/* include/memory.h */
   typedef struct {
           memptr_t start;
           memptr_t end;
   
           uint32_t flags;
           uint32_t tag;
   } mempool_t;
      
   /* Kernel permissions flags */
   #define MP_KR		0x0001
   #define MP_KW		0x0002
   #define MP_KX		0x0004
   
   /* Userspace permissions flags */
   #define MP_UR		0x0010
   #define MP_UW		0x0020
   #define MP_UX		0x0040
   
   /* Fpage type */
   #define MP_NO_FPAGE  0x0000		/*! Not mappable */
   #define MP_SRAM      0x0100		/*! Fpage in SRAM: granularity 1 << */
   #define MP_AHB_RAM   0x0200		/*! Fpage in AHB SRAM: granularity 64 words, bit bang mappings */
   #define MP_DEVICES   0x0400		/*! Fpage in AHB/APB0/AHB0: granularity 16 kB */
   #define MP_MEMPOOL   0x0800		/*! Entire mempool is mapped  */
   
   /* Map memory from mempool always (for example text is mapped always because
    * without it thread couldn't run)
    * other fpages mapped on request because we limited in MPU resources)
    */
   #define MP_MAP_ALWAYS 	0x1000
   
   typedef enum {
   	MPT_KERNEL_TEXT,
   	MPT_KERNEL_DATA,
   	MPT_USER_TEXT,
   	MPT_USER_DATA,
   	MPT_AVAILABLE,
   	MPT_DEVICES,
   	MPT_UNKNOWN = -1
   } mempool_tag_t;
   
   #define DECLARE_MEMPOOL(name_, start_, end_, flags_, tag_) \
   {                                                \
           .start = (memptr_t) (start_),                \
           .end  = (memptr_t) (end_),                \
           .flags = flags_,                        \
           .tag = tag_                                \
   }
   
   #define DECLARE_MEMPOOL_2(name, prefix, flags, tag) \
           DECLARE_MEMPOOL(name, &(prefix ## _start), &(prefix ## _end), flags, tag)

   /* kernel/memory.c */
   /**
    * Memory map of MPU.
    * Translated into memdesc array in KIP by memory_init
    */
   static mempool_t memmap[] = {
   	DECLARE_MEMPOOL_2("KTEXT" , kernel_text, MP_KR | MP_KX | MP_NO_FPAGE, MPT_KERNEL_TEXT),
   	DECLARE_MEMPOOL_2("UTEXT" , user_text,   MP_UR | MP_UX | MP_MEMPOOL | MP_MAP_ALWAYS, MPT_USER_TEXT),
   	DECLARE_MEMPOOL_2("KIP"   , kip,         MP_KR | MP_KW | MP_UR | MP_SRAM, MPT_KERNEL_DATA),
   	DECLARE_MEMPOOL("KDATA"   , &kip_end, &kernel_data_end,MP_KR | MP_KW | MP_NO_FPAGE, MPT_KERNEL_DATA),
   	DECLARE_MEMPOOL_2("KBSS"  , kernel_bss,  MP_KR | MP_KW | MP_NO_FPAGE, MPT_KERNEL_DATA),
   	DECLARE_MEMPOOL_2("UDATA" , user_data,   MP_UR | MP_UW | MP_MEMPOOL | MP_MAP_ALWAYS, MPT_USER_DATA),
   	DECLARE_MEMPOOL_2("UBSS"  , user_bss,    MP_UR | MP_UW | MP_MEMPOOL  | MP_MAP_ALWAYS, MPT_USER_DATA),
   	DECLARE_MEMPOOL("MEM0"    , &user_bss_end, 0x2001c000, MP_UR | MP_UW | MP_SRAM, MPT_AVAILABLE),
   #ifdef CONFIG_BITMAP_BITBAND
   	DECLARE_MEMPOOL("KBITMAP" , &bitmap_bitband_start, &bitmap_bitband_end,MP_KR | MP_KW | MP_NO_FPAGE, MPT_KERNEL_DATA),
   #else
   	DECLARE_MEMPOOL("KBITMAP" , &bitmap_start, &bitmap_end,MP_KR | MP_KW | MP_NO_FPAGE, MPT_KERNEL_DATA),
   #endif
   	DECLARE_MEMPOOL("MEM1"     , &kernel_ahb_end, 0x10010000,MP_UR | MP_UW | MP_AHB_RAM, MPT_AVAILABLE),
   	DECLARE_MEMPOOL("APB1DEV"  , 0x40000000, 0x40007800,MP_UR | MP_UW | MP_DEVICES, MPT_DEVICES),
   	DECLARE_MEMPOOL("APB2_1DEV", 0x40010000, 0x40013400,MP_UR | MP_UW | MP_DEVICES, MPT_DEVICES),
   	DECLARE_MEMPOOL("APB2_2DEV", 0x40014000, 0x40014c00,MP_UR | MP_UW | MP_DEVICES, MPT_DEVICES),
   	DECLARE_MEMPOOL("AHB1_1DEV", 0x40020000, 0x40022400,MP_UR | MP_UW | MP_DEVICES, MPT_DEVICES),
   	DECLARE_MEMPOOL("AHB1_2DEV", 0x40023c00, 0x40040000,MP_UR | MP_UW | MP_DEVICES, MPT_DEVICES),
   	DECLARE_MEMPOOL("AHB2DEV"  , 0x50000000, 0x50061000,MP_UR | MP_UW | MP_DEVICES, MPT_DEVICES),
   	DECLARE_MEMPOOL("AHB3DEV"  , 0x60000000, 0xA0001000,MP_UR | MP_UW | MP_DEVICES, MPT_DEVICES),
   };
   
   // 如果addr落在size當中，則會將addr加上size對齊，不過不須對齊的情況應該直接return addr就好
   static memptr_t addr_align(memptr_t addr, size_t size)
   {
   	if (addr & (size - 1))
   		return (addr & ~(size - 1)) + size;
   	return (addr & ~(size - 1));
   }
   
   void memory_init()
   {
   	int i = 0, j = 0;
   	uint32_t *shcsr = (uint32_t *) 0xE000ED24;
   
   	fpages_init();
   
   	ktable_init(&as_table);
   
   	mem_desc = (kip_mem_desc_t *) kip_extra;
   
   	/* Initialize mempool table in KIP */
   	for (i = 0; i < sizeof(memmap) / sizeof(mempool_t); ++i) {
   		switch (memmap[i].tag) {
   		case MPT_USER_DATA:
   		case MPT_USER_TEXT:
   		case MPT_DEVICES:
   		case MPT_AVAILABLE:
   			mem_desc[j].base = addr_align((memmap[i].start), CONFIG_SMALLEST_FPAGE_SIZE) | i;
   			mem_desc[j].size = addr_align((memmap[i].end - memmap[i].start), CONFIG_SMALLEST_FPAGE_SIZE) | memmap[i].tag;
   			j++;
   			break;
   		}
   	}
   
        // memory_desc_ptr需要存的是從kip到mem_desc的offset
   	kip.memory_info.s.memory_desc_ptr = ((void *) mem_desc) - ((void *) &kip);
   	kip.memory_info.s.n = j;
   
   	*shcsr |= 1 << 16;	/* Enable memfault */
   }   
   
   INIT_HOOK(memory_init, INIT_LEVEL_KERNEL_EARLY);

   /* include/fpage.h */
   struct fpage {
   	struct fpage *as_next;
   	struct fpage *map_next;
   	struct fpage *mpu_next;
   
   	union {
   		struct {
   			uint32_t base;
   			uint32_t mpid : 6;
   			uint32_t flags : 6;
   			uint32_t shift : 16;
   			uint32_t rwx : 4;
   		} fpage;
   		uint32_t raw[2];
   	};
   };

   typedef struct fpage fpage_t;

   /* kernel/fpage.c */
   static int fp_addr_log2(memptr_t addr)
   {
   	int shift = 0;
   
   	while ((addr <<= 1) != 0)
   		++shift;
   
   	return 31 - shift;
   }
   
   static fpage_t *create_fpage(memptr_t base, size_t shift, int mpid)
   {
   	fpage_t *fpage = (fpage_t *) ktable_alloc(&fpage_table);
   
   	assert(fpage != NULL);
   
   	fpage->as_next = NULL;
   	fpage->map_next = fpage; 	/* That is first fpage in mapping */
   	fpage->mpu_next = NULL;
   	fpage->fpage.mpid = mpid;
   	fpage->fpage.flags = 0;
   	fpage->fpage.rwx = MP_USER_PERM(mempool_getbyid(mpid)->flags);
   
   	fpage->fpage.base = base;
   	fpage->fpage.shift = shift;
   
   	if (mempool_getbyid(mpid)->flags & MP_MAP_ALWAYS)
   		fpage->fpage.flags |= FPAGE_ALWAYS;
   
   	return fpage;
   }

   static void create_fpage_chain(memptr_t base, size_t size, int mpid, fpage_t **pfirst, fpage_t **plast)
   {
   	int shift, sshift, bshift;
   	fpage_t *fpage = NULL;
   
   	while (size) {
   		/* Select least of log2(base), log2(size). Needed to make regions with correct align */
   		bshift = fp_addr_log2(base);
   		sshift = fp_addr_log2(size);
   
   		shift = ((1 << bshift) > size) ? sshift : bshift;
   
   		if (!*pfirst) {
   			/* Create first page */
   			fpage = create_fpage(base, shift, mpid);
   			*pfirst = fpage;
   			*plast = fpage;
   		} else {
   			/* Build chain */
   			fpage->as_next = create_fpage(base, shift, mpid);
   			fpage = fpage->as_next;
   			*plast = fpage;
   		}
   
   		size -= (1 << shift);
   		base += (1 << shift);
   	}
    }
    
    /********************** Example *************************
    Base 0x60000000 0110 0000 0000 0000 0000 0000 0000 0000
    End  0xA0001000 1010 0000 0000 0000 0001 0000 0000 0000
    Size 0x40001000 0100 0000 0000 0000 0001 0000 0000 0000
    
