Merge branch 'cow' into net

Conflicts:
	.gitignore
	Makefile
	conf/lab.mk
	kernel/defs.h
	kernel/syscall.c
	kernel/vm.c
	user/pingpong.c
	user/user.h
	user/usys.pl

14 files changed, 441 insertions, 22 deletions

diff --git a/kernel/cow.c b/kernel/cow.c
new file mode 100644
index 0000000..b3634fc
--- /dev/null
+++ b/kernel/cow.c
@@ -0,0 +1,30 @@
+// COW pagefault handler
+#include "types.h"
+#include "riscv.h"
+#include "defs.h"
+
+int
+cow_handler(pagetable_t pagetable, uint64 va)
+{
+  // you can't really write to rediculous pointers
+  if(va >= MAXVA || PGROUNDDOWN(va) == 0)
+    return -1;
+  pte_t *pte = walk(pagetable, va, 0);
+  if(pte == 0 || (*pte & PTE_V) == 0 || (*pte & PTE_U) == 0)
+    return -1;
+  if(*pte & PTE_C){
+    uint64 pa_orig = PTE2PA(*pte);
+    uint64 pa_new = (uint64)kalloc();
+    if(pa_new == 0){
+      printf("cow pagefault: kalloc failed\n");
+      return -1;
+    }
+    // copy the page and add write permission
+    memmove((void*)pa_new, (void*)pa_orig, PGSIZE);
+    uint64 flags = (PTE_FLAGS(*pte) | PTE_W) & ~PTE_C;
+    *pte = PA2PTE(pa_new) | flags;
+    kfree((void*)pa_orig);
+  } else if ((*pte & PTE_W) == 0)
+    return -1;
+  return 0;
+}
diff --git a/kernel/defs.h b/kernel/defs.h
index c6fef8c..02226b5 100644
--- a/kernel/defs.h
+++ b/kernel/defs.h
@@ -12,6 +12,7 @@ struct superblock;
 struct mbuf;
 struct sock;
 #endif
+struct sysinfo;
 
 // bio.c
 void            binit(void);
@@ -26,6 +27,9 @@ void            consoleinit(void);
 void            consoleintr(int);
 void            consputc(int);
 
+// cow.c
+int             cow_handler(pagetable_t, uint64);
+
 // exec.c
 int             exec(char*, char**);
 
@@ -64,9 +68,12 @@ void            ramdiskintr(void);
 void            ramdiskrw(struct buf*);
 
 // kalloc.c
+int             refcnt_inc(uint64);
+int             refcnt_dec(uint64);
 void*           kalloc(void);
 void            kfree(void *);
 void            kinit(void);
+int             get_freemem(void);
 
 // log.c
 void            initlog(int, struct superblock*);
@@ -84,6 +91,7 @@ int             pipewrite(struct pipe*, uint64, int);
 void            printf(char*, ...);
 void            panic(char*) __attribute__((noreturn));
 void            printfinit(void);
+void            backtrace(void);
 
 // proc.c
 int             cpuid(void);
@@ -110,6 +118,8 @@ void            yield(void);
 int             either_copyout(int user_dst, uint64 dst, void *src, uint64 len);
 int             either_copyin(void *dst, int user_src, uint64 src, uint64 len);
 void            procdump(void);
+int             get_nproc(void);
+int             pgaccess(uint64 base, int len, uint64 mask);
 
 // swtch.S
 void            swtch(struct context*, struct context*);
@@ -149,6 +159,9 @@ int             fetchstr(uint64, char*, int);
 int             fetchaddr(uint64, uint64*);
 void            syscall();
 
+// sysinfo.c
+int             sys_info(uint64);
+
 // trap.c
 extern uint     ticks;
 void            trapinit(void);
@@ -181,6 +194,7 @@ uint64          walkaddr(pagetable_t, uint64);
 int             copyout(pagetable_t, uint64, char *, uint64);
 int             copyin(pagetable_t, char *, uint64, uint64);
 int             copyinstr(pagetable_t, char *, uint64, uint64);
+void            vmprint(pagetable_t);
 
