Merge pull request #4 from Richard-Qin-001/dev/shell

Rebuilt the system's underlying structure; it is now stable enough to merge. 

The system now supports a read-only file system and has a simple shell implemented.

12 files changed, 2276 insertions, 663 deletions

diff --git a/src/kernel/bio.cc b/src/kernel/bio.cc
new file mode 100644
index 0000000..6e63d60
--- /dev/null
+++ b/src/kernel/bio.cc
@@ -0,0 +1,135 @@
+#include "kernel/buf.h"
+#include "kernel/spinlock.h"
+#include "kernel/riscv.h"
+#include "drivers/virtio.h"
+#include "drivers/uart.h"
+
+namespace BufferCache
+{
+    struct 
+    {
+        Spinlock lock;
+        struct Buf buf[NBUF];
+        struct Buf head;
+    } bcache;
+
+    void init()
+    {
+        bcache.lock.init("bcache");
+        // Initialize LRU doubly circular linked list
+        bcache.head.prev = &bcache.head;
+        bcache.head.next = &bcache.head;
+        for (struct Buf *b = bcache.buf; b < bcache.buf + NBUF; ++b)
+        {
+            b->lock.init("buffer");
+            b->next = bcache.head.next;
+            b->prev = &bcache.head;
+            bcache.head.next->prev = b;
+            bcache.head.next = b;
+        }
+        Drivers::uart_puts("[Bio] Buffer cache initialized.\n");
+    }
+
+    static struct Buf* bget(uint32 dev, uint32 blockno)
+    {
+        struct Buf* b;
+        bcache.lock.acquire();
+
+        // Attempt to hit the cache
+        for (b = bcache.head.next; b != &bcache.head; b = b->next)
+        {
+            if (b->dev == dev && b->blockno == blockno)
+            {
+                b->refcnt++;
+                bcache.lock.release();
+                b->lock.acquire(); // Acquire Sleep Lock
+                return b;
+            }
+        }
+
+        // Cache miss, evicting LRU
+        for (b = bcache.head.prev; b != &bcache.head; b = b->prev)
+        {
+            if (b->refcnt == 0)
+            {
+                b->dev = dev;
+                b->blockno = blockno;
+                b->valid = 0;
+                b->refcnt = 1;
+                bcache.lock.release();
+                b->lock.acquire();
+                return b;
+            }
+        }
+
+        Drivers::uart_puts("panic: bget: no buffers\n");
+        while (1)
+            ;
+    }
+
+    struct Buf* bread(uint32 dev, uint32 blockno)
+    {
+        struct Buf *b = bget(dev, blockno);
+
+        if (!b->valid)
+        {
+            VirtIO::rw(0, b->blockno, (char *)b->data);
+            b->valid = 1;
+        }
+
+        return b;
+    }
+
+    void bwrite(struct Buf *b)
+    {
+        if (!b->lock.holding())
+        { 
+            Drivers::uart_puts("panic: bwrite\n");
+            while (1)
+                ;
+        }
+        VirtIO::rw(1, b->blockno, (char *)b->data);
+    }
+
+    void brelse(struct Buf *b)
+    {
+        if (!b->lock.holding())
+        {
+            Drivers::uart_puts("panic: brelse\n");
+            while (1)
+                ;
+        }
+        b->lock.release();
+
+        bcache.lock.acquire();
+        b->refcnt--;
+
+        if (b->refcnt == 0)
+        {
+            b->next->prev = b->prev;
+            b->prev->next = b->next;
+
+            b->next = bcache.head.next;
+            b->prev = &bcache.head;
+            bcache.head.next->prev = b;
+            bcache.head.next = b;
+        }
+
+        bcache.lock.release();
+    }
+
+    void bpin(struct Buf *b)
+    {
+        bcache.lock.acquire();
+        b->refcnt++;
+        bcache.lock.release();
+    }
+
+    void bunpin(struct Buf* b)
+    {
+        bcache.lock.acquire();
+        b->refcnt --;
+        bcache.lock.release();
+    }
+
+} // namespace BufferCache
diff --git a/src/kernel/cxx.cc b/src/kernel/cxx.cc
new file mode 100644
index 0000000..f9541b5
--- /dev/null
+++ b/src/kernel/cxx.cc
@@ -0,0 +1,68 @@
+#include "common/types.h"
+#include "kernel/pmm.h"
+#include "drivers/uart.h"
+
+/*
+ * C++ Kernel Runtime Support
+ *
+ * * Strategy: Map directly to PMM::alloc_page().
+ * Pros: Simple, works immediately for VFS.
+ * Cons: Allocates 4KB for every object (wasteful for small objects),
+ * but acceptable for current stage.
+ */
+
+void *operator new(unsigned long size)
+{
+    // Safety check: PMM allocates 4096 bytes max per call
+    if (size > 4096)
+    {
+        Drivers::uart_puts("panic: new allocation too big (max 4096)\n");
+        while (1)
+            ;
+    }
+
+    void *p = PMM::alloc_page();
+    if (!p)
+    {
+        Drivers::uart_puts("panic: new out of memory\n");
+        while (1)
+            ;
+    }
+    // PMM::alloc_page returns zeroed memory usually,
+    // but standard 'new' doesn't guarantee it.
+    // The constructor will handle initialization.
+    return p;
+}
+
+void *operator new[](unsigned long size)
+{
+    return operator new(size);
+}
+
+void operator delete(void *p)
+{
+    if (p)
+        PMM::free_page(p);
+}
+
+void operator delete[](void *p)
+{
+    if (p)
+        PMM::free_page(p);
+}
+
+// C++14 Sized Deallocation (Required by modern compilers)
+// The compiler optimizes 'delete' calls to pass the size of the object
+void operator delete(void *p, unsigned long size)
+{
+    (void)size; // We ignore size because PMM always frees a full page
+    if (p)
+        PMM::free_page(p);
+}
+
+void operator delete[](void *p, unsigned long size)
+{
+    (void)size;
+    if (p)
+        PMM::free_page(p);
+}
\ No newline at end of file
diff --git a/src/kernel/fdt.cc b/src/kernel/fdt.cc
index 1863086..5334845 100644
--- a/src/kernel/fdt.cc
+++ b/src/kernel/fdt.cc
@@ -96,17 +96,6 @@ void fdt_init(uint64 dtb)
                     }
                 }
 
-                // if (g_clint_base == 0)
-                // {
-                //     for (uint32 i = 0; i < len; i++)
-                //     {
-                //         if (data[i] == 'c' && data[i + 1] == 'l' && data[i + 2] == 'i' && data[i + 3] == 'n')
-                //         {
-                //             g_clint_base = current_reg_addr;
-                //             break;
-                //         }
-                //     }
-                // }
             }
         }
     }
diff --git a/src/kernel/main.cc b/src/kernel/main.cc
index c6d794d..9a24028 100644
--- a/src/kernel/main.cc
+++ b/src/kernel/main.cc
@@ -1,75 +1,68 @@
+#include "common/types.h"
+#include "kernel/riscv.h"
 #include "drivers/uart.h"
+#include "drivers/plic.h"
+#include "drivers/virtio.h"
 #include "kernel/pmm.h"
 #include "kernel/mm.h"
-#include "kernel/trap.h"
+#include "kernel/slab.h"
 #include "kernel/proc.h"
+#include "kernel/trap.h"
 #include "kernel/timer.h"
-#include "kernel/config.h"
-
-void fdt_init(uint64 dtb);
+#include "kernel/cpu.h"
+#include "kernel/buf.h"
+#include "fs/fs.h"
+#include "fs/file.h"
+#include "fs/fat32.h"
+#include "lib/string.h"
 
-void delay()
-{
-    for(volatile int i = 0; i < 1000000; i++)
-    {
+extern void fdt_init(uint64 dtb);
+extern uint64 g_dtb_addr;
 
-    }
-}
-
-void task_a()
-{
-    while(1)
-    {
-        Drivers::uart_putc('A');
-        delay();
-        // ProcManager::yield();
-    }
-}
+volatile static int started = 0;
 
-void task_b()
+extern "C" void kernel_main(uint64 hartid, uint64 dtb)
 {
-    while (1)
+    if (hartid == 0)
     {
-        Drivers::uart_putc('B');
-        delay();
-        // ProcManager::yield();
-    }
-    
-}
-
-extern "C" void kernel_main()
-{
-
-    fdt_init(g_dtb_addr);
-    Drivers::uart_init();
-    Drivers::uart_puts("\n[Lume OS Kernel] Booted in S-Mode.\n");
-    Drivers::uart_puts("2025 Richard Qin\n");
-    Drivers::uart_puts("\n");
-    Drivers::uart_puts("\n[Boot] Kernel started.\n");
+        fdt_init(dtb);
 
-    PMM::init();
-    Drivers::uart_puts("[Boot] PMM initialized.\n");
+        Drivers::uart_init();
+        Drivers::uart_puts("\n[Lume OS] Booting...\n");
 
-    VM::kvminit();
-    Drivers::uart_puts("[Boot] Kernel page table created.\n");
+        Drivers::uart_puts("[Boot] PMP configured.\n");
 
-    VM::kvminithart();
-    Drivers::uart_puts("[Boot] MMU ENABLED! We are now using virtual addresses.\n");
+        PMM::init();              // Physical Memory Management
+        VM::kvminit();            // Kernel Pagetable
+        VM::kvminithart();        // Enable MMU
+        Slab::init();
+        Trap::init();             // Trap Management
+        Trap::inithart();
+        PLIC::init();
+        PLIC::inithart();
+        VirtIO::init();
+        BufferCache::init();
+        VFS::init();
+        FileTable::init();
+        Timer::init();
+        ProcManager::init();      // Process Management
+        ProcManager::user_init(); // Initialize first user process
 
-    Trap::init();
-    Drivers::uart_puts("[Boot] Trap Handler Installed.\n");
+        __atomic_store_n(&started, 1, __ATOMIC_RELEASE);
 
-    Timer::init();
-    Drivers::uart_puts("[Boot] Timer Interrupt Enabled.\n");
-
-    ProcManager::init();
-    Drivers::uart_puts("[Boot] ProcManager Initialized.\n");
+        Drivers::uart_puts("[Boot] System initialized. Entering scheduler...\n");
+    }
+    else
+    {
+        while (__atomic_load_n(&started, __ATOMIC_ACQUIRE) == 0)
+            ;
 
-    void task_a();
-    void task_b();
-    // ProcManager::create_kernel_thread(task_a, "Task A");
-    // ProcManager::create_kernel_thread(task_b, "Task B");
-    ProcManager::user_init();
+        VM::kvminithart();
+        Trap::inithart();
+        PLIC::inithart();
+        Timer::init();
+        Drivers::uart_puts("[Boot] Hart started.\n");
+    }
 
-    ProcManager::scheduler();
+    ProcManager::scheduler(); // Enable Scheduler
 }
\ No newline at end of file
diff --git a/src/kernel/mm/pmm.cc b/src/kernel/mm/pmm.cc
index 9b68fcd..e871d8a 100644
--- a/src/kernel/mm/pmm.cc
+++ b/src/kernel/mm/pmm.cc
@@ -1,71 +1,289 @@
+#include "common/types.h"
+#include "kernel/riscv.h"
 #include "kernel/pmm.h"
+#include "kernel/mm.h"
+// #include "kernel/spinlock.h"
 #include "drivers/uart.h"
+#include "lib/string.h"
 
 extern "C" char kernel_end[];
+extern uint64 g_dtb_addr;
 
 namespace PMM
 {
-    struct Run
-    {
-        struct Run *next;
-    };
+    // Global metadata array pointer
+    struct Page *mem_map = nullptr;
+    // Total number of physical memory pages
+    uint64 total_pages = 0;
+    // Free list array (free_area[k] stores the head of the free block list of order=k)
+    struct Page *free_area[MAX_ORDER];
+    // Protective lock
+    Spinlock pmm_lock;
 
-    struct
+    struct Page *pa_to_page(uint64 pa)
     {
-        struct Run *freelist;
-    } kmem;
+        if (pa < KERNBASE || pa >= PHYSTOP)
+            return nullptr;
+        uint64 pfn = (pa - KERNBASE) >> PGSHIFT;
+        if (pfn >= total_pages)
+            return nullptr;
+        return &mem_map[pfn];
+    }
 
-    inline uint64_t PGROUNDUP(uint64_t a)
+    uint64 page_to_pa(struct Page *page)
     {
-        return (a + PGSIZE - 1) & ~(PGSIZE - 1);
+        uint64 pfn = page - mem_map;
+        return KERNBASE + (pfn << PGSHIFT);
     }
 
-    void init()
+    void list_add(struct Page *page, int order)
     {
-        uint64_t start = PGROUNDUP((uint64_t)kernel_end);
+        page->order = order;
+        page->flags = 0; // Mark as available
+        page->next = free_area[order];
+        page->prev = nullptr;
 
-        Drivers::uart_puts("PMM: Initializing from");
+        if (free_area[order])
+        {
+            free_area[order]->prev = page;
+        }
+        free_area[order] = page;
+    }
 
-        for (uint64_t p = start; p + PGSIZE <= PHYSTOP; p += PGSIZE)
+    void list_del(struct Page* page, int order)
+    {
+        if (page->prev)
+        {
+            page->prev->next = page->next;
+        }
+        else
         {
-            free_page((void *)p);
+            free_area[order] = page->next;
         }
+        if (page->next)
+        {
+            page->next->prev = page->prev;
+        }
+        page->next = nullptr;
+        page->prev = nullptr;
     }
 
