Homework: intro to xv6

This lecture is the introduction to xv6, our re-implementation of Unix v6. Read the source code in the assigned files; The assigned chapter for today provides a commentary on the assigned files.

You won't have to understand the details yet; we will focus on how the first user-level process comes into existence after the computer is turned on.

Hand-In Procedure

You are to turn in this homework during lecture. Please write up your answers to the exercises below and hand them in to a 6.828 staff member at the beginning of lecture.

Assignment:
Fetch and un-tar the xv6 source:

sh-3.00$ wget http://pdos.csail.mit.edu/6.828/2009/src/xv6-rev3.tar.gz 
sh-3.00$ tar xzvf xv6-rev3.tar.gz
xv6/
xv6/asm.h
xv6/bio.c
xv6/bootasm.S
xv6/bootmain.c
...
$

Build xv6:

$ cd xv6
$ make
gcc -O -nostdinc -I. -c bootmain.c
gcc -nostdinc -I. -c bootasm.S
ld -N -e start -Ttext 0x7C00 -o bootblock.o bootasm.o bootmain.o
objdump -S bootblock.o > bootblock.asm
objcopy -S -O binary bootblock.o bootblock
...
$

Find the address of the main function by looking in kernel.asm:

% grep main kernel.asm
...
00102454 <mpmain>:
mpmain(void)
001024d0 <main>:
  10250d:       79 f1                   jns    102500 <main+0x30>
  1025f3:       76 6f                   jbe    102664 <main+0x194>
  102611:       74 2f                   je     102642 <main+0x172>

In this case, the address is 001024d0.

Run the kernel inside QEMU GDB, setting a breakpoint at the beginning of main (i.e., the address you just found). (Note: If you're running your own copy of QEMU and have installed the QEMU accelerator kernel module (kqemu), you'll need to disable kqemu for these exercises using the -no-kqemu argument to QEMU in order to work around a bug in it's implementation of breakpoints.)

$ make qemu-gdb
...
$ gdb
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
+ target remote localhost:26000
[New Thread 1]
The target architecture is assumed to be i8086
[f000:fff0] 0xffff0:    ljmp   $0xf000,$0xe05b
0x0000fff0 in ?? ()
(gdb) br * 0x001024d0
Breakpoint 1 at 0x1024d0
(gdb) c
Continuing.
The target architecture is assumed to be i386
0x1024d0:       lea    0x4(%esp),%ecx

Breakpoint 1, 0x001024d0 in ?? ()

The details of what you see are likely to differ from the above output. Look at the registers and the stack contents:

(gdb) info reg
...
(gdb) x/16x $esp
...
(gdb)

Which part of the stack printout is actually the stack? (Hint: not all of it.) Identify all the non-zero values on the stack.

Turn in: the output of x/16x $esp with the valid part of the stack marked. Write a short (3-5 word) comment next to each non-zero value explaining what it is.

Make a copy of Makefile called Makefile.uni, find the line that starts with QEMUOPTS, and change -smp 2 to -smp 1, and write out the file. Then run

make -f Makefile.uni qemu-gdb

This will run QEMU with just one CPU. Set a breakpoint at 0x0, set it running, and continue past the first break:

[f000:fff0] 0xffff0:    ljmp   $0xf000,$0xe05b
0x0000fff0 in ?? ()
(gdb) br * 0x0
Breakpoint 1 at 0x0
(gdb) c
Continuing.
[f000:   0] 0xf0000:    add    %al,(%bx,%si)

Breakpoint 1, 0x00000000 in ?? ()
(gdb) c
Continuing.
The target architecture is assumed to be i386
0x0:    push   $0x24

Breakpoint 1, 0x00000000 in ?? ()
(gdb)

The code that is running is from initcode.S; the push 0x00000024 is the first instruction of the first user-level process. 0x24 is the address of some data; the process is pushing the address so that the kernel can later fetch the data.

Turn in: What physical address does the 0x24 translate to? That is, if the code were at this point to load 32 bits from address 0x24, from what physical address would the data be fetched? What is the data at that address?

Hint: You can use <Ctrl-a c> in the terminal you launched QEMU in to switch between the console and the QEMU monitor. The QEMU monitor command info registers will print information about segments. You can use the xp /1xw addr QEMU monitor command to print one 32-bit value from physical memory.