cat <<"EOF"> hello.c
int main(void) {
    return 0;
}
EOF
gcc hello.c -o hello

.global _binary_hello_start
.global _binary_hello_end
.global _binary_hello_size
_binary_hello_start:
    .db xxxxxx
    .db xxxxxx
    .db xxxxxx
    .db xxxxxx
_binary_hello_end:
_binary_hello_size:
    .dword x32xxx

#include <stdio.h>
 
extern unsigned char _binary_hello_start;
extern unsigned char _binary_hello_end;
extern unsigned char _binary_hello_size;
 
int main()
{
  unsigned char *pblob = &_binary_hello_start;
  while(pblob < &_binary_hello_end)
  {
    printf("%d: %02X\n", pblob - &_binary_hello_start, *pblob);
    pblob++;
  }
  printf("size: %d\n", &_binary_hello_size);
 
  return 0;
}

// Mark all environments in 'envs' as free, set their env_ids to 0,
// 把env_ids = 0
// and insert them into the env_free_list.
// Make sure the environments are in the free list in the same order
// 注意顺序，链表的是顺序与数组的顺序是完全一致的。
// they are in the envs array (i.e., so that the first call to
// env_alloc() returns envs[0]).
// 比如第一次申请的时候，肯定拿到的是envs[0]
//
void
env_init(void)
{
    // Set up envs array
    // LAB 3: Your code here.
    // 直接用memset把所有元素清0了。
    // 这里其实不用清0也没有关系。是因为在mem_init里面已经清0b 。
    
    memset(envs, 0, sizeof(envs));
    env_free_list = NULL;
    for (int i = NENV - 1; i >= 0; i--) {
        envs[i].env_link = env_free_list;
        env_free_list = envs + i;
    }
    assert(env_free_list == envs);
    // Per-CPU part of the initialization
    env_init_percpu();
}

for (uint32_t i = NENV - 1; i >= 0; i--) {
    
}

//
// Initialize the kernel virtual memory layout for environment e.
// Allocate a page directory, set e->env_pgdir accordingly,
// and initialize the kernel portion of the new environment's address space.
// Do NOT (yet) map anything into the user portion
// of the environment's virtual address space.
//
// Returns 0 on success, < 0 on error.  Errors include:
//    -E_NO_MEM if page directory or table could not be allocated.
//
static int
env_setup_vm(struct Env *e)
{
    int i;
    struct PageInfo *p = NULL;
    // Allocate a page for the page directory
    if (!(p = page_alloc(ALLOC_ZERO)))
        return -E_NO_MEM;
    // Now, set e->env_pgdir and initialize the page directory.
    //
    // Hint:
    //    - The VA space of all envs is identical above UTOP
    //    (except at UVPT, which we've set below).
    //    See inc/memlayout.h for permissions and layout.
    //    Can you use kern_pgdir as a template?  Hint: Yes.
    //    (Make sure you got the permissions right in Lab 2.)
    //    - The initial VA below UTOP is empty.
    //    - You do not need to make any more calls to page_alloc.
    //    - Note: In general, pp_ref is not maintained for
    //    physical pages mapped only above UTOP, but env_pgdir
    //    is an exception -- you need to increment env_pgdir's
    //    pp_ref for env_free to work correctly.
    //    - The functions in kern/pmap.h are handy.
    // LAB 3: Your code here.
    // 要点：高于UTOP的虚拟地址都是一样的。因为给内核用了。但是UVPT除外。
    //      这里需要利用kern_pgdir作为一个模板
    // 确保kern_pgdir里面的权限是正确设置的。
    //      1. 小于UTOP的地址是空的
    //      2. 不需要调用page_alloc
    //      3. pp_ref高于UTOP的部分是不维护的。因为只有内核在用。
    //         但是env_pgdir是个例外，因为可能其他进程的页表会引用到
    //         所以需要p->pp_ref++;
    e->env_pgdir = page2kva(p);
    p->pp_ref++;
    memcpy(e->env_pgdir, kern_pgdir, PGSIZE);
    // UVPT maps the env's own page table read-only.
    // Permissions: kernel R, user R
    e->env_pgdir[PDX(UVPT)] = PADDR(e->env_pgdir) | PTE_P | PTE_U;
    return 0;
}