    1.
    Base 0x60000000 0110 0000 0000 0000 0000 0000 0000 0000
    Size 0x40001000 0100 0000 0000 0000 0001 0000 0000 0000
    2^Log2(Base) < Size => Create a fpage with 2^Log2(Base)
    Base = 0x60000000 + 0x20000000 = 0x80000000
    
    2.
    Base 0x80000000 1000 0000 0000 0000 0000 0000 0000 0000
    Size 0x20001000 0010 0000 0000 0000 0001 0000 0000 0000
    2^Log2(Base) > Size => Create a fpage with 2^Log2(Size)
    Base = 0x80000000 + 0x00001000 = 0x80001000
    
    3.
    Base 0x80001000 1000 0000 0000 0000 0001 0000 0000 0000
    Size 0x20000000 0010 0000 0000 0000 0000 0000 0000 0000
    2^Log2(Base) < Size => Create a fpage with 2^Log2(Base)
    Base = 0x80001000 + 0x00001000 = 0x80010000
    *******************************************************/

   int assign_fpages_ext(int mpid, as_t *as, memptr_t base, size_t size, fpage_t **pfirst, fpage_t **plast)
   {
   	fpage_t **fp;
   	memptr_t  end;
   
   	if (size <= 0)
   		return -1;
   
   	/* if mpid is unknown, search using base addr */
   	if (mpid == -1) {
   		if ((mpid = mempool_search(base, size)) == -1) {
   			/* Cannot find appropriate mempool, return error */
   			return -1;
   		}
   	}
   
   	end = base + size;
   
   	if (as) {
   		/* find unmapped space */
   		fp = &as->first;
   		while (base < end && *fp) {
   			if (base < FPAGE_BASE(*fp)) {
   				fpage_t *first = NULL, *last = NULL;
   				size = (end < FPAGE_BASE(*fp) ? end : FPAGE_BASE(*fp)) - base;

   				create_fpage_chain(mempool_align(mpid, base),
   				                   mempool_align(mpid, size),
   				                   mpid, &first, &last);
   
   				last->as_next = *fp;
   				*fp = first;
   				fp = &last->as_next;
   
   				if (!*pfirst)
   					*pfirst = first;
   				*plast = last;
   
   				base = FPAGE_END(*fp);
   			} else if (base < FPAGE_END(*fp)) {
   				if (!*pfirst)
   					*pfirst = *fp;
   				*plast = *fp;
   
   				base = FPAGE_END(*fp);
   			}
   
   			fp = &(*fp)->as_next;
   		}
   
   		if (base < end) {
   			fpage_t *first = NULL, *last = NULL;
   			size = end - base;
   
   			create_fpage_chain(mempool_align(mpid, base),
   			                   mempool_align(mpid, size),
   			                   mpid, &first, &last);
   
   			*fp = first;
   
   			if (!*pfirst)
   				*pfirst = first;
   			*plast = last;
   		}
   	} else {
   		create_fpage_chain(mempool_align(mpid, base),
   		                   mempool_align(mpid, size),
   		                   mpid, pfirst, plast);
   	}
   
   	return 0;
   }

   int assign_fpages(as_t *as, memptr_t base, size_t size)
   {
   	fpage_t *first = NULL, *last = NULL;
   	return assign_fpages_ext(-1, as, base, size, &first, &last);
   }

   /* include/memory.h */
   typedef struct {
   	uint32_t as_spaceid;	/*! Space Identifier */
   	struct fpage *first;	/*! head of fpage list */
   
   	struct fpage *mpu_first;	/*! head of MPU fpage list */
   	struct fpage *mpu_stack_first;	/*! head of MPU stack fpage list */
   	uint32_t shared;	/*! shared user number */
   } as_t;

   /* kernel/memory.c */
   void as_map_user(as_t *as)
   {
   	int i;
   
   	for (i = 0; i < sizeof(memmap) / sizeof(mempool_t); ++i) {
   		switch (memmap[i].tag) {
   		case MPT_USER_DATA:
   		case MPT_USER_TEXT:
   			/* Create fpages only for user text and user data */
   			assign_fpages(as, memmap[i].start, (memmap[i].end - memmap[i].start));
   		}
   	}
   }

    int map_area(as_t *src, as_t *dst, memptr_t base, size_t size, map_action_t action, int is_priviliged)
    {
    	memptr_t end = base + size, probe = base;
    	fpage_t *fp = src->first, *first = NULL, *last = NULL;
    	int last_invalid = 0;
    
    	/* For priviliged thread (ROOT), we use shadowed mapping,
    	 * so first we will check if that fpages exist and then
    	 * create them.
    	 */
    
    	if (is_priviliged) {
    		assign_fpages_ext(-1, src, base, size, &first, &last);
    		if (src == dst) {
    			/* Maps to itself, ignore other actions */
    			return 0;
    		}
    	} else {
    		if (src == dst) {
    			/* Maps to itself, ignore other actions */
    			return 0;
    		}

    		while (fp) {
    			if (!first && addr_in_fpage(base, fp, 0)) {
    				first = fp;
    			}
    
    			if (!last && addr_in_fpage(end, fp, 1)) {
    				last = fp;
    				break;
    			}
    
    			if (first) {
    				/* Check weather if addresses in fpage list
    				 * are sequental
    				 */
    				if (!addr_in_fpage(probe, fp, 1))
    					return -1;
    
    				probe += (1 << fp->fpage.shift);
    			}
    
    			fp = fp->as_next;
    		}
    	}
    
    	if (!last || !first) {
    		/* Not in address space or error */
    		return -1;
    	}
    
    	if (first == last)
    		last_invalid = 1;
    
    	/* That is a problem because we should split
    	 * fpages into two (and split all mappings too)
    	 */
    
    	first = split_fpage(src, first, base, 1);
    
    	/* If first and last were same pages, after first split,
    	 * last fpage will be invalidated, so we search it again
    	 */
    	if (last_invalid) {
    		fp = first;
    		while (fp) {
    			if (addr_in_fpage(end, fp, 1)) {
    				last = fp;
    				break;
    			}
    			fp = fp->as_next;
    		}
    	}
    
    	last  = split_fpage(src, last, end, 0);
    
    	if (!last || !first) {
    		/* Splitting not supported for mapped pages */
    		/* UNIMPLIMENTED */
    		return -1;
    	}
    
    	/* Map chain of fpages */
    
    	fp = first;
    	while (fp != last) {
    		map_fpage(src, dst, fp, action);
    		fp = fp->as_next;
    	}
    	map_fpage(src, dst, fp, action);
    
    	return 0;
    }

    /* kernel/memory.c */
    void as_setup_mpu(as_t *as, memptr_t sp, memptr_t pc, memptr_t stack_base, size_t stack_size)
    {
    	fpage_t *mpu[8] = {NULL};
    	fpage_t *fp;
    	int mpu_first_i;
    	int i, j;
    
    	fpage_t *mpu_stack_first = NULL;
    	memptr_t start = stack_base;
    	memptr_t end = stack_base + stack_size;
    
    	/* 找到 stack 是在哪些 fpage 中，並且把這些 fpage 放到 mpu 陣列中 */
    	fp = as->first;
    	i = 0;
    	while (i < 8 && fp != NULL && start < end) {
    		if (addr_in_fpage(start, fp, 0)) {
    			if (!mpu_stack_first)
    				mpu_stack_first = fp;
    
    			mpu[i++] = fp;
    			start = FPAGE_END(fp);
    		}
    		fp = fp->as_next;
    	}
    
    	as->mpu_stack_first = mpu_stack_first;
    	mpu_first_i = i;
    
    	/*
    	 * 如果還沒有設定過mpu，則掃過整個 fpage 序列，並將他們分成下面三類，最後依照順序串成一列放到 as->mpu_first
    	 * mpu_fp[0] are pc
    	 * mpu_fp[1] are always-mapped fpages
    	 * mpu_fp[2] are others
    	 */
    	fp = as->mpu_first;
    	if (fp == NULL) {
    		fpage_t *mpu_first[3] = {NULL};
    		fpage_t *mpu_fp[3] = {NULL};
    
    		fp = as->first;
    		while (fp != NULL) {
    			int priv = 2;
    
    			if (addr_in_fpage(pc, fp, 0)) {
    				priv = 0;
    			} else if (fp->fpage.flags & FPAGE_ALWAYS) {
    				priv = 1;
    			}
    
    			if (mpu_first[priv] == NULL) {
    				mpu_first[priv] = fp;
    				mpu_fp[priv] = fp;
    			} else {
    				mpu_fp[priv]->mpu_next = fp;
    				mpu_fp[priv] = fp;
    			}
    
    			fp = fp->as_next;
    		}
    
    		if (mpu_first[1]) {
    			mpu_fp[1]->mpu_next = mpu_first[2];
    		} else {
    			mpu_first[1] = mpu_first[2];
    		}
    		if (mpu_first[0]) {
    			mpu_fp[0]->mpu_next = mpu_first[1];
    		} else {
    			mpu_first[0] = mpu_first[1];
    		}
    		as->mpu_first = mpu_first[0];
    	}
    
