24 files changed, 1690 insertions, 30 deletions

diff --git a/.gitignore b/.gitignore
index 10a47b9..1f45623 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,5 +24,6 @@ barrier
 /lab-*.json
 .DS_Store
 *.dSYM
+*.pcap
 riscv/
 compile_flags.txt
diff --git a/Makefile b/Makefile
index 217311b..561311a 100644
--- a/Makefile
+++ b/Makefile
@@ -206,22 +206,18 @@ UPROGS += \
 	$U/_stats
 endif
 
-ifeq ($(LAB),traps)
 UPROGS += \
 	$U/_call\
 	$U/_bttest\
 	$U/_alarmtest
-endif
 
 ifeq ($(LAB),lazy)
 UPROGS += \
 	$U/_lazytests
 endif
 
-ifeq ($(LAB),cow)
 UPROGS += \
 	$U/_cowtest
-endif
 
 ifeq ($(LAB),thread)
 UPROGS += \
@@ -241,10 +237,8 @@ barrier: notxv6/barrier.c
 	gcc -o barrier -g -O2 $(XCFLAGS) notxv6/barrier.c -pthread
 endif
 
-ifeq ($(LAB),pgtbl)
 UPROGS += \
 	$U/_pgtbltest
-endif
 
 ifeq ($(LAB),lock)
 UPROGS += \
@@ -265,9 +259,7 @@ UPROGS += \
 endif
 
 UEXTRA=
-ifeq ($(LAB),util)
-	UEXTRA += user/xargstest.sh
-endif
+UEXTRA += user/xargstest.sh
 
 
 fs.img: mkfs/mkfs README $(UEXTRA) $(UPROGS)
diff --git a/conf/lab.mk b/conf/lab.mk
index 629f978..26dcd75 100644
--- a/conf/lab.mk
+++ b/conf/lab.mk
@@ -1 +1 @@
-LAB=cow
+LAB=net
diff --git a/grade-lab-net b/grade-lab-net
new file mode 100755
index 0000000..dd193e6
--- /dev/null
+++ b/grade-lab-net
@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+
+import re
+import subprocess
+from gradelib import *
+
+r = Runner(save("xv6.out"))
+
+@test(0, "running nettests")
+def test_nettest():
+    server = subprocess.Popen(["make", "server"], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    r.run_qemu(shell_script([
+        'nettests'
+    ]), timeout=30)
+    server.terminate()
+    server.communicate()
+
+@test(40, "nettest: ping", parent=test_nettest)
+def test_nettest_():
+    r.match('^testing ping: OK$')
+
+@test(20, "nettest: single process", parent=test_nettest)
+def test_nettest_():
+    r.match('^testing single-process pings: OK$')
+
+@test(20, "nettest: multi-process", parent=test_nettest)
+def test_nettest_fork_test():
+    r.match('^testing multi-process pings: OK$')
+
+@test(19, "nettest: DNS", parent=test_nettest)
+def test_nettest_dns_test():
+    r.match('^DNS OK$')
+
+#@test(10, "answers-net.txt")
+#def test_answers():
+#    # just a simple sanity check, will be graded manually
+#    check_answers("answers-net.txt")
+
+@test(1, "time")
+def test_time():
+    check_time()
+
+run_tests()
diff --git a/kernel/defs.h b/kernel/defs.h
index 870c984..02226b5 100644
--- a/kernel/defs.h
+++ b/kernel/defs.h
@@ -8,6 +8,10 @@ struct spinlock;
 struct sleeplock;
 struct stat;
 struct superblock;
+#ifdef LAB_NET
+struct mbuf;
+struct sock;
+#endif
 struct sysinfo;
 
 // bio.c
@@ -127,6 +131,10 @@ void            initlock(struct spinlock*, char*);
 void            release(struct spinlock*);
 void            push_off(void);
 void            pop_off(void);
+int             atomic_read4(int *addr);
+#ifdef LAB_LOCK
+void            freelock(struct spinlock*);
+#endif
 
 // sleeplock.c
 void            acquiresleep(struct sleeplock*);
@@ -201,3 +209,44 @@ void            virtio_disk_intr(void);
 