//
// Allocate len bytes of physical memory for environment env,
// and map it at virtual address va in the environment's address space.
// Does not zero or otherwise initialize the mapped pages in any way.
// Pages should be writable by user and kernel.
// Panic if any allocation attempt fails.
//
static void
region_alloc(struct Env *e, void *va, size_t len)
{
    // LAB 3: Your code here.
    // (But only if you need it for load_icode.)
    //
    // Hint: It is easier to use region_alloc if the caller can pass
    //   'va' and 'len' values that are not page-aligned.
    //   You should round va down, and round (va + len) up.
    //   (Watch out for corner-cases!)
    // 分配len字节的物理地址给进程env，并且要映射到虚拟地址va.
    // 不要初始化这个映射的页面。
    // 页面要可读，可写
    // 如果分配失败要panic.
    // region_alloc
    void *v = ROUNDDOWN(va, PGSIZE);
    size_t l = ROUNDUP(len, PGSIZE);
    for (uint32_t i = 0; i < l; i += PGSIZE) {
        struct PageInfo *p = page_alloc(0);
        if (!p) {
            panic("region_alloc :%e", -E_NO_MEM);
        }
        assert(!page_insert(e->env_pgdir, p, v, PTE_U | PTE_W));
        v += PGSIZE;
        // 不要溢出
        assert(v > va && i < len);
    }
}

//
// Set up the initial program binary, stack, and processor flags
// for a user process.
// 设置一个初始的程序代码段，栈，CPU标志位给用户程序。
// This function is ONLY called during kernel initialization,
// before running the first user-mode environment.
// 这个函数只会在内核初始化的时候被调用。并且是在第一次跳到用户
// 模式环境之前。
//
// This function loads all loadable segments from the ELF binary image
// into the environment's user memory, starting at the appropriate
// virtual addresses indicated in the ELF program header.
//
// 这个函数加载所有从ELF二进制里面可加载的段到用户环境的内存里面。
// 加载到合适的想到的虚拟地址那里去。
// 
// At the same time it clears to zero any portions of these segments
// that are marked in the program header as being mapped
// but not actually present in the ELF file - i.e., the program's bss section.
// 
// 同时这个程序也会把应该清0的段对应的内存进行清0操作。比如程序里面的
// bss段。
//
// All this is very similar to what our boot loader does, except the boot
// loader also needs to read the code from disk.  Take a look at
// boot/main.c to get ideas.
//
// 实际上这个跟我们前面在bootloader里面做的事情是很像的。这个时候可以看
// 看boot/main.c。
//
// Finally, this function maps one page for the program's initial stack.
//
// 最后会加载一页做为程序初始的栈。
//
// load_icode panics if it encounters problems.
//  - How might load_icode fail?  What might be wrong with the given input?
// 在什么情况下load_icode会挂掉。
// 给定的输入可能会出啥问题。
//
static void
load_icode(struct Env *e, uint8_t *binary)
{
    // Hints:
    //  Load each program segment into virtual memory
    //  at the address specified in the ELF segment header.
    //
    //  ELF header里面记录了所有的段的信息。
    //
    //  You should only load segments with ph->p_type == ELF_PROG_LOAD.
    //
    //  只加载：ph->p_type = ELF_PROG_LOAD
    //
    //  Each segment's virtual address can be found in ph->p_va
    //  and its size in memory can be found in ph->p_memsz.
    //
    //  段的虚拟地址: ph->p_va
    //  段大小: ph->p_memsz
    //
    //  The ph->p_filesz bytes from the ELF binary, starting at
    //  'binary + ph->p_offset', should be copied to virtual address
    //  ph->p_va.
    //
    //  段起始: binary + ph->p_offset
    //  段长： ph->p_filesz
    //
    // Any remaining memory bytes should be cleared to zero.
    //  (The ELF header should have ph->p_filesz <= ph->p_memsz.)
    //
    //  清零段：ph->p_filesz <= ph->p_memsz
    //
    //  Use functions from the previous lab to allocate and map pages.
    //
    //  All page protection bits should be user read/write for now.
    //
    //  页权限: PTE_U | PTE_W
    //
    //  ELF segments are not necessarily page-aligned, but you can
    //  assume for this function that no two segments will touch
    //  the same virtual page.
    //
    //  ELF段不需要页对齐：不会有两个段指向同样的虚拟地址
    //
    //  You may find a function like region_alloc useful.
    //
    //  region_alloc有用
    //
    //  Loading the segments is much simpler if you can move data
    //  directly into the virtual addresses stored in the ELF binary.
    //  So which page directory should be in force during
    //  this function?
    //
    //  加载段还是比较简单的，比如可以把数据直接从含有ELF虚拟地址空间
    //  复制过去。所以这个时候应该加载的是哪个页目录表？
    //
    //  You must also do something with the program's entry point,
    //  to make sure that the environment starts executing there.
    //  What?  (See env_run() and env_pop_tf() below.)
    //
    //  你必须要利用program entry来做一些事情，以确保后面从这里开始执行。
    //  env_run & env_pop_tf().
    // LAB 3: Your code here.
    struct Elf *ELFHDR = (struct Elf*)binary;
    assert(ELFHDR->e_magic == ELF_MAGIC);
    struct Proghdr *ph, *eph;
    // load each program segment (ignores ph flags)
    ph = (struct Proghdr *) ((uint8_t *) ELFHDR + ELFHDR->e_phoff);
    eph = ph + ELFHDR->e_phnum;
    lcr3(PADDR(e->env_pgdir));
    for (; ph < eph; ph++) {
        if (ph->p_type == ELF_PROG_LOAD) {
            region_alloc(e, (void*)(ph->p_va), ph->p_memsz);
            uint8_t *src = binary + ph->p_offset;
            uint8_t *dst = (uint8_t*)ph->p_va;
            // 由于页面可能不是连续的，所以这里这种拷贝方式不工作
            // uint8_t *dst = page2kva(page_lookup(e->env_pgdir, (void *)(ph->p_va), NULL));
            memcpy(dst, src, ph->p_filesz);
            if (ph->p_filesz < ph->p_memsz) {
                memset(dst + ph->p_filesz, 0, ph->p_memsz - ph->p_filesz);
            }
        }
    }
    lcr3(PADDR(kern_pgdir));
    e->env_tf.tf_eip = ELFHDR->e_entry;
    // Now map one page for the program's initial stack
    // at virtual address USTACKTOP - PGSIZE.
    // LAB 3: Your code here.
    region_alloc(e, (void*)(USTACKTOP - PGSIZE), PGSIZE);
}

