Skip to content

Prep: User Mode — 48k

Session: Fri Nov 13, 1h30 · Exercises: 48k_user_mode · Prep time: ~25 min · Lecture: Week 12 · The Console, the Shell, and User Mode

What you will build

rv6 runs its first user program: a dozen lines of assembly in a private address space with a code page and a stack page it may touch, plus the trampoline and trapframe it cannot. The kernel clears sstatus.SPP and executes its first sret; the program prints through a system call, asks for its pid, and exits with that pid plus 41. You finish the crossing in both directions. The self-check expects hello from user mode on the console and exit status 42 from pid 1.

Concepts you need

Read before class

What Time
Week 12 · Friday · 48k User mode through A private address space 3 min
Week 12 · The trapframe, and why not the user's stack and The trampoline 3 min
Week 12 · The system-call ABI and Done versus retry 3 min
Week 12 · One program, end to end, with its sequence diagram 3 min
Week 12 · For the exam: Two pages at the top and sscratch. Not needed today; on Midterm 2 2 min
rv6 Architecture: Path 3, the user syscall round trip 5 min

Mental model

One getpid() from a process whose pid is 7, end to end:

user    0x20: li a7, 11 ; 0x24: ecall   # scause = 8, sepc = 0x24 (the ecall itself)
enter   uservec: csrrw a0, sscratch, a0 ; park 31 registers in TRAPFRAME
kernel  saved pc: 0x24 -> 0x28          # the work is done: never run ecall again
        saved a0: 7                     # the answer goes into RAM, not a register
leave   sret aimed at U-mode, at the saved pc
user    0x28: a0 == 7                   # the value spent the whole trip as a u64 in a page

Every value that crosses the wall lives in the trapframe for the duration. Forget the +4 and the program makes the same call forever; a page fault is the opposite case: sepc stays put, so the load retries once a kernel maps the page (rv6 maps nothing on demand, so it ends the program).

Check yourself

  1. A program passes buf = 0x3F_FFFF_E000, its own trapframe, to write. What happens, and which check stops it?
    AnswerThe page is mapped in the user's table, but without PTE_U, and walkaddr returns 0 for any PTE lacking that bit. The call returns -1; nothing leaks.
  2. The saved epc is left pointing at the ecall. What does the program do, and why is leaving sepc alone correct for a page fault?
    AnswerIt re-executes the ecall forever. A page fault reports a condition a kernel can remove by mapping the page, so re-running the load is the point; rv6 maps nothing on demand, so it ends the program instead.
  3. The trampoline sits inside the user's address space. Why is it mapped without PTE_U, and how does the CPU ever get there?
    AnswerOnly a trap lands there, and a trap raises privilege to S before the first byte is fetched. PTE_U would break that very path: S-mode never executes code from a U page, so the first trap would fault in uservec.

What "done" looks like

oslings run is green, then oslings submit before you leave. Not green? Submit anyway — the tests that pass earn their share — then finish it at a make-up session (office hours, on the class network) for three quarters, or anywhere else for half, and submit again. Midterm 2 is next Thursday, Nov 19, and covers processes through this exercise.

If you finish early

Work Week 12 · Problem 3: The two top pages and Problem 4: Where does the program resume? on paper; they match Midterm 2's shape. Then start the next prep page, Prep: Exec and File Descriptors.