-    void free_page(void* pa)
+    void init()
     {
-        struct Run *r;
-        if (((uint64_t)pa % PGSIZE) != 0 || (uint64_t)pa < (uint64_t)kernel_end || (uint64_t)pa >= PHYSTOP)
+        pmm_lock.init("pmm");
+
+        uint64 kern_end_pa = PGROUNDUP((uint64)kernel_end);
+        total_pages = (PHYSTOP - KERNBASE) / PGSIZE;
+
+        Drivers::uart_puts(ANSI_GREEN "[PMM] Total RAM size: 128MB\n" ANSI_RESET);
+        // Place the mem_map array
+        // mem_map is located immediately after kernel_end
+        mem_map = (struct Page*)kern_end_pa;
+
+        uint64 mem_map_size = total_pages * sizeof(struct Page);
+        uint64 free_mem_start = PGROUNDUP(kern_end_pa + mem_map_size);
+
+        Drivers::uart_puts(ANSI_GREEN "[PMM] MemMap placed at: " );
+        Drivers::print_hex((uint64)mem_map);
+        Drivers::uart_puts("\n" ANSI_RESET);
+
+        Drivers::uart_puts(ANSI_GREEN "[PMM] Free memory starts at: ");
+        Drivers::print_hex(free_mem_start);
+        Drivers::uart_puts("\n" ANSI_RESET);
+
+        if (free_mem_start >= PHYSTOP)
         {
-            Drivers::uart_puts("PMM: Error - Invalid free address\n");
-            return;
+            Drivers::uart_puts(ANSI_RED "[PMM] Error - Kernel too large, no memory left!\n" ANSI_RESET);
+            while (1)
+                ;
         }
-        r = (struct Run*)pa;
 
-        r->next = kmem.freelist;
-        kmem.freelist = r;
+        // Initialize all page states
+        for (uint64 i = 0; i < total_pages; i++)
+        {
+            mem_map[i].flags = PG_reserved;
+            mem_map[i].order = 0;
+            mem_map[i].refcnt = 0;
+            mem_map[i].next = nullptr;
+            mem_map[i].prev = nullptr;
+        }
+
+        for (int i = 0; i < MAX_ORDER; i++)
+        {
+            free_area[i] = nullptr;
+        }
+
+        // Release actual free memory to the allocator
+        // Range: [free_mem_start, PHYSTOP)
+        // Note: need to avoid the page where the DTB is located
+        uint64 dtb_pa_start = PGROUNDDOWN(g_dtb_addr);
+        uint64 dtb_pa_end = PGROUNDUP(g_dtb_addr + 0x10000);
+
+        uint64 p = free_mem_start;
+        while (p < PHYSTOP)
+        {
+            if (p >= dtb_pa_start && p < dtb_pa_end)
+            {
+                p += PGSIZE;
+                continue;
+            }
+
+            // Mark the page as Used, then call free_pages to release it
+            // This allows free_pages to handle the merging logic automatically
+            struct Page *page = pa_to_page(p);
+            if (page)
+            {
+                page->flags = PG_used;
+                free_pages((void *)p, 0); // Release page by page, let Buddy merge automatically
+            }
+            p += PGSIZE;
+
+            
+        }
         
     }
 
-    void* alloc_page()
+    void *alloc_pages(int order)
     {
-        struct Run* r;
+        if (order < 0 || order >= MAX_ORDER)
+            return nullptr;
+        
+        pmm_lock.acquire();
 
-        r = kmem.freelist;
-        if (r)
+        int current_order = order;
+        while (current_order < MAX_ORDER)
         {
-            kmem.freelist = r->next;
+            if (free_area[current_order])
+            {
+                // Find free block
+                struct Page *page = free_area[current_order];
+                list_del(page, current_order);
+
+                // If the block is too large, split it.
+                while (current_order > order)
+                {
+                    current_order--;
+                    // page is the left part (Buddy A)
+                    // buddy is the right part (Buddy B)
+                    // Pointer addition: Page* + n is equivalent to address offset n * sizeof(Page)
+                    // Since mem_map is linearly mapped, mem_map[i + (1<<k)] exactly corresponds to physical address + (1<<k)*PGSIZE
+                    struct Page *buddy = page + (1 << current_order);
+
+                    // Add the buddy to a lower-level linked list
+                    list_add(buddy, current_order);
+                }
+
+                // Mark as Occupied
+                page->flags = PG_used;
+                page->order = order; // Record the orders that have been assigned
+                page->refcnt = 1;
 
-            uint64_t *p = (uint64_t *)r;
-            for (int i = 0; i < PGSIZE / 8; i++)
+                pmm_lock.release();
+                return (void *)page_to_pa(page);
+            }
+            current_order++;
+        }
+        pmm_lock.release();
+        Drivers::uart_puts("PMM: OOM alloc_pages\n");
+        return nullptr;
+    }
+
+    void free_pages(void *pa, int order)
+    {
+        if (!pa)
+            return;
+        struct Page *page = pa_to_page((uint64)pa);
+        if (!page)
+            return;
+        pmm_lock.acquire();
+
+        if (!(page->flags & PG_used))
+        {
+            Drivers::uart_puts("PMM: Double free warning\n");
+            pmm_lock.release();
+            return;
+        }
+
+        // Mark as basic status
+        page->flags = 0;
+        page->refcnt = 0;
+
+        // try merge
+        uint64 page_idx = page - mem_map;
+
+        while (order < MAX_ORDER - 1)
+        {
+            // calculate Buddy index: index ^ (1 << order)
+            uint64 buddy_idx = page_idx ^ (1 << order);
+            struct Page *buddy = &mem_map[buddy_idx];
+
+            // Check if the Buddy can be merged:
+            // 1. Must be within the memory range
+            // 2. Must be free (flags == 0)
+            // 3. Must be at the current order (to prevent merging already split small blocks)
+            if (buddy_idx >= total_pages || (buddy->flags & PG_used) || (buddy->flags & PG_reserved) || buddy->order != order)
+            {
+                break;
+            }
+
+            // Can be merged!
+            // Remove Buddy from the free list
+            list_del(buddy, order);
+
+            // Update the current block to the merged block
+            // The starting address of the merged block is the smaller one between index and buddy_index
+            if (buddy_idx < page_idx)
             {
-                p[i] = 0;
+                page = buddy;
+                page_idx = buddy_idx;
             }
+
+            order++;
         }
-        else
+
+        // Insert into the final order linked list
+        list_add(page, order);
+
+        pmm_lock.release();
+    }
+
+    void *alloc_page()
+    {
+        void *p = alloc_pages(0);
+        if (p)
         {
-            Drivers::uart_puts("PMM: Out of memory!\n");
+            memset(p, 0, PGSIZE);
+        }
+        return p;
+    }
+
+    void free_page(void *pa)
+    {
+        free_pages(pa, 0);
+    }
+
+    void print_free_lists()
+    {
+        // Debug print the number of free blocks at each level
+        Drivers::uart_puts("PMM Stats: [ ");
+        for (int i = 0; i < MAX_ORDER; i++)
+        {
+            int count = 0;
+            struct Page *p = free_area[i];
+            while (p)
+            {
+                count++;
+                p = p->next;
+            }
+            if (count > 0)
+            {
+                Drivers::uart_puts("Order");
+                // Drivers::uart_put_int(i);
+                Drivers::uart_puts(":");
+                // Drivers::uart_put_int(count);
+                Drivers::uart_puts(" ");
+            }
         }
-        return (void *)r;
+        Drivers::uart_puts("]\n");
     }
-}
\ No newline at end of file
+} // namespace PMM
diff --git a/src/kernel/mm/slab.cc b/src/kernel/mm/slab.cc
new file mode 100644
index 0000000..702dc5c
--- /dev/null
+++ b/src/kernel/mm/slab.cc
@@ -0,0 +1,255 @@
+#include "kernel/slab.h"
+#include "kernel/pmm.h"
+#include "kernel/spinlock.h"
+#include "kernel/riscv.h"
+#include "drivers/uart.h"
+#include "lib/string.h"
+
+#define PG_slab 0x04
+
+// Supported object size (must be a multiple of 8 and <= 2048)
+const uint64 kmalloc_sizes[] = {
+    16, 32, 64, 128, 256, 512, 1024, 2048};
+const int NUM_CACHES = 8;
+
+struct SlabHeader
+{
+    struct SlabHeader *next; // Next slab in the linked list
+    uint16 free_idx;         // Index of the head of the free list (0xFFFF means none)
+    uint16 used_count;       // Number of allocated objects
+    // Followed immediately by object data...
+    // The free list of objects is embedded in the first 2 bytes of the object itself (stores the index of the next object)
+    uint32 padding;
+};
+
+struct KmemCache
+{
+    Spinlock lock;
+    uint64 obj_size;
+    uint64 obj_count_per_slab;
+    struct SlabHeader *slab_list; // Slab list with free objects
+    const char *name;
+};
+
+struct KmemCache caches[NUM_CACHES];
+
+// Virtual address -> struct Page*
+static struct Page *virt_to_page(void *ptr)
+{
+    uint64 pa = (uint64)ptr;
+    return PMM::pa_to_page(pa);
+}
+
+// Slab Implementation
+
+namespace Slab
+{
+
+    void init()
+    {
+        for (int i = 0; i < NUM_CACHES; i++)
+        {
+            caches[i].lock.init("slab_lock");
+            caches[i].obj_size = kmalloc_sizes[i];
+            caches[i].name = "kmalloc";
+
+            // Calculate how many objects can fit on a page
+            // Excluding the overhead of the SlabHeader
+            uint64 available = PGSIZE - sizeof(struct SlabHeader);
+            caches[i].obj_count_per_slab = available / caches[i].obj_size;
+            caches[i].slab_list = nullptr;
+        }
+        Drivers::uart_puts("[Slab] Initialized kmalloc caches.\n");
+    }
+
+    // Allocate a new slab page for the cache
+    // Must hold cache->lock
+    static struct SlabHeader *grow_cache(struct KmemCache *c)
+    {
+        void *p = PMM::alloc_page();
+        if (!p)
+            return nullptr;
+
+        // Mark this page as a Slab page
+        struct Page *page = virt_to_page(p);
+        if (page)
+        {
+            page->flags |= PG_slab;
+            int cache_idx = c - caches;
+            page->order = (uint8)cache_idx;
+        }
+
+        struct SlabHeader *slab = (struct SlabHeader *)p;
+        slab->next = nullptr;
+        slab->used_count = 0;
+        slab->free_idx = 0;
+        slab->padding = 0;
+
+        // Initialize the free list of objects
+        // The starting position of each object stores the index of the next object
+        // Starting position of the object data area
+        char *base = (char *)(slab + 1);
+
+        for (uint i = 0; i < c->obj_count_per_slab - 1; i++)
+        {
+            // The content of the i-th object is i+1
+            uint16 *ptr = (uint16 *)(base + i * c->obj_size);
+            *ptr = i + 1;
+        }
+        // The last object points to 0xFFFF
+        uint16 *ptr = (uint16 *)(base + (c->obj_count_per_slab - 1) * c->obj_size);
+        *ptr = 0xFFFF;
+
+        return slab;
+    }
+
+    void *kmalloc(uint64 size)
+    {
+        if (size == 0)
+            return nullptr;
+
+        // Large objects go directly through PMM
+        if (size > 2048)
+        {
+            // calculate order
+            int order = 0;
+            uint64 req = size;
+            uint64 pages = (size + PGSIZE - 1) / PGSIZE;
+            (void)req;
+
+            // calculate order: 2^order >= pages
+            while ((1UL << order) < pages)
+            {
+                order++;
+            }
+            if (order > MAX_ORDER)
+                return nullptr;
+
+            void *p = PMM::alloc_pages(order);
+            // Here, page->flags defaults to PG_used, not PG_slab
+            // kfree needs to be able to recognize it
+            return p;
+        }
+
+        int idx = 0;
+        while (idx < NUM_CACHES && kmalloc_sizes[idx] < size)
+        {
+            idx++;
+        }
+
+        struct KmemCache *c = &caches[idx];
+        c->lock.acquire();
+
+        if (!c->slab_list)
+        {
+            c->slab_list = grow_cache(c);
+            if (!c->slab_list)
+            {
+                c->lock.release();
+                return nullptr;
+            }
+        }
+
+        struct SlabHeader *slab = c->slab_list;
+
+        int obj_idx = slab->free_idx;
+        char *base = (char *)(slab + 1);
+        void *ptr = base + obj_idx * c->obj_size;
+
+        uint16 *link = (uint16 *)ptr;
+        slab->free_idx = *link;
+        slab->used_count++;
+
+        if (slab->free_idx == 0xFFFF)
+        {
+            if (slab->next)
+            {
+                c->slab_list = slab->next;
+                slab->next = nullptr;
+            }
+            else
+            {
+                c->slab_list = nullptr;
+            }
+        }
+
+        c->lock.release();
+
+        memset(ptr, 0, size);
+        return ptr;
+    }
+
+    void kfree(void *ptr)
+    {
+        if (!ptr)
+            return;
+
+        struct Page *page = virt_to_page(ptr);
+        if (!page)
+            return;
+
+        if (!page || !(page->flags & PG_slab))
+        {
+            PMM::free_pages(ptr, page->order);
+            return;
+        }
+
+        int cache_idx = page->order;
+        if (cache_idx >= NUM_CACHES)
+        {
+            Drivers::uart_puts("Slab: Corrupted page metadata\n");
+            return;
+        }
+
+        struct KmemCache *c = &caches[cache_idx];
+        c->lock.acquire();
+
+        struct SlabHeader *slab = (struct SlabHeader *)PGROUNDDOWN((uint64)ptr);
+
+        if ((uint64)ptr < (uint64)(slab + 1) || (uint64)ptr >= (uint64)slab + PGSIZE)
+        {
+            Drivers::uart_puts("Slab: kfree invalid pointer\n");
+            c->lock.release();
+            return;
+        }
+
+        char *base = (char *)(slab + 1);
+        int obj_idx = ((uint64)ptr - (uint64)base) / c->obj_size;
+
+        uint16 *link = (uint16 *)ptr;
+        *link = slab->free_idx;
+        slab->free_idx = (uint16)obj_idx;
+
+        slab->used_count--;
+
+        if (slab->used_count == 0)
+        {
+            struct SlabHeader **pp = &c->slab_list;
+            // bool found = false;
+            while (*pp)
+            {
+                if (*pp == slab)
+                {
+                    *pp = slab->next;
+                    // found = true;
+                    break;
+                }
+                pp = &(*pp)->next;
+            }
+
+            page->flags &= ~PG_slab;
+            PMM::free_page(slab);
+        }
+        else
+        {
+
+            if (slab->used_count == c->obj_count_per_slab - 1)
+            {
+                slab->next = c->slab_list;
+                c->slab_list = slab;
+            }
+        }
+
+        c->lock.release();
+    }
+}
\ No newline at end of file
diff --git a/src/kernel/mm/vm.cc b/src/kernel/mm/vm.cc
index 650fcf1..1155d2c 100644
--- a/src/kernel/mm/vm.cc
+++ b/src/kernel/mm/vm.cc
@@ -1,75 +1,85 @@
 #include "kernel/mm.h"
 #include "kernel/pmm.h"
 #include "kernel/riscv.h"
-#include "drivers/uart.h"
 #include "common/types.h"
-#include "kernel/config.h"
 #include "lib/string.h"
+#include "drivers/uart.h"
 
+extern "C"
+{
+    extern char kernel_end[];
+    extern char trampoline[];
+}
 
-extern char text_start[];
-extern char text_end[];
-extern char rodata_start[];
-extern char rodata_end[];
-extern char data_start[];
-extern char data_end[];
-extern char bss_start[];
-extern char bss_end[];
-extern char kernel_end[];
+namespace VM
+{
 
-extern char uservec[];
-extern char userret[];
-extern char trampoline[];
+    uint64 *kernel_pagetable;
 
-VM::pagetable_t kernel_pagetable;
+    static void page_ref_inc(uint64 pa)
+    {
+        struct Page *p = PMM::pa_to_page(pa);
+        if (p)
+        {
+            __atomic_add_fetch(&p->refcnt, 1, __ATOMIC_RELAXED);
+        }
+    }
 
-namespace VM
-{
-    // pagetable_t kernel_pagetable;
+    static bool page_ref_dec(uint64 pa)
+    {
+        struct Page *p = PMM::pa_to_page(pa);
+        if (p)
+        {
+            if (__atomic_sub_fetch(&p->refcnt, 1, __ATOMIC_RELEASE) == 0)
+            {
+                return true;
+            }
+        }
+        return false;
+    }
 
-    pte_t *walk(pagetable_t pagetable, uint64 va, int alloc)
+    static uint64 *walk(uint64 *pagetable, uint64 va, int alloc)
     {
         if (va >= MAXVA)
-            return 0;
-        
+            return nullptr;
+
         for (int level = 2; level > 0; level--)
         {
-            pte_t *pte = &pagetable[PX(level, va)];
-
+            uint64 *pte = &pagetable[PX(level, va)];
             if (*pte & PTE_V)
             {
-                pagetable = (pagetable_t)PTE2PA(*pte);
+                pagetable = (uint64 *)PTE2PA(*pte);
             }
             else
             {
-                if (!alloc || (pagetable = (pagetable_t)PMM::alloc_page()) == 0)
-                    return 0;
+                if (!alloc || (pagetable = (uint64 *)PMM::alloc_page()) == nullptr)
+                    return nullptr;
+
                 memset(pagetable, 0, PGSIZE);
-                // pagetable = (pagetable_t)PMM::alloc_page();
                 *pte = PA2PTE(pagetable) | PTE_V;
             }
         }
         return &pagetable[PX(0, va)];
     }
 
-    int mappages(pagetable_t pagetable, uint64 va, uint64 size, uint64 pa, int perm)
+    int mappages(uint64 *pagetable, uint64 va, uint64 size, uint64 pa, int perm)
     {
         uint64 a, last;
-        pte_t *pte;
+        uint64 *pte;
+
+        if (size == 0)
+            return -1;
 
         a = PGROUNDDOWN(va);
         last = PGROUNDDOWN(va + size - 1);
 
-        for(;;)
+        for (;;)
         {
-            if((pte = walk(pagetable, a, 1)) == 0)
+            if ((pte = walk(pagetable, a, 1)) == nullptr)
                 return -1;
 
             if (*pte & PTE_V)
             {
-                Drivers::uart_puts("Remap panic: ");
-                Drivers::print_hex(a);
-                Drivers::uart_puts("\n");
                 return -1;
             }
 
@@ -83,228 +93,356 @@ namespace VM
         return 0;
     }
 
-    void kvmmap(uint64 va, uint64 pa, uint64 sz, int perm)
+    uint64 *uvmcreate()
     {
-        if (mappages(kernel_pagetable, va, sz, pa, perm) != 0)
+        uint64 *pagetable = (uint64 *)PMM::alloc_page();
+        if (pagetable)
         {
-            Drivers::uart_puts("kvmmap: failed to map\n");
+            memset(pagetable, 0, PGSIZE);
+
+            if (mappages(pagetable, TRAMPOLINE, PGSIZE, (uint64)trampoline, PTE_R | PTE_X) < 0)
+            {
+                PMM::free_page(pagetable);
+                return nullptr;
+            }
         }
+        return pagetable;
     }
 
-    void kvminit()
+    void uvminit(uint64 *pagetable, uchar *src, uint64 sz)
     {
-        kernel_pagetable = (pagetable_t)PMM::alloc_page();
-        memset(kernel_pagetable, 0, PGSIZE);
-
-        kvmmap(g_uart_base, g_uart_base, PGSIZE, PTE_R | PTE_W);
-
-        kvmmap(g_plic_base, g_plic_base, 0x400000, PTE_R | PTE_W);
-
-        // kvmmap(g_clint_base, g_clint_base, 0x10000, PTE_R | PTE_W);
-
-        kvmmap((uint64)text_start, (uint64)text_start,
-               (uint64)text_end - (uint64)text_start, PTE_R | PTE_X);
-
-        kvmmap((uint64)rodata_start, (uint64)rodata_start,
-               (uint64)rodata_end - (uint64)rodata_start, PTE_R);
+        char *mem;
 
-        kvmmap((uint64)data_start, (uint64)data_start,
-               (uint64)kernel_end - (uint64)data_start, PTE_R | PTE_W);
+        if (sz >= PGSIZE)
+        {
+            Drivers::uart_puts("uvminit: initcode too big!\n");
+            return;
+        }
 
-        kvmmap((uint64)kernel_end, (uint64)kernel_end,
-               (uint64)PHYSTOP - (uint64)kernel_end, PTE_R | PTE_W);
+        mem = (char *)PMM::alloc_page();
+        memset(mem, 0, PGSIZE);
 
-        kvmmap(TRAMPOLINE, (uint64)trampoline, PGSIZE, PTE_R | PTE_X);
-    }
-    void kvminithart()
-    {
-        w_satp(MAKE_SATP(kernel_pagetable));
-        sfence_vma();
+        mappages(pagetable, 0, PGSIZE, (uint64)mem, PTE_W | PTE_R | PTE_X | PTE_U);
+        memmove(mem, src, sz);
     }
 
-
-    pagetable_t uvmcreate()
+    uint64 uvmalloc(uint64 *pagetable, uint64 oldsz, uint64 newsz, int xperm)
     {
-        pagetable_t pagetable = (pagetable_t)PMM::alloc_page();
-        if (pagetable == 0)
-            return 0;
-        memset(pagetable, 0, PGSIZE);
+        char *mem;
+        uint64 a;
+
+        if (newsz < oldsz)
+            return oldsz;
 
-        if (mappages(pagetable, TRAMPOLINE, PGSIZE, (uint64)trampoline, PTE_R | PTE_X) < 0)
+        oldsz = PGROUNDUP(oldsz);
+        for (a = oldsz; a < newsz; a += PGSIZE)
         {
-            return 0;
+            mem = (char *)PMM::alloc_page();
+            if (mem == nullptr)
+            {
+                uvmdealloc(pagetable, a, oldsz);
+                return 0;
+            }
+            memset(mem, 0, PGSIZE);
+            if (mappages(pagetable, a, PGSIZE, (uint64)mem, PTE_R | PTE_U | xperm) != 0)
+            {
+                PMM::free_page(mem);
+                uvmdealloc(pagetable, a, oldsz);
+                return 0;
+            }
         }
-
-        return pagetable;
+        return newsz;
     }
 
-    void uvminit(pagetable_t pagetable, uchar *src, uint sz)
+    uint64 uvmdealloc(uint64 *pagetable, uint64 oldsz, uint64 newsz)
     {
-        char *mem;
+        if (newsz >= oldsz)
+            return oldsz;
 
-        if (sz >= PGSIZE)
+        if (PGROUNDUP(newsz) < PGROUNDUP(oldsz))
         {
-            Drivers::uart_puts("uvminit: initcode too big\n");
-            return;
+            int npages = (PGROUNDUP(oldsz) - PGROUNDUP(newsz)) / PGSIZE;
+            uvmunmap(pagetable, PGROUNDUP(newsz), npages, 1);
         }
 
-        mem = (char*)PMM::alloc_page();
-        memset(mem, 0, PGSIZE);
-
-        mappages(pagetable, 0, PGSIZE, (uint64)mem, PTE_W|PTE_R|PTE_X|PTE_U);
-
-        memmove(mem, src, sz);
-
-        uint64 trap_pa = (uint64)uservec;
-        uint64 trap_page_start = PGROUNDDOWN(trap_pa);
-
-        mappages(pagetable, trap_page_start, PGSIZE, trap_page_start, PTE_R | PTE_X);
-
-        mappages(pagetable, trap_page_start + PGSIZE, PGSIZE, trap_page_start + PGSIZE, PTE_R | PTE_X);
+        return newsz;
     }
 
-    void uvmunmap(pagetable_t pagetable, uint64 va, uint64 npages, int do_free)
+    void uvmunmap(uint64 *pagetable, uint64 va, uint64 npages, int do_free)
     {
         uint64 a;
-        pte_t *pte;
+        uint64 *pte;
 
         if ((va % PGSIZE) != 0)
-        {
-            Drivers::uart_puts("uvmunmap: not aligned\n");
             return;
-        }
 
-        for(a = va; a < va + npages * PGSIZE; a += PGSIZE)
+        for (a = va; a < va + npages * PGSIZE; a += PGSIZE)
         {
-            if ((pte = walk(pagetable, a, 0)) == 0)
+            if ((pte = walk(pagetable, a, 0)) == nullptr)
                 continue;
 
-            if((*pte & PTE_V) == 0)
+            if ((*pte & PTE_V) == 0)
                 continue;
 
-            if (PTE_FLAGS(*pte) == PTE_V)
+            if ((PTE_FLAGS(*pte) & (PTE_R | PTE_W | PTE_X)) == 0)
             {
-                Drivers::uart_puts("uvmunmap: not a leaf\n");
+                continue;
             }
 
             if (do_free)
             {
                 uint64 pa = PTE2PA(*pte);
-                PMM::free_page((void *)pa);
+                if (page_ref_dec(pa))
+                {
+                    PMM::free_page((void *)pa);
+                }
             }
             *pte = 0;
         }
     }
 
-    void uvmfree(pagetable_t pagetable, uint64 sz)
+    static void freewalk(uint64 *pagetable)
     {
-        if(sz > 0)
-            uvmunmap(pagetable, 0, PGROUNDDOWN(sz)/PGSIZE, 1);
+        for (int i = 0; i < 512; i++)
+        {
+            uint64 pte = pagetable[i];
+            if ((pte & PTE_V) && (pte & (PTE_R | PTE_W | PTE_X)) == 0)
+            {
+                uint64 *child = (uint64 *)PTE2PA(pte);
+                freewalk(child);
+                pagetable[i] = 0;
+            }
+        }
+        PMM::free_page(pagetable);
+    }
 
-        PMM::free_page((void *)pagetable);
+    void uvmfree(uint64 *pagetable, uint64 sz)
+    {
+        if (sz > 0)
+            uvmunmap(pagetable, 0, PGROUNDUP(sz) / PGSIZE, 1);
+        freewalk(pagetable);
     }
 
-    int uvmcopy(pagetable_t oldpt, pagetable_t newpt, uint64 sz)
+    int uvmcopy(uint64 *oldpt, uint64 *newpt, uint64 sz)
     {
-        pte_t *pte;
+        uint64 *pte;
         uint64 pa, i;
         uint flags;
-        char *mem;
 
-        for(i = 0; i < sz; i += PGSIZE)
+        for (i = 0; i < sz; i += PGSIZE)
         {
-            if((pte = walk(oldpt, i, 0)) == 0)
+            if ((pte = walk(oldpt, i, 0)) == nullptr)
                 continue;
             if ((*pte & PTE_V) == 0)
                 continue;
-            
+
             pa = PTE2PA(*pte);
             flags = PTE_FLAGS(*pte);
 
