// kernel/exec.c
  // Allocate two pages at the next page boundary.
  // Use the second as the user stack.
  sz = PGROUNDUP(sz);
  if((sz = uvmalloc(pagetable, sz, sz + 2*PGSIZE)) == 0)
    goto bad;
  uvmclear(pagetable, sz-2*PGSIZE);
  sp = sz;
  stackbase = sp - PGSIZE;

// kernel/vm.c
// mark a PTE invalid for user access.
// used by exec for the user stack guard page.
void
uvmclear(pagetable_t pagetable, uint64 va)
{
  pte_t *pte;
  
  pte = walk(pagetable, va, 0);
  if(pte == 0)
    panic("uvmclear");
  *pte &= ~PTE_U;
}

uint64
uvmalloc(pagetable_t pagetable, uint64 oldsz, uint64 newsz)
{
  char *mem;
  uint64 a;

  if(newsz < oldsz)
    return oldsz;

  oldsz = PGROUNDUP(oldsz);
  a = oldsz;
  for(; a < newsz; a += PGSIZE){
    mem = kalloc();
    if(mem == 0){
      uvmdealloc(pagetable, a, oldsz);
      return 0;
    }
    memset(mem, 0, PGSIZE);
    if(mappages(pagetable, a, PGSIZE, (uint64)mem, PTE_W|PTE_X|PTE_R|PTE_U) != 0){
      kfree(mem);
      uvmdealloc(pagetable, a, oldsz);
      return 0;
    }
  }
  return newsz;
}

// part of user/cowtest.c

char junk1[4096];
int fds[2];
char junk2[4096];
char buf[4096];
char junk3[4096];

// test whether copyout() simulates COW faults.
void
filetest()
{
  printf("file: ");
  
  buf[0] = 99;

  for(int i = 0; i < 4; i++){
    if(pipe(fds) != 0){
      printf("pipe() failed\n");
      exit(-1);
......
}

  
　// kernel/exec.c
  // Check ELF header
  if(readi(ip, 0, (uint64)&elf, 0, sizeof(elf)) != sizeof(elf))
    goto bad;
  if(elf.magic != ELF_MAGIC)
    goto bad;

  if((pagetable = proc_pagetable(p)) == 0)　　// 此時TRAPFRAME -> &p->tf間的關係已經寫入到pagetable中
    goto bad;

struct proc {
  struct spinlock lock;

  // p->lock must be held when using these:
  enum procstate state;        // Process state
  struct proc *parent;         // Parent process
  void *chan;                  // If non-zero, sleeping on chan
  int killed;                  // If non-zero, have been killed
  int xