feat: B7 APIC/IOAPIC接管 + NVMe写路径 + virtio_net virtqueue + PE兼容层修复 + QEMU测试套件全自动化
中断路由 (B7): - apic.drv: LAPIC enable + IOAPIC重定向表编程(MADT ISO感知) + apic_route/apic_route_legacy/apic_diag开关 - UTSM: LAPIC EOI钩子(register_apic_eoi, ABI尾部追加) + IDT 0-255全覆盖 + spurious 0xFF特判 - FUCK: apic_route=0默认PIC(零回归) / =1 IOAPIC->LAPIC接管(失败完整降级) / legacy放开IRQ1/12/11 存储: - nvme.drv: 写路径 + PRP list + 读回校验 + MSI/MSI-X中断驱动(nvme_msi开关, 回退纯轮询) - build.ps1: apic.drv纳入构建(原为预置二进制) 网络: - virtio_net: virtqueue RX/TX + netdev注册 + DHCP自测(slirp真实OFFER) PE兼容层: - pe_shim: guest->host指针转换(g_emu_mem_base + gp()) + shim fn32列补齐 - gen_pe.py: PE32+ RVA偏置修复(BUG-004) + cmd.exe生成 - desktop_app.h: da_mouse_poll先判AUX位 + da_mouse_init冲刷残留(BUG-003/008) - shell: Ctrl修饰键跟踪(BUG-001) + g_run_image扩至1MB(BUG-002) QEMU测试套件: - 9用例全自动化(Run-All.ps1): boot-regression/driver-matrix/linux-compat/pe-compat/deaicup-e2e/userapps-matrix/network-e2e/performance-baseline/x86emu32-coverage - QemuTest.ps1公共库: 串口断言/monitor sendkey/screendump/HTTP服务器/并发隔离 文档: - CLAUDE.md: APIC/IOAPIC能力 + kernel_api暴露 + IRQ后端升级状态 - LESSONS_LEARNED.md: B7 LAPIC/IOAPIC经验教训(2条) - Bug记录.txt: BUG-20260801-001~008 + BUG-20260803-009(9条) - test-cases/*.md: 全部补充自动化脚本小节 - 桌面设计.md: .lnk快捷方式 + LINUXAPP.CNF Linux应用图标 - 系统开发策划.md: NVMe/virtio_net标完成 + B2/B7标已解决 + M2进度列
This commit is contained in:
xyou
+970
-55
@@ -1,4 +1,4 @@
|
||||
/* DKM APIC Driver — APIC discovery + IOAPIC init + LAPIC enable
|
||||
/* DKM APIC Driver — APIC discovery + IOAPIC init + LAPIC enable + 路由接管
|
||||
* Stage 0, required, depends on "timer", provides "irq" and "apic".
|
||||
*
|
||||
* 真机路径:
|
||||
@@ -8,6 +8,40 @@
|
||||
* 3. MADT ISO (Interrupt Source Override) 处理: 按 ACPI 规范修正 IRQ→GSI 映射
|
||||
* 4. SIPI 多核启动框架 (预留, 未实现)
|
||||
*
|
||||
* B7 路由接管 (apic_route):
|
||||
* FUCK [drivers] apic_route=1 时, 本驱动在初始化末尾尝试把中断路由
|
||||
* 从 8259 PIC 切换到 IOAPIC→LAPIC 路径:
|
||||
* a. 经 kernel_api.register_apic_eoi 向 UTSM 注册 LAPIC EOI 钩子
|
||||
* (B7 阶段2 接口; idt_handler 两个 IRQ 分支在分发末尾调用之)
|
||||
* b. 注册 PIT tick 计数 handler 于 vector 0x20 — 即 idt_handler 的
|
||||
* PIC 分支 (0x20-0x2F), 与键盘 0x21/鼠标 0x2C/网卡 0x2B 同一代码
|
||||
* 路径; handler 返回 0 由钩子完成 LAPIC EOI, 重复投递 >=2 即证明
|
||||
* "legacy vector 分支 + 钩子 EOI" 全链路可持续 (阶段1 用 0xE0 自
|
||||
* EOI 只证明了 APIC 分支)
|
||||
* c. 按 ISO 表解析 PIT GSI (QEMU q35: IRQ0→GSI2), 解屏蔽该条目
|
||||
* d. LAPIC TPR=0 全放行, PIC IMR 全 1 屏蔽 (QEMU 无功能 IMCR 寄存器,
|
||||
* PIC 全屏蔽即等效切换; 8259 与 IOAPIC 同时监听 IRQ 线, 全屏蔽避免双投递)
|
||||
* e. PIT ch0 mode3 100Hz 产生真实硬件中断, 500ms 窗口内计数 >=2 次
|
||||
* 即证明 IOAPIC→LAPIC→IDT→handler→钩子EOI 全链路
|
||||
* f. 验证失败完整降级: IOAPIC 全 mask + 恢复原 PIC IMR + 注销 handler
|
||||
* 与 EOI 钩子, 系统行为与切换前完全一致
|
||||
*
|
||||
* B7 阶段2 (apic_route_legacy):
|
||||
* EOI 钩子落地后, legacy IRQ1(键盘 0x21)/IRQ12(鼠标 0x2C)/IRQ11(e1000
|
||||
* 0x2B) 重定向项可持续投递, 不再是 one-shot。ISA 线按 MADT ISO 极性/触发
|
||||
* (缺省 edge/active-high); PCI 线 (IRQ11) 无 ISO 覆盖时强制 level/
|
||||
* active-low (PCI INTx 规范; QEMU 内部 pci irq 电平语义与之匹配,
|
||||
* Linux/Windows 同配置)。e1000 handler 读 ICR 清源后电平 deassert,
|
||||
* 由钩子 EOI 完成 LAPIC 侧清扫。
|
||||
*
|
||||
* apic_diag=1 诊断:
|
||||
* - HPET 绝对时基对拍: 解析 ACPI HPET 表 (QEMU q35 有, 100MHz 主计数器),
|
||||
* 用主计数器实测 tsc_calibrate 的 10ms 窗口与 route 验证的 500ms 窗口,
|
||||
* 定论 "tick 2x" 根因 (TSC 校准测半 vs PIT mode3 双触发)
|
||||
* - PS/2 鼠标流: 初始化 AUX 端口 + 注册 IRQ12 诊断 handler, 配合
|
||||
* QEMU monitor mouse_move 验证 IRQ12 持续投递 (计数 + 观察窗)
|
||||
* diag 只增观测不改变量路由语义, 默认 0 关闭。
|
||||
*
|
||||
* QEMU 兼容:
|
||||
* - QEMU 默认只提供 1 个 IOAPIC, 24 条 GSI
|
||||
* - 实机可能有多个 IOAPIC, GSI 范围更大
|
||||
@@ -61,6 +95,11 @@ struct dkm_kernel_api {
|
||||
const void *mmio;
|
||||
void *(*mm_map_mmio)(u64 phys, u64 size);
|
||||
void (*mm_unmap_mmio)(void *virt, u64 size);
|
||||
/* B7 阶段2 尾部追加 (旧内核无此字段 -> 判空使用) */
|
||||
void (*register_apic_eoi)(void (*eoi_fn)(void));
|
||||
/* B7 阶段3 尾部追加 (本驱动不使用, 保持布局与 UTSM 一致) */
|
||||
int (*irq_vector_alloc)(void);
|
||||
void (*irq_vector_free)(int vector);
|
||||
};
|
||||
|
||||
struct dkm_driver_handle;
|
||||
@@ -95,7 +134,7 @@ const struct dkm_driver_desc driver_desc = {
|
||||
.abi_version = DKM_ABI_VERSION,
|
||||
.desc_size = sizeof(struct dkm_driver_desc),
|
||||
.name = "apic",
|
||||
.version = "0.1.0",
|
||||
.version = "0.2.0",
|
||||
.vendor = "Deshab",
|
||||
.driver_class = 3, /* DKM_CLASS_INTERRUPT */
|
||||
.stage = 0,
|
||||
@@ -149,6 +188,45 @@ typedef struct __attribute__((packed)) {
|
||||
u32 flags;
|
||||
} acpi_madt;
|
||||
|
||||
/* ACPI HPET 表 (signature "HPET") — apic_diag 绝对时基对拍用 */
|
||||
typedef struct __attribute__((packed)) {
|
||||
acpi_sdt_header hdr;
|
||||
u32 event_timer_block_id;
|
||||
/* ACPI Generic Address Structure (GAS) */
|
||||
u8 addr_space_id; /* 0 = system memory */
|
||||
u8 register_bit_width;
|
||||
u8 register_bit_offset;
|
||||
u8 access_size;
|
||||
u64 base_addr; /* HPET MMIO 物理基址 (QEMU: 0xFED00000) */
|
||||
u8 hpet_number;
|
||||
u16 min_clock_tick;
|
||||
u8 page_protection;
|
||||
} acpi_hpet;
|
||||
|
||||
/* Limine boot module 最小类型 (与 bootfs.drv / UTSM limine.h 布局一致) */
|
||||
struct limine_file_min {
|
||||
u64 revision;
|
||||
void *address;
|
||||
u64 size;
|
||||
char *path;
|
||||
char *cmdline;
|
||||
u32 media_type;
|
||||
u32 unused;
|
||||
u32 tftp_ip;
|
||||
u32 tftp_port;
|
||||
u32 partition_index;
|
||||
u32 mbr_disk_id;
|
||||
u8 gpt_disk_uuid[16];
|
||||
u8 gpt_part_uuid[16];
|
||||
u8 part_uuid[16];
|
||||
};
|
||||
|
||||
struct limine_module_response_min {
|
||||
u64 revision;
|
||||
u64 module_count;
|
||||
struct limine_file_min **modules;
|
||||
};
|
||||
|
||||
/* ---- IOAPIC 信息存储（真机多 IOAPIC 支持） ---- */
|
||||
|
||||
#define MAX_IOAPIC 4
|
||||
@@ -186,7 +264,22 @@ struct madt_info {
|
||||
struct lapic_entry lapics[MAX_LAPIC];
|
||||
};
|
||||
|
||||
/* ---- B7 路由接管配置 (FUCK [drivers]) ---- */
|
||||
struct apic_config {
|
||||
int lapic_enable; /* lapic_enable, 默认 1 */
|
||||
int ioapic_init; /* ioapic_init, 默认 1 */
|
||||
int apic_route; /* apic_route, 默认 0 (PIC 路由, 现状) */
|
||||
int apic_route_legacy; /* apic_route_legacy, 默认 0 */
|
||||
int apic_diag; /* apic_diag, 默认 0 (HPET 校准/投递计数/鼠标流诊断) */
|
||||
};
|
||||
|
||||
static const struct dkm_log_api *g_log;
|
||||
static struct apic_config g_cfg = { 1, 1, 0, 0, 0 };
|
||||
|
||||
static volatile u32 *g_lapic; /* LAPIC MMIO 映射基址, 0=未映射 */
|
||||
static u32 g_lapic_id; /* BSP Local APIC ID (IOAPIC 目的 ID) */
|
||||
static volatile u32 g_tick_count; /* PIT tick 计数 (路由验证) */
|
||||
static int g_route_active; /* 1=IOAPIC 路由已接管 */
|
||||
|
||||
static __inline__ void apic_mb(void) {
|
||||
__asm__ volatile("" ::: "memory");
|
||||
@@ -199,6 +292,24 @@ static int memeq(const char *a, const char *b, u32 n) {
|
||||
return 1;
|
||||
}
|
||||
|
||||
static u32 str_len(const char *s) {
|
||||
u32 n = 0;
|
||||
while (s[n]) n++;
|
||||
return n;
|
||||
}
|
||||
|
||||
/* 在 NUL 结尾字符串中查找子串 (cmdline 匹配用) */
|
||||
static int str_contains(const char *hay, const char *needle) {
|
||||
u32 nlen = str_len(needle);
|
||||
if (!nlen) return 1;
|
||||
for (u32 i = 0; hay[i]; i++) {
|
||||
u32 j = 0;
|
||||
while (j < nlen && hay[i + j] && hay[i + j] == needle[j]) j++;
|
||||
if (j == nlen) return 1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static u8 checksum8(const u8 *data, u32 len) {
|
||||
u8 sum = 0;
|
||||
for (u32 i = 0; i < len; i++) sum += data[i];
|
||||
@@ -219,6 +330,37 @@ static void log_hex(const char *prefix, u64 val) {
|
||||
g_log->info(buf);
|
||||
}
|
||||
|
||||
static void log_dec(const char *prefix, u64 val) {
|
||||
char buf[24];
|
||||
u32 pos = 0;
|
||||
if (!val) {
|
||||
buf[pos++] = '0';
|
||||
} else {
|
||||
char tmp[20];
|
||||
u32 n = 0;
|
||||
while (val) { tmp[n++] = (char)('0' + (val % 10)); val /= 10; }
|
||||
while (n) buf[pos++] = tmp[--n];
|
||||
}
|
||||
buf[pos] = 0;
|
||||
g_log->info(prefix);
|
||||
g_log->info(buf);
|
||||
}
|
||||
|
||||
/* ---- I/O 端口 (PIC / PIT) ---- */
|
||||
static __inline__ void outb(u16 port, u8 value) {
|
||||
__asm__ volatile ("outb %0, %1" :: "a"(value), "Nd"(port));
|
||||
}
|
||||
|
||||
static __inline__ u8 inb(u16 port) {
|
||||
u8 value;
|
||||
__asm__ volatile ("inb %1, %0" : "=a"(value) : "Nd"(port));
|
||||
return value;
|
||||
}
|
||||
|
||||
static __inline__ void io_wait(void) {
|
||||
outb(0x80, 0);
|
||||
}
|
||||
|
||||
static void cpuid(u32 leaf, u32 *a, u32 *b, u32 *c, u32 *d) {
|
||||
__asm__ volatile ("cpuid"
|
||||
: "=a"(*a), "=b"(*b), "=c"(*c), "=d"(*d)
|
||||
@@ -232,6 +374,12 @@ static u64 rdmsr(u32 msr) {
|
||||
return ((u64)hi << 32) | lo;
|
||||
}
|
||||
|
||||
static void wrmsr(u32 msr, u64 val) {
|
||||
u32 lo = (u32)(val & 0xffffffffu);
|
||||
u32 hi = (u32)(val >> 32);
|
||||
__asm__ volatile("wrmsr" :: "a"(lo), "d"(hi), "c"(msr));
|
||||
}
|
||||
|
||||
static int cpu_has_lapic(void) {
|
||||
u32 a, b, c, d;
|
||||
cpuid(1, &a, &b, &c, &d);
|
||||
@@ -241,6 +389,131 @@ static int cpu_has_lapic(void) {
|
||||
return (d & (1u << 9)) != 0;
|
||||
}
|
||||
|
||||
/* ---- FUCK 配置自解析 (DKM 侧, 不依赖 UTSM ini_parser) ---- *
|
||||
* UTSM 通过 Limine boot module (cmdline="fuck:config") 预加载 FUCK;
|
||||
* kernel_api.boot_modules_response 对所有 DKM 驱动可见。
|
||||
* 此处实现最小分区感知 INI 扫描: 只找 [drivers] 分区下的目标键。
|
||||
* 缺失文件/缺失键一律回退默认值, 行为与无配置时一致。
|
||||
*/
|
||||
|
||||
/* 解析值 token: 支持 0/1/true/false/on/off/yes/no 及十进制整数 */
|
||||
static int parse_scalar(const char *line, u64 start, u64 line_len, int defval) {
|
||||
u64 i = start;
|
||||
while (i < line_len && (line[i] == ' ' || line[i] == '\t')) i++;
|
||||
u64 tok_start = i;
|
||||
while (i < line_len && line[i] != ' ' && line[i] != '\t' &&
|
||||
line[i] != '#' && line[i] != ';' && line[i] != '\r') i++;
|
||||
u64 tok_len = i - tok_start;
|
||||
const char *tok = line + tok_start;
|
||||
if (!tok_len) return defval;
|
||||
if (tok_len == 1 && tok[0] == '1') return 1;
|
||||
if (tok_len == 1 && tok[0] == '0') return 0;
|
||||
if (tok_len == 4 && memeq(tok, "true", 4)) return 1;
|
||||
if (tok_len == 5 && memeq(tok, "false", 5)) return 0;
|
||||
if (tok_len == 2 && memeq(tok, "on", 2)) return 1;
|
||||
if (tok_len == 3 && memeq(tok, "off", 3)) return 0;
|
||||
if (tok_len == 3 && memeq(tok, "yes", 3)) return 1;
|
||||
if (tok_len == 2 && memeq(tok, "no", 2)) return 0;
|
||||
/* 十进制整数 (允许前导 '-') */
|
||||
int neg = 0;
|
||||
u64 j = 0;
|
||||
if (tok[0] == '-') { neg = 1; j = 1; }
|
||||
int val = 0;
|
||||
int any = 0;
|
||||
for (; j < tok_len; j++) {
|
||||
if (tok[j] < '0' || tok[j] > '9') return defval;
|
||||
val = val * 10 + (tok[j] - '0');
|
||||
any = 1;
|
||||
}
|
||||
if (!any) return defval;
|
||||
return neg ? -val : val;
|
||||
}
|
||||
|
||||
static int fuck_get_int(const char *text, u64 size,
|
||||
const char *section, const char *key, int defval) {
|
||||
u64 pos = 0;
|
||||
int in_section = 0;
|
||||
u32 slen = str_len(section);
|
||||
u32 klen = str_len(key);
|
||||
|
||||
while (pos < size) {
|
||||
u64 end = pos;
|
||||
while (end < size && text[end] != '\n') end++;
|
||||
u64 line_len = end - pos;
|
||||
if (line_len > 0 && text[pos + line_len - 1] == '\r') line_len--;
|
||||
const char *line = text + pos;
|
||||
|
||||
u64 i = 0;
|
||||
while (i < line_len && (line[i] == ' ' || line[i] == '\t')) i++;
|
||||
if (i < line_len) {
|
||||
char c = line[i];
|
||||
if (c == '#' || c == ';') {
|
||||
/* 注释行, 跳过 */
|
||||
} else if (c == '[') {
|
||||
in_section = 0;
|
||||
if (line_len >= (u64)(i + 1 + slen + 1) &&
|
||||
memeq(line + i + 1, section, slen) &&
|
||||
line[i + 1 + slen] == ']') {
|
||||
in_section = 1;
|
||||
}
|
||||
} else if (in_section) {
|
||||
if (line_len >= (u64)(i + klen) &&
|
||||
memeq(line + i, key, klen)) {
|
||||
u64 j = i + klen;
|
||||
while (j < line_len && (line[j] == ' ' || line[j] == '\t')) j++;
|
||||
if (j < line_len && line[j] == '=') {
|
||||
return parse_scalar(line, j + 1, line_len, defval);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
pos = end + 1;
|
||||
}
|
||||
return defval;
|
||||
}
|
||||
|
||||
static void load_fuck_config(const struct dkm_kernel_api *api) {
|
||||
/* 编译期默认: 与 FUCK 注释承诺一致 (无配置时行为不变) */
|
||||
g_cfg.lapic_enable = 1;
|
||||
g_cfg.ioapic_init = 1;
|
||||
g_cfg.apic_route = 0;
|
||||
g_cfg.apic_route_legacy = 0;
|
||||
g_cfg.apic_diag = 0;
|
||||
|
||||
const struct limine_module_response_min *resp =
|
||||
(const struct limine_module_response_min *)api->boot_modules_response;
|
||||
if (!resp || !resp->modules) {
|
||||
g_log->warn("[apic] no boot modules; FUCK defaults in effect");
|
||||
return;
|
||||
}
|
||||
|
||||
for (u64 i = 0; i < resp->module_count; i++) {
|
||||
struct limine_file_min *f = resp->modules[i];
|
||||
if (!f || !f->cmdline || !f->address || !f->size) continue;
|
||||
if (!str_contains(f->cmdline, "fuck:config")) continue;
|
||||
|
||||
const char *text = (const char *)f->address;
|
||||
u64 size = f->size;
|
||||
g_log->info("[apic] FUCK config module found");
|
||||
log_hex("[apic] FUCK size=", size);
|
||||
|
||||
g_cfg.lapic_enable = fuck_get_int(text, size, "drivers", "lapic_enable", 1);
|
||||
g_cfg.ioapic_init = fuck_get_int(text, size, "drivers", "ioapic_init", 1);
|
||||
g_cfg.apic_route = fuck_get_int(text, size, "drivers", "apic_route", 0);
|
||||
g_cfg.apic_route_legacy = fuck_get_int(text, size, "drivers", "apic_route_legacy", 0);
|
||||
g_cfg.apic_diag = fuck_get_int(text, size, "drivers", "apic_diag", 0);
|
||||
|
||||
log_dec("[apic] cfg lapic_enable=", (u64)g_cfg.lapic_enable);
|
||||
log_dec("[apic] cfg ioapic_init=", (u64)g_cfg.ioapic_init);
|
||||
log_dec("[apic] cfg apic_route=", (u64)g_cfg.apic_route);
|
||||
log_dec("[apic] cfg apic_route_legacy=", (u64)g_cfg.apic_route_legacy);
|
||||
log_dec("[apic] cfg apic_diag=", (u64)g_cfg.apic_diag);
|
||||
return;
|
||||
}
|
||||
|
||||
g_log->warn("[apic] FUCK module (fuck:config) not found; defaults in effect");
|
||||
}
|
||||
|
||||
static const acpi_sdt_header *find_table_from_rsdt(const acpi_sdt_header *rsdt, const char sig[4], u32 entry_size) {
|
||||
if (!rsdt || rsdt->length < sizeof(acpi_sdt_header)) return NULL;
|
||||
if (checksum8((const u8 *)rsdt, rsdt->length) != 0) return NULL;
|
||||
@@ -288,6 +561,27 @@ static const acpi_madt *find_madt(const void *rsdp_addr) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/* 查找 HPET 表 (apic_diag 用; 与 find_madt 同构, 仅签名不同) */
|
||||
static const acpi_hpet *find_hpet(const void *rsdp_addr) {
|
||||
if (!rsdp_addr) return NULL;
|
||||
const acpi_rsdp_v2 *rsdp = (const acpi_rsdp_v2 *)rsdp_addr;
|
||||
if (!memeq(rsdp->signature, "RSD PTR ", 8)) return NULL;
|
||||
if (checksum8((const u8 *)rsdp, 20) != 0) return NULL;
|
||||
if (rsdp->revision >= 2 && rsdp->length >= sizeof(acpi_rsdp_v2) && rsdp->xsdt_addr) {
|
||||
if (checksum8((const u8 *)rsdp, rsdp->length) == 0) {
|
||||
const acpi_sdt_header *xsdt = (const acpi_sdt_header *)(uintptr_t)rsdp->xsdt_addr;
|
||||
const acpi_sdt_header *hpet = find_table_from_rsdt(xsdt, "HPET", 8);
|
||||
if (hpet) return (const acpi_hpet *)hpet;
|
||||
}
|
||||
}
|
||||
if (rsdp->rsdt_addr) {
|
||||
const acpi_sdt_header *rsdt = (const acpi_sdt_header *)(uintptr_t)(u64)rsdp->rsdt_addr;
|
||||
const acpi_sdt_header *hpet = find_table_from_rsdt(rsdt, "HPET", 4);
|
||||
if (hpet) return (const acpi_hpet *)hpet;
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
static void parse_madt_entries(const acpi_madt *madt, struct madt_info *info) {
|
||||
const u8 *base = (const u8 *)madt;
|
||||
u32 off = (u32)sizeof(acpi_madt);
|
||||
@@ -376,18 +670,19 @@ static void ioapic_write(volatile u32 *base, u8 reg, u32 val) {
|
||||
base[IOAPIC_IOWIN / 4] = val;
|
||||
}
|
||||
|
||||
/* IOAPIC 重定向表项 (64-bit, 分两次 32-bit 读写)
|
||||
/* IOAPIC 重定向表项 (64-bit, 分两次 32-bit 读写, 82093AA 规范布局)
|
||||
* bits 0-7: interrupt vector (0x20-0xFF)
|
||||
* bit 8: delivery mode: 0=fixed, 1=lowest, 2=SMI, 4=NMI, 5=INIT, 7=ExtINT
|
||||
* bit 9: destination mode: 0=physical, 1=logical
|
||||
* bit 10: delivery status (RO)
|
||||
* bit 11: polarity: 0=active high, 1=active low
|
||||
* bit 12: remote IRR (RO, level-triggered only)
|
||||
* bit 13: trigger mode: 0=edge, 1=level
|
||||
* bit 14: mask: 0=enabled, 1=masked
|
||||
* bit 15: reserved
|
||||
* bits 16-55: reserved
|
||||
* bits 8-10: delivery mode: 0=fixed, 1=lowest, 2=SMI, 4=NMI, 5=INIT, 7=ExtINT
|
||||
* bit 11: destination mode: 0=physical, 1=logical
|
||||
* bit 12: delivery status (RO)
|
||||
* bit 13: polarity: 0=active high, 1=active low
|
||||
* bit 14: remote IRR (RO, level-triggered only)
|
||||
* bit 15: trigger mode: 0=edge, 1=level
|
||||
* bit 16: mask: 0=enabled, 1=masked
|
||||
* bits 17-55: reserved
|
||||
* bits 56-63: destination APIC ID (physical mode) or MDA (logical mode)
|
||||
* 注: 历史版本曾将 polarity/trigger/mask 错置于 bit 11/13/14,
|
||||
* 导致 mask 写入只读 remote IRR 位而从未生效 —— 勿回退。
|
||||
*/
|
||||
static u64 ioapic_read_redir(volatile u32 *base, u8 entry) {
|
||||
u32 lo = ioapic_read(base, (u8)(0x10 + entry * 2));
|
||||
@@ -400,13 +695,96 @@ static void ioapic_write_redir(volatile u32 *base, u8 entry, u64 val) {
|
||||
ioapic_write(base, (u8)(0x10 + entry * 2 + 1), (u32)(val >> 32));
|
||||
}
|
||||
|
||||
/* ---- B7: GSI 路由辅助 ---- */
|
||||
|
||||
/* 合成重定向表项: vector + ISO 极性/触发 + 物理目的 APIC ID + mask 位 */
|
||||
static u64 redir_compose(u32 vector, u16 iso_flags, u32 dest_apic_id, int masked) {
|
||||
u64 entry = (u64)(vector & 0xFFu);
|
||||
/* delivery mode = fixed (0), destination mode = physical (0) */
|
||||
|
||||
/* 极性: bit 13. ISA 默认 active-high (0).
|
||||
* ISO flags bit 0-1: 0=conforms, 1=active-high, 2=reserved, 3=active-low */
|
||||
if ((iso_flags & 0x03u) == 0x03u) entry |= (1ULL << 13);
|
||||
|
||||
/* 触发: bit 15. ISA 默认 edge (0).
|
||||
* ISO flags bit 2-3: 0=conforms, 1=edge, 2=reserved, 3=level */
|
||||
if ((iso_flags & 0x0Cu) == 0x0Cu) entry |= (1ULL << 15);
|
||||
|
||||
entry |= ((u64)dest_apic_id << 56);
|
||||
if (masked) entry |= (1ULL << 16);
|
||||
return entry;
|
||||
}
|
||||
|
||||
/* 找覆盖指定 GSI 的 IOAPIC (多 IOAPIC 按 GSI 范围划分) */
|
||||
static struct ioapic_info *ioapic_for_gsi(struct madt_info *info, u32 gsi) {
|
||||
for (u32 i = 0; i < info->ioapic_count; i++) {
|
||||
struct ioapic_info *io = &info->ioapics[i];
|
||||
if (gsi >= io->gsi_base && gsi < io->gsi_base + io->gsi_count) return io;
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/* ISA IRQ → GSI 解析: 优先 MADT ISO override, 缺省恒等 (QEMU ISA 惯例) */
|
||||
static u32 isa_irq_to_gsi(u8 isa_irq, u16 *flags_out,
|
||||
const struct iso_info *isos, u32 iso_count) {
|
||||
for (u32 i = 0; i < iso_count; i++) {
|
||||
if (isos[i].bus_source == isa_irq) {
|
||||
*flags_out = isos[i].flags;
|
||||
return isos[i].gsi;
|
||||
}
|
||||
}
|
||||
*flags_out = 0;
|
||||
return (u32)isa_irq;
|
||||
}
|
||||
|
||||
/* 编程单个 GSI 的重定向项 (unmask=1 放开投递, 0 保持屏蔽) */
|
||||
static int ioapic_program_gsi(struct madt_info *info, u32 gsi,
|
||||
u32 vector, u16 iso_flags, int unmask) {
|
||||
struct ioapic_info *io = ioapic_for_gsi(info, gsi);
|
||||
if (!io || !io->mmio) return -1;
|
||||
u8 pin = (u8)(gsi - io->gsi_base);
|
||||
ioapic_write_redir(io->mmio, pin,
|
||||
redir_compose(vector, iso_flags, g_lapic_id, !unmask));
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* 全 IOAPIC 全条目屏蔽 (降级路径) — 保留 vector 信息, 仅置 mask 位 */
|
||||
static void ioapic_mask_all(struct madt_info *info) {
|
||||
for (u32 i = 0; i < info->ioapic_count; i++) {
|
||||
struct ioapic_info *io = &info->ioapics[i];
|
||||
if (!io->mmio) continue;
|
||||
for (u32 pin = 0; pin < io->gsi_count && pin < 64; pin++) {
|
||||
u64 entry = ioapic_read_redir(io->mmio, (u8)pin);
|
||||
entry |= (1ULL << 16);
|
||||
ioapic_write_redir(io->mmio, (u8)pin, entry);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* 重定向表回读 dump (验证证据) */
|
||||
static void ioapic_dump_table(struct madt_info *info) {
|
||||
for (u32 i = 0; i < info->ioapic_count; i++) {
|
||||
struct ioapic_info *io = &info->ioapics[i];
|
||||
if (!io->mmio) continue;
|
||||
g_log->info("[apic] IOREDTBL readback:");
|
||||
for (u32 pin = 0; pin < io->gsi_count && pin < 24; pin++) {
|
||||
u64 entry = ioapic_read_redir(io->mmio, (u8)pin);
|
||||
u32 vec = (u32)(entry & 0xFFu);
|
||||
u32 masked = (u32)((entry >> 16) & 1u);
|
||||
log_dec("[apic] pin=", pin);
|
||||
log_hex("[apic] vec=", vec);
|
||||
log_dec("[apic] mask=", masked);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* ---- IOAPIC 初始化 ---- *
|
||||
* 逐条目编程重定向表: ISA IRQ→vector 映射 + mask all。
|
||||
* 真机关键: 处理 MADT ISO (IRQ0→GSI2 是最常见的 override)。
|
||||
* PIC 兼容模式: vector = 0x20 + IRQ (与 PIC remap 布局一致)。
|
||||
*
|
||||
* **QEMU 无法测试但真机必需的代码路径**:
|
||||
* 1. ISO 处理: 真机几乎总有 IRQ0→GSI2 override, QEMU 默认无 override
|
||||
* 1. ISO 处理: 真机几乎总有 IRQ0→GSI2 override, QEMU 默认有 1 条
|
||||
* 2. 极性标志: 真机 ISA IRQ0 (timer) 必须设 active-high,
|
||||
* 但 ISO 可能指定 active-low (PCIe SCI 等)
|
||||
* 3. 多 IOAPIC: 真机可能有 2+ IOAPIC, 每个 GSI 范围不同
|
||||
@@ -480,29 +858,12 @@ static void ioapic_init_one(struct ioapic_info *io, u64 hhdm_offset,
|
||||
u32 vec = gsi_to_vector[gsi];
|
||||
u16 flags = gsi_flags[gsi];
|
||||
|
||||
entry = (u64)vec; /* vector */
|
||||
/* delivery mode = fixed (0) */
|
||||
/* destination mode = physical (0) */
|
||||
|
||||
/* 极性: bit 11. ISA 默认 active-high (0).
|
||||
* ISO flags bit 1: 0=conforms (active-high for ISA), 1=active-low */
|
||||
if (flags & 0x03) {
|
||||
if (flags & 0x02) entry |= (1ULL << 11); /* active low */
|
||||
}
|
||||
|
||||
/* 触发模式: bit 13. ISA 默认 edge (0).
|
||||
* ISO flags bit 3: 0=conforms (edge for ISA), 1=level */
|
||||
if (flags & 0x08) {
|
||||
if (flags & 0x04) entry |= (1ULL << 13); /* level triggered */
|
||||
}
|
||||
|
||||
/* destination: BSP APIC ID (读自 LAPIC) */
|
||||
/* 暂时硬编码 destination = 0 (BSP), 后续从 LAPIC ID 寄存器获取 */
|
||||
entry |= (0ULL << 56); /* destination APIC ID = 0 */
|
||||
/* vector + ISO 极性/触发 + 真实 BSP LAPIC ID, 保持 mask */
|
||||
entry = redir_compose(vec, flags, g_lapic_id, 1);
|
||||
} else {
|
||||
entry = (1ULL << 16); /* 无映射条目: 纯 mask (bit16, vector=0 无害) */
|
||||
}
|
||||
|
||||
entry |= (1ULL << 14); /* mask = 1, 所有条目默认屏蔽 */
|
||||
|
||||
ioapic_write_redir(io->mmio, (u8)pin, entry);
|
||||
}
|
||||
|
||||
@@ -519,14 +880,8 @@ static void ioapic_init_one(struct ioapic_info *io, u64 hhdm_offset,
|
||||
* 但实机 BIOS 可能留 LAPIC 为 software-disable 状态。
|
||||
*/
|
||||
|
||||
static void wrmsr(u32 msr, u64 val) {
|
||||
u32 lo = (u32)(val & 0xffffffffu);
|
||||
u32 hi = (u32)(val >> 32);
|
||||
__asm__ volatile("wrmsr" :: "a"(lo), "d"(hi), "c"(msr));
|
||||
}
|
||||
|
||||
static void lapic_enable(u64 hhdm_offset, u64 lapic_phys) {
|
||||
volatile u32 *lapic = (volatile u32 *)(uintptr_t)(hhdm_offset + lapic_phys);
|
||||
static void lapic_enable(void) {
|
||||
volatile u32 *lapic = g_lapic;
|
||||
|
||||
/* 确保 IA32_APIC_BASE 的 global enable 和 BSP 位已设置 */
|
||||
u64 apic_base = rdmsr(0x1B);
|
||||
@@ -559,6 +914,532 @@ static void lapic_enable(u64 hhdm_offset, u64 lapic_phys) {
|
||||
log_hex("[apic] LAPIC version=", lapic[0x30 / 4]);
|
||||
}
|
||||
|
||||
/* LAPIC EOI — 写 0 到 EOI 寄存器 (offset 0xB0)。
|
||||
* B7 阶段2: 本函数作为 EOI 钩子经 kernel_api.register_apic_eoi 注册给 UTSM,
|
||||
* idt_handler 在两个 IRQ 分支的分发末尾调用 (钩子签名 void(*)(void) 匹配)。
|
||||
* 调用点: IRQ 上下文, 单核 BSP interrupt gate (IF=0), 无嵌套, 无需锁。 */
|
||||
static __inline__ void lapic_eoi(void) {
|
||||
if (g_lapic) {
|
||||
g_lapic[0xB0 / 4] = 0;
|
||||
apic_mb();
|
||||
}
|
||||
}
|
||||
|
||||
/* ---- B7 diag: HPET 绝对时基 (tick 2x 定论实验) ---- *
|
||||
* 选型理由: TSC 校准 (PIT mode0 回绕法) 与被测对象 (PIT mode3 投递频率)
|
||||
* 共享 PIT 硬件, 循环论证无法定论 2x 根因。HPET 主计数器是独立时基
|
||||
* (QEMU q35: 100MHz, period=10000fs), 32 位回绕周期 ~42.9s, 对 ms 级
|
||||
* 窗口充裕。只设 GEN_CONF bit0 (overall enable); 绝不置 bit1
|
||||
* (legacy replacement route 会抢 PIT IRQ0/RTC IRQ8 路由, 破坏被测链路)。
|
||||
*/
|
||||
|
||||
static volatile u32 *g_hpet; /* HPET MMIO 基址 (HHDM), 0=不可用 */
|
||||
static u32 g_hpet_period_fs; /* 主计数器周期 (飞秒), GCAP_ID[63:32] */
|
||||
|
||||
#define HPET_GCAP_ID 0x00
|
||||
#define HPET_GEN_CONF 0x10
|
||||
#define HPET_MAIN_CNT 0xF0
|
||||
|
||||
static u64 hpet_read64(u32 off) {
|
||||
volatile u32 *p = (volatile u32 *)((volatile u8 *)g_hpet + off);
|
||||
u32 lo = p[0];
|
||||
u32 hi = p[1];
|
||||
return ((u64)hi << 32) | lo;
|
||||
}
|
||||
|
||||
static void hpet_write64(u32 off, u64 v) {
|
||||
volatile u32 *p = (volatile u32 *)((volatile u8 *)g_hpet + off);
|
||||
p[0] = (u32)(v & 0xffffffffu);
|
||||
p[1] = (u32)(v >> 32);
|
||||
}
|
||||
|
||||
static __inline__ u32 hpet_main32(void) {
|
||||
return *(volatile u32 *)((volatile u8 *)g_hpet + HPET_MAIN_CNT);
|
||||
}
|
||||
|
||||
/* 初始化 HPET 时基; 成功返回 0 且 g_hpet/g_hpet_period_fs 有效 */
|
||||
static int hpet_diag_init(const struct dkm_kernel_api *api) {
|
||||
const acpi_hpet *hpet = find_hpet(api->rsdp_address);
|
||||
if (!hpet) {
|
||||
g_log->warn("[apic] diag: HPET table not found");
|
||||
return -1;
|
||||
}
|
||||
if (hpet->addr_space_id != 0 || !hpet->base_addr) {
|
||||
g_log->warn("[apic] diag: HPET not memory-mapped");
|
||||
return -1;
|
||||
}
|
||||
g_hpet = (volatile u32 *)(uintptr_t)(api->hhdm_offset + hpet->base_addr);
|
||||
u64 gcap = hpet_read64(HPET_GCAP_ID);
|
||||
g_hpet_period_fs = (u32)(gcap >> 32);
|
||||
if (!g_hpet_period_fs || g_hpet_period_fs > 100000000u) {
|
||||
g_log->warn("[apic] diag: HPET period implausible");
|
||||
g_hpet = 0;
|
||||
return -1;
|
||||
}
|
||||
log_hex("[apic] diag: HPET base=", hpet->base_addr);
|
||||
log_dec("[apic] diag: HPET period(fs)=", g_hpet_period_fs);
|
||||
|
||||
/* overall enable (bit0); legacy replacement route (bit1) 保持 0 */
|
||||
u64 conf = hpet_read64(HPET_GEN_CONF);
|
||||
if (!(conf & 1u)) {
|
||||
hpet_write64(HPET_GEN_CONF, conf | 1u);
|
||||
apic_mb();
|
||||
}
|
||||
g_log->info("[apic] diag: HPET main counter enabled");
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* HPET 主计数器差值 → 微秒 (全程 u64 整数, -msoft-float 环境无浮点) */
|
||||
static u64 hpet_delta_us(u32 h0, u32 h1) {
|
||||
/* 无符号回绕安全: u32 减法自动回绕 (42.9s 周期, 窗口 << 此值) */
|
||||
u64 ticks = (u64)(u32)(h1 - h0);
|
||||
/* ticks * period_fs / 1e9 = us; period_fs 典型 10000, 500ms 窗口
|
||||
* ticks≈5e7, 乘积 5e11 << 2^64, 溢出安全 */
|
||||
return (ticks * (u64)g_hpet_period_fs) / 1000000000ull;
|
||||
}
|
||||
|
||||
/* ---- B7 diag: PS/2 鼠标流 (IRQ12 持续投递验证) ---- *
|
||||
* UTSM 阶段 IRQ12 无属主 (mouseInit 是 DSK 阶段模块), diag handler 独占;
|
||||
* DSK mouseInit 之后经 irq_register(12) 覆盖本 handler 并完整复位鼠标,
|
||||
* 无状态冲突。所有单步带超时, 失败只记日志不阻塞。 */
|
||||
|
||||
static volatile u32 g_mouse_pkt_count;
|
||||
|
||||
static int ps2_wait_ibf(void) {
|
||||
u32 t = 100000;
|
||||
while (t--) { if (!(inb(0x64) & 0x02)) return 0; }
|
||||
return -1;
|
||||
}
|
||||
|
||||
static int ps2_wait_obf(void) {
|
||||
u32 t = 100000;
|
||||
while (t--) { if (inb(0x64) & 0x01) return 0; }
|
||||
return -1;
|
||||
}
|
||||
|
||||
static void ps2_drain(void) {
|
||||
while (inb(0x64) & 0x01) { (void)inb(0x60); }
|
||||
}
|
||||
|
||||
/* 经 0xD4 通道写鼠标命令并等 ACK(0xFA); 失败返回 -1 */
|
||||
static int ps2_aux_cmd(u8 cmd) {
|
||||
if (ps2_wait_ibf() != 0) return -1;
|
||||
outb(0x64, 0xD4);
|
||||
if (ps2_wait_ibf() != 0) return -1;
|
||||
outb(0x60, cmd);
|
||||
if (ps2_wait_obf() != 0) return -1;
|
||||
return inb(0x60) == 0xFA ? 0 : -1;
|
||||
}
|
||||
|
||||
/* IRQ12 诊断 handler: 只读数据计数, EOI 交给 idt_handler 分发路径
|
||||
* (PIC 模式: 8259 EOI; route 模式: 钩子 LAPIC EOI + 无害 8259 EOI)。
|
||||
* 返回 0 — 不自负 EOI, 与 ps2kbd/e1000 handler 同一约定。 */
|
||||
static int apic_mouse_diag_handler(u8 vector) {
|
||||
(void)vector;
|
||||
u8 st = inb(0x64);
|
||||
if ((st & 0x01) && (st & 0x20)) { /* OBF 且 AUX 位置位 = 鼠标数据 */
|
||||
u8 data = inb(0x60); /* 必须读, 否则 OBF 保持阻塞后续包 */
|
||||
g_mouse_pkt_count++;
|
||||
if (g_mouse_pkt_count <= 6) {
|
||||
g_log->info("[apic] diag: mouse packet byte");
|
||||
log_hex("[apic] diag: data=", data);
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* IRQ1 诊断 handler (键盘流计数): ps2kbd demo 窗口只有 ~10ms 数量级,
|
||||
* 自动化无法抓住; diag 在 stage0 自建 3s 观察窗验证 IRQ1 持续投递。
|
||||
* stage3 ps2kbd 注册时覆盖本 handler, 无冲突。 */
|
||||
static volatile u32 g_kbd_pkt_count;
|
||||
|
||||
static int apic_kbd_diag_handler(u8 vector) {
|
||||
(void)vector;
|
||||
u8 st = inb(0x64);
|
||||
if ((st & 0x01) && !(st & 0x20)) { /* OBF 且 AUX 位清零 = 键盘数据 */
|
||||
u8 data = inb(0x60); /* 读走扫描码 (窗内按键, 无消费者) */
|
||||
g_kbd_pkt_count++;
|
||||
if (g_kbd_pkt_count <= 6) {
|
||||
g_log->info("[apic] diag: kbd scancode byte");
|
||||
log_hex("[apic] diag: sc=", data);
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* AUX 端口初始化: 启用 AUX 时钟 + 采样率 100 + 数据报告, 最后才开 AUX IRQ。
|
||||
* 顺序要点: AUX IRQ (cfg bit1) 必须在全部命令/ACK 交互完成后才使能 —
|
||||
* 否则 ACK 字节 (0xFA) 到达即触发 IRQ12 被 diag handler 读走, 轮询侧
|
||||
* 永远等不到 ACK (实测 F3 nack 即此竞态: handler 日志 data=0xfa)。
|
||||
* 单步失败只记日志继续 (与 mouseInit 同一安全准则)。 */
|
||||
static void ps2_aux_enable_stream(void) {
|
||||
ps2_drain();
|
||||
|
||||
if (ps2_wait_ibf() != 0) { g_log->warn("[apic] diag: PS2 ibf timeout"); return; }
|
||||
outb(0x64, 0x20); /* 读配置字节 */
|
||||
if (ps2_wait_obf() != 0) { g_log->warn("[apic] diag: PS2 cfg read timeout"); return; }
|
||||
u8 cfg = inb(0x60);
|
||||
cfg &= (u8)~0x02; /* bit1=0: AUX IRQ 先关闭 (轮询期) */
|
||||
cfg &= (u8)~0x20; /* bit5=0: AUX clock enable */
|
||||
cfg |= 0x01; /* bit0=1: KBD IRQ 保持使能 (键盘流用) */
|
||||
|
||||
if (ps2_wait_ibf() != 0) return;
|
||||
outb(0x64, 0x60); /* 写配置字节 */
|
||||
if (ps2_wait_ibf() != 0) return;
|
||||
outb(0x60, cfg);
|
||||
log_hex("[apic] diag: PS2 cfg byte=", cfg);
|
||||
|
||||
if (ps2_wait_ibf() != 0) return;
|
||||
outb(0x64, 0xA8); /* 启用 AUX 端口 */
|
||||
|
||||
if (ps2_aux_cmd(0xF3) != 0) { g_log->warn("[apic] diag: mouse F3 nack"); }
|
||||
else if (ps2_aux_cmd(100) != 0) { g_log->warn("[apic] diag: mouse rate nack"); }
|
||||
if (ps2_aux_cmd(0xF4) != 0) { g_log->warn("[apic] diag: mouse F4 nack"); return; }
|
||||
g_log->info("[apic] diag: PS/2 mouse data reporting enabled");
|
||||
|
||||
ps2_drain(); /* 清 F4 ACK 后可能挂起的首个流字节 */
|
||||
|
||||
/* 全部交互完成, 现在才开 AUX IRQ — 之后鼠标字节全走 IRQ12 handler */
|
||||
if (ps2_wait_ibf() != 0) return;
|
||||
outb(0x64, 0x20);
|
||||
if (ps2_wait_obf() != 0) return;
|
||||
cfg = inb(0x60);
|
||||
cfg |= 0x02; /* bit1=1: AUX IRQ enable */
|
||||
if (ps2_wait_ibf() != 0) return;
|
||||
outb(0x64, 0x60);
|
||||
if (ps2_wait_ibf() != 0) return;
|
||||
outb(0x60, cfg);
|
||||
log_hex("[apic] diag: PS2 cfg byte(final)=", cfg);
|
||||
}
|
||||
|
||||
/* ---- B7 阶段2: PIT tick 路由验证 ---- *
|
||||
* vector 0x20 落在 idt_handler 的 PIC 分支 (vector 32-47) — 与键盘 0x21/
|
||||
* 鼠标 0x2C/网卡 0x2B 同一代码路径。分发顺序: handler(本函数) → 钩子
|
||||
* LAPIC EOI → 8259 EOI (PIC 全屏蔽下为无害 no-op)。
|
||||
* 本 handler 返回 0 不自负 EOI: 由 UTSM 钩子写 LAPIC EOI 寄存器清除
|
||||
* ISR 位; 重复投递 (计数>=2) 即证明"legacy 向量分支 + 钩子 EOI"可持续,
|
||||
* 这正是键盘/鼠标/网卡将要走的路径 (阶段1 的 0xE0+自EOI 无法证明此路径)。
|
||||
* handler 是普通 C 函数 (SysV ABI), isr stub 已完成现场保存/iret。
|
||||
*/
|
||||
static int apic_tick_handler(u8 vector) {
|
||||
(void)vector;
|
||||
g_tick_count++;
|
||||
if (g_tick_count <= 8) {
|
||||
g_log->info("[apic] ioapic tick (PIT GSI -> LAPIC -> IDT vec 0x20, hook EOI)");
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static u64 rdtsc(void) {
|
||||
u32 lo, hi;
|
||||
__asm__ volatile("rdtsc" : "=a"(lo), "=d"(hi));
|
||||
return ((u64)hi << 32) | lo;
|
||||
}
|
||||
|
||||
static u64 g_tsc_per_ms;
|
||||
|
||||
/* PIT ch0 mode 0 单发 (~10ms, 11932 counts) 校准 TSC。
|
||||
* 必须在把 PIT 改为 mode 3 周期模式之前调用。 */
|
||||
static void tsc_calibrate(void) {
|
||||
outb(0x43, 0x30); /* ch0, lo+hi, mode 0, binary */
|
||||
outb(0x40, 0x9C); /* 11932 low = ~10ms */
|
||||
outb(0x40, 0x2E); /* 11932 high */
|
||||
u64 tsc_start = rdtsc();
|
||||
u16 prev = 0;
|
||||
u64 loops = 0;
|
||||
for (;;) {
|
||||
outb(0x43, 0x00);
|
||||
u16 cur = (u16)inb(0x40) | ((u16)inb(0x40) << 8);
|
||||
if (cur > prev && loops > 10) break; /* 回绕 = 10ms 到 */
|
||||
prev = cur;
|
||||
loops++;
|
||||
}
|
||||
u64 tsc_end = rdtsc();
|
||||
g_tsc_per_ms = (tsc_end - tsc_start) / 10;
|
||||
}
|
||||
|
||||
static void tsc_delay_ms(u32 ms) {
|
||||
if (!g_tsc_per_ms) {
|
||||
for (volatile u32 i = 0; i < 100000 * ms; i++) __asm__ volatile("pause");
|
||||
return;
|
||||
}
|
||||
u64 target = g_tsc_per_ms * ms;
|
||||
u64 start = rdtsc();
|
||||
while (rdtsc() - start < target) __asm__ volatile("pause");
|
||||
}
|
||||
|
||||
/* ---- B7 阶段2: 路由切换主流程 ---- *
|
||||
* 成功: PIC IMR 全 1, IOAPIC 拥有路由, EOI 钩子保持注册, tick 验证后
|
||||
* tick 线重新 mask (保留路由表内容), legacy 线按 apic_route_legacy。
|
||||
* 失败: IOAPIC 全 mask + 恢复原 PIC IMR + 注销 tick handler + 注销 EOI
|
||||
* 钩子, 与切换前状态完全一致 (现状不回归)。
|
||||
*/
|
||||
static void apic_route_switch(const struct dkm_kernel_api *api,
|
||||
struct madt_info *info) {
|
||||
g_log->info("[apic] apic_route=1: attempting IOAPIC routing takeover");
|
||||
|
||||
if (!g_lapic) {
|
||||
g_log->warn("[apic] route abort: LAPIC MMIO unavailable; PIC retained");
|
||||
return;
|
||||
}
|
||||
if (info->ioapic_count == 0) {
|
||||
g_log->warn("[apic] route abort: no IOAPIC; PIC retained");
|
||||
return;
|
||||
}
|
||||
if (!api->irq_register) {
|
||||
g_log->warn("[apic] route abort: irq_register missing; PIC retained");
|
||||
return;
|
||||
}
|
||||
|
||||
/* 0) B7 阶段2 前提: EOI 钩子接口必须存在 (旧内核无此字段 → 判空中止)。
|
||||
* 无钩子时 legacy 向量 (0x20-0x2F) 在 IOAPIC 路由下只能 one-shot,
|
||||
* 路由接管不成立 — 宁可保留 PIC 也不进入半残状态。 */
|
||||
if (!api->register_apic_eoi) {
|
||||
g_log->warn("[apic] route abort: register_apic_eoi missing (old kernel); PIC retained");
|
||||
return;
|
||||
}
|
||||
api->register_apic_eoi(lapic_eoi);
|
||||
g_log->info("[apic] LAPIC EOI hook registered to UTSM");
|
||||
|
||||
/* 1) 保存 PIC IMR (降级恢复用) */
|
||||
u8 imr1 = inb(0x21);
|
||||
u8 imr2 = inb(0xA1);
|
||||
log_hex("[apic] PIC IMR saved master=", imr1);
|
||||
log_hex("[apic] PIC IMR saved slave=", imr2);
|
||||
|
||||
/* 2) TSC 校准 (PIT 尚在 firmware/driver 遗留状态, 先校准再改模式)。
|
||||
* diag: HPET 绝对时基对拍本窗口 — 校准窗口标称 10ms, HPET 实测
|
||||
* 若 ~20000us 则 PIT mode0 实际跑了 20ms (TSC 测半), ~10000us
|
||||
* 则校准正确, tick 2x 根因另在他处。 */
|
||||
int hpet_ok = 0;
|
||||
if (g_cfg.apic_diag) {
|
||||
hpet_ok = (hpet_diag_init(api) == 0);
|
||||
}
|
||||
u32 hc0 = 0;
|
||||
if (hpet_ok) hc0 = hpet_main32();
|
||||
tsc_calibrate();
|
||||
if (hpet_ok) {
|
||||
u32 hc1 = hpet_main32();
|
||||
u64 calib_us = hpet_delta_us(hc0, hc1);
|
||||
log_dec("[apic] diag: calib window(us)=", calib_us);
|
||||
g_log->info("[apic] diag: (nominal 10000us; ~20000 => TSC half-measured)");
|
||||
}
|
||||
log_hex("[apic] tsc_per_ms=", g_tsc_per_ms);
|
||||
|
||||
/* 3) 注册 tick handler @ vector 0x20 — PIC 分支 (legacy 向量路径),
|
||||
* handler 返回 0, LAPIC EOI 由 UTSM 钩子完成 */
|
||||
if (api->irq_register(0x20, (void *)(uintptr_t)apic_tick_handler) != 0) {
|
||||
g_log->warn("[apic] route abort: irq_register(0x20) failed");
|
||||
api->register_apic_eoi(NULL);
|
||||
return;
|
||||
}
|
||||
g_log->info("[apic] tick handler registered at vector 0x20 (PIC branch, hook EOI)");
|
||||
|
||||
/* 4) PIT tick GSI 解析: MADT ISO source 0 (QEMU q35: GSI2), 缺省恒等 */
|
||||
u16 tick_flags = 0;
|
||||
u32 tick_gsi = isa_irq_to_gsi(0, &tick_flags, info->isos, info->iso_count);
|
||||
log_hex("[apic] tick GSI=", tick_gsi);
|
||||
log_hex("[apic] tick GSI flags=", tick_flags);
|
||||
|
||||
/* 5) 编程 tick 重定向项 (vector 0x20, 放开) */
|
||||
if (ioapic_program_gsi(info, tick_gsi, 0x20, tick_flags, 1) != 0) {
|
||||
g_log->warn("[apic] route abort: tick GSI not covered by any IOAPIC");
|
||||
api->irq_register(0x20, (void *)0);
|
||||
api->register_apic_eoi(NULL);
|
||||
return;
|
||||
}
|
||||
g_log->info("[apic] tick redirection unmasked (vec 0x20)");
|
||||
|
||||
/* 6) legacy 线 (apic_route_legacy): EOI 钩子已就位, 持续投递成立。
|
||||
* ISA 线 (IRQ1/12) 按 ISO, 缺省 edge/active-high;
|
||||
* PCI 线 (IRQ11 e1000) 无 ISO 覆盖时强制 level/active-low
|
||||
* (PCI INTx 规范; flags=0xF = pol bit0-1=3 active-low + trig bit2-3=3
|
||||
* level)。e1000 handler 读 ICR 清源 → 电平 deassert → 钩子 EOI。 */
|
||||
if (g_cfg.apic_route_legacy) {
|
||||
u16 f1 = 0, f12 = 0, f11 = 0;
|
||||
u32 gsi1 = isa_irq_to_gsi(1, &f1, info->isos, info->iso_count);
|
||||
u32 gsi12 = isa_irq_to_gsi(12, &f12, info->isos, info->iso_count);
|
||||
u32 gsi11 = isa_irq_to_gsi(11, &f11, info->isos, info->iso_count);
|
||||
if (!f11) f11 = 0x0F;
|
||||
ioapic_program_gsi(info, gsi1, 0x21, f1, 1); /* 键盘 */
|
||||
ioapic_program_gsi(info, gsi12, 0x2C, f12, 1); /* 鼠标 */
|
||||
ioapic_program_gsi(info, gsi11, 0x2B, f11, 1); /* e1000 (QEMU 默认 IRQ11) */
|
||||
g_log->info("[apic] legacy IRQ1/12/11 unmasked (sustained delivery via EOI hook)");
|
||||
log_hex("[apic] kbd gsi=", gsi1);
|
||||
log_hex("[apic] mouse gsi=", gsi12);
|
||||
log_hex("[apic] e1000 gsi=", gsi11);
|
||||
log_hex("[apic] e1000 flags=", f11);
|
||||
}
|
||||
|
||||
/* 7) LAPIC TPR=0 全放行 */
|
||||
g_lapic[0x80 / 4] = 0;
|
||||
apic_mb();
|
||||
log_hex("[apic] LAPIC TPR=", g_lapic[0x80 / 4]);
|
||||
|
||||
/* 8) PIC 全屏蔽 (先 slave 后 master, 避免 cascade 窗口; QEMU 无功能 IMCR) */
|
||||
outb(0xA1, 0xFF);
|
||||
io_wait();
|
||||
outb(0x21, 0xFF);
|
||||
io_wait();
|
||||
g_log->info("[apic] PIC fully masked; IOAPIC owns IRQ routing");
|
||||
|
||||
/* 9) PIT ch0 mode 3 周期 ~100Hz (divisor 11932), 产生真实 tick 源 */
|
||||
outb(0x43, 0x36);
|
||||
outb(0x40, 0x9C);
|
||||
outb(0x40, 0x2E);
|
||||
g_log->info("[apic] PIT ch0 mode3 100Hz started");
|
||||
|
||||
/* 10) 500ms 验证窗口 (+ diag: HPET 实测窗口与 tick 频率定论) */
|
||||
u32 hv0 = 0;
|
||||
if (hpet_ok) hv0 = hpet_main32();
|
||||
u32 before = g_tick_count;
|
||||
tsc_delay_ms(500);
|
||||
u32 ticks = g_tick_count - before;
|
||||
if (hpet_ok) {
|
||||
u32 hv1 = hpet_main32();
|
||||
u64 win_us = hpet_delta_us(hv0, hv1);
|
||||
log_dec("[apic] diag: verify window(us)=", win_us);
|
||||
if (win_us) {
|
||||
u64 hz_x10 = (u64)ticks * 10000000ull / win_us;
|
||||
log_dec("[apic] diag: tick rate(Hz x10)=", hz_x10);
|
||||
}
|
||||
/* tick 2x 定论分支:
|
||||
* win≈500ms 且 ticks≈100 → PIT mode3 在 IOAPIC edge 下双触发 (200Hz 真实)
|
||||
* win≈1000ms 且 ticks≈100 → TSC 校准窗口翻倍 (tick 频率真实 100Hz)
|
||||
* win≈500ms 且 ticks≈50 → 一切正常 */
|
||||
if (win_us > 750000) {
|
||||
g_log->info("[apic] diag: TICK2X VERDICT: TSC calib window doubled (PIT mode0 ran ~20ms); tick rate nominal");
|
||||
} else if (ticks > 75) {
|
||||
g_log->info("[apic] diag: TICK2X VERDICT: PIT mode3 double-clocked on IOAPIC edge (~200Hz real)");
|
||||
} else {
|
||||
g_log->info("[apic] diag: TICK2X VERDICT: nominal (~100Hz, no 2x)");
|
||||
}
|
||||
}
|
||||
log_dec("[apic] route verify ticks=", ticks);
|
||||
|
||||
if (ticks >= 2) {
|
||||
/* 成功: 重复投递证明钩子 EOI 正确清除 ISR 位, 路由链路完整 */
|
||||
g_log->info("[apic] ROUTE VERIFY OK — IOAPIC->LAPIC->IDT(vec 0x20)->handler->hook EOI chain proven");
|
||||
|
||||
/* diag: 第二窗口持续投递证据 (排除窗口内偶发两次的弱证明) */
|
||||
if (g_cfg.apic_diag) {
|
||||
u32 before2 = g_tick_count;
|
||||
tsc_delay_ms(500);
|
||||
u32 ticks2 = g_tick_count - before2;
|
||||
log_dec("[apic] diag: sustain window ticks=", ticks2);
|
||||
if (ticks2 >= 2) {
|
||||
g_log->info("[apic] diag: SUSTAINED delivery confirmed (2nd window)");
|
||||
}
|
||||
}
|
||||
|
||||
/* tick 线重新 mask (保留路由表, vector 保持 0x20), 避免后台周期中断;
|
||||
* PIT 恢复 mode 3 @ 18.2Hz (BIOS 惯例值, 已被 mask 不会投递)。
|
||||
* EOI 钩子保持注册 — legacy 线的持续投递依赖它。 */
|
||||
ioapic_program_gsi(info, tick_gsi, 0x20, tick_flags, 0);
|
||||
outb(0x43, 0x36);
|
||||
outb(0x40, 0x00);
|
||||
outb(0x40, 0x00);
|
||||
g_route_active = 1;
|
||||
g_log->info("[apic] APIC ROUTING ACTIVE (PIC masked; EOI hook live; tick line re-masked)");
|
||||
} else {
|
||||
/* 失败: 完整降级回 PIC (含注销 EOI 钩子) */
|
||||
g_log->error("[apic] ROUTE VERIFY FAILED — degrading to PIC routing");
|
||||
ioapic_mask_all(info);
|
||||
api->irq_register(0x20, (void *)0);
|
||||
api->register_apic_eoi(NULL);
|
||||
outb(0x43, 0x36);
|
||||
outb(0x40, 0x00);
|
||||
outb(0x40, 0x00);
|
||||
outb(0x21, imr1);
|
||||
io_wait();
|
||||
outb(0xA1, imr2);
|
||||
io_wait();
|
||||
g_log->info("[apic] PIC routing restored (IMR restored, IOAPIC masked, hook cleared)");
|
||||
}
|
||||
}
|
||||
|
||||
/* ---- B7 diag: IRQ1/IRQ12 键鼠流观察窗 ---- *
|
||||
* 在 route switch 之后调用 (route 成功走 IOAPIC; 否则走 PIC IMR)。
|
||||
* 打锚点日志供测试脚本/人工在窗口内用 QEMU monitor sendkey/mouse_move
|
||||
* 注入输入; 窗口结束分别报告收包计数。计数 >1 即证明该线在当前路由
|
||||
* 模式下可持续投递 (一次按键=make+break 两包, 一次移动=多包)。 */
|
||||
static void apic_diag_mouse_window(const struct dkm_kernel_api *api,
|
||||
struct madt_info *info) {
|
||||
g_log->info("[apic] diag: IRQ1/IRQ12 input stream check begin");
|
||||
|
||||
/* 确保 TSC 延时可用 (route=0 时未校准: 现场校准并恢复 PIT 惯例状态) */
|
||||
if (!g_tsc_per_ms) {
|
||||
tsc_calibrate();
|
||||
outb(0x43, 0x36);
|
||||
outb(0x40, 0x00);
|
||||
outb(0x40, 0x00);
|
||||
}
|
||||
|
||||
if (!api->irq_register) return;
|
||||
|
||||
if (g_route_active) {
|
||||
/* IOAPIC 路由: 确保 IRQ12/IRQ1 重定向项放开 (legacy=1 时幂等重编) */
|
||||
u16 f12 = 0, f1 = 0;
|
||||
u32 gsi12 = isa_irq_to_gsi(12, &f12, info->isos, info->iso_count);
|
||||
u32 gsi1 = isa_irq_to_gsi(1, &f1, info->isos, info->iso_count);