ph = (struct Proghdr *) ((uint8_t *) ELFHDR + ELFHDR->e_phoff);
eph = ph + ELFHDR->e_phnum;
lcr3(PADDR(e->env_pgdir));
for (; ph < eph; ph++) {
    if (ph->p_type == ELF_PROG_LOAD) {
        region_alloc(e, (void*)(ph->p_va), ph->p_memsz);
        uint8_t *src = binary + ph->p_offset;
        // 由于页面可能不是连续的，所以这里这种拷贝方式不工作
        uint8_t *dst = page2kva(page_lookup(e->env_pgdir, (void *)(ph->p_va), NULL));
        memcpy(dst, src, ph->p_filesz);
        if (ph->p_filesz < ph->p_memsz) {
            memset(dst + ph->p_filesz, 0, ph->p_memsz - ph->p_filesz);
        }
    }
}
e->env_tf.tf_eip = ELFHDR->e_entry;

uint8_t *dst = page2kva(page_lookup(e->env_pgdir, (void *)(ph->p_va), NULL));

//
// Allocates a new env with env_alloc, loads the named elf
// binary into it with load_icode, and sets its env_type.
// This function is ONLY called during kernel initialization,
// before running the first user-mode environment.
// The new env's parent ID is set to 0.
//
void
env_create(uint8_t *binary, enum EnvType type)
{
    // LAB 3: Your code here.
    struct Env *init_task = NULL;
    // 必须成功
    assert(!env_alloc(&init_task, 0));
    init_task->env_parent_id = 0;
    init_task->env_type = type;
    load_icode(init_task, binary);
}

//
// Context switch from curenv to env e.
// Note: if this is the first call to env_run, curenv is NULL.
//
// This function does not return.
//
void
env_run(struct Env *e)
{
    // Step 1: If this is a context switch (a new environment is running):
    //       1. Set the current environment (if any) back to
    //          ENV_RUNNABLE if it is ENV_RUNNING (think about
    //          what other states it can be in),
    //       2. Set 'curenv' to the new environment,
    //       3. Set its status to ENV_RUNNING,
    //       4. Update its 'env_runs' counter,
    //       5. Use lcr3() to switch to its address space.
    // Step 2: Use env_pop_tf() to restore the environment's
    //       registers and drop into user mode in the
    //       environment.
    // Hint: This function loads the new environment's state from
    //    e->env_tf.  Go back through the code you wrote above
    //    and make sure you have set the relevant parts of
    //    e->env_tf to sensible values.
    // LAB 3: Your code here.
    if (curenv && curenv->env_status == ENV_RUNNING) {
        curenv->env_status = ENV_RUNNABLE;
    }
    curenv = e;
    curenv->env_status = ENV_RUNNING;
    e->env_runs++;
    lcr3(PADDR(e->env_pgdir));
    env_pop_tf(&(e->env_tf));
    // panic("env_run not yet implemented");
}