    	/* 將剩下的 fpage 放到 mpu 中，因為 stack 的 fpage 已經放過了，所以要忽略 */
    	for (fp = as->mpu_first; i < 8 && fp != NULL; fp = fp->mpu_next) {
    		for (j = 0; j < mpu_first_i; j++) {
    			if (fp == mpu[j]) {
    				break;
    			}
    		}
    
    		if (j == mpu_first_i) {
    			mpu[i++] = fp;
    		}
    	}
    
    	/* 設定 mpu_first 為第一個非 stack 的 fpage */
    	as->mpu_first = mpu[mpu_first_i];
    
    	/* Setup MPU stack regions */
    	for (j = 0; j < mpu_first_i; ++j) {
    		mpu_setup_region(j, mpu[j]);
    
    		if (j < mpu_first_i - 1)
    			mpu[j]->mpu_next = mpu[j + 1];
    		else
    			mpu[j]->mpu_next = NULL;
    	}
    
    	/* Setup MPU fifo regions */
    	for (; j < i; ++j) {
    		mpu_setup_region(j, mpu[j]);
    
    		if (j < i - 1)
    			mpu[j]->mpu_next = mpu[j + 1];
    	}
    
    	/* Clean unused MPU regions */
    	for (; j < 8; ++j) {
    		mpu_setup_region(j, NULL);
    	}
    }

    /* include/platform/irq.h */
    #define request_schedule()						\
    	do { *SCB_ICSR |= SCB_ICSR_PENDSVSET; } while (0)

    /* include/platform/irq.h */
    // 這邊為了簡化觀察，省略了 FPU 的部份
    #define irq_save(ctx)                                                 \
    	__asm__ __volatile__ ("cpsid i");                                 \
    	__asm__ __volatile__ ("mov r0, %0" : : "r" ((ctx)->regs) : "r0"); \
    	__asm__ __volatile__ ("stm r0, {r4-r11}");                        \
    	__asm__ __volatile__ ("and r4, lr, 0xf":::"r4");                  \
    	__asm__ __volatile__ ("teq r4, #0x9");                            \
    	__asm__ __volatile__ ("ite eq");                                  \
    	__asm__ __volatile__ ("mrseq r0, msp"::: "r0");                   \
    	__asm__ __volatile__ ("mrsne r0, psp"::: "r0");                   \
    	__asm__ __volatile__ ("mov %0, r0" : "=r" ((ctx)->sp));           \
    	__asm__ __volatile__ ("mov %0, lr" : "=r" ((ctx)->ret));
    
    #define irq_restore(ctx) \
    	__asm__ __volatile__ ("mov lr, %0" : : "r" ((ctx)->ret));        \
    	__asm__ __volatile__ ("mov r0, %0" : : "r" ((ctx)->sp));         \
    	__asm__ __volatile__ ("mov r2, %0" : : "r" ((ctx)->ctl));        \
    	__asm__ __volatile__ ("and r4, lr, 0xf":::"r4");                 \
    	__asm__ __volatile__ ("teq r4, #0x9");                           \
    	__asm__ __volatile__ ("ite eq");                                 \
    	__asm__ __volatile__ ("msreq msp, r0");                          \
    	__asm__ __volatile__ ("msrne psp, r0");                          \
    	__asm__ __volatile__ ("mov r0, %0" : : "r" ((ctx)->regs));       \
    	__asm__ __volatile__ ("ldm r0, {r4-r11}");                       \
    	__asm__ __volatile__ ("msr control, r2");                        \
    	__asm__ __volatile__ ("cpsie i");

    /* platform/irq.c */
    // 這邊我直接將巨集展開，方便觀察
    extern volatile tcb_t *current;
    
    void pendsv_handler(void) __NAKED;
    void pendsv_handler(void)
    {
    	__asm__ __volatile__ ("push {lr}");
    
    	register tcb_t *sel;                                        
    	sel = schedule_select();                                
    	if (sel != current) {                                       
    		__asm__ __volatile__ ("pop {lr}");                        
    		irq_save(&(current)->ctx);                                        
    		thread_switch((sel));                                        
    		irq_restore(&(current)->ctx);                                
    		__asm__ __volatile__ ("bx lr");  
    	}
    
    	__asm__ __volatile__ ("pop {lr}");                                
    	__asm__ __volatile__ ("bx lr");
    }
    
    /* kernel/thread.c */
    void thread_switch(tcb_t *thr)
    {
    	assert(thr != NULL);
    	assert(thread_isrunnable(thr));
    
    	current = thr;
    	current_utcb = thr->utcb;
    	if (current->as)
    		as_setup_mpu(current->as, current->ctx.sp, ((uint32_t*)current->ctx.sp)[REG_PC], current->stack_base, current->stack_size);
    }

    /* include/platform/irq.h */
    // 為了觀察方便，將內部的巨集展開
    #define IRQ_HANDLER(name, sub)                                      \
    	void name(void) __NAKED;                                        \
    	void name(void)                                                 \
    	{                                                               \
    		__asm__ __volatile__ ("push {lr}");                     \
    		sub();                                                  \
    		do { *SCB_ICSR |= SCB_ICSR_PENDSVSET; } while (0)       \
    		__asm__ __volatile__ ("pop {lr}");                      \
    		__asm__ __volatile__ ("bx lr");                         \
    	}

    $ grep IRQ_HANDLER kernel/* platform/* platform/stm32f4/*
    kernel/ktimer.c:IRQ_HANDLER(ktimer_handler, __ktimer_handler);
    kernel/syscall.c:IRQ_HANDLER(svc_handler, __svc_handler);
    platform/debug_uart.c:IRQ_HANDLER(BOARD_UART_HANDLER, __uart_irq_handler);
    platform/stm32f4/mpu.c:IRQ_HANDLER(memmanage_handler, __memmanage_handler);

   /* FPB Flash Patch and Breakpoint unit Registers */
   #define FPB_MAX_COMP        6
   #define FPB_BASE        (uint32_t) (0xE0002000)
   #define FPB_CTRL        (volatile uint32_t *) (FPB_BASE)
   #define FPB_REMAP       (volatile uint32_t *) (FPB_BASE + 0x04)
   #define FPB_COMP        (volatile uint32_t *) (FPB_BASE + 0x08)

   BKPT #imm

   //platform/breakpoint-hard.c
   void hard_breakpoint_pool_init(void)
   {
      ...
      /* Enable DWT watchpoint & DebugMon exception */
      *DCB_DEMCR |= DCB_DEMCR_TRCENA | DCB_DEMCR_MON_EN;
      ...
   }

   /* include/platform/mpu.h */
   #define MPU_BASE_ADDR                0xE000ED9C
   #define MPU_ATTR_ADDR                0xE000EDA0
   #define MPU_CTRL_ADDR                0xE000ED94
   #define MPU_RNR_ADDR                 0xE000ED98

   #define MPU_REGION_MASK              0xFFFFFFE0

   /* platform/stm32f4/mpu.c */
   void mpu_setup_region(int n, fpage_t *fp)
   {
           static uint32_t *mpu_base = (uint32_t *) MPU_BASE_ADDR;
           static uint32_t *mpu_attr = (uint32_t *) MPU_ATTR_ADDR;
   
           if (fp) {
                   *mpu_base = (FPAGE_BASE(fp) & MPU_REGION_MASK) | 0x10 | (n & 0xF);
                   *mpu_attr = ((mempool_getbyid(fp->fpage.mpid)->flags & MP_UX) ?
                                0 :
                                (1 << 28)) |        /* XN bit */
                               (0x3 << 24) /* Full access */ |
                               ((fp->fpage.shift - 1) << 1) /* Region */ |
                               1 /* Enable */;
           } else {
                   /* Clean MPU region */
                   *mpu_base = 0x10 | (n & 0xF);
                   *mpu_attr = 0;
           }
   }

   /* platform/stm32f4/mpu.c */
   void mpu_enable(mpu_state_t i)
   {
           static uint32_t *mpu_ctrl = (uint32_t*) MPU_CTRL_ADDR;
   