-            if ((mem = (char *)PMM::alloc_page()) == 0)
-                goto err;
-
-            memmove(mem, (char *)pa, PGSIZE);
+            if (flags & PTE_W)
+            {
+                flags &= ~PTE_W;
+                flags |= PTE_COW;
+                *pte = PA2PTE(pa) | flags;
+            }
 
-            if (mappages(newpt, i, PGSIZE, (uint64)mem, flags) != 0)
+            if (mappages(newpt, i, PGSIZE, pa, flags) != 0)
             {
-                PMM::free_page(mem);
-                goto err;
+                return -1;
             }
+
+            page_ref_inc(pa);
         }
+
+        sfence_vma();
         return 0;
-    err:
-        uvmunmap(newpt, 0, i / PGSIZE, 1);
-        return -1;
     }
 
-    uint64 uvmalloc(pagetable_t pagetable, uint64 oldsz, uint64 newsz)
-    {
-        char *mem;
-        uint64 a;
+    int handle_cow_fault(uint64 *pagetable, uint64 va);
 
-        if (newsz < oldsz)
-            return oldsz;
+    int copyout(uint64 *pagetable, uint64 dstva, char *src, uint64 len)
+    {
+        uint64 n, va0, pa0;
+        uint64 *pte;
 
-        oldsz = PGROUNDUP(oldsz);
-        for (a = oldsz; a < newsz; a += PGSIZE)
+        while (len > 0)
         {
-            mem = (char *)PMM::alloc_page();
-            if (mem == 0)
-            {
-                uvmdealloc(pagetable, a, oldsz);
-                return 0;
-            }
-            memset(mem, 0, PGSIZE);
-            if (mappages(pagetable, a, PGSIZE, (uint64)mem, PTE_W | PTE_X | PTE_R | PTE_U) != 0)
+            va0 = PGROUNDDOWN(dstva);
+            pte = walk(pagetable, va0, 0);
+            if (pte == nullptr || (*pte & PTE_V) == 0 || (*pte & PTE_U) == 0)
+                return -1;
+
+            // Note: Maybe a bug
+            if (*pte & PTE_COW)
             {
-                PMM::free_page(mem);
-                uvmdealloc(pagetable, a, oldsz);
-                return 0;
+                if (handle_cow_fault(pagetable, va0) < 0)
+                    return -1;
+                // Re-walk because handle_cow_fault replaced the page mapping
+                pte = walk(pagetable, va0, 0);
+                if (pte == nullptr || (*pte & PTE_V) == 0 || (*pte & PTE_U) == 0)
+                    return -1;
             }
-        }
-        return newsz;
-    }
 
-    uint64 uvmdealloc(pagetable_t pagetable, uint64 oldsz, uint64 newsz)
-    {
-        if (newsz >= oldsz)
-            return oldsz;
+            pa0 = PTE2PA(*pte);
+            n = PGSIZE - (dstva - va0);
+            if (n > len)
+                n = len;
 
-        if (PGROUNDUP(newsz) < PGROUNDUP(oldsz))
-        {
-            int npages = (PGROUNDUP(oldsz) - PGROUNDUP(newsz)) / PGSIZE;
-            uvmunmap(pagetable, PGROUNDUP(newsz), npages, 1);
-        }
+            memmove((void *)(pa0 + (dstva - va0)), src, n);
 
-        return newsz;
+            len -= n;
+            src += n;
+            dstva = va0 + PGSIZE;
+        }
+        return 0;
     }
 
-    int copyin(pagetable_t pagetable, char *dst, uint64 srcva, uint64 len)
+    int copyin(uint64 *pagetable, char *dst, uint64 srcva, uint64 len)
     {
         uint64 n, va0, pa0;
-        pte_t *pte;
+        uint64 *pte;
 
         while (len > 0)
         {
             va0 = PGROUNDDOWN(srcva);
             pte = walk(pagetable, va0, 0);
-            if(pte == 0 || (*pte & PTE_V) == 0 || (*pte & PTE_U) == 0)
-            {
+            if (pte == nullptr || (*pte & PTE_V) == 0 || (*pte & PTE_U) == 0)
                 return -1;
-            }
+
             pa0 = PTE2PA(*pte);
             n = PGSIZE - (srcva - va0);
-            if(n > len)
+            if (n > len)
                 n = len;
-            
-            memmove(dst, (void*)(pa0 + (srcva - va0)), n);
+
+            memmove(dst, (void *)(pa0 + (srcva - va0)), n);
 
             len -= n;
             dst += n;
             srcva = va0 + PGSIZE;
         }
         return 0;
-        
+    }
+
+    int copyinstr(uint64 *pagetable, char *dst, uint64 srcva, uint64 max)
+    {
+        uint64 n, va0, pa0;
+        uint64 *pte;
+        int got_null = 0;
+        uint64 len = 0;
+
+        while (len < max)
+        {
+            va0 = PGROUNDDOWN(srcva);
+            pte = walk(pagetable, va0, 0);
+
+            if (pte == nullptr || (*pte & PTE_V) == 0 || (*pte & PTE_U) == 0)
+                return -1;
+
+            pa0 = PTE2PA(*pte);
+
+            n = PGSIZE - (srcva - va0);
+            if (n > max - len)
+                n = max - len;
+
+            char *p = (char *)(pa0 + (srcva - va0));
+            while (n > 0)
+            {
+                if (*p == '\0')
+                {
+                    *dst = '\0';
+                    got_null = 1;
+                    break;
+                }
+                *dst = *p;
+                n--;
+                srcva++;
+                dst++;
+                p++;
+                len++;
+            }
+            if (got_null)
+                break;
+        }
+
+        if (got_null)
+            return 0;
+
+        return -1;
+    }
+
+    int handle_cow_fault(uint64 *pagetable, uint64 va)
+    {
+        if (va >= MAXVA)
+            return -1;
+
+        uint64 *pte = walk(pagetable, va, 0);
+        if (pte == nullptr || (*pte & PTE_V) == 0 || (*pte & PTE_U) == 0)
+            return -1;
+
+        if ((*pte & PTE_COW) == 0)
+            return -1;
+
+        uint64 pa = PTE2PA(*pte);
+        uint64 flags = PTE_FLAGS(*pte);
+
+        char *mem = (char *)PMM::alloc_page();
+        if (mem == nullptr)
+            return -1;
+
+        memmove(mem, (char *)pa, PGSIZE);
+
+        uint64 new_flags = (flags | PTE_W) & ~PTE_COW;
+        *pte = PA2PTE((uint64)mem) | new_flags | PTE_V;
+
+        if (page_ref_dec(pa))
+        {
+            PMM::free_page((void *)pa);
+        }
+
+        sfence_vma();
+        return 0;
+    }
+
+    static void kvmmap(uint64 va, uint64 pa, uint64 sz, int perm)
+    {
+        if (mappages(kernel_pagetable, va, sz, pa, perm) != 0)
+        {
+            Drivers::uart_puts("kvmmap: failed\n");
+            while (1)
+                ;
+        }
+    }
+
+    void kvminit()
+    {
+        kernel_pagetable = uvmcreate();
+
+        kvmmap(0x10000000, 0x10000000, 0x10000, PTE_R | PTE_W);
+        kvmmap(0x0c000000, 0x0c000000, 0x400000, PTE_R | PTE_W);
+        kvmmap(0x02000000, 0x02000000, 0x10000, PTE_R | PTE_W); // CLINT
+        kvmmap(KERNBASE, KERNBASE, PHYSTOP - KERNBASE, PTE_R | PTE_W | PTE_X);
+    }
+
+    void kvminithart()
+    {
+        w_satp(MAKE_SATP(kernel_pagetable));
+        sfence_vma();
+        Drivers::uart_puts("[Boot] MMU ENABLED! Using virtual addresses.\n");
+    }
+
+    uint64 walkaddr(uint64 *pagetable, uint64 va)
+    {
+        uint64 *pte;
+        uint64 pa;
+
+        if (va >= MAXVA)
+            return 0;
+
+        pte = walk(pagetable, va, 0);
+        if (pte == 0 || (*pte & PTE_V) == 0 || (*pte & PTE_U) == 0)
+            return 0;
+
+        pa = PTE2PA(*pte);
+        return pa;
     }
 }
\ No newline at end of file
diff --git a/src/kernel/proc/exec.cc b/src/kernel/proc/exec.cc
new file mode 100644
index 0000000..22e4842
--- /dev/null
+++ b/src/kernel/proc/exec.cc
@@ -0,0 +1,214 @@
+#include "common/types.h"
+#include "kernel/riscv.h"
+#include "kernel/proc.h"
+#include "kernel/mm.h"
+#include "kernel/elf.h"
+#include "fs/fs.h"
+#include "lib/string.h"
+#include "drivers/uart.h"
+#include "kernel/trap.h"
+#include "drivers/uart.h"
+
+extern char trampoline[];
+
+// RAII: Page Table Resource Management
+class VmGuard
+{
+public:
+    uint64 *pagetable = nullptr;
+    uint64 sz = 0;
+
+    VmGuard() : pagetable(VM::uvmcreate()) {}
+
+    ~VmGuard()
+    {
+        if (pagetable)
+        {
+            VM::uvmfree(pagetable, sz);
+        }
+    }
+
+    // Copying is prohibited
+    VmGuard(const VmGuard &) = delete;
+    VmGuard &operator=(const VmGuard &) = delete;
+
+    // Submit resources: Ownership transfer, destructor no longer releases
+    uint64 *commit()
+    {
+        uint64 *pt = pagetable;
+        pagetable = nullptr;
+        return pt;
+    }
+};
+
+// RAII: Inode Lock Management
+class InodeGuard
+{
+public:
+    Inode *ip;
+    InodeGuard(Inode *i) : ip(i)
+    {
+        if (ip)
+            VFS::ilock(ip);
+    }
+    ~InodeGuard()
+    {
+        if (ip)
+        {
+            VFS::iunlockput(ip); // Automatically unlock and release references
+        }
+    }
+    // Copying is prohibited
+    InodeGuard(const InodeGuard &) = delete;
+    InodeGuard &operator=(const InodeGuard &) = delete;
+};
+
+// laod segment
+static int loadseg(uint64 *pagetable, uint64 va, Inode *ip, uint64 offset, uint64 sz)
+{
+    for (uint64 i = 0; i < sz; i += PGSIZE)
+    {
+        uint64 pa = VM::walkaddr(pagetable, va + i);
+        if (pa == 0)
+            return -1;
+
+        uint64 n = PGSIZE - (va + i) % PGSIZE;
+        if (i + n > sz)
+            n = sz - i;
+
+        // Read physical address (isUser=0)
+        if (ip->read((char *)(pa + (va + i) % PGSIZE), offset + i, n, 0) != (int)n)
+            return -1;
+    }
+    return 0;
+}
+
+namespace Exec
+{
+    int exec(char *path, char **argv)
+    {
+        // Get Inode
+        Inode *raw_ip = VFS::namei(path);
+        if (!raw_ip)
+            return -1;
+        InodeGuard iguard(raw_ip);
+
+        // Get ELF head
+        struct elfhdr elf;
+        if (raw_ip->read((char *)&elf, 0, sizeof(elf), 0) != sizeof(elf))
+            return -1;
+        if (elf.magic != ELF_MAGIC)
+            return -1;
+        // Create new pagetable
+        VmGuard vm_guard;
+        if (!vm_guard.pagetable)
+            return -1;
+        // Load Program Segment
+        struct proghdr ph;
+        for (int i = 0; i < elf.phnum; i++)
+        {
+            uint64 off = elf.phoff + i * sizeof(ph);
+            if (raw_ip->read((char *)&ph, off, sizeof(ph), 0) != sizeof(ph))
+                return -1;
+
+            if (ph.type != ELF_PROG_LOAD)
+                continue;
+            if (ph.memsz < ph.filesz)
+                return -1;
+            if (ph.vaddr + ph.memsz < ph.vaddr)
+                return -1;
+
+            uint64 sz1 = VM::uvmalloc(vm_guard.pagetable, vm_guard.sz, ph.vaddr + ph.memsz, PTE_W | PTE_X | PTE_R | PTE_U);
+            if (sz1 == 0)
+                return -1;
+            vm_guard.sz = sz1;
+
+            if (loadseg(vm_guard.pagetable, ph.vaddr, raw_ip, ph.off, ph.filesz) < 0)
+                return -1;
+        }
+
+        // Prepare user stack
+        uint64 sz = PGROUNDUP(vm_guard.sz);
+
+        const int stack_data_pages = 16;
+        const int stack_total_pages = stack_data_pages + 1;
+
+        uint64 sz1 = VM::uvmalloc(vm_guard.pagetable, sz, sz + stack_total_pages * PGSIZE, PTE_W | PTE_R | PTE_U);
+        if (sz1 == 0)
+            return -1;
+        vm_guard.sz = sz1;
+
+        VM::uvmunmap(vm_guard.pagetable, sz, 1, 0); // protected pagetable
+
+        uint64 sp = sz1;
+        uint64 stackbase = sp - stack_data_pages * PGSIZE;
+        uint64 ustack[32];
+        uint64 argc = 0;
+
+        // Push parameter string
+        for (; argv[argc]; argc++)
+        {
+            if (argc >= 31)
+                return -1;
+            sp -= strlen(argv[argc]) + 1;
+            sp -= sp % 16;
+            if (sp < stackbase)
+                return -1;
+
+            if (VM::copyout(vm_guard.pagetable, sp, argv[argc], strlen(argv[argc]) + 1) < 0)
+                return -1;
+            ustack[argc] = sp;
+        }
+        ustack[argc] = 0;
+
+        // Push into parameter array
+        sp -= (argc + 1) * sizeof(uint64);
+        sp -= sp % 16;
+        if (sp < stackbase)
+            return -1;
+        if (VM::copyout(vm_guard.pagetable, sp, (char *)ustack, (argc + 1) * sizeof(uint64)) < 0)
+            return -1;
+
+        // Commit Changes
+        struct Proc *p = myproc();
+        if (VM::mappages(vm_guard.pagetable, TRAPFRAME, PGSIZE, (uint64)p->tf, PTE_R | PTE_W) < 0)
+            return -1;
+
+        uint64 oldsz = p->sz;
+        uint64 *oldpagetable = p->pagetable;
+
+        // setup Trapframe
+        p->tf->a0 = argc;
+        p->tf->a1 = sp;
+        p->tf->sp = sp;
+        p->tf->epc = elf.entry;
+
+        // update process name
+        char *s = path, *last = path;
+        while (*s)
+        {
+            if (*s == '/')
+                last = s + 1;
+            s++;
+        }
+        // memmove(p->name, last, sizeof(p->name));
+        size_t len = 0;
+        while (last[len] && len < sizeof(p->name) - 1)
+        {
+            p->name[len] = last[len];
+            len++;
+        }
+        p->name[len] = '\0';
+
+        // change pagetable
+        p->pagetable = vm_guard.commit();
+        p->sz = vm_guard.sz;
+
+        // release old pagetable
+        VM::uvmfree(oldpagetable, oldsz);
+
+        asm volatile("fence.i");
+
+        return 0; // iguard unlocks and releases IP upon destruction
+    }
+}
\ No newline at end of file
diff --git a/src/kernel/proc/proc.cc b/src/kernel/proc/proc.cc
index b0ab370..5db5f7a 100644
--- a/src/kernel/proc/proc.cc
+++ b/src/kernel/proc/proc.cc
@@ -1,112 +1,231 @@
 #include "kernel/proc.h"
+#include "kernel/proc_def.h"
+#include "kernel/runqueue.h"
+#include "kernel/cpu.h"
+#include "kernel/spinlock.h"
 #include "kernel/pmm.h"
 #include "kernel/mm.h"
-#include "drivers/uart.h"
 #include "kernel/trap.h"
-#include "common/types.h"
 #include "kernel/riscv.h"
-#include "kernel/config.h"
-#include "kernel/spinlock.h"
+#include "kernel/slab.h"
+#include "drivers/uart.h"
+#include "fs/fs.h"
+#include "fs/file.h"
 #include "lib/string.h"
 
