MIT_6.828_Lab_3: User Environments Part A

项目地址：Lab 3

Environment State

在文件inc/env.h文件中，定义了环境(进程)结构体：

struct Env {
	struct Trapframe env_tf;	// Saved registers
	struct Env *env_link;		// Next free Env
	envid_t env_id;			// Unique environment identifier
	envid_t env_parent_id;		// env_id of this env's parent
	enum EnvType env_type;		// Indicates special system environments
	unsigned env_status;		// Status of the environment
	uint32_t env_runs;		// Number of times environment has run

	// Address space
	pde_t *env_pgdir;		// Kernel virtual address of page dir
};

不同于xv6,JOS里面的每个环境都有自己的页目录，内核也有自己的页目录。

Allocating the Environments Array

Exercise 1. Modify mem_init() in kern/pmap.c to allocate and map the envs array. This array consists of exactly NENV instances of the Env structure allocated much like how you allocated the pages array. Also like the pages array, the memory backing envs should also be mapped user read-only at UENVS (defined in inc/memlayout.h) so user processes can read from this array.
You should run your code and make sure check_kern_pgdir() succeeds.

有了Lab 2的积累之后，做这道题会轻松很多。
首先在内核空间里面声明env数组：

	//
	// Make 'envs' point to an array of size 'NENV' of 'struct Env'.
	// LAB 3: Your code here.
	envs = (struct Env*)boot_alloc(sizeof(struct Env)*NENV);
	memset(envs,0,sizeof(struct Env)*NENV);

接着对其进行映射即可：

	// LAB 3: Your code here.
	boot_map_region(kern_pgdir,
					UENVS,
					PTSIZE,
					PADDR(envs),
					PTE_U);

之后进行make;make qemu，如果从Lab 2继承下来，会出现kernel panic at kern/pmap.c:152: PADDR called with invalid kva 00000000的错误！
究其原因，链接器提供的end变量并没有指向数据区域的最后，而是指向数据区域内。

错误分析

使用objdump -h obj/kern/kernel,得到如下信息：

Sections:
Idx Name          Size      VMA       LMA       File off  Algn
  0 .text         00005379  f0100000  00100000  00001000  2**4
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
  1 .rodata       000016b0  f0105380  00105380  00006380  2**5
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  2 .stab         000088c9  f0106a30  00106a30  00007a30  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  3 .stabstr      00002a60  f010f2f9  0010f2f9  000102f9  2**0
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  4 .data         0007a014  f0112000  00112000  00013000  2**12
                  CONTENTS, ALLOC, LOAD, DATA
  5 .got          0000000c  f018c014  0018c014  0008d014  2**2
                  CONTENTS, ALLOC, LOAD, DATA
  6 .got.plt      0000000c  f018c020  0018c020  0008d020  2**2
                  CONTENTS, ALLOC, LOAD, DATA
  7 .data.rel.local 0000100e  f018d000  0018d000  0008e000  2**12
                  CONTENTS, ALLOC, LOAD, DATA
  8 .data.rel.ro.local 000000cc  f018e020  0018e020  0008f020  2**5
                  CONTENTS, ALLOC, LOAD, DATA
  9 .bss          00000f14  f018e100  0018e100  0008f100  2**5
                  CONTENTS, ALLOC, LOAD, DATA
 10 .comment      0000002b  00000000  00000000  00090014  2**0
                  CONTENTS, READONLY

可以看出.bss段的范围为：0xf018e100-0xf018f014,大小为0xf14。将end变量输出，得到：end=0xf018f000。可以看到end在数据段之间。

解决办法

修改链接脚本kern/kernel.ld:

	.bss : {
		PROVIDE(edata = .);
		*(.bss)
		*(COMMON) 
		PROVIDE(end = .);
		BYTE(0)
	}

将COMMON添加在end之前即可。
参考链接：MIT 6.828 labs walkthroughs

Creating and Running Environments

Exercise 2. In the file env.c, finish coding the following functions:

env_init()
Initialize all of the Env structures in the envs array and add them to the env_free_list. Also calls env_init_percpu, which configures the segmentation hardware with separate segments for privilege level 0 (kernel) and privilege level 3 (user).
env_setup_vm()
Allocate a page directory for a new environment and initialize the kernel portion of the new environment’s address space.
region_alloc()
Allocates and maps physical memory for an environment
load_icode()
You will need to parse an ELF binary image, much like the boot loader already does, and load its contents into the user address space of a new environment.
env_create()
Allocate an environment with env_alloc and call load_icode to load an ELF binary into it.
env_run()
Start a given environment running in user mode.
As you write these functions, you might find the new cprintf verb %e useful – it prints a description corresponding to an error code. For example,

r = -E_NO_MEM;
panic("env_alloc: %e", r);

will panic with the message “env_alloc: out of memory”.