|
||||
ioapic_program_gsi(info, gsi12, 0x2C, f12, 1);
|
||||
ioapic_program_gsi(info, gsi1, 0x21, f1, 1);
|
||||
g_log->info("[apic] diag: IRQ12+IRQ1 via IOAPIC redirection");
|
||||
} else {
|
||||
/* PIC 路由: 解 slave IMR bit4 (IRQ12); master IMR bit1 (IRQ1)
|
||||
* UTSM pic_remap 已留 0xFD (IRQ1 enable), 幂等确认。
|
||||
* diag 属实验开关, 显式改变 PIC 状态并打日志; UTSM PIC 分支
|
||||
* 会做 8259 EOI, diag handler 返回 0 即可。 */
|
||||
outb(0xA1, (u8)(inb(0xA1) & (u8)~0x10u));
|
||||
outb(0x21, (u8)(inb(0x21) & (u8)~0x02u));
|
||||
g_log->info("[apic] diag: IRQ12+IRQ1 via PIC (IMR bits cleared)");
|
||||
}
|
||||
|
||||
/* 控制器交互必须全轮询完成: 期间到达的 IRQ (KBD bit0 一直开着)
|
||||
* 因 handler 未注册只会被 EOI 丢弃, 不会偷走命令响应字节。
|
||||
* (实测教训: 先注册 handler 时, 0x20 读 cfg 的响应被 kbd handler
|
||||
* 当扫描码读走, 轮询侧 cfg read timeout) */
|
||||
ps2_aux_enable_stream();
|
||||
|
||||
/* 交互全部完成, 现在才注册诊断 handler */
|
||||
if (api->irq_register(0x2C, (void *)(uintptr_t)apic_mouse_diag_handler) != 0) {
|
||||
g_log->warn("[apic] diag: irq_register(0x2C) failed");
|
||||
return;
|
||||
}
|
||||
if (api->irq_register(0x21, (void *)(uintptr_t)apic_kbd_diag_handler) != 0) {
|
||||
g_log->warn("[apic] diag: irq_register(0x21) failed");
|
||||
return;
|
||||
}
|
||||
|
||||
/* 6000ms 窗口: 注入方需经 "串口日志落盘(块缓冲) → 测试脚本轮询" 的
|
||||
* 可见性延迟 (~1s 量级), 3s 窗口实测会被注入延迟吃光 */
|
||||
g_log->info("[apic] diag: INPUT OBSERVE WINDOW 6000ms — sendkey/mouse_move now");
|
||||
u32 m_before = g_mouse_pkt_count;
|
||||
u32 k_before = g_kbd_pkt_count;
|
||||
tsc_delay_ms(6000);
|
||||
u32 mpkts = g_mouse_pkt_count - m_before;
|
||||
u32 kpkts = g_kbd_pkt_count - k_before;
|
||||
log_dec("[apic] diag: mouse packets observed=", mpkts);
|
||||
log_dec("[apic] diag: kbd packets observed=", kpkts);
|
||||
if (mpkts > 1) {
|
||||
g_log->info("[apic] diag: IRQ12 SUSTAINED delivery confirmed");
|
||||
} else if (mpkts == 1) {
|
||||
g_log->warn("[apic] diag: IRQ12 single packet only (check EOI path)");
|
||||
} else {
|
||||
g_log->info("[apic] diag: no mouse packets (inject via monitor mouse_move)");
|
||||
}
|
||||
if (kpkts > 1) {
|
||||
g_log->info("[apic] diag: IRQ1 SUSTAINED delivery confirmed");
|
||||
} else if (kpkts == 1) {
|
||||
g_log->warn("[apic] diag: IRQ1 single packet only (check EOI path)");
|
||||
} else {
|
||||
g_log->info("[apic] diag: no kbd packets (inject via monitor sendkey)");
|
||||
}
|
||||
/* handler 保持注册: stage3 ps2kbd 经 irq_register(1) 覆盖键盘 handler,
|
||||
* DSK mouseInit 经 irq_register(12) 覆盖鼠标 handler, 均无冲突;
|
||||
* 重定向项/IMR 保持现状 (ps2kbd/mouseInit 有完整初始化序列)。 */
|
||||
}
|
||||
|
||||
__attribute__((visibility("default")))
|
||||
int driver_init(const struct dkm_kernel_api *api,
|
||||
struct dkm_driver_handle *handle) {
|
||||
@@ -575,6 +1456,9 @@ int driver_init(const struct dkm_kernel_api *api,
|
||||
}
|
||||
g_log->info("[apic] kernel IRQ backend present: PIC");
|
||||
|
||||
/* B7: FUCK 配置自解析 (lapic_enable/ioapic_init/apic_route/apic_route_legacy/apic_diag) */
|
||||
load_fuck_config(api);
|
||||
|
||||
if (!cpu_has_lapic()) {
|
||||
g_log->warn("[apic] CPUID local APIC not present; PIC fallback active");
|
||||
g_log->info("[apic] driver ready");
|
||||
@@ -612,29 +1496,60 @@ int driver_init(const struct dkm_kernel_api *api,
|
||||
}
|
||||
|
||||
if (api->hhdm_offset && info.lapic_phys) {
|
||||
volatile u32 *lapic = (volatile u32 *)(uintptr_t)(api->hhdm_offset + info.lapic_phys);
|
||||
log_hex("[apic] LAPIC ID reg=", lapic[0x20 / 4]);
|
||||
log_hex("[apic] LAPIC version reg=", lapic[0x30 / 4]);
|
||||
log_hex("[apic] LAPIC SVR reg=", lapic[0xF0 / 4]);
|
||||
g_lapic = (volatile u32 *)(uintptr_t)(api->hhdm_offset + info.lapic_phys);
|
||||
g_lapic_id = g_lapic[0x20 / 4] >> 24;
|
||||
log_hex("[apic] LAPIC ID reg=", g_lapic[0x20 / 4]);
|
||||
log_hex("[apic] LAPIC version reg=", g_lapic[0x30 / 4]);
|
||||
log_hex("[apic] LAPIC SVR reg=", g_lapic[0xF0 / 4]);
|
||||
log_hex("[apic] LAPIC TPR reg=", g_lapic[0x80 / 4]);
|
||||
log_hex("[apic] BSP LAPIC ID=", g_lapic_id);
|
||||
} else {
|
||||
g_log->warn("[apic] HHDM unavailable; skip LAPIC MMIO read");
|
||||
g_lapic = (volatile u32 *)0;
|
||||
}
|
||||
|
||||
/* ---- LAPIC 使能（真机必需，QEMU 也可安全执行） ---- */
|
||||
if (api->hhdm_offset && info.lapic_phys) {
|
||||
lapic_enable(api->hhdm_offset, info.lapic_phys);
|
||||
if (g_lapic && g_cfg.lapic_enable) {
|
||||
lapic_enable();
|
||||
} else if (!g_cfg.lapic_enable) {
|
||||
g_log->info("[apic] lapic_enable=0: skip LAPIC software enable");
|
||||
}
|
||||
|
||||
/* ---- IOAPIC 初始化（真机必需，QEMU 也可安全执行） ---- */
|
||||
for (u32 i = 0; i < info.ioapic_count; i++) {
|
||||
g_log->info("[apic] initializing IOAPIC");
|
||||
log_hex("[apic] index=", i);
|
||||
ioapic_init_one(&info.ioapics[i], api->hhdm_offset,
|
||||
info.isos, info.iso_count,
|
||||
api->mm_map_mmio);
|
||||
if (g_cfg.ioapic_init) {
|
||||
for (u32 i = 0; i < info.ioapic_count; i++) {
|
||||
g_log->info("[apic] initializing IOAPIC");
|
||||
log_hex("[apic] index=", i);
|
||||
ioapic_init_one(&info.ioapics[i], api->hhdm_offset,
|
||||
info.isos, info.iso_count,
|
||||
api->mm_map_mmio);
|
||||
}
|
||||
} else {
|
||||
g_log->info("[apic] ioapic_init=0: skip IOAPIC programming (PIC mode)");
|
||||
}
|
||||
|
||||
g_log->info("[apic] discovery + init complete; PIC routing retained as fallback");
|
||||
/* ---- B7: 路由接管 (默认关, FUCK apic_route=1 启用) ---- */
|
||||
if (g_cfg.apic_route && g_cfg.ioapic_init) {
|
||||
apic_route_switch(api, &info);
|
||||
} else {
|
||||
g_log->info("[apic] apic_route=0: PIC routing retained (default)");
|
||||
}
|
||||
|
||||
/* ---- B7 diag: IRQ12 鼠标流观察窗 (apic_diag=1, 两种路由模式皆可测) ---- */
|
||||
if (g_cfg.apic_diag) {
|
||||
apic_diag_mouse_window(api, &info);
|
||||
}
|
||||
|
||||
/* 重定向表回读 (验证证据; 无 IOAPIC 时无输出) */
|
||||
if (g_cfg.ioapic_init) {
|
||||
ioapic_dump_table(&info);
|
||||
}
|
||||
|
||||
if (g_route_active) {
|
||||
g_log->info("[apic] discovery + init complete; APIC routing active");
|
||||
} else {
|
||||
g_log->info("[apic] discovery + init complete; PIC routing retained as fallback");
|
||||
}
|
||||
g_log->info("[apic] driver ready");
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -193,6 +193,11 @@ struct dkm_kernel_api {
|
||||
/* —— 新增字段只允许追加在末尾（DSK 以 api+0xA8 硬偏移读取 block） —— */
|
||||
void *(*mm_map_mmio)(u64 phys, u64 size); /* MMIO 独立窗口映射（PCD|PWT），返回虚拟地址，失败返回 0 */
|
||||
void (*mm_unmap_mmio)(void *virt, u64 size); /* 解除 MMIO 独立窗口映射 */
|
||||
/* B7 阶段2 尾部追加（旧内核无此字段 → 判空使用） */
|
||||
void (*register_apic_eoi)(void (*eoi_fn)(void));
|
||||
/* B7 阶段3 尾部追加：动态 IDT 向量分配器（MSI/MSI-X），池 0x40-0xDF */
|
||||
int (*irq_vector_alloc)(void);
|
||||
void (*irq_vector_free)(int vector);
|
||||
};
|
||||
|
||||
struct dkm_driver_handle;
|
||||
|
||||
+699
-6
@@ -6,8 +6,17 @@
|
||||
* 1. 64-bit BAR 常位于 4G 以上（QEMU/OVMF 把 NVMe BAR0 放到 ~48GiB），
|
||||
* HHDM 直映射不保证覆盖。访问前先用 kernel_api.mmio->is_mapped 做
|
||||
* 四级页表 walk 核实；未映射则 map_mmio 原地补建 4KiB UC 页。
|
||||
* 2. 同步轮询模型: 单 outstanding 命令 + CQE phase bit 轮询 + TSC 超时,
|
||||
* 不依赖 IRQ/MSI（当前 PIC/APIC 后端未完工）。
|
||||
* 2. 完成模型: 单 outstanding 命令 + CQE phase bit。B7 阶段3 起 IO 队列
|
||||
* 默认尝试 MSI/MSI-X 中断驱动（FUCK [drivers] nvme_msi, 默认 1 自动）:
|
||||
* 先 MSI cap 编程, 缺则 MSI-X (QEMU nvme 只暴露 MSI-X) — 表项
|
||||
* addr=0xFEE00000|dest<<12, data=动态向量, entry unmask + cap Enable;
|
||||
* Create IOCQ IEN=1/IV=0 + INTMC 解除 IV0; handler 摘 CQE 进完成槽、
|
||||
* 推进 head、写 CQ doorbell, 自写 LAPIC EOI 并返回 1 (MSI 直投 LAPIC,
|
||||
* 与 apic_route 开关无关, 不依赖阶段2 的 EOI 钩子注册状态)。
|
||||
* 提交侧统一等待: 先查完成槽(中断路径), 再在 irqsave 临界区内手动
|
||||
* 摘取(自适应轮询路径) — IF=0 (DSK 阶段) 或 MSI 未投递时零感知降级,
|
||||
* 行为与旧版纯轮询一致。计数: g_msi_irq_count / g_msi_slot_hits /
|
||||
* g_msi_poll_harvests / g_msi_timeouts, init 末尾与压测后打点。
|
||||
* 3. 数据面: 32 页 (128KiB) 物理连续 DMA bounce buffer + 单页 PRP list。
|
||||
* PRP 布局按传输页数分档: 1 页单 PRP1; 2 页 PRP2 直连第二页;
|
||||
* >=3 页 PRP2 指向 PRP list 页 (512 项 u64, 上限 513 页 = 2052KiB)。
|
||||
@@ -32,7 +41,7 @@ const struct dkm_driver_desc driver_desc = {
|
||||
.abi_version = DKM_ABI_VERSION,
|
||||
.desc_size = sizeof(struct dkm_driver_desc),
|
||||
.name = "nvme",
|
||||
.version = "0.3.0",
|
||||
.version = "0.4.0",
|
||||
.vendor = "Deshab",
|
||||
.driver_class = 6, /* DKM_CLASS_STORAGE */
|
||||
.stage = 1,
|
||||
@@ -110,6 +119,24 @@ static u32 g_chunk_max_sectors; /* 单命令扇区上限 (buffer/MDTS/NL
|
||||
static int g_io_ready;
|
||||
static int g_test_disk; /* LBA0 带 DESHABNVME0 签名的测试盘 */
|
||||
|
||||
/* ---- B7 阶段3: MSI 状态 ---- */
|
||||
static int g_cfg_nvme_msi = 1; /* FUCK [drivers] nvme_msi, 默认 1 自动尝试 */
|
||||
static int g_msi_enabled; /* MSI/MSI-X 编程成功且 handler 已注册 */
|
||||
static int g_msix_mode; /* 1=MSI-X 表项模式, 0=MSI cap 模式 */
|
||||
static int g_msi_vector = -1; /* 动态分配的 IDT 向量 (0x40-0xDF 池) */
|
||||
/* 完成槽: 单 outstanding 前提下, handler 是唯一写者、提交侧是唯一读者,
|
||||
* 且下一命令提交前不可能再有新 CQE, 故读-清无需互斥; valid 最后写/最先读,
|
||||
* x86 TSO store-store / load-load 天然有序, nvme_mb 只挡编译器重排。 */
|
||||
static volatile u32 g_slot_valid;
|
||||
static volatile u32 g_slot_status; /* sc | (sct << 8), 0 = 成功 */
|
||||
static volatile u32 g_slot_dw0; /* CQE dw0 (命令特定返回) */
|
||||
static volatile u32 g_slot_cid; /* CQE dw3 低 16 位 CID, 提交侧比对防错位 */
|
||||
static u64 g_msi_irq_count; /* MSI handler 进入次数 (投递证明) */
|
||||
static u64 g_msi_slot_hits; /* 提交侧经完成槽完成的命令数 (中断路径) */
|
||||
static u64 g_msi_poll_harvests; /* 提交侧 irqsave 手动摘取数 (轮询路径) */
|
||||
static u64 g_msi_timeouts; /* 完成超时计数 (真故障, 非降级) */
|
||||
static u64 g_msi_cid_mismatch; /* 摘到 CID 与提交 cid 不符的 CQE 计数 (队列错位警报) */
|
||||
|
||||
/* ---- 基础工具 ---- */
|
||||
|
||||
static void log_hex(const char *prefix, u64 value) {
|
||||
@@ -149,6 +176,66 @@ static __inline__ void nvme_mb(void) {
|
||||
__asm__ volatile("" ::: "memory");
|
||||
}
|
||||
|
||||
/* 十进制打印 (MSI 计数器打点用, 比 hex 直观) */
|
||||
static void log_dec(const char *prefix, u64 val) {
|
||||
char buf[24];
|
||||
u32 pos = 0;
|
||||
if (!val) {
|
||||
buf[pos++] = '0';
|
||||
} else {
|
||||
char tmp[20];
|
||||
u32 n = 0;
|
||||
while (val) { tmp[n++] = (char)('0' + (val % 10)); val /= 10; }
|
||||
while (n) buf[pos++] = tmp[--n];
|
||||
}
|
||||
buf[pos] = 0;
|
||||
g_log->info(prefix);
|
||||
g_log->info(buf);
|
||||
}
|
||||
|
||||
static int memeq(const char *a, const char *b, u32 n) {
|
||||
for (u32 i = 0; i < n; i++) {
|
||||
if (a[i] != b[i]) return 0;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
static u32 str_len(const char *s) {
|
||||
u32 n = 0;
|
||||
while (s[n]) n++;
|
||||
return n;
|
||||
}
|
||||
|
||||
/* 在 NUL 结尾字符串中查找子串 (boot module cmdline 匹配用) */
|
||||
static int str_contains(const char *hay, const char *needle) {
|
||||
u32 nlen = str_len(needle);
|
||||
if (!nlen) return 1;
|
||||
for (u32 i = 0; hay[i]; i++) {
|
||||
u32 j = 0;
|
||||
while (j < nlen && hay[i + j] && hay[i + j] == needle[j]) j++;
|
||||
if (j == nlen) return 1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void nvme_cpuid(u32 leaf, u32 *a, u32 *b, u32 *c, u32 *d) {
|
||||
__asm__ volatile ("cpuid"
|
||||
: "=a"(*a), "=b"(*b), "=c"(*c), "=d"(*d)
|
||||
: "a"(leaf), "c"(0));
|
||||
}
|
||||
|
||||
/* irqsave 临界区: 提交侧手动摘取 CQE 时屏蔽中断, 与 MSI handler 互斥。
|
||||
* pushf/popf 配对恢复 IF — DSK 阶段 IF=0, 绝不能无条件 sti。 */
|
||||
static __inline__ u64 nvme_irqsave(void) {
|
||||
u64 flags;
|
||||
__asm__ volatile("pushfq; popq %0; cli" : "=r"(flags) :: "memory");
|
||||
return flags;
|
||||
}
|
||||
|
||||
static __inline__ void nvme_irqrestore(u64 flags) {
|
||||
__asm__ volatile("pushq %0; popfq" :: "r"(flags) : "memory", "cc");
|
||||
}
|
||||
|
||||
static u32 mmio_read32(u32 off) {
|
||||
return *(volatile u32 *)(void *)(g_regs + off);
|
||||
}
|
||||
@@ -204,6 +291,138 @@ static int nvme_find(u8 *out_bus, u8 *out_dev, u8 *out_func) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* ---- FUCK 配置自解析 (与 apic.c 同一范式, 不依赖 UTSM ini_parser) ----
|
||||
* UTSM 经 Limine boot module (cmdline="fuck:config") 预加载 FUCK;
|
||||
* kernel_api.boot_modules_response 对所有 DKM 驱动可见。
|
||||
* 此处只找 [drivers] 分区下的 nvme_msi 键; 缺失文件/键一律默认 1
|
||||
* (自动尝试 MSI, 失败回轮询), 与无配置时行为一致。
|
||||
*/
|
||||
|
||||
/* Limine boot module 最小类型 (与 apic.c / bootfs.c / UTSM limine.h 布局一致) */
|
||||
struct limine_file_min {
|
||||
u64 revision;
|
||||
void *address;
|
||||
u64 size;
|
||||
char *path;
|
||||
char *cmdline;
|
||||
u32 media_type;
|
||||
u32 unused;
|
||||
u32 tftp_ip;
|
||||
u32 tftp_port;
|
||||
u32 partition_index;
|
||||
u32 mbr_disk_id;
|
||||
u8 gpt_disk_uuid[16];
|
||||
u8 gpt_part_uuid[16];
|
||||
u8 part_uuid[16];
|
||||
};
|
||||
|
||||
struct limine_module_response_min {
|
||||
u64 revision;
|
||||
u64 module_count;
|
||||
struct limine_file_min **modules;
|
||||
};
|
||||
|
||||
/* 解析值 token: 支持 0/1/true/false/on/off/yes/no 及十进制整数 */
|
||||
static int parse_scalar(const char *line, u64 start, u64 line_len, int defval) {
|
||||
u64 i = start;
|
||||
while (i < line_len && (line[i] == ' ' || line[i] == '\t')) i++;
|
||||
u64 tok_start = i;
|
||||
while (i < line_len && line[i] != ' ' && line[i] != '\t' &&
|
||||
line[i] != '#' && line[i] != ';' && line[i] != '\r') i++;
|
||||
u64 tok_len = i - tok_start;
|
||||
const char *tok = line + tok_start;
|
||||
if (!tok_len) return defval;
|
||||
if (tok_len == 1 && tok[0] == '1') return 1;
|
||||
if (tok_len == 1 && tok[0] == '0') return 0;
|
||||
if (tok_len == 4 && memeq(tok, "true", 4)) return 1;
|
||||
if (tok_len == 5 && memeq(tok, "false", 5)) return 0;
|
||||
if (tok_len == 2 && memeq(tok, "on", 2)) return 1;
|
||||
if (tok_len == 3 && memeq(tok, "off", 3)) return 0;
|
||||
if (tok_len == 3 && memeq(tok, "yes", 3)) return 1;
|
||||
if (tok_len == 2 && memeq(tok, "no", 2)) return 0;
|
||||
int neg = 0;
|
||||
u64 j = 0;
|
||||
if (tok[0] == '-') { neg = 1; j = 1; }
|
||||
int val = 0;
|
||||
int any = 0;
|
||||
for (; j < tok_len; j++) {
|
||||
if (tok[j] < '0' || tok[j] > '9') return defval;
|
||||
val = val * 10 + (tok[j] - '0');
|
||||
any = 1;
|
||||
}
|
||||
if (!any) return defval;
|
||||
return neg ? -val : val;
|
||||
}
|
||||
|
||||
static int fuck_get_int(const char *text, u64 size,
|
||||
const char *section, const char *key, int defval) {
|
||||
u64 pos = 0;
|
||||
int in_section = 0;
|
||||
u32 slen = str_len(section);
|
||||
u32 klen = str_len(key);
|
||||
|
||||
while (pos < size) {
|
||||
u64 end = pos;
|
||||
while (end < size && text[end] != '\n') end++;
|
||||
u64 line_len = end - pos;
|
||||
if (line_len > 0 && text[pos + line_len - 1] == '\r') line_len--;
|
||||
const char *line = text + pos;
|
||||
|
||||
u64 i = 0;
|
||||
while (i < line_len && (line[i] == ' ' || line[i] == '\t')) i++;
|
||||
if (i < line_len) {
|
||||
char c = line[i];
|
||||
if (c == '#' || c == ';') {
|
||||
/* 注释行, 跳过 */
|
||||
} else if (c == '[') {
|
||||
in_section = 0;
|
||||
if (line_len >= (u64)(i + 1 + slen + 1) &&
|
||||
memeq(line + i + 1, section, slen) &&
|
||||
line[i + 1 + slen] == ']') {
|
||||
in_section = 1;
|
||||
}
|
||||
} else if (in_section) {
|
||||
if (line_len >= (u64)(i + klen) &&
|
||||
memeq(line + i, key, klen)) {
|
||||
u64 j = i + klen;
|
||||
while (j < line_len && (line[j] == ' ' || line[j] == '\t')) j++;
|
||||
if (j < line_len && line[j] == '=') {
|
||||
return parse_scalar(line, j + 1, line_len, defval);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
pos = end + 1;
|
||||
}
|
||||
return defval;
|
||||
}
|
||||
|
||||
static void nvme_load_config(const struct dkm_kernel_api *api) {
|
||||
/* 编译期默认: 自动尝试 MSI (任何前提缺失都会回退纯轮询, 零回归) */
|
||||
g_cfg_nvme_msi = 1;
|
||||
|
||||
const struct limine_module_response_min *resp =
|
||||
(const struct limine_module_response_min *)api->boot_modules_response;
|
||||
if (!resp || !resp->modules) {
|
||||
g_log->warn("[nvme] no boot modules; FUCK defaults in effect");
|
||||
return;
|
||||
}
|
||||
|
||||
for (u64 i = 0; i < resp->module_count; i++) {
|
||||
struct limine_file_min *f = resp->modules[i];
|
||||
if (!f || !f->cmdline || !f->address || !f->size) continue;
|
||||
if (!str_contains(f->cmdline, "fuck:config")) continue;
|
||||
|
||||
g_cfg_nvme_msi = fuck_get_int((const char *)f->address, f->size,
|
||||
"drivers", "nvme_msi", 1);
|
||||
g_log->info("[nvme] FUCK config module found");
|
||||
log_dec("[nvme] cfg nvme_msi=", (u64)g_cfg_nvme_msi);
|
||||
return;
|
||||
}
|
||||
|
||||
g_log->warn("[nvme] FUCK module (fuck:config) not found; defaults in effect");
|
||||
}
|
||||
|
||||
/* ---- CSTS 等待 ---- */
|
||||
|
||||
static int nvme_wait_csts(u32 mask, u32 expect, u64 timeout_ms) {
|
||||
@@ -229,6 +448,142 @@ static int nvme_wait_csts(u32 mask, u32 expect, u64 timeout_ms) {
|
||||
/* 前向声明: nvme_dump_regs 在 nvme_submit 中使用 */
|
||||
static void nvme_dump_regs(const char *ctx);
|
||||
|
||||
/* ---- B7 阶段3: IO CQ 完成摘取 (MSI handler 与提交侧轮询共用) ----
|
||||
* 返回 1 = 摘到一枚 CQE; 0 = 无新完成。
|
||||
* out_cid 返回 CQE dw3 低 16 位的命令 ID, 供调用方与提交 cid 比对 —
|
||||
* 单 outstanding 模型下 CQ 任何时刻只应有当前命令的一枚 CQE, CID 不匹配
|
||||
* 即队列状态错位的硬证据, 必须显式报错而非静默当作当前命令完成
|
||||
* (route=0 曾观测 stress readback MISMATCH @0x9000, 疑 CQE 提前消费)。
|
||||
* 并发模型: 单生产者(控制器 DMA 写 CQ) + 单逻辑消费者, 消费者有两个入口 ——
|
||||
* 1. MSI handler (IRQ 上下文): 同一 vector 在 EOI 前不会被 LAPIC 再次
|
||||
* 投递, handler 对同向量天然不可重入, 无需自锁;
|
||||
* 2. 提交侧统一等待 (主上下文): 必须在 nvme_irqsave 临界区内调用,
|
||||
* 屏蔽中断期间 handler 不可能插入, 消除 "phase 判定后、head 推进前
|
||||
* 被 handler 抢摘同一 CQE" 的双消费竞态。
|
||||
* head 推进 + CQ doorbell 只在此函数内发生, 是两个入口的唯一汇合点。
|
||||
*/
|
||||
static int nvme_iocq_harvest(u32 *out_status, u32 *out_dw0, u32 *out_cid) {
|
||||
volatile u32 *cq = (volatile u32 *)g_iocq.virt;
|
||||
u32 dw3 = cq[g_iocq_head * 4 + 3];
|
||||
if (((dw3 >> 16) & 1u) != g_iocq_phase) return 0;
|
||||
|
||||
if (out_dw0) *out_dw0 = cq[g_iocq_head * 4 + 0];
|
||||
if (out_cid) *out_cid = dw3 & 0xffffu;
|
||||
u32 sc = (dw3 >> 17) & 0xffu;
|
||||
u32 sct = (dw3 >> 25) & 0x7u;
|
||||
/* SC 与 SCT 联合编码 (与 nvme_submit 经典路径同一约定):
|
||||
* SCT!=0 且 SC==0 时只返回 sc 会被误判成功。 */
|
||||
*out_status = sc | (sct << 8);
|
||||
|
||||
g_iocq_head = (g_iocq_head + 1) % IO_QSIZE;
|
||||
if (g_iocq_head == 0) g_iocq_phase ^= 1u;
|
||||
nvme_mb(); /* head 先于 doorbell 可见 */
|
||||
mmio_write32(cq_head_db(1), g_iocq_head);
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* MSI 中断 handler: 摘 CQE 进完成槽。
|
||||
* 返回 1 = 自负 LAPIC EOI (抑制 idt_handler 的钩子补 EOI)。
|
||||
* 为何自写 EOI 而不依赖钩子: MSI 是设备向 LAPIC 直投的消息中断,
|
||||
* 投递路径不经过 IOAPIC/PIC, 与 apic_route 开关无关; 但 EOI 钩子只在
|
||||
* route=1 时注册, route=0 下钩子为 NULL 会漏写 EOI — LAPIC ISR 位
|
||||
* 残留将永久阻塞同优先级后续中断, MSI 静默退化为 one-shot。
|
||||
* handler 内直写 LAPIC EOI 寄存器后返回 1, 两种路由模式下行为一致。
|
||||
* LAPIC 未软件使能时该写为无害 no-op (此时 MSI 本就不会投递)。
|
||||
* 地址取 x86 默认 LAPIC base 0xFEE00000 + EOI 偏移 0xB0 (QEMU/MADT
|
||||
* 一致; SAS-R0 恒等映射覆盖 4G 以下, apic.drv 已实证可直访)。
|
||||
* 时序说明: 即使提交侧轮询抢先摘走 CQE, 控制器中断信号早已发出,
|
||||
* 本次 handler 仍会执行并计入 g_msi_irq_count — 投递证据不受竞态影响。 */
|
||||
static int nvme_msi_handler(u8 vector) {
|
||||
(void)vector;
|
||||
g_msi_irq_count++;
|
||||
u32 st = 0, dw0 = 0, cid = 0;
|
||||
if (nvme_iocq_harvest(&st, &dw0, &cid)) {
|
||||
g_slot_status = st;
|
||||
g_slot_dw0 = dw0;
|
||||
g_slot_cid = cid;
|
||||
nvme_mb(); /* payload 先于 valid 对提交侧可见 */
|
||||
g_slot_valid = 1;
|
||||
}
|
||||
*(volatile u32 *)(uintptr_t)0xFEE000B0u = 0; /* LAPIC EOI */
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* IO 命令统一完成等待 (MSI 模式): 完成槽(中断路径)优先, irqsave 手动摘取
|
||||
* (自适应轮询路径)兜底。MSI 健康时 handler 在 CQE 落盘瞬间填槽; MSI 未投递
|
||||
* (LAPIC 未启用/IF=0/信号丢失) 时手动摘取沿原 phase 语义直接完成, 调用方
|
||||
* 零感知。超时语义与经典路径一致 (CAP.TO*500ms*10, 下限 5s)。 */
|
||||
static int nvme_io_wait_completion(u16 cid, u32 opcode, u32 *out_cqe_dw0) {
|
||||
u64 submit_timeout_ms = g_timeout_ms * 10;
|
||||
if (submit_timeout_ms < 5000) submit_timeout_ms = 5000;
|
||||
u64 deadline = dkm_rdtsc() + dkm_tsc_per_ms * submit_timeout_ms;