/* Interrupt descriptor table.  (Must be built at run time because
 * shifted function addresses can't be represented in relocation records.)
 */
struct Gatedesc idt[256] = { { 0 } };
struct Pseudodesc idt_pd = {
    sizeof(idt) - 1, (uint32_t) idt
};

void
trap_init(void)
{
    extern struct Segdesc gdt[];
    // LAB 3: Your code here.
    void T_DIVIDE_handler();
    void T_DEBUG_handler();
    void T_NMI_handler();
    void T_BRKPT_handler();
    void T_OFLOW_handler();
    void T_BOUND_handler();
    void T_ILLOP_handler();
    void T_DEVICE_handler();
    void T_DBLFLT_handler();
    void T_TSS_handler();
    void T_SEGNP_handler();
    void T_STACK_handler();
    void T_GPFLT_handler();
    void T_PGFLT_handler();
    void T_FPERR_handler();
    void T_ALIGN_handler();
    void T_MCHK_handler();
    void T_SIMDERR_handler();
    void T_SYSCALL_handler();
    SETGATE(idt[T_DIVIDE], 0, GD_KT, T_DIVIDE_handler, 0);
    SETGATE(idt[T_DEBUG], 0, GD_KT, T_DEBUG_handler, 0);
    SETGATE(idt[T_NMI], 0, GD_KT, T_NMI_handler, 0);
    SETGATE(idt[T_BRKPT], 1, GD_KT, T_BRKPT_handler, 0);
    SETGATE(idt[T_OFLOW], 1, GD_KT, T_OFLOW_handler, 0);
    SETGATE(idt[T_BOUND], 0, GD_KT, T_BOUND_handler, 0);
    SETGATE(idt[T_ILLOP], 0, GD_KT, T_ILLOP_handler, 0);
    SETGATE(idt[T_DEVICE], 0, GD_KT, T_DEVICE_handler, 0);
    SETGATE(idt[T_DBLFLT], 0, GD_KT, T_DBLFLT_handler, 0);
    SETGATE(idt[T_TSS], 0, GD_KT, T_TSS_handler, 0);
    SETGATE(idt[T_SEGNP], 0, GD_KT, T_SEGNP_handler, 0);
    SETGATE(idt[T_STACK], 0, GD_KT, T_STACK_handler, 0);
    SETGATE(idt[T_GPFLT], 0, GD_KT, T_GPFLT_handler, 0);
    SETGATE(idt[T_PGFLT], 0, GD_KT, T_PGFLT_handler, 0);
    SETGATE(idt[T_FPERR], 0, GD_KT, T_FPERR_handler, 0);
    SETGATE(idt[T_ALIGN], 0, GD_KT, T_ALIGN_handler, 0);
    SETGATE(idt[T_MCHK], 0, GD_KT, T_MCHK_handler, 0);
    SETGATE(idt[T_SIMDERR], 0, GD_KT, T_SIMDERR_handler, 0);
    SETGATE(idt[T_SYSCALL], 1, GD_KT, T_SYSCALL_handler, 3);
    // Per-CPU setup 
    trap_init_percpu();
}
// Initialize and load the per-CPU TSS and IDT
void
trap_init_percpu(void)
{
    // Setup a TSS so that we get the right stack
    // when we trap to the kernel.
    ts.ts_esp0 = KSTACKTOP;
    ts.ts_ss0 = GD_KD;
    ts.ts_iomb = sizeof(struct Taskstate);
    // Initialize the TSS slot of the gdt.
    gdt[GD_TSS0 >> 3] = SEG16(STS_T32A, (uint32_t) (&ts),
                    sizeof(struct Taskstate) - 1, 0);
    gdt[GD_TSS0 >> 3].sd_s = 0;
    // Load the TSS selector (like other segment selectors, the
    // bottom three bits are special; we leave them 0)
    ltr(GD_TSS0);
    // Load the IDT
    lidt(&idt_pd);
}

1. 如果是在ring 0，那么直接使用当前的ss/esp
2. 如果是在ring 3, 那么使用当前tss段里面的ss0/esp0。然后开始压栈

struct Trapframe {
    .....
    uint32_t tf_trapno;
    /* below here defined by x86 hardware */
    uint32_t tf_err;
    uintptr_t tf_eip;
    uint16_t tf_cs;
    uint16_t tf_padding3;
    uint32_t tf_eflags;
    /* below here only when crossing rings, such as from user to kernel */
    uintptr_t tf_esp;
    uint16_t tf_ss;
    uint16_t tf_padding4;
} __attribute__((packed));

