《MIT 6.828 Homework 1: boot xv6》解题报告

问题

Exercise: What is on the stack?

While stopped at the above breakpoint, look at the registers and the stack contents:

(gdb) info reg

...

(gdb) x/24x $esp

...

(gdb)

Write a short (3-5 word) comment next to each non-zero value on the stack explaining what it is. Which part of the stack printout is actually the stack?

Here are some questions to help you along:

Begin by restarting qemu and gdb, and set a break-point at 0x7c00, the start of the boot block (bootasm.S). Single step through the instructions (type si at the gdb prompt). Where in bootasm.S is the stack pointer initialized? (Single step until you see an instruction that moves a value into %esp, the register for the stack pointer.)

Single step through the call to bootmain; what is on the stack now?

What do the first assembly instructions of bootmain do to the stack? Look for bootmain in bootblock.asm.

Continue tracing via gdb (using breakpoints if necessary -- see hint below) and look for the call that changes eip to 0x10000c. What does that call do to the stack? (Hint: Think about what this call is trying to accomplish in the boot sequence and try to identify this point in bootmain.c, and the corresponding instruction in the bootmain code in bootblock.asm. This might help you set suitable breakpoints to speed things up.)

解答

本题目要求解释内核启动时栈中的数据。由于PC启动顺序是BIOS -> boot loader -> kernel，要想知道内核启动时栈中数据的来源，需要知道前面BIOS和boot loader如何使用栈。因此，下面先解答文中提出的早期BIOS和boot loader启动的问题，再来解释内核启动时栈中的数据。

问题1：栈指针的初始值是什么？

在地址0x7c00处设置断点，使用c命令运行至此，然后使用si命令执行一步，最后查看寄存器信息，结果如下所示。可知栈指针的初始值为0x6f20，并且地址0x6f20存的数据为0xf000d239.

(gdb) b *0x7c00

Breakpoint 1 at 0x7c00

(gdb) c

Continuing.

[   0:7c00] => 0x7c00:	cli    

Thread 1 hit Breakpoint 1, 0x00007c00 in ?? ()

(gdb) si

[   0:7c01] => 0x7c01:	xor    %ax,%ax

0x00007c01 in ?? ()

(gdb) info reg

eax            0xaa55	43605

ecx            0x0	0

edx            0x80	128

ebx            0x0	0

esp            0x6f20	0x6f20

ebp            0x0	0x0

esi            0x0	0

edi            0x0	0

eip            0x7c01	0x7c01

eflags         0x2	[ ]

cs             0x0	0

ss             0x0	0

ds             0x0	0

es             0x0	0

fs             0x0	0

gs             0x0	0

(gdb) x/xw 0x6f20

0x6f20:	0xf000d239

问题2：当调用bootmain时栈中数据是什么？

单步执行到call bootmain处，发现esp寄存器的值为0x7c00，也就是boot block的起始地址。当执行完call指令后，esp寄存器的值变为0x7bfc，call指令的下一条指令的地址，也是bootmain函数的返回地址。

(gdb) si

=> 0x7c43:	mov    $0x7c00,%esp

0x00007c43 in ?? ()

1: /x $ebp = 0x0

2: /x $esp = 0x6f20

(gdb) si

=> 0x7c48:	call   0x7d3b

0x00007c48 in ?? ()

1: /x $ebp = 0x0

2: /x $esp = 0x7c00

(gdb) si

=> 0x7d3b:	push   %ebp

Thread 1 hit Breakpoint 2, 0x00007d3b in ?? ()

1: /x $ebp = 0x0

2: /x $esp = 0x7bfc

问题3：bootmain的第一条指令做了什么？

从bootblock.asm文件可以看到bootmain的第一条指令将ebp寄存器的值压栈。

    7d3b:	55                   	push   %ebp

这导致esp寄存器的值减4，由0x7bfc变为0x7bf8，而栈顶存储的元素也就是ebp寄存器的值，亦即为0.

问题4：那个修改eip的值为0x10000c的call语句对栈做了什么？

修改eip的值为0x10000c的语句是call *0x10018，其中地址0x10018处存储的内容为0x10000c，所以此语句做的事情是：先将返回地址0x7d8d压栈，然后跳到0x10000c的位置。

问题5：解释内核启动时栈中的数据

按照题目要求，执行gdb后，在地址0x0010000c处设置断点。然后

查看寄存器信息

(gdb) info reg

eax            0x0	0

ecx            0x0	0

edx            0x1f0	496

ebx            0x10074	65652

esp            0x7bdc	0x7bdc

ebp            0x7bf8	0x7bf8

esi            0x10074	65652

edi            0x0	0

eip            0x10000c	0x10000c

eflags         0x46	[ PF ZF ]

cs             0x8	8

ss             0x10	16

ds             0x10	16

es             0x10	16

fs             0x0	0

gs             0x0	0

查看栈中数据

(gdb) x/24x $esp

0x7bdc:	0x00007d8d	0x00000000	0x00000000	0x00000000

0x7bec:	0x00000000	0x00000000	0x00000000	0x00000000

0x7bfc:	0x00007c4d	0x8ec031fa	0x8ec08ed8	0xa864e4d0

0x7c0c:	0xb0fa7502	0xe464e6d1	0x7502a864	0xe6dfb0fa

0x7c1c:	0x16010f60	0x200f7c78	0xc88366c0	0xc0220f01

0x7c2c:	0x087c31ea	0x10b86600	0x8ed88e00	0x66d08ec0

解释栈中数据

注意，栈实际上从0x7c00向下增长，大于0x7c00的地址存储的是BIOS和boot loader的代码。

0x7bdc:	0x00007d8d	// function return address after calling kernel

0x7be0: 0x00000000	// reserved value

0x7be4: 0x00000000	// reserved value

0x7be8: 0x00000000  // reserved value

0x7bec:	0x00000000	// reserved value

0x7bf0: 0x00000000	// ebx's value when calling bootmain

0x7bf4: 0x00000000	// esi's value when calling bootmain

0x7bf8: 0x00000000  // edi's value when calling bootmain

0x7bfc:	0x00007c4d	// function return address after calling bootmain

0x7c00: 0x8ec031fa	// cli (The following is instructions of bootblock)

0x7c04: 0x8ec08ed8

0x7c08: 0xa864e4d0

0x7c0c:	0xb0fa7502

0x7c10: 0xe464e6d1

0x7c14: 0x7502a864

0x7c18: 0xe6dfb0fa

0x7c1c:	0x16010f60

0x7c20: 0x200f7c78

0x7c24: 0xc88366c0

0x7c28: 0xc0220f01

0x7c2c:	0x087c31ea

0x7c30: 0x10b86600

0x7c34: 0x8ed88e00

0x7c38: 0x66d08ec0

备注

第一次执行gdb时，没能运行到.gdbinit文件，有以下打印信息：

warning: File "/home/along/src/6.828/src/xv6-public/.gdbinit" auto-loading has been declined by your `auto-load safe-path' set to "$debugdir:$datadir/auto-load".

To enable execution of this file add

	add-auto-load-safe-path /home/along/src/6.828/src/xv6-public/.gdbinit

line to your configuration file "/home/along/.gdbinit".

按照提示，在/home/along/.gdbinit文件中增加以上语句后，再运行gdb就正常了。