-#define NPROC 10
+// #define NPROC 64
+#define NCPU 8
 
 extern "C" void swtch(struct Context *old_ctx, struct Context *new_ctx);
-extern char uservec[];
+extern char uservec[], trampoline[];
+extern "C" void usertrap();
 extern "C" void userret(uint64, uint64);
-extern char trampoline[];
+extern char initcode_start[], initcode_end[];
+
+// struct Proc procs[NPROC];
+struct Proc *proc_list_head = nullptr;
+struct Proc *initproc = nullptr;
+struct Spinlock proc_mem_lock;
+struct cpu cpus[NCPU];
+struct RunQueue runqueues[NCPU];
+
 
-struct Proc procs[NPROC];
-struct Context main_context;
-struct Proc *current_proc = nullptr;
-struct spinlock proc_lock;
+static int nextpid = 1;
 
-int nextpid = 1;
 
-extern char initcode_start[];
-extern char initcode_end[];
+struct cpu *mycpu()
+{
+    int id = r_tp();
+    return &cpus[id];
+}
+
 
-struct Proc *myproc()
+void RunQueue::init(const char *name)
 {
-    // 简化处理
-    return current_proc;
+    lock.init(name);
+    count = 0;
+    for (int i = 0; i < N_PRIO; i++)
+    {
+        heads[i] = nullptr;
+        tails[i] = nullptr;
+    }
 }
 
+void RunQueue::enqueue(struct Proc *p)
+{
+    if (p->priority < 0 || p->priority >= N_PRIO)
+        p->priority = PRIO_MIN;
+    p->next = nullptr;
+    if (heads[p->priority] == nullptr)
+    {
+        heads[p->priority] = p;
+        tails[p->priority] = p;
+    }
+    else
+    {
+        tails[p->priority]->next = p;
+        tails[p->priority] = p;
+    }
+    count++;
+}
+
+struct Proc *RunQueue::dequeue()
+{
+    for (int i = 0; i < N_PRIO; i++)
+    {
+        if (heads[i])
+        {
+            struct Proc *p = heads[i];
+            heads[i] = p->next;
+            if (!heads[i])
+                tails[i] = nullptr;
+            p->next = nullptr;
+            count--;
+            return p;
+        }
+    }
+    return nullptr;
+}
+
+struct Proc *RunQueue::steal()
+{
+    for (int i = N_PRIO - 1; i >= 0; i--)
+    {
+        if (heads[i])
+        {
+            struct Proc *p = heads[i];
+            heads[i] = p->next;
+            if (!heads[i])
+                tails[i] = nullptr;
+            p->next = nullptr;
+            count--;
+            return p;
+        }
+    }
+    return nullptr;
+}
+
+//  Trap Return Functions
+
 void usertrapret()
 {
     struct Proc *p = myproc();
 
     intr_off();
 
+    // Set stvec to point to uservec in the trampoline
+    // When an interrupt occurs in user mode, the CPU will jump here
     uint64 trampoline_uservec = TRAMPOLINE + (uservec - trampoline);
     w_stvec(trampoline_uservec);
 
+    // Fill in the Trapframe, used when uservec saves the kernel state
     p->tf->kernel_satp = r_satp();
     p->tf->kernel_sp = (uint64)p->kstack + PGSIZE;
     p->tf->kernel_trap = (uint64)usertrap;
     p->tf->kernel_hartid = r_tp();
 
+    // Set SSTATUS
+    // SPP = 0 (return to User Mode)
+    // SPIE = 1 (enable interrupts)
     unsigned long x = r_sstatus();
     x &= ~SSTATUS_SPP;
     x |= SSTATUS_SPIE;
     w_sstatus(x);
 
+    // Set SEPC to the user program counter
     w_sepc(p->tf->epc);
 
+    // Prepare user page table SATP
     uint64 satp = MAKE_SATP(p->pagetable);
 
+    // Calculate the virtual address of userret in the trampoline
     uint64 fn = TRAMPOLINE + ((uint64)userret - (uint64)trampoline);
+
+    // Jump to userret, with parameters being the TRAPFRAME address and the user page table SATP
     ((void (*)(uint64, uint64))fn)(TRAPFRAME, satp);
 }
 
+
 void forkret()
 {
-    //....
-    Spinlock::release(&proc_lock);
+
+    struct cpu *c = mycpu();
+    c->runqueue->lock.release();
 
     Drivers::uart_puts("[Proc] forkret: jumping to user.\n");
+
+    // Enter user mode
     usertrapret();
 }
 
+//  ProcManager Implementation
+
 static Proc *allocproc()
 {
-    struct Proc* p;
-    Spinlock::acquire(&proc_lock);
-    for (p = procs; p < &procs[NPROC]; p++)
+    struct Proc *p;
+    proc_mem_lock.acquire();
+
+    p = (struct Proc *)Slab::kmalloc(sizeof(struct Proc));
+
+    if (!p)
     {
-        if (p->state == UNUSED)
-        {
-            goto found;
-        }
+        proc_mem_lock.release();
+        return 0;
     }
 
-    Spinlock::release(&proc_lock);
-    return 0;
+    memset(p, 0, sizeof(struct Proc));
+
+    p->all_next = proc_list_head;
+    p->all_prev = nullptr;
+    if (proc_list_head)
+        proc_list_head->all_prev = p;
+    proc_list_head = p;
+
 
-found:
     p->state = USED;
     p->pid = nextpid++;
+    p->priority = 0;
+    p->cpu = mycpu();
+    p->cwd = nullptr;
+    for (int i = 0; i < NOFILE; i++)
+        p->ofile[i] = nullptr;
 
     if ((p->tf = (struct Trapframe *)PMM::alloc_page()) == 0)
     {
         p->state = UNUSED;
-        Spinlock::release(&proc_lock);
+        if (p->all_next)
+            p->all_next->all_prev = p->all_prev;
+        if (p->all_prev)
+            p->all_prev->all_next = p->all_next;
+        if (p == proc_list_head)
+            proc_list_head = p->all_next;
+        Slab::kfree(p);
+        proc_mem_lock.release();
         return 0;
     }
+
     if ((p->kstack = PMM::alloc_page()) == 0)
     {
         PMM::free_page(p->tf);
         p->state = UNUSED;
-        Spinlock::release(&proc_lock);
+        if (p->all_next)
+            p->all_next->all_prev = p->all_prev;
+        if (p->all_prev)
+            p->all_prev->all_next = p->all_next;
+        if (p == proc_list_head)
+            proc_list_head = p->all_next;
+        Slab::kfree(p);
+
+        proc_mem_lock.release();
         return 0;
     }
     memset(p->kstack, 0, PGSIZE);
 
     memset(&p->context, 0, sizeof(p->context));
+
+    // Set the context so that the next time this process is scheduled, it starts executing directly from forkret
     p->context.ra = (uint64)forkret;
     p->context.sp = (uint64)p->kstack + PGSIZE;
-
-    Spinlock::release(&proc_lock);
     return p;
 }
 
@@ -115,218 +234,275 @@ static void freeproc(struct Proc *p)
     if (p->tf)
         PMM::free_page(p->tf);
     p->tf = 0;
-
     if (p->kstack)
         PMM::free_page(p->kstack);
     p->kstack = 0;
-
     if (p->pagetable)
         VM::uvmfree(p->pagetable, p->sz);
-    p->pagetable = 0;
-
-    p->sz = 0;
-    p->pid = 0;
-    p->parent = 0;
-    p->name[0] = 0;
-    p->chan = 0;
-    p->state = UNUSED;
+    for (int i = 0; i < NOFILE; i++)
+    {
+        if (p->ofile[i])
+        {
+            FileTable::close(p->ofile[i]);
+            p->ofile[i] = nullptr;
+        }
+    }
+    if (p->cwd)
+    {
+        VFS::iput(p->cwd);
+        p->cwd = nullptr;
+    }
+
+    if (p->all_prev)
+        p->all_prev->all_next = p->all_next;
+    else
+        proc_list_head = p->all_next;
+
+    if (p->all_next)
+        p->all_next->all_prev = p->all_prev;
+
+    Slab::kfree(p);
 }
 
 int fork()
 {
-    int pid;
     struct Proc *np;
     struct Proc *p = myproc();
 
     if ((np = allocproc()) == 0)
-    {
         return -1;
-    }
 
     np->pagetable = VM::uvmcreate();
-
+    np->sz = p->sz;
     if (VM::uvmcopy(p->pagetable, np->pagetable, p->sz) < 0)
     {
         freeproc(np);
-        Spinlock::release(&proc_lock);
+        proc_mem_lock.release();
         return -1;
     }
-    np->sz = p->sz;
+    
 
-    if (VM::mappages(np->pagetable, TRAPFRAME, PGSIZE,
-                     (uint64)np->tf, PTE_R | PTE_W) < 0)
+    if (VM::mappages(np->pagetable, TRAPFRAME, PGSIZE, (uint64)np->tf, PTE_R | PTE_W) < 0)
     {
         freeproc(np);
+        proc_mem_lock.release();
         return -1;
     }
 
     *(np->tf) = *(p->tf);
-
     np->tf->a0 = 0;
-
     strcpy(np->name, p->name);
     np->parent = p;
+    np->priority = p->priority;
 
-    Spinlock::acquire(&proc_lock);
+    for (int i = 0; i < NOFILE; i++)
+    {
+        if (p->ofile[i])
+        {
+            np->ofile[i] = FileTable::dup(p->ofile[i]);
+        }
+    }
+
+    if (p->cwd)
+    {
+        np->cwd = VFS::idup(p->cwd);
+    }
+
+    proc_mem_lock.release();
+
+    struct cpu *c = mycpu();
+    c->runqueue->lock.acquire();
     np->state = RUNNABLE;
-    pid = np->pid;
-    Spinlock::release(&proc_lock);
+    c->runqueue->enqueue(np);
+    c->runqueue->lock.release();
 
-    return pid;
+    return np->pid;
 }
 
 namespace ProcManager
 {
+
     void init()
     {
-        Spinlock::init(&proc_lock, "proc");
+        proc_mem_lock.init("proc_mem");
+
+        proc_list_head = nullptr;
 
-        for (int i = 0; i < NPROC; i++)
+        for (int i = 0; i < NCPU; i++)
         {
-            procs[i].state = UNUSED;
-            procs[i].kstack = 0;
+            cpus[i].runqueue = &runqueues[i];
+            cpus[i].runqueue->init("runqueue");
         }
     }
 
-    void create_kernel_thread(void (*func)(), const char *name)
+    void scheduler()
     {
-        struct Proc *p = nullptr;
-        for(int i = 0; i < NPROC; i++)
-        {
-            if(procs[i].state == UNUSED)
-            {
-                p = &procs[i];
-                p->pid = i + 1;
-                break;
-            }
-        }
+        struct Proc *p;
+        struct cpu *c = mycpu();
+        c->proc = 0;
+        Drivers::uart_puts("[Proc] Scheduler started (Per-CPU).\n");
 
-        if (!p)
+        for (;;)
         {
-            Drivers::uart_puts("Error: No free process slots!\n");
-            return;
-        }
+            intr_on();
 