/*
 * Lab 3: Your code here for generating entry points for the different traps.
 */
TRAPHANDLER_NOEC(T_DIVIDE_handler, T_DIVIDE)
TRAPHANDLER_NOEC(T_DEBUG_handler, T_DEBUG)
TRAPHANDLER_NOEC(T_NMI_handler, T_NMI)
TRAPHANDLER_NOEC(T_BRKPT_handler, T_BRKPT)
TRAPHANDLER_NOEC(T_OFLOW_handler, T_OFLOW)
TRAPHANDLER_NOEC(T_BOUND_handler, T_BOUND)
TRAPHANDLER_NOEC(T_ILLOP_handler, T_ILLOP)
TRAPHANDLER_NOEC(T_DEVICE_handler, T_DEVICE)
TRAPHANDLER(T_DBLFLT_handler, T_DBLFLT)
TRAPHANDLER(T_TSS_handler, T_TSS)
TRAPHANDLER(T_SEGNP_handler, T_SEGNP)
TRAPHANDLER(T_STACK_handler, T_STACK)
TRAPHANDLER(T_GPFLT_handler, T_GPFLT)
TRAPHANDLER(T_PGFLT_handler, T_PGFLT)
TRAPHANDLER_NOEC(T_FPERR_handler, T_FPERR)
TRAPHANDLER(T_ALIGN_handler, T_ALIGN)
TRAPHANDLER_NOEC(T_MCHK_handler, T_MCHK)
TRAPHANDLER_NOEC(T_SIMDERR_handler, T_SIMDERR)
TRAPHANDLER_NOEC(T_SYSCALL_handler, T_SYSCALL)

int ret = 0;
switch (tf->tf_trapno) {
case T_PGFLT:
    page_fault_handler(tf);
    return;
default:
    break;
}

case T_BRKPT:
    monitor(tf);
    return;

/* system call numbers */
enum {
    SYS_cputs = 0,
    SYS_cgetc,
    SYS_getenvid,
    SYS_env_destroy,
    NSYSCALLS
};

case T_SYSCALL:
    if (tf->tf_regs.reg_eax >= NSYSCALLS) return -E_INVAL;
    tf->tf_regs.reg_eax = syscall(
        tf->tf_regs.reg_eax,
        tf->tf_regs.reg_edx,
        tf->tf_regs.reg_ecx,
        tf->tf_regs.reg_ebx,
        tf->tf_regs.reg_edi,
        tf->tf_regs.reg_esi
    );
    return;

// Dispatches to the correct kernel function, passing the arguments.
int32_t
syscall(uint32_t syscallno, uint32_t a1, uint32_t a2, uint32_t a3, uint32_t a4, uint32_t a5)
{
    // Call the function corresponding to the 'syscallno' parameter.
    // Return any appropriate return value.
    // LAB 3: Your code here.
    // LAB 3: DONE
    switch (syscallno) {
        case SYS_cputs:
            sys_cputs((char*)a1, (size_t)a2);
        case SYS_cgetc:
            return sys_cgetc();
        case SYS_getenvid:
            assert(curenv);
            return sys_getenvid();
        case SYS_env_destroy:
            assert(curenv);
            return sys_env_destroy(sys_getenvid());
    default:
        return -E_INVAL;
    }
}

// Print a string to the system console.
// The string is exactly 'len' characters long.
// Destroys the environment on memory errors.
static void
sys_cputs(const char *s, size_t len)
{
    // Check that the user has permission to read memory [s, s+len).
    // Destroy the environment if not.
    // LAB 3: Your code here.
    // LAB 3: DONE
    user_mem_assert(curenv, s, len, PTE_P|PTE_U);
    // Print the string supplied by the user.
    cprintf("%.*s", len, s);
}

int
user_mem_check(struct Env *env, const void *va, size_t len, int perm)
{
    // LAB 3: Your code here.
    // LAB 3: DONE
    user_mem_check_addr = 0;
    for (const void *b = va; (b - va) < len; b += PGSIZE) {
        // 注意在这里检查一下内存地址的有效性
        user_mem_check_addr = (size_t)b < ULIM ? 0 : (size_t)b;
        if (!user_mem_check_addr) {
            pte_t *pte = pgdir_walk(env->env_pgdir, b, 0);
            if (!pte || !(*pte & (PTE_P|perm|PTE_U))) {
                user_mem_check_addr = (size_t)b;
            }
        }
        if (user_mem_check_addr) return -E_FAULT;
        b = ROUNDDOWN(b, PGSIZE);
    }
    return 0;
}