 // number of elements in fixed-size array
 #define NELEM(x) (sizeof(x)/sizeof((x)[0]))
+
+
+
+#ifdef LAB_PGTBL
+// vmcopyin.c
+int             copyin_new(pagetable_t, char *, uint64, uint64);
+int             copyinstr_new(pagetable_t, char *, uint64, uint64);
+#endif
+
+// stats.c
+void            statsinit(void);
+void            statsinc(void);
+
+// sprintf.c
+int             snprintf(char*, int, char*, ...);
+
+#ifdef KCSAN
+void            kcsaninit();
+#endif
+
+#ifdef LAB_NET
+// pci.c
+void            pci_init();
+
+// e1000.c
+void            e1000_init(uint32 *);
+void            e1000_intr(void);
+int             e1000_transmit(struct mbuf*);
+
+// net.c
+void            net_rx(struct mbuf*);
+void            net_tx_udp(struct mbuf*, uint32, uint16, uint16);
+
+// sysnet.c
+void            sockinit(void);
+int             sockalloc(struct file **, uint32, uint16, uint16);
+void            sockclose(struct sock *);
+int             sockread(struct sock *, uint64, int);
+int             sockwrite(struct sock *, uint64, int);
+void            sockrecvudp(struct mbuf*, uint32, uint16, uint16);
+#endif
diff --git a/kernel/e1000.c b/kernel/e1000.c
new file mode 100644
index 0000000..70a2adf
--- /dev/null
+++ b/kernel/e1000.c
@@ -0,0 +1,129 @@
+#include "types.h"
+#include "param.h"
+#include "memlayout.h"
+#include "riscv.h"
+#include "spinlock.h"
+#include "proc.h"
+#include "defs.h"
+#include "e1000_dev.h"
+#include "net.h"
+
+#define TX_RING_SIZE 16
+static struct tx_desc tx_ring[TX_RING_SIZE] __attribute__((aligned(16)));
+static struct mbuf *tx_mbufs[TX_RING_SIZE];
+
+#define RX_RING_SIZE 16
+static struct rx_desc rx_ring[RX_RING_SIZE] __attribute__((aligned(16)));
+static struct mbuf *rx_mbufs[RX_RING_SIZE];
+
+// remember where the e1000's registers live.
+static volatile uint32 *regs;
+
+struct spinlock e1000_lock;
+
+// called by pci_init().
+// xregs is the memory address at which the
+// e1000's registers are mapped.
+void
+e1000_init(uint32 *xregs)
+{
+  int i;
+
+  initlock(&e1000_lock, "e1000");
+
+  regs = xregs;
+
+  // Reset the device
+  regs[E1000_IMS] = 0; // disable interrupts
+  regs[E1000_CTL] |= E1000_CTL_RST;
+  regs[E1000_IMS] = 0; // redisable interrupts
+  __sync_synchronize();
+
+  // [E1000 14.5] Transmit initialization
+  memset(tx_ring, 0, sizeof(tx_ring));
+  for (i = 0; i < TX_RING_SIZE; i++) {
+    tx_ring[i].status = E1000_TXD_STAT_DD;
+    tx_mbufs[i] = 0;
+  }
+  regs[E1000_TDBAL] = (uint64) tx_ring;
+  if(sizeof(tx_ring) % 128 != 0)
+    panic("e1000");
+  regs[E1000_TDLEN] = sizeof(tx_ring);
+  regs[E1000_TDH] = regs[E1000_TDT] = 0;
+  
+  // [E1000 14.4] Receive initialization
+  memset(rx_ring, 0, sizeof(rx_ring));
+  for (i = 0; i < RX_RING_SIZE; i++) {
+    rx_mbufs[i] = mbufalloc(0);
+    if (!rx_mbufs[i])
+      panic("e1000");
+    rx_ring[i].addr = (uint64) rx_mbufs[i]->head;
+  }
+  regs[E1000_RDBAL] = (uint64) rx_ring;
+  if(sizeof(rx_ring) % 128 != 0)
+    panic("e1000");
+  regs[E1000_RDH] = 0;
+  regs[E1000_RDT] = RX_RING_SIZE - 1;
+  regs[E1000_RDLEN] = sizeof(rx_ring);
+
+  // filter by qemu's MAC address, 52:54:00:12:34:56
+  regs[E1000_RA] = 0x12005452;
+  regs[E1000_RA+1] = 0x5634 | (1<<31);
+  // multicast table
+  for (int i = 0; i < 4096/32; i++)
+    regs[E1000_MTA + i] = 0;
+
+  // transmitter control bits.
+  regs[E1000_TCTL] = E1000_TCTL_EN |  // enable
+    E1000_TCTL_PSP |                  // pad short packets
+    (0x10 << E1000_TCTL_CT_SHIFT) |   // collision stuff
+    (0x40 << E1000_TCTL_COLD_SHIFT);
+  regs[E1000_TIPG] = 10 | (8<<10) | (6<<20); // inter-pkt gap
+
+  // receiver control bits.
+  regs[E1000_RCTL] = E1000_RCTL_EN | // enable receiver
+    E1000_RCTL_BAM |                 // enable broadcast
+    E1000_RCTL_SZ_2048 |             // 2048-byte rx buffers
+    E1000_RCTL_SECRC;                // strip CRC
+  
+  // ask e1000 for receive interrupts.
+  regs[E1000_RDTR] = 0; // interrupt after every received packet (no timer)
+  regs[E1000_RADV] = 0; // interrupt after every packet (no timer)
+  regs[E1000_IMS] = (1 << 7); // RXDW -- Receiver Descriptor Write Back
+}
+
+int
+e1000_transmit(struct mbuf *m)
+{
+  //
+  // Your code here.
+  //
+  // the mbuf contains an ethernet frame; program it into
+  // the TX descriptor ring so that the e1000 sends it. Stash
+  // a pointer so that it can be freed after sending.
+  //
+  
+  return 0;
+}
+
+static void
+e1000_recv(void)
+{
+  //
+  // Your code here.
+  //
+  // Check for packets that have arrived from the e1000
+  // Create and deliver an mbuf for each packet (using net_rx()).
+  //
+}
+
+void
+e1000_intr(void)
+{
+  // tell the e1000 we've seen this interrupt;
+  // without this the e1000 won't raise any
+  // further interrupts.
+  regs[E1000_ICR] = 0xffffffff;
+
+  e1000_recv();
+}
diff --git a/kernel/e1000_dev.h b/kernel/e1000_dev.h
new file mode 100644
index 0000000..9b462df
--- /dev/null
+++ b/kernel/e1000_dev.h
@@ -0,0 +1,125 @@
+//
+// E1000 hardware definitions: registers and DMA ring format.
+// from the Intel 82540EP/EM &c manual.
+//
+
+/* Registers */
+#define E1000_CTL      (0x00000/4)  /* Device Control Register - RW */
+#define E1000_ICR      (0x000C0/4)  /* Interrupt Cause Read - R */
+#define E1000_IMS      (0x000D0/4)  /* Interrupt Mask Set - RW */
+#define E1000_RCTL     (0x00100/4)  /* RX Control - RW */
+#define E1000_TCTL     (0x00400/4)  /* TX Control - RW */
+#define E1000_TIPG     (0x00410/4)  /* TX Inter-packet gap -RW */
+#define E1000_RDBAL    (0x02800/4)  /* RX Descriptor Base Address Low - RW */
+#define E1000_RDTR     (0x02820/4)  /* RX Delay Timer */
+#define E1000_RADV     (0x0282C/4)  /* RX Interrupt Absolute Delay Timer */
+#define E1000_RDH      (0x02810/4)  /* RX Descriptor Head - RW */
+#define E1000_RDT      (0x02818/4)  /* RX Descriptor Tail - RW */
+#define E1000_RDLEN    (0x02808/4)  /* RX Descriptor Length - RW */
+#define E1000_RSRPD    (0x02C00/4)  /* RX Small Packet Detect Interrupt */
+#define E1000_TDBAL    (0x03800/4)  /* TX Descriptor Base Address Low - RW */
+#define E1000_TDLEN    (0x03808/4)  /* TX Descriptor Length - RW */
+#define E1000_TDH      (0x03810/4)  /* TX Descriptor Head - RW */
+#define E1000_TDT      (0x03818/4)  /* TX Descripotr Tail - RW */
+#define E1000_MTA      (0x05200/4)  /* Multicast Table Array - RW Array */
+#define E1000_RA       (0x05400/4)  /* Receive Address - RW Array */
+
+/* Device Control */
+#define E1000_CTL_SLU     0x00000040    /* set link up */
+#define E1000_CTL_FRCSPD  0x00000800    /* force speed */
+#define E1000_CTL_FRCDPLX 0x00001000    /* force duplex */
+#define E1000_CTL_RST     0x00400000    /* full reset */
+
+/* Transmit Control */
+#define E1000_TCTL_RST    0x00000001    /* software reset */
+#define E1000_TCTL_EN     0x00000002    /* enable tx */
+#define E1000_TCTL_BCE    0x00000004    /* busy check enable */
+#define E1000_TCTL_PSP    0x00000008    /* pad short packets */
+#define E1000_TCTL_CT     0x00000ff0    /* collision threshold */
+#define E1000_TCTL_CT_SHIFT 4
+#define E1000_TCTL_COLD   0x003ff000    /* collision distance */
+#define E1000_TCTL_COLD_SHIFT 12
+#define E1000_TCTL_SWXOFF 0x00400000    /* SW Xoff transmission */
+#define E1000_TCTL_PBE    0x00800000    /* Packet Burst Enable */
+#define E1000_TCTL_RTLC   0x01000000    /* Re-transmit on late collision */
+#define E1000_TCTL_NRTU   0x02000000    /* No Re-transmit on underrun */
+#define E1000_TCTL_MULR   0x10000000    /* Multiple request support */
+
+/* Receive Control */
+#define E1000_RCTL_RST            0x00000001    /* Software reset */
+#define E1000_RCTL_EN             0x00000002    /* enable */
+#define E1000_RCTL_SBP            0x00000004    /* store bad packet */
+#define E1000_RCTL_UPE            0x00000008    /* unicast promiscuous enable */
+#define E1000_RCTL_MPE            0x00000010    /* multicast promiscuous enab */
+#define E1000_RCTL_LPE            0x00000020    /* long packet enable */
+#define E1000_RCTL_LBM_NO         0x00000000    /* no loopback mode */
+#define E1000_RCTL_LBM_MAC        0x00000040    /* MAC loopback mode */
+#define E1000_RCTL_LBM_SLP        0x00000080    /* serial link loopback mode */
+#define E1000_RCTL_LBM_TCVR       0x000000C0    /* tcvr loopback mode */
+#define E1000_RCTL_DTYP_MASK      0x00000C00    /* Descriptor type mask */
+#define E1000_RCTL_DTYP_PS        0x00000400    /* Packet Split descriptor */
+#define E1000_RCTL_RDMTS_HALF     0x00000000    /* rx desc min threshold size */
+#define E1000_RCTL_RDMTS_QUAT     0x00000100    /* rx desc min threshold size */
+#define E1000_RCTL_RDMTS_EIGTH    0x00000200    /* rx desc min threshold size */
+#define E1000_RCTL_MO_SHIFT       12            /* multicast offset shift */
+#define E1000_RCTL_MO_0           0x00000000    /* multicast offset 11:0 */
+#define E1000_RCTL_MO_1           0x00001000    /* multicast offset 12:1 */
+#define E1000_RCTL_MO_2           0x00002000    /* multicast offset 13:2 */
+#define E1000_RCTL_MO_3           0x00003000    /* multicast offset 15:4 */
+#define E1000_RCTL_MDR            0x00004000    /* multicast desc ring 0 */
+#define E1000_RCTL_BAM            0x00008000    /* broadcast enable */
+/* these buffer sizes are valid if E1000_RCTL_BSEX is 0 */
+#define E1000_RCTL_SZ_2048        0x00000000    /* rx buffer size 2048 */
+#define E1000_RCTL_SZ_1024        0x00010000    /* rx buffer size 1024 */
+#define E1000_RCTL_SZ_512         0x00020000    /* rx buffer size 512 */
+#define E1000_RCTL_SZ_256         0x00030000    /* rx buffer size 256 */
+/* these buffer sizes are valid if E1000_RCTL_BSEX is 1 */
+#define E1000_RCTL_SZ_16384       0x00010000    /* rx buffer size 16384 */
+#define E1000_RCTL_SZ_8192        0x00020000    /* rx buffer size 8192 */
+#define E1000_RCTL_SZ_4096        0x00030000    /* rx buffer size 4096 */
+#define E1000_RCTL_VFE            0x00040000    /* vlan filter enable */
+#define E1000_RCTL_CFIEN          0x00080000    /* canonical form enable */
+#define E1000_RCTL_CFI            0x00100000    /* canonical form indicator */
+#define E1000_RCTL_DPF            0x00400000    /* discard pause frames */
+#define E1000_RCTL_PMCF           0x00800000    /* pass MAC control frames */
+#define E1000_RCTL_BSEX           0x02000000    /* Buffer size extension */
+#define E1000_RCTL_SECRC          0x04000000    /* Strip Ethernet CRC */
+#define E1000_RCTL_FLXBUF_MASK    0x78000000    /* Flexible buffer size */
+#define E1000_RCTL_FLXBUF_SHIFT   27            /* Flexible buffer shift */
+
+#define DATA_MAX 1518
+
+/* Transmit Descriptor command definitions [E1000 3.3.3.1] */
+#define E1000_TXD_CMD_EOP    0x01 /* End of Packet */
+#define E1000_TXD_CMD_RS     0x08 /* Report Status */
+
+/* Transmit Descriptor status definitions [E1000 3.3.3.2] */
+#define E1000_TXD_STAT_DD    0x00000001 /* Descriptor Done */
+
+// [E1000 3.3.3]
+struct tx_desc
+{
+  uint64 addr;
+  uint16 length;
+  uint8 cso;
+  uint8 cmd;
+  uint8 status;
+  uint8 css;
+  uint16 special;
+};
+
+/* Receive Descriptor bit definitions [E1000 3.2.3.1] */
+#define E1000_RXD_STAT_DD       0x01    /* Descriptor Done */
+#define E1000_RXD_STAT_EOP      0x02    /* End of Packet */
+
+// [E1000 3.2.3]
+struct rx_desc
+{
+  uint64 addr;       /* Address of the descriptor's data buffer */
+  uint16 length;     /* Length of data DMAed into data buffer */
+  uint16 csum;       /* Packet checksum */
+  uint8 status;      /* Descriptor status */
+  uint8 errors;      /* Descriptor Errors */
+  uint16 special;
+};
+
diff --git a/kernel/file.c b/kernel/file.c
index 25fa226..0fba21b 100644
--- a/kernel/file.c
+++ b/kernel/file.c
@@ -80,6 +80,11 @@ fileclose(struct file *f)
     iput(ff.ip);
     end_op();
   }
+#ifdef LAB_NET
+  else if(ff.type == FD_SOCK){
+    sockclose(ff.sock);
+  }
+#endif
 }
 