|
||||
|
||||
for (;;) {
|
||||
/* 中断路径: handler 已摘取 CQE 进完成槽 */
|
||||
if (g_slot_valid) {
|
||||
u32 st = g_slot_status;
|
||||
u32 dw0 = g_slot_dw0;
|
||||
u32 scid = g_slot_cid;
|
||||
nvme_mb();
|
||||
g_slot_valid = 0;
|
||||
g_msi_slot_hits++;
|
||||
if (scid != (u32)cid) {
|
||||
/* CID 错位: 槽内 CQE 不属于本命令 — 队列状态已损,
|
||||
* 显式报错并继续等真 CQE (超时兜底), 绝不静默当成功 */
|
||||
g_msi_cid_mismatch++;
|
||||
g_log->error("[nvme] CID mismatch (slot)");
|
||||
log_hex("[nvme] expect cid=", cid);
|
||||
log_hex("[nvme] got cid=", scid);
|
||||
continue;
|
||||
}
|
||||
if (out_cqe_dw0) *out_cqe_dw0 = dw0;
|
||||
if (st) {
|
||||
g_log->error("[nvme] command failed (msi slot)");
|
||||
log_hex("[nvme] opcode=", opcode);
|
||||
log_hex("[nvme] cid=", cid);
|
||||
log_hex("[nvme] status=", st);
|
||||
return (int)st;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* 自适应轮询路径: irqsave 临界区内手动摘取 (与 handler 互斥) */
|
||||
u32 st = 0, dw0 = 0, hcid = 0;
|
||||
u64 flags = nvme_irqsave();
|
||||
int got = nvme_iocq_harvest(&st, &dw0, &hcid);
|
||||
nvme_irqrestore(flags);
|
||||
if (got) {
|
||||
g_msi_poll_harvests++;
|
||||
if (hcid != (u32)cid) {
|
||||
g_msi_cid_mismatch++;
|
||||
g_log->error("[nvme] CID mismatch (poll)");
|
||||
log_hex("[nvme] expect cid=", cid);
|
||||
log_hex("[nvme] got cid=", hcid);
|
||||
continue;
|
||||
}
|
||||
if (out_cqe_dw0) *out_cqe_dw0 = dw0;
|
||||
if (st) {
|
||||
g_log->error("[nvme] command failed");
|
||||
log_hex("[nvme] opcode=", opcode);
|
||||
log_hex("[nvme] cid=", cid);
|
||||
log_hex("[nvme] status=", st);
|
||||
return (int)st;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (dkm_rdtsc() > deadline) {
|
||||
g_msi_timeouts++;
|
||||
g_log->error("[nvme] completion timeout (msi mode)");
|
||||
log_hex("[nvme] opcode=", opcode);
|
||||
log_hex("[nvme] cid=", cid);
|
||||
nvme_dump_regs("completion timeout");
|
||||
return -100;
|
||||
}
|
||||
__asm__ volatile("pause");
|
||||
}
|
||||
}
|
||||
|
||||
/* ---- 命令提交（同步轮询, 单 outstanding） ----
|
||||
* dw[16] 为完整 SQE（dw0 低 16 位不含 CID, 由本函数填入）。
|
||||
* 返回 0 成功；>0 = NVMe status code；<0 超时/内部错误。
|
||||
@@ -239,6 +594,10 @@ static int nvme_submit(volatile u32 *sq, u32 *sq_tail, u16 sq_qid,
|
||||
dw[0] = (dw[0] & 0xffffu) | ((u32)g_cid << 16);
|
||||
u32 cid = g_cid;
|
||||
g_cid++;
|
||||
/* CID=0 保留不用: QEMU 在 MSI-X unmask 边界会向 IO CQ 补投一枚
|
||||
* CID=0/phase 正确/status 成功的幽灵 CQE (实测稳定复现), g_cid 回绕
|
||||
* 跳过 0 可保证该幽灵 CQE 永远被 CID 校验拒绝, 绝无误判窗口。 */
|
||||
if (g_cid == 0) g_cid = 1;
|
||||
|
||||
/* 逐 dword 写入 SQE（64B），避免 freestanding 下编译器生成 memcpy 调用 */
|
||||
u32 pos = *sq_tail;
|
||||
@@ -248,6 +607,13 @@ static int nvme_submit(volatile u32 *sq, u32 *sq_tail, u16 sq_qid,
|
||||
nvme_mb(); /* SQ 内容先于 doorbell 可见 */
|
||||
mmio_write32(sq_tail_db(sq_qid), *sq_tail);
|
||||
|
||||
/* B7 阶段3: IO 队列 MSI 模式 → 完成槽 + irqsave 摘取统一等待。
|
||||
* admin 队列保持纯轮询 (仅 init 期使用, 且 INTMC 解除前 IV0 处于
|
||||
* 屏蔽态, admin 完成不会触发 MSI)。 */
|
||||
if (cq_qid == 1 && g_msi_enabled) {
|
||||
return nvme_io_wait_completion(cid, dw[0] & 0xffu, out_cqe_dw0);
|
||||
}
|
||||
|
||||
/* 真机超时: 使用 CAP.TO * 500ms * 10 (留 10 倍余量), 下限 5s。
|
||||
* 真机 NVMe 控制器在重负载下可能需要更长的完成时间。 */
|
||||
u64 submit_timeout_ms = g_timeout_ms * 10;
|
||||
@@ -371,19 +737,277 @@ static int nvme_identify_namespace(u32 nsid, u64 *out_nsze, u32 *out_lbads) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* ---- B7 阶段3: PCI MSI 能力编程 ----
|
||||
* MSI cap (ID 0x05) 布局:
|
||||
* +0x00 u8 Cap ID (=0x05) +0x01 u8 Next Ptr
|
||||
* +0x02 u16 Message Control: bit0 Enable, bit[3:1] MMC(可申请向量数-1),
|
||||
* bit[6:4] MME(已分配向量数-1), bit7 64-bit Capable, bit8 PVM
|
||||
* +0x04 u32 Message Address
|
||||
* 64-bit 时: +0x08 u32 Message Upper Address, +0x0C u16 Message Data
|
||||
* 32-bit 时: +0x08 u16 Message Data
|
||||
* PVM(bit8)=1 时另有 Mask/Pending 寄存器, 复位值 0 (全部 unmask)。
|
||||
* x86 LAPIC 投递公式 (physical destination, fixed delivery):
|
||||
* Address = 0xFEE00000 | (dest_apic_id << 12) (RH=0, DM=0)
|
||||
* Data = vector | (0<<8 delivery=fixed) (level/trigger 对 MSI 无效)
|
||||
*/
|
||||
#define PCI_CAP_ID_MSI 0x05
|
||||
#define PCI_CAP_ID_MSIX 0x11
|
||||
#define PCI_STATUS_CAPLIST 0x10u
|
||||
|
||||
static int nvme_find_pci_cap(u8 bus, u8 dev, u8 func, u8 cap_id) {
|
||||
u32 reg04 = dkm_pci_read(bus, dev, func, PCI_COMMAND);
|
||||
if (!((reg04 >> 16) & PCI_STATUS_CAPLIST)) return -1; /* Status.CapList=0 */
|
||||
u8 ptr = (u8)(dkm_pci_read(bus, dev, func, PCI_CAP_PTR) & 0xFC);
|
||||
int guard = 0;
|
||||
while (ptr && guard++ < 64) { /* guard 防配置空间坏链死循环 */
|
||||
u32 dw = dkm_pci_read(bus, dev, func, ptr);
|
||||
u8 id = (u8)(dw & 0xff);
|
||||
u8 next = (u8)((dw >> 8) & 0xff);
|
||||
log_hex("[nvme] pci cap id=", id);
|
||||
log_hex("[nvme] pci cap at=", ptr);
|
||||
if (id == cap_id) return (int)ptr;
|
||||
ptr = next & 0xFC;
|
||||
}
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* MSI cap (0x05) 编程路径: 成功返回 1, cap 缺失或失败返回 0。
|
||||
* 失败路径完整回滚 (恢复 msg_ctl + 释放向量), 不留半编程状态。 */
|
||||
static int nvme_msi_program(const struct dkm_kernel_api *api,
|
||||
u8 bus, u8 dev, u8 func) {
|
||||
int cap = nvme_find_pci_cap(bus, dev, func, PCI_CAP_ID_MSI);
|
||||
if (cap < 0) {
|
||||
g_log->info("[nvme] MSI capability not present");
|
||||
return 0;
|
||||
}
|
||||
|
||||
u32 cdw = dkm_pci_read(bus, dev, func, (u8)cap);
|
||||
u32 msg_ctl = (cdw >> 16) & 0xffffu;
|
||||
int cap64 = (int)((msg_ctl >> 7) & 1u);
|
||||
int pvm = (int)((msg_ctl >> 8) & 1u);
|
||||
log_hex("[nvme] MSI msg_ctl=", msg_ctl);
|
||||
log_hex("[nvme] MSI 64bit=", (u64)cap64);
|
||||
log_hex("[nvme] MSI pvm=", (u64)pvm);
|
||||
|
||||
/* 动态向量: UTSM 位图池 0x40-0xDF, 与静态向量 (tick 0xE0/spurious 0xFF)
|
||||
* 及 legacy PIC 段 (0x20-0x2F) 无交叠。 */
|
||||
int vector = api->irq_vector_alloc();
|
||||
if (vector < 0 || vector > 255) {
|
||||
g_log->warn("[nvme] MSI: vector alloc failed; polling");
|
||||
return 0;
|
||||
}
|
||||
log_dec("[nvme] MSI vector=", (u64)vector);
|
||||
|
||||
/* 目的 APIC ID: CPUID.1:EBX[31:24] = BSP initial APIC ID (QEMU=0) */
|
||||
u32 ca, cb, cc_, cd;
|
||||
nvme_cpuid(1, &ca, &cb, &cc_, &cd);
|
||||
(void)ca; (void)cc_; (void)cd;
|
||||
u32 dest = (cb >> 24) & 0xffu;
|
||||
log_hex("[nvme] MSI dest apic id=", dest);
|
||||
|
||||
u32 addr = 0xFEE00000u | (dest << 12);
|
||||
u32 data = (u32)vector & 0xffu; /* fixed delivery, edge */
|
||||
|
||||
/* 先写 Address/Data, 最后置 Enable — 避免半成品消息被发出 */
|
||||
dkm_pci_write(bus, dev, func, (u8)(cap + 4), addr);
|
||||
if (cap64) {
|
||||
dkm_pci_write(bus, dev, func, (u8)(cap + 8), 0); /* upper addr */
|
||||
u32 dw = dkm_pci_read(bus, dev, func, (u8)(cap + 12));
|
||||
dw = (dw & 0xffff0000u) | data; /* data 为低 u16 */
|
||||
dkm_pci_write(bus, dev, func, (u8)(cap + 12), dw);
|
||||
} else {
|
||||
u32 dw = dkm_pci_read(bus, dev, func, (u8)(cap + 8));
|
||||
dw = (dw & 0xffff0000u) | data;
|
||||
dkm_pci_write(bus, dev, func, (u8)(cap + 8), dw);
|
||||
}
|
||||
|
||||
/* Message Control: MME=0 (单向量), Enable=1; 低 u16 (id/next) 回写原值 */
|
||||
u32 mc = msg_ctl;
|
||||
mc &= ~(0x7u << 4); /* MME=0 → 1 vector */
|
||||
mc |= 1u; /* MSI Enable */
|
||||
cdw = (cdw & 0x0000ffffu) | (mc << 16);
|
||||
dkm_pci_write(bus, dev, func, (u8)cap, cdw);
|
||||
|
||||
/* PVM: 显式清 mask bit0 (复位值即为 0, 此处防御性 RMW) */
|
||||
if (pvm) {
|
||||
int mask_off = cap64 ? cap + 16 : cap + 12;
|
||||
u32 mask = dkm_pci_read(bus, dev, func, (u8)mask_off);
|
||||
mask &= ~1u;
|
||||
dkm_pci_write(bus, dev, func, (u8)mask_off, mask);
|
||||
log_hex("[nvme] MSI mask cleared=", mask);
|
||||
}
|
||||
|
||||
/* 回读验证: Enable 置位 + Address/Data 与编程值一致 */
|
||||
u32 rb_ctl = (dkm_pci_read(bus, dev, func, (u8)cap) >> 16) & 0xffffu;
|
||||
u32 rb_addr = dkm_pci_read(bus, dev, func, (u8)(cap + 4));
|
||||
u32 rb_data = dkm_pci_read(bus, dev, func,
|
||||
(u8)(cap64 ? cap + 12 : cap + 8)) & 0xffffu;
|
||||
log_hex("[nvme] MSI readback ctl=", rb_ctl);
|
||||
log_hex("[nvme] MSI readback addr=", rb_addr);
|
||||
log_hex("[nvme] MSI readback data=", rb_data);
|
||||
if (!(rb_ctl & 1u) || rb_addr != addr || (rb_data & 0xffu) != data) {
|
||||
g_log->warn("[nvme] MSI: readback mismatch; rolling back");
|
||||
u32 rb = dkm_pci_read(bus, dev, func, (u8)cap);
|
||||
rb = (rb & 0x0000ffffu) | (msg_ctl << 16); /* 恢复原 msg_ctl */
|
||||
dkm_pci_write(bus, dev, func, (u8)cap, rb);
|
||||
api->irq_vector_free(vector);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* 注册 handler (irq_register 已接受向量命名空间, >0x2F 直挂分发表) */
|
||||
api->irq_register((u8)vector, (void *)(uintptr_t)nvme_msi_handler);
|
||||
|
||||
g_msi_enabled = 1;
|
||||
g_msi_vector = vector;
|
||||
g_log->info("[nvme] MSI enabled (IO CQ IEN=1, IV=0)");
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* 按 BIR 读取 BAR 物理基址 (处理 64-bit BAR; IO BAR 返回 0) */
|
||||
static u64 nvme_bar_phys(u8 bus, u8 dev, u8 func, u32 bir) {
|
||||
u8 reg = (u8)(PCI_BAR0 + bir * 4u);
|
||||
u32 lo = dkm_pci_read(bus, dev, func, reg);
|
||||
if (lo & 1u) return 0; /* IO BAR */
|
||||
if ((lo & 0x6u) == 0x4u) { /* 64-bit MMIO BAR */
|
||||
u32 hi = dkm_pci_read(bus, dev, func, (u8)(reg + 4));
|
||||
return ((u64)hi << 32) | (u64)(lo & 0xFFFFFFF0u);
|
||||
}
|
||||
return (u64)(lo & 0xFFFFFFF0u);
|
||||
}
|
||||
|
||||
/* MSI-X cap (0x11) 编程路径: 成功返回 1, cap 缺失或失败返回 0。
|
||||
* QEMU nvme 只暴露 MSI-X (无 0x05), 本路径是 QEMU 下中断驱动化的唯一通道。
|
||||
* 与 MSI 的差异仅在消息存储位置: MSI-X 的 addr/data 存放在 BAR 内的
|
||||
* 表项 (16B/项), 需先把表区 MMIO 映射进 CPU 地址空间再编程 entry 0。
|
||||
* 失败路径完整回滚 (清 Enable + 表项重新 mask + 释放向量)。 */
|
||||
static int nvme_msix_program(const struct dkm_kernel_api *api,
|
||||
u8 bus, u8 dev, u8 func) {
|
||||
int cap = nvme_find_pci_cap(bus, dev, func, PCI_CAP_ID_MSIX);
|
||||
if (cap < 0) {
|
||||
g_log->warn("[nvme] MSI-X capability not present; polling");
|
||||
return 0;
|
||||
}
|
||||
if (!api->mm_map_mmio) {
|
||||
g_log->warn("[nvme] MSI-X: mm_map_mmio unavailable; polling");
|
||||
return 0;
|
||||
}
|
||||
|
||||
u32 cdw = dkm_pci_read(bus, dev, func, (u8)cap);
|
||||
u32 msg_ctl = (cdw >> 16) & 0xffffu;
|
||||
u32 table_size = (msg_ctl & 0x7ffu) + 1u; /* N-1 encoded */
|
||||
u32 tbl_dw = dkm_pci_read(bus, dev, func, (u8)(cap + 4));
|
||||
u32 bir = tbl_dw & 7u;
|
||||
u32 tbl_off = tbl_dw & ~7u;
|
||||
log_hex("[nvme] MSI-X msg_ctl=", msg_ctl);
|
||||
log_dec("[nvme] MSI-X table size=", table_size);
|
||||
log_hex("[nvme] MSI-X table BIR=", bir);
|
||||
log_hex("[nvme] MSI-X table offset=", tbl_off);
|
||||
if (bir > 5u) {
|
||||
g_log->warn("[nvme] MSI-X: invalid BIR; polling");
|
||||
return 0;
|
||||
}
|
||||
|
||||
u64 bar_phys = nvme_bar_phys(bus, dev, func, bir);
|
||||
if (!bar_phys) {
|
||||
g_log->warn("[nvme] MSI-X: table BAR invalid; polling");
|
||||
return 0;
|
||||
}
|
||||
u64 tbl_phys = bar_phys + tbl_off;
|
||||
log_hex("[nvme] MSI-X table BAR phys=", bar_phys);
|
||||
log_hex("[nvme] MSI-X table phys=", tbl_phys);
|
||||
|
||||
/* 映射表区首页 (含 entry0 的 16B)。mm_map_mmio 返回含页内偏移的指针,
|
||||
* 页属性 PCD|PWT (UC), MSI-X 表访问不要求 cache 一致性操作。 */
|
||||
volatile u32 *tbl = (volatile u32 *)api->mm_map_mmio(tbl_phys, 4096);
|
||||
if (!tbl) {
|
||||
g_log->warn("[nvme] MSI-X: table MMIO map failed; polling");
|
||||
return 0;
|
||||
}
|
||||
|
||||
int vector = api->irq_vector_alloc();
|
||||
if (vector < 0 || vector > 255) {
|
||||
g_log->warn("[nvme] MSI-X: vector alloc failed; polling");
|
||||
return 0;
|
||||
}
|
||||
log_dec("[nvme] MSI-X vector=", (u64)vector);
|
||||
|
||||
u32 ca, cb, cc_, cd;
|
||||
nvme_cpuid(1, &ca, &cb, &cc_, &cd);
|
||||
(void)ca; (void)cc_; (void)cd;
|
||||
u32 dest = (cb >> 24) & 0xffu;
|
||||
u32 addr = 0xFEE00000u | (dest << 12);
|
||||
|
||||
/* 先写表项 (addr/data/mask=0), 再置 cap Enable — 避免半成品消息 */
|
||||
volatile u32 *e = tbl; /* entry 0 */
|
||||
e[0] = addr; /* Msg Addr Lo */
|
||||
e[1] = 0; /* Msg Addr Hi */
|
||||
e[2] = (u32)vector & 0xffu; /* Msg Data = 向量 */
|
||||
e[3] = 0; /* Vector Control: unmask */
|
||||
nvme_mb();
|
||||
|
||||
u32 nc = (msg_ctl | 0x8000u) & ~(1u << 14); /* Enable=1, FunctionMask=0 */
|
||||
cdw = (cdw & 0x0000ffffu) | (nc << 16);
|
||||
dkm_pci_write(bus, dev, func, (u8)cap, cdw);
|
||||
|
||||
/* 回读验证: cap Enable + 表项 addr/data/mask 与编程值一致 */
|
||||
u32 rb_ctl = (dkm_pci_read(bus, dev, func, (u8)cap) >> 16) & 0xffffu;
|
||||
u32 rb_a0 = e[0], rb_a1 = e[1], rb_d = e[2], rb_vc = e[3];
|
||||
log_hex("[nvme] MSI-X readback ctl=", rb_ctl);
|
||||
log_hex("[nvme] MSI-X readback entry addr=", ((u64)rb_a1 << 32) | rb_a0);
|
||||
log_hex("[nvme] MSI-X readback entry data=", rb_d);
|
||||
log_hex("[nvme] MSI-X readback entry vctl=", rb_vc);
|
||||
if (!(rb_ctl & 0x8000u) || rb_a0 != addr || rb_a1 != 0 ||
|
||||
(rb_d & 0xffu) != ((u32)vector & 0xffu) || (rb_vc & 1u)) {
|
||||
g_log->warn("[nvme] MSI-X: readback mismatch; rolling back");
|
||||
u32 rb = dkm_pci_read(bus, dev, func, (u8)cap);
|
||||
rb = (rb & 0x0000ffffu) | (msg_ctl << 16); /* 恢复原 msg_ctl */
|
||||
dkm_pci_write(bus, dev, func, (u8)cap, rb);
|
||||
e[3] = 1; /* 表项重新 mask */
|
||||
api->irq_vector_free(vector);
|
||||
return 0;
|
||||
}
|
||||
|
||||
api->irq_register((u8)vector, (void *)(uintptr_t)nvme_msi_handler);
|
||||
|
||||
g_msi_enabled = 1;
|
||||
g_msix_mode = 1;
|
||||
g_msi_vector = vector;
|
||||
g_log->info("[nvme] MSI-X enabled (table entry0, IO CQ IEN=1, IV=0)");
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* 中断驱动化入口: 先 MSI (0x05), 缺则 MSI-X (0x11), 皆不可则纯轮询。
|
||||
* 前提检查集中在此; 两条编程路径各自保证失败完整回滚。 */
|
||||
static int nvme_msi_setup(const struct dkm_kernel_api *api,
|
||||
u8 bus, u8 dev, u8 func) {
|
||||
if (!g_cfg_nvme_msi) {
|
||||
g_log->info("[nvme] MSI disabled by FUCK (nvme_msi=0); polling mode");
|
||||
return 0;
|
||||
}
|
||||
if (!api->irq_vector_alloc || !api->irq_vector_free || !api->irq_register) {
|
||||
g_log->warn("[nvme] MSI: kernel vector allocator unavailable; polling");
|
||||
return 0;
|
||||
}
|
||||
if (nvme_msi_program(api, bus, dev, func)) return 1;
|
||||
return nvme_msix_program(api, bus, dev, func);
|
||||
}
|
||||
|
||||
/* ---- IO queue 创建 ---- */
|
||||
|
||||
static int nvme_create_io_queues(void) {
|
||||
u32 dw[16];
|
||||
|
||||
/* Create IO CQ (qid=1): PC=1, IEN=0 (轮询模式)
|
||||
* CDW10 = QSIZE[31:16](0's based) | QID[15:0] —— QID 必须在低半字 */
|
||||
/* Create IO CQ (qid=1): PC=1; MSI 就绪时 IEN=1 + IV=0
|
||||
* CDW10 = QSIZE[31:16](0's based) | QID[15:0] —— QID 必须在低半字
|
||||
* CDW11 = IV[31:16] | IEN[1] | PC[0] —— IV=0 与 INTMS/INTMC bit0 对应 */
|
||||
nvme_zero(dw, sizeof(dw));
|
||||
dw[0] = NVME_ADM_CREATE_IOCQ;
|
||||
dw[6] = (u32)(g_iocq.phys & 0xffffffffu);
|
||||
dw[7] = (u32)(g_iocq.phys >> 32);
|
||||
dw[10] = ((u32)(IO_QSIZE - 1u) << 16) | 1u;
|
||||
dw[11] = 1;
|
||||
dw[11] = 1u;
|
||||
if (g_msi_enabled) dw[11] = 1u | (1u << 1); /* PC=1, IEN=1, IV=0 */
|
||||
log_hex("[nvme] create IOCQ CDW11=", dw[11]);
|
||||
int rc = nvme_admin_submit(dw, 0);
|
||||
if (rc != 0) {
|
||||
g_log->error("[nvme] create IO CQ failed");
|
||||
@@ -586,6 +1210,61 @@ static void nvme_selftest_rw(u64 lba, u32 sectors) {
|
||||
g_log->info("[nvme] write+flush+readback verify OK");
|
||||
}
|
||||
|
||||
/* B7 阶段3 压测: 128 扇区 (64KiB, PRP list 路径) × 50 次 写+读。
|
||||
* 统计总耗时与 MSI 计数器增量, 供中断/轮询两模式粗粒度对比。
|
||||
* 仅签名测试盘运行 (写 LBA3000 起的 50 个块, 不碰 LBA0 签名区)。 */
|
||||
static void nvme_selftest_stress(void) {
|
||||
static u8 wbuf[65536];
|
||||
static u8 rbuf[65536];
|
||||
for (u32 i = 0; i < sizeof(wbuf); i++) wbuf[i] = (u8)(i * 17u + 3u);
|
||||
|
||||
u64 irq0 = g_msi_irq_count, slot0 = g_msi_slot_hits, poll0 = g_msi_poll_harvests;
|
||||
u64 t0 = dkm_rdtsc();
|
||||
u32 fails = 0;
|
||||
for (u32 i = 0; i < 50; i++) {
|
||||
u64 lba = 3000 + (u64)i * 128;
|
||||
if (nvme_block_write(0, lba, 128, wbuf) != 0) { fails++; break; }
|
||||
if (nvme_block_read(0, lba, 128, rbuf) != 0) { fails++; break; }
|
||||
}
|
||||
u64 elapsed_ms = dkm_tsc_per_ms ? (dkm_rdtsc() - t0) / dkm_tsc_per_ms : 0;
|
||||
|
||||
/* 末次读回全量校验 (数据通路在 MSI 模式下完整性证明) */
|
||||
if (!fails) {
|
||||
for (u32 i = 0; i < sizeof(wbuf); i++) {
|
||||
if (rbuf[i] != wbuf[i]) {
|
||||
g_log->error("[nvme] stress readback MISMATCH");
|
||||
log_hex("[nvme] first bad idx=", i);
|
||||
log_hex("[nvme] expect=", wbuf[i]);
|
||||
log_hex("[nvme] actual=", rbuf[i]);
|
||||
log_hex("[nvme] cq head=", g_iocq_head);
|
||||
log_hex("[nvme] cq phase=", g_iocq_phase);
|
||||
log_hex("[nvme] slot valid=", g_slot_valid);
|
||||
fails++;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
log_dec("[nvme] stress 50x(128sec W+R) ms=", elapsed_ms);
|
||||
log_dec("[nvme] stress fails=", fails);
|
||||
log_dec("[nvme] stress irq delta=", g_msi_irq_count - irq0);
|
||||
log_dec("[nvme] stress slot delta=", g_msi_slot_hits - slot0);
|
||||
log_dec("[nvme] stress poll delta=", g_msi_poll_harvests - poll0);
|
||||
if (!fails) g_log->info("[nvme] stress verify OK");
|
||||
}
|
||||
|
||||
static void nvme_msi_stats_dump(const char *tag) {
|
||||
g_log->info(tag);
|
||||
log_dec("[nvme] msi enabled=", (u64)g_msi_enabled);
|
||||
log_dec("[nvme] msix mode=", (u64)g_msix_mode);
|
||||
log_dec("[nvme] msi vector=", (u64)(g_msi_vector < 0 ? 0 : g_msi_vector));
|
||||
log_dec("[nvme] msi irq count=", g_msi_irq_count);
|
||||
log_dec("[nvme] msi slot hits=", g_msi_slot_hits);
|
||||
log_dec("[nvme] msi poll harvests=", g_msi_poll_harvests);
|
||||
log_dec("[nvme] msi timeouts=", g_msi_timeouts);
|
||||
log_dec("[nvme] msi cid mismatch=", g_msi_cid_mismatch);
|
||||
}
|
||||
|
||||
/* ---- 真机诊断: dump 关键寄存器 ---- */
|
||||
|
||||
static void nvme_dump_regs(const char *ctx) {
|
||||
@@ -673,6 +1352,7 @@ int driver_init(const struct dkm_kernel_api *api,
|
||||
dkm_instr_init(api);
|
||||
|
||||
g_log->info("[nvme] init begin");
|
||||
nvme_load_config(api);
|
||||
|
||||
u8 bus = 0, dev = 0, func = 0;
|
||||
if (nvme_find(&bus, &dev, &func) != 0) {
|
||||
@@ -867,6 +1547,9 @@ dma_ok:
|
||||
log_hex("[nvme] chunk max sectors=", g_chunk_max_sectors);
|
||||
}
|
||||
|
||||
/* ---- B7 阶段3: IO queue 创建前尝试 MSI (任何前提缺失回退纯轮询) ---- */
|
||||
nvme_msi_setup(api, bus, dev, func);
|
||||
|
||||
/* ---- IO queue ---- */
|
||||
if (nvme_create_io_queues() != 0) {
|
||||
g_log->error("[nvme] IO queue creation failed");
|
||||
@@ -876,6 +1559,13 @@ dma_ok:
|
||||
g_io_ready = 1;
|
||||
g_log->info("[nvme] IO queue live");
|
||||
|
||||
/* MSI 就绪: INTMC 解除 IV0 屏蔽 (此前 IV0 保持屏蔽, admin 完成不产生
|
||||
* MSI; 此后 IO CQ 每次完成经 MSI 投递到 g_msi_vector) */
|
||||
if (g_msi_enabled) {
|
||||
mmio_write32(NVME_INTMC, 1u);
|
||||
log_hex("[nvme] INTMC unmask IV0, INTMS=", mmio_read32(NVME_INTMS));
|
||||
}
|
||||
|
||||
/* ---- LBA0 读取验证 ---- */
|
||||
{
|
||||
int rc = nvme_io_rw(NVME_IO_READ, 0, 1, g_data.phys);
|
||||
@@ -921,6 +1611,7 @@ dma_ok:
|
||||
nvme_selftest_read_multipage(); /* 32 扇区 16KiB: PRP list 读 */
|
||||
nvme_selftest_rw(1000, 16); /* 8KiB: PRP2 直连 (2 页) 写+读回 */
|
||||
nvme_selftest_rw(2000, 32); /* 16KiB: PRP list (4 页) 写+读回 */
|
||||
nvme_selftest_stress(); /* B7: 128 扇区×50 压测 + MSI 计数 */
|
||||
if (nvme_lba0_sig_ok()) {
|
||||
g_log->info("[nvme] LBA0 sig intact after write tests");
|
||||
} else {
|
||||
@@ -930,6 +1621,8 @@ dma_ok:
|
||||
g_log->info("[nvme] not a test disk; write self-test skipped");
|
||||
}
|
||||
|
||||
nvme_msi_stats_dump("[nvme] --- MSI stats ---");
|
||||
|
||||
g_log->info("[nvme] driver ready");
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -141,9 +141,15 @@ fn raster_tri(
|
||||
let mut w0 = edge(x1, y1, x2, y2, px as f32 + 0.5, fy) * inv_area;
|
||||
let mut w1 = edge(x2, y2, x0, y0, px as f32 + 0.5, fy) * inv_area;
|
||||
let mut w2 = 1.0 - w0 - w1;
|
||||
// Per-pixel increments (dx = +1)
|
||||
let dw0 = (y1 - y2) * inv_area;
|
||||
let dw1 = (y2 - y0) * inv_area;
|
||||
// Per-pixel increments (dx = +1).