           *mpu_ctrl = i | MPU_PRIVDEFENA;
   }

   /* platform/stm32f4/mpu.c */
   int addr_in_mpu(uint32_t addr)
   {
           static uint32_t *mpu_rnr = (uint32_t *) MPU_RNR_ADDR;
           static uint32_t *mpu_base = (uint32_t *) MPU_BASE_ADDR;
           static uint32_t *mpu_attr = (uint32_t *) MPU_ATTR_ADDR;
           int i;
   
           for (i = 0; i < 8; ++i) {
                   *mpu_rnr = i;
                   if (*mpu_attr & 0x1) {
                           uint32_t base = *mpu_base & MPU_REGION_MASK;
                           uint32_t size = 1 << (((*mpu_attr >> 1) & 0x1F) + 1);
                           if (addr >= base && addr < base + size)
                                   return 1;
                   }
           }
           
           return 0;
   }

    /* include/platform/mpu.h */
    #define MPU_FAULT_STATUS_ADDR	0xE000ED28
    #define MPU_FAULT_ADDRESS_ADDR	0xE000ED34
    
    #define MPU_MEM_FAULT		0x80
    #define MPU_MSTKERR		0x10
    #define MPU_MUSTKERR		0x08
    #define MPU_DACCVIOL		0x02
    #define MPU_IACCVIOL		0x01
    
    /* platform/stm32f4/mpu.c */
    void __memmanage_handler(void)
    {
    	uint32_t mmsr = *((uint32_t *) MPU_FAULT_STATUS_ADDR);
    	uint32_t mmar = *((uint32_t *) MPU_FAULT_ADDRESS_ADDR);
    	tcb_t *current = thread_current();
    
    	/* stack errors */
    	if (mmsr & MPU_MSTKERR) {
    		panic("Corrupted Stack, current = %t, psp = %p\n", current->t_globalid, PSP());
    	}
    
    	if (mmsr & MPU_MEM_FAULT) {
    		if (mpu_select_lru(current->as, mmar) == 0)
    			goto ok;
    	}
    
    	/* unstacking errors */
    	if (mmsr & MPU_MUSTKERR) {
    		/* Processor is not writing mmar, so we do it manually */
    		if (mpu_select_lru(current->as, (uint32_t)PSP() + 31) == 0) {
    			goto ok;
    		}
    	}
    
    	if (mmsr & MPU_IACCVIOL) {
    		uint32_t pc = PSP()[REG_PC];
    
    		if (mpu_select_lru(current->as, pc) == 0)
    			goto ok;
    
    		if (mpu_select_lru(current->as, pc + 2) == 0)
    			goto ok;
    	}
    
    	mpu_dump();
    	panic("Memory fault mmsr:%p, mmar:%p,\n current:%t, psp:%p, pc:%p\n", mmsr, mmar, current->t_globalid, PSP(), PSP()[REG_PC]);
    
    ok:
    	/* Clean status register */
    	*((uint32_t *) MPU_FAULT_STATUS_ADDR) = mmsr;
    	return;
    }
    
    int mpu_select_lru(as_t *as, uint32_t addr)
    {
    	fpage_t *fp = NULL;
    	int i;
    
    	/* Kernel fault? */
    	if (as == NULL)
    		return 1;
    
    	if (addr_in_mpu(addr))
    		return 1;
    
    	fp = as->first;
    	while (fp) {
    		if (addr_in_fpage(addr, fp, 0)) {
    			fpage_t *sfp = as->mpu_stack_first;
    
    			fp->mpu_next = as->mpu_first;
    			as->mpu_first = fp;
    
    			/* Get first avalible MPU index */
    			i = 0;
    			while (sfp != NULL) {
    				++i;
    				sfp = sfp->mpu_next;
    			}
    
    			/* Update MPU */
    			mpu_setup_region(i++, fp);
    
    			while (i < 8 && fp->mpu_next != NULL) {
    				mpu_setup_region(i++, fp->mpu_next);
    				fp = fp->mpu_next;
    			}
    
    			return 0;
    		}
    
    		fp = fp->as_next;
    	}
    	return 1;
    }

   //user/include/l4/platform/vregs.h
   register L4_Word32_t __L4_MR0 asm ("r4");
   register L4_Word32_t __L4_MR1 asm ("r5");
   register L4_Word32_t __L4_MR2 asm ("r6");
   register L4_Word32_t __L4_MR3 asm ("r7");
   register L4_Word32_t __L4_MR4 asm ("r8");
   register L4_Word32_t __L4_MR5 asm ("r9");
   register L4_Word32_t __L4_MR6 asm ("r10");
   register L4_Word32_t __L4_MR7 asm ("r11");
   
   //include/ipc.h
   static uint32_t ipc_read_mr(tcb_t *from, int i)
   {
      // 可以發現 8以下的mr屬於ctx裡的regs
      if (i >= 8)
         return from->utcb->mr[i - 8];
      return from->ctx.regs[i];
   }

   //include/l4/ipc.h
   typedef union {
      struct {
       /* Number of words */
         uint32_t n_untyped : 6;
         uint32_t n_typed : 6;
         uint32_t prop       : 1;
         uint32_t reserved   : 3;    /* Type of operation */
         uint16_t label;
      } s;
      uint32_t raw;
   } ipc_msg_tag_t;

   //user/apps/pingpong/main.c
   void __USER_TEXT pong_thread(void)
   {
      ...
      while(1) {
         msgtag = L4_Receive(threads[PING_THREAD]);
         L4_MsgStore(msgtag, &msg);
        }
    }

   //user/include/l4/ipc.h
   L4_INLINE L4_MsgTag_t L4_Receive(L4_ThreadId_t from)
   {
      /* call L4_Receive_Timeout with no timeout */
      return L4_Receive_Timeout(from, L4_Never);
   }

   L4_INLINE L4_MsgTag_t L4_Receive_Timeout(L4_ThreadId_t from, L4_Time_t RcvTimeout)
   {
      L4_ThreadId_t dummy;
      /* 
         Call L4_Ipc, the reason that using another function call is 
         ipc required syscall, and it's different with different hw, so
         using another function call to separate the hw-dependent and 
         not-hw-dependent codes.
      */
      return L4_Ipc(L4_nilthread, from, (L4_Word_t) RcvTimeout.raw, &dummy);
   }

   // user/lib/l4/platform/syscalls.c
   L4_MsgTag_t L4_Ipc(L4_ThreadId_t to, L4_ThreadId_t FromSpecifier, L4_Word_t Timeouts, L4_ThreadId_t *from)
   {
      L4_MsgTag_t result;
      L4_ThreadId_t from_ret;
      __asm__ __volatile__(
         "svc %[syscall_num]\n"
         "str r0, %[from]\n"
         : [from] "=m"(from_ret)
         : [syscall_num] "i"(SYS_IPC));
      result.raw = __L4_MR0;
      if (from != NULL)
         *from = from_ret;
      return result;
   }

   //kernel/ipc.c
   void sys_ipc(uint32_t *param1)
   {
      /* TODO: Checking of recv-mask */
      tcb_t *to_thr = NULL;
      l4_thread_t to_tid = param1[REG_R0], from_tid = param1[REG_R1];
      uint32_t timeout = param1[REG_R2]; 
      /* 所以從 R0 讀取 to_tid, R1 讀取 from_tid, R2 讀取 Timeout */

      /* 當 to_tid == L4_NILTHREAD 時候，表示说不發送资料，只是等待接收 */
      if (to_tid == L4_NILTHREAD && timeout) { /* Timeout/Sleep */
         ipc_time_t t = { .raw = timeout };
         caller->state = T_INACTIVE;
         ktimer_event_create((t.period.m << t.period.e) /
                         ((1000000)/(CORE_CLOCK/CONFIG_KTIMER_HEARTBEAT)), /* millisec to ticks */
                         ipc_timeout, caller);
         return;
      }

      /* 當 to_tid != L4_NILTHREAD, 就是要發送资料 */
      if (to_tid != L4_NILTHREAD) {
         to_thr = thread_by_globalid(to_tid);
         if (to_tid == TID_TO_GLOBALID(THREAD_LOG)) {
            user_log(caller);
            caller->state = T_RUNNABLE;
            return;
         } else if ((to_thr && to_thr->state == T_RECV_BLOCKED) || to_tid == caller->t_globalid) {
           /* 這邊要礭定 to_thr 的狀态是在等待接收才可以傳送 */

           /* To thread who is waiting for us or sends to myself */
            do_ipc(caller, to_thr);
            return;

         } else if (to_thr && to_thr->state == T_INACTIVE && GLOBALID_TO_TID(to_thr->utcb->t_pager) == GLOBALID_TO_TID(caller->t_globalid)) {
            /* 如果thread狀态是 T_INACTIVE, 則啟動它 */

            if (ipc_read_mr(caller, 0) == 0x00000003) {
                 /* thread start protocol */
                memptr_t sp = ipc_read_mr(caller, 2);
                size_t stack_size = ipc_read_mr(caller, 3);
                dbg_printf(DL_IPC, "IPC: %t thread start\n", to_tid);
                to_thr->stack_base = sp - stack_size;
                to_thr->stack_size = stack_size;
                thread_init_ctx((void *) sp, (void *) ipc_read_mr(caller, 1), to_thr);
                caller->state = T_RUNNABLE;
               /* Start thread */
                to_thr->state = T_RUNNABLE;
                return;
          } else  {
            /* 如果没有任何 thread在等待接收，則讓自己進入等待發送階段 */

            /* No waiting, block myself */
             caller->state = T_SEND_BLOCKED;
             caller->utcb->intended_receiver = to_tid;
             dbg_printf(DL_IPC, "IPC: %t sending\n", caller->t_globalid);
             return;
          }
      }