 // Get metadata about file f.
@@ -122,7 +127,13 @@ fileread(struct file *f, uint64 addr, int n)
     if((r = readi(f->ip, 1, addr, f->off, n)) > 0)
       f->off += r;
     iunlock(f->ip);
-  } else {
+  }
+#ifdef LAB_NET
+  else if(f->type == FD_SOCK){
+    r = sockread(f->sock, addr, n);
+  }
+#endif
+  else {
     panic("fileread");
   }
 
@@ -173,7 +184,13 @@ filewrite(struct file *f, uint64 addr, int n)
       i += r;
     }
     ret = (i == n ? n : -1);
-  } else {
+  }
+#ifdef LAB_NET
+  else if(f->type == FD_SOCK){
+    ret = sockwrite(f->sock, addr, n);
+  }
+#endif
+  else {
     panic("filewrite");
   }
 
diff --git a/kernel/file.h b/kernel/file.h
index b076d1d..1eb5107 100644
--- a/kernel/file.h
+++ b/kernel/file.h
@@ -1,10 +1,17 @@
 struct file {
+#ifdef LAB_NET
+  enum { FD_NONE, FD_PIPE, FD_INODE, FD_DEVICE, FD_SOCK } type;
+#else
   enum { FD_NONE, FD_PIPE, FD_INODE, FD_DEVICE } type;
+#endif
   int ref; // reference count
   char readable;
   char writable;
   struct pipe *pipe; // FD_PIPE
   struct inode *ip;  // FD_INODE and FD_DEVICE
+#ifdef LAB_NET
+  struct sock *sock; // FD_SOCK
+#endif
   uint off;          // FD_INODE
   short major;       // FD_DEVICE
 };
@@ -38,3 +45,4 @@ struct devsw {
 extern struct devsw devsw[];
 