|
||||
// d/dpx edge(a, b, P) = (b.y - a.y):
|
||||
// w0 = edge(p1, p2, P) -> (y2 - y1)
|
||||
// w1 = edge(p2, p0, P) -> (y0 - y2)
|
||||
// 符号写反会让 u/v/顶点色沿 +x 反向插值：文字逐行起始像素正确、
|
||||
// 向右逐渐反向采样图集（字形水平镜像/竖条碎裂），纯色面板因
|
||||
// 采样恒白区域不可见而掩盖了该 bug。
|
||||
let dw0 = (y2 - y1) * inv_area;
|
||||
let dw1 = (y0 - y2) * inv_area;
|
||||
|
||||
while px < max_x {
|
||||
if w0 >= 0.0 && w1 >= 0.0 && w2 >= 0.0 {
|
||||
|
||||
+165
-13
@@ -405,10 +405,21 @@ static void pic_remap(void) {
|
||||
outb(PIC2_DATA, 0xFF); /* mask all slave */
|
||||
}
|
||||
|
||||
/* 运行时读取当前内核 CS — 必须与实际生效的 GDT 一致。
|
||||
* 注意:UTSM 运行在 Limine 提供的 GDT 下(CS=0x28),不能假设
|
||||
* OSDev 教程布局(0x08=code)。若 IDT gate selector 指向无效/非64位
|
||||
* 代码段,异常派发时加载 CS 会 #GP(selector error),异常链升级为
|
||||
* #DF -> triple fault,且全程无任何日志输出。 */
|
||||
static u16 idt_kernel_cs(void) {
|
||||
u16 cs;
|
||||
__asm__ volatile("mov %%cs, %0" : "=r"(cs));
|
||||
return cs;
|
||||
}
|
||||
|
||||
static void idt_set_entry(u8 vector, void *handler, u8 ist, u8 type) {
|
||||
u64 addr = (u64)handler;
|
||||
g_idt[vector].offset_low = (u16)(addr & 0xffff);
|
||||
g_idt[vector].selector = 0x08; /* kernel code segment (from GDT) */
|
||||
g_idt[vector].selector = idt_kernel_cs();
|
||||
g_idt[vector].ist = ist;
|
||||
g_idt[vector].type_attr = type;
|
||||
g_idt[vector].offset_mid = (u16)((addr >> 16) & 0xffff);
|
||||
@@ -459,15 +470,122 @@ void idt_halt_all(void) {
|
||||
__asm__ volatile("lidt %0" :: "m"(idtr));
|
||||
}
|
||||
|
||||
void idt_install_dsk_diag(void) {
|
||||
/* BUG-20260801-005: DSK 交接诊断 IDT（替代原 idt_halt_all 静默化）。
|
||||
* 原 halt_all 将 256 项全部换成静默 halt stub——防御正确，但 DSK
|
||||
* 阶段任何 CPU 异常（PF/GP/UD）被无声吞掉，零日志无法诊断
|
||||
* （实测 pe HELLO64.EXE 早期 #PF 直接表现为"卡死/三重故障"）。
|
||||
* 本函数在保留 IRQ 防御的前提下恢复异常可见性:
|
||||
* vector 0-31 -> 原 isr_stub（走 idt_handler 异常路径，打完整
|
||||
* vector/err/rip/CR2/寄存器日志后安全停机）
|
||||
* vector 32-255 -> 保持 halt stub（PIC 已全 mask 且 IF=0，IRQ 本
|
||||
* 不该到达；spurious IRQ 维持原防御行为）
|
||||
* 不做 pic_remap / sti——DSK 上下文 IF=0 不变式保持不变。
|
||||
* isr_stub / idt_handler 是 UTSM .text 代码，SAS-R0 下常驻内存
|
||||
* 有效（BUG-20260729-013 登记行为:halt_all 引入前 DSK 阶段异常
|
||||
* 本就能送达 idt_handler）；异常路径只用 log/serial，不依赖已过期
|
||||
* 的 IRQ handler 状态。 */
|
||||
for (u16 i = 0; i < 32; i++) {
|
||||
idt_set_entry((u8)i, g_isr_table[i], 0, 0x8E);
|
||||
}
|
||||
for (u16 i = 32; i < IDT_ENTRIES; i++) {
|
||||
idt_set_entry((u8)i, (void *)isr_halt_stub, 0, 0x8E);
|
||||
}
|
||||
idt_ptr idtr;
|
||||
idtr.limit = (u16)(sizeof(g_idt) - 1);
|
||||
idtr.base = (u64)&g_idt;
|
||||
__asm__ volatile("lidt %0" :: "m"(idtr));
|
||||
log_info("[IDT] DSK diag IDT installed (exc 0-31 logged, IRQ halted)");
|
||||
}
|
||||
|
||||
void idt_install_pe_diag(void) {
|
||||
/* 语义与 idt_install_dsk_diag 相同：BUG-20260801-005 起 DSK 交接
|
||||
* 默认装备诊断 IDT，PE 原生执行前重装一次保持幂等（防御 PE 运行
|
||||
* 期间 IDT 被第三方改写的场景）。 */
|
||||
idt_install_dsk_diag();
|
||||
}
|
||||
|
||||
/* IRQ handler table — 扩展到 256 个 vector (真机 APIC/IOAPIC/MSI 需要) */
|
||||
static irq_handler_t g_irq_handlers[256];
|
||||
|
||||
/* B7 阶段2: LAPIC EOI 钩子 (由 apic.drv 经 kernel_api.register_apic_eoi 注册)。
|
||||
* 指向写 LAPIC EOI 寄存器 (0xFEE000B0) 的函数; NULL = PIC 路由模式, 不调用。
|
||||
* 单核 BSP 场景: 注册发生在 apic.drv init (普通上下文), 调用发生在 IRQ
|
||||
* 上下文; 函数指针赋值对齐原子, 无需锁。 */
|
||||
static void (*g_apic_eoi_hook)(void) = 0;
|
||||
|
||||
void idt_register_apic_eoi(void (*eoi_fn)(void)) {
|
||||
g_apic_eoi_hook = eoi_fn;
|
||||
if (eoi_fn) {
|
||||
log_info("[IDT] APIC EOI hook registered (LAPIC EOI on IRQ dispatch)");
|
||||
} else {
|
||||
log_info("[IDT] APIC EOI hook cleared");
|
||||
}
|
||||
}
|
||||
|
||||
/* ---- 插桩: IRQ 统计计数器 ---- */
|
||||
INSTR_STAT_DECL(pic_irq_total);
|
||||
INSTR_STAT_DECL(apic_irq_total);
|
||||
|
||||
/* ---- B7 阶段3: 动态 IDT 向量分配器 (MSI/MSI-X 用) ----
|
||||
* 分配范围 0x40-0xDF (160 个向量):
|
||||
* 0x00-0x1F CPU 异常
|
||||
* 0x20-0x2F PIC legacy IRQ (保留不动)
|
||||
* 0x30-0x3F 保留给 IOAPIC GSI 16-31 未来扩展 (本阶段不动态分配)
|
||||
* 0x40-0xDF 动态分配池 (MSI/MSI-X)
|
||||
* 0xE0 APIC tick 自测预留 (阶段1 惯例)
|
||||
* 0xFF LAPIC spurious vector
|
||||
* 数据结构: 3 x u64 位图 (192 bit, 用后 160), __builtin_ctzll 找首个
|
||||
* 零位, 分配/释放均 O(1)。热路径无锁: SAS-R0 单核 BSP, alloc/free 只在
|
||||
* driver_init 主上下文调用 (MSI 编程期间对应设备尚未解除中断屏蔽,
|
||||
* IRQ 上下文不可能并发分配), 位图字为对齐 u64 单写原子。
|
||||
* 动态入口无需新增 stub: idt_stubs.S 已为 0-255 全部向量预生成入口,
|
||||
* 分配后 irq_register(vector, handler) 直接挂上既有分发表。 */
|
||||
#define IRQ_VEC_POOL_BASE 0x40
|
||||
#define IRQ_VEC_POOL_COUNT 160
|
||||
static u64 g_vec_bitmap[3];
|
||||
|
||||
int irq_vector_alloc(void) {
|
||||
for (u32 w = 0; w < 3; w++) {
|
||||
u64 free_bits = ~g_vec_bitmap[w];
|
||||
if (!free_bits) continue;
|
||||
u32 bit = (u32)__builtin_ctzll(free_bits);
|
||||
u32 idx = w * 64u + bit;
|
||||
if (idx >= IRQ_VEC_POOL_COUNT) break;
|
||||
g_vec_bitmap[w] |= (1ULL << bit);
|
||||
int vec = IRQ_VEC_POOL_BASE + (int)idx;
|
||||
log_info("[IDT] vector alloc");
|
||||
log_hex64("[IDT] vector=", (u64)vec);
|
||||
return vec;
|
||||
}
|
||||
log_warn("[IDT] vector alloc failed: pool exhausted");
|
||||
return -1;
|
||||
}
|
||||
|
||||
void irq_vector_free(int vector) {
|
||||
if (vector < IRQ_VEC_POOL_BASE ||
|
||||
vector >= IRQ_VEC_POOL_BASE + (int)IRQ_VEC_POOL_COUNT) {
|
||||
return; /* 越界输入幂等忽略 (静态向量不在池内) */
|
||||
}
|
||||
u32 idx = (u32)(vector - IRQ_VEC_POOL_BASE);
|
||||
g_vec_bitmap[idx / 64u] &= ~(1ULL << (idx % 64u));
|
||||
log_info("[IDT] vector free");
|
||||
log_hex64("[IDT] vector=", (u64)vector);
|
||||
}
|
||||
|
||||
int irq_register(u8 vector, irq_handler_t handler) {
|
||||
if ((unsigned)vector >= 256) return -1;
|
||||
/* IRQ号/向量兼容 shim: 0-15 视为 ISA IRQ 号, 换算 vector=0x20+IRQ。
|
||||
* 依据: vector 0-15 是 CPU 异常向量 (#DE/#DB/...), idt_handler 的 IRQ
|
||||
* 分发只覆盖 32-255, 故 0-15 作为注册目标永不可达、无歧义。
|
||||
* 现状调用方两命名空间并存: ps2kbd(1)/e1000(11)/mouseInit(12) 传 IRQ 号,
|
||||
* apic(0xE0)/virtio_net(0x20+n) 传向量 — 统一在此归一到向量空间。 */
|
||||
if (vector < 16) {
|
||||
u8 v = (u8)(0x20u + vector);
|
||||
log_info("[IDT] irq_register: ISA IRQ number translated to vector");
|
||||
log_hex64("[IDT] irq=", vector);
|
||||
log_hex64("[IDT] vector=", v);
|
||||
vector = v;
|
||||
}
|
||||
g_irq_handlers[vector] = handler;
|
||||
INSTR_LOG(INSTR_LOG_DEBUG, INSTR_F_UTSM_TRACE, "[IDT] IRQ handler registered");
|
||||
return 0;
|
||||
@@ -483,25 +601,55 @@ typedef struct {
|
||||
|
||||
void idt_handler(isr_frame *frame) {
|
||||
if (frame->vector < 32) {
|
||||
/* CR2: #PF 的 fault 线性地址；CR3: 当前页表基址。
|
||||
* 寄存器 dump 用于定位 fault 指令的操作数来源。 */
|
||||
u64 cr2, cr3;
|
||||
__asm__ volatile("mov %%cr2, %0" : "=r"(cr2));
|
||||
__asm__ volatile("mov %%cr3, %0" : "=r"(cr3));
|
||||
INSTR_PROBE(EXCP, frame->vector, frame->error_code, frame->rip, 0);
|
||||
log_error("[IDT] exception");
|
||||
log_hex64("[IDT] vector=", frame->vector);
|
||||
log_hex64("[IDT] err=", frame->error_code);
|
||||
log_hex64("[IDT] rip=", frame->rip);
|
||||
log_hex64("[IDT] cr2=", cr2);
|
||||
log_hex64("[IDT] cr3=", cr3);
|
||||
log_hex64("[IDT] rax=", frame->rax);
|
||||
log_hex64("[IDT] rcx=", frame->rcx);
|
||||
log_hex64("[IDT] rdx=", frame->rdx);
|
||||
log_hex64("[IDT] rsi=", frame->rsi);
|
||||
log_hex64("[IDT] rdi=", frame->rdi);
|
||||
log_hex64("[IDT] r8=", frame->r8);
|
||||
log_hex64("[IDT] r9=", frame->r9);
|
||||
log_hex64("[IDT] r10=", frame->r10);
|
||||
log_hex64("[IDT] r11=", frame->r11);
|
||||
log_hex64("[IDT] cs=", frame->cs);
|
||||
log_hex64("[IDT] rflags=", frame->rflags);
|
||||
for (;;) { __asm__ volatile ("cli; hlt"); }
|
||||
}
|
||||
|
||||
/* PIC IRQ: vectors 0x20-0x2F (32-47) */
|
||||
/* PIC IRQ: vectors 0x20-0x2F (32-47)
|
||||
* B7 阶段2: 本分支同时服务两种路由来源:
|
||||
* - 8259 PIC 路由 (默认): handler 后只需 8259 EOI, 钩子为 NULL 跳过;
|
||||
* - IOAPIC->LAPIC 路由 (apic_route=1, legacy 线重定向到 0x20-0x2F):
|
||||
* 中断由 LAPIC 递交, ISR 位置位, 必须写 LAPIC EOI (钩子) 清除,
|
||||
* 否则同级 (vector[7:4] 相同) 中断被永久阻塞 — 每条线只投递一次。
|
||||
* LAPIC EOI 先于 8259 EOI; PIC 全屏蔽时 8259 EOI 为无害 no-op
|
||||
* (8259 无 in-service 位, 非特异性 EOI 不写任何状态)。 */
|
||||
if (frame->vector >= 32 && frame->vector <= 47) {
|
||||
INSTR_STAT_INC(pic_irq_total);
|
||||
u8 irq = (u8)(frame->vector - 0x20);
|
||||
|
||||
/* call registered handler */
|
||||
/* call registered handler; 返回 1 = 自负 EOI 全责 (两者皆抑制) */
|
||||
if (g_irq_handlers[frame->vector]) {
|
||||
int suppress_eoi = g_irq_handlers[frame->vector](irq);
|
||||
if (suppress_eoi) return;
|
||||
}
|
||||
|
||||
/* LAPIC EOI (IOAPIC 路由时必需; PIC 路由时钩子为 NULL) */
|
||||
if (g_apic_eoi_hook) {
|
||||
g_apic_eoi_hook();
|
||||
}
|
||||
|
||||
/* send PIC EOI */
|
||||
if (frame->vector >= 0x28) {
|
||||
outb(PIC2_CMD, 0x20);
|
||||
@@ -511,19 +659,23 @@ void idt_handler(isr_frame *frame) {
|
||||
}
|
||||
|
||||
/* APIC/IOAPIC/MSI IRQ: vectors 0x30-0xFF (48-255)
|
||||
* **QEMU 无法测试但真机必需的代码路径**:
|
||||
* - APIC EOI 写入 LAPIC EOI 寄存器 (0xFEE000B0)
|
||||
* - 当前 PIC 仍激活, 不需要 APIC EOI
|
||||
* - 迁移到 IOAPIC 后需要此处补 APIC EOI */
|
||||
* handler 约定: 返回 0 -> 由钩子补 LAPIC EOI (安全网);
|
||||
* 返回 1 -> handler 已自行 LAPIC EOI, 跳过钩子。
|
||||
* 钩子未注册 (纯 PIC 路由) 时本分支不做任何 EOI — 与旧版行为一致,
|
||||
* 此时 handler 必须自行 LAPIC EOI (参见 apic.drv tick handler)。 */
|
||||
if (frame->vector >= 48 && frame->vector <= 255) {
|
||||
/* LAPIC spurious (SVR 低 8 位 = 0xFF): 规范上不置 ISR 位, 永不需 EOI。
|
||||
* 若在此调钩子写 EOI, 会误清嵌套场景下真正 in-service 的最高位,
|
||||
* 故特判直接返回 (EOI 空 ISR 虽无害, 但语义上 spurious 不该有 EOI)。 */
|
||||
if (frame->vector == 0xFF) return;
|
||||
INSTR_STAT_INC(apic_irq_total);
|
||||
int suppress_eoi = 0;
|
||||
if (g_irq_handlers[frame->vector]) {
|
||||
g_irq_handlers[frame->vector]((u8)frame->vector);
|
||||
suppress_eoi = g_irq_handlers[frame->vector]((u8)frame->vector);
|
||||
}
|
||||
if (!suppress_eoi && g_apic_eoi_hook) {
|
||||
g_apic_eoi_hook();
|
||||
}
|
||||
/* TODO: LAPIC EOI — 写 0 到 LAPIC EOI 寄存器 (mmio offset 0xB0)
|
||||
* 当从 PIC 迁移到 APIC 中断路由时, 必须在此处添加:
|
||||
* *(volatile u32 *)(hhdm_offset + lapic_phys + 0xB0) = 0;
|
||||
*/
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
Binary file not shown.
@@ -56,7 +56,8 @@ static dkm_kernel_api g_kernel_api = {
|
||||
.block = 0,
|
||||
.mmio = 0,
|
||||
.mm_map_mmio = 0,
|
||||
.mm_unmap_mmio = 0
|
||||
.mm_unmap_mmio = 0,
|
||||
.register_apic_eoi = 0
|
||||
};
|
||||
|
||||
const dkm_kernel_api *dkm_get_kernel_api(void) {
|
||||
@@ -94,4 +95,9 @@ void dkm_fill_platform_info(void) {
|
||||
}
|
||||
g_kernel_api.mm_map_mmio = mm_map_mmio;
|
||||
g_kernel_api.mm_unmap_mmio = mm_unmap_mmio;
|
||||
/* B7 阶段2: 暴露 LAPIC EOI 钩子注册入口（apic.drv LAPIC 接管时调用） */
|
||||
g_kernel_api.register_apic_eoi = idt_register_apic_eoi;
|
||||
/* B7 阶段3: 暴露动态向量分配器（MSI/MSI-X 设备驱动使用） */
|
||||
g_kernel_api.irq_vector_alloc = irq_vector_alloc;
|
||||
g_kernel_api.irq_vector_free = irq_vector_free;
|
||||
}
|
||||
|
||||
Binary file not shown.
@@ -100,6 +100,17 @@ typedef struct dkm_kernel_api {
|
||||
/* —— 新增字段只允许追加在末尾（DSK 以 api+0xA8 硬偏移读取 block） —— */
|
||||
void *(*mm_map_mmio)(u64 phys, u64 size); /* MMIO 独立窗口映射（PCD|PWT），返回虚拟地址，失败返回 0 */
|
||||
void (*mm_unmap_mmio)(void *virt, u64 size); /* 解除 MMIO 独立窗口映射 */
|
||||
/* B7 阶段2: 驱动向 UTSM 注册 LAPIC EOI 钩子（写 LAPIC EOI 寄存器的函数指针）。
|
||||
* apic.drv 在 LAPIC 接管时注册；idt_handler 的 IRQ 分发末尾调用该钩子，
|
||||
* 使 vector 0x20-0x2F 的 legacy 线在 IOAPIC 路由下可持续投递。
|
||||
* 未注册（PIC 路由）时钩子为 NULL，idt_handler 跳过，行为与旧版一致。 */
|
||||
void (*register_apic_eoi)(void (*eoi_fn)(void));
|
||||
/* B7 阶段3: 动态 IDT 向量分配器（MSI/MSI-X 用），尾部追加保持 ABI。
|
||||
* 池范围 0x40-0xDF；alloc 返回向量号、失败 -1；free 幂等越界忽略。
|
||||
* 驱动拿到向量后经 irq_register(vector, handler) 直接注册（现有
|
||||
* 接口已接受向量命名空间，无需新注册 ABI）。 */
|
||||
int (*irq_vector_alloc)(void);
|
||||
void (*irq_vector_free)(int vector);
|
||||
} dkm_kernel_api;
|
||||
|
||||
typedef enum dkm_driver_state {
|
||||
|
||||
@@ -10,11 +10,39 @@ void idt_init(void);
|
||||
* 被 spurious IRQ / 异常触发导致三重故障重启。 */
|
||||
void idt_halt_all(void);
|
||||
|
||||
/* IRQ handler: return 1 to suppress default ACK (PIC), 0 for normal EOI.
|
||||
* 参数为 IDT vector 号 (0x20-0xFF)。
|
||||
* PIC IRQ (0x20-0x2F): 返回 1 抑制 PIC EOI; 返回 0 自动发送 PIC EOI。
|
||||
* APIC/IOAPIC/MSI (0x30-0xFF): 返回值当前忽略, EOI 需手动处理 (TODO)。 */
|
||||
/* DSK 诊断 IDT：vector 0-31 恢复原 isr_stub（异常走 idt_handler
|
||||
* 打完整日志后停机），vector 32-255 保持 halt stub。
|
||||
* BUG-20260801-005：UTSM→DSK 交接处以本函数替代 idt_halt_all，
|
||||
* 恢复 DSK 阶段 CPU 异常可见性（原静默 halt 零诊断）。
|
||||
* 不做 pic_remap / sti，DSK 上下文 IF=0 不变式保持不变。 */
|
||||
void idt_install_dsk_diag(void);
|
||||
|
||||
/* PE 诊断 IDT：idt_install_dsk_diag 的别名（幂等重装）。
|
||||
* 用于 PE 兼容层原生执行 PE32+ 前恢复异常可见性。 */
|
||||
void idt_install_pe_diag(void);
|
||||
|
||||
/* IRQ handler: return 1 to suppress default ACK (EOI), 0 for normal EOI.
|
||||
* 注册参数兼容两种命名空间（二者不重叠，自动判别）:
|
||||
* - ISA IRQ 号 0-15 -> 自动换算为 vector 0x20+IRQ (兼容 ps2kbd/e1000/mouseInit)
|
||||
* - IDT vector 0x20+ -> 直接按 vector 注册 (apic 0xE0 / virtio_net 0x20+n 现状)
|
||||
* vector 0-15 是 CPU 异常向量，idt_handler 从不作为 IRQ 分发目标，故无歧义。
|
||||
* EOI 语义:
|
||||
* - PIC IRQ (0x20-0x2F): 返回 0 -> 先调 APIC EOI 钩子(若已注册)再发 8259 EOI;
|
||||
* 返回 1 -> 两者都抑制, handler 自负 EOI 全责。
|
||||
* - APIC/IOAPIC/MSI (0x30-0xFF): 返回 0 -> 调 APIC EOI 钩子(若已注册);
|
||||
* 返回 1 -> 抑制(如 handler 内已自行 LAPIC EOI)。未注册钩子时不做任何 EOI。 */
|
||||
typedef int (*irq_handler_t)(u8 vector);
|
||||
int irq_register(u8 vector, irq_handler_t handler);
|
||||
|
||||
/* B7 阶段2: 注册 LAPIC EOI 钩子（由 apic.drv 在 LAPIC 接管后调用）。
|
||||
* 钩子语义: 向 LAPIC EOI 寄存器 (MMIO base+0xB0) 写 0，清除当前 in-service
|
||||
* 最高优先级 ISR 位。重复注册以最后一次为准；传 NULL 可注销。 */
|
||||
void idt_register_apic_eoi(void (*eoi_fn)(void));
|
||||
|
||||
/* B7 阶段3: 动态 IDT 向量分配器 (MSI/MSI-X 用)。
|
||||
* 池范围 0x40-0xDF (160 个), 位图 O(1); 分配返回向量号, 池耗尽返回 -1。
|
||||
* free 幂等, 越界/静态向量输入忽略。主上下文调用, 无锁。 */
|
||||
int irq_vector_alloc(void);
|
||||
void irq_vector_free(int vector);
|
||||
|
||||
#endif
|
||||
|
||||
@@ -731,12 +731,14 @@ int dsk_load_and_jump(void) {
|
||||
}
|
||||
}
|
||||
|
||||
/* 4) 将 IDT 所有 256 个条目替换为安全 halt stub。
|
||||
* 实机会产生 spurious IRQ7/15（即使 PIC 已 mask），
|
||||
* 且 SMI/NMI 可能触发异常。如果 UTSM 的 idt_handler
|
||||
* 所调用的 log 函数或串口驱动被覆盖，会导致双重异常→三重故障。 */
|
||||
extern void idt_halt_all(void);
|
||||
idt_halt_all();
|
||||
/* 4) BUG-20260801-005: 换装 DSK 诊断 IDT（替代原静默 halt_all）。
|
||||
* vector 0-31 → UTSM isr_stub（idt_handler 打完整异常现场后
|
||||
* 安全停机），vector 32-255 保持 halt stub 防御 spurious IRQ7/15。
|
||||
* SAS-R0 下 UTSM .text 常驻内存，DSK 阶段异常投递路径已验证
|
||||
* 可用（BUG-20260729-013 登记行为）；原 halt_all 把 #PF/#GP
|
||||
* 无声吞掉，DSK 阶段零诊断。 */
|
||||
extern void idt_install_dsk_diag(void);
|
||||
idt_install_dsk_diag();
|
||||
|
||||
/* 5) NMI off */
|
||||
outb(0x70, inb(0x70) | 0x80);
|
||||
|
||||
Binary file not shown.
@@ -48,7 +48,7 @@ typedef struct {
|
||||
const image_file_header *file_hdr;
|
||||
const void *optional_hdr;
|
||||
int is_pe32_plus;
|
||||
u32 image_base; /* 32位截断的加载基址（PE32+ 也截断用于 RVA 计算） */
|
||||
u64 image_base; /* 链接时首选基址（PE32+ 为 64 位，如 0x140000000，必须全宽保留） */
|
||||
u32 size_of_image;
|
||||
u32 size_of_headers;
|
||||
u32 entry_rva;
|
||||
@@ -75,7 +75,7 @@ static int parse_nt_headers(const void *pe_data, u64 size, pe_nt_info *out) {
|
||||
if (magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) {
|
||||
const image_optional_header64 *oh = (const image_optional_header64 *)opt;
|
||||
out->is_pe32_plus = 1;
|
||||
out->image_base = (u32)oh->image_base;
|
||||
out->image_base = oh->image_base; /* PE32+: u64 全宽，禁止截断（重定位 delta 依赖高位） */
|
||||
out->size_of_image = oh->size_of_image;
|
||||
out->size_of_headers = oh->size_of_headers;
|
||||
out->entry_rva = oh->address_of_entry_point;
|
||||
@@ -98,7 +98,7 @@ static int parse_nt_headers(const void *pe_data, u64 size, pe_nt_info *out) {
|
||||
}
|
||||
|
||||
/* ---- 应用基址重定位 ---- */
|
||||
static void apply_relocations(u8 *image, u32 image_size, u64 image_base_actual, u32 image_base_preferred,
|
||||
static void apply_relocations(u8 *image, u32 image_size, u64 image_base_actual, u64 image_base_preferred,
|
||||
const image_data_directory *reloc_dir,
|
||||
const image_section_header *sections, int nsec,
|
||||
const void *pe_data, u64 pe_size, int is_pe32_plus) {
|
||||
@@ -313,7 +313,7 @@ int pe_load_image(const void *pe_data, u64 size, pe_image_info *out) {
|
||||
|
||||
/* 基址重定位 */
|
||||
u64 actual_base = (u64)image;
|
||||
u32 preferred_base = nt.image_base;
|
||||
u64 preferred_base = nt.image_base;
|
||||
/* image 缓冲区按 RVA 排列（image[0]=RVA 0），重定位写入 image 内 */
|
||||
/* 注意：apply_relocations 直接操作 image 缓冲区，delta = actual_base - preferred_base */
|
||||
{
|
||||
|
||||
@@ -17,6 +17,7 @@
|
||||
#include "x86emu32.h"
|
||||
#include "../include/utsm/pe.h"
|
||||
#include <utsm/arena.h>
|
||||
#include <utsm/idt.h>
|
||||
#include <utsm/log.h>
|
||||
#include <utsm/types.h>
|
||||
|
||||
@@ -275,6 +276,12 @@ int pe_service_run(const void *pe_data, u64 size, const char *cmdline, u64 *exit
|
||||
log_info("[PE] running PE32+ natively");
|
||||
pe_enable_sse();
|
||||
|
||||
/* 恢复异常可见性:UTSM 交权 DSK 时 idt_halt_all() 将 IDT 全部
|
||||
* 替换为静默 halt stub,PE 原生执行期间的 CPU 异常(PF/GP/UD)
|
||||
* 会被无声吞掉。安装 PE 诊断 IDT 后异常走 idt_handler 打完整
|
||||
* vector/err/rip/CR2/寄存器日志再安全停机。 */
|
||||
idt_install_pe_diag();
|
||||
|
||||
/* 独立 1MB 栈(内核栈仅 16KB,egui 渲染会溢出) */
|
||||
u8 *pe_stack = (u8 *)kmem_alloc_aligned(PE_STACK_BYTES, 4096);
|
||||
if (!pe_stack) {
|
||||
@@ -283,9 +290,13 @@ int pe_service_run(const void *pe_data, u64 size, const char *cmdline, u64 *exit
|
||||
}
|
||||
u64 stack_top = (u64)pe_stack + PE_STACK_BYTES; /* 4096 对齐 -> 16 对齐 */
|
||||
|
||||
/* BUG-20260801-006: __builtin_setjmp 必须直接出现在
|
||||
* pe_service_run 本体内——该帧在 PE 执行全程存活,longjmp
|
||||
* 恢复合法.原 pe_shim_setup_exit() 包装函数 setjmp 后即返回,
|
||||
* longjmp 跨已销毁帧 = UB(实测从脏栈 pop 出 log_hex64 缓冲
|
||||
* 残片充当 R12-R15/RBP → 野指针 call → 三重故障). */
|
||||
u64 code = 0;
|
||||
int jumped = pe_shim_setup_exit();
|
||||
if (jumped == 0) {
|
||||
if (__builtin_setjmp(pe_shim_exit_jmpbuf()) == 0) {
|
||||
pe_entry_fn entry = (pe_entry_fn)info.entry_point;
|
||||
log_hex64("[PE] entry=", (u64)entry);
|
||||
log_hex64("[PE] stack_top=", stack_top);
|
||||
@@ -323,22 +334,30 @@ int pe_service_run(const void *pe_data, u64 size, const char *cmdline, u64 *exit
|
||||
}
|
||||
emu.eip = img.entry_point;
|
||||
|
||||
/* BUG-20260801-007: fn64 回退 shim 收到的指针参数是 32 位
|
||||
* guest VA,设置解释器内存基址使 shim 内 gp() 完成 guest→host
|
||||
* 转换;运行结束立即复位(原生 PE32+ 路径恒为 0,gp 恒等映射). */
|
||||
pe_shim_set_emu_base((u64)img.mem);
|
||||
|
||||
/* BUG-20260801-006: 同 PE32+ 路径,setjmp 直接出现在本体内.
