[10] = 0x00; /* start bus 0 */
p[11] = 0x00; /* end bus 0 */
p[12] = 0x00; p[13] = 0x00; p[14] = 0x00; p[15] = 0x00; /* reserved */
return 0;
}
/* HPET：36 头 + event_block_id(4) + GAS(12) + tick_unit(2) + 属性(1) = 55 → 56。
* base=0xFED00000（幽灵），generalCapabilities 读 0 → hpetPeriod=0，不挂起 */
static int xj380_build_hpet(u64 hpa) {
u8 *t = (u8 *)to_virt(hpa);
acpi_set_header((xj_acpi_header *)t, "HPET", 56);
u8 *p = t + 36;
p[0] = 0x00; p[1] = 0x00; p[2] = 0x00; p[3] = 0x00; /* event_block_id */
p[4] = 0x00; /* address_space = 系统内存 */
p[5] = 0x20; /* bit_width = 64 */
p[6] = 0x00; /* bit_offset */
p[7] = 0x00; /* access_size */
p[8] = 0x00; p[9] = 0x00; p[10] = 0x00; p[11] = 0x00;
p[12] = 0x00; p[13] = 0xD0; p[14] = 0xFE; p[15] = 0x0F; /* base = 0xFED00000 */
p[16] = 0x00; p[17] = 0x00; /* clock_tick_unit */
p[18] = 0x00; /* page_oem_flags */
return 0;
}
/* ===== EFI 格式内存图 =====
*
* 仅一个 Conventional 区（guest RAM），其余区域隐式保留。
* EfiMemoryDesc：Type(4)+pad(4)+PhysicalStart(8)+VirtualStart(8)+
* NumberOfPages(8)+Attribute(8)，16 字节对齐 → 48 字节。
*/
typedef struct __attribute__((aligned(16))) {
u32 type;
u32 pad;
u64 physical_start;
u64 virtual_start;
u64 number_of_pages;
u64 attribute;
} xj_efi_memdesc;
#define XJ_EFI_CONVENTIONAL 7
#define XJ_EFI_DESC_SIZE (u64)sizeof(xj_efi_memdesc)
#define XJ_EFI_MEM_ATTR 0xFULL
static int xj380_build_memmap(u64 hpa) {
xj_efi_memdesc *d = (xj_efi_memdesc *)to_virt(hpa);
mem_zero(d, sizeof(*d));
d->type = XJ_EFI_CONVENTIONAL;
d->physical_start = g_guest.ram_gpa;
d->virtual_start = 0;
d->number_of_pages = g_guest.ram_size / 4096;
d->attribute = XJ_EFI_MEM_ATTR;
return 0;
}
/* ===== BOOT_CONFIG（布局必须与 OpenXJ380 boot/include/boot.h 一致） =====
*
* MEMORY_MAP 在 memory.h 中 #pragma pack(1)：36 字节；BOOT_CONFIG 默认对齐。
* 关键：MemoryMap.Buffer / saved_mtrrs 是【物理地址】（内核自行 +HHDM）；
* temp_stack[] 是【HHDM 虚拟地址】数组（仅拷贝，1 CPU 不 deref）。
*/
typedef struct __attribute__((packed)) {
u64 map_size;
u64 buffer; /* 物理 GPA */
u64 map_key;
u64 descriptor_size;
u32 descriptor_version;
} xj_memory_map; /* 36 字节 */
typedef struct {
xj_memory_map memory_map;
u64 fadt;
u64 madt;
u64 hpet;
u64 mcfg;
u64 *saved_mtrrs; /* 物理 GPA，内核 +HHDM */
u64 *temp_stack[256]; /* HHDM 虚拟地址 */
int is_qemu;
u64 boot_flags;
u64 installer_root_pak;
u64 installer_root_pak_size;
u64 system_payload_pak;
u64 system_payload_pak_size;
} xj_boot_config;
_Static_assert(sizeof(xj_memory_map) == 36, "xj_memory_map layout mismatch");
_Static_assert(sizeof(xj_boot_config) == 2176, "xj_boot_config layout mismatch");
/* FrameBufferConfig（boot/include/fbc.h，默认对齐，24 字节） */
typedef struct {
u8 *frame_buffer; /* HHDM 虚拟地址 */
u32 pixels_per_scan_line;
u32 horizontal_resolution;
u32 vertical_resolution;
u32 pixel_format; /* 0=kRGBR, 1=kBGRR */
} xj_framebuffer_config;
_Static_assert(sizeof(xj_framebuffer_config) == 24, "fbc layout mismatch");
static int xj380_build_boot_config(u64 hpa, u64 mtrr_hpa, u64 stack_gpa, u64 fbc_gpa) {
xj_boot_config *bc = (xj_boot_config *)to_virt(hpa);
mem_zero(bc, sizeof(*bc));
bc->memory_map.map_size = XJ_EFI_DESC_SIZE; /* 单描述符 */
bc->memory_map.buffer = XJ380_MEMMAP_GPA; /* 物理 GPA */
bc->memory_map.map_key = 0;
bc->memory_map.descriptor_size = XJ_EFI_DESC_SIZE;
bc->memory_map.descriptor_version = 1;
bc->fadt = XJ380_FADT_GPA;
bc->madt = XJ380_MADT_GPA;
bc->hpet = XJ380_HPET_GPA;
bc->mcfg = XJ380_MCFG_GPA;
bc->saved_mtrrs = (u64 *)mtrr_hpa; /* 物理 GPA */
u64 stack_hhdm = stack_gpa + XJ380_HHDM_OFFSET;
for (int i = 0; i < 256; i++) bc->temp_stack[i] = (u64 *)stack_hhdm;
bc->is_qemu = 1;
bc->boot_flags = XJ380_BOOT_FLAG_DISABLE_KMOD | XJ380_BOOT_FLAG_SAFE_STORAGE_IO;
/* installer paks 均为 0（安装器模式关闭） */
/* FrameBufferConfig：frame_buffer 传 HHDM 虚拟地址，pixel_format=1(kBGRR) */
xj_framebuffer_config *fbc = (xj_framebuffer_config *)to_virt(fbc_gpa);
mem_zero(fbc, sizeof(*fbc));
fbc->frame_buffer = (u8 *)(XJ380_GUEST_FB_GPA + XJ380_HHDM_OFFSET);
fbc->pixels_per_scan_line = XJ380_FB_WIDTH;
fbc->horizontal_resolution = XJ380_FB_WIDTH;
fbc->vertical_resolution = XJ380_FB_HEIGHT;
fbc->pixel_format = 1; /* kBGRR */
return 0;
}
/* ===== Module finder ===== */
void *xj380_find_kernel_module(u64 *size_out) {
if (!g_module_request.response) {
log_error("[XJ380] no Limine module response");
return (void *)0;
}
struct limine_module_response *resp = g_module_request.response;
for (u64 i = 0; i < resp->module_count; i++) {
struct limine_file *file = resp->modules[i];
if (!file || !file->path) continue;
/* 路径含 "xj380"（大小写不敏感） */
const char *p = file->path;
int match = 0;
for (const char *s = p; *s; s++) {
if ((s[0] == 'x' || s[0] == 'X') &&
(s[1] == 'j' || s[1] == 'J') &&
(s[2] == '3' || s[2] == '3') &&
(s[3] == '8' || s[3] == '8') &&
(s[4] == '0' || s[4] == '0')) {
match = 1;
break;
}
}
if (!match) continue;
if (size_out) *size_out = file->size;
log_info("[XJ380] found kernel module:");
log_info(file->path);
log_hex64("[XJ380] module size=", file->size);
return file->address;
}
log_warn("[XJ380] no kernel.krl module found");
return (void *)0;
}
/* ===== 主加载入口 ===== */
int xj380_loader_init(void) {
log_info("[XJ380] loader init begin");
/* 1. 查找 kernel.krl 模块 */
u64 krl_size = 0;
void *krl = xj380_find_kernel_module(&krl_size);
if (!krl) {