 // plic.c
 void            plicinit(void);
diff --git a/kernel/exec.c b/kernel/exec.c
index e18bbb6..35b35f5 100644
--- a/kernel/exec.c
+++ b/kernel/exec.c
@@ -128,6 +128,10 @@ exec(char *path, char **argv)
   p->trapframe->sp = sp; // initial stack pointer
   proc_freepagetable(oldpagetable, oldsz);
 
+  if(p->pid == 1){
+    vmprint(p->pagetable);
+  }
+
   return argc; // this ends up in a0, the first argument to main(argc, argv)
 
  bad:
diff --git a/kernel/kalloc.c b/kernel/kalloc.c
index 0699e7e..581f0f6 100644
--- a/kernel/kalloc.c
+++ b/kernel/kalloc.c
@@ -23,10 +23,41 @@ struct {
   struct run *freelist;
 } kmem;
 
+int phypg_refcnt[PHYSTOP/PGSIZE];
+
+// Increase the refcnt
+int
+refcnt_inc(uint64 pa)
+{
+  acquire(&kmem.lock);
+  int *prefcnt = &phypg_refcnt[pa/PGSIZE];
+  if(pa > PHYSTOP || *prefcnt < 1)
+    panic("increase refcnt");
+  (*prefcnt)++;
+  release(&kmem.lock);
+  return *prefcnt;
+}
+
+// Decrease the refcnt
+int
+refcnt_dec(uint64 pa)
+{
+  acquire(&kmem.lock);
+  int *prefcnt = &phypg_refcnt[pa/PGSIZE];
+  if(pa > PHYSTOP || *prefcnt < 1)
+    panic("decrease refcnt");
+  (*prefcnt)--;
+  release(&kmem.lock);
+  return *prefcnt;
+}
+
 void
 kinit()
 {
   initlock(&kmem.lock, "kmem");
+  // init all refcnt to 1, which would later be freed to 0 by kfree()
+  for(uint64 p = PGROUNDUP((uint64)end); p + PGSIZE <= PHYSTOP; p += PGSIZE)
+    phypg_refcnt[p/PGSIZE] = 1;
   freerange(end, (void*)PHYSTOP);
 }
 
@@ -51,6 +82,12 @@ kfree(void *pa)
   if(((uint64)pa % PGSIZE) != 0 || (char*)pa < end || (uint64)pa >= PHYSTOP)
     panic("kfree");
 
+  refcnt_dec((uint64)pa);
+
+  if(phypg_refcnt[(uint64)pa/PGSIZE] > 0)
+    // We still have refs to this phy page, do not actually free it
+    return;
+
   // Fill with junk to catch dangling refs.
   memset(pa, 1, PGSIZE);
 
@@ -72,11 +109,29 @@ kalloc(void)
 
   acquire(&kmem.lock);
   r = kmem.freelist;
-  if(r)
+  if(r){
+    if(phypg_refcnt[(uint64)r/PGSIZE])
+      panic("kalloc: invalid refcnt");
+    phypg_refcnt[(uint64)r/PGSIZE] = 1;
     kmem.freelist = r->next;
+  }
   release(&kmem.lock);
 