|
||||
* PE32 解释器路径同一 longjmp 机制,同样暴露在 UB 下. */
|
||||
u64 code = 0;
|
||||
int jumped = pe_shim_setup_exit();
|
||||
if (jumped == 0) {
|
||||
if (__builtin_setjmp(pe_shim_exit_jmpbuf()) == 0) {
|
||||
int rrc = x86emu32_run(&emu, &code);
|
||||
if (rrc != 0) {
|
||||
log_error("[PE32] emulator error");
|
||||
code = 0xFFFFFFFFULL;
|
||||
}
|
||||
/* emu 字段只在未发生 longjmp 的正常返回路径读取
|
||||
* (setjmp 语义:longjmp 后被修改的自动变量值不确定) */
|
||||
if (emu.error && !emu.exited) {
|
||||
log_warn("[PE32] emulator stopped with error");
|
||||
}
|
||||
} else {
|
||||
code = pe_shim_get_exit_code();
|
||||
log_hex64("[PE32] ExitProcess code=", code);
|
||||
}
|
||||
|
||||
if (emu.error && !emu.exited) {
|
||||
log_warn("[PE32] emulator stopped with error");
|
||||
}
|
||||
pe_shim_set_emu_base(0);
|
||||
|
||||
if (exit_code) *exit_code = code;
|
||||
return 0;
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
pe/pe_service.o: pe\pe_service.c pe\pe_loader.h include\utsm\types.h \
|
||||
include\utsm\pe.h pe\pe_shim.h pe\x86emu32.h pe\..\include\utsm\pe.h \
|
||||
include\utsm\arena.h include\utsm\log.h
|
||||
include\utsm\arena.h include\utsm\idt.h include\utsm\log.h
|
||||
pe\pe_loader.h:
|
||||
include\utsm\types.h:
|
||||
include\utsm\pe.h:
|
||||
@@ -8,4 +8,5 @@ pe\pe_shim.h:
|
||||
pe\x86emu32.h:
|
||||
pe\..\include\utsm\pe.h:
|
||||
include\utsm\arena.h:
|
||||
include\utsm\idt.h:
|
||||
include\utsm\log.h:
|
||||
|
||||
+391
-85
@@ -9,14 +9,19 @@
|
||||
* ntdll.dll NtWriteFile、RtlNtStatusToDosError
|
||||
* bcryptprimitives.dll ProcessPrng (rdtsc xorshift)
|
||||
* api-ms-win-core-synch-l1-2-0.dll WaitOnAddress、WakeByAddress (futex 桩)
|
||||
* user32.dll 窗口类、窗口、消息泵 (PS/2 键盘轮询)、DefWindowProc
|
||||
* user32.dll 窗口类、窗口、消息泵 (PS/2 键盘+AUX 鼠标轮询)、DefWindowProc
|
||||
* gdi32.dll 内存 DC、DIBSection、BitBlt 到 Limine 帧缓冲
|
||||
*
|
||||
* 窗口模型:单顶层窗口 (固定伪句柄),GetDC 返回窗口 DC,
|
||||
* BitBlt(窗口 DC, ...) 把 DIB 后台缓冲按窗口原点拷入帧缓冲.
|
||||
* 消息泵:PeekMessageW 轮询 PS/2 键盘 (0x64/0x60),生成
|
||||
* WM_KEYDOWN、WM_KEYUP、WM_CHAR;Esc 额外合成 WM_CLOSE (无鼠标环境的
|
||||
* 唯一退出途径).鼠标字节 (状态位 0x20) 直接丢弃.
|
||||
* 消息泵:PeekMessageW 轮询 PS/2 (0x64/0x60),按状态位 0x20 分流键盘/鼠标:
|
||||
* 键盘 -> WM_KEYDOWN、WM_KEYUP、WM_CHAR;Esc 额外合成 WM_CLOSE;
|
||||
* 鼠标 -> 3 字节包解码(同步位/溢出防御),坐标钳位到帧缓冲,
|
||||
* 边沿生成 WM_MOUSEMOVE 与 WM_xBUTTONDOWN/WM_xBUTTONUP 系列.
|
||||
* 软件光标:BitBlt 上屏后在光标坐标叠画 12x12 箭头(黑边白心),
|
||||
* 下一帧 BitBlt 自动覆盖旧光标,无需保存/恢复背景.
|
||||
* 鼠标初始化:on-demand(首次轮询时),AUX 启用 + 0xF4 数据报告,
|
||||
* 全程超时保护,单步失败只记日志并禁用鼠标,绝不阻塞.
|
||||
*/
|
||||
|
||||
#include "pe_shim.h"
|
||||
@@ -45,16 +50,39 @@ static int g_exit_jmp_set;
|
||||
static u64 g_exit_code;
|
||||
static const char *g_cmdline = "";
|
||||
|
||||
/* ===== BUG-20260801-007: PE32 guest→host 指针转换 =====
|
||||
* PE32 解释器路径下,fn64 回退 shim 收到的指针参数是 32 位 guest VA
|
||||
* (相对解释器 mem 基址的偏移),直接当 host 指针解引用 → 低地址 #PF
|
||||
* → 三重故障(定案证据:#PF RIP 落在 shim_printf 体内解引用 0x401017)。
|
||||
* x86emu32 执行前经 pe_shim_set_emu_base() 设置 mem 基址,各 shim 在
|
||||
* **指针解引用点**经 gp() 转换(不在参数入口盲目转换——退出码/长度等
|
||||
* 小整数参数会被误转)。阈值 0x10000000 与 pe_service.c 解释器地址
|
||||
* 空间上限一致;shim 伪句柄(0x10000001+)与负值句柄天然豁免。
|
||||
* 原生 PE32+ 路径 g_emu_mem_base 恒为 0,gp() 恒等映射,零影响。 */
|
||||
static u64 g_emu_mem_base = 0;
|
||||
|
||||
void pe_shim_set_emu_base(u64 base) { g_emu_mem_base = base; }
|
||||
|
||||
static inline u64 gp(u64 va) {
|
||||
if (g_emu_mem_base && va && va < 0x10000000ULL)
|
||||
return g_emu_mem_base + va;
|
||||
return va;
|
||||
}
|
||||
|
||||
void pe_shim_init(const char *cmdline) {
|
||||
g_cmdline = cmdline ? cmdline : "";
|
||||
g_exit_jmp_set = 0;
|
||||
g_exit_code = 0;
|
||||
g_emu_mem_base = 0; /* BUG-007: 默认非解释器上下文(原生路径恒等映射) */
|
||||
}
|
||||
|
||||
/* pe_run 调用:保存上下文,返回 0 = 首次(继续执行),1 = ExitProcess 触发 */
|
||||
int pe_shim_setup_exit(void) {
|
||||
/* 返回 ExitProcess longjmp 目标 jmpbuf(见 pe_shim.h 的 BUG-006 说明).
|
||||
* 本函数只提供缓冲区并重置退出状态;__builtin_setjmp 由调用方
|
||||
* (pe_service_run 本体)直接执行,确保 setjmp 帧在 PE 执行全程存活. */
|
||||
void **pe_shim_exit_jmpbuf(void) {
|
||||
g_exit_jmp_set = 1;
|
||||
return __builtin_setjmp(g_exit_jmp);
|
||||
g_exit_code = 0;
|
||||
return g_exit_jmp;
|
||||
}
|
||||
|
||||
void pe_shim_exit_process(u64 exit_code) {
|
||||
@@ -81,7 +109,18 @@ u64 pe_shim_unimpl_stub(void) {
|
||||
}
|
||||
|
||||
/* ===== 串口/帧缓冲输出(shim 内部复用) ===== */
|
||||
/* 单次输出长度上限:防御 PE 侧传野 (buf,len)(如 panic 递归中损坏的
|
||||
* String)把半个地址空间倒进串口并踩穿未映射页(#PF).正常日志远远
|
||||
* 低于此值;截断时留锚点便于定位. */
|
||||
#define SHIM_OUTPUT_MAX (1ULL * 1024ULL * 1024ULL)
|
||||
|
||||
static void shim_output(const char *s, u64 len) {
|
||||
if (len > SHIM_OUTPUT_MAX) {
|
||||
log_error("[shim] output len clamped");
|
||||
log_hex64("[shim] output buf=", (u64)s);
|
||||
log_hex64("[shim] output len=", len);
|
||||
len = SHIM_OUTPUT_MAX;
|
||||
}
|
||||
for (u64 i = 0; i < len; i++) {
|
||||
serial_putc(s[i]);
|
||||
}
|
||||
@@ -115,10 +154,11 @@ static u64 __attribute__((ms_abi)) shim_WriteFile(u64 handle, u64 buffer, u64 le
|
||||
u64 bytes_written_ptr, u64 overlapped) {
|
||||
(void)overlapped;
|
||||
if (handle == SHIM_STDOUT_HANDLE || handle == SHIM_STDERR_HANDLE) {
|
||||
const char *buf = (const char *)buffer;
|
||||
const char *buf = (const char *)gp(buffer);
|
||||
shim_output(buf, length);
|
||||
/* lpNumberOfBytesWritten 是 DWORD*(4 字节),不能按 u64 写 */
|
||||
if (bytes_written_ptr) *(u32 *)bytes_written_ptr = (u32)length;
|
||||
u64 bwp = gp(bytes_written_ptr);
|
||||
if (bwp) *(u32 *)bwp = (u32)length;
|
||||
return 1; /* TRUE */
|
||||
}
|
||||
return 0;
|
||||
@@ -127,8 +167,9 @@ static u64 __attribute__((ms_abi)) shim_WriteFile(u64 handle, u64 buffer, u64 le
|
||||
static u64 __attribute__((ms_abi)) shim_ReadFile(u64 handle, u64 buffer, u64 max_length,
|
||||
u64 bytes_read_ptr, u64 overlapped) {
|
||||
(void)handle; (void)buffer; (void)max_length; (void)overlapped;
|
||||
/* 暂不支持输入读取 */
|
||||
if (bytes_read_ptr) *(u64 *)bytes_read_ptr = 0;
|
||||
/* 暂不支持输入读取;lpNumberOfBytesRead 同为 DWORD*(4 字节) */
|
||||
u64 brp = gp(bytes_read_ptr);
|
||||
if (brp) *(u32 *)brp = 0;
|
||||
return 1;
|
||||
}
|
||||
|
||||
@@ -163,12 +204,13 @@ static u64 __attribute__((ms_abi)) shim_HeapAlloc(u64 heap, u64 flags, u64 size)
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_HeapFree(u64 heap, u64 flags, u64 ptr) {
|
||||
(void)heap; (void)flags;
|
||||
shim_heap_free((void *)ptr);
|
||||
/* gp():PE32 野指针收束进 guest 沙盒,避免低地址 host 解引用 */
|
||||
shim_heap_free((void *)gp(ptr));
|
||||
return 1;
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_HeapReAlloc(u64 heap, u64 flags, u64 ptr, u64 size) {
|
||||
(void)heap; (void)flags;
|
||||
return (u64)shim_heap_realloc((void *)ptr, size);
|
||||
return (u64)shim_heap_realloc((void *)gp(ptr), size);
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_GetProcessHeap(void) {
|
||||
return 0x10000010;
|
||||
@@ -216,7 +258,7 @@ static void shim_msvcrt_output(const char *s) {
|
||||
static u64 __attribute__((ms_abi)) shim_printf(u64 fmt, u64 a1, u64 a2, u64 a3) {
|
||||
/* 可变参数:MS x64 ABI 下 a1-a3 在 RDX/R8/R9,更多参数在栈上.
|
||||
* 简化处理:只处理前 3 个参数. */
|
||||
const char *f = (const char *)fmt;
|
||||
const char *f = (const char *)gp(fmt);
|
||||
u64 args[3] = {a1, a2, a3};
|
||||
int argi = 0;
|
||||
char outbuf[512];
|
||||
@@ -226,7 +268,7 @@ static u64 __attribute__((ms_abi)) shim_printf(u64 fmt, u64 a1, u64 a2, u64 a3)
|
||||
i++;
|
||||
switch (f[i]) {
|
||||
case 's': {
|
||||
const char *s = (const char *)(args[argi++ & 3]);
|
||||
const char *s = (const char *)gp(args[argi++ & 3]);
|
||||
if (s) while (*s && oi < 510) outbuf[oi++] = *s++;
|
||||
break;
|
||||
}
|
||||
@@ -272,7 +314,7 @@ static u64 __attribute__((ms_abi)) shim_printf(u64 fmt, u64 a1, u64 a2, u64 a3)
|
||||
}
|
||||
|
||||
static u64 __attribute__((ms_abi)) shim_puts(u64 str) {
|
||||
const char *s = (const char *)str;
|
||||
const char *s = (const char *)gp(str);
|
||||
shim_msvcrt_output(s);
|
||||
shim_msvcrt_output("\n");
|
||||
return 0;
|
||||
@@ -292,9 +334,9 @@ static u64 __attribute__((ms_abi)) shim_calloc(u64 count, u64 size) {
|
||||
if (p) for (u64 i = 0; i < total; i++) p[i] = 0;
|
||||
return (u64)p;
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_free(u64 ptr) { shim_heap_free((void *)ptr); return 0; }
|
||||
static u64 __attribute__((ms_abi)) shim_free(u64 ptr) { shim_heap_free((void *)gp(ptr)); return 0; }
|
||||
static u64 __attribute__((ms_abi)) shim_realloc(u64 ptr, u64 size) {
|
||||
return (u64)shim_heap_realloc((void *)ptr, size);
|
||||
return (u64)shim_heap_realloc((void *)gp(ptr), size);
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_exit(u64 code) {
|
||||
pe_shim_exit_process(code);
|
||||
@@ -302,38 +344,38 @@ static u64 __attribute__((ms_abi)) shim_exit(u64 code) {
|
||||
}
|
||||
|
||||
static u64 __attribute__((ms_abi)) shim_memcpy(u64 dst, u64 src, u64 n) {
|
||||
u8 *d = (u8 *)dst; const u8 *s = (const u8 *)src;
|
||||
u8 *d = (u8 *)gp(dst); const u8 *s = (const u8 *)gp(src);
|
||||
for (u64 i = 0; i < n; i++) d[i] = s[i];
|
||||
return dst;
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_memset(u64 dst, u64 val, u64 n) {
|
||||
u8 *d = (u8 *)dst; u8 v = (u8)(val & 0xFF);
|
||||
u8 *d = (u8 *)gp(dst); u8 v = (u8)(val & 0xFF);
|
||||
for (u64 i = 0; i < n; i++) d[i] = v;
|
||||
return dst;
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_memmove(u64 dst, u64 src, u64 n) {
|
||||
u8 *d = (u8 *)dst; const u8 *s = (const u8 *)src;
|
||||
u8 *d = (u8 *)gp(dst); const u8 *s = (const u8 *)gp(src);
|
||||
if (d < s) { for (u64 i = 0; i < n; i++) d[i] = s[i]; }
|
||||
else { for (u64 i = n; i > 0; i--) d[i-1] = s[i-1]; }
|
||||
return dst;
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_strlen(u64 str) {
|
||||
const char *s = (const char *)str;
|
||||
const char *s = (const char *)gp(str);
|
||||
u64 n = 0; while (s[n]) n++; return n;
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_strcmp(u64 a, u64 b) {
|
||||
const char *pa = (const char *)a; const char *pb = (const char *)b;
|
||||
const char *pa = (const char *)gp(a); const char *pb = (const char *)gp(b);
|
||||
while (*pa && *pa == *pb) { pa++; pb++; }
|
||||
return (u64)(i64)(*pa - *pb);
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_strcpy(u64 dst, u64 src) {
|
||||
char *d = (char *)dst; const char *s = (const char *)src;
|
||||
char *d = (char *)gp(dst); const char *s = (const char *)gp(src);
|
||||
while (*s) *d++ = *s++;
|
||||
*d = 0;
|
||||
return dst;
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_strncmp(u64 a, u64 b, u64 n) {
|
||||
const char *pa = (const char *)a; const char *pb = (const char *)b;
|
||||
const char *pa = (const char *)gp(a); const char *pb = (const char *)gp(b);
|
||||
for (u64 i = 0; i < n; i++) {
|
||||
if (pa[i] != pb[i]) return (u64)(i64)(pa[i] - pb[i]);
|
||||
if (pa[i] == 0) return 0;
|
||||
@@ -343,12 +385,12 @@ static u64 __attribute__((ms_abi)) shim_strncmp(u64 a, u64 b, u64 n) {
|
||||
static u64 __attribute__((ms_abi)) shim_fwrite(u64 ptr, u64 size, u64 nmemb, u64 stream) {
|
||||
(void)stream;
|
||||
u64 total = size * nmemb;
|
||||
shim_output((const char *)ptr, total);
|
||||
shim_output((const char *)gp(ptr), total);
|
||||
return nmemb;
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_fputs(u64 str, u64 stream) {
|
||||
(void)stream;
|
||||
shim_output_str((const char *)str);
|
||||
shim_output_str((const char *)gp(str));
|
||||
return 0;
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_fputc(u64 ch, u64 stream) {
|
||||
@@ -372,11 +414,23 @@ static u64 __attribute__((ms_abi)) shim_initterm_e(u64 start, u64 end) {
|
||||
*
|
||||
* Rust std 的 GlobalAlloc 走 GetProcessHeap/HeapAlloc/HeapReAlloc/
|
||||
* HeapFree.arena 只增不减,GUI 主循环每帧的 Vec 分配会耗尽内存,
|
||||
* 因此 shim 从 arena carve 一块 8MB 区域自行管理:
|
||||
* 32B 块头 {size,used,next_free,pad},首次适应 + 分割 + 前向合并.
|
||||
* 因此 shim 从 arena carve 一块 32MB 区域自行管理:
|
||||
* 32B 块头 {size,used,next_free,pad},首次适应 + 分割.
|
||||
*
|
||||
* 合并策略(2026-08-02 修复):空闲链表按地址升序维护,free 时做
|
||||
* 前向 + 后向双向合并.旧实现是 LIFO 头插 + 仅前向合并,egui 每帧
|
||||
* 内部存在非 LIFO 的 alloc/free 序列,物理相邻的空闲块永远无法
|
||||
* 后向合并,堆逐渐碎成小片,实测 ~27KB/帧的速度劣化,第 ~1200 帧
|
||||
* (BitBlt frames=0x4b0)连 0x2a80 的连续块都分不出而 OOM,随后
|
||||
* Rust panic 递归损坏 String,NtWriteFile 野性转储 55MB 踩穿
|
||||
* 未映射页 #PF(rip=shim_NtWriteFile+0x30).地址有序空闲链表使
|
||||
* "物理相邻"等价于"链相邻",前后向合并即可完备回收.
|
||||
*
|
||||
* (egui 字体 + 每帧 tessellation 缓冲实测 8MB 会在第 3 帧 OOM,扩到 32MB;
|
||||
* arena 总 64MB,PE 镜像~3MB + 栈 1MB + DIB ~6MB,余量充足.)
|
||||
* ========================================================== */
|
||||
|
||||
#define SHIM_HEAP_BYTES (8ULL * 1024ULL * 1024ULL)
|
||||
#define SHIM_HEAP_BYTES (32ULL * 1024ULL * 1024ULL)
|
||||
#define HEAP_HDR 32
|
||||
|
||||
typedef struct heap_blk {
|
||||
@@ -388,6 +442,7 @@ typedef struct heap_blk {
|
||||
|
||||
static u8 *g_heap_region;
|
||||
static heap_blk *g_heap_free_head;
|
||||
static u64 g_heap_live; /* 已分配字节合计(诊断:区分真泄漏与碎片化) */
|
||||
|
||||
static void shim_heap_init_once(void) {
|
||||
if (g_heap_region) return;
|
||||
@@ -404,57 +459,88 @@ static void shim_heap_init_once(void) {
|
||||
g_heap_free_head = b;
|
||||
}
|
||||
|
||||
/* 大/小块阈值:egui 长寿命缓存块多为几十字节,每帧 tessellation 等
|
||||
* 瞬态缓冲为 10-30KB.大块专取地址最高的适配块,使顶部连续区域免于
|
||||
* 被小长寿块钉碎(实测无此策略时 2400 帧后 29.9MB 空闲碎成 6 万个
|
||||
* 平均 500B 的片,free_max 只剩 10.2KB,10.8KB 请求即 OOM). */
|
||||
#define SHIM_HEAP_LARGE 2048ULL
|
||||
|
||||
static void *shim_heap_alloc(u64 size) {
|
||||
shim_heap_init_once();
|
||||
if (!g_heap_region) return 0;
|
||||
if (size == 0) size = 16;
|
||||
size = (size + 15) & ~15ULL;
|
||||
heap_blk *prev = 0, *b = g_heap_free_head;
|
||||
while (b) {
|
||||
if (b->size >= size) {
|
||||
if (prev) prev->next_free = b->next_free;
|
||||
else g_heap_free_head = (heap_blk *)b->next_free;
|
||||
/* 剩余足够再分一块则分割 */
|
||||
if (b->size >= size + HEAP_HDR + 16) {
|
||||
heap_blk *nb = (heap_blk *)((u8 *)b + HEAP_HDR + size);
|
||||
nb->size = b->size - size - HEAP_HDR;
|
||||
nb->used = 0;
|
||||
nb->pad = 0;
|
||||
nb->next_free = (u64)g_heap_free_head;
|
||||
g_heap_free_head = nb;
|
||||
b->size = size;
|
||||
}
|
||||
b->used = 1;
|
||||
b->next_free = 0;
|
||||
return (u8 *)b + HEAP_HDR;
|
||||
heap_blk *cand = 0, *cand_prev = 0;
|
||||
if (size < SHIM_HEAP_LARGE) {
|
||||
/* 小块:首次适应(低地址优先)填碎洞,保护顶部大区域 */
|
||||
while (b) {
|
||||
if (b->size >= size) { cand = b; cand_prev = prev; break; }
|
||||
prev = b; b = (heap_blk *)b->next_free;
|
||||
}
|
||||
prev = b;
|
||||
b = (heap_blk *)b->next_free;
|
||||
} else {
|
||||
/* 大块:取地址最高的适配块(地址有序链,最后一个适配者) */
|
||||
while (b) {
|
||||
if (b->size >= size) { cand = b; cand_prev = prev; }
|
||||
prev = b; b = (heap_blk *)b->next_free;
|
||||
}
|
||||
}
|
||||
b = cand; prev = cand_prev;
|
||||
if (b) {
|
||||
/* 摘除 b;分割时余量 nb 占据 b 原链位即可保持地址有序
|
||||
* (nb=b+HEAP_HDR+size < 原后继:后继不与 b 重叠 => 后继>=b 块尾 > nb) */
|
||||
if (prev) prev->next_free = b->next_free;
|
||||
else g_heap_free_head = (heap_blk *)b->next_free;
|
||||
if (b->size >= size + HEAP_HDR + 16) {
|
||||
heap_blk *nb = (heap_blk *)((u8 *)b + HEAP_HDR + size);
|
||||
nb->size = b->size - size - HEAP_HDR;
|
||||
nb->used = 0;
|
||||
nb->pad = 0;
|
||||
nb->next_free = b->next_free;
|
||||
if (prev) prev->next_free = (u64)nb;
|
||||
else g_heap_free_head = nb;
|
||||
b->size = size;
|
||||
}
|
||||
b->used = 1;
|
||||
b->next_free = 0;
|
||||
g_heap_live += b->size;
|
||||
return (u8 *)b + HEAP_HDR;
|
||||
}
|
||||
/* OOM 诊断:live 持续增长=真泄漏;live 平稳而 free_max 萎缩=碎片化 */
|
||||
u64 ft = 0, fm = 0, fc = 0;
|
||||
for (heap_blk *f = g_heap_free_head; f; f = (heap_blk *)f->next_free) {
|
||||
ft += f->size; if (f->size > fm) fm = f->size; fc++;
|
||||
}
|
||||
log_error("[shim] heap OOM");
|
||||
log_hex64("[shim] heap req=", size);
|
||||
log_hex64("[shim] heap live=", g_heap_live);
|
||||
log_hex64("[shim] heap free_total=", ft);
|
||||
log_hex64("[shim] heap free_max=", fm);
|
||||
log_hex64("[shim] heap free_blocks=", fc);
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void shim_heap_free(void *ptr) {
|
||||
if (!ptr) return;
|
||||
heap_blk *b = (heap_blk *)((u8 *)ptr - HEAP_HDR);
|
||||
g_heap_live -= b->size;
|
||||
b->used = 0;
|
||||
/* 前向合并:物理下一块若空闲则吸收 */
|
||||
heap_blk *nb = (heap_blk *)((u8 *)b + HEAP_HDR + b->size);
|
||||
if ((u8 *)nb >= g_heap_region && (u8 *)nb < g_heap_region + SHIM_HEAP_BYTES
|
||||
&& !nb->used && nb->size) {
|
||||
/* 从空闲链摘除 nb */
|
||||
heap_blk *prev = 0, *x = g_heap_free_head;
|
||||
while (x && x != nb) { prev = x; x = (heap_blk *)x->next_free; }
|
||||
if (x == nb) {
|
||||
if (prev) prev->next_free = nb->next_free;
|
||||
else g_heap_free_head = (heap_blk *)nb->next_free;
|
||||
b->size += HEAP_HDR + nb->size;
|
||||
}
|
||||
/* 地址升序插入空闲链表:prev < b < x(x 可为 0 表尾) */
|
||||
heap_blk *prev = 0, *x = g_heap_free_head;
|
||||
while (x && x < b) { prev = x; x = (heap_blk *)x->next_free; }
|
||||
b->next_free = (u64)x;
|
||||
if (prev) prev->next_free = (u64)b;
|
||||
else g_heap_free_head = b;
|
||||
/* 前向合并:x 与 b 物理相邻则吸收(地址有序 => 物理相邻即链相邻) */
|
||||
if (x && (u8 *)b + HEAP_HDR + b->size == (u8 *)x) {
|
||||
b->size += HEAP_HDR + x->size;
|
||||
b->next_free = x->next_free;
|
||||
}
|
||||
/* 后向合并:prev 与 b 物理相邻则把 b 并入 prev */
|
||||
if (prev && (u8 *)prev + HEAP_HDR + prev->size == (u8 *)b) {
|
||||
prev->size += HEAP_HDR + b->size;
|
||||
prev->next_free = b->next_free;
|
||||
}
|
||||
b->next_free = (u64)g_heap_free_head;
|
||||
g_heap_free_head = b;
|
||||
}
|
||||
|
||||
static void *shim_heap_realloc(void *ptr, u64 size) {
|
||||
@@ -503,11 +589,13 @@ static void shim_tsc_init(void) {
|
||||
|
||||
static u64 __attribute__((ms_abi)) shim_QueryPerformanceFrequency(u64 freq_ptr) {
|
||||
shim_tsc_init();
|
||||
freq_ptr = gp(freq_ptr);
|
||||
if (freq_ptr) *(u64 *)freq_ptr = g_tsc_per_ms * 1000;
|
||||
return 1;
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_QueryPerformanceCounter(u64 count_ptr) {
|
||||
shim_tsc_init();
|
||||
count_ptr = gp(count_ptr);
|
||||
if (count_ptr) *(u64 *)count_ptr = shim_rdtsc();
|
||||
return 1;
|
||||
}
|
||||
@@ -524,6 +612,7 @@ static u64 __attribute__((ms_abi)) shim_Sleep(u64 ms) {
|
||||
|
||||
/* SYSTEM_INFO(x64,48 字节) */
|
||||
static u64 __attribute__((ms_abi)) shim_GetSystemInfo(u64 si_p) {
|
||||
si_p = gp(si_p);
|
||||
if (!si_p) return 0;
|
||||
u8 *p = (u8 *)si_p;
|
||||
for (int i = 0; i < 48; i++) p[i] = 0;
|
||||
@@ -548,7 +637,7 @@ static u64 __attribute__((ms_abi)) shim_WriteConsoleW(u64 handle, u64 buf, u64 n
|
||||
u64 written_ptr, u64 reserved) {
|
||||
(void)reserved;
|
||||
if (handle != SHIM_STDOUT_HANDLE && handle != SHIM_STDERR_HANDLE) return 0;
|
||||
const u16 *s = (const u16 *)buf;
|
||||
const u16 *s = (const u16 *)gp(buf);
|
||||
for (u64 i = 0; i < nchars; i++) {
|
||||
u32 c = s[i];
|
||||
if (c < 0x80) {
|
||||
@@ -562,12 +651,14 @@ static u64 __attribute__((ms_abi)) shim_WriteConsoleW(u64 handle, u64 buf, u64 n
|
||||
serial_putc((char)(0x80 | (c & 0x3F)));
|
||||
}
|
||||
}
|
||||
written_ptr = gp(written_ptr);
|
||||
if (written_ptr) *(u32 *)written_ptr = (u32)nchars;
|
||||
return 1;
|
||||
}
|
||||
|
||||
static u64 __attribute__((ms_abi)) shim_GetCurrentDirectoryW(u64 buflen, u64 buf) {
|
||||
static const u16 cwd[] = { 'C', ':', '\\', 0 };
|
||||
buf = gp(buf);
|
||||
if (!buf || buflen < 4) return 4; /* 需要 4 个字符(含 NUL) */
|
||||
u16 *out = (u16 *)buf;
|
||||
for (int i = 0; i < 4; i++) out[i] = cwd[i];
|
||||
@@ -603,6 +694,7 @@ static u64 __attribute__((ms_abi)) shim_FormatMessageW(u64 flags, u64 src, u64 m
|
||||
}
|
||||
|
||||
static u64 __attribute__((ms_abi)) shim_LoadLibraryA(u64 name_p) {
|
||||
name_p = gp(name_p);
|
||||
if (!name_p) return 0;
|
||||
const char *n = (const char *)name_p;
|
||||
/* 已知 DLL 返回伪句柄(大小写不敏感子串匹配) */
|
||||
@@ -625,7 +717,7 @@ static u64 __attribute__((ms_abi)) shim_LoadLibraryA(u64 name_p) {
|
||||
}
|
||||
|
||||
static u64 __attribute__((ms_abi)) shim_lstrlenW(u64 str_p) {
|
||||
const u16 *s = (const u16 *)str_p;
|
||||
const u16 *s = (const u16 *)gp(str_p);
|
||||
u64 n = 0;
|
||||
if (s) while (s[n]) n++;
|
||||
return n;
|
||||
@@ -636,6 +728,7 @@ static u64 __attribute__((ms_abi)) shim_lstrlenW(u64 str_p) {
|
||||
* Rust std 用它动态探测 Rtl 系列/dbghelp API,命中返回真实 shim 地址,miss 返回 0。 */
|
||||
static u64 __attribute__((ms_abi)) shim_GetProcAddress(u64 module, u64 name_p) {
|
||||
(void)module;
|
||||
name_p = gp(name_p);
|
||||
if (!name_p) return 0;
|
||||
if ((name_p >> 16) == 0) { /* ordinal 导入 */
|
||||
g_last_error = 127; /* ERROR_PROC_NOT_FOUND */
|
||||
@@ -660,12 +753,13 @@ static u64 __attribute__((ms_abi)) shim_GetProcAddress(u64 module, u64 name_p) {
|
||||
|
||||
/* Rtl* — Rust panic/unwind 机制引用(panic=abort 下不会真正走到) */
|
||||
static u64 __attribute__((ms_abi)) shim_RtlCaptureContext(u64 ctx_p) {
|
||||
u8 *p = (u8 *)ctx_p;
|
||||
u8 *p = (u8 *)gp(ctx_p);
|
||||
if (p) for (int i = 0; i < 1232; i++) p[i] = 0; /* x64 CONTEXT ≈ 1232B */
|
||||
return 0;
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_RtlLookupFunctionEntry(u64 rip, u64 base_p, u64 table_p) {
|
||||
(void)rip;
|
||||
base_p = gp(base_p); table_p = gp(table_p);
|
||||
if (base_p) *(u64 *)base_p = 0;
|
||||
if (table_p) *(u64 *)table_p = 0;
|
||||
return 0;
|
||||
@@ -680,8 +774,8 @@ static u64 __attribute__((ms_abi)) shim_RtlVirtualUnwind(u64 a, u64 b, u64 c, u6
|
||||
static u64 __attribute__((ms_abi)) shim_MultiByteToWideChar(u64 cp, u64 flags, u64 mbs_p,
|
||||
u64 cbmb, u64 wbuf_p, u64 cchw) {
|
||||
(void)flags;
|
||||
const u8 *s = (const u8 *)mbs_p;
|
||||
u16 *out = (u16 *)wbuf_p;
|
||||
const u8 *s = (const u8 *)gp(mbs_p);
|
||||
u16 *out = (u16 *)gp(wbuf_p);
|
||||
i64 remain = (i64)cbmb; /* -1 = NUL 结尾 */
|
||||
u64 need = 0;
|
||||
if (!s) return 0;
|
||||
@@ -730,10 +824,11 @@ static u64 __attribute__((ms_abi)) shim_WideCharToMultiByte(u64 cp, u64 flags, u
|
||||
u64 cchw, u64 mbs_p, u64 cbmb,
|
||||
u64 defc, u64 used_p) {
|
||||
(void)flags; (void)defc;
|
||||
const u16 *s = (const u16 *)ws_p;
|
||||
u8 *out = (u8 *)mbs_p;
|
||||
const u16 *s = (const u16 *)gp(ws_p);
|
||||
u8 *out = (u8 *)gp(mbs_p);
|
||||
i64 remain = (i64)cchw; /* -1 = NUL 结尾 */
|
||||
u64 need = 0;
|
||||
used_p = gp(used_p);
|
||||
if (used_p) *(u32 *)used_p = 0;
|
||||
if (!s) return 0;
|
||||
for (;;) {
|
||||
@@ -785,8 +880,9 @@ static u64 __attribute__((ms_abi)) shim_NtWriteFile(u64 fh, u64 ev, u64 apc_r, u
|
||||
u64 off, u64 key) {
|
||||
(void)ev; (void)apc_r; (void)apc_c; (void)off; (void)key;
|
||||
if (fh == SHIM_STDOUT_HANDLE || fh == SHIM_STDERR_HANDLE) {
|
||||
shim_output((const char *)buf, len);
|
||||
shim_output((const char *)gp(buf), len);
|
||||
}
|
||||
iosb = gp(iosb);
|
||||
if (iosb) { /* IO_STATUS_BLOCK: {NTSTATUS Status; ULONG_PTR Information} */
|
||||
((u64 *)iosb)[0] = 0;
|
||||
((u64 *)iosb)[1] = len;
|
||||
@@ -799,7 +895,7 @@ static u64 __attribute__((ms_abi)) shim_RtlNtStatusToDosError(u64 status) {
|
||||
|
||||
static u64 __attribute__((ms_abi)) shim_ProcessPrng(u64 buf, u64 len) {
|
||||
u64 s = shim_rdtsc() ^ 0x9E3779B97F4A7C15ULL;
|
||||
u8 *p = (u8 *)buf;
|
||||
u8 *p = (u8 *)gp(buf);
|
||||
for (u64 i = 0; i < len; i++) {
|
||||
s ^= s << 13; s ^= s >> 7; s ^= s << 17; /* xorshift64 */
|
||||
p[i] = (u8)(s & 0xFF);
|
||||
@@ -815,7 +911,7 @@ static u64 __attribute__((ms_abi)) shim_WaitOnAddress(u64 addr, u64 expected, u6
|
||||
static u64 __attribute__((ms_abi)) shim_WakeByAddress(u64 addr) { (void)addr; return 0; }
|
||||
|
||||
/* ============================================================
|
||||
* user32.dll — 单窗口 + 消息泵(PS/2 键盘轮询)
|
||||
* user32.dll — 单窗口 + 消息泵(PS/2 键盘 + AUX 鼠标轮询)
|
||||
* ========================================================== */
|
||||
|
||||
#define SHIM_HWND 0x20000001ULL
|
||||
@@ -827,6 +923,19 @@ static u64 __attribute__((ms_abi)) shim_WakeByAddress(u64 addr) { (void)addr; re
|
||||
#define SHIM_WM_KEYDOWN 0x0100u
|
||||
#define SHIM_WM_KEYUP 0x0101u
|
||||
#define SHIM_WM_CHAR 0x0102u
|
||||
#define SHIM_WM_MOUSEMOVE 0x0200u
|
||||
#define SHIM_WM_LBUTTONDOWN 0x0201u
|
||||
#define SHIM_WM_LBUTTONUP 0x0202u
|
||||
#define SHIM_WM_RBUTTONDOWN 0x0204u
|
||||
#define SHIM_WM_RBUTTONUP 0x0205u
|
||||
#define SHIM_WM_MBUTTONDOWN 0x0207u
|
||||
#define SHIM_WM_MBUTTONUP 0x0208u
|
||||
/* wparam MK_* 修饰位 */
|
||||
#define SHIM_MK_LBUTTON 0x0001u
|
||||
#define SHIM_MK_RBUTTON 0x0002u
|
||||
#define SHIM_MK_SHIFT 0x0004u
|
||||
#define SHIM_MK_CONTROL 0x0008u
|
||||
#define SHIM_MK_MBUTTON 0x0010u
|
||||
|
||||
static u64 g_wnd_proc = 0;
|
||||
static int g_wnd_created = 0;
|
||||
@@ -846,8 +955,13 @@ typedef struct {
|
||||
static shim_msg_t g_msgq[SHIM_MSGQ_CAP];
|
||||
static int g_mq_head = 0, g_mq_count = 0;
|
||||
|
||||
static void shim_msg_push(u32 msg, u64 w, u64 l) {
|
||||
if (g_mq_count >= SHIM_MSGQ_CAP) return; /* 满则丢弃 */
|
||||
static u32 g_mq_drops = 0; /* 队列满丢弃计数(诊断) */
|
||||
|
||||
static void shim_msg_push_pt(u32 msg, u64 w, u64 l, i32 ptx, i32 pty) {
|
||||
if (g_mq_count >= SHIM_MSGQ_CAP) {
|
||||
if (g_mq_drops < 4) { g_mq_drops++; log_hex64("[shim] msgq drop msg=", msg); }
|
||||
return;
|
||||
}
|
||||
int idx = (g_mq_head + g_mq_count) % SHIM_MSGQ_CAP;
|
||||
g_msgq[idx].hwnd = SHIM_HWND;
|
||||
g_msgq[idx].message = msg;
|
||||
@@ -856,11 +970,15 @@ static void shim_msg_push(u32 msg, u64 w, u64 l) {
|
||||
g_msgq[idx].lparam = l;
|
||||
g_msgq[idx].time = 0;
|
||||
g_msgq[idx].pad1 = 0;
|
||||
g_msgq[idx].ptx = 0;
|
||||
g_msgq[idx].pty = 0;
|
||||
g_msgq[idx].ptx = ptx;
|
||||
g_msgq[idx].pty = pty;
|
||||
g_mq_count++;
|
||||
}
|
||||
|
||||
static void shim_msg_push(u32 msg, u64 w, u64 l) {
|
||||
shim_msg_push_pt(msg, w, l, 0, 0);
|
||||
}
|
||||
|
||||
/* PS/2 键盘状态 */
|
||||
static int s_kbd_shift = 0, s_kbd_ctrl = 0, s_kbd_alt = 0, s_kbd_e0 = 0;
|
||||
|
||||
@@ -895,9 +1013,15 @@ static u32 shim_scan_vk(u8 sc, int e0) {
|
||||
default: return 0;
|
||||
}
|
||||
}
|
||||
if (sc >= 0x10 && sc <= 0x19) return 'Q' + (sc - 0x10);
|
||||
if (sc >= 0x1E && sc <= 0x26) return 'A' + (sc - 0x1E);
|
||||
if (sc >= 0x2C && sc <= 0x32) return 'Z' + (sc - 0x2C);
|
||||
/* 字母三行:scancode 顺序与 ASCII 序不一致(QWERTY 布局),且 'Z'+1='['
|
||||
* 在 ASCII 中不连续,必须用显式表,不能算术偏移(此前 shift-b 出 0x5E). */
|
||||
static const u8 vk_row_q[10] = { 'Q','W','E','R','T','Y','U','I','O','P' };
|
||||
static const u8 vk_row_a[9] = { 'A','S','D','F','G','H','J','K','L' };
|
||||
static const u8 vk_row_z[7] = { 'Z','X','C','V','B','N','M' };
|
||||
if (sc >= 0x10 && sc <= 0x19) return vk_row_q[sc - 0x10];
|
||||
if (sc >= 0x1E && sc <= 0x26) return vk_row_a[sc - 0x1E];
|
||||
if (sc >= 0x2C && sc <= 0x32) return vk_row_z[sc - 0x2C];
|
||||
/* 数字行 scancode 与 ASCII 均连续,算术偏移正确 */
|
||||
if (sc >= 0x02 && sc <= 0x0A) return '1' + (sc - 0x02);
|
||||
if (sc == 0x0B) return '0';
|
||||
switch (sc) {
|
||||
@@ -913,13 +1037,134 @@ static u32 shim_scan_vk(u8 sc, int e0) {
|
||||
}
|
||||
}
|
||||
|
||||
/* 前向声明(shim_fb 定义在下方 RegisterClassExW 之后) */
|
||||
static const struct limine_framebuffer *shim_fb(void);
|
||||
|
||||
/* ============================================================
|
||||
* PS/2 AUX 鼠标(轮询模式,无 IRQ12)
|
||||
*
|
||||
* 初始化:on-demand(首次消息泵轮询时执行),启用 AUX 端口 +
|
||||
* 清配置字节 bit5(启用 AUX 时钟) + 发 0xF4 启用数据报告.