 #define CONSOLE 1
+#define STATS   2
diff --git a/kernel/main.c b/kernel/main.c
index f0d3171..48c9555 100644
--- a/kernel/main.c
+++ b/kernel/main.c
@@ -12,6 +12,9 @@ main()
 {
   if(cpuid() == 0){
     consoleinit();
+#if defined(LAB_LOCK)
+    statsinit();
+#endif
     printfinit();
     printf("\n");
     printf("xv6 kernel is booting\n");
@@ -28,11 +31,18 @@ main()
     iinit();         // inode table
     fileinit();      // file table
     virtio_disk_init(); // emulated hard disk
+#ifdef LAB_NET
+    pci_init();
+    sockinit();
+#endif    
     userinit();      // first user process
+#ifdef KCSAN
+    kcsaninit();
+#endif
     __sync_synchronize();
     started = 1;
   } else {
-    while(started == 0)
+    while(atomic_read4((int *) &started) == 0)
       ;
     __sync_synchronize();
     printf("hart %d starting\n", cpuid());
diff --git a/kernel/net.c b/kernel/net.c
new file mode 100644
index 0000000..137ea2b
--- /dev/null
+++ b/kernel/net.c
@@ -0,0 +1,374 @@
+//
+// networking protocol support (IP, UDP, ARP, etc.).
+//
+
+#include "types.h"
+#include "param.h"
+#include "memlayout.h"
+#include "riscv.h"
+#include "spinlock.h"
+#include "proc.h"
+#include "net.h"
+#include "defs.h"
+
+static uint32 local_ip = MAKE_IP_ADDR(10, 0, 2, 15); // qemu's idea of the guest IP
+static uint8 local_mac[ETHADDR_LEN] = { 0x52, 0x54, 0x00, 0x12, 0x34, 0x56 };
+static uint8 broadcast_mac[ETHADDR_LEN] = { 0xFF, 0XFF, 0XFF, 0XFF, 0XFF, 0XFF };
+
+// Strips data from the start of the buffer and returns a pointer to it.
+// Returns 0 if less than the full requested length is available.
+char *
+mbufpull(struct mbuf *m, unsigned int len)
+{
+  char *tmp = m->head;
+  if (m->len < len)
+    return 0;
+  m->len -= len;
+  m->head += len;
+  return tmp;
+}
+
+// Prepends data to the beginning of the buffer and returns a pointer to it.
+char *
+mbufpush(struct mbuf *m, unsigned int len)
+{
+  m->head -= len;
+  if (m->head < m->buf)
+    panic("mbufpush");
+  m->len += len;
+  return m->head;
+}
+
+// Appends data to the end of the buffer and returns a pointer to it.
+char *
+mbufput(struct mbuf *m, unsigned int len)
+{
+  char *tmp = m->head + m->len;
+  m->len += len;
+  if (m->len > MBUF_SIZE)
+    panic("mbufput");
+  return tmp;
+}
+
+// Strips data from the end of the buffer and returns a pointer to it.
+// Returns 0 if less than the full requested length is available.
+char *
+mbuftrim(struct mbuf *m, unsigned int len)
+{
+  if (len > m->len)
+    return 0;
+  m->len -= len;
+  return m->head + m->len;
+}
+
+// Allocates a packet buffer.
+struct mbuf *
+mbufalloc(unsigned int headroom)
+{
+  struct mbuf *m;
+ 
+  if (headroom > MBUF_SIZE)
+    return 0;
+  m = kalloc();
+  if (m == 0)
+    return 0;
+  m->next = 0;
+  m->head = (char *)m->buf + headroom;
+  m->len = 0;
+  memset(m->buf, 0, sizeof(m->buf));
+  return m;
+}
+
+// Frees a packet buffer.
+void
+mbuffree(struct mbuf *m)
+{
+  kfree(m);
+}
+
+// Pushes an mbuf to the end of the queue.
+void
+mbufq_pushtail(struct mbufq *q, struct mbuf *m)
+{
+  m->next = 0;
+  if (!q->head){
+    q->head = q->tail = m;
+    return;
+  }
+  q->tail->next = m;
+  q->tail = m;
+}
+
+// Pops an mbuf from the start of the queue.
+struct mbuf *
+mbufq_pophead(struct mbufq *q)
+{
+  struct mbuf *head = q->head;
+  if (!head)
+    return 0;
+  q->head = head->next;
+  return head;
+}
+
+// Returns one (nonzero) if the queue is empty.
+int
+mbufq_empty(struct mbufq *q)
+{
+  return q->head == 0;
+}
+
+// Intializes a queue of mbufs.
+void
+mbufq_init(struct mbufq *q)
+{
+  q->head = 0;
+}
+
+// This code is lifted from FreeBSD's ping.c, and is copyright by the Regents
+// of the University of California.
+static unsigned short
+in_cksum(const unsigned char *addr, int len)
+{
+  int nleft = len;
+  const unsigned short *w = (const unsigned short *)addr;
+  unsigned int sum = 0;
+  unsigned short answer = 0;
+
+  /*
+   * Our algorithm is simple, using a 32 bit accumulator (sum), we add
+   * sequential 16 bit words to it, and at the end, fold back all the
+   * carry bits from the top 16 bits into the lower 16 bits.
+   */
+  while (nleft > 1)  {
+    sum += *w++;
+    nleft -= 2;
+  }
+
+  /* mop up an odd byte, if necessary */
+  if (nleft == 1) {
+    *(unsigned char *)(&answer) = *(const unsigned char *)w;
+    sum += answer;
+  }
+
+  /* add back carry outs from top 16 bits to low 16 bits */
+  sum = (sum & 0xffff) + (sum >> 16);
+  sum += (sum >> 16);
+  /* guaranteed now that the lower 16 bits of sum are correct */
+
+  answer = ~sum; /* truncate to 16 bits */
+  return answer;
+}
+
+// sends an ethernet packet
+static void
+net_tx_eth(struct mbuf *m, uint16 ethtype)
+{
+  struct eth *ethhdr;
+
+  ethhdr = mbufpushhdr(m, *ethhdr);
+  memmove(ethhdr->shost, local_mac, ETHADDR_LEN);
+  // In a real networking stack, dhost would be set to the address discovered
+  // through ARP. Because we don't support enough of the ARP protocol, set it
+  // to broadcast instead.
+  memmove(ethhdr->dhost, broadcast_mac, ETHADDR_LEN);
+  ethhdr->type = htons(ethtype);
+  if (e1000_transmit(m)) {
+    mbuffree(m);
+  }
+}
+
+// sends an IP packet
+static void
+net_tx_ip(struct mbuf *m, uint8 proto, uint32 dip)
+{
+  struct ip *iphdr;
+
+  // push the IP header
+  iphdr = mbufpushhdr(m, *iphdr);
+  memset(iphdr, 0, sizeof(*iphdr));
+  iphdr->ip_vhl = (4 << 4) | (20 >> 2);
+  iphdr->ip_p = proto;
+  iphdr->ip_src = htonl(local_ip);
+  iphdr->ip_dst = htonl(dip);
+  iphdr->ip_len = htons(m->len);
+  iphdr->ip_ttl = 100;
+  iphdr->ip_sum = in_cksum((unsigned char *)iphdr, sizeof(*iphdr));
+
+  // now on to the ethernet layer
+  net_tx_eth(m, ETHTYPE_IP);
+}
+
+// sends a UDP packet
+void
+net_tx_udp(struct mbuf *m, uint32 dip,
+           uint16 sport, uint16 dport)
+{
+  struct udp *udphdr;
+
+  // put the UDP header
+  udphdr = mbufpushhdr(m, *udphdr);
+  udphdr->sport = htons(sport);
+  udphdr->dport = htons(dport);
+  udphdr->ulen = htons(m->len);
+  udphdr->sum = 0; // zero means no checksum is provided
+
+  // now on to the IP layer
+  net_tx_ip(m, IPPROTO_UDP, dip);
+}
+
+// sends an ARP packet
+static int
+net_tx_arp(uint16 op, uint8 dmac[ETHADDR_LEN], uint32 dip)
+{
+  struct mbuf *m;
+  struct arp *arphdr;
+
+  m = mbufalloc(MBUF_DEFAULT_HEADROOM);
+  if (!m)
+    return -1;
+
+  // generic part of ARP header
+  arphdr = mbufputhdr(m, *arphdr);
+  arphdr->hrd = htons(ARP_HRD_ETHER);
+  arphdr->pro = htons(ETHTYPE_IP);
+  arphdr->hln = ETHADDR_LEN;
+  arphdr->pln = sizeof(uint32);
+  arphdr->op = htons(op);
+
+  // ethernet + IP part of ARP header
+  memmove(arphdr->sha, local_mac, ETHADDR_LEN);
+  arphdr->sip = htonl(local_ip);
+  memmove(arphdr->tha, dmac, ETHADDR_LEN);
+  arphdr->tip = htonl(dip);
+
+  // header is ready, send the packet
+  net_tx_eth(m, ETHTYPE_ARP);
+  return 0;
+}
+
+// receives an ARP packet
+static void
+net_rx_arp(struct mbuf *m)
+{
+  struct arp *arphdr;
+  uint8 smac[ETHADDR_LEN];
+  uint32 sip, tip;
+
+  arphdr = mbufpullhdr(m, *arphdr);
+  if (!arphdr)
+    goto done;
+
+  // validate the ARP header
+  if (ntohs(arphdr->hrd) != ARP_HRD_ETHER ||
+      ntohs(arphdr->pro) != ETHTYPE_IP ||
+      arphdr->hln != ETHADDR_LEN ||
+      arphdr->pln != sizeof(uint32)) {
+    goto done;
+  }
+
+  // only requests are supported so far
+  // check if our IP was solicited
+  tip = ntohl(arphdr->tip); // target IP address
+  if (ntohs(arphdr->op) != ARP_OP_REQUEST || tip != local_ip)
+    goto done;
+
+  // handle the ARP request
+  memmove(smac, arphdr->sha, ETHADDR_LEN); // sender's ethernet address
+  sip = ntohl(arphdr->sip); // sender's IP address (qemu's slirp)
+  net_tx_arp(ARP_OP_REPLY, smac, sip);
+
+done:
+  mbuffree(m);
+}
+
+// receives a UDP packet
+static void
+net_rx_udp(struct mbuf *m, uint16 len, struct ip *iphdr)
+{
+  struct udp *udphdr;
+  uint32 sip;
+  uint16 sport, dport;
+
+
+  udphdr = mbufpullhdr(m, *udphdr);
+  if (!udphdr)
+    goto fail;
+
+  // TODO: validate UDP checksum
+
+  // validate lengths reported in headers
+  if (ntohs(udphdr->ulen) != len)
+    goto fail;
+  len -= sizeof(*udphdr);
+  if (len > m->len)
+    goto fail;
+  // minimum packet size could be larger than the payload
+  mbuftrim(m, m->len - len);
+
+  // parse the necessary fields
+  sip = ntohl(iphdr->ip_src);
+  sport = ntohs(udphdr->sport);
+  dport = ntohs(udphdr->dport);
+  sockrecvudp(m, sip, dport, sport);
+  return;
+
+fail:
+  mbuffree(m);
+}
+
+// receives an IP packet
+static void
+net_rx_ip(struct mbuf *m)
+{