-        p->kstack = PMM::alloc_page();
-        if (!p->kstack)
-        {
-            Drivers::uart_puts("Error: Alloc kstack failed!\n");
-            return;
-        }
+            // Get from the local queue
+            c->runqueue->lock.acquire();
+            p = c->runqueue->dequeue();
+            c->runqueue->lock.release();
 
-        p->context.ra = (uint64)func;
+            // Work Stealing
+            if (!p)
+            {
+                for (int i = 0; i < NCPU; i++)
+                {
+                    if ((uint64)i == r_tp())
+                        continue;
+
+                    struct cpu *victim = &cpus[i];
+                    victim->runqueue->lock.acquire();
+                    if (victim->runqueue->count > 0)
+                        p = victim->runqueue->steal();
+                    victim->runqueue->lock.release();
+                    if (p)
+                        break;
+                }
+            }
 
-        p->context.sp = (uint64)p->kstack + 4096;
+            if (p)
+            {
+                p->state = RUNNING;
+                c->proc = p;
 
-        p->state = RUNNABLE;
-        strcpy(p->name, name);
+                c->runqueue->lock.acquire();
+                swtch(&c->context, &p->context);
+                c->runqueue->lock.release();
 
-        Drivers::uart_puts("[Proc] Created thread: ");
-        Drivers::uart_puts(name);
-        Drivers::uart_puts("\n");
+                c->proc = 0;
+            }
+        }
     }
 
     void yield()
     {
         struct Proc *p = myproc();
-        Spinlock::acquire(&proc_lock);
+        struct cpu *c = mycpu();
+        c->runqueue->lock.acquire();
         if (p && p->state == RUNNING)
         {
             p->state = RUNNABLE;
-            swtch(&p->context, &main_context);
+            if (p->priority < PRIO_MIN)
+                p->priority++;
+            c->runqueue->enqueue(p);
+            swtch(&p->context, &c->context);
         }
-        Spinlock::release(&proc_lock);
+        c->runqueue->lock.release();
     }
 
-    void scheduler()
+    void user_init()
     {
-        struct Proc *p = nullptr;
-        Drivers::uart_puts("[Proc] Scheduler started.\n");
+        struct Proc *p = allocproc();
+        if (!p)
+            return;
 
-        for (;;)
-        {
-            intr_on();
+        initproc = p;
 
-            Spinlock::acquire(&proc_lock);
+        p->pagetable = VM::uvmcreate();
 
-            for (p = procs; p < &procs[NPROC]; p++)
+        uint64 initcode_sz = initcode_end - initcode_start;
+        Drivers::uart_puts("[Proc] initcode size: ");
+        Drivers::uart_put_int(initcode_sz);
+        Drivers::uart_puts(" bytes\n");
+
+        uint64 code_pages = PGROUNDUP(initcode_sz) / PGSIZE;
+
+        for (uint64 i = 0; i < code_pages; i++)
+        {
+            void *mem = PMM::alloc_page();
+            if (!mem)
             {
-                if (p->state == RUNNABLE)
-                {
-                    p->state = RUNNING;
-                    current_proc = p;
+                Drivers::uart_puts("user_init: out of memory for code\n");
+                return;
+            }
+            memset(mem, 0, PGSIZE);
 
-                    swtch(&main_context, &p->context);
+            uint64 src_offset = i * PGSIZE;
+            uint64 copy_len = PGSIZE;
+            if (src_offset + copy_len > initcode_sz)
+            {
+                copy_len = initcode_sz - src_offset;
+            }
+            memmove(mem, (void *)(initcode_start + src_offset), copy_len);
 
-                    current_proc = nullptr;
-                }
+            if (VM::mappages(p->pagetable, i * PGSIZE, PGSIZE, (uint64)mem, PTE_R | PTE_W | PTE_X | PTE_U) < 0)
+            {
+                Drivers::uart_puts("user_init: mappages code failed\n");
+                return;
             }
-            Spinlock::release(&proc_lock);
         }
-    }
 
-    void user_init()
-    {
-        struct Proc *p;
+        uint64 stack_va = (code_pages + 1) * PGSIZE;
 
-        p = allocproc();
-        if (!p)
-        {
-            Drivers::uart_puts("user_init: failed\n");
+        void *stack = PMM::alloc_page();
+        if (!stack)
             return;
-        }
-
-        p->pagetable = VM::uvmcreate();
+        memset(stack, 0, PGSIZE);
 
-        uint64 initcode_sz = initcode_end - initcode_start;
-        VM::uvminit(p->pagetable, (uchar *)initcode_start, initcode_sz);
-        p->sz = PGSIZE;
+        if (VM::mappages(p->pagetable, stack_va, PGSIZE, (uint64)stack, PTE_R | PTE_W | PTE_U) < 0)
+            return;
 
-        if (VM::mappages(p->pagetable, TRAPFRAME, PGSIZE,
-                         (uint64)p->tf, PTE_R | PTE_W) < 0)
-        {
-            Drivers::uart_puts("user_init: map trapframe failed\n");
+        if (VM::mappages(p->pagetable, TRAPFRAME, PGSIZE, (uint64)p->tf, PTE_R | PTE_W) < 0)
             return;
-        }
 
-        
         p->tf->epc = 0;
-        p->tf->sp = PGSIZE;
-
+        p->tf->sp = stack_va + PGSIZE;
+        p->sz = stack_va + PGSIZE;
         strcpy(p->name, "initcode");
 
-        
-        Spinlock::acquire(&proc_lock);
+        p->cwd = nullptr;
+
+        proc_mem_lock.release();
+
+        struct cpu *c = &cpus[0];
+        c->runqueue->lock.acquire();
         p->state = RUNNABLE;
-        Spinlock::release(&proc_lock);
+        c->runqueue->enqueue(p);
+        c->runqueue->lock.release();
 
         Drivers::uart_puts("[Proc] user_init success. PID: 1\n");
+        asm volatile("fence.i");
     }
 
-    void sleep(void *chan, struct spinlock *lk)
+    void sleep(void *chan, Spinlock *lk)
     {
         struct Proc *p = myproc();
-        if(lk != &proc_lock)
-        {
-            Drivers::uart_puts("sleep: lock mismatch\n");
-            while (1)
-                ;
-        }
-        p->chan = chan;
-        p->state = SLEEPING;
+        struct cpu *c = mycpu();
 
-        swtch(&p->context, &main_context);
+        if (lk && lk != &proc_mem_lock)
+            lk->release();
 
+        c->runqueue->lock.acquire();
+        p->chan = chan;
+        p->state = SLEEPING;
+        swtch(&p->context, &c->context);
         p->chan = 0;
+        c->runqueue->lock.release();
+
+        if (lk && lk != &proc_mem_lock)
+            lk->acquire();
     }
 
     void wakeup(void *chan)
     {
-        for(struct Proc *p = procs; p < &procs[NPROC]; p++)
+        for (struct Proc *p = proc_list_head; p != nullptr; p = p->all_next)
         {
             if (p->state == SLEEPING && p->chan == chan)
             {
+                struct cpu *c = mycpu();
+                c->runqueue->lock.acquire();
                 p->state = RUNNABLE;
+                c->runqueue->enqueue(p);
+                c->runqueue->lock.release();
             }
         }
     }
@@ -334,18 +510,15 @@ namespace ProcManager
     void exit(int status)
     {
         struct Proc *p = myproc();
-        struct Proc *initproc = &procs[0];
-
         if (p == initproc)
-        {
-            Drivers::uart_puts("init exiting!\n");
             while (1)
                 ;
-        }
 
-        Spinlock::acquire(&proc_lock);
+        wakeup(p->parent);
 
-        for (struct Proc *pp = procs; pp < &procs[NPROC]; pp++)
+        proc_mem_lock.acquire();
+
+        for (struct Proc *pp = proc_list_head; pp != nullptr; pp = pp->all_next)
         {
             if (pp->parent == p)
             {
@@ -354,56 +527,94 @@ namespace ProcManager
             }
         }
 
-        wakeup(p->parent);
+        proc_mem_lock.release();
 
         p->xstate = status;
-        p->state = ZOMBIE;
 
-        swtch(&p->context, &main_context);
-
-        while(1);
+        struct cpu *c = mycpu();
+        c->runqueue->lock.acquire();
+        p->state = ZOMBIE;
+        swtch(&p->context, &c->context);
+        while (1)
+            ;
     }
 
     int wait(uint64 addr)
     {
-        struct Proc* np;
+
+        struct Proc *np;
         int havekids, pid;
         struct Proc *p = myproc();
-
-        Spinlock::acquire(&proc_lock);
-
-        for(;;)
+        for (;;)
         {
             havekids = 0;
-            for (np = procs; np < &procs[NPROC]; np++)
+            proc_mem_lock.acquire();
+
+            for (np = proc_list_head; np != nullptr; np = np->all_next)
             {
                 if (np->parent == p)
                 {
                     havekids = 1;
                     if (np->state == ZOMBIE)
                     {
-                        // Found one
+
+                        struct cpu *child_cpu = np->cpu;
+                        if (child_cpu)
+                        {
+                            proc_mem_lock.release();
+                            child_cpu->runqueue->lock.acquire();
+                            child_cpu->runqueue->lock.release();
+                            proc_mem_lock.acquire();
+                        }
+
                         pid = np->pid;
-                        if (addr != 0)
+                        if (addr != 0 && VM::copyout(p->pagetable, addr, (char *)&np->xstate, sizeof(np->xstate)) < 0)
                         {
-                            // copyout(p->pagetable, addr, (char*)&np->xstate, sizeof(np->xstate));
-                            // 暂时不做 copyout
+                            proc_mem_lock.release();
+                            return -1;
                         }
                         freeproc(np);
-                        Spinlock::release(&proc_lock);
+                        proc_mem_lock.release();
                         return pid;
                     }
                 }
             }
+            proc_mem_lock.release();
+
             if (!havekids || p->state == ZOMBIE)
-            {
-                Spinlock::release(&proc_lock);
                 return -1;
-            }
-            sleep(p, &proc_lock);
+            sleep(p, &proc_mem_lock);
         }
     }
 
+    int growproc(int n)
+    {
+        uint64 sz;
+        struct Proc *p = myproc();
+
+        sz = p->sz;
+
+        if (n > 0)
+        {
+            // Call VM::uvmalloc to allocate memory
+            // Parameters: page table, old size, new size, permissions (PTE_W)
+            if ((sz = VM::uvmalloc(p->pagetable, sz, sz + n, PTE_W | PTE_R | PTE_U)) == 0)
+            {
+                return -1;
+            }
+        }
+        else if (n < 0)
+        {
+            sz = VM::uvmdealloc(p->pagetable, sz, sz + n);
+        }
 
+        p->sz = sz;
+        return 0;
+    }
 
+    void create_kernel_thread(void (*func)(), const char *name)
+    {
+        (void)func;
+        (void)name;
+    }
 }
\ No newline at end of file
diff --git a/src/kernel/spinlock.cc b/src/kernel/spinlock.cc
index 210e0b9..55dfc6b 100644
--- a/src/kernel/spinlock.cc
+++ b/src/kernel/spinlock.cc
@@ -1,107 +1,195 @@
 #include "kernel/spinlock.h"
 #include "kernel/riscv.h"
-#include "kernel/proc.h"
+#include "kernel/cpu.h"
+#include "kernel/proc_def.h"
 #include "drivers/uart.h"
-#include "common/types.h"
 
-#define NCPU 8
+extern struct cpu cpus[];
 
-namespace Spinlock
+namespace ProcManager
 {
-    int g_noff[NCPU];
+    void sleep(void *chan, Spinlock *lk);
+    void wakeup(void *chan);
+}
+
+// Interrupt Depth Management
+void push_off(void);
+void pop_off(void);
+
+// // Get the pointer of the current CPU
+// // Depends on r_tp() in riscv.h to read the tp register
+// struct cpu *mycpu()
+// {
+//     int id = r_tp();
+//     return &cpus[id];
+// }
+
+// Get the current process
+// Must be called with interrupts disabled, or read atomically in a safe manner
+struct Proc *myproc()
+{
+    push_off();
+    struct cpu *c = mycpu();
+    struct Proc *p = c->proc;
+    pop_off();
+    return p;
+}
 
-    int g_intena[NCPU];
+// Spinlock Implementation
 
-    int cpuid()
-    {
-        return r_tp();
-    }
+void Spinlock::init(const char *lock_name)
+{
+    name = lock_name;
+    locked = 0;
+    cpu = nullptr;
+}
+
+void Spinlock::acquire()
+{
+    push_off(); // Disable interrupts: prevent deadlocks (interrupt handler requests a lock that is already held)
 
-    void init(struct spinlock *lk, char* name)
+    if (holding())
     {
-        lk->name = name;
-        lk->locked = 0;
-        lk->cpu_id = -1;
+        Drivers::uart_puts("panic: recursive acquire ");
+        Drivers::uart_puts(name);
+        Drivers::uart_puts("\n");
+        while (1)
+            ;
     }
 
-    void push_off()
+    // Atomic Exchange
+    // __ATOMIC_ACQUIRE: Ensures that reads and writes after the acquire are not reordered before the acquire
+    while (__atomic_exchange_n(&locked, 1, __ATOMIC_ACQUIRE))
     {
-        int old = intr_get();
-        intr_off();
-
-        int id = cpuid();
-        if (g_noff[id] == 0)
+        // Busy-wait (Spinning)
+        // Optimization: Read-only, no writes, reducing cache coherence traffic
+        while (__atomic_load_n(&locked, __ATOMIC_RELAXED) == 1)
         {
-            g_intena[id] = old;
+            asm volatile("nop"); // RISC-V indicates that the CPU is in a spin state
         }
-        g_noff[id] += 1;
     }
 