|
||||
* 全程超时保护:任何单步失败只记日志并永久禁用鼠标,绝不阻塞
|
||||
* GUI 主循环.包解码:3 字节(同步位 bit3 校验,9 位有符号位移,
|
||||
* 溢出位丢弃位移),坐标钳位到帧缓冲,边沿合成鼠标消息.
|
||||
* ========================================================== */
|
||||
|
||||
static int s_mouse_inited = 0;
|
||||
static int s_mouse_ok = 0;
|
||||
static i32 s_mouse_x = 512, s_mouse_y = 384; /* 屏幕坐标 */
|
||||
static u8 s_mouse_btn = 0; /* bit0=L bit1=R bit2=M */
|
||||
static u8 s_mpkt[3];
|
||||
static int s_mpkt_n = 0;
|
||||
static int s_dbg_aux = 0; /* 调试:前 16 个 AUX 字节计数 */
|
||||
static int s_dbg_pkt = 0; /* 调试:前 8 个完整包计数 */
|
||||
static int s_dbg_key = 0; /* 调试:前 16 个键盘消息计数(KEYDOWN/KEYUP/CHAR) */
|
||||
|
||||
static int ps2_wait_ibf_clear(u32 spins) {
|
||||
while (spins--) { if (!(inb(0x64) & 2)) return 0; }
|
||||
return -1;
|
||||
}
|
||||
static int ps2_wait_obf_set(u32 spins) {
|
||||
while (spins--) { if (inb(0x64) & 1) return 0; }
|
||||
return -1;
|
||||
}
|
||||
/* 经 0xD4 转发命令到鼠标并等 ACK(0xFA) */
|
||||
static int ps2_aux_cmd(u8 v) {
|
||||
if (ps2_wait_ibf_clear(100000) < 0) return -1;
|
||||
outb(0x64, 0xD4);
|
||||
if (ps2_wait_ibf_clear(100000) < 0) return -1;
|
||||
outb(0x60, v);
|
||||
if (ps2_wait_obf_set(100000) < 0) return -1;
|
||||
return inb(0x60) == 0xFA ? 0 : -1;
|
||||
}
|
||||
|
||||
static void shim_mouse_init_once(void) {
|
||||
if (s_mouse_inited) return;
|
||||
s_mouse_inited = 1;
|
||||
/* 排空控制器残留输出字节 */
|
||||
for (int i = 0; i < 16 && (inb(0x64) & 1); i++) (void)inb(0x60);
|
||||
/* 启用 AUX 端口 */
|
||||
if (ps2_wait_ibf_clear(100000) < 0) { log_warn("[shim] mouse: ctrl busy"); return; }
|
||||
outb(0x64, 0xA8);
|
||||
/* 读配置字节:清 bit5(启用 AUX 时钟),置 bit1(IRQ12 允许,轮询下无害) */
|
||||
if (ps2_wait_ibf_clear(100000) < 0) { log_warn("[shim] mouse: ctrl busy2"); return; }
|
||||
outb(0x64, 0x20);
|
||||
if (ps2_wait_obf_set(100000) < 0) { log_warn("[shim] mouse: no cfg byte"); return; }
|
||||
u8 cfg = inb(0x60);
|
||||
cfg = (u8)((cfg & ~0x20u) | 0x02u);
|
||||
if (ps2_wait_ibf_clear(100000) < 0) { log_warn("[shim] mouse: cfg wbusy"); return; }
|
||||
outb(0x64, 0x60);
|
||||
if (ps2_wait_ibf_clear(100000) < 0) { log_warn("[shim] mouse: cfg wbusy2"); return; }
|
||||
outb(0x60, cfg);
|
||||
/* 启用流模式数据报告 */
|
||||
if (ps2_aux_cmd(0xF4) < 0) { log_warn("[shim] mouse: enable-report nack"); return; }
|
||||
s_mouse_ok = 1;
|
||||
log_info("[shim] mouse init ok (AUX streaming, polled)");
|
||||
}
|
||||
|
||||
/* 鼠标 1 字节 -> 3 字节包 -> Win32 消息 */
|
||||
static void shim_mouse_byte(u8 b) {
|
||||
if (s_mpkt_n == 0 && !(b & 0x08)) return; /* byte0 同步位(bit3)必须为 1,否则丢弃重同步 */
|
||||
s_mpkt[s_mpkt_n++] = b;
|
||||
if (s_mpkt_n < 3) return;
|
||||
s_mpkt_n = 0;
|
||||
|
||||
u8 f = s_mpkt[0];
|
||||
i32 dx = (i32)s_mpkt[1] - ((f & 0x10) ? 0x100 : 0); /* 9 位有符号位移 */
|
||||
i32 dy = (i32)s_mpkt[2] - ((f & 0x20) ? 0x100 : 0);
|
||||
if (f & 0x40) dx = 0; /* X 溢出:位移不可信,只取按钮 */
|
||||
if (f & 0x80) dy = 0; /* Y 溢出 */
|
||||
if (s_dbg_pkt < 8) {
|
||||
s_dbg_pkt++;
|
||||
log_hex64("[shim] mpkt f=", f);
|
||||
log_hex64("[shim] mpkt dx=", (u64)(i64)dx);
|
||||
log_hex64("[shim] mpkt dy=", (u64)(i64)dy);
|
||||
}
|
||||
|
||||
const struct limine_framebuffer *fb = shim_fb();
|
||||
i32 fw = fb ? (i32)fb->width : 1024;
|
||||
i32 fh = fb ? (i32)fb->height : 768;
|
||||
i32 nx = s_mouse_x + dx;
|
||||
i32 ny = s_mouse_y - dy; /* PS/2 Y 向前(屏幕上方向)为正 -> 屏幕坐标取反 */
|
||||
if (nx < 0) nx = 0; else if (nx >= fw) nx = fw - 1;
|
||||
if (ny < 0) ny = 0; else if (ny >= fh) ny = fh - 1;
|
||||
|
||||
u8 nbtn = (u8)(f & 0x07);
|
||||
i32 cx = nx - g_wnd_x, cy = ny - g_wnd_y; /* 客户区坐标(消息 lparam) */
|
||||
u64 lp = (u64)(u32)(((u32)(u16)cy << 16) | (u32)(u16)cx);
|
||||
u64 mk = 0;
|
||||
if (nbtn & 1) mk |= SHIM_MK_LBUTTON;
|
||||
if (nbtn & 2) mk |= SHIM_MK_RBUTTON;
|
||||
if (nbtn & 4) mk |= SHIM_MK_MBUTTON;
|
||||
if (s_kbd_shift) mk |= SHIM_MK_SHIFT;
|
||||
if (s_kbd_ctrl) mk |= SHIM_MK_CONTROL;
|
||||
|
||||
if (nx != s_mouse_x || ny != s_mouse_y) {
|
||||
s_mouse_x = nx; s_mouse_y = ny;
|
||||
shim_msg_push_pt(SHIM_WM_MOUSEMOVE, mk, lp, nx, ny);
|
||||
}
|
||||
/* 按钮边沿(按钮事件罕见,逐一打点:msg/客户区坐标) */
|
||||
if ((nbtn & 1) && !(s_mouse_btn & 1)) { shim_msg_push_pt(SHIM_WM_LBUTTONDOWN, mk, lp, nx, ny); log_hex64("[shim] LDOWN lp=", lp); }
|
||||
if (!(nbtn & 1) && (s_mouse_btn & 1)) { shim_msg_push_pt(SHIM_WM_LBUTTONUP, mk, lp, nx, ny); log_hex64("[shim] LUP lp=", lp); }
|
||||
if ((nbtn & 2) && !(s_mouse_btn & 2)) shim_msg_push_pt(SHIM_WM_RBUTTONDOWN, mk, lp, nx, ny);
|
||||
if (!(nbtn & 2) && (s_mouse_btn & 2)) shim_msg_push_pt(SHIM_WM_RBUTTONUP, mk, lp, nx, ny);
|
||||
if ((nbtn & 4) && !(s_mouse_btn & 4)) shim_msg_push_pt(SHIM_WM_MBUTTONDOWN, mk, lp, nx, ny);
|
||||
if (!(nbtn & 4) && (s_mouse_btn & 4)) shim_msg_push_pt(SHIM_WM_MBUTTONUP, mk, lp, nx, ny);
|
||||
s_mouse_btn = nbtn;
|
||||
}
|
||||
|
||||
/* 排空 PS/2 输出缓冲,转成 Win32 消息入队 */
|
||||
static void shim_kbd_poll(void) {
|
||||
shim_mouse_init_once();
|
||||
for (;;) {
|
||||
u8 st = inb(0x64);
|
||||
if (!(st & 1)) break;
|
||||
u8 sc = inb(0x60);
|
||||
if (st & 0x20) continue; /* 鼠标字节丢弃 */
|
||||
if (st & 0x20) {
|
||||
if (s_dbg_aux < 16) { s_dbg_aux++; log_hex64("[shim] aux byte=", sc); }
|
||||
if (s_mouse_ok) shim_mouse_byte(sc);
|
||||
continue;
|
||||
}
|
||||
if (sc == 0xE0) { s_kbd_e0 = 1; continue; }
|
||||
int e0 = s_kbd_e0;
|
||||
if (!e0) {
|
||||
@@ -933,18 +1178,25 @@ static void shim_kbd_poll(void) {
|
||||
s_kbd_e0 = 0;
|
||||
if (sc & 0x80) {
|
||||
u32 vk = shim_scan_vk(sc & 0x7F, e0);
|
||||
if (vk) shim_msg_push(SHIM_WM_KEYUP, vk, sc);
|
||||
if (vk) {
|
||||
shim_msg_push(SHIM_WM_KEYUP, vk, sc);
|
||||
if (s_dbg_key < 16) { s_dbg_key++; log_hex64("[shim] KEYUP vk=", vk); }
|
||||
}
|
||||
continue;
|
||||
}
|
||||
u32 vk = shim_scan_vk(sc, e0);
|
||||
if (vk) {
|
||||
shim_msg_push(SHIM_WM_KEYDOWN, vk, sc);
|
||||
if (s_dbg_key < 16) { s_dbg_key++; log_hex64("[shim] KEYDOWN vk=", vk); }
|
||||
/* Esc -> 额外合成 WM_CLOSE:无鼠标环境下关闭窗口的唯一途径 */
|
||||
if (vk == 0x1B && !e0) shim_msg_push(SHIM_WM_CLOSE, 0, 0);
|
||||
}
|
||||
if (!e0) {
|
||||
char c = shim_scan_ascii(sc, s_kbd_shift);
|
||||
if (c >= ' ' && c < 0x7F) shim_msg_push(SHIM_WM_CHAR, (u64)(u8)c, sc);
|
||||
if (c >= ' ' && c < 0x7F) {
|
||||
shim_msg_push(SHIM_WM_CHAR, (u64)(u8)c, sc);
|
||||
if (s_dbg_key < 16) { s_dbg_key++; log_hex64("[shim] CHAR ch=", (u64)(u8)c); }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1005,7 +1257,7 @@ static u64 __attribute__((ms_abi)) shim_SetCursor(u64 cur) {
|
||||
(void)cur; return SHIM_HCURSOR;
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_GetCursorPos(u64 pt_p) {
|
||||
if (pt_p) { ((i32 *)pt_p)[0] = g_wnd_w / 2; ((i32 *)pt_p)[1] = g_wnd_h / 2; }
|
||||
if (pt_p) { ((i32 *)pt_p)[0] = s_mouse_x; ((i32 *)pt_p)[1] = s_mouse_y; }
|
||||
return 1;
|
||||
}
|
||||
static u64 __attribute__((ms_abi)) shim_ScreenToClient(u64 hwnd, u64 pt_p) {
|
||||
@@ -1163,6 +1415,50 @@ static u64 __attribute__((ms_abi)) shim_GdiFlush(void) { return 1; }
|
||||
|
||||
static u64 g_blit_count = 0;
|
||||
|
||||
/* 12x12 箭头软件光标:'X'=黑边 '#'=白心 '.'=透明.
|
||||
* 设计:BitBlt 上屏后叠画;egui 每帧全量重绘,下一帧 BitBlt 自动覆盖旧光标,
|
||||
* 无需保存/恢复背景.只在窗口矩形内绘制(越界裁剪),避免屏外残影. */
|
||||
static const char *const g_cursor_bmp[12] = {
|
||||
"X...........",
|
||||
"XX..........",
|
||||
"X#X.........",
|
||||
"X##X........",
|
||||
"X###X.......",
|
||||
"X####X......",
|
||||
"X#####X.....",
|
||||
"X######X....",
|
||||
"X#######X...",
|
||||
"X########X..",
|
||||
"X####XXXX...",
|
||||
"XXXX........",
|
||||
};
|
||||
|
||||
static void shim_draw_cursor(const struct limine_framebuffer *fb) {
|
||||
if (!s_mouse_ok || !g_wnd_created) return;
|
||||
i32 wx1 = g_wnd_x + g_wnd_w, wy1 = g_wnd_y + g_wnd_h;
|
||||
if (s_mouse_x < g_wnd_x || s_mouse_y < g_wnd_y) return;
|
||||
if (s_mouse_x >= wx1 || s_mouse_y >= wy1) return;
|
||||
u8 *fbb = (u8 *)fb->address;
|
||||
for (i32 r = 0; r < 12; r++) {
|
||||
i32 fy = s_mouse_y + r;
|
||||
if (fy >= wy1 || fy >= (i32)fb->height) break;
|
||||
u8 *rowb = fbb + (u64)fy * fb->pitch;
|
||||
for (i32 c = 0; c < 12; c++) {
|
||||
char ch = g_cursor_bmp[r][c];
|
||||
if (ch != 'X' && ch != '#') continue;
|
||||
i32 fx = s_mouse_x + c;
|
||||
if (fx >= wx1 || fx >= (i32)fb->width) break;
|
||||
if (fb->bpp == 32) {
|
||||
((u32 *)rowb)[fx] = (ch == '#') ? 0xFFFFFFFFu : 0xFF000000u;
|
||||
} else {
|
||||
u8 v = (ch == '#') ? 0xFF : 0x00;
|
||||
u8 *p = rowb + (u64)fx * 3;
|
||||
p[0] = v; p[1] = v; p[2] = v;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
static u64 __attribute__((ms_abi)) shim_BitBlt(u64 dstdc, u64 x, u64 y, u64 cx, u64 cy,
|
||||
u64 srcdc, u64 x1, u64 y1, u64 rop) {
|
||||
(void)rop;
|
||||
@@ -1216,9 +1512,19 @@ static u64 __attribute__((ms_abi)) shim_BitBlt(u64 dstdc, u64 x, u64 y, u64 cx,
|
||||
}
|
||||
}
|
||||
}
|
||||
shim_draw_cursor(fb);
|
||||
g_blit_count++;
|
||||
if (g_blit_count == 1) log_info("[shim] BitBlt first frame on screen");
|
||||
if ((g_blit_count % 600) == 0) log_hex64("[shim] BitBlt frames=", g_blit_count);
|
||||
if ((g_blit_count % 600) == 0) {
|
||||
log_hex64("[shim] BitBlt frames=", g_blit_count);
|
||||
/* 堆健康度:live 逐周期线性增长=真泄漏;free_max 持续萎缩=碎片化 */
|
||||
u64 fm = 0;
|
||||
for (heap_blk *f = g_heap_free_head; f; f = (heap_blk *)f->next_free) {
|
||||
if (f->size > fm) fm = f->size;
|
||||
}
|
||||
log_hex64("[shim] heap live=", g_heap_live);
|
||||
log_hex64("[shim] heap free_max=", fm);
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
+23
-3
@@ -49,9 +49,22 @@ void pe_shim_init(const char *cmdline);
|
||||
* 64位和32位共用。exit_code = 进程退出码。 */
|
||||
void pe_shim_exit_process(u64 exit_code);
|
||||
|
||||
/* pe_run 调用：保存上下文（__builtin_setjmp）。
|
||||
* 返回 0 = 首次（继续执行 PE），1 = ExitProcess 触发（longjmp 回来）。 */
|
||||
int pe_shim_setup_exit(void);
|
||||
/* 获取 ExitProcess longjmp 目标 jmpbuf，并重置退出状态。
|
||||
*
|
||||
* BUG-20260801-006：__builtin_setjmp 必须出现在 PE 执行全程存活的
|
||||
* 栈帧内（pe_service_run 本体）。此前由 pe_shim_setup_exit() 包装
|
||||
* 调用——该函数调用 setjmp 后即返回，C 标准明确规定"含 setjmp 的
|
||||
* 函数已返回后再 longjmp"为未定义行为（实测 longjmp 尾声从脏栈
|
||||
* pop 出 log_hex64 缓冲区 ASCII 残片充当 R12-R15/RBP → 野指针
|
||||
* call → 三重故障）。
|
||||
*
|
||||
* 调用方标准写法（setjmp 直接出现在调用方函数本体内）：
|
||||
* if (__builtin_setjmp(pe_shim_exit_jmpbuf()) == 0) {
|
||||
* ... 执行 PE ...