+  struct ip *iphdr;
+  uint16 len;
+
+  iphdr = mbufpullhdr(m, *iphdr);
+  if (!iphdr)
+	  goto fail;
+
+  // check IP version and header len
+  if (iphdr->ip_vhl != ((4 << 4) | (20 >> 2)))
+    goto fail;
+  // validate IP checksum
+  if (in_cksum((unsigned char *)iphdr, sizeof(*iphdr)))
+    goto fail;
+  // can't support fragmented IP packets
+  if (htons(iphdr->ip_off) != 0)
+    goto fail;
+  // is the packet addressed to us?
+  if (htonl(iphdr->ip_dst) != local_ip)
+    goto fail;
+  // can only support UDP
+  if (iphdr->ip_p != IPPROTO_UDP)
+    goto fail;
+
+  len = ntohs(iphdr->ip_len) - sizeof(*iphdr);
+  net_rx_udp(m, len, iphdr);
+  return;
+
+fail:
+  mbuffree(m);
+}
+
+// called by e1000 driver's interrupt handler to deliver a packet to the
+// networking stack
+void net_rx(struct mbuf *m)
+{
+  struct eth *ethhdr;
+  uint16 type;
+
+  ethhdr = mbufpullhdr(m, *ethhdr);
+  if (!ethhdr) {
+    mbuffree(m);
+    return;
+  }
+
+  type = ntohs(ethhdr->type);
+  if (type == ETHTYPE_IP)
+    net_rx_ip(m);
+  else if (type == ETHTYPE_ARP)
+    net_rx_arp(m);
+  else
+    mbuffree(m);
+}
diff --git a/kernel/net.h b/kernel/net.h
new file mode 100644
index 0000000..9e6fefe
--- /dev/null
+++ b/kernel/net.h
@@ -0,0 +1,173 @@
+//
+// packet buffer management
+//
+
+#define MBUF_SIZE              2048
+#define MBUF_DEFAULT_HEADROOM  128
+
+struct mbuf {
+  struct mbuf  *next; // the next mbuf in the chain
+  char         *head; // the current start position of the buffer
+  unsigned int len;   // the length of the buffer
+  char         buf[MBUF_SIZE]; // the backing store
+};
+
+char *mbufpull(struct mbuf *m, unsigned int len);
+char *mbufpush(struct mbuf *m, unsigned int len);
+char *mbufput(struct mbuf *m, unsigned int len);
+char *mbuftrim(struct mbuf *m, unsigned int len);
+
+// The above functions manipulate the size and position of the buffer:
+//            <- push            <- trim
+//             -> pull            -> put
+// [-headroom-][------buffer------][-tailroom-]
+// |----------------MBUF_SIZE-----------------|
+//
+// These marcos automatically typecast and determine the size of header structs.
+// In most situations you should use these instead of the raw ops above.
+#define mbufpullhdr(mbuf, hdr) (typeof(hdr)*)mbufpull(mbuf, sizeof(hdr))
+#define mbufpushhdr(mbuf, hdr) (typeof(hdr)*)mbufpush(mbuf, sizeof(hdr))
+#define mbufputhdr(mbuf, hdr) (typeof(hdr)*)mbufput(mbuf, sizeof(hdr))
+#define mbuftrimhdr(mbuf, hdr) (typeof(hdr)*)mbuftrim(mbuf, sizeof(hdr))
+
+struct mbuf *mbufalloc(unsigned int headroom);
+void mbuffree(struct mbuf *m);
+
+struct mbufq {
+  struct mbuf *head;  // the first element in the queue
+  struct mbuf *tail;  // the last element in the queue
+};
+
+void mbufq_pushtail(struct mbufq *q, struct mbuf *m);
+struct mbuf *mbufq_pophead(struct mbufq *q);
+int mbufq_empty(struct mbufq *q);
+void mbufq_init(struct mbufq *q);
+
+
+//
+// endianness support
+//
+
+static inline uint16 bswaps(uint16 val)
+{
+  return (((val & 0x00ffU) << 8) |
+          ((val & 0xff00U) >> 8));
+}
+
+static inline uint32 bswapl(uint32 val)
+{
+  return (((val & 0x000000ffUL) << 24) |
+          ((val & 0x0000ff00UL) << 8) |
+          ((val & 0x00ff0000UL) >> 8) |
+          ((val & 0xff000000UL) >> 24));
+}
+
+// Use these macros to convert network bytes to the native byte order.
+// Note that Risc-V uses little endian while network order is big endian.
+#define ntohs bswaps
+#define ntohl bswapl
+#define htons bswaps
+#define htonl bswapl
+
+
+//
+// useful networking headers
+//
+
+#define ETHADDR_LEN 6
+
+// an Ethernet packet header (start of the packet).
+struct eth {
+  uint8  dhost[ETHADDR_LEN];
+  uint8  shost[ETHADDR_LEN];
+  uint16 type;
+} __attribute__((packed));
+
+#define ETHTYPE_IP  0x0800 // Internet protocol
+#define ETHTYPE_ARP 0x0806 // Address resolution protocol
+
+// an IP packet header (comes after an Ethernet header).
+struct ip {
+  uint8  ip_vhl; // version << 4 | header length >> 2
+  uint8  ip_tos; // type of service
+  uint16 ip_len; // total length
+  uint16 ip_id;  // identification
+  uint16 ip_off; // fragment offset field
+  uint8  ip_ttl; // time to live
+  uint8  ip_p;   // protocol
+  uint16 ip_sum; // checksum
+  uint32 ip_src, ip_dst;
+};
+
+#define IPPROTO_ICMP 1  // Control message protocol
+#define IPPROTO_TCP  6  // Transmission control protocol
+#define IPPROTO_UDP  17 // User datagram protocol
+
+#define MAKE_IP_ADDR(a, b, c, d)           \
+  (((uint32)a << 24) | ((uint32)b << 16) | \
+   ((uint32)c << 8) | (uint32)d)
+
+// a UDP packet header (comes after an IP header).
+struct udp {
+  uint16 sport; // source port
+  uint16 dport; // destination port
+  uint16 ulen;  // length, including udp header, not including IP header
+  uint16 sum;   // checksum
+};
+
+// an ARP packet (comes after an Ethernet header).
+struct arp {
+  uint16 hrd; // format of hardware address
+  uint16 pro; // format of protocol address
+  uint8  hln; // length of hardware address
+  uint8  pln; // length of protocol address
+  uint16 op;  // operation
+
+  char   sha[ETHADDR_LEN]; // sender hardware address
+  uint32 sip;              // sender IP address
+  char   tha[ETHADDR_LEN]; // target hardware address
+  uint32 tip;              // target IP address
+} __attribute__((packed));
+
+#define ARP_HRD_ETHER 1 // Ethernet
+
+enum {
+  ARP_OP_REQUEST = 1, // requests hw addr given protocol addr
+  ARP_OP_REPLY = 2,   // replies a hw addr given protocol addr
+};
+
+// an DNS packet (comes after an UDP header).
+struct dns {
+  uint16 id;  // request ID
+
+  uint8 rd: 1;  // recursion desired
+  uint8 tc: 1;  // truncated
+  uint8 aa: 1;  // authoritive
+  uint8 opcode: 4; 
+  uint8 qr: 1;  // query/response
+  uint8 rcode: 4; // response code
+  uint8 cd: 1;  // checking disabled
+  uint8 ad: 1;  // authenticated data
+  uint8 z:  1;  
+  uint8 ra: 1;  // recursion available
+  
+  uint16 qdcount; // number of question entries
+  uint16 ancount; // number of resource records in answer section
+  uint16 nscount; // number of NS resource records in authority section
+  uint16 arcount; // number of resource records in additional records
+} __attribute__((packed));
+
+struct dns_question {
+  uint16 qtype;
+  uint16 qclass;
+} __attribute__((packed));
+  
+#define ARECORD (0x0001)
+#define QCLASS  (0x0001)
+
+struct dns_data {
+  uint16 type;
+  uint16 class;
+  uint32 ttl;
+  uint16 len;
+} __attribute__((packed));
diff --git a/kernel/pci.c b/kernel/pci.c
new file mode 100644
index 0000000..5cd2102
--- /dev/null
+++ b/kernel/pci.c
@@ -0,0 +1,61 @@
+//
+// simple PCI-Express initialization, only
+// works for qemu and its e1000 card.
+//
+
+#include "types.h"
+#include "param.h"
+#include "memlayout.h"
+#include "riscv.h"
+#include "spinlock.h"
+#include "proc.h"
+#include "defs.h"
+
+void
+pci_init()
+{
+  // we'll place the e1000 registers at this address.
+  // vm.c maps this range.
+  uint64 e1000_regs = 0x40000000L;
+
+  // qemu -machine virt puts PCIe config space here.
+  // vm.c maps this range.
+  uint32  *ecam = (uint32 *) 0x30000000L;
+  
+  // look at each possible PCI device on bus 0.
+  for(int dev = 0; dev < 32; dev++){
+    int bus = 0;
+    int func = 0;
+    int offset = 0;
+    uint32 off = (bus << 16) | (dev << 11) | (func << 8) | (offset);
+    volatile uint32 *base = ecam + off;
+    uint32 id = base[0];
+    
+    // 100e:8086 is an e1000
+    if(id == 0x100e8086){
+      // command and status register.
+      // bit 0 : I/O access enable
+      // bit 1 : memory access enable
+      // bit 2 : enable mastering
+      base[1] = 7;
+      __sync_synchronize();
+
+      for(int i = 0; i < 6; i++){
+        uint32 old = base[4+i];
+
+        // writing all 1's to the BAR causes it to be
+        // replaced with its size.
+        base[4+i] = 0xffffffff;
+        __sync_synchronize();
+
+        base[4+i] = old;
+      }
+
+      // tell the e1000 to reveal its registers at
+      // physical address 0x40000000.
+      base[4+0] = e1000_regs;
+
+      e1000_init((uint32*)e1000_regs);
+    }
+  }
+}
diff --git a/kernel/plic.c b/kernel/plic.c
index 4175db9..5c9d96a 100644
--- a/kernel/plic.c
+++ b/kernel/plic.c
@@ -14,6 +14,13 @@ plicinit(void)
   // set desired IRQ priorities non-zero (otherwise disabled).
   *(uint32*)(PLIC + UART0_IRQ*4) = 1;
   *(uint32*)(PLIC + VIRTIO0_IRQ*4) = 1;
+  
+#ifdef LAB_NET
+  // PCIE IRQs are 32 to 35
+  for(int irq = 1; irq < 0x35; irq++){
+    *(uint32*)(PLIC + irq*4) = 1;
+  }
+#endif  
 }
 