-    void pop_off()
+    // Record holder
+    cpu = mycpu();
+}
+
+void Spinlock::release()
+{
+    if (!holding())
     {
-        int id = cpuid();
-        if (intr_get())
-            Drivers::uart_puts("pop_off - interruptible\n");
+        Drivers::uart_puts("panic: release not holding\n");
+        while (1)
+            ;
+    }
 
-        if (g_noff[id] < 1)
-            Drivers::uart_puts("pop_off - count error\n");
+    cpu = nullptr;
 
-        g_noff[id] -= 1;
+    // Atomic Store
+    // __ATOMIC_RELEASE: Ensures all reads and writes before the Release are completed
+    __atomic_store_n(&locked, 0, __ATOMIC_RELEASE);
 
-        if (g_noff[id] == 0 && g_intena[id])
-        {
-            intr_on();
-        }
-    }
+    pop_off();
+}
+
+// Check if the current CPU holds the lock
+bool Spinlock::holding()
+{
+    // Interrupt checks must be disabled, otherwise a process switch may occur causing CPU fluctuations.
+    int r;
+    push_off();
+    r = (locked && cpu == mycpu());
+    pop_off();
+    return r;
+}
+
+
+// Mutex Implementation (Sleep Locks)
+
+void Mutex::init(const char *lock_name)
+{
+    name = lock_name;
+    locked = 0;
+    pid = 0;
+    lk.init("mutex_internal");
+}
+
+void Mutex::acquire()
+{
+    lk.acquire(); // Acquire the internal lock to protect the locked field
 
-    int holding(struct spinlock *lk)
+    while (locked)
     {
-        int r;
-        push_off();
-        r = (lk->locked && lk->cpu_id == cpuid());
-        pop_off();
-        return r;
+        // Lock is held, preparing to sleep
+        // Atomicity contract of sleep():
+        // 1. Mark the current process as SLEEPING
+        // 2. Release lk (so others can operate on locked)
+        // 3. Switch CPU (context switch)
+        // 4. After being woken up, reacquire the lk lock and return
+        ProcManager::sleep(this, &lk);
     }
 
-    void acquire(struct spinlock *lk)
-    {
-        push_off();
+    locked = 1;
+    pid = myproc()->pid;
 
-        if(holding(lk))
-        {
-            Drivers::uart_puts("acquire: panic - recursive lock ");
-            Drivers::uart_puts(lk->name);
-            Drivers::uart_puts("\n");
-            while (1)
-                ;
-        }
+    lk.release();
+}
 
-        while (__sync_lock_test_and_set(&lk->locked, 1) != 0)
-        {
-            // 自旋等待
-        }
+void Mutex::release()
+{
+    lk.acquire();
 
-        __sync_synchronize();
+    locked = 0;
+    pid = 0;
 
-        lk->cpu_id = cpuid();
-    }
+    // Wake up all processes sleeping on this lock (chan = this)
+    ProcManager::wakeup(this);
 
-    void release(struct spinlock *lk)
-    {
-        if (!holding(lk))
-        {
-            Drivers::uart_puts("release: panic - not holding\n");
-            while (1)
-                ;
-        }
+    lk.release();
+}
 
-        lk->cpu_id = -1;
+bool Mutex::holding()
+{
+    lk.acquire(); // Must use a lock when reading to prevent race conditions.
+    bool r = locked && (pid == myproc()->pid);
+    lk.release();
+    return r;
+}
 
-        __sync_synchronize();
+// Interrupt Depth Management
 
-        __sync_lock_release(&lk->locked);
+void push_off(void)
+{
+    int old = intr_get();
+    intr_off();
+
+    struct cpu *c = mycpu();
+
+    if (c->noff == 0)
+        c->intena = old;
+
+    c->noff += 1;
+}
+
+void pop_off(void)
+{
+    struct cpu *c = mycpu();
 
-        pop_off();
+    if (intr_get())
+    {
+        Drivers::uart_puts("panic: pop_off - interruptible\n");
+        while (1)
+            ;
     }
+    if (c->noff < 1)
+    {
+        Drivers::uart_puts("panic: pop_off count\n");
+        while (1)
+            ;
+    }
+
+    c->noff -= 1;
 
-} // namespace Spinlock
+    // An interrupt is only truly enabled when the nesting level returns to zero and the outermost layer allows interrupts.
+    if (c->noff == 0 && c->intena)
+        intr_on();
+}
\ No newline at end of file
diff --git a/src/kernel/syscall.cc b/src/kernel/syscall.cc
index 92b1a1b..6af7730 100644
--- a/src/kernel/syscall.cc
+++ b/src/kernel/syscall.cc
@@ -1,22 +1,34 @@
 #include "kernel/syscall.h"
 #include "common/types.h"
+#include "common/fcntl.h"
 #include "kernel/proc.h"
 #include "kernel/riscv.h"
 #include "drivers/uart.h"
+#include "drivers/virtio.h"
 #include "kernel/timer.h"
 #include "kernel/mm.h"
+#include "kernel/trap.h"
+#include "kernel/slab.h"
+#include "fs/fat32.h"
+#include "fs/file.h"
+#include "lib/string.h"
 
-extern int fork();
+extern "C++" int fork();
+namespace Exec
+{
+    int exec(char *path, char **argv);
+}   
 
 namespace ProcManager
 {
     void exit(int status);
-    int wait(uint64 addr);
+    int wait(uint64_t addr);
 }
 
-uint64 argraw(int n)
+
+static uint64_t argraw(int n)
 {
-    struct Proc *p = myproc();
+    Proc *p = myproc();
     switch (n)
     {
     case 0:
@@ -31,76 +43,237 @@ uint64 argraw(int n)
         return p->tf->a4;
     case 5:
         return p->tf->a5;
+    default:
+        return static_cast<uint64_t>(-1);
+    }
+}
+
+static int argint(int n, int *ip)
+{
+    *ip = static_cast<int>(argraw(n));
+    return 0;
+}
+
+static int argstr(int n, char *buf, int max)
+{
+    uint64 addr = argraw(n);
+    return VM::copyinstr(myproc()->pagetable, buf, addr, max);
+}
+
+struct KernelArgv
+{
+    static const int MAX_ARGS = 32;
+    static const int MAX_ARG_LEN = 128;
+
+    char *args[MAX_ARGS];
+
+    KernelArgv()
+    {
+        memset(args, 0, sizeof(args));
+    }
+
+    ~KernelArgv()
+    {
+        for (int i = 0; i < MAX_ARGS; i++)
+        {
+            if (args[i])
+            {
+                Slab::kfree(args[i]);
+                args[i] = nullptr;
+            }
+        }
+    }
+
+    KernelArgv(const KernelArgv &) = delete;
+    KernelArgv &operator=(const KernelArgv &) = delete;
+};
+
+static int fdalloc(struct file *f)
+{
+    struct Proc *p = myproc();
+    for (int i = 0; i < NOFILE; i++)
+    {
+        if (p->ofile[i] == 0)
+        {
+            p->ofile[i] = f;
+            return i;
+        }
     }
     return -1;
 }
 
-int argint(int n, int *ip)
+static uint64 sys_open()
+{
+    char path[128];
+    int omode;
+    int fd;
+    struct file *f;
+    Inode *ip;
+
+    if (argstr(0, path, 128) < 0 || argint(1, &omode) < 0)
+        return -1;
+
+    ip = VFS::namei(path);
+    if (ip == nullptr)
+    {
+        return -1;
+    }
+
+    f = FileTable::alloc();
+    if (f == nullptr)
+    {
+        VFS::iput(ip);
+        return -1;
+    }
+
+    fd = fdalloc(f);
+    if (fd < 0)
+    {
+        f->ref = 0;
+        f->type = FD_NONE;
+        VFS::iput(ip);
+        return -1;
+    }
+
+    f->type = FD_INODE;
+    f->ip = ip;
+    f->off = 0;
+    f->readable = !(omode & O_WRONLY);
+    f->writable = (omode & O_WRONLY) || (omode & O_RDWR);
+
+    return fd;
+}
+
+static uint64 sys_close()
 {
-    *ip = argraw(n);
+    int fd;
+    if (argint(0, &fd) < 0)
+        return -1;
+
+    struct Proc *p = myproc();
+    if (fd < 0 || fd >= NOFILE || p->ofile[fd] == 0)
+        return -1;
+
+    FileTable::close(p->ofile[fd]);
+    p->ofile[fd] = 0;
     return 0;
 }
 
-uint64 sys_exit()
+static uint64 sys_exec()
+{
+    char path[128];
+    uint64 uargv_ptr;
+
+    if (argstr(0, path, sizeof(path)) < 0)
+    {
+        return -1;
+    }
+
+    if (argint(1, (int *)&uargv_ptr) < 0)
+    {
+        return -1;
+    }
+
+    KernelArgv kargv;
+
+    for (int i = 0; i < KernelArgv::MAX_ARGS; ++i)
+    {
+        uint64 uarg_str_ptr;
+
+        if (VM::copyin(myproc()->pagetable, (char *)&uarg_str_ptr, uargv_ptr + i * sizeof(uint64), sizeof(uint64)) < 0)
+        {
+            return -1;
+        }
+
+        if (uarg_str_ptr == 0)
+        {
+            kargv.args[i] = nullptr;
+            break;
+        }
+
+        kargv.args[i] = (char *)Slab::kmalloc(KernelArgv::MAX_ARG_LEN);
+        if (kargv.args[i] == nullptr)
+        {
+            return -1;
+        }
+
+        if (VM::copyinstr(myproc()->pagetable, kargv.args[i], uarg_str_ptr, KernelArgv::MAX_ARG_LEN) < 0)
+        {
+            return -1;
+        }
+    }
+
+    return Exec::exec(path, kargv.args);
+}
+
+static uint64 sys_exit()
 {
     int n;
     if (argint(0, &n) < 0)
-        return -1;
+        return static_cast<uint64>(-1);
     ProcManager::exit(n);
     return 0;
 }
 
-uint64 sys_fork()
+static uint64 sys_fork()
 {
-    return fork();
+    return static_cast<uint64>(fork());
 }
 
-uint64 sys_wait()
+static uint64 sys_wait()
 {
-    uint64 p;
-    p = argraw(0);
-    return ProcManager::wait(p);
+    uint64 p = argraw(0);
+    return static_cast<uint64>(ProcManager::wait(p));
 }
 
-uint64 sys_getpid()
+static uint64 sys_getpid()
 {
-    return myproc()->pid;
+    return static_cast<uint64>(myproc()->pid);
 }
 
-uint64 sys_putc()
+static uint64 sys_putc()
 {
-    char c = (char)argraw(0);
+    char c = static_cast<char>(argraw(0));
     Drivers::uart_putc(c);
     return 0;
 }
 
-uint64 sys_write()
+static uint64 sys_write()
 {
-    int fd;
-    uint64 p;
+    struct file *f;
     int n;
+    uint64 p;
+    int fd;
 
-    if (argint(0, &fd) < 0 || argint(2, &n) < 0 || argraw(1) == 0)
+    if (argint(0, &fd) < 0 || argint(2, &n) < 0 || argint(1, (int *)&p) < 0)
         return -1;
+
+    struct Proc *proc = myproc();
+
     p = argraw(1);
 
-    if (fd == 1)
+    // Drivers::uart_puts("DEBUG: sys_write fd=");
+    // Drivers::uart_put_int(fd);
+    // Drivers::uart_puts(" len=");
+    // Drivers::uart_put_int(n);
+    // Drivers::uart_puts("\n");
+
+    if (fd == 1 && proc->ofile[fd] == nullptr) // stdout
     {
-        struct Proc *proc = myproc();
-        const int max = 128;
-        char buf[max];
+        constexpr int MAX_WRITE_BUF = 128;
+        char buf[MAX_WRITE_BUF];
         int i = 0;
 
         while (i < n)
         {
             int len = n - i;
-            if (len > max)
-                len = max;
+            if (len > MAX_WRITE_BUF)
+                len = MAX_WRITE_BUF;
 
-            if (VM::copyin(proc->pagetable, buf, p + i, len) < 0)
+            if (VM::copyin(proc->pagetable, buf, p + i, static_cast<uint64>(len)) < 0)
             {
                 Drivers::uart_puts("sys_write: copyin failed\n");
-                return -1;
+                return static_cast<uint64>(-1);
             }
 
             for (int j = 0; j < len; j++)
@@ -109,25 +282,111 @@ uint64 sys_write()
             }
             i += len;
         }
-        return n;
+        return static_cast<uint64>(n);
+    }
+    if (fd < 0 || fd >= NOFILE || (f = proc->ofile[fd]) == 0)
+        return static_cast<uint64>(-1);
+
+    return FileTable::write(f, p, n);
+}
+
+static uint64_t sys_read()
+{
+    struct file *f;
+    int n;
+    uint64 p;
+    int fd;
+
+    // get param: fd, buf, len
+    if (argint(0, &fd) < 0 || argint(2, &n) < 0 || argint(1, (int *)&p) < 0)
+        return -1;
+    
+    struct Proc* proc = myproc();
+    if (fd == 0 && proc->ofile[fd] == nullptr)
+    {
+        return Drivers::console_read(p, n);
     }
+
+    if (fd < 0 || fd >= NOFILE || (f = proc->ofile[fd]) == 0)
+        return -1;
+
+    return FileTable::read(f, p, n);
+
     return -1;
 }
 
-void syscall()
+static uint64 sys_sbrk()
+{
+    int n;
+    if (argint(0, &n) < 0)
+        return -1;
+
+    uint64 addr = myproc()->sz;
+    if (ProcManager::growproc(n) < 0)
+        return -1;
+
+    return addr;
+}
+
+static uint64 sys_disk_test()
 {
+    // VirtIO::test_rw();
+    // VirtIO::test_bio();
+    fat32_test();
+    return 0;
+}
+
+static uint64 sys_lseek()
+{
+    int fd, offset, whence;
+    if (argint(0, &fd) < 0 || argint(1, &offset) < 0 || argint(2, &whence) < 0)
+        return -1;
+
     struct Proc *p = myproc();
+    if (fd < 0 || fd >= NOFILE || p->ofile[fd] == 0)
+        return -1;
+
+    return FileTable::lseek(p->ofile[fd], offset, whence);
+}
+
+void syscall()
+{
+    Proc *p = myproc();
     int num = p->tf->a7;
-    uint64 ret = -1;
+    uint64 ret = static_cast<uint64>(-1);
+
+    /* Just For Debug */
+    // Drivers::uart_puts("Syscall: ");
+    // Drivers::print_hex(num);
+    // Drivers::uart_puts("\n");
 
     switch (num)
     {
+    case SYS_open:
+        ret = sys_open();
+        break;
+    case SYS_close:
+        ret = sys_close();
+        break;
+    case SYS_write:
+        ret = sys_write();
+        break;
+    case SYS_read:
+        ret = sys_read();
+        break;
     case SYS_putc:
         ret = sys_putc();
         break;
     case SYS_fork:
         ret = sys_fork();
         break;
+    case SYS_exec:
+        ret = sys_exec();
+        if (ret != static_cast<uint64>(-1))
+        {
+            return;
+        }
+        break;
     case SYS_exit:
         ret = sys_exit();
         break;
@@ -137,14 +396,31 @@ void syscall()
     case SYS_getpid:
         ret = sys_getpid();
         break;
-    case SYS_write:
-        ret = sys_write();
+    case SYS_sbrk:
+        ret = sys_sbrk();
+        break;
+    case SYS_disk_test:
+        ret = sys_disk_test();
+        break;
+    case SYS_lseek:
+        ret = sys_lseek();
+        break;
+    case SYS_pipe:
+    case SYS_dup:
+    case SYS_chdir:
+    case SYS_fstat:
+    case SYS_mkdir:
+    case SYS_mknod:
+    case SYS_unlink:
+    case SYS_link:
+        Drivers::uart_puts("Unimplemented syscall\n");
+        ret = static_cast<uint64>(-1);
         break;
     default:
         Drivers::uart_puts("Unknown Syscall ID: ");
         Drivers::print_hex(num);
         Drivers::uart_puts("\n");
-        ret = -1;
+        ret = static_cast<uint64>(-1);
         break;
     }
 
diff --git a/src/kernel/trap/handler.cc b/src/kernel/trap/handler.cc
index 14ef4c5..3fb772e 100644
--- a/src/kernel/trap/handler.cc
+++ b/src/kernel/trap/handler.cc
@@ -1,13 +1,18 @@
 #include "kernel/trap.h"
-#include "common/types.h"
-#include "drivers/uart.h"
+#include "kernel/riscv.h"
 #include "kernel/proc.h"
-#include "kernel/timer.h"
+#include "drivers/uart.h"
 #include "kernel/syscall.h"
-#include "kernel/riscv.h"
+#include "kernel/mm.h"
+#include "kernel/timer.h"
+#include "drivers/plic.h"
+#include "drivers/virtio.h"
+#include "lib/string.h"
+
+
+extern "C" void kernelvec();
 
-extern void usertrapret();
-extern void forkret();
+// Handle Function
 
 void panic(const char *s)
 {
@@ -18,160 +23,183 @@ void panic(const char *s)
         ;
 }
 
+// Trap Implementation
+
 namespace Trap
 {
     void init()
     {
-        uint64 stvec_val = (uint64)kernelvec;
-        asm volatile("csrw stvec, %0" : : "r"(stvec_val));
+        Drivers::uart_puts("[Trap] Global init done.\n");
+    }
 
-        uint64 sstatus;
-        asm volatile("csrr %0, sstatus" : "=r"(sstatus));
-        sstatus &= ~(1L << 1);
-        asm volatile("csrw sstatus, %0" : : "r"(sstatus));
+    // Each CPU core needs to call this function when starting to set its own stvec
+    void inithart()
+    {
+        w_stvec((uint64)kernelvec);
 
-        Drivers::uart_puts("[Trap] Initialized stvec to: ");
-        Drivers::print_hex(stvec_val);
-        Drivers::uart_puts("\n");
+        // Ensure that the S-Mode interrupt enable bit (SIE) is cleared during initialization
+        // Interrupt enabling will be done by the scheduler when the first process runs
+        w_sstatus(r_sstatus() & ~SSTATUS_SIE);
+
+        // Enable the external interrupt, clock interrupt, and software interrupt bits in S-Mode (in SIE register)
+        uint64 sie = r_sie();
+        sie |= SIE_SEIE | SIE_STIE | SIE_SSIE;
+        w_sie(sie);
+
+        Drivers::uart_puts("[Trap] Hart initialized (stvec set).\n");
     }
 
-    extern "C" void kerneltrap(struct Trapframe *tf)
+    // Device Interrupt Check
+    int devintr()
     {
-        uint64 scause, stval, sepc;
+        uint64 scause = r_scause();
 
-        asm volatile("csrr %0, scause" : "=r"(scause));
-        asm volatile("csrr %0, stval" : "=r"(stval));
-        asm volatile("csrr %0, sepc" : "=r"(sepc));
+        bool is_interrupt = (scause & 0x8000000000000000L) != 0;
+        uint64 code = scause & 0xff;
 
-        if (scause & (1L << 63))
+        if (is_interrupt && code == 9)
         {
-            uint64 cause_code = scause & 0x7FFFFFFFFFFFFFFFL;
-            switch (cause_code)
+            // Supervisor External Interrupt (IRQ 9)
+            int irq = PLIC::claim();
+
+            if (irq == 10)
             {
-            case 1:
-                Drivers::uart_puts("[IRQ] Software Interrupt (Unexpected)\n");
-                break;
-
-            case 5:
-                Drivers::uart_puts("[IRQ] Timer Interrupt\n");
-                Timer::set_next_trigger();
-                ProcManager::yield();
-                break;
-            
-            case 9:
-                Drivers::uart_puts("[IRQ] External Interrupt\n");
-                break;
-
-            default:
-                Drivers::uart_puts("[IRQ] Unknown Interrupt: ");
-                Drivers::print_hex(cause_code);
-                Drivers::uart_puts("\n");
-                break;
+                Drivers::uart_intr();
+                // Debug
+                // Drivers::uart_puts("[Interrupt] UART Input detected!\n");
             }
-        }
-        else
-        {
-            switch (scause)
+            else if (irq >= 1 && irq <= 8)
+            {
+                VirtIO::intr();
+                // Debug
+                // Drivers::uart_puts("[Interrupt] VirtIO disk finished!\n");
+            }
+
+            if (irq > 0)
             {
-            case 8:
-                Drivers::uart_puts("[Syscall] ecall from Kernel Mode? Panic.\n");
-                panic("Kernel Ecall");
-                break;
-
-            case 12:
-            case 13:
-            case 15:
-                Drivers::uart_puts("\n--- PAGE FAULT ---\n");
-                Drivers::uart_puts("Cause Code: ");
-                Drivers::print_hex(scause);
-                Drivers::uart_puts("\n");
-                Drivers::uart_puts("Fault Addr (stval): ");
-                Drivers::print_hex(stval);
-                Drivers::uart_puts("\n");
-                Drivers::uart_puts("Instruction (sepc): ");
-                Drivers::print_hex(sepc);
-                Drivers::uart_puts("\n");
-
-                if (stval == 0)
-                {
-                    panic("Null Pointer Dereference!");
-                }
-                else if (stval < 0x80000000)
-                {
-                    panic("Invalid Low Memory Access!");
-                }
-                else
-                {
-                    panic("Segmentation Fault (Unmapped Area)");
-                }
-                break;
-
-            case 2:
-                Drivers::uart_puts("\n--- ILLEGAL INSTRUCTION ---\n");
-                Drivers::uart_puts("Instruction (sepc): ");
-                Drivers::print_hex(sepc);
-                Drivers::uart_puts("\n");
-                panic("CPU encountered an unknown opcode");
-                break;
-
-            default:
-                Drivers::uart_puts("\n--- UNHANDLED EXCEPTION ---\n");
-                Drivers::uart_puts("Cause: ");
-                Drivers::print_hex(scause);
-                Drivers::uart_puts("\n");
-                Drivers::uart_puts("sepc: ");
-                Drivers::print_hex(sepc);
-                Drivers::uart_puts("\n");
-                panic("System Halt");
-                break;
+                PLIC::complete(irq);
             }
+
+            return 1;
+        }
+        else if (is_interrupt && code == 5)
+        {
+            // Supervisor Timer Interrupt (IRQ 5)
+            Timer::set_next_trigger();
+            // w_sip(r_sip() & ~2);
+            return 2;
         }
+
+        return 0;
+    }
+}
+
+// Exception Handling Entry
+
+extern "C" void kerneltrap(struct Trapframe *tf)
+{
+    uint64 sepc = r_sepc();
+    uint64 sstatus = r_sstatus();
+    uint64 scause = r_scause();
+
+    if ((sstatus & SSTATUS_SPP) == 0)
+        panic("kerneltrap: not from supervisor mode");
+
+    if (intr_get() != 0)
+        panic("kerneltrap: interrupts enabled");
+
+    if (Trap::devintr() == 0)
+    {
+        Drivers::uart_puts("\n--- KERNEL EXCEPTION ---\n");
+        Drivers::uart_puts("scause: ");
+        Drivers::print_hex(scause);
+        Drivers::uart_puts("\n");
+        Drivers::uart_puts("sepc:   ");
+        Drivers::print_hex(sepc);
+        Drivers::uart_puts("\n");
+        Drivers::uart_puts("stval:  ");
+        Drivers::print_hex(r_stval());
+        Drivers::uart_puts("\n");
+        panic("kerneltrap exception");
     }
+
+    w_sepc(sepc);
+    w_sstatus(sstatus);
 }
 
 extern "C" void usertrap()
 {
-    asm volatile("csrw stvec, %0" : : "r"(Trap::kernelvec));
+    // Drivers::uart_puts("[Debug] Entered usertrap!\n");
+    int which_dev = 0;
 
-    uint64 scause;
-    asm volatile("csrr %0, scause" : "=r"(scause));
+    if ((r_sstatus() & SSTATUS_SPP) != 0)
+        panic("usertrap: not from user mode");
+
+    w_stvec((uint64)kernelvec);
 
     struct Proc *p = myproc();
-    
-    extern struct Proc procs[];
     if (!p)
-    {
-        for (int i = 0; i < 10; ++i)
-            if (procs[i].state == RUNNING)
-                p = &procs[i];
-    }
+        panic("usertrap: no process");
+
+    p->tf->epc = r_sepc();
 
-    uint64 sepc;
-    asm volatile("csrr %0, sepc" : "=r"(sepc));
-    p->tf->epc = sepc;
+    uint64 scause = r_scause();
+    uint64 stval = r_stval();
 
-    if(scause == 8)
+    if (scause == 8) // Syscall
     {
-        intr_on();
+        if (p->state == ZOMBIE)
+            ProcManager::exit(-1);
         p->tf->epc += 4;
-
+        intr_on();
         syscall();
-
         intr_off();
     }
-    else if ((scause & (1L << 63)) && (scause & 0xF) == 5)
+    else if (scause == 15) // Store Page Fault
     {
-        Drivers::uart_puts("\nTick\n");
-        Timer::set_next_trigger();
-        ProcManager::yield();
+        if (VM::handle_cow_fault(p->pagetable, PGROUNDDOWN(stval)) != 0)
+        {
+            uint64 pa = VM::walkaddr(p->pagetable, stval);
+
+            if (pa == 0)
+            {
+                Drivers::uart_puts("usertrap: Segmentation Fault (unmapped) at ");
+            }
+            else
+            {
+                Drivers::uart_puts("usertrap: Protection Fault (or OOM) at ");
+            }
+
+            Drivers::print_hex(stval);
+            Drivers::uart_puts("\n");
+            p->state = ZOMBIE;
+            ProcManager::exit(-1);
+        }
+    }
+    else if ((which_dev = Trap::devintr()) != 0)
+    {
+        if (which_dev == 2)
+        {
+            ProcManager::yield();
+        }
     }
     else
     {
-        Drivers::uart_puts("Unexpected User Trap!\n");
+        Drivers::uart_puts("\nusertrap(): unexpected scause ");
         Drivers::print_hex(scause);
-        while (1)
-            ;
+        Drivers::uart_puts(" pid=");
+        Drivers::uart_put_int(p->pid);
+        Drivers::uart_puts(" sepc=");
+        Drivers::print_hex(p->tf->epc);
+        Drivers::uart_puts(" stval=");
+        Drivers::print_hex(stval);
+        Drivers::uart_puts("\n");
+        p->state = ZOMBIE;
+        ProcManager::exit(-1);
     }
 
+    if (p->state == ZOMBIE)
+        ProcManager::exit(-1);
+
     usertrapret();
 }
\ No newline at end of file