参考了别人的做法后，现在依次给出实现。

env_init()

	// LAB 3: Your code here.
    env_free_list = NULL;
    for (int i = NENV - 1; i >= 0; i--) {   //前插法构建链表
        envs[i].env_id = 0;
        envs[i].env_link = env_free_list;
        env_free_list = &envs[i];
    }

对环境数组进行初始化，这个不复杂。

env_setup_vm()

设置用户的页表，进行虚拟内存的内存的设置。

	 // LAB 3: Your code here.
    p->pp_ref++;
    e->env_pgdir = (pde_t *) page2kva(p);  //刚分配的物理页作为页目录使用
    memcpy(e->env_pgdir, kern_pgdir, PGSIZE); //继承内核页目录

每个环境（进程）的内核部分映射应该是相同的，所以直接将内核的页表复制过来就行了。刚开始我还试图模仿pmap.c里面的实现一项一项地映射，但发现那样实在是事倍功半。

region_alloc()

	void *start=ROUNDDOWN(va,PGSIZE),*end=ROUNDUP(va+len,PGSIZE);
	for (void * addr=start;addr<end;addr+=PGSIZE){
		struct PageInfo* p=page_alloc(0);
		if(p==NULL){
			panic("region alloc failed: No more page to be allocated.\n");
		}
		else {
			if(page_insert(e->env_pgdir,p,addr, PTE_U | PTE_W)==-E_NO_MEM){
				panic("region alloc failed: page table couldn't be allocated.\n");
			}
		}
	}

load_icode()

	// LAB 3: Your code here.
    struct Elf *ELFHDR = (struct Elf *) binary;
    struct Proghdr *ph;             //Program Header
    int ph_num;                     //Program entry number
    if (ELFHDR->e_magic != ELF_MAGIC) {
        panic("binary is not ELF format\n");
    }
    ph = (struct Proghdr *) ((uint8_t *) ELFHDR + ELFHDR->e_phoff);
    ph_num = ELFHDR->e_phnum;

    lcr3(PADDR(e->env_pgdir));          //这步别忘了，虽然到目前位置e->env_pgdir和kern_pgdir除了PDX(UVPT)这一项不同，其他都一样。
                                        //但是后面会给e->env_pgdir增加映射关系

    for (int i = 0; i < ph_num; i++) {
        if (ph[i].p_type == ELF_PROG_LOAD) {        //只加载LOAD类型的Segment
            region_alloc(e, (void *)ph[i].p_va, ph[i].p_memsz);
            memset((void *)ph[i].p_va, 0, ph[i].p_memsz);       //因为这里需要访问刚分配的内存，所以之前需要切换页目录
            memcpy((void *)ph[i].p_va, binary + ph[i].p_offset, ph[i].p_filesz); //应该有如下关系：ph->p_filesz <= ph->p_memsz。搜索BSS段
        }
    }

    lcr3(PADDR(kern_pgdir));
    e->env_tf.tf_eip = ELFHDR->e_entry;

	// Now map one page for the program's initial stack
	// at virtual address USTACKTOP - PGSIZE.
	// LAB 3: Your code here.
	region_alloc(e,(void*)(USTACKTOP - PGSIZE),PGSIZE);

env_create()

	struct Env * e;
	int r=env_alloc(&e,0);
	if(r!=0){
		cprintf("%e\n",r);
		panic("env_create:error");
	}
	load_icode(e,binary);
	e->env_type=type;

env_run()

	// LAB 3: Your code here.  
	if (e->env_status == ENV_RUNNING)
	{
		e->env_status = ENV_RUNNABLE;	
	}
	curenv = e;
	e->env_status = ENV_RUNNING;
	e->env_runs ++;
	lcr3(PADDR(e->env_pgdir));

	env_pop_tf(&(e->env_tf));
	//panic("env_run not yet implemented");

make;make qemu之后出现：

Triple fault.  Halting for inspection via QEMU monitor.

即正确。因为此时还未设置中断向量表，所以会出现上述的信息。使用gdb进行调试：

(gdb) b env_pop_tf
Breakpoint 1 at 0xf0103a1f: file kern/env.c, line 558.
(gdb) c
Continuing.
The target architecture is assumed to be i386
=> 0xf0103a1f <env_pop_tf>:	push   %ebp

Breakpoint 1, env_pop_tf (tf=0xf01d1000) at kern/env.c:558
558	{
(gdb) 

设置断点 ，进入函数env_pop_tf.

=> 0xf0103a2b <env_pop_tf+12>:	add    $0x885f5,%ebx
0xf0103a2b	558	{
(gdb) 
=> 0xf0103a31 <env_pop_tf+18>:	mov    0x8(%ebp),%esp
559		asm volatile(
(gdb) 
=> 0xf0103a34 <env_pop_tf+21>:	popa   
0xf0103a34	559		asm volatile(
(gdb) 
=> 0xf0103a35 <env_pop_tf+22>:	pop    %es
0xf0103a35 in env_pop_tf (
    tf=<error reading variable: Unknown argument list address for `tf'.>)
    at kern/env.c:559
559		asm volatile(
(gdb) 
=> 0xf0103a36 <env_pop_tf+23>:	pop    %ds
0xf0103a36	559		asm volatile(
(gdb) 
=> 0xf0103a37 <env_pop_tf+24>:	add    $0x8,%esp
0xf0103a37	559		asm volatile(
(gdb) 
=> 0xf0103a3a <env_pop_tf+27>:	iret   
0xf0103a3a	559		asm volatile(
(gdb) 

一直执行到iret语句。查看此时的寄存器：

eax            0x0	0
ecx            0x0	0
edx            0x0	0
ebx            0x0	0
esp            0xf01d1030	0xf01d1030
ebp            0x0	0x0
esi            0x0	0
edi            0x0	0
eip            0xf0103a3a	0xf0103a3a <env_pop_tf+27>
eflags         0x96	[ PF AF SF ]
cs             0x8	8
ss             0x10	16
ds             0x23	35
es             0x23	35
fs             0x23	35
gs             0x23	35

单步执行后iret后：

(gdb) si
=> 0x800020:	cmp    $0xeebfe000,%esp
0x00800020 in ?? ()
(gdb) 

进入到hello程序里面。

查看此时的寄存器值：

eax            0x0	0
ecx            0x0	0
edx            0x0	0
ebx            0x0	0
esp            0xeebfe000	0xeebfe000
ebp            0x0	0x0
esi            0x0	0
edi            0x0	0
eip            0x800020	0x800020
eflags         0x2	[ ]
cs             0x1b	27
ss             0x23	35
ds             0x23	35
es             0x23	35
fs             0x23	35
gs             0x23	35

此时的cs为GD_UT | 0X3 = 0x1b,也即此时进入用户态执行程序。esp为USTACKTOP这个值。

查看obj/user/hello.asm:

  800b7c:	cd 30                	int    $0x30

可以看到此处有中断语句。设置断点在此处：

(gdb) b *0x800b7c
Breakpoint 1 at 0x800b7c
(gdb) c
Continuing.
The target architecture is assumed to be i386
=> 0x800b7c:	int    $0x30

Breakpoint 1, 0x00800b7c in ?? ()
(gdb) si
=> 0x800b7c:	int    $0x30

Breakpoint 1, 0x00800b7c in ?? ()
(gdb) 
=> 0x800b7c:	int    $0x30

Breakpoint 1, 0x00800b7c in ?? ()
(gdb) 
=> 0x800b7c:	int    $0x30

Breakpoint 1, 0x00800b7c in ?? ()
(gdb) 

由于此时没有建立中断向量表，所以一直会执行int $0x30这条指令。

Handling Interrupts and Exceptions

Exercise 4. Edit trapentry.S and trap.c and implement the features described above. The macros TRAPHANDLER and TRAPHANDLER_NOEC in trapentry.S should help you, as well as the T_ defines in inc/trap.h. You will need to add an entry point in trapentry.S (using those macros) for each trap defined in inc/trap.h, and you’ll have to provide _alltraps which the TRAPHANDLER macros refer to. You will also need to modify trap_init() to initialize the idt to point to each of these entry points defined in trapentry.S; the SETGATE macro will be helpful here.
Your _alltraps should:
push values to make the stack look like a struct Trapframe
load GD_KD into %ds and %es
pushl %esp to pass a pointer to the Trapframe as an argument to trap()
call trap (can trap ever return?)
Consider using the pushal instruction; it fits nicely with the layout of the struct Trapframe.
Test your trap handling code using some of the test programs in the user directory that cause exceptions before making any system calls, such as user/divzero. You should be able to get make grade to succeed on the divzero, softint, and badsegment tests at this point.*

首先，宏

#define TRAPHANDLER(name, num)						\
	.globl name;		/* define global symbol for 'name' */	\
	.type name, @function;	/* symbol type is function */		\
	.align 2;		/* align function definition */		\
	name:			/* function starts here */		\
	pushl $(num);							\
	jmp _alltraps

和宏

#define TRAPHANDLER_NOEC(name, num)					\
	.globl name;							\
	.type name, @function;						\
	.align 2;							\
	name:								\
	pushl $0;							\
	pushl $(num);							\
	jmp _alltraps

为我们定义了中断服务程序的入口形式。
根据Error Code Summary可以确定哪些中断号使用哪个宏。
我们可以写出下列内容：

TRAPHANDLER_NOEC(handler_divide,T_DIVIDE)
TRAPHANDLER_NOEC(handler_debug,T_DEBUG)
TRAPHANDLER_NOEC(handler_brkpt,T_BRKPT)
TRAPHANDLER_NOEC(handler_oflow,T_OFLOW)
TRAPHANDLER_NOEC(handler_bound,T_BOUND)
TRAPHANDLER_NOEC(handler_illop,T_ILLOP)
TRAPHANDLER_NOEC(handler_device,T_DEVICE)
TRAPHANDLER(handler_dblflt,T_DBLFLT)
TRAPHANDLER_NOEC(handler_tss,T_TSS)
TRAPHANDLER(handler_segnp,T_SEGNP)
TRAPHANDLER(handler_stack,T_STACK)
TRAPHANDLER(handler_gpflt,T_GPFLT)
TRAPHANDLER(handler_pgflt,T_PGFLT)
TRAPHANDLER_NOEC(handler_fperr,T_FPERR)
TRAPHANDLER_NOEC(handler_syscall,T_SYSCALL)

这里需要注意不要写错。

接着写_alltraps:

_alltraps:
	pushl %ds
	pushl %es
	pushal
	
	movw $GD_KD,%ax
	movw %ax,%ds
	movw %ax,%es
	pushl %esp
	call trap

最后，在kern/trap.c里面注册各个中断服务程序：

void
trap_init(void)
{
	extern struct Segdesc gdt[];

	// LAB 3: Your code here.
	void handler_divide();
	void handler_debug();
	void handler_brkpt();
	void handler_oflow();
	void handler_bound();
	void handler_illop();
	void handler_device();
	void handler_dblflt();
	void handler_tss();
	void handler_segnp();
	void handler_stack();
	void handler_gpflt();
	void handler_pgflt();
	void handler_fperr();
	void handler_syscall();
	
	SETGATE(idt[T_DIVIDE],0,GD_KT,handler_divide,0);
	SETGATE(idt[T_DEBUG],0,GD_KT,handler_debug,0);
	SETGATE(idt[T_BRKPT],0,GD_KT,handler_brkpt,0);
	SETGATE(idt[T_OFLOW],0,GD_KT,handler_oflow,0);
	SETGATE(idt[T_BOUND],0,GD_KT,handler_bound,0);
	SETGATE(idt[T_ILLOP],0,GD_KT,handler_illop,0);
	SETGATE(idt[T_DEVICE],0,GD_KT,handler_device,0);
	SETGATE(idt[T_DBLFLT],0,GD_KT,handler_dblflt,0);
	SETGATE(idt[T_TSS],0,GD_KT,handler_tss,0);
	SETGATE(idt[T_SEGNP],0,GD_KT,handler_segnp,0);
	SETGATE(idt[T_STACK],0,GD_KT,handler_stack,0);
	SETGATE	(idt[T_GPFLT],0,GD_KT,handler_gpflt,0);
	SETGATE(idt[T_PGFLT],0,GD_KT,handler_pgflt,0);
	SETGATE(idt[T_FPERR],0,GD_KT,handler_fperr,0);
	SETGATE(idt[T_SYSCALL],0,GD_KT,handler_syscall,3);

	// Per-CPU setup 
	trap_init_percpu();
}

使用make grade,可以查看分数：

divzero: OK (1.0s) 
softint: OK (0.9s) 
badsegment: OK (1.1s) 
Part A score: 30/30

至此Part A完成。

END.