 void
@@ -25,6 +32,11 @@ plicinithart(void)
   // for the uart and virtio disk.
   *(uint32*)PLIC_SENABLE(hart) = (1 << UART0_IRQ) | (1 << VIRTIO0_IRQ);
 
+#ifdef LAB_NET
+  // hack to get at next 32 IRQs for e1000
+  *(uint32*)(PLIC_SENABLE(hart)+4) = 0xffffffff;
+#endif
+  
   // set this hart's S-mode priority threshold to 0.
   *(uint32*)PLIC_SPRIORITY(hart) = 0;
 }
diff --git a/kernel/spinlock.c b/kernel/spinlock.c
index 9840302..266a698 100644
--- a/kernel/spinlock.c
+++ b/kernel/spinlock.c
@@ -8,12 +8,52 @@
 #include "proc.h"
 #include "defs.h"
 
+#ifdef LAB_LOCK
+#define NLOCK 500
+
+static struct spinlock *locks[NLOCK];
+struct spinlock lock_locks;
+
+void
+freelock(struct spinlock *lk)
+{
+  acquire(&lock_locks);
+  int i;
+  for (i = 0; i < NLOCK; i++) {
+    if(locks[i] == lk) {
+      locks[i] = 0;
+      break;
+    }
+  }
+  release(&lock_locks);
+}
+
+static void
+findslot(struct spinlock *lk) {
+  acquire(&lock_locks);
+  int i;
+  for (i = 0; i < NLOCK; i++) {
+    if(locks[i] == 0) {
+      locks[i] = lk;
+      release(&lock_locks);
+      return;
+    }
+  }
+  panic("findslot");
+}
+#endif
+
 void
 initlock(struct spinlock *lk, char *name)
 {
   lk->name = name;
   lk->locked = 0;
   lk->cpu = 0;
+#ifdef LAB_LOCK
+  lk->nts = 0;
+  lk->n = 0;
+  findslot(lk);
+#endif  
 }
 
 // Acquire the lock.
@@ -25,12 +65,21 @@ acquire(struct spinlock *lk)
   if(holding(lk))
     panic("acquire");
 
+#ifdef LAB_LOCK
+    __sync_fetch_and_add(&(lk->n), 1);
+#endif      
+
   // On RISC-V, sync_lock_test_and_set turns into an atomic swap:
   //   a5 = 1
   //   s1 = &lk->locked
   //   amoswap.w.aq a5, a5, (s1)
-  while(__sync_lock_test_and_set(&lk->locked, 1) != 0)
-    ;
+  while(__sync_lock_test_and_set(&lk->locked, 1) != 0) {
+#ifdef LAB_LOCK
+    __sync_fetch_and_add(&(lk->nts), 1);
+#else
+   ;
+#endif
+  }
 
   // Tell the C compiler and the processor to not move loads or stores
   // past this point, to ensure that the critical section's memory
@@ -108,3 +157,61 @@ pop_off(void)
   if(c->noff == 0 && c->intena)
     intr_on();
 }
+
+// Read a shared 32-bit value without holding a lock
+int
+atomic_read4(int *addr) {
+  uint32 val;
+  __atomic_load(addr, &val, __ATOMIC_SEQ_CST);
+  return val;
+}
+
+#ifdef LAB_LOCK
+int
+snprint_lock(char *buf, int sz, struct spinlock *lk)
+{
+  int n = 0;
+  if(lk->n > 0) {
+    n = snprintf(buf, sz, "lock: %s: #test-and-set %d #acquire() %d\n",
+                 lk->name, lk->nts, lk->n);
+  }
+  return n;
+}
+
+int
+statslock(char *buf, int sz) {
+  int n;
+  int tot = 0;
+
+  acquire(&lock_locks);
+  n = snprintf(buf, sz, "--- lock kmem/bcache stats\n");
+  for(int i = 0; i < NLOCK; i++) {
+    if(locks[i] == 0)
+      break;
+    if(strncmp(locks[i]->name, "bcache", strlen("bcache")) == 0 ||
+       strncmp(locks[i]->name, "kmem", strlen("kmem")) == 0) {
+      tot += locks[i]->nts;
+      n += snprint_lock(buf +n, sz-n, locks[i]);
+    }
+  }
+  
+  n += snprintf(buf+n, sz-n, "--- top 5 contended locks:\n");
+  int last = 100000000;
+  // stupid way to compute top 5 contended locks
+  for(int t = 0; t < 5; t++) {
+    int top = 0;
+    for(int i = 0; i < NLOCK; i++) {
+      if(locks[i] == 0)
+        break;
+      if(locks[i]->nts > locks[top]->nts && locks[i]->nts < last) {
+        top = i;
+      }
+    }
+    n += snprint_lock(buf+n, sz-n, locks[top]);
+    last = locks[top]->nts;
+  }
+  n += snprintf(buf+n, sz-n, "tot= %d\n", tot);
+  release(&lock_locks);  
+  return n;
+}
+#endif
diff --git a/kernel/syscall.c b/kernel/syscall.c
index 8392eb4..172c5ea 100644
--- a/kernel/syscall.c
+++ b/kernel/syscall.c
@@ -113,6 +113,13 @@ extern uint64 sys_pgaccess(void);
 extern uint64 sys_sigalarm(void);
 extern uint64 sys_sigreturn(void);
 
+#ifdef LAB_NET
+extern uint64 sys_connect(void);
+#endif
+#ifdef LAB_PGTBL
+extern uint64 sys_pgaccess(void);
+#endif
+
 // An array mapping syscall numbers from syscall.h
 // to the function that handles the system call.
 static uint64 (*syscalls[])(void) = {
@@ -185,7 +192,6 @@ static char *syscall_names[] = {
 };
 
 
-
 void
 syscall(void)
 {
diff --git a/kernel/sysfile.c b/kernel/sysfile.c
index 16b668c..4b2189a 100644
--- a/kernel/sysfile.c
+++ b/kernel/sysfile.c
@@ -503,3 +503,29 @@ sys_pipe(void)
   }
   return 0;
 }
+
+
+#ifdef LAB_NET
+int
+sys_connect(void)
+{
+  struct file *f;
+  int fd;
+  uint32 raddr;
+  uint32 rport;
+  uint32 lport;
+
+  argint(0, (int*)&raddr);
+  argint(1, (int*)&lport);
+  argint(2, (int*)&rport);
+
+  if(sockalloc(&f, raddr, lport, rport) < 0)
+    return -1;
+  if((fd=fdalloc(f)) < 0){
+    fileclose(f);
+    return -1;
+  }
+
+  return fd;
+}
+#endif
diff --git a/kernel/sysnet.c b/kernel/sysnet.c
new file mode 100644
index 0000000..1c48cb3
--- /dev/null
+++ b/kernel/sysnet.c
@@ -0,0 +1,185 @@
+//
+// network system calls.
+//
+
+#include "types.h"
+#include "param.h"
+#include "memlayout.h"
+#include "riscv.h"
+#include "spinlock.h"
+#include "proc.h"
+#include "defs.h"
+#include "fs.h"
+#include "sleeplock.h"
+#include "file.h"
+#include "net.h"
+
+struct sock {
+  struct sock *next; // the next socket in the list
+  uint32 raddr;      // the remote IPv4 address
+  uint16 lport;      // the local UDP port number
+  uint16 rport;      // the remote UDP port number
+  struct spinlock lock; // protects the rxq
+  struct mbufq rxq;  // a queue of packets waiting to be received
+};
+
+static struct spinlock lock;
+static struct sock *sockets;
+
+void
+sockinit(void)
+{
+  initlock(&lock, "socktbl");
+}
+
+int
+sockalloc(struct file **f, uint32 raddr, uint16 lport, uint16 rport)
+{
+  struct sock *si, *pos;
+
+  si = 0;
+  *f = 0;
+  if ((*f = filealloc()) == 0)
+    goto bad;
+  if ((si = (struct sock*)kalloc()) == 0)
+    goto bad;
+
+  // initialize objects
+  si->raddr = raddr;
+  si->lport = lport;
+  si->rport = rport;
+  initlock(&si->lock, "sock");
+  mbufq_init(&si->rxq);
+  (*f)->type = FD_SOCK;
+  (*f)->readable = 1;
+  (*f)->writable = 1;
+  (*f)->sock = si;
+
+  // add to list of sockets
+  acquire(&lock);
+  pos = sockets;
+  while (pos) {
+    if (pos->raddr == raddr &&
+        pos->lport == lport &&
+	pos->rport == rport) {
+      release(&lock);
+      goto bad;
+    }
+    pos = pos->next;
+  }
+  si->next = sockets;
+  sockets = si;
+  release(&lock);
+  return 0;
+
+bad:
+  if (si)
+    kfree((char*)si);
+  if (*f)
+    fileclose(*f);
+  return -1;
+}
+
+void
+sockclose(struct sock *si)
+{
+  struct sock **pos;
+  struct mbuf *m;
+
+  // remove from list of sockets
+  acquire(&lock);
+  pos = &sockets;
+  while (*pos) {
+    if (*pos == si){
+      *pos = si->next;
+      break;
+    }
+    pos = &(*pos)->next;
+  }
+  release(&lock);
+
+  // free any pending mbufs
+  while (!mbufq_empty(&si->rxq)) {
+    m = mbufq_pophead(&si->rxq);
+    mbuffree(m);
+  }
+
+  kfree((char*)si);
+}
+
+int
+sockread(struct sock *si, uint64 addr, int n)
+{
+  struct proc *pr = myproc();
+  struct mbuf *m;
+  int len;
+
+  acquire(&si->lock);
+  while (mbufq_empty(&si->rxq) && !pr->killed) {
+    sleep(&si->rxq, &si->lock);
+  }
+  if (pr->killed) {
+    release(&si->lock);
+    return -1;
+  }
+  m = mbufq_pophead(&si->rxq);
+  release(&si->lock);
+
+  len = m->len;
+  if (len > n)
+    len = n;
+  if (copyout(pr->pagetable, addr, m->head, len) == -1) {
+    mbuffree(m);
+    return -1;
+  }
+  mbuffree(m);
+  return len;
+}
+
+int
+sockwrite(struct sock *si, uint64 addr, int n)
+{
+  struct proc *pr = myproc();
+  struct mbuf *m;
+
+  m = mbufalloc(MBUF_DEFAULT_HEADROOM);
+  if (!m)
+    return -1;
+
+  if (copyin(pr->pagetable, mbufput(m, n), addr, n) == -1) {
+    mbuffree(m);
+    return -1;
+  }
+  net_tx_udp(m, si->raddr, si->lport, si->rport);
+  return n;
+}
+
+// called by protocol handler layer to deliver UDP packets
+void
+sockrecvudp(struct mbuf *m, uint32 raddr, uint16 lport, uint16 rport)
+{
+  //
+  // Find the socket that handles this mbuf and deliver it, waking
+  // any sleeping reader. Free the mbuf if there are no sockets
+  // registered to handle it.
+  //
+  struct sock *si;
+
+  acquire(&lock);
+  si = sockets;
+  while (si) {
+    if (si->raddr == raddr && si->lport == lport && si->rport == rport)
+      goto found;
+    si = si->next;
+  }
+  release(&lock);
+  mbuffree(m);
+  return;
+
+found:
+  acquire(&si->lock);
+  mbufq_pushtail(&si->rxq, m);
+  wakeup(&si->rxq);
+  release(&si->lock);
+  release(&lock);
+}
diff --git a/kernel/trap.c b/kernel/trap.c
index bd3b100..7cc69b1 100644
--- a/kernel/trap.c
+++ b/kernel/trap.c
@@ -79,6 +79,8 @@ usertrap(void)
     if(cow_handler(p->pagetable, va) < 0)
       goto err;
   } else {
+
+    
     printf("usertrap(): unexpected scause %p pid=%d\n", r_scause(), p->pid);
     printf("            sepc=%p stval=%p\n", r_sepc(), r_stval());
   err:
@@ -88,6 +90,7 @@ usertrap(void)
 