log_warn("[XJ380] no kernel.krl found, skipping XJ380 guest");
return -1;
}
/* 2. 解析 ELF */
u64 entry, span;
if (xj380_parse_elf(krl, krl_size, &entry, &span) != 0) {
log_error("[XJ380] kernel.krl parse failed");
return -2;
}
if (entry < XJ380_KERNEL_VADDR || entry >= XJ380_KERNEL_VADDR + span) {
log_error("[XJ380] entry outside kernel window");
return -3;
}
/* 3. 分配 boot area 缓冲（按页） */
dkm_dma_buffer pgt_buf, gdt_buf, madt_buf, fadt_buf, mcfg_buf, hpet_buf;
dkm_dma_buffer memmap_buf, bootcfg_buf, mtrr_buf, stack_buf, fakeefi_buf, fbc_buf;
if (dma_alloc_pages(8, 4096, 0, &pgt_buf) != 0) { log_error("[XJ380] alloc pgt failed"); return -4; }
if (dma_alloc_pages(1, 4096, 0, &gdt_buf) != 0) { log_error("[XJ380] alloc gdt failed"); return -5; }
if (dma_alloc_pages(1, 4096, 0, &madt_buf) != 0) { log_error("[XJ380] alloc madt failed"); return -6; }
if (dma_alloc_pages(1, 4096, 0, &fadt_buf) != 0) { log_error("[XJ380] alloc fadt failed"); return -7; }
if (dma_alloc_pages(1, 4096, 0, &mcfg_buf) != 0) { log_error("[XJ380] alloc mcfg failed"); return -8; }
if (dma_alloc_pages(1, 4096, 0, &hpet_buf) != 0) { log_error("[XJ380] alloc hpet failed"); return -9; }
if (dma_alloc_pages(1, 4096, 0, &memmap_buf) != 0) { log_error("[XJ380] alloc memmap failed"); return -10; }
if (dma_alloc_pages(1, 4096, 0, &bootcfg_buf) != 0) { log_error("[XJ380] alloc bootcfg failed"); return -11; }
if (dma_alloc_pages(1, 4096, 0, &mtrr_buf) != 0) { log_error("[XJ380] alloc mtrr failed"); return -12; }
if (dma_alloc_pages(2, 4096, 0, &stack_buf) != 0) { log_error("[XJ380] alloc stack failed"); return -13; }
if (dma_alloc_pages(1, 4096, 0, &fakeefi_buf) != 0) { log_error("[XJ380] alloc fake efi failed"); return -14; }
if (dma_alloc_pages(1, 4096, 0, &fbc_buf) != 0) { log_error("[XJ380] alloc fbc failed"); return -15; }
/* 4. 分配内核缓冲并装入 PT_LOAD 段 */
u64 kernel_alloc = (span + 4095) & ~4095ULL;
dkm_dma_buffer kernel_buf;
if (dma_alloc_pages(kernel_alloc / 4096, 2 * 1024 * 1024, 0, &kernel_buf) != 0) {
log_error("[XJ380] failed to alloc kernel memory");
return -16;
}
{
const xj_elf64_ehdr *eh = (const xj_elf64_ehdr *)krl;
const xj_elf64_phdr *ph = (const xj_elf64_phdr *)((const u8 *)krl + eh->e_phoff);
u8 *dst = (u8 *)kernel_buf.virt;
for (u16 i = 0; i < eh->e_phnum; i++) {
if (ph[i].p_type != ELF_PT_LOAD) continue;
u64 off = ph[i].p_vaddr - XJ380_KERNEL_VADDR;
mem_copy(dst + off, (const u8 *)krl + ph[i].p_offset, ph[i].p_filesz);
if (ph[i].p_memsz > ph[i].p_filesz)
mem_zero(dst + off + ph[i].p_filesz, ph[i].p_memsz - ph[i].p_filesz);
}
log_hex64("[XJ380] kernel loaded HPA=", kernel_buf.phys);
}
/* 5. 分配 framebuffer 并清零 */