   if(r)
     memset((char*)r, 5, PGSIZE); // fill with junk
   return (void*)r;
 }
+
+int
+get_freemem(void)
+{
+  int n;
+  struct run *r;
+
+  acquire(&kmem.lock);
+  for (n = 0, r = kmem.freelist; r; r = r->next)
+    n++;
+  release(&kmem.lock);
+
+  return n * PGSIZE;
+}
diff --git a/kernel/printf.c b/kernel/printf.c
index 1a50203..509c1c5 100644
--- a/kernel/printf.c
+++ b/kernel/printf.c
@@ -122,6 +122,8 @@ panic(char *s)
   printf("panic: ");
   printf(s);
   printf("\n");
+  backtrace();
+
   panicked = 1; // freeze uart output from other CPUs
   for(;;)
     ;
@@ -133,3 +135,18 @@ printfinit(void)
   initlock(&pr.lock, "pr");
   pr.locking = 1;
 }
+
+void
+backtrace(void)
+{
+  uint64 fp = r_fp();
+  printf("backtrace:\n");
+  uint64 stackpg = PGROUNDDOWN(fp);
+  // Whereever fp points to should always live in the stack page
+  while(PGROUNDDOWN(fp) == stackpg){
+    // print the return addr (stored in fp-8)
+    printf("%p\n", *(uint64 *)(fp-8));
+    // load previous (upper stack) fp
+    fp = *(uint64 *)(fp-16);
+  }
+}
diff --git a/kernel/proc.c b/kernel/proc.c
index 58a8a0b..9a9bae9 100644
--- a/kernel/proc.c
+++ b/kernel/proc.c
@@ -39,6 +39,7 @@ proc_mapstacks(pagetable_t kpgtbl)
     if(pa == 0)
       panic("kalloc");
     uint64 va = KSTACK((int) (p - proc));
+  p->alarm_tickspassed = 0;
     kvmmap(kpgtbl, va, (uint64)pa, PGSIZE, PTE_R | PTE_W);
   }
 }
@@ -132,6 +133,25 @@ found:
     return 0;
   }
 
+  // Allocate a usyscall page and fill pid.
+  if((p->usyscall = (struct usyscall *)kalloc()) == 0){
+    freeproc(p);
+    release(&p->lock);
+    return 0;
+  }
+  p->usyscall->pid = p->pid;
+
+  // reset sigalarm props 
+  p->alarm_interval = 0;
+  p->alarm_handler = 0;
+  p->alarm_tickspassed = 0;
+  p->alarm_caninvoke = 1;
+  if((p->atpfm = (struct trapframe *)kalloc()) == 0){
+    freeproc(p);
+    release(&p->lock);
+    return 0;
+  }
+
   // An empty user page table.
   p->pagetable = proc_pagetable(p);
   if(p->pagetable == 0){
@@ -158,8 +178,18 @@ freeproc(struct proc *p)
   if(p->trapframe)
     kfree((void*)p->trapframe);
   p->trapframe = 0;
+  if(p->usyscall)
+    kfree((void*)p->usyscall);
+  p->usyscall = 0;
   if(p->pagetable)
     proc_freepagetable(p->pagetable, p->sz);
+  if(p->atpfm)
+    kfree((void*)p->atpfm);
+  p->atpfm = 0;
+  p->alarm_interval = 0;
+  p->alarm_handler = 0;
+  p->alarm_tickspassed = 0;
+  p->alarm_caninvoke = 1;
   p->pagetable = 0;
   p->sz = 0;
   p->pid = 0;
@@ -172,7 +202,7 @@ freeproc(struct proc *p)
 }
 
 // Create a user page table for a given process, with no user memory,
-// but with trampoline and trapframe pages.
+// but with trampoline, trapframe and usyscall pages.
 pagetable_t
 proc_pagetable(struct proc *p)
 {
@@ -202,6 +232,14 @@ proc_pagetable(struct proc *p)
     return 0;
   }
 
+  // map the usyscall page below the trapframe page, for
+  // ugetpid().
+  if(mappages(pagetable, USYSCALL, PGSIZE,
+              (uint64)(p->usyscall), PTE_R | PTE_U) < 0){
+    uvmunmap(pagetable, USYSCALL, 1, 0);
+    uvmfree(pagetable, 0);
+    return 0;
+  }
   return pagetable;
 }
 
@@ -212,6 +250,7 @@ proc_freepagetable(pagetable_t pagetable, uint64 sz)
 {
   uvmunmap(pagetable, TRAMPOLINE, 1, 0);
   uvmunmap(pagetable, TRAPFRAME, 1, 0);
+  uvmunmap(pagetable, USYSCALL, 1, 0);
   uvmfree(pagetable, sz);
 }
 
@@ -299,6 +338,9 @@ fork(void)
   // copy saved user registers.
   *(np->trapframe) = *(p->trapframe);
 
+  // inherit trace_mask
+  np->trace_mask = p->trace_mask;
+
   // Cause fork to return 0 in the child.
   np->trapframe->a0 = 0;
 
