Traps and Sytem calls

• Trap is transparent

• Xv6 handles all traps in the kernel, which means traps are not delivered to user code
1. Handling traps in the kernel is natural for system calls.
2. It makes sense for interrupts since isolation demands that only the kernel be allowed to use devices, and because the kernel is a convenient mechanism with which to share devices among multiple processes.
3. It also makes sense for exceptions since xv6 responds to all exceptions from user space by killing the offending program

• Four stages Xv6 trap handling proceeds
1. Hardware actions taken by the RISC-V CPU (stvec will be set in this step)
2. Some assembly instructions that prepare the way for kernel C code
3. A C function that decides what to do with the trap(usertrap() and kerneltrap())
4. The system call or device-driver service routine

• Three distinct cases:
1. traps from user space
2. traps from kernel space
3. timer interrupts

RISC-V trap machinery

• some inportant registers
• sscratch: The kernel places a value here that comes in handy at the very start of a trap handler. (trapframe is put here in kernal)
• scause: A number that describes the reason for the trap will be put here .
• stvec: Address of its trap handler; the RISC-V jumps to the address in stvec to handle a trap. stvec → pc
• sepc: PC will be saved here (since the pc is then overwritten with the value in stvec) when a trap occurs. The sret (return from trap) instruction copies sepc to the pc. The kernel can write sepc to control where sret goes. pc → sepc
• sstatus:
• SIE: Control whether device interrupts are enabled. If the kernel clears SIE, the RISC-V will defer device interrupts until the kernel sets SIE.
• SPP: Indicate whether a trap came from user mode or supervisor mode, and controls to what mode sret returns.



• satp: holds the address of the pgtbl root

• The RISC-V hardware does the following for all trap types when it needs to force a trap
1. If the trap is a device interrupt, and the sstatus SIE bit is clear, don’t do any of the following.
2. Disable interrupts by clearing the SIE bit in sstatus.
3. Copy the pc to sepc
4. Save the current mode (user or supervisor) in the SPP bit in sstatus.
5. Set scause to reflect the trap’s cause
6. Set the mode to supervisor.
7. Copy stvec to the pc.
8. Start executing at the new pc.

Traps from user space

• when a trap occurs, which code blocks shoud be executed
• uservec(kernel/trampoline.S:16): The high-level path of a trap from user space
• usertrap(kernel/trap.c:37):
• usertrapret(kernel/trap.c:90): when returning
• userret(kernel/trampoline.S:88):

• Trampoline:
• It is mapped in the user page table, with the PTE_U flag, traps can start executing there in su- pervisor mode.
• It is mapped at the same address in the kernel address space, the trap handler can continue to execute after it switches to the kernel page table.

Traps from kernel space

• what should kernel do before handling the trap?
• set stvec points to kernelvec
• satp points to the kernel pgtbl
• stack point points to a vaild kernel stack

• when a trap occurs, what code blocks should be executed?
1. kernelvec copys the 32 registers on the stack, and jump to kerneltrap()
2. kerneltrap() executes trap handling, and returns to kernelvec
3. kernelvec() set the 32 registers from stack
kernelvec copys the 32 registers on the stack of interrupted kernel thread

code

• usertrap()
• Determine the cause of the trap, process it, and return
• Changes stvec so that a trap while in the kernel will be handled by kernelvec rather than uservec
• It saves the sepc register (the saved user PC), because usertrap might call yield to switch to another process’s kernel thread, and that process might return to user space, in the process of which it will modify sepc.
1. 首先检查trap是否来自user mode
2. 改变stvec值指向kernelvec而不是userevec，从而将后续trap类型为interrupts和exception交给kerneltrap()
3. 保存spec中的user pc，usertrap可能会调用yield()，改变到另一个process‘s kernel
4. 判断trap的类型，syscall则交给syscall()处理，否则就是异常，kernel杀死该进程
5. syscall()执行前将trapframe→epc += 4
6. usertrap()结束之前，检查该进程是否被杀死，如果是timer interruption需要让出cpu

• kerneltrap()
• 首先检查sstatus的SPP位，确认trap来自supervisor mode，检查SIE
• 调用devintr()，检查是timer interrupt，device interrupt或者exception
• device interrupt：调用uartintr()或virtio_disk_inte()进行进一步的处理
• time interrupt：return 2，调用yield()
• 无法识别：返回0并panic
• 当等到CPU有机会运行我们的thread，则会继续运行kerneltrap()
• kerneltrap()结束后，需要返回之前，需要恢复spec和sstatus，这两个寄存器可能以为yield()导致里边存放的是脏值。然后返回到kernelvec汇编代码
• 最后返回到kernnelvec，恢复并返回the interrupted kernel code

• usertrapret()
用于返回用户空间
1. 准备工作，关闭中断
2. 设置stvec指向uservec
3. 为process将来的trap设置好trapframe，恢复pgtbl，stack，hartid等
4. spp设置为0，恢复中断
5. p→trapframe = user pc
6. 调用uerret

• uservec
• The csrrw instruction at the start of uservec swaps the contents of a0 and sscratch. Now the user code’s a0 is saved in sscratch; uservec has one register (a0) to play with(a0 is avaliable now); and a0 contains the value the kernel previously placed in sscratch.
• Save the 32 user registers. Before entering user space, the kernel set sscratch to point to a per-process trapframe structure that (among other things) has space to save the 32 user registers
1. save 32 general registers
2. load the kernel’s pgtbl, stack, current cpu id into relavent registers
3. jump to usertrap() and execute the c code

• sret
与ecall刚好相反
1. enable int
2. copy sepc to pc
3. set mode to usermode
4. start executing at the new pc

• userret
主要完成从kernel到user的完整切换
1. 传入的参数中，a1存放指向process‘s用户态页表的指针，首先交换a1和satp，调用汇编指令切换到user pgtbl
2. a0存放TRAPFRAME，将a0值存在t0，然后存到sscratch中
3. 恢复现场，从trapframe中恢复除了a0之外所有寄存器的值
4. 交换sscratch和a0的值，恢复a0，将trapframe保存到sscratch，为下一次的trap做好准备
5. 执行sret指令

• ecall
1. 如果trap是设备中断，且SIE位被清空，则不执行任何指令
2. 清除SIE位以禁止中断
3. U mode → S mode
4. spec = pc
5. pc = stvec
6. jump to pc
7. 将当前的mode保存在SPP中