dkm_dma_buffer fb_buf;
if (dma_alloc_pages((XJ380_FB_SIZE + 4095) / 4096, 4096, 0, &fb_buf) != 0) {
log_error("[XJ380] failed to alloc framebuffer");
return -17;
}
{
u8 *fb = (u8 *)fb_buf.virt;
for (u64 i = 0; i < XJ380_FB_SIZE; i++) fb[i] = 0;
}
/* 6. 分配 guest RAM（1GB，降级 512MB/256MB） */
u64 ram_size = XJ380_GUEST_RAM_SIZE;
dkm_dma_buffer ram_buf;
if (dma_alloc_pages(ram_size / 4096, 2 * 1024 * 1024, 0, &ram_buf) != 0) {
log_warn("[XJ380] failed to alloc guest RAM (1GB), trying 512MB");
ram_size = 512 * 1024 * 1024;
if (dma_alloc_pages(ram_size / 4096, 2 * 1024 * 1024, 0, &ram_buf) != 0) {
log_warn("[XJ380] failed to alloc guest RAM (512MB), trying 256MB");
ram_size = XJ380_GUEST_RAM_MIN;
if (dma_alloc_pages(ram_size / 4096, 2 * 1024 * 1024, 0, &ram_buf) != 0) {
log_error("[XJ380] failed to alloc guest RAM (256MB minimum)");
return -18;
}
}
}
log_hex64("[XJ380] guest RAM HPA=", ram_buf.phys);
log_hex64("[XJ380] guest RAM size=", ram_size);
/* 7. 记录 guest 信息 */
g_guest.pgt_gpa = XJ380_PGT_GPA;
g_guest.gdt_gpa = XJ380_GDT_GPA;
g_guest.kernel_gpa = XJ380_GUEST_KERNEL_GPA;
g_guest.kernel_entry = entry;
g_guest.kernel_size = span;
g_guest.ram_gpa = XJ380_GUEST_RAM_GPA;
g_guest.ram_size = ram_size;
g_guest.fb_gpa = XJ380_GUEST_FB_GPA;
/* 8. 构造 guest 页表 / GDT */
xj380_build_page_tables(pgt_buf.phys, g_guest.kernel_gpa, span);
xj380_build_gdt(gdt_buf.phys);
log_hex64("[XJ380] page tables HPA=", pgt_buf.phys);
log_hex64("[XJ380] GDT HPA=", gdt_buf.phys);
/* 9. 构造 ACPI 桩表 */
xj380_build_madt(madt_buf.phys);
xj380_build_fadt(fadt_buf.phys);
xj380_build_mcfg(mcfg_buf.phys);
xj380_build_hpet(hpet_buf.phys);
/* 10. 构造内存图 + BOOT_CONFIG（含 MTRR 缓冲清零、伪 EFI 表清零） */
xj380_build_memmap(memmap_buf.phys);
mem_zero(mtrr_buf.virt, 4096);
mem_zero(fakeefi_buf.virt, 4096);
xj380_build_boot_config(bootcfg_buf.phys, mtrr_buf.phys, XJ380_STACK_GPA, fbc_buf.phys);
/* 11. EPT 映射所有 guest 区域。
* boot area 各缓冲独立分配，逐个按自身 GPA 映射。 */
if (ept_map_range(XJ380_PGT_GPA, pgt_buf.phys, XJ380_PGT_SIZE, EPT_READ | EPT_WRITE) != 0) {
log_error("[XJ380] EPT map page tables failed");
return -19;
}
if (ept_map_range(XJ380_GDT_GPA, gdt_buf.phys, 4096, EPT_READ | EPT_WRITE) != 0) {
log_error("[XJ380] EPT map GDT failed");
return -20;
}
if (ept_map_range(XJ380_MADT_GPA, madt_buf.phys, 4096, EPT_READ | EPT_WRITE) != 0) {
log_error("[XJ380] EPT map MADT failed");
return -21;
}
if (ept_map_range(XJ380_FADT_GPA, fadt_buf.phys, 4096, EPT_READ | EPT_WRITE) != 0) {
log_error("[XJ380] EPT map FADT failed");
return -22;
}
if (ept_map_range(XJ380_MCFG_GPA, mcfg_buf.phys, 4096, EPT_READ | EPT_WRITE) != 0) {