      /* 如果 from_tid == L4_NILTHREAD， 就是不接收资料 */
      if (from_tid != L4_NILTHREAD) {
        /* Only receive phases, simply lock myself */
         caller->state = T_RECV_BLOCKED;
         /* 進入等待接收階段 */
         caller->ipc_from = from_tid;
         /* 設定等待的目標 */
         dbg_printf(DL_IPC, "IPC: %t receiving\n", caller->t_globalid);
         return;
      }

      caller->state = T_SEND_BLOCKED;
   }

   //kernel/ipc.c
   static void do_ipc(tcb_t *from, tcb_t *to)
   {
     ipc_msg_tag_t tag;
        ...
     /* 先讀取 tag */
     tag.raw = ipc_read_mr(from, 0);
        ...
     ipc_write_mr(to, 0，tag.raw);

     /* Copy untyped words，透過 tag 可以知道 untyped word 的數量 */
     for (untyped_idx = 1; untyped_idx < untyped_last; ++untyped_idx) {
        ipc_write_mr(to, untyped_idx, ipc_read_mr(from, untyped_idx));
     }

     typed_item_idx = -1;
     /* Copy typed words，同樣透過 tag 可以知道 typed words 數量
      * FSM: j - number of byte */
     for (typed_idx = untyped_idx; typed_idx < typed_last; ++typed_idx) {
        uint32_t mr_data = ipc_read_mr(from, typed_idx);

      /* Write typed mr data to 'to' thread */
        ipc_write_mr(to, typed_idx, mr_data);
        if (typed_item_idx == -1) {
        /* If typed_item_idx == -1 - read typed item's tag */
           typed_item.raw = mr_data;
           ++typed_item_idx;
        } else if (typed_item.s.header & IPC_TI_MAP_GRANT) {
           /* MapItem / GrantItem have 1xxx in header */

            typed_data = mr_data;
           /* Map/Grant action */
            map_area(from->as, to->as, typed_item.raw & 0xFFFFFFC0, typed_data & 0xFFFFFFC0,
                     (typed_item.s.header & IPC_TI_GRANT) ? GRANT : MAP, thread_ispriviliged(from));

           /* Read tag for next word */
           typed_item_idx = -1;
        }
          /* TODO: StringItem support */

     }
    /* It checked if to and from stack pointer is not available */
     if (!to->ctx.sp || !from->ctx.sp) {
        caller->state = T_RUNNABLE;
        return;
     }

     to->utcb->sender = from->t_globalid;
    /* to->state 從 T_RECV_BLOCKED 更改為 T_RUNNABLE */
     to->state = T_RUNNABLE;
    /* Reset ipc_from */
     to->ipc_from = L4_NILTHREAD;
     ((uint32_t*)to->ctx.sp)[REG_R0] = from->t_globalid;

    /* If from has receive phases, lock myself */
     from_recv_tid = ((uint32_t*)from->ctx.sp)[REG_R1];
     if (from_recv_tid == L4_NILTHREAD) {
        from->state = T_RUNNABLE;
     } else {
    /* 如果準備接收，更改狀態，並且透過 ipc_from 指明等待對象 */
        from->state = T_RECV_BLOCKED;
        from->ipc_from = from_recv_tid;
        dbg_printf(DL_IPC, "IPC: %t receiving\n", from->t_globalid);
     }
       ...
   }

   // kernel/start.c : main()
   ktimer_event_create(64, ipc_deliver, NULL);

   //user/include/l4/message.h
   typedef union {
      L4_Word_t raw[__L4_NUM_MRS];
      L4_Word_t msg[__L4_NUM_MRS];
      L4_MsgTag_t tag;
   } L4_Msg_t;

   static void __USER_TEXT start_thread(L4_ThreadId_t t, L4_Word_t ip, L4_Word_t sp, L4_Word_t stack_size)
   {
      L4_Msg_t msg;
      L4_MsgClear(&msg);
      L4_MsgAppendWord(&msg, ip);
      L4_MsgAppendWord(&msg, sp);
      L4_MsgAppendWord(&msg, stack_size);
      L4_MsgLoad(&msg);
      L4_Send(t);
   }

   //user/include/l4/message.h
   L4_INLINE void L4_MsgLoad (L4_Msg_t *msg)
   {
    /* 同樣為了分隔硬體相關和非硬體相關的程式碼 */
      L4_LoadMRs(0, msg->tag.X.u + msg->tag.X.t + 1, &msg->msg[0]);
   }

   //user/include/l4/platform/vregs.h
   L4_INLINE void L4_LoadMRs(int i, int k, L4_Word_t *w)
   {
      if (i < 0 || k <= 0 || i + k > __L4_NUM_MRS)
         return;
      switch (i) {
         case 0: __L4_MR0 = *w++; if (--k <= 0) break;
         case 1: __L4_MR1 = *w++; if (--k <= 0) break;
         case 2: __L4_MR2 = *w++; if (--k <= 0) break;
         case 3: __L4_MR3 = *w++; if (--k <= 0) break;
         case 4: __L4_MR4 = *w++; if (--k <= 0) break;
         case 5: __L4_MR5 = *w++; if (--k <= 0) break;
         case 6: __L4_MR6 = *w++; if (--k <= 0) break;
         case 7: __L4_MR7 = *w++; if (--k <= 0) break;
         default:
         {
            uint32_t *mr = __L4_Utcb()->mr;
            while (k-- > 0)
               *mr++ = *w++;
         }
      }
   }

   //include/thread.h
   struct tcb {
      //global id 是唯一的
      l4_thread_t t_globalid;
      l4_thread_t t_localid;
      // 目前thread的執行狀態
      thread_state_t state;

      memptr_t stack_base;
      size_t stack_size;

      context_t ctx;

      as_t *as;

      struct utcb *utcb;
      // 當處在等待接收訊息狀態時候，ipc_from表示了等待的目標
      l4_thread_t ipc_from;
      // 建立thread map所需要的元素
      struct tcb *t_sibling;
      struct tcb *t_parent;
      struct tcb *t_child;
   };

   //include/thread.h
   typedef struct {
      uint32_t sp; // stack pointer
      uint32_t ret; // return address
      uint32_t ctl; // control register
      uint32_t regs[8]; // r4 - r11
      #ifdef CONFIG_FPU
      uint64_t fp_regs[8]; // floating point registers
      uint32_t fp_flag;
      #endif
   } context_t;

   //include/l4/utcb.h
   struct utcb {
      /* +0w */
      l4_thread_t t_globalid;
      uint32_t    processor_no;
      uint32_t    user_defined_handle;    /* NOT used by kernel */
      l4_thread_t t_pager;

      /* +4w */
      uint32_t    exception_handler;
      uint32_t    flags;      /* COP/PREEMPT flags (not used) */
      uint32_t    xfer_timeouts;
      uint32_t    error_code;

      /* +8w */
      l4_thread_t intended_receiver;
      l4_thread_t sender;
      uint32_t    thread_word_1;
      uint32_t    thread_word_2;

      /* +12w */
      uint32_t    mr[8];      /* MRs 8-15 (0-8 are laying in
                                r4..r11 [thread's context]) */
      /* +20w */
      uint32_t    br[8];
      /* +28w */
      uint32_t    reserved[4];
      /* +32w */
   };

   tcb_t *thread_create(l4_thread_t globalid, utcb_t *utcb)
   {
       ...
      /* 這邊會先init thread，而且把tcb 空間配置好後回傳*/
      thr = thread_init(globalid, utcb);

      /* 呼叫create thread的thread為 parent */
      thr->t_parent = caller;

      /* 以下只是把thread放到 caller的child */
      /* Place under */
      if (caller->t_child) {
         tcb_t *t = caller->t_child;
         while (t->t_sibling != 0)
            t = t->t_sibling;
         t->t_sibling = thr;

         /* thread的local id由child的數序決定，因此可能不同的thread有同樣的local id*/
         thr->t_localid = t->t_localid + (1 << 6);
      } else {
         /* That is first thread in child chain */
         caller->t_child = thr;
         thr->t_localid = (1 << 6);
      }
   return thr;
   }

   //user/include/l4/types.h
   L4_INLINE L4_ThreadId_t L4_GlobalId(L4_Word_t threadno, L4_Word_t version)
   {
      L4_ThreadId_t t;
      t.global.X.thread_no = threadno;
      t.global.X.version = version;
      return t;
   }

   tcb_t *thread_init(l4_thread_t globalid, utcb_t *utcb)
   {
      tcb_t *thr;
     /* 首先從thread_table中獲得記憶體 */
      thr = (tcb_t *) ktable_alloc(&thread_table);
      if (!thr) {
         set_caller_error(UE_OUT_OF_MEM);
         return NULL;
      }

     /* 把thread放進thread map中 */
      thread_map_insert(globalid, thr);

     /* local id過後會根據所屬parent的child順序決定，因此這邊先給0x0 */
      thr->t_localid = 0x0;

        ...

      thr->as = NULL;
      thr->utcb = utcb;
      thr->state = T_INACTIVE;
      dbg_printf(DL_THREAD, "T: New thread: %t @[%p] \n", globalid, thr);
      return thr;
   }

   void thread_space(tcb_t *thr, l4_thread_t spaceid, utcb_t *utcb)
   {
     /* If spaceid == dest than create new address space
      * else share address space between threads
      */
      if (GLOBALID_TO_TID(thr->t_globalid) == GLOBALID_TO_TID(spaceid)) {
         thr->as = as_create(thr->t_globalid);

        /* Grant kip_fpage & kip_ext_fpage only to new AS */
         map_fpage(NULL, thr->as, kip_fpage, GRANT);
         map_fpage(NULL, thr->as, kip_extra_fpage, GRANT);
         dbg_printf(DL_THREAD,"\tNew space: as: %p, utcb: %p \n", thr->as, utcb);

      } else {
         tcb_t *space = thread_by_globalid(spaceid);
         thr->as = space->as;
         ++(space->as->shared);
      }
    /* If no caller, than it is mapping from kernel to root thread
     * (some special case for root_utcb)
     */
      if (caller)
        map_area(caller->as, thr->as, (memptr_t) utcb,
                 sizeof(utcb_t), GRANT, thread_ispriviliged(caller));
      else
        map_area(thr->as, thr->as, (memptr_t) utcb, sizeof(utcb_t), GRANT, 1);
   }

   static void __USER_TEXT start_thread(L4_ThreadId_t t, L4_Word_t ip, L4_Word_t sp, L4_Word_t stack_size)
   {
      L4_Msg_t msg;
      L4_MsgClear(&msg);
      L4_MsgAppendWord(&msg, ip);
      L4_MsgAppendWord(&msg, sp);
      L4_MsgAppendWord(&msg, stack_size);
      L4_MsgLoad(&msg);
      L4_Send(t);
   }

   // kernel/ipc
   void sys_ipc()
   {
     ...
      else if (to_thr && to_thr->state == T_INACTIVE &&
               GLOBALID_TO_TID(to_thr->utcb->t_pager) == GLOBALID_TO_TID(caller->t_globalid)) {
         if (ipc_read_mr(caller, 0) == 0x00000003) {
              /* thread start protocol */
                /* stack pointer */
            memptr_t sp = ipc_read_mr(caller, 2);
                /* stack size */
            size_t stack_size = ipc_read_mr(caller, 3);
            dbg_printf(DL_IPC, "IPC: %t thread start\n", to_tid);
            to_thr->stack_base = sp - stack_size;
            to_thr->stack_size = stack_size;
               /* ipc_read_mr return ip here, 然後ip會被储存到pc當中 */
            thread_init_ctx((void *) sp, (void *) ipc_read_mr(caller, 1), to_thr);
            caller->state = T_RUNNABLE;
               /* Start thread */
            to_thr->state = T_RUNNABLE;
            return;
      }
        ...
   }

   //kernel/systhread.c
   void create_root_thread(void)
   {
      root = thread_init(TID_TO_GLOBALID(THREAD_ROOT), &root_utcb);
      thread_space(root, TID_TO_GLOBALID(THREAD_ROOT), &root_utcb);
      as_map_user(root->as);
      thread_init_ctx((void *) &root_stack_end, root_thread, root);
      root->stack_base = (memptr_t)&root_stack_start;
      root->stack_size = (uint32_t)&root_stack_end - (uint32_t)&root_stack_start;
      sched_slot_dispatch(SSI_ROOT_THREAD, root);
      root->state = T_RUNNABLE;
   }

   //include/platform/armv7m.h
   enum register_stack_t {
     /* Saved by hardware */
      REG_R0,
      REG_R1,
      REG_R2,
      REG_R3,
      REG_R12,
      REG_LR,
      REG_PC,
      REG_xPSR
   };

   // user/root_thread.c
   extern user_struct user_runtime_start[];
   extern user_struct user_runtime_end[];

   void __USER_TEXT __root_thread(kip_t *kip_ptr, utcb_t *utcb_ptr)
   {
      L4_ThreadId_t myself = {.raw = utcb_ptr->t_globalid};
      char *free_mem = (char *) get_free_base(kip_ptr);
      for (user_struct *ptr = user_runtime_start; ptr != user_runtime_end; ++ptr) {
         L4_ThreadId_t tid;
         L4_Word_t stack;
         user_fpage_t *fpage = ptr->fpages;
         tid = L4_GlobalId(ptr->tid + kip_ptr->thread_info.s.user_base, 2);

       /* create thread */
         L4_ThreadControl(tid, tid, L4_nilthread, myself, free_mem);
       //在create thread時候，會從free_mem配置出utcb
         free_mem += UTCB_SIZE;

       /* map user_text, user_data and user_bss */
         map_user_sections(kip_ptr, tid);

       /* map thread stack */
         L4_Map(tid, (L4_Word_t)free_mem, STACK_SIZE);
         free_mem += STACK_SIZE;
         stack = (L4_Word_t)free_mem;

       /* map fpages */
         while (fpage->base || fpage->size) {
            if (fpage->base) {
               L4_Map(tid, fpage->base, fpage->size);
            } else {
               L4_Map(tid, (L4_Word_t)free_mem, fpage->size);
               fpage->base = (L4_Word_t)free_mem;
            }
            free_mem += fpage->size;
            fpage++;
         }
       /* start thread */
         start_thread(tid, (L4_Word_t)ptr->entry, stack, STACK_SIZE);
      }
      while (1)
         L4_Sleep(L4_Never);
   }

   struct kprobe {
      void *addr; /*中斷地址*/
      kprobe_pre_handler_t pre_handler; /*前處理*/
      kprobe_post_handler_t post_handler; /*後處理*/
      struct breakpoint *bkpt; /*硬體中斷資料結構*/
      void *step_addr; /* 儲存下一個指令地址，arm cortex M 在debug mode支援single step */
      struct kprobe *next; /*下一個*/
   };

   struct breakpoint{
      uint16_t type; /*種類分成三種NONE, SOFT, HARD */
      union{
         uint16_t hard_breakpoint_id; /* breakpoint id*/
         uint16_t back_instr;
         uint16_t raw_data;
      };
      uint32_t addr; /*目標地址 */
      void (*enable)(struct breakpoint *b); /*根據種類指向對應的enable，disable，release功能*/
      void (*disable)(struct breakpoint *b);
      void (*release)(struct breakpoint *b);
   };

How-to-use
===========

| Kprobes 可以透過 kprobe_register & kprobe_unregister 登記和取消登記，成功時候會回傳0，反之負數。
| Kprobes 將所有 register 的 kp 儲存在 kplist 當中，並且設定相關硬體 register
```c
   int kprobe_register(struct kprobe *kp)
   {
      int ret;
      kp->addr = (void *)((uint32_t) kp->addr & ~(1UL)); /*把最後一bit設為0 */
      if (is_thumb32(*(uint16_t *) kp->addr)) /* 支援thumb */
         kp->step_addr = kp->addr + 4; /*這邊是下一個指令地址*/
      else
         kp->step_addr = kp->addr + 2;

      ret = kprobe_arch_add(kp);

      if (ret < 0)
         return -1;

      kplist_add(kp); /* 加入到 kplist中 */
      return 0;
   }

   //platform/kprobe_arc.c
   int kprobe_arch_add(struct kprobe *kp)
   {
      struct kprobe *found = kplist_search(kp->addr);
      struct breakpoint *b;

      /*
       * If there is no kprobe at this addr, give it a new bkpt,
       * otherwise share the existing bkpt.
       */

      if (found == NULL) {
         b = breakpoint_install((uint32_t) kp->addr);
         if (b != NULL) {
            kp->bkpt = b;
            enable_breakpoint(b);
         } else
            goto arch_add_error;
      } else {
         kp->bkpt = found->bkpt;
      }
      return 0;

   arch_add_error:
      return -1;
   }

   //platform/breakpoint.c
   static struct breakpoint *get_avail_breakpoint(uint32_t addr)
   {
      int i;
      for (i = 0; i < BKPT_MAX_NUM; i++) {
         if (breakpoints[i].type == BKPT_NONE) /* 檢查空的，然後設定 */
            return breakpoint_config(i, addr);
      }
      return NULL;
   }

   #define breakpoint_type_by_addr(addr) ((addr) < 0x20000000 ? BKPT_HARD : BKPT_SOFT)

   //platform/breakpoint-hard.c
   struct breakpoint *hard_breakpoint_config(uint32_t addr, struct breakpoint *b)
   {
      if (breakpoint_type_by_addr(addr) == BKPT_HARD) {
         int _hard_breakpoint_id = get_avail_hard_breakpoint();
         int breakpoint_id = get_breakpoint_id(b);
         if (breakpoint_id >= 0 && _hard_breakpoint_id >= 0) {
            hard_breakpoints[_hard_breakpoint_id] = breakpoint_id;
            b->type = BKPT_HARD;
            b->addr = addr;
            b->hard_breakpoint_id = _hard_breakpoint_id;
            b->enable = hard_breakpoint_enable;
            b->disable = hard_breakpoint_disable;
            b->release = hard_breakpoint_release;
            return b;
         }
      }
      return NULL;
   }

   #define FPB_COMP_ENABLE     (uint32_t) (1 << 0)
   #define FPB_COMP_REPLACE_LOWER  (uint32_t) (1 << 30)
   #define FPB_COMP_REPLACE_UPPER  (uint32_t) (2 << 30)

   /* FP_COMPx: 000:COMP_ADDR:00 */
   #define FPB_COMP_ADDR_MASK 0x1FFFFFFC
 
   static void hard_breakpoint_enable(struct breakpoint *b)
   {
      uint32_t addr = b->addr;
      if (IS_UPPER_HALFWORLD(addr)) { /* ？？？ */
         *(FPB_COMP + b->hard_breakpoint_id) = FPB_COMP_REPLACE_UPPER | (addr & FPB_COMP_ADDR_MASK) | FPB_COMP_ENABLE;
      } else {
         *(FPB_COMP + b->hard_breakpoint_id) = FPB_COMP_REPLACE_LOWER | (addr & FPB_COMP_ADDR_MASK) | FPB_COMP_ENABLE;
      }
   }

   //platform/hw_debug.c
   void debugmon_handler(void)
   {
      /* select interrupted stack */
      /* 透過地址比對獲知kprobe addr的模式，然後选擇對應的stack */
      __asm__ __volatile__("and r0, lr, #4");
      __asm__ __volatile__("cmp r0, #0");
      __asm__ __volatile__("ite eq");
      __asm__ __volatile__("mrseq r0, msp");
      __asm__ __volatile__("mrsne r0, psp");

      /* save r4-r11 */
      __asm__ __volatile__("push {r4-r11}");
      __asm__ __volatile__("mov r1, sp");

      /*
       * arch_kprobe_handler(uint32_t *stack, uint32_t *kp_regs)
       * r0 = r0-r3,r12,lr,pc,psr
       * r1 = r4-r11
       */
      __asm__ __volatile__("push {lr}"); //储存lr，才能回到之前的指令
      __asm__ __volatile__("bl arch_kprobe_handler");
      __asm__ __volatile__("pop {lr}");

      /* override r4-r11 */
      __asm__ __volatile__("pop {r4-r11}");

      /* NOTE: No support stack modification for the time being */
      /* 處理结束，回到原本地址 */
      __asm__ __volatile__("bx lr");
   }

   //platform/kprobes-arch.c
   void arch_kprobe_handler(uint32_t *stack, uint32_t *kp_regs)
   {
      /*
       * For convenience currently we assume all cpu single-step is
       * enabled/disabled by arch_kprobe_handler.
       *
       * To execute instruction at the probed address, we have to disable
       * breakpoint before return from handler, and re-enable it in the
       * next instruction.
       */

      if ((*SCB_DFSR & SCB_DFSR_DWTTRAP)) {
         panic("DWT Watchpoint hit\n");
      } else if ((*SCB_DFSR & SCB_DFSR_BKPT)) {
         /* 首先去執行 prehandler */
         kprobe_prebreak(stack, kp_regs);
         /* Clear BKPT status bit */
         *SCB_DFSR = SCB_DFSR_BKPT;
         /* 這邊enable single step的原因在於要進入下方else if做出post_handler */
         cpu_enable_single_step();
         /* 需要把breakpoint解除才能夠執行probed address */
         kprobe_breakpoint_disable(stack);
      } else if (*SCB_DFSR & SCB_DFSR_HALTED) {
         /* 執行 posthandler */
         kprobe_postbreak(stack, kp_regs);
         /* Clear HALTED status bit */
         *SCB_DFSR = SCB_DFSR_HALTED;
         /* 解除single step */
         cpu_disable_single_step();
         /* 把breakpoint重新啟動 */
         kprobe_breakpoint_enable(stack);
      } else {
         /*
          * sometimes DWT generates faults
          * without setting SCB_DFSR_DWTTRAP
          */
      }
   }

   //kernel/sampling-kdb.c
   extern void ktimer_handler(void);
   void kdb_show_sampling(void)
   {
      ...
      static int init = 0;
      static struct kprobe k;

      if (init == 0) { //第一次會register kprobe
         dbg_printf(DL_KDB, "Init sampling...\n");
         sampling_init();
         sampling_enable();
         init++;
        //下面是正確的register kprobe範例
         k.addr = ktimer_handler;
         k.pre_handler = sampling_handler;
         k.post_handler = NULL;
         kprobe_register(&k);
         return;
      }
      ...
   }

   //kernel/ktimer.c
   void __ktimer_handler(void)
   {
      ++ktimer_now; //目前的time
      if (ktimer_enabled && ktimer_delta > 0) {
         ++ktimer_time;
         --ktimer_delta; //利用counting down方式的timer
         if (ktimer_delta == 0) {
            ktimer_enabled = 0;
            ktimer_time = ktimer_delta = 0;

          //ktimer_delta 等於0的時候，把相關event加入排程。
            softirq_schedule(KTE_SOFTIRQ);
         }
      }
   }

   void ktimer_event_init()
   {
      ktable_init(&ktimer_event_table);
      ktimer_init();
     // softirq that belongs to KTE_SOFTIRQ will be handled by ktimer_event_handler
      softirq_register(KTE_SOFTIRQ, ktimer_event_handler);
   }
   ...
   // INIT HOOK
   INIT_HOOK(ktimer_event_init, INIT_LEVEL_KERNEL);

   void ktimer_event_handler()
   {
      ktimer_event_t *event = event_queue;
      ktimer_event_t *last_event = NULL;
      ktimer_event_t *next_event = NULL;

      uint32_t h_retvalue = 0;
      if (!event_queue) {
        /* That is bug if we are here */
         ...
      }
      /* 尋找最後一個delta = 0的event */
      do {
         event = event->next;
      } while (event && event->delta == 0);

      // last_event->delta != 0
      last_event = event;
      /* All rescheduled events will be scheduled after last event */

      // 所以event 是要處理的event, event_queue把要處理的event 拿掉了
      event = event_queue;
      event_queue = last_event;

      /* walk chain */
      do {
       //event->handler應該在register的時候就要儲存
         h_retvalue = event->handler(event);
         next_event = event->next;

       // 下一次的event時間，所以重新排進event_queue中
         if (h_retvalue != 0x0) {
            dbg_printf(DL_KTIMER,
                       "KTE: Handled and rescheduled event %p @%ld\n",
                       event, ktimer_now);

            ktimer_event_schedule(h_retvalue, event);
         } else {
           //不再需要發生了，所以把記憶體free掉
             dbg_printf(DL_KTIMER,
                        "KTE: Handled event %p @%ld\n",
                        event, ktimer_now);

             ktable_free(&ktimer_event_table, event);
         }

         event = next_event; /* Guaranteed to be next
                               regardless of re-scheduling */

      } while (next_event && next_event != last_event);

      if (event_queue) {
            /* Reset ktimer */
            // 重新把ktimer設定好，並且把ktimer_delta設定成下一個event_queue的delta
         ktimer_enable(event_queue->delta);
      }
   }

   //kernel/ktimer.c
   static void ktimer_enable(uint32_t delta)
   {
      if (!ktimer_enabled) {
         ktimer_delta = delta;
         ktimer_time = 0;
         ktimer_enabled = 1;
      }
   }

   //kernel/ktimer.c
   int ktimer_event_schedule(uint32_t ticks, ktimer_event_t *kte)
   {
      long etime = 0, delta = 0;
      ktimer_event_t *event = NULL, *next_event = NULL;

      if (!ticks)
         return -1;

      // 每次enable, ktimer_time 歸零，所以tick是距離最近的ktimer_handler的時間開始計算
      // 要注意的是最近的ktimer_handler不包含本次
      ticks -= ktimer_time;
      kte->next = NULL;

      //分成兩個情況，event_queue裡面是否有event
      if (event_queue == NULL) {
         /* All other events are already handled, so simply schedule
          * and enable timer
          */
            ...
          //設定kte->delta，然後放進event_queue
