Homework-1: boot xv6

Homework-1: boot xv6

Finding and breaking at an address

Find the address of _start, the entry point of the kernel:

$ nm kernel | grep _start
8010a48c D _binary_entryother_start
8010a460 D _binary_initcode_start
0010000c T _start

$ make qemu-gdb
$ gdb #new tty
(gdb) br * 0x0010000c
(gdb) c
=> 0x10000c:    mov    %cr4,%eax

(gdb)  info reg
eax            0x0                 0
ecx            0x0                 0
edx            0x1f0               496
ebx            0x10054             65620
esp            0x7bdc              0x7bdc
ebp            0x7bf8              0x7bf8
esi            0x10054             65620
edi            0x1144a8            1131688
eip            0x10000c            0x10000c
eflags         0x46                [ PF ZF ]
cs             0x8                 8
ss             0x10                16
ds             0x10                16
es             0x10                16
fs             0x0                 0
gs             0x0                 0

(gdb) info frame
Stack level 0, frame at 0x7c00:
 eip = 0x10000c; saved eip = 0x7c4d
 called by frame at 0x0
 Arglist at 0x7bf8, args:
 Locals at 0x7bf8, Previous frame's sp is 0x7c00
 Saved registers:
  ebp at 0x7bf8, eip at 0x7bfc

(gdb) x/24x $esp
0x7bdc: 0x00007d7d  0x00000000  0x00000000  0x00000000
0x7bec: 0x00000000  0x00000000  0x00000000  0x00000000
0x7bfc: 0x00007c4d  0x8ec031fa  0x8ec08ed8  0xa864e4d0
0x7c0c: 0xb0fa7502  0xe464e6d1  0x7502a864  0xe6dfb0fa
0x7c1c: 0x16010f60  0x200f7c78  0xc88366c0  0xc0220f01
0x7c2c: 0x087c31ea  0x10b86600  0x8ed88e00  0x66d08ec0

当前的stack还是bootloard 的stack 所以还是从 7c00 开始的

Where in bootasm.S is the stack pointer initialized?

  # Set up the stack pointer and call into C.
  movl    $start, %esp
  #start is 7c00

• Single step through the call to bootmain; what is on the stack now?

(gdb) x/24x $esp
0x7bdc: 0x00007d7d  0x00000000  0x00000000  0x00000000
0x7bec: 0x00000000  0x00000000  0x00000000  0x00000000
0x7bfc: 0x00007c4d  0x8ec031fa  0x8ec08ed8  0xa864e4d0
0x7c0c: 0xb0fa7502  0xe464e6d1  0x7502a864  0xe6dfb0fa
0x7c1c: 0x16010f60  0x200f7c78  0xc88366c0  0xc0220f01
0x7c2c: 0x087c31ea  0x10b86600  0x8ed88e00  0x66d08ec0

• What do the first assembly instructions of bootmain do to the stack? Look for bootmain in bootblock.asm.

    7c8c:   55                      push   %ebp
    7c8d:   89 e5                   mov    %esp,%ebp
    7c8f:   57                      push   %edi
    7c90:   53                      push   %ebx

• Continue tracing via gdb (using breakpoints if necessary -- see hint below) and look for the call that changes eip to 0x10000c. What does that call do to the stack? (Hint: Think about what this call is trying to accomplish in the boot sequence and try to identify this point in bootmain.c, and the corresponding instruction in the bootmain code in bootblock.asm. This might help you set suitable breakpoints to speed things up.)

  => 0x7d77:    call   *0x10018
  
  Thread 1 hit Breakpoint 3, 0x00007d77 in ?? ()
  (gdb) info register
  eax            0x0                 0
  ecx            0x0                 0
  edx            0x1f0               496
  ebx            0x10054             65620
  esp            0x7be0              0x7be0
  ebp            0x7bf8              0x7bf8
  esi            0x10054             65620
  edi            0x1144a8            1131688
  eip            0x7d77              0x7d77
  eflags         0x46                [ PF ZF ]
  cs             0x8                 8
  ss             0x10                16
  ds             0x10                16
  es             0x10                16
  fs             0x0                 0
  gs             0x0                 0
  (gdb) si
  => 0x10000c:  mov    %cr4,%eax
  0x0010000c in ?? ()
  (gdb) info register
  eax            0x0                 0
  ecx            0x0                 0
  edx            0x1f0               496
  ebx            0x10054             65620
  esp            0x7bdc              0x7bdc
  ebp            0x7bf8              0x7bf8
  esi            0x10054             65620
  edi            0x1144a8            1131688
  eip            0x10000c            0x10000c
  eflags         0x46                [ PF ZF ]
  cs             0x8                 8
  ss             0x10                16
  ds             0x10                16
  es             0x10                16
  fs             0x0                 0
  gs             0x0                 0
  

这里开启了保护模式开启的高地址的映射。

=> 0x100028:    mov    $0x8010a5c0,%esp

切换了内核的堆栈。

分页前有一部分是:

Now entry needs to transfer to the kernel’s C code, and run it in high memory. First it makes the stack pointer,%esp, point to memory to be used as a stack. All symbols have high addresses, including stack, so the stack will still be valid even when the low mappings are removed. Finally entry jumps to main, which is also a high address. The indirect jump is needed because the assembler would otherwise generate a PC-relative direct jump, which would execute the low-memory version of
main. Main cannot return, since the there’s no return PC on the stack. Now the kernel is running in high addresses in the function main.

这个没怎么看懂。