log_error("[XJ380] EPT map MCFG failed");
return -23;
}
if (ept_map_range(XJ380_HPET_GPA, hpet_buf.phys, 4096, EPT_READ | EPT_WRITE) != 0) {
log_error("[XJ380] EPT map HPET failed");
return -24;
}
if (ept_map_range(XJ380_MEMMAP_GPA, memmap_buf.phys, 4096, EPT_READ | EPT_WRITE) != 0) {
log_error("[XJ380] EPT map memory map failed");
return -25;
}
if (ept_map_range(XJ380_BOOTCFG_GPA, bootcfg_buf.phys, 4096, EPT_READ | EPT_WRITE) != 0) {
log_error("[XJ380] EPT map BOOT_CONFIG failed");
return -26;
}
if (ept_map_range(XJ380_MTRR_GPA, mtrr_buf.phys, 4096, EPT_READ | EPT_WRITE) != 0) {
log_error("[XJ380] EPT map MTRR buffer failed");
return -27;
}
if (ept_map_range(XJ380_STACK_GPA, stack_buf.phys, 8192, EPT_READ | EPT_WRITE) != 0) {
log_error("[XJ380] EPT map stack failed");
return -28;
}
if (ept_map_range(XJ380_FAKEEFI_GPA, fakeefi_buf.phys, 4096, EPT_READ | EPT_WRITE) != 0) {
log_error("[XJ380] EPT map fake EFI table failed");
return -29;
}
if (ept_map_range(XJ380_FBC_GPA, fbc_buf.phys, 4096, EPT_READ | EPT_WRITE) != 0) {
log_error("[XJ380] EPT map FrameBufferConfig failed");
return -30;
}
if (ept_map_range(g_guest.fb_gpa, fb_buf.phys, XJ380_FB_SIZE,
EPT_READ | EPT_WRITE) != 0) {
log_error("[XJ380] EPT map framebuffer failed");
return -31;
}
if (ept_map_range(g_guest.kernel_gpa, kernel_buf.phys, kernel_alloc,
EPT_RWX) != 0) {
log_error("[XJ380] EPT map kernel failed");
return -32;
}
if (ept_map_range(g_guest.ram_gpa, ram_buf.phys, ram_size,
EPT_RWX) != 0) {
log_error("[XJ380] EPT map guest RAM failed");
return -33;
}
/* 低 1MB 恒等映射（BIOS 区，与 linux_loader 一致；<1MB 无需按需分配） */
if (ept_identity_map(0, 0x100000, EPT_RWX) != 0) {
log_warn("[XJ380] EPT identity map first 1MB failed (non-critical)");
}
/* 12. 完成 */
g_guest.loaded = 1;
log_hex64("[XJ380] kernel GPA=", g_guest.kernel_gpa);
log_hex64("[XJ380] kernel entry=", g_guest.kernel_entry);
log_hex64("[XJ380] kernel size=", g_guest.kernel_size);
log_hex64("[XJ380] RAM GPA=", g_guest.ram_gpa);
log_hex64("[XJ380] RAM size=", g_guest.ram_size);
log_info("[XJ380] loader init ok");
return 0;
}
const struct xj380_guest_info *xj380_get_guest_info(void) {
return g_guest.loaded ? &g_guest : (struct xj380_guest_info *)0;
}
CODE/UTSM/vmm/xj380_loader.d
+10
View File
@@ -0,0 +1,10 @@
vmm/xj380_loader.o: vmm\xj380_loader.c include\utsm\xj380_loader.h \
include\utsm\types.h include\utsm\vmx.h include\utsm\ept.h \
include\utsm\log.h include\utsm\dma.h vmm\..\arch\x86_64\limine.h
include\utsm\xj380_loader.h:
include\utsm\types.h:
include\utsm\vmx.h:
include\utsm\ept.h:
include\utsm\log.h:
include\utsm\dma.h:
vmm\..\arch\x86_64\limine.h: