MIT 6.S081 (BOOK-RISCV-REV1)教材第四章内容 --Trap -- 上

//kernel/vm.c

// Load the user initcode into address 0 of pagetable,
// for the very first process.
// sz must be less than a page.
// 将initcode程序的代码加载到0号进程用户态页表的0地址处
void
uvminit(pagetable_t pagetable, uchar *src, uint sz)
{
  char *mem;

  if(sz >= PGSIZE)
    panic("inituvm: more than a page");
  //分配物理页,并初始化该物理页
  mem = kalloc();
  memset(mem, 0, PGSIZE);
  // 虚拟地址0~PGSIZE 与 上面分配的物理页地址建立映射关系
  mappages(pagetable, 0, PGSIZE, (uint64)mem, PTE_W|PTE_R|PTE_X|PTE_U);
  // 将initcode代码数据从内核空间拷贝到用户空间 ---> 因为此时这个物理页是映射到了0号用户态进程的,因此可以这样理解
  memmove(mem, src, sz);
}

// Per-CPU process scheduler.
// Each CPU calls scheduler() after setting itself up.
// 每个CPU都会在初始化工作完成后,调用scheduler开始任务调度执行
// Scheduler never returns.  It loops, doing:
//  - choose a process to run.
//  - swtch to start running that process.
//  - eventually that process transfers control
//    via swtch back to the scheduler.
void scheduler(void)
{
  struct proc *p;
  // 获取当前hart
  struct cpu *c = mycpu();
  // 清空当前hart正在运行的进程信息
  c->proc = 0;
  for (;;)
  {
    // Avoid deadlock by ensuring that devices can interrupt.
    // 设置sstatus寄存器的SIE为1,即打开S态下的全局中断
    intr_on();
    // 寻找下一个需要被调度的进程
    int found = 0;
    for (p = proc; p < &proc[NPROC]; p++)
    {
      acquire(&p->lock);
      // 简单遍历proc数组,找到第一个处于RUNNABLE状态的进程
      // RUNNABLE在xv6中表示可调度运行状态
      if (p->state == RUNNABLE)
      {
        // Switch to chosen process.  It is the process's job
        // to release its lock and then reacquire it
        // before jumping back to us.
        // 设置当前进程的状态为RUNNABLE ——> 运行态
        p->state = RUNNING;
        // 将该进程与当前hart绑定
        c->proc = p;

         // 页表实验中我们新增的代码: 更新SATP指向当前进程的内核页表
        // Store the kernal page table into the SATP
        proc_inithart(p->kernelpt);
        
        // 具体切换执行的函数---cpu中的context用于保存当前寄存器上下文环境
        // proc中的context用于恢复其保存的寄存器上下文环境
        swtch(&c->context, &p->context);

        // Come back to the global kernel page table
        // 当CPU空闲时,恢复stap指向全局的内核页表---也是我们新增的代码
        kvminithart();

        // Process is done running for now.
        // It should have changed its p->state before coming back.
        // 解决绑定关系
        c->proc = 0;

        found = 1;
      }
      release(&p->lock);
    }
#if !defined(LAB_FS)
    if (found == 0)
    {
      intr_on();
      asm volatile("wfi");
    }
#else
    ;
#endif
  }
}

struct cpu cpus[NCPU];

// Saved registers for kernel context switches.
// 下面是一些需要在函数调用时,进行保存的寄存器
struct context {
  uint64 ra;
  uint64 sp;

  // callee-saved
  uint64 s0;
  uint64 s1;
  uint64 s2;
  uint64 s3;
  uint64 s4;
  uint64 s5;
  uint64 s6;
  uint64 s7;
  uint64 s8;
  uint64 s9;
  uint64 s10;
  uint64 s11;
};

// Per-CPU state.
struct cpu {
  // 当前hart上正在运行的进程
  struct proc *proc;          // The process running on this cpu, or null.
  // context用于存储需要在swtch函数进行任务切换过程中保存的寄存器
  struct context context;     // swtch() here to enter scheduler().
  int noff;                   // Depth of push_off() nesting.
  int intena;                 // Were interrupts enabled before push_off()?
};

// Must be called with interrupts disabled,
// to prevent race with process being moved
// to a different CPU.
// 获取tp寄存器中保存的当前硬件线程的hart id
int cpuid()
{
  int id = r_tp();
  return id;
}

// Return this CPU's cpu struct.
// Interrupts must be disabled.
struct cpu *
mycpu(void)
{
  int id = cpuid();
  // xv6中使用cpu[]数组保存所有cpu核--hart id作为数组索引
  struct cpu *c = &cpus[id];
  return c;
}

// Look in the process table for an UNUSED proc.
// If found, initialize state required to run in the kernel,
// and return with p->lock held.
// If there are no free procs, or a memory allocation fails, return 0.
static struct proc *
allocproc(void)
{
  struct proc *p;
  //遍历找到一个空位---如果找到了,说明当前创建的进程数量没有超过最大进程数的限制
  for (p = proc; p < &proc[NPROC]; p++)
  {
    acquire(&p->lock);
    if (p->state == UNUSED)
    {
      //跳到found标记处继续执行 
      goto found;
    }
    else
    {
      release(&p->lock);
    }
  }
  return 0;

found:
  // 分配pid
  p->pid = allocpid();

  // Allocate a trapframe page.
  // 为trapframe帧分配页面--->该帧是用于上下文切换时来保持当前寄存器环境上下文快照的
  if ((p->trapframe = (struct trapframe *)kalloc()) == 0)
  {
    release(&p->lock);
    return 0;
  }

  // An empty user page table.
  // 为进程的用户态页表分配一个新的空闲物理页--同时做好TRAMPOLINE和TRAMPOLINE的映射
  // TRAMPOLINE和TRAMPOLINE这两部分代码是上下文切换通用代码，所以会被映射到每个用户虚拟地址空间最高地址处
  p->pagetable = proc_pagetable(p);
  if (p->pagetable == 0)
  {
    freeproc(p);
    release(&p->lock);
    return 0;
  }

  //----------上一节页表实验中补充的代码-----------------
  // 为当前进程分配一个空的内核态根页表
  p->kernelpt = proc_kpt_init(p);
  if (p->pagetable == 0)
  {
    freeproc(p);
    release(&p->lock);
    return 0;
  }

  // Allocate a page for the process's kernel stack.
  // Map it high in memory, followed by an invalid
  // guard page.
  char *pa = kalloc();
  if (pa == 0)
    panic("kalloc");  
  uint64 va = KSTACK((int)(p - proc));
  // 当前进程的内核栈映射到当前进程的自己内核页表中
  uvmmap(p->kernelpt, va, (uint64)pa, PGSIZE, PTE_R | PTE_W);
  p->kstack = va;
  //-----------补充结束----------------------

  // Set up new context to start executing at forkret,
  // which returns to user space.
  // 清空当前进程的context
  memset(&p->context, 0, sizeof(p->context));
  //设置context的ra指向forkret函数地址
  p->context.ra = (uint64)forkret;
  //设置sp指向内核栈栈顶地址---内核栈只占据一个页面大小
  p->context.sp = p->kstack + PGSIZE;

  return p;
}

swtch(&c->context, &p->context);

//proc.c

// A fork child's very first scheduling by scheduler()
// will swtch to forkret.
void forkret(void)
{
  //静态的局部变量first
  //第一次执行该函数时进行初始化,在随后的forkret()调用中，'first'的值将跨越函数调用保持不变，不会重新初始化
  static int first = 1;

  // Still holding p->lock from scheduler.
  release(&myproc()->lock);

  if (first)
  {
    // File system initialization must be run in the context of a
    // regular process (e.g., because it calls sleep), and thus cannot
    // be run from main().
    first = 0;
    fsinit(ROOTDEV);
  }
  //执行从S态返回用户态的操作
  usertrapret();
}

//proc.c

//这三个外部全局遍历定义在trampoline.s中
extern char trampoline[], uservec[], userret[];

//
// return to user space
//
void
usertrapret(void)
{
  // 获取当前进程
  struct proc *p = myproc();

  // we're about to switch the destination of traps from
  // kerneltrap() to usertrap(), so turn off interrupts until
  // we're back in user space, where usertrap() is correct.
  //设置sstatus的值为0,以此来关闭S态下全局中断
  intr_off();

  // send syscalls, interrupts, and exceptions to trampoline.S
  // stvec更改为指向uservec
  w_stvec(TRAMPOLINE + (uservec - trampoline));

  // set up trapframe values that uservec will need when
  // the process next re-enters the kernel.
  //保存内核根页表的位置
  p->trapframe->kernel_satp = r_satp();         // kernel page table
  //保存当前进程的内核栈栈顶指针
  p->trapframe->kernel_sp = p->kstack + PGSIZE; // process's kernel stack
  // 用户态发生trap时会调用usertrap进行处理
  p->trapframe->kernel_trap = (uint64)usertrap;
  //保存hart id
  p->trapframe->kernel_hartid = r_tp();         // hartid for cpuid()

  // set up the registers that trampoline.S's sret will use
  // to get to user space.
  
  // set S Previous Privilege mode to User.
  unsigned long x = r_sstatus();
  //设置status的SPP位为0,这样sret指令执行后,会恢复到user特权下
  x &= ~SSTATUS_SPP; // clear SPP to 0 for user mode
  //设置status的SPIE位为1,这样sret指令执行后, 会重新打开全局中断 
  x |= SSTATUS_SPIE; // enable interrupts in user mode
  //重新设置sstatus寄存器的值
  w_sstatus(x);

  // set S Exception Program Counter to the saved user pc.
  //设置sepc指向trapframe中保存的epc,也就是我们先前设置好的程序的入口地址
  w_sepc(p->trapframe->epc);

  // tell trampoline.S the user page table to switch to.
  // 设置stap在sret执行后,指向进程的用户态根页表
  uint64 satp = MAKE_SATP(p->pagetable);

  // jump to trampoline.S at the top of memory, which 
  // switches to the user page table, restores user registers,
  // and switches to user mode with sret.
  // fn为userret函数的入口地址
  uint64 fn = TRAMPOLINE + (userret - trampoline);
  // TRAPFRAME帧用于在用户态和内核态切换时进行上下文的保存和恢复
  // 该帧在proc_pagetable初始化进程的用户态页表时分配物理页并在用户态页表建立映射
  // 其位置就在TRAMPOLINE帧下面
  // userret函数传入当前用户态上下文trapframe地址,和用户态的根页表
  ((void (*)(uint64,uint64))fn)(TRAPFRAME, satp);
}

//memlayout.h

// map the trampoline page to the highest address,
// in both user and kernel space.
// TRAMPOLINE被映射到的虚拟地址空间的地址--占据虚拟地址空间最高地址处的一个页面
#define TRAMPOLINE (MAXVA - PGSIZE)

// set up to take exceptions and traps while in the kernel.
void
trapinithart(void)
{
  //stvec指向kernelvec
  w_stvec((uint64)kernelvec);
}

.globl uservec
uservec:    
	#
        # trap.c sets stvec to point here, so
        # traps from user space start here,
        # in supervisor mode, but with a
        # user page table.
        #
        # sscratch points to where the process's p->trapframe is
        # mapped into user space, at TRAPFRAME.
        #
        
	# swap a0 and sscratch
        # so that a0 is TRAPFRAME
        # 交换a0和sscratch寄存器的值,此时a0指向TRAPFRAME的地址,sscratch保存a0的值
        csrrw a0, sscratch, a0

        # save the user registers in TRAPFRAME
        # 保存通用寄存器到TRAPFRAME
        sd ra, 40(a0)
        sd sp, 48(a0)
        sd gp, 56(a0)
        sd tp, 64(a0)
        sd t0, 72(a0)
        sd t1, 80(a0)
        sd t2, 88(a0)
        sd s0, 96(a0)
        sd s1, 104(a0)
        sd a1, 120(a0)
        sd a2, 128(a0)
        sd a3, 136(a0)
        sd a4, 144(a0)
        sd a5, 152(a0)
        sd a6, 160(a0)
        sd a7, 168(a0)
        sd s2, 176(a0)
        sd s3, 184(a0)
        sd s4, 192(a0)
        sd s5, 200(a0)
        sd s6, 208(a0)
        sd s7, 216(a0)
        sd s8, 224(a0)
        sd s9, 232(a0)
        sd s10, 240(a0)
        sd s11, 248(a0)
        sd t3, 256(a0)
        sd t4, 264(a0)
        sd t5, 272(a0)
        sd t6, 280(a0)

	# save the user a0 in p->trapframe->a0
	# 将sscratch保存的a0寄存器的值读取到t0中,然后把原本a0的值也保存进trapframe中
        csrr t0, sscratch
        sd t0, 112(a0)

        # restore kernel stack pointer from p->trapframe->kernel_sp
        # 有关当前进程在内核态中寄存器的值是在usertrapret中被设置的
        # 将kernel_satp的值设置到sp寄存器中,也就是sp指向当前进程内核栈的地址
        ld sp, 8(a0)

        # make tp hold the current hartid, from p->trapframe->kernel_hartid
        # 恢复tp寄存器的值,保存当前hart id 
        ld tp, 32(a0)

        # load the address of usertrap(), p->trapframe->kernel_trap
        # 使用t0寄存器暂存usertrap函数地址
        ld t0, 16(a0)

        # restore kernel page table from p->trapframe->kernel_satp
        # satp指向内核页表,并刷新TLB
        ld t1, 0(a0)
        csrw satp, t1
        sfence.vma zero, zero

        # a0 is no longer valid, since the kernel page
        # table does not specially map p->tf.

        # jump to usertrap(), which does not return
        // 跳转到Usertrap地址处继续执行
        jr t0

// handle an interrupt, exception, or system call from user space.
// called from trampoline.S
// 处理用户态发生的trap
void
usertrap(void)
{
  int which_dev = 0;
  // 确保是用户态发生的trap  
  if((r_sstatus() & SSTATUS_SPP) != 0)
    panic("usertrap: not from user mode");

  // send interrupts and exceptions to kerneltrap(),
  // since we're now in the kernel.
  // 由于我们现在处于内核态,所以后续trap发生都交给kernelvec处理
  w_stvec((uint64)kernelvec);
  
  struct proc *p = myproc();
  
  // save user program counter.
  // 将spec保存到trapframe中
  p->trapframe->epc = r_sepc();
  // 错误码为8,表示产生的是系统调用异常
  if(r_scause() == 8){
    // system call
    // 如果当前进程被杀死了,然后销毁当前进程
    if(p->killed)
      exit(-1);

    // sepc points to the ecall instruction,
    // but we want to return to the next instruction.
    // 产生异常时,spec保存的是发生异常的那条指令地址,这里为了防止产生无限循环,将trapframe中保存的epc值+4
    p->trapframe->epc += 4;

    // an interrupt will change sstatus &c registers,
    // so don't enable until done with those registers.
    // 发生trap时,硬件会自动关闭全局中断,我们这里确保保存好了上面这些寄存器内容后,重新打开中断
    intr_on();
    // 系统调用号保存在a7寄存器中,调用syscall函数,根据系统调用号进行系统调用的派发
    syscall();
  }
  // 处理设备中断--判断是什么设备中断
  else if((which_dev = devintr()) != 0){
    // ok
  } else {
    //无法识别的cause错误码
    printf("usertrap(): unexpected scause %p pid=%d\n", r_scause(), p->pid);
    printf("            sepc=%p stval=%p\n", r_sepc(), r_stval());
    p->killed = 1;
  }
  
  if(p->killed)
    exit(-1);

  // give up the CPU if this is a timer interrupt.
  // 如果是时钟中断,则主动让出当前cpu
  if(which_dev == 2)
    yield();
  // 如果不是时钟中断,说明是系统调用执行完毕后,执行到这里,则进行trap返回流程
  //该函数已经分析过了
  usertrapret();
}

// Fetch the nul-terminated string at addr from the current process.
// Returns length of string, not including nul, or -1 for error.
// 
int
fetchstr(uint64 addr, char *buf, int max)
{
  struct proc *p = myproc();
  // 负责用户态虚地址转换,并将数据从用户态缓冲区拷贝到内核态中来
  int err = copyinstr(p->pagetable, buf, addr, max);
  if(err < 0)
    return err;
  return strlen(buf);
}

// Copy a null-terminated string from user to kernel.
// Copy bytes to dst from virtual address srcva in a given page table,
// until a '\0', or max.
// Return 0 on success, -1 on error.
int
// 从用户空间传过来的虚拟地址srcva处拷贝字符串,直到遇到'\0'结束符号,或者拷贝字符超过max限制
// copy带有'\0'结束符号的字符串
copyinstr(pagetable_t pagetable, char *dst, uint64 srcva, uint64 max)
{
  uint64 n, va0, pa0;
  int got_null = 0;

  while(got_null == 0 && max > 0){
    //用户态下的虚拟地址进行向下对齐
    va0 = PGROUNDDOWN(srcva);
    //遍历用户态页表,将传入的用户态虚拟地址翻译为物理地址
    pa0 = walkaddr(pagetable, va0);
    if(pa0 == 0)
      return -1;
    n = PGSIZE - (srcva - va0);
    if(n > max)
      n = max;
    // 整体实现思路和 copyin 一致
    //不同之处在于,由于事先不清楚copy数据的长度,只能一个个字节的copy，边copy边判断是否到达字符串末尾
    char *p = (char *) (pa0 + (srcva - va0));
    while(n > 0){
      if(*p == '\0'){
        *dst = '\0';
        got_null = 1;
        break;
      } else {
        // 由于内核态下采用的是等价映射,所以才可以直接这样玩
        //毕竟dst代表内核态的虚拟地址，而p代表物理地址
        *dst = *p;
      }
      --n;
      --max;
      p++;
      dst++;
    }
    srcva = va0 + PGSIZE;
  }
  if(got_null){
    return 0;
  } else {
    return -1;
  }
}

// Copy a null-terminated string from user to kernel.
// Copy bytes to dst from virtual address srcva in a given page table,
// until a '\0', or max.
// Return 0 on success, -1 on error.
int
copyinstr(pagetable_t pagetable, char *dst, uint64 srcva, uint64 max)
{
  return copyinstr_new(pagetable, dst, srcva, max);
}

// Copy a null-terminated string from user to kernel.
// Copy bytes to dst from virtual address srcva in a given page table,
// until a '\0', or max.
// Return 0 on success, -1 on error.
int
copyinstr_new(pagetable_t pagetable, char *dst, uint64 srcva, uint64 max)
{
  struct proc *p = myproc();
  char *s = (char *) srcva;
  
  stats.ncopyinstr++;   // XXX lock
  //无需经历虚地址到物理地址翻译这一步,可以直接解引用,因为每个进程的内核页表包含了用户态内核映射
  //所以无需考虑转换
  for(int i = 0; i < max && srcva + i < p->sz; i++){
    dst[i] = s[i];
    if(s[i] == '\0')
      return 0;
  }
  return -1;
}