|
||||
* } else {
|
||||
* code = pe_shim_get_exit_code();
|
||||
* } */
|
||||
void **pe_shim_exit_jmpbuf(void);
|
||||
|
||||
/* 获取上次 ExitProcess 的退出码 */
|
||||
u64 pe_shim_get_exit_code(void);
|
||||
@@ -62,4 +75,11 @@ int pe_shim_is_exit_call(u64 target);
|
||||
/* 获取 cmdline（shim 内部用） */
|
||||
const char *pe_shim_get_cmdline(void);
|
||||
|
||||
/* BUG-20260801-007：设置 PE32 解释器内存基址（guest→host 指针转换）。
|
||||
* PE32 解释器路径下，fn64 回退 shim 收到的指针参数是 32 位 guest VA
|
||||
* （相对解释器 mem 基址的偏移），直接当 host 指针解引用 → 低地址 #PF
|
||||
* → 三重故障。执行 PE32 前设置 base=mem，shim 内部 gp() 在指针解引用点
|
||||
* 完成转换；base=0 表示非解释器上下文（原生 PE32+ 路径），gp() 恒等映射。 */
|
||||
void pe_shim_set_emu_base(u64 base);
|
||||
|
||||
#endif /* PE_SHIM_H */
|
||||
|
||||
@@ -310,8 +310,15 @@ static int try_iat_call(x86emu_state *emu, u32 target) {
|
||||
ret = se->fn32(esp_ptr);
|
||||
} else if (se->fn64) {
|
||||
/* 回退：调用 64位 shim（最多 4 个参数）。
|
||||
* MS x64 ABI 由 C 编译器处理寄存器分配。 */
|
||||
typedef u64 (*fn4_t)(u64, u64, u64, u64);
|
||||
* BUG-20260801-007 后续修正：fn4_t 必须显式 ms_abi。
|
||||
* UTSM 以 clang x86_64-unknown-none 编译，C 默认 ABI 是 SysV
|
||||
* （arg1=RDI/RSI/RDX/RCX），而 shim 全部 __attribute__((ms_abi))
|
||||
* （arg1=RCX/RDX/R8/R9）。typedef 不带 ms_abi 时编译器生成 SysV
|
||||
* 调用序列 → shim 在 RCX 读到的是 SysV 第4参数 a3(=0) → gp(0)=0
|
||||
* → shim_printf 解引用 NULL → #PF cr2=0（实测寄存器现场:
|
||||
* rdi=0x401017 即 SysV arg1=fmt, rcx=0, cr2=0）。
|
||||
* 原生 PE32+ 路径 guest 是 Windows 程序天生 MS ABI，不受影响。 */
|
||||
typedef u64 (__attribute__((ms_abi)) *fn4_t)(u64, u64, u64, u64);
|
||||
fn4_t f = (fn4_t)se->fn64;
|
||||
ret = f(a0, a1, a2, a3);
|
||||
|
||||
|
||||
+57
-28
@@ -265,6 +265,10 @@ static int g_drag_off_x, g_drag_off_y;
|
||||
static app_descriptor g_apps[MAX_APPS];
|
||||
static int g_app_count = 0;
|
||||
|
||||
/* Linux 兼容层服务运行态（register_linux_apps 设置）：0 时 Linux 图标置灰，
|
||||
* 双击仍开终端窗口并提示不可用原因（lnx_on_create 运行时复查）。 */
|
||||
static int g_lnx_svc_up = 0;
|
||||
|
||||
static desktop_icon g_icons[MAX_ICONS];
|
||||
static int g_icon_count = 0;
|
||||
|
||||
@@ -545,24 +549,25 @@ static void draw_icon_browser(du_context *ctx, int cx, int cy) {
|
||||
du_pixel(ctx, ccx, ccy, KS_ACCENT2);
|
||||
}
|
||||
|
||||
/* Linux 应用图标：暗底终端 + 霓虹绿 >_ 提示符（与 bash 终端同色板） */
|
||||
static void draw_icon_linux(du_context *ctx, int cx, int cy) {
|
||||
/* Linux 应用图标：暗底终端 + 霓虹绿 >_ 提示符（与 bash 终端同色板）。
|
||||
* 服务不可用时 accent 传 KS_TEXT_DIM（置灰，点击仍给原因提示）。 */
|
||||
static void draw_icon_linux(du_context *ctx, int cx, int cy, u32 accent) {
|
||||
du_fill_rect(ctx, cx, cy, 40, 40, KS_BG_PRIMARY);
|
||||
du_rect_outline(ctx, cx, cy, 40, 40, KS_ACCENT2, 2);
|
||||
du_rect_outline(ctx, cx, cy, 40, 40, accent, 2);
|
||||
/* '>' 折线 */
|
||||
du_fill_rect(ctx, cx + 8, cy + 12, 2, 2, KS_ACCENT2);
|
||||
du_fill_rect(ctx, cx + 10, cy + 14, 2, 2, KS_ACCENT2);
|
||||
du_fill_rect(ctx, cx + 12, cy + 16, 2, 2, KS_ACCENT2);
|
||||
du_fill_rect(ctx, cx + 10, cy + 18, 2, 2, KS_ACCENT2);
|
||||
du_fill_rect(ctx, cx + 8, cy + 20, 2, 2, KS_ACCENT2);
|
||||
du_fill_rect(ctx, cx + 8, cy + 12, 2, 2, accent);
|
||||
du_fill_rect(ctx, cx + 10, cy + 14, 2, 2, accent);
|
||||
du_fill_rect(ctx, cx + 12, cy + 16, 2, 2, accent);
|
||||
du_fill_rect(ctx, cx + 10, cy + 18, 2, 2, accent);
|
||||
du_fill_rect(ctx, cx + 8, cy + 20, 2, 2, accent);
|
||||
/* '_' 光标块 */
|
||||
du_fill_rect(ctx, cx + 16, cy + 22, 8, 2, KS_ACCENT2);
|
||||
du_fill_rect(ctx, cx + 16, cy + 22, 8, 2, accent);
|
||||
}
|
||||
|
||||
static void draw_app_icon(du_context *ctx, int app_id, int cx, int cy) {
|
||||
/* Linux 应用走专属图标（暗底绿提示符），其余保持原有映射 */
|
||||
if (app_id >= 0 && app_id < g_app_count && g_apps[app_id].linux_cmd) {
|
||||
draw_icon_linux(ctx, cx, cy);
|
||||
draw_icon_linux(ctx, cx, cy, g_lnx_svc_up ? KS_ACCENT2 : KS_TEXT_DIM);
|
||||
return;
|
||||
}
|
||||
switch (app_id) {
|
||||
@@ -1355,19 +1360,16 @@ static void lnx_on_destroy(void *state) {
|
||||
}
|
||||
|
||||
/* ---- Linux 应用注册 ----
|
||||
* 服务不可用（reserved[5] 为空或 magic 不匹配或 guest 未就绪）时直接返回，
|
||||
* 不注册任何图标，desktop 其余功能不受影响。
|
||||
* 无论服务是否可用都注册图标：可用时双击即同步 exec；不可用（VMX 缺失/
|
||||
* guest 未驻留）时图标置灰（g_lnx_svc_up=0），双击由 lnx_on_create 运行时
|
||||
* 复查并显示 "linux: compat service unavailable [exit -1]"，绝不 panic。
|
||||
* 配置：FAT32 根目录 LINUXAPP.CNF（8.3 名 LINUXAPPCNF），每行 显示名|linux命令；
|
||||
* 文件缺失或无有效行时回退内置默认列表（neofetch / htop）。 */
|
||||
* 文件缺失或无有效行时回退内置默认列表（echo hello / uname -a / ls -l /，
|
||||
* 三条均为 Arch rootfs 与 initramfs busybox 环境共有的可执行命令）。 */
|
||||
static void register_linux_apps(void) {
|
||||
if (!g_lxc_svc) {
|
||||
slog("linux apps: service absent");
|
||||
return;
|
||||
}
|
||||
if (!g_lxc_svc->is_available()) {
|
||||
slog("linux apps: service unavailable");
|
||||
return;
|
||||
}
|
||||
g_lnx_svc_up = (g_lxc_svc && g_lxc_svc->is_available()) ? 1 : 0;
|
||||
if (!g_lxc_svc) slog("linux apps: service absent (icons greyed)");
|
||||
else if (!g_lnx_svc_up) slog("linux apps: service unavailable (icons greyed)");
|
||||
|
||||
da_linux_app ents[DA_LINUXAPP_MAX];
|
||||
int n = 0;
|
||||
@@ -1379,12 +1381,14 @@ static void register_linux_apps(void) {
|
||||
}
|
||||
|
||||
if (n <= 0) {
|
||||
/* 内置默认保底 */
|
||||
kstrcpy(g_lnx_name_pool[0], "NEOFETCH", 12);
|
||||
kstrcpy(g_lnx_cmd_pool[0], "/usr/bin/neofetch", 64);
|
||||
kstrcpy(g_lnx_name_pool[1], "HTOP", 12);
|
||||
kstrcpy(g_lnx_cmd_pool[1], "/usr/bin/htop", 64);
|
||||
n = 2;
|
||||
/* 内置默认保底（guest 中确定存在的命令） */
|
||||
kstrcpy(g_lnx_name_pool[0], "HELLO", 12);
|
||||
kstrcpy(g_lnx_cmd_pool[0], "/bin/echo hello from deshab linux", 64);
|
||||
kstrcpy(g_lnx_name_pool[1], "UNAME", 12);
|
||||
kstrcpy(g_lnx_cmd_pool[1], "/bin/uname -a", 64);
|
||||
kstrcpy(g_lnx_name_pool[2], "LS", 12);
|
||||
kstrcpy(g_lnx_cmd_pool[2], "/bin/ls -l /", 64);
|
||||
n = 3;
|
||||
slog("linux apps: builtin defaults");
|
||||
} else {
|
||||
for (int i = 0; i < n; i++) {
|
||||
@@ -1403,6 +1407,12 @@ static void register_linux_apps(void) {
|
||||
0, g_lnx_cmd_pool[i]
|
||||
};
|
||||
g_app_count++;
|
||||
{
|
||||
char msg[64];
|
||||
kstrcpy(msg, "linux app registered: ", 64);
|
||||
kstrcat(msg, g_lnx_name_pool[i], 64);
|
||||
slog(msg);
|
||||
}
|
||||
}
|
||||
slog("linux apps registered");
|
||||
}
|
||||
@@ -1759,7 +1769,8 @@ static void register_apps(void) {
|
||||
};
|
||||
g_app_count++;
|
||||
|
||||
/* Linux 兼容层应用（服务不可用时内部直接返回，不注册图标） */
|
||||
/* Linux 兼容层应用：无论服务是否可用都注册图标（不可用时置灰，
|
||||
* 双击仍开终端窗口提示原因，见 register_linux_apps / lnx_on_create） */
|
||||
register_linux_apps();
|
||||
}
|
||||
|
||||
@@ -1794,6 +1805,24 @@ static void setup_desktop_icons(void) {
|
||||
g_icon_count++;
|
||||
x += KATE_ICON_W + KATE_ICON_GAP;
|
||||
}
|
||||
|
||||
/* 再追加 Linux 应用图标（register_linux_apps 已登记进 g_apps，带 linux_cmd）。
|
||||
* 服务不可用时图标仍上架但置灰（draw_app_icon 查 g_lnx_svc_up），
|
||||
* 双击开终端窗口提示原因，与可用时同一入口。 */
|
||||
for (int a = 0; a < g_app_count && g_icon_count < MAX_ICONS; a++) {
|
||||
if (!g_apps[a].linux_cmd) continue;
|
||||
if (x > pad && x + KATE_ICON_W > max_x) {
|
||||
x = pad;
|
||||
y += KATE_ICON_H + KATE_ICON_GAP;
|
||||
}
|
||||
g_icons[g_icon_count].app_id = a;
|
||||
g_icons[g_icon_count].x = x;
|
||||
g_icons[g_icon_count].y = y;
|
||||
g_icons[g_icon_count].label = g_apps[a].display_name;
|
||||
g_icons[g_icon_count].selected = 0;
|
||||
g_icon_count++;
|
||||
x += KATE_ICON_W + KATE_ICON_GAP;
|
||||
}
|
||||
}
|
||||
|
||||
/* ============================================================
|
||||
|
||||
+12
-5
@@ -1846,8 +1846,9 @@ typedef struct { u32 type,flags; u64 offset,vaddr,paddr,filesz,memsz,align; } sh
|
||||
typedef struct { i64 tag; u64 val; } sh_elf64_dyn;
|
||||
typedef struct { u64 offset; u64 info; i64 addend; } sh_elf64_rela;
|
||||
|
||||
/* run 加载镜像缓冲（容纳工具 ELF 展开后的 memsz） */
|
||||
static u8 g_run_image[262144];
|
||||
/* run 加载镜像缓冲（容纳工具 ELF 展开后的 memsz；与 desktop 宿主 g_elf_image 对齐。
|
||||
* editor.elf 文件 43KB 但 BSS NOBITS 内存镜像 ~496KB，256KB 上限曾导致 sh_load_elf -5。） */
|
||||
static u8 g_run_image[1048576];
|
||||
|
||||
static int sh_load_elf(u8 *data, void **entry_out) {
|
||||
const sh_elf64_ehdr *eh = (const sh_elf64_ehdr *)data;
|
||||
@@ -3314,6 +3315,7 @@ void dsk_entry(const dsk_boot_context *ctx) {
|
||||
/* 主循环 */
|
||||
int shift = 0;
|
||||
int e0 = 0;
|
||||
int ctrl = 0; /* Ctrl 修饰键状态：0x1D 按下 / 0x9D 释放（右 Ctrl 为 E0 前缀同名扫描码） */
|
||||
u64 blink_start = rdtsc_shell();
|
||||
for (;;) {
|
||||
draw_prompt();
|
||||
@@ -3350,7 +3352,11 @@ void dsk_entry(const dsk_boot_context *ctx) {
|
||||
if (sc == 0xE0) { e0 = 1; continue; }
|
||||
if (sc == 0x2A || sc == 0x36) { shift = 1; continue; }
|
||||
if (sc == 0xAA || sc == 0xB6) { shift = 0; continue; }
|
||||
/* Ctrl 修饰键跟踪：左 Ctrl 按下 0x1D；右 Ctrl 为 E0 1D（e0 已置位，此处一并清除） */
|
||||
if (sc == 0x1D) { ctrl = 1; e0 = 0; continue; }
|
||||
if (sc & 0x80) {
|
||||
/* 左 Ctrl 释放 0x9D；右 Ctrl 释放 E0 9D —— 两者 sc 均为 0x9D */
|
||||
if (sc == 0x9D) { ctrl = 0; }
|
||||
if (e0 && sc == 0x9C) { e0 = 0; }
|
||||
else if (e0 && sc == 0xCB) { e0 = 0; }
|
||||
else if (e0 && sc == 0xCD) { e0 = 0; }
|
||||
@@ -3396,9 +3402,10 @@ void dsk_entry(const dsk_boot_context *ctx) {
|
||||
if (sc == 0x0E) { delete_char_back(); continue; }
|
||||
if (sc == 0x0F) { handle_tab_complete(); continue; }
|
||||
if (sc == 0x01) { logl("[shell] esc -> return to DSK"); return; }
|
||||
if (sc == 0x15 && !shift) { kill_line(); continue; }
|
||||
if (sc == 0x17 && !shift) { while (input_cursor > 0) delete_char_back(); continue; }
|
||||
if (sc == 0x0B && !shift) { kill_to_end(); continue; }
|
||||
/* Ctrl 组合键：仅 Ctrl 按下时生效，普通键入 y/i/0 走下方 ASCII 插入（BUG-20260801-001） */
|
||||
if (sc == 0x15 && ctrl) { kill_line(); continue; } /* Ctrl+U: 清空整行 */
|
||||
if (sc == 0x17 && ctrl) { while (input_cursor > 0) delete_char_back(); continue; } /* Ctrl+W: 删至行首 */
|
||||
if (sc == 0x0B && ctrl) { kill_to_end(); continue; } /* Ctrl+K: 删至行尾 */
|
||||
char c = scan_to_ascii(sc, shift);
|
||||
if (c && c >= 32 && c <= 126) {
|
||||
insert_char(c);
|
||||
|
||||
Binary file not shown.
@@ -258,14 +258,30 @@ typedef struct {
|
||||
int has_pkt;
|
||||
} da_mouse;
|
||||
|
||||
/* 冲刷 PS/2 控制器输出缓冲（最多 16 字节） */
|
||||
static inline void da_ps2_drain(void) {
|
||||
for (int i = 0; i < 16; i++) {
|
||||
if (!(inb(0x64) & 1)) break;
|
||||
inb(0x60);
|
||||
}
|
||||
}
|
||||
|
||||
static inline void da_mouse_init(void) {
|
||||
/* 必须先冲刷输出缓冲再发 0x20 读配置字：shell 启动本应用时最后键入的
|
||||
* 回车 break code(0x9C) 或鼠标流字节若残留在输出缓冲，会被误读为"配置字"
|
||||
* 并写回控制器 —— 残留字节 bit4(0x10)=1 会置位 KBD 时钟禁用位，键盘被
|
||||
* 控制器级禁用且应用退出后仍不恢复（BUG-20260801-008）。
|
||||
* 复位/使能后的响应字节也必须全部读完（0xFF 返回 FA AA 00 共 3 字节），
|
||||
* 否则残留字节同样会污染后续配置字读写。
|
||||
* 序列与 desktop/main.c:ps2_mouse_init 保持一致。 */
|
||||
da_ps2_drain();
|
||||
for (int t = 0; t < 100000; t++) { if (!(inb(0x64) & 2)) break; }
|
||||
outb(0x64, 0xA8);
|
||||
for (int t = 0; t < 100000; t++) { if (!(inb(0x64) & 2)) break; }
|
||||
outb(0x64, 0x20);
|
||||
for (int t = 0; t < 100000; t++) { if (inb(0x64) & 1) break; }
|
||||
u8 cfg = inb(0x60);
|
||||
cfg |= 0x02; cfg &= ~0x20;
|
||||
cfg &= ~0x20; cfg |= 0x02; cfg |= 0x40; /* AUX 时钟启用 + AUX IRQ + 键盘翻译(集1, 与 desktop 一致) */
|
||||
for (int t = 0; t < 100000; t++) { if (!(inb(0x64) & 2)) break; }
|
||||
outb(0x64, 0x60);
|
||||
for (int t = 0; t < 100000; t++) { if (!(inb(0x64) & 2)) break; }
|
||||
@@ -274,21 +290,33 @@ static inline void da_mouse_init(void) {
|
||||
outb(0x64, 0xD4);
|
||||
for (int t = 0; t < 100000; t++) { if (!(inb(0x64) & 2)) break; }
|
||||
outb(0x60, 0xFF);
|
||||
for (int t = 0; t < 100000; t++) { if (inb(0x64) & 1) break; }
|
||||
inb(0x60);
|
||||
for (int i = 0; i < 8; i++) { /* 读完复位全部响应(FA AA 00) */
|
||||
int got = 0;
|
||||
for (int t = 0; t < 100000; t++) { if (inb(0x64) & 1) { got = 1; break; } }
|
||||
if (!got) break;
|
||||
inb(0x60);
|
||||
}
|
||||
for (int t = 0; t < 100000; t++) { if (!(inb(0x64) & 2)) break; }
|
||||
outb(0x64, 0xD4);
|
||||
for (int t = 0; t < 100000; t++) { if (!(inb(0x64) & 2)) break; }
|
||||
outb(0x60, 0xF4);
|
||||
for (int t = 0; t < 100000; t++) { if (inb(0x64) & 1) break; }
|
||||
inb(0x60);
|
||||
for (int i = 0; i < 4; i++) { /* 读完使能 ACK */
|
||||
int got = 0;
|
||||
for (int t = 0; t < 100000; t++) { if (inb(0x64) & 1) { got = 1; break; } }
|
||||
if (!got) break;
|
||||
inb(0x60);
|
||||
}
|
||||
da_ps2_drain();
|
||||
}
|
||||
|
||||
static inline int da_mouse_poll(da_mouse *m, da_cursor *c, i64 fb_w, i64 fb_h) {
|
||||
u8 st = inb(0x64);
|
||||
if (!(st & 1)) return 0;
|
||||
u8 data = inb(0x60);
|
||||
/* 必须先查 AUX 位(bit5)再读数据端口：键盘字节(st&0x20)==0 属于键盘路径，
|
||||
* 此处若先 inb(0x60) 会把键盘扫描码吞掉（BUG-20260801-003）。
|
||||
* 与 desktop/main.c:ps2_mouse_poll 顺序保持一致。 */
|
||||
if (!(st & 0x20)) return 0;
|
||||
u8 data = inb(0x60);
|
||||
m->buf[m->idx++] = data;
|
||||
if (m->idx < 3) return 0;
|
||||
m->idx = 0;
|
||||
|
||||
Binary file not shown.
Binary file not shown.
+140
-26
@@ -128,7 +128,11 @@ def build_pe32_plus():
|
||||
code_rva = 0x1000 # .text RVA
|
||||
main_rva = code_rva
|
||||
printf_iat_rva = code_rva + 0x200 # IAT 在 .text 后（同一 section 内，简化）
|
||||
exitproc_iat_rva = printf_iat_rva + 8
|
||||
# 注意：每个 import descriptor 的 thunk 数组必须 NULL 终止。
|
||||
# printf thunk 占 0x200..0x207，0x208..0x20F 为 NULL 终止符，
|
||||
# ExitProcess thunk 放 0x210（此前放 0x208 导致 desc0 的 thunk 数组
|
||||
# 无 NULL 终止、加载器把 ExitProcess 误配到 msvcrt.dll）。
|
||||
exitproc_iat_rva = printf_iat_rva + 16
|
||||
|
||||
# 修正 lea rcx, [rip + msg]: msg 在 code[19] 之后（lea 7字节 + call 6 + xor 2 + call 6 + ret 1 = 22）
|
||||
msg_offset_in_code = 22
|
||||
@@ -140,30 +144,41 @@ def build_pe32_plus():
|
||||
struct.pack_into('<i', code, 3, 15)
|
||||
# 修正 call [rip + printf_iat]: printf IAT 在 printf_iat_rva, call 后下一指令 RIP = main_rva + 13
|
||||
# disp32 = printf_iat_rva - (main_rva + 13) = 0x200 - 13 = 499
|
||||
struct.pack_into('<i', code, 10, 0x200 - 13)
|
||||
# 注意：call 指令在 code[7..12]（FF 15 + disp32），disp32 位于偏移 9；
|
||||
# 此前误写偏移 10 → disp 变为 0x1F300 且覆盖 xor ecx,ecx 的 0x31 → 三重故障。
|
||||
struct.pack_into('<i', code, 9, (printf_iat_rva - code_rva) - 13)
|
||||
# 修正 call [rip + exitproc]: ExitProcess IAT 在 exitproc_iat_rva, call 后下一指令 RIP = main_rva + 21
|
||||
# disp32 = exitproc_iat_rva - (main_rva + 21) = 0x208 - 21 = 491
|
||||
struct.pack_into('<i', code, 17, 0x208 - 21)
|
||||
# disp32 = exitproc_iat_rva - (main_rva + 21)
|
||||
struct.pack_into('<i', code, 17, (exitproc_iat_rva - code_rva) - 21)
|
||||
|
||||
# IAT 8字节对齐填充
|
||||
while len(code) < 0x200:
|
||||
code += b'\x00'
|
||||
# IAT 内容（指向 import 函数名 RVA）
|
||||
# 注意：以下 RVA 都必须带 code_rva(0x1000) 偏置——此前写成裸缓冲区偏移
|
||||
# (0x300/0x320/0x350/0x360/0x400)，导致 import 数据目录指向 headers 区、
|
||||
# rva_to_offset 解析失败、IAT 永远不被 shim 修补，call [IAT] 跳到 0x300
|
||||
# → #PF → DSK 阶段异常无法投递 → 三重故障（QEMU -d int 实测定案）。
|
||||
printf_name_rva = code_rva + 0x300 # 0x1300
|
||||
exitproc_name_rva = code_rva + 0x320 # 0x1320
|
||||
msvcrt_dll_rva = code_rva + 0x350 # 0x1350
|
||||
kernel32_dll_rva = code_rva + 0x360 # 0x1360
|
||||
import_desc_rva = code_rva + 0x400 # 0x1400
|
||||
|
||||
# IAT 内容（指向 import 函数名 RVA），每个 descriptor 的 thunk 数组 NULL 终止
|
||||
iat_data = bytearray()
|
||||
iat_data += struct.pack('<Q', 0x300) # printf function name RVA (hint+name 表)
|
||||
iat_data += struct.pack('<Q', 0x320) # ExitProcess function name RVA
|
||||
iat_data += struct.pack('<Q', printf_name_rva) # printf function name RVA (hint+name 表)
|
||||
iat_data += struct.pack('<Q', 0) # desc0 thunk 数组 NULL 终止
|
||||
iat_data += struct.pack('<Q', exitproc_name_rva) # ExitProcess function name RVA
|
||||
iat_data += struct.pack('<Q', 0) # desc1 thunk 数组 NULL 终止
|
||||
code += iat_data
|
||||
|
||||
# Import descriptor 数据
|
||||
import_desc_rva = 0x400 # 在 IAT 后
|
||||
# Import descriptor 数据（在 IAT 后）
|
||||
while len(code) < 0x300:
|
||||
code += b'\x00'
|
||||
|
||||
# Hint/Name 表
|
||||
# "msvcrt.dll\0" + printf name "printf\0"
|
||||
# "kernel32.dll\0" + ExitProcess name "ExitProcess\0"
|
||||
printf_name_rva = 0x300
|
||||
exitproc_name_rva = 0x320
|
||||
printf_hint_name = struct.pack('<H', 0) + b'printf\0' # hint=0
|
||||
exitproc_hint_name = struct.pack('<H', 0) + b'ExitProcess\0'
|
||||
while len(code) < printf_name_rva - code_rva:
|
||||
@@ -174,8 +189,6 @@ def build_pe32_plus():
|
||||
code += exitproc_hint_name
|
||||
|
||||
# DLL 名（放在 import descriptor 之后）
|
||||
msvcrt_dll_rva = 0x350
|
||||
kernel32_dll_rva = 0x360
|
||||
while len(code) < msvcrt_dll_rva - code_rva:
|
||||
code += b'\x00'
|
||||
code += b'msvcrt.dll\0'
|
||||
@@ -324,7 +337,11 @@ def build_pe32():
|
||||
code_rva = 0x1000
|
||||
main_rva = code_rva
|
||||
printf_iat_rva = code_rva + 0x200 # 0x1200
|
||||
exitproc_iat_rva = printf_iat_rva + 4 # 0x1204 (4-byte thunk)
|
||||
# 注意：每个 import descriptor 的 thunk 数组必须 NULL 终止。
|
||||
# printf thunk 占 0x1200，0x1204 为 NULL 终止符，ExitProcess thunk 放 0x1208
|
||||
# （此前放 0x1204 导致 desc0 thunk 数组无 NULL 终止，
|
||||
# 加载器把 ExitProcess 误配到 msvcrt.dll → "[PE32] unimplemented import"）。
|
||||
exitproc_iat_rva = printf_iat_rva + 8 # 0x1208 (4-byte thunk + NULL 间隔)
|
||||
printf_name_rva = 0x1300
|
||||
exitproc_name_rva = 0x1320
|
||||
msvcrt_dll_rva = 0x1350
|
||||
@@ -348,9 +365,11 @@ def build_pe32():
|
||||
# 对齐到 IAT (0x200)
|
||||
while len(code) < 0x200:
|
||||
code += b'\x00'
|
||||
# IAT (4-byte thunks，初始值 = hint/name RVA)
|
||||
# IAT (4-byte thunks，初始值 = hint/name RVA)，每个 descriptor 的 thunk 数组 NULL 终止
|
||||
code += struct.pack('<I', printf_name_rva)
|
||||
code += struct.pack('<I', 0) # desc0 thunk 数组 NULL 终止
|
||||
code += struct.pack('<I', exitproc_name_rva)
|
||||
code += struct.pack('<I', 0) # desc1 thunk 数组 NULL 终止
|
||||
|
||||
# 对齐到 hint/name 表 (0x300)
|
||||
while len(code) < printf_name_rva - code_rva:
|
||||
@@ -494,23 +513,31 @@ def build_cmd_exe():
|
||||
code_rva = 0x1000
|
||||
main_rva = code_rva
|
||||
printf_iat_rva = code_rva + 0x200
|
||||
exitproc_iat_rva = printf_iat_rva + 8
|
||||
# 同 build_pe32_plus：thunk 数组 NULL 终止，ExitProcess thunk 放 0x210
|
||||
exitproc_iat_rva = printf_iat_rva + 16
|
||||
|
||||
msg_offset_in_code = 22
|
||||
struct.pack_into('<i', code, 3, 15)
|
||||
struct.pack_into('<i', code, 10, 0x200 - 13)
|
||||
struct.pack_into('<i', code, 17, 0x208 - 21)
|
||||
# call#1 disp32 位于偏移 9（同 build_pe32_plus 的偏移修正说明）
|
||||
struct.pack_into('<i', code, 9, (printf_iat_rva - code_rva) - 13)
|
||||
struct.pack_into('<i', code, 17, (exitproc_iat_rva - code_rva) - 21)
|
||||
|
||||
# 同 build_pe32_plus 修复：RVA 必须带 code_rva(0x1000) 偏置
|
||||
printf_name_rva = code_rva + 0x300 # 0x1300
|
||||
exitproc_name_rva = code_rva + 0x320 # 0x1320
|
||||
msvcrt_dll_rva = code_rva + 0x350 # 0x1350
|
||||
kernel32_dll_rva = code_rva + 0x360 # 0x1360
|
||||
import_desc_rva = code_rva + 0x400 # 0x1400
|
||||
|
||||
while len(code) < 0x200:
|
||||
code += b'\x00'
|
||||
code += struct.pack('<Q', 0x300)
|
||||
code += struct.pack('<Q', 0x320)
|
||||
code += struct.pack('<Q', printf_name_rva)
|
||||
code += struct.pack('<Q', 0) # desc0 thunk 数组 NULL 终止
|
||||
code += struct.pack('<Q', exitproc_name_rva)
|
||||
code += struct.pack('<Q', 0) # desc1 thunk 数组 NULL 终止
|
||||
|
||||
import_desc_rva = 0x400
|
||||
while len(code) < 0x300:
|
||||
code += b'\x00'
|
||||
printf_name_rva = 0x300
|
||||
exitproc_name_rva = 0x320
|
||||
printf_hint_name = struct.pack('<H', 0) + b'printf\0'
|
||||
exitproc_hint_name = struct.pack('<H', 0) + b'ExitProcess\0'
|
||||
while len(code) < printf_name_rva - code_rva:
|
||||
@@ -520,8 +547,6 @@ def build_cmd_exe():
|
||||
code += b'\x00'
|
||||
code += exitproc_hint_name
|
||||
|
||||
msvcrt_dll_rva = 0x350
|
||||
kernel32_dll_rva = 0x360
|
||||
while len(code) < msvcrt_dll_rva - code_rva:
|
||||
code += b'\x00'
|
||||
code += b'msvcrt.dll\0'
|
||||
@@ -602,6 +627,89 @@ def build_cmd_exe():
|
||||
return bytes(headers) + bytes(code)
|
||||
|
||||
|
||||
def build_fault64():
|
||||
"""构造 fault64.exe — PE32+ 故意 #PF 验收样本（BUG-20260801-005）。
|
||||
|
||||
用途: 验证 DSK 诊断 IDT 的异常投递。机器码:
|
||||
movabs rax, 0x400000000000 ; 48 B8 <8B>
|
||||
mov dword [rax], 1 ; C7 00 01 00 00 00
|
||||
jmp $ ; EB FE (兜底:万一未 fault 原地死循环)
|
||||
0x400000000000 是低位规范地址(bit47=0)且远超任何已映射区,
|
||||
写入必然 #PF(err=0x2, supervisor write non-present, cr2=0x400000000000)。
|
||||
预期串口: "[IDT] exception" + vector=0xe + cr2=0x0000400000000000。
|
||||
无导入表(pe_loader 对空 import directory 直接跳过)。
|
||||
"""
|
||||
image_base = 0x140000000
|
||||
section_align = 0x1000
|
||||
file_align = 0x200
|
||||
|
||||
dos_header = bytearray(64)
|
||||
struct.pack_into('<H', dos_header, 0, IMAGE_DOS_SIGNATURE)
|
||||
struct.pack_into('<I', dos_header, 60, 64)
|
||||
|
||||
pe_sig = struct.pack('<I', IMAGE_NT_SIGNATURE)
|
||||
|
||||
coff_header = struct.pack('<HHIIIHH',
|
||||
IMAGE_FILE_MACHINE_AMD64,
|
||||
1, 0, 0, 0, 240,
|
||||
IMAGE_FILE_MACHINE_AMD64_CHARACTERISTICS)
|
||||
|
||||
code = bytearray()
|
||||
code += b'\x48\xB8' + struct.pack('<Q', 0x400000000000) # movabs rax, 0x400000000000
|
||||
code += b'\xC7\x00' + struct.pack('<I', 1) # mov dword [rax], 1
|
||||
code += b'\xEB\xFE' # jmp $
|
||||
|
||||
while len(code) % file_align != 0:
|
||||
code += b'\x00'
|
||||
|
||||
code_rva = 0x1000
|
||||
main_rva = code_rva
|
||||
size_of_code = len(code)
|
||||
size_of_image = code_rva + size_of_code
|
||||
while size_of_image % section_align != 0:
|
||||
size_of_image += 1
|
||||
|
||||
opt_header = bytearray(240)
|
||||
struct.pack_into('<H', opt_header, 0, 0x20b) # Magic = PE32+
|
||||
struct.pack_into('<I', opt_header, 4, size_of_code) # SizeOfCode
|
||||
struct.pack_into('<I', opt_header, 16, main_rva) # AddressOfEntryPoint
|
||||
struct.pack_into('<I', opt_header, 20, code_rva) # BaseOfCode
|
||||
struct.pack_into('<Q', opt_header, 24, image_base) # ImageBase
|
||||
struct.pack_into('<I', opt_header, 32, section_align)
|
||||
struct.pack_into('<I', opt_header, 36, file_align)
|
||||
struct.pack_into('<H', opt_header, 40, 6) # MajorOperatingSystemVersion
|
||||
struct.pack_into('<H', opt_header, 48, 6) # MajorSubsystemVersion
|
||||
struct.pack_into('<I', opt_header, 56, size_of_image)
|
||||
struct.pack_into('<I', opt_header, 60, 0x200) # SizeOfHeaders
|
||||
struct.pack_into('<H', opt_header, 68, IMAGE_SUBSYSTEM_WINDOWS_CUI)
|
||||
struct.pack_into('<Q', opt_header, 72, 0x100000) # SizeOfStackReserve
|
||||
struct.pack_into('<Q', opt_header, 80, 0x1000) # SizeOfStackCommit
|
||||
struct.pack_into('<Q', opt_header, 88, 0x100000) # SizeOfHeapReserve
|
||||
struct.pack_into('<Q', opt_header, 96, 0x1000) # SizeOfHeapCommit
|
||||
struct.pack_into('<I', opt_header, 108, 16) # NumberOfRvaAndSizes
|
||||
# DataDirectory 全 0（无导入表）
|
||||
|
||||
section_header = bytearray(40)
|
||||
section_header[0:8] = b'.text\0\0\0'
|
||||
struct.pack_into('<I', section_header, 8, size_of_code)
|
||||
struct.pack_into('<I', section_header, 12, code_rva)
|
||||
struct.pack_into('<I', section_header, 16, size_of_code)
|
||||
struct.pack_into('<I', section_header, 20, file_align)
|
||||
struct.pack_into('<I', section_header, 36,
|
||||
IMAGE_SCN_CNT_CODE | IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_MEM_READ)
|
||||
|
||||
headers = bytearray()
|
||||
headers += dos_header
|
||||
headers += pe_sig
|
||||
headers += coff_header
|
||||
headers += opt_header
|
||||
headers += section_header
|
||||
while len(headers) % file_align != 0:
|
||||
headers += b'\x00'
|
||||
|
||||
return bytes(headers) + bytes(code)
|
||||
|
||||
|
||||
def main():
|
||||
out_dir = os.path.dirname(os.path.abspath(__file__))
|
||||
|
||||
@@ -623,7 +731,13 @@ def main():
|
||||
f.write(cmd_exe)
|
||||
print(f"[gen] Generated cmd.exe: {out_path} ({len(cmd_exe)} bytes)")
|
||||
|
||||
print("[gen] 完成。复制到 SYSTEM/system/deshab64/tools/ 并重新运行 build.bat")
|
||||
fault64 = build_fault64()
|
||||
out_path = os.path.join(out_dir, 'fault64.exe')
|
||||
with open(out_path, 'wb') as f:
|
||||
f.write(fault64)
|
||||
print(f"[gen] Generated fault64.exe: {out_path} ({len(fault64)} bytes)")
|
||||
|
||||
print("[gen] 完成。复制到 SYSTEM/bin/ 并重新运行 build.bat")
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
|
||||
Binary file not shown.
Binary file not shown.
Reference in New Issue
Block a user