          kte->delta = ticks;
          event_queue = kte;
          //重設ktimer
          ktimer_enable(ticks);
      } else {
         next_event = event_queue;
         //因為event_queue原本已經排序好，所以只需要找出擺放位置就可以了
         if (ticks >= event_queue->delta) {
            do {
               event = next_event;

               //etime是到目前event所需要的delta
               etime += event->delta;

               //delta是所要倒數的時間與前一個event的時間差
               //例如queue原本有A，A的delta是20，而B需要倒數30，則B的delta是10
               delta = ticks - etime;
               next_event = event->next;
            } while (next_event && ticks > (etime + next_event->delta));
            /* Insert into chain and recalculate */
            event->next = kte;
         } else {
            event_queue = kte;
            delta = ticks;
           /* Reset timer */
            ktimer_enable(ticks);
         }
           /* Chaining events */
         if (delta < CONFIG_KTIMER_MINTICKS)
            delta = 0;
            kte->next = next_event;
            kte->delta = delta;
            ktimer_event_recalc(next_event, delta);
         }
      return 0;
   }

   //kernel/ktimer.c
   int ktimer_event_create(uint32_t ticks, ktimer_event_handler_t handler, void *data)
   {
      ktimer_event_t *kte;
      if (!handler)
         return -1;

      kte = (ktimer_event_t *) ktable_alloc(&ktimer_event_table);

      /* No available slots */
      if (kte == NULL)
         return -1;

      kte->next = NULL;
      kte->handler = handler;
      kte->data = data;
      return ktimer_event_schedule(ticks, kte);
   }

    /* include/l4/kip_types.h */
    // 我將F9中沒有用到或沒有實作的部份先拿掉
    typedef struct {
            uint32_t         base;        /* Last 6 bits contains poolid */
            uint32_t        size;        /* Last 6 bits contains tag */
    } kip_mem_desc_t;
    
    typedef union {
            struct {
                    uint8_t  version;
                    uint8_t  subversion;
                    uint8_t  reserved;
            } s;
            uint32_t raw;
    } kip_apiversion_t;
    
    typedef union {
            struct {
                    uint32_t  reserved : 28;
                    uint32_t  ww : 2;
                    uint32_t  ee : 2;
            } s;
            uint32_t raw;
    } kip_apiflags_t;

    typedef union {
            struct {
                    uint16_t memory_desc_ptr; // 從kip開頭到mem_desc的offset
                    uint16_t n;
            } s;
            uint32_t raw;
    } kip_memory_info_t;
    
    typedef union {
            struct {
                    uint32_t user_base;
                    uint32_t system_base;
            } s;
            uint32_t raw;
    } kip_threadinfo_t;

    struct kip {
            uint32_t kernel_id;
            kip_apiversion_t api_version;
            kip_apiflags_t api_flags;
            uint32_t kern_desc_ptr;
    
            kip_memory_info_t memory_info;
    
            kip_threadinfo_t thread_info;
    };

   /* include/init_hook.h */
   typedef struct {
           unsigned int level;
           init_hook_t hook;
           const char *hook_name;
   } init_struct;

   /* include/init_hook.h */
   #define INIT_HOOK(_hook, _level)                                        \
           const init_struct _init_struct_##_hook __attribute__((section(".init_hook"))) = {        \
                   .level = _level,                                        \
                   .hook = _hook,                                                \
                   .hook_name = #_hook,                                        \
           };

   /* loader/loader.ld */
   SECTIONS {
           .text 0x08000000:
           {
                   KEEP(*(.isr_vector))
                   . = TEXT_BASE;
                   text_start = .;
                   *(.text*)
                   *(.rodata*)
                   .init_hook_start = .;
                   KEEP(*(.init_hook))
                   init_hook_end = .;
                   text_end = .;
           } > MFlash
           ...
   }

   $ grep INIT_HOOK kernel/* platform/*
   kernel/kdb.c:INIT_HOOK(kdb_init, INIT_LEVEL_KERNEL);
   kernel/kprobes.c:INIT_HOOK(kprobe_init, INIT_LEVEL_KERNEL);
   kernel/ksym.c:INIT_HOOK(ksym_init, INIT_LEVEL_KERNEL_EARLY);
   kernel/ktimer.c:INIT_HOOK(ktimer_event_init, INIT_LEVEL_KERNEL);
   kernel/memory.c:INIT_HOOK(memory_init, INIT_LEVEL_KERNEL_EARLY);
   kernel/sched.c:INIT_HOOK(sched_init, INIT_LEVEL_KERNEL_EARLY);
   kernel/syscall.c:INIT_HOOK(syscall_init, INIT_LEVEL_KERNEL);
   kernel/thread.c:INIT_HOOK(thread_init_subsys, INIT_LEVEL_KERNEL);
   platform/debug_device.c:INIT_HOOK(dbg_device_init_hook, INIT_LEVEL_PLATFORM);

   $ arm-none-eabi-readelf -s f9.elf | grep "init_hook_start|init_hook_end" -E
      765: 08005924     0 NOTYPE  GLOBAL DEFAULT    1 init_hook_end
      934: 080058b8     0 NOTYPE  GLOBAL DEFAULT    1 init_hook_start
   
   $ arm-none-eabi-objdump -d f9.elf | grep init_struct
   080058b8 <_init_struct_dbg_device_init_hook>:
   080058c4 <_init_struct_ktimer_event_init>:
   080058d0 <_init_struct_memory_init>:
   080058dc <_init_struct_sched_init>:
   080058e8 <_init_struct_syscall_init>:
   080058f4 <_init_struct_thread_init_subsys>:
   08005900 <_init_struct_kdb_init>:
   0800590c <_init_struct_kprobe_init>:
   08005918 <_init_struct_ksym_init>:

   /* kernel/init.c */
   extern const init_struct init_hook_start[];
   extern const init_struct init_hook_end[];
   static unsigned int last_level = 0;
   
   int run_init_hook(unsigned int level)
   {
           unsigned int max_called_level = last_level;
   
           for (const init_struct *ptr = init_hook_start; ptr != init_hook_end; ++ptr)
                   if ((ptr->level > last_level) && (ptr->level <= level)) {
                           max_called_level = MAX(max_called_level, ptr->level);
                           ptr->hook();
                   }
   
           last_level = max_called_level;
   
           return last_level;
   }

    struct ktable {
        char *tname;
        bitmap_ptr_t bitmap;
        ptr_t data;
        size_t num;
        size_t size;
    };

    typedef struct ktable ktable_t;

   // 宣告一個ktable
   // $ arm-none-eabi-readelf f9.elf -s | grep fpage_table
   //    263: 10000000    32 OBJECT  LOCAL  DEFAULT    8 kt_fpage_table_bitmap
   //    265: 2000c4e0  6144 OBJECT  LOCAL  DEFAULT    4 kt_fpage_table_data
   #define DECLARE_KTABLE(type, name, num_)			\
   	DECLARE_BITMAP(kt_ ## name ## _bitmap, num_);		\
   	static __KTABLE type kt_ ## name ## _data[num_];	\
   	ktable_t name = {					\
   			.tname = #name,				\
   			.bitmap = kt_ ## name ## _bitmap,	\
   			.data = (ptr_t) kt_ ## name ## _data,	\
   			.num = num_, .size = sizeof(type)	\
   	}

   // 將kt中的bitmap全部設為0
   void ktable_init(ktable_t *kt);
   // 檢查第i個元素是否已經被配置
   int ktable_is_allocated(ktable_t *kt, int i);
   // 配置第i個元素，回傳元素的位置
   void *ktable_alloc_id(ktable_t *kt, int i);
   // 配置到第一個free的元素，回傳元素的位置
   void *ktable_alloc(ktable_t *kt);
   // 釋放元素
   void  ktable_free(ktable_t *kt, void *element);
   // 取得該元素位在ktable內的id
   uint32_t ktable_getid(ktable_t *kt, void *element);

   for i from 0 to n/w-1
       complement[i] := not a[i]
       union[i]        := a[i] or b[i]
       intersection[i] := a[i] and b[i]
       difference[i]   := a[i] and (not b[i])

   for i from 0 to n/w-1
        index := 0    // if needed
        word := a[i]
        for b from 0 to w-1
            value := word and 1 ≠ 0
            word := word shift right 1
            // do something with value
            index := index + 1   // if needed

   bit_word_offset = (byte_offset x 32) + (bit_number × 4)
   bit_word_addr = bit_band_base + bit_word_offset

   /* include/lib/bitmap.h */
   // 宣告一塊bitmap
   #define DECLARE_BITMAP(name, size) \
       static __BITMAP uint32_t name [ALIGNED(size, BITMAP_ALIGN)];
   
   // ADDR_BITBAND指的是target bit所在byte對應到的align，還沒加上bit_number
   // ((ptr_t) addr) & 0xFFFFF) 可以抓出addr在bit-band區域中的第幾個byte
   #define BITBAND_ADDR_SHIFT         5
   #define ADDR_BITBAND(addr) \
           (bitmap_cursor_t) (0x22000000 + \
                              ((((ptr_t) addr) & 0xFFFFF) << BITBAND_ADDR_SHIFT))
   #define BIT_SHIFT                  2
   
   // bitmap_cursor是加上bit_number後的值，也就是target bit正確的align
   #define bitmap_cursor(bitmap, bit) \
           ((ADDR_BITBAND(bitmap) + (bit << BIT_SHIFT)))
           
   // bitmap_cursor_id可以取得bit_number
   // ((1 << (BITBAND_ADDR_SHIFT + BIT_SHIFT)) - 1) 取得 0b1111111 也就是七位的mask，與cursor進行完AND操作並右移兩位後，會留下兩位的byte_offset以   及bit_number，也就是BBXXX(B:byte_offset、X:bit_number)
   #define bitmap_cursor_id(cursor) \
        (((ptr_t) cursor & ((1 << (BITBAND_ADDR_SHIFT + BIT_SHIFT)) - 1)) >> BIT_SHIFT)        
   // bitmap_cursor_goto_next 可以把cursor往前推一格(+= 4)
   #define bitmap_cursor_goto_next(cursor) \
           cursor += 1 << BIT_SHIFT
   
   // for_each_in_bitmap 可以從某一個bitmap的start開始訪問完一塊bitmap        
   #define for_each_in_bitmap(cursor, bitmap, size, start) \
           for (cursor = bitmap_cursor(bitmap, start); \
                bitmap_cursor_id(cursor) < size;        \
                bitmap_cursor_goto_next(cursor))