   if(killed(p))
     exit(-1);
+  
 
   if(which_dev == 2){
     // timer interrupt
@@ -216,7 +219,13 @@ devintr()
       uartintr();
     } else if(irq == VIRTIO0_IRQ){
       virtio_disk_intr();
-    } else if(irq){
+    }
+#ifdef LAB_NET
+    else if(irq == E1000_IRQ){
+      e1000_intr();
+    }
+#endif
+    else if(irq){
       printf("unexpected interrupt irq=%d\n", irq);
     }
 
diff --git a/kernel/vm.c b/kernel/vm.c
index 11f9e0a..be7d042 100644
--- a/kernel/vm.c
+++ b/kernel/vm.c
@@ -4,6 +4,8 @@
 #include "elf.h"
 #include "riscv.h"
 #include "defs.h"
+#include "spinlock.h"
+#include "proc.h"
 #include "fs.h"
 
 /*
@@ -30,6 +32,14 @@ kvmmake(void)
   // virtio mmio disk interface
   kvmmap(kpgtbl, VIRTIO0, VIRTIO0, PGSIZE, PTE_R | PTE_W);
 
+#ifdef LAB_NET
+  // PCI-E ECAM (configuration space), for pci.c
+  kvmmap(kpgtbl, 0x30000000L, 0x30000000L, 0x10000000, PTE_R | PTE_W);
+
+  // pci.c maps the e1000's registers here.
+  kvmmap(kpgtbl, 0x40000000L, 0x40000000L, 0x20000, PTE_R | PTE_W);
+#endif  
+
   // PLIC
   kvmmap(kpgtbl, PLIC, PLIC, 0x400000, PTE_R | PTE_W);
 
@@ -136,9 +146,8 @@ kvmmap(pagetable_t kpgtbl, uint64 va, uint64 pa, uint64 sz, int perm)
 }
 
 // Create PTEs for virtual addresses starting at va that refer to
-// physical addresses starting at pa.
-// va and size MUST be page-aligned.
-// Returns 0 on success, -1 if walk() couldn't
+// physical addresses starting at pa. va and size might not
+// be page-aligned. Returns 0 on success, -1 if walk() couldn't
 // allocate a needed page-table page.
 int
 mappages(pagetable_t pagetable, uint64 va, uint64 size, uint64 pa, int perm)
@@ -146,17 +155,11 @@ mappages(pagetable_t pagetable, uint64 va, uint64 size, uint64 pa, int perm)
   uint64 a, last;
   pte_t *pte;
 
-  if((va % PGSIZE) != 0)
-    panic("mappages: va not aligned");
-
-  if((size % PGSIZE) != 0)
-    panic("mappages: size not aligned");
-
   if(size == 0)
     panic("mappages: size");
   