@@ -686,3 +728,43 @@ procdump(void)
     printf("\n");
   }
 }
+
+int
+get_nproc(void)
+{
+  int n = 0;
+  struct proc *p;
+
+  for(int i = 0; i < NPROC; i++) {
+    p = &proc[i];
+    acquire(&p->lock);
+    if(p->state != UNUSED)
+      n++;
+    release(&p->lock);
+  }
+
+  return n;
+}
+
+// lab pagetable: report which pages have been accessed (r/w)
+// according to PTE_A and store it in a bit mask (3rd param)
+int
+pgaccess(uint64 base, int len, uint64 mask_addr)
+{
+  struct proc *p = myproc();
+  pagetable_t pgtbl = p->pagetable;
+  pte_t *pte;
+  int mask = 0;
+  
+  // iterater thru pages
+  for(int i = 0; i < len; i++) {
+    pte = walk(pgtbl, base + i * PGSIZE, 0);
+    if(*pte & PTE_A) {
+      *pte &= (~PTE_A); // clear PTE_A to avoid setting it forever
+      mask |= (1L << i);
+    }
+  }
+
+  // now copyout the mask to user memory
+  return copyout(pgtbl, mask_addr, (char *)&mask, sizeof(mask));
+}
diff --git a/kernel/proc.h b/kernel/proc.h
index d021857..a195b02 100644
--- a/kernel/proc.h
+++ b/kernel/proc.h
@@ -91,6 +91,7 @@ struct proc {
   int killed;                  // If non-zero, have been killed
   int xstate;                  // Exit status to be returned to parent's wait
   int pid;                     // Process ID
+  int trace_mask;              // SYS_trace mask (1 << SYS_xxx)
 
   // wait_lock must be held when using this:
   struct proc *parent;         // Parent process
@@ -100,8 +101,14 @@ struct proc {
   uint64 sz;                   // Size of process memory (bytes)
   pagetable_t pagetable;       // User page table
   struct trapframe *trapframe; // data page for trampoline.S
+  struct usyscall *usyscall;   // data page for usyscall
   struct context context;      // swtch() here to run process
   struct file *ofile[NOFILE];  // Open files
   struct inode *cwd;           // Current directory
   char name[16];               // Process name (debugging)
+  int alarm_interval;          // sigalarm syscall interval
+  uint64 alarm_handler;        // sigalarm syscall handler
+  int alarm_tickspassed;       // record how many ticks passed since last sigalarm handler call
+  int alarm_caninvoke;         // prevent re-entrant calls to handler
+  struct trapframe *atpfm;     // trapframe to resume after handling, must hold p->lock
 };
diff --git a/kernel/riscv.h b/kernel/riscv.h
index 20a01db..7d6eb6e 100644
--- a/kernel/riscv.h
+++ b/kernel/riscv.h
@@ -327,6 +327,15 @@ sfence_vma()
   asm volatile("sfence.vma zero, zero");
 }
 
+// read the frame pointer of currently executing func
+static inline uint64
+r_fp()
+{
+  uint64 x;
+  asm volatile("mv %0, s0" : "=r" (x) );
+  return x;
+}
+
 typedef uint64 pte_t;
 typedef uint64 *pagetable_t; // 512 PTEs
 
@@ -343,6 +352,8 @@ typedef uint64 *pagetable_t; // 512 PTEs
 #define PTE_W (1L << 2)
 #define PTE_X (1L << 3)
 #define PTE_U (1L << 4) // user can access
+#define PTE_A (1L << 6) // riscv access bit                      
+#define PTE_C (1L << 8) // RSW low bit, use it to mark whether a page is COW
 
