Application Loading

[Andrejus]

Hi,

i want to load user application. I'm at early stage and I don't use multitasking, etc.

So, I don't know what I need.

Now I do those steps:

1. Load application to RAM (I have my own application format, it is modified *.com, at first byte I have jump to code section)

2. Change current EIP register (point to user app):

Code: Select all

; body of an asm(" ... ":"=a" (peip) : "g" (adr)  // new eip value, address of first byte of *.com

       xor %%eax, %%eax
       call jumpme1
       jumpme1:
       popl %%eax
       movl %1, %%eax
       pushl %%eax
       ret

It is right way ?

Thanks

[Pype.Clicker]

it looks to me that most of your code is useless ..

You want to store the value of eax at the end of the code into 'peip' but the code will never reach the line after 'ret' ... the first lines (up to 'popl eax') are pointless as you're trashing the precious "current address" you compute.

Moreover, i think you should have a 'far' return rather than a 'near' return so that you can change the segment for the user code (you're unlikely to want it executed at kernel level, no ?)

[Andrejus_]

this is what i found about far return :
" (Far Return) Copy the word at [SP] into IP and the word at 2[SP] into CS. Then increment SP by (4 + bytecount). "

so, if i have 32 bit long direct address in the memory (adr), i assume that i should do this :
copy value adr >> 16 into 2[SP]
and value adr & 0xffff into [SP]

am i right ?

[Pype.Clicker]

you're reading the documentation for real-mode retf. In protected mode, RETF do

• pop one dword from the stack and loads it into EIP register
• pop one dword from the stack and uses its lowest 16 bits as the new code selector to be loaded in CS
• continue execution at the new CS:EIP address (if protection allows it -- trigger a GPF otherwise)

[Andrejus_]

thank you for your reply.

but what you wrote is how retf works or what?
cause i don't actually understand how to use your advice

thank you.

[Pype.Clicker]

depending on whether you're in real mode (backward-compatibility 16 bits mode used by the BIOS, MS-DOS, etc) or protected mode (native 32 bits mode used by linux, windows, etc), the way RETF works differs. what you described is how RETF works in 16 bits code segment with a 16 bits stack, while i explained how it works in a 32 bits code segment with a 32bits-wide stack.

[Andrejus]

Thank you,
but I still have problem, help me.

I have set up only one CS segment in GDT (length 4GB)
So, i don't need far jump, because i change EIP in the same segment (use it like offest).
change EIP:
__asm__(
"xor %%eax, %%eax\t\n"
"movl %0, %%eax\t\n"
"pushl %%eax\t\n"
"ret\t\n"
:
: "g" (startA)
);

After that i have Page Fault (i use paging, and all pages are mapped as present)

May be my problem is in GDT (code section):

gdtCode: EQU $ - gdt ; // Code Segment
dw 0x0FFFFF
dw 0x0
db 0x0
db 0x9A
db 0xCF
db 0x0

I don't know what is wrong, when I try to change EIP, result is the same - Page Fault.

???

[Pype.Clicker]

if you really have a page fault, then the problem is not in your GDT, but in your page tables. I'm suspicious about the "all my pages are mapped and present" since you're unlikely to have 4GB, some of your pages will be non-present (even if your whole physical memory is mapped

do you have a clue on the EIP and CR3 values when your page fault occur ? I can envision two possible problem causes:

1. your return address is somehow miscomputed and you're returning to void

2. you're returning to the correct address (your user code), but that code is not designed to be run at the location it has and includes references to invalid memory regions. This could be the case if the code was compiled as a legacy application for another OS (i.e. Linux programs are always expecting they'll be loaded at offset 0x8000000 or something, and similar things occur to Windows programs, etc.)

3. some dark wizard at MS-HQ do not like you to be programming an OS and sends negative waves to make your system crash :p

[Andrejus]

Hi,

you have good sence of humour (for Pype).

I use flat memory model (GDT) + paging, all pages are present, supervisor and read/write. (of course my machine don't have 4GB RAM )

for example (address):
0000000001 0000000010 000000000011

but when I allocate user app, i ask my Memory Manager give me some memory space, it returns first address from some 4KB page.
But that address don't have flags (all flags I set to 0),
for example (MM return):
0000000001 0000000010 000000000000 (32 bit address)

so, lowest 12 bits are 0, may be there must be supervisor, present, read/write, and processor automaticali transforms it to offset 0 ?

Thanks

[Andrejus]

When I have page Fault,
I check CR2 register (not present page), it give something near 300MB (such address)

But I jump to 8MB
i jump to address: 0x820000
(it is 3 page dir, and 32 table entry)

Why I get after page fault such strange address (about 300 MB)

???