-  a = va;
-  last = va + size - PGSIZE;
+  a = PGROUNDDOWN(va);
+  last = PGROUNDDOWN(va + size - 1);
   for(;;){
     if((pte = walk(pagetable, a, 1)) == 0)
       return -1;
@@ -186,8 +189,10 @@ uvmunmap(pagetable_t pagetable, uint64 va, uint64 npages, int do_free)
   for(a = va; a < va + npages*PGSIZE; a += PGSIZE){
     if((pte = walk(pagetable, a, 0)) == 0)
       panic("uvmunmap: walk");
-    if((*pte & PTE_V) == 0)
+    if((*pte & PTE_V) == 0) {
+      printf("va=%p pte=%p\n", a, *pte);
       panic("uvmunmap: not mapped");
+    }
     if(PTE_FLAGS(*pte) == PTE_V)
       panic("uvmunmap: not a leaf");
     if(do_free){
@@ -402,7 +407,7 @@ int
 copyin(pagetable_t pagetable, char *dst, uint64 srcva, uint64 len)
 {
   uint64 n, va0, pa0;
-
+  
   while(len > 0){
     va0 = PGROUNDDOWN(srcva);
     pa0 = walkaddr(pagetable, va0);
diff --git a/ping.py b/ping.py
new file mode 100644
index 0000000..eab10f8
--- /dev/null
+++ b/ping.py
@@ -0,0 +1,12 @@
+import socket
+import sys
+import time
+
+sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+addr = ('localhost', int(sys.argv[1]))
+buf = "this is a ping!".encode('utf-8')
+
+while True:
+	print("pinging...", file=sys.stderr)
+	sock.sendto(buf, ("127.0.0.1", int(sys.argv[1])))
+	time.sleep(1)
diff --git a/server.py b/server.py
new file mode 100644
index 0000000..2421c31
--- /dev/null
+++ b/server.py
@@ -0,0 +1,13 @@
+import socket
+import sys
+
+sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+addr = ('localhost', int(sys.argv[1]))
+print('listening on %s port %s' % addr, file=sys.stderr)
+sock.bind(addr)
+
+while True:
+    buf, raddr = sock.recvfrom(4096)
+    print(buf.decode("utf-8"), file=sys.stderr)
+    if buf:
+        sent = sock.sendto(b'this is the host!', raddr)
diff --git a/user/nettests.c b/user/nettests.c
new file mode 100644
index 0000000..2f7d6cd
--- /dev/null
+++ b/user/nettests.c
@@ -0,0 +1,297 @@
+#include "kernel/types.h"
+#include "kernel/net.h"
+#include "kernel/stat.h"
+#include "user/user.h"
+
+//
+// send a UDP packet to the localhost (outside of qemu),
+// and receive a response.
+//
+static void
+ping(uint16 sport, uint16 dport, int attempts)
+{
+  int fd;
+  char *obuf = "a message from xv6!";
+  uint32 dst;
+
+  // 10.0.2.2, which qemu remaps to the external host,
+  // i.e. the machine you're running qemu on.
+  dst = (10 << 24) | (0 << 16) | (2 << 8) | (2 << 0);
+
+  // you can send a UDP packet to any Internet address
+  // by using a different dst.
+  
+  if((fd = connect(dst, sport, dport)) < 0){
+    fprintf(2, "ping: connect() failed\n");
+    exit(1);
+  }
+
+  for(int i = 0; i < attempts; i++) {
+    if(write(fd, obuf, strlen(obuf)) < 0){
+      fprintf(2, "ping: send() failed\n");
+      exit(1);
+    }
+  }
+
+  char ibuf[128];
+  int cc = read(fd, ibuf, sizeof(ibuf)-1);
+  if(cc < 0){
+    fprintf(2, "ping: recv() failed\n");
+    exit(1);
+  }
+
+  close(fd);
+  ibuf[cc] = '\0';
+  if(strcmp(ibuf, "this is the host!") != 0){
+    fprintf(2, "ping didn't receive correct payload\n");
+    exit(1);
+  }
+}
+
+// Encode a DNS name
+static void
+encode_qname(char *qn, char *host)
+{
+  char *l = host; 
+  
+  for(char *c = host; c < host+strlen(host)+1; c++) {
+    if(*c == '.') {
+      *qn++ = (char) (c-l);
+      for(char *d = l; d < c; d++) {
+        *qn++ = *d;
+      }
+      l = c+1; // skip .
+    }
+  }
+  *qn = '\0';
+}
+
+// Decode a DNS name
+static void
+decode_qname(char *qn, int max)
+{
+  char *qnMax = qn + max;
+  while(1){
+    if(qn >= qnMax){
+      printf("invalid DNS reply\n");
+      exit(1);
+    }
+    int l = *qn;
+    if(l == 0)
+      break;
+    for(int i = 0; i < l; i++) {
+      *qn = *(qn+1);
+      qn++;
+    }
+    *qn++ = '.';
+  }
+}
+
+// Make a DNS request
+static int
+dns_req(uint8 *obuf)
+{
+  int len = 0;
+  
+  struct dns *hdr = (struct dns *) obuf;
+  hdr->id = htons(6828);
+  hdr->rd = 1;
+  hdr->qdcount = htons(1);
+  
+  len += sizeof(struct dns);
+  
+  // qname part of question
+  char *qname = (char *) (obuf + sizeof(struct dns));
+  char *s = "pdos.csail.mit.edu.";
+  encode_qname(qname, s);
+  len += strlen(qname) + 1;
+
+  // constants part of question
+  struct dns_question *h = (struct dns_question *) (qname+strlen(qname)+1);
+  h->qtype = htons(0x1);
+  h->qclass = htons(0x1);
+
+  len += sizeof(struct dns_question);
+  return len;
+}
+
+// Process DNS response
+static void
+dns_rep(uint8 *ibuf, int cc)
+{
+  struct dns *hdr = (struct dns *) ibuf;
+  int len;
+  char *qname = 0;
+  int record = 0;
+
+  if(cc < sizeof(struct dns)){
+    printf("DNS reply too short\n");
+    exit(1);
+  }
+
+  if(!hdr->qr) {
+    printf("Not a DNS reply for %d\n", ntohs(hdr->id));
+    exit(1);
+  }
+
+  if(hdr->id != htons(6828)){
+    printf("DNS wrong id: %d\n", ntohs(hdr->id));
+    exit(1);
+  }
+  
+  if(hdr->rcode != 0) {
+    printf("DNS rcode error: %x\n", hdr->rcode);
+    exit(1);
+  }
+  
+  //printf("qdcount: %x\n", ntohs(hdr->qdcount));
+  //printf("ancount: %x\n", ntohs(hdr->ancount));
+  //printf("nscount: %x\n", ntohs(hdr->nscount));
+  //printf("arcount: %x\n", ntohs(hdr->arcount));
+  
+  len = sizeof(struct dns);
+
+  for(int i =0; i < ntohs(hdr->qdcount); i++) {
+    char *qn = (char *) (ibuf+len);
+    qname = qn;
+    decode_qname(qn, cc - len);
+    len += strlen(qn)+1;
+    len += sizeof(struct dns_question);
+  }
+
+  for(int i = 0; i < ntohs(hdr->ancount); i++) {
+    if(len >= cc){
+      printf("invalid DNS reply\n");
+      exit(1);
+    }
+    
+    char *qn = (char *) (ibuf+len);
+
+    if((int) qn[0] > 63) {  // compression?
+      qn = (char *)(ibuf+qn[1]);
+      len += 2;
+    } else {
+      decode_qname(qn, cc - len);
+      len += strlen(qn)+1;
+    }
+      
+    struct dns_data *d = (struct dns_data *) (ibuf+len);
+    len += sizeof(struct dns_data);
+    //printf("type %d ttl %d len %d\n", ntohs(d->type), ntohl(d->ttl), ntohs(d->len));
+    if(ntohs(d->type) == ARECORD && ntohs(d->len) == 4) {
+      record = 1;
+      printf("DNS arecord for %s is ", qname ? qname : "" );
+      uint8 *ip = (ibuf+len);
+      printf("%d.%d.%d.%d\n", ip[0], ip[1], ip[2], ip[3]);
+      if(ip[0] != 128 || ip[1] != 52 || ip[2] != 129 || ip[3] != 126) {
+        printf("wrong ip address");
+        exit(1);
+      }
+      len += 4;
+    }
+  }
+
+  // needed for DNS servers with EDNS support
+  for(int i = 0; i < ntohs(hdr->arcount); i++) {
+    char *qn = (char *) (ibuf+len);
+    if(*qn != 0) {
+      printf("invalid name for EDNS\n");
+      exit(1);
+    }
+    len += 1;
+
+    struct dns_data *d = (struct dns_data *) (ibuf+len);
+    len += sizeof(struct dns_data);
+    if(ntohs(d->type) != 41) {
+      printf("invalid type for EDNS\n");
+      exit(1);
+    }
+    len += ntohs(d->len);
+  }
+
+  if(len != cc) {
+    printf("Processed %d data bytes but received %d\n", len, cc);
+    exit(1);
+  }
+  if(!record) {
+    printf("Didn't receive an arecord\n");
+    exit(1);
+  }
+}
+
+static void
+dns()
+{
+  #define N 1000
+  uint8 obuf[N];
+  uint8 ibuf[N];
+  uint32 dst;
+  int fd;
+  int len;
+
+  memset(obuf, 0, N);
+  memset(ibuf, 0, N);
+  
+  // 8.8.8.8: google's name server
+  dst = (8 << 24) | (8 << 16) | (8 << 8) | (8 << 0);
+
+  if((fd = connect(dst, 10000, 53)) < 0){
+    fprintf(2, "ping: connect() failed\n");
+    exit(1);
+  }
+
+  len = dns_req(obuf);
+  
+  if(write(fd, obuf, len) < 0){
+    fprintf(2, "dns: send() failed\n");
+    exit(1);
+  }
+  int cc = read(fd, ibuf, sizeof(ibuf));
+  if(cc < 0){
+    fprintf(2, "dns: recv() failed\n");
+    exit(1);
+  }
+  dns_rep(ibuf, cc);
+
+  close(fd);
+}  
+
+int
+main(int argc, char *argv[])
+{
+  int i, ret;
+  uint16 dport = NET_TESTS_PORT;
+
+  printf("nettests running on port %d\n", dport);
+  
+  printf("testing ping: ");
+  ping(2000, dport, 1);
+  printf("OK\n");
+  
+  printf("testing single-process pings: ");
+  for (i = 0; i < 100; i++)
+    ping(2000, dport, 1);
+  printf("OK\n");
+  
+  printf("testing multi-process pings: ");
+  for (i = 0; i < 10; i++){
+    int pid = fork();
+    if (pid == 0){
+      ping(2000 + i + 1, dport, 1);
+      exit(0);
+    }
+  }
+  for (i = 0; i < 10; i++){
+    wait(&ret);
+    if (ret != 0)
+      exit(1);
+  }
+  printf("OK\n");
+  
+  printf("testing DNS\n");
+  dns();
+  printf("DNS OK\n");
+  
+  printf("all tests passed.\n");
+  exit(0);
+}
diff --git a/user/xargstest.sh b/user/xargstest.sh
new file mode 100644
index 0000000..4362589
--- /dev/null
+++ b/user/xargstest.sh
@@ -0,0 +1,6 @@
+mkdir a
+echo hello > a/b
+mkdir c
+echo hello > c/b
+echo hello > b
+find . b | xargs grep hello