 // shift a physical address to the right place for a PTE.
 #define PA2PTE(pa) ((((uint64)pa) >> 12) << 10)
diff --git a/kernel/syscall.c b/kernel/syscall.c
index beea0ef..172c5ea 100644
--- a/kernel/syscall.c
+++ b/kernel/syscall.c
@@ -101,6 +101,17 @@ extern uint64 sys_unlink(void);
 extern uint64 sys_link(void);
 extern uint64 sys_mkdir(void);
 extern uint64 sys_close(void);
+extern uint64 sys_trace(void);
+extern uint64 sys_sysinfo(void);
+
+#ifdef LAB_NET
+extern uint64 sys_connect(void);
+#endif
+#ifdef LAB_PGTBL
+extern uint64 sys_pgaccess(void);
+#endif
+extern uint64 sys_sigalarm(void);
+extern uint64 sys_sigreturn(void);
 
 #ifdef LAB_NET
 extern uint64 sys_connect(void);
@@ -139,8 +150,46 @@ static uint64 (*syscalls[])(void) = {
 #ifdef LAB_PGTBL
 [SYS_pgaccess] sys_pgaccess,
 #endif
+[SYS_trace]   sys_trace,
+[SYS_sysinfo] sys_sysinfo,
+[SYS_sigalarm] sys_sigalarm,
+[SYS_sigreturn] sys_sigreturn,
 };
 
+// syscall name maps for SYS_trace:
+static char *syscall_names[] = {
+[SYS_fork]    "fork",
+[SYS_exit]    "exit",
+[SYS_wait]    "wait",
+[SYS_pipe]    "pipe",
+[SYS_read]    "read",
+[SYS_kill]    "kill",
+[SYS_exec]    "exec",
+[SYS_fstat]   "fstat",
+[SYS_chdir]   "chdir",
+[SYS_dup]     "dup",
+[SYS_getpid]  "getpid",
+[SYS_sbrk]    "sbrk",
+[SYS_sleep]   "sleep",
+[SYS_uptime]  "uptime",
+[SYS_open]    "open",
+[SYS_write]   "write",
+[SYS_mknod]   "mknod",
+[SYS_unlink]  "unlink",
+[SYS_link]    "link",
+[SYS_mkdir]   "mkdir",
+[SYS_close]   "close",
+#ifdef LAB_NET
+[SYS_connect] "connect",
+#endif
+#ifdef LAB_PGTBL
+[SYS_pgaccess] "pgaccess",
+#endif
+[SYS_trace]   "trace",
+[SYS_sysinfo] "sysinfo",
+[SYS_sigalarm]  "sigalarm",
+[SYS_sigreturn] "sigreturn",
+};
 
 
 void
@@ -154,9 +203,17 @@ syscall(void)
     // Use num to lookup the system call function for num, call it,
     // and store its return value in p->trapframe->a0
     p->trapframe->a0 = syscalls[num]();
+    
+    // SYS_trace: match all the syscalls which number < mask asked
+    // p->trace_mask == 1 << SYS_xxx
+    if(p->trace_mask >> num) {
+      printf("%d: syscall %s -> %d\n", p->pid, syscall_names[num], p->trapframe->a0);
+    }
+
   } else {
     printf("%d %s: unknown sys call %d\n",
             p->pid, p->name, num);
     p->trapframe->a0 = -1;
   }
 }
+
diff --git a/kernel/sysinfo.c b/kernel/sysinfo.c
new file mode 100644
index 0000000..c66324d
--- /dev/null
+++ b/kernel/sysinfo.c
@@ -0,0 +1,24 @@
+#include "types.h"
+#include "riscv.h"
+#include "param.h"
+#include "spinlock.h"
+#include "defs.h"
+#include "sysinfo.h"
+#include "proc.h"
+
+// Get current system info
+// addr is a user virtual address, pointing to a struct sysinfo.
+int
+sys_info(uint64 addr) {
+  struct proc *p = myproc();
+  struct sysinfo info;
+
+  // Fill nums into the sysinfo struct
+  info.freemem = get_freemem();
+  info.nproc = get_nproc();
+
+  if(copyout(p->pagetable, addr, (char *)&info, sizeof(info)) < 0)
+    return -1;
+  return 0;
+}
+
diff --git a/kernel/sysinfo.h b/kernel/sysinfo.h
new file mode 100644
index 0000000..fb878e6
--- /dev/null
+++ b/kernel/sysinfo.h
@@ -0,0 +1,4 @@
+struct sysinfo {
+  uint64 freemem;   // amount of free memory (bytes)
+  uint64 nproc;     // number of process
+};
diff --git a/kernel/sysproc.c b/kernel/sysproc.c
index 3b4d5bd..715a511 100644
--- a/kernel/sysproc.c
+++ b/kernel/sysproc.c
@@ -1,7 +1,7 @@
 #include "types.h"
 #include "riscv.h"
-#include "defs.h"
 #include "param.h"
+#include "defs.h"
 #include "memlayout.h"
 #include "spinlock.h"
 #include "proc.h"
@@ -54,9 +54,8 @@ sys_sleep(void)
   int n;
   uint ticks0;
 
+
   argint(0, &n);
-  if(n < 0)
-    n = 0;
   acquire(&tickslock);
   ticks0 = ticks;
   while(ticks - ticks0 < n){
@@ -66,10 +65,29 @@ sys_sleep(void)
     }
     sleep(&ticks, &tickslock);
   }
+
+  // backtrace();
+
   release(&tickslock);
   return 0;
 }
 
+
+#ifdef LAB_PGTBL
+int
+sys_pgaccess(void)
+{
+  uint64 base, mask;
+  int len;
+
+  
+  argaddr(0, &base);
+  argint(1, &len);
+  argaddr(2, &mask);
+  return pgaccess(base, len, mask);
+}
+#endif
+
 uint64
 sys_kill(void)
 {
@@ -91,3 +109,44 @@ sys_uptime(void)
   release(&tickslock);
   return xticks;
 }
+
+uint64
+sys_trace(void)
+{
+  argint(0, &myproc()->trace_mask);
+
+  return -(myproc()->trace_mask <= 1);
+}
+
+uint64
+sys_sysinfo(void)
+{
+  uint64 si; // user pointer to struct sysinfo
+
+  argaddr(0, &si);
+  return sys_info(si);
+}
+
+uint64
+sys_sigalarm(void)
+{
+  struct proc *p = myproc();
+  uint64 handler;
+
+  argint(0, &p->alarm_interval);
+  argaddr(1, &handler);
+  p->alarm_handler = handler;
+
+  return 0;
+}
+
+uint64 sys_sigreturn(void)
+{
+  struct proc *p = myproc();
+  // retore saved trapframe to resume
+  memmove(p->trapframe, p->atpfm, sizeof(struct trapframe));
+  p->alarm_tickspassed = 0;
+  p->alarm_caninvoke = 1;
+  // make sure return the original a0 in trapframe to pass test3
+  return p->trapframe->a0;
+}
diff --git a/kernel/trap.c b/kernel/trap.c
index 5332dda..7cc69b1 100644
--- a/kernel/trap.c
+++ b/kernel/trap.c
@@ -6,6 +6,12 @@
 #include "proc.h"
 #include "defs.h"
 
+/*
+ * Always remember that RISC-V disables interrupts when it starts to take a trap,
+ * so there's no need to call intr_off() at the beginning of trap handling.
+ * Reference: xv6-riscv-book 4.5
+ */
+
 struct spinlock tickslock;
 uint ticks;
 
@@ -67,11 +73,18 @@ usertrap(void)
     syscall();
   } else if((which_dev = devintr()) != 0){
     // ok
+  } else if(r_scause() == 13 || r_scause() == 15){
+    // deal with page fault
+    uint64 va = r_stval();
+    if(cow_handler(p->pagetable, va) < 0)
+      goto err;
   } else {
 
     
     printf("usertrap(): unexpected scause %p pid=%d\n", r_scause(), p->pid);
     printf("            sepc=%p stval=%p\n", r_sepc(), r_stval());
+  err:
+    printf("killing the process...\n");
     setkilled(p);
   }
 
@@ -79,9 +92,22 @@ usertrap(void)
     exit(-1);
   
 
-  // give up the CPU if this is a timer interrupt.
-  if(which_dev == 2)
+  if(which_dev == 2){
+    // timer interrupt
+    if(p->alarm_interval > 0 && p->alarm_caninvoke){
+      // record sigalarm
+      p->alarm_tickspassed++;
+      if(p->alarm_tickspassed == p->alarm_interval){
+        // store original trapframe in p->atpfm
+        memmove(p->atpfm, p->trapframe, sizeof(struct trapframe));
+        p->alarm_tickspassed = 0;
+        p->alarm_caninvoke = 0;
+        p->trapframe->epc = p->alarm_handler;
+      }
+    }
+    // give up the CPU.
     yield();
+  }
 
   usertrapret();
 }
diff --git a/kernel/vm.c b/kernel/vm.c
index 7119242..be7d042 100644
--- a/kernel/vm.c
+++ b/kernel/vm.c
@@ -320,20 +320,26 @@ uvmcopy(pagetable_t old, pagetable_t new, uint64 sz)
   pte_t *pte;
   uint64 pa, i;
   uint flags;
-  char *mem;
+  // char *mem;
 
   for(i = 0; i < sz; i += PGSIZE){
     if((pte = walk(old, i, 0)) == 0)
       panic("uvmcopy: pte should exist");
     if((*pte & PTE_V) == 0)
       panic("uvmcopy: page not present");
-    pa = PTE2PA(*pte);
-    flags = PTE_FLAGS(*pte);
+    // do not do the actual copy, just increase the refcnt and mark pages readonly COW
+    /*
     if((mem = kalloc()) == 0)
       goto err;
     memmove(mem, (char*)pa, PGSIZE);
-    if(mappages(new, i, PGSIZE, (uint64)mem, flags) != 0){
-      kfree(mem);
+    */
+    *pte &= ~PTE_W;
+    *pte |= PTE_C;
+    pa = PTE2PA(*pte);
+    refcnt_inc(pa);
+    flags = PTE_FLAGS(*pte);
+    if(mappages(new, i, PGSIZE, (uint64)pa, flags) != 0){
+      // kfree(mem);
       goto err;
     }
   }
@@ -364,22 +370,21 @@ int
 copyout(pagetable_t pagetable, uint64 dstva, char *src, uint64 len)
 {
   uint64 n, va0, pa0;
-  pte_t *pte;
+  // pte_t *pte;
 
   while(len > 0){
     va0 = PGROUNDDOWN(dstva);
-    if (va0 >= MAXVA)
-      return -1;
-    if((pte = walk(pagetable, va0, 0)) == 0) {
-      // printf("copyout: pte should exist 0x%x %d\n", dstva, len);
-      return -1;
-    }
-
 
-    // forbid copyout over read-only user text pages.
-    if((*pte & PTE_W) == 0)
+    if(cow_handler(pagetable, va0) < 0)
       return -1;
     
+    /*
+    pte = walk(pagetable, va0, 0);
+    if(pte == 0 || (*pte & PTE_V) == 0 || (*pte & PTE_U) == 0 ||
+       (*pte & PTE_W) == 0)
+      return -1;
+    pa0 = PTE2PA(*pte);
+    */
     pa0 = walkaddr(pagetable, va0);
     if(pa0 == 0)
       return -1;
@@ -463,5 +468,29 @@ copyinstr(pagetable_t pagetable, char *dst, uint64 srcva, uint64 max)
   }
 }
 
+static void
+walkprint(pagetable_t pgtbl, int level)
+{
+  for(int i = 0; i < 512; i++){
+    pte_t pte = pgtbl[i];
+    if(pte & PTE_V){
+      for(int j = 0; j < level; j++){
+        printf(" ..");
+      }
+      printf("%d: pte %p pa %p\n", i, pte, PTE2PA(pte));
+      if((pte & (PTE_R|PTE_W|PTE_X)) == 0){
+        // this PTE points to a lower-level page table.
+        walkprint((pagetable_t)PTE2PA(pte), level+1);
+      }
+    }
+  }
+}
 
+// Print the contents of a page table
+void
+vmprint(pagetable_t pgtbl)
+{
+  printf("page table %p\n", pgtbl);
 
+  walkprint(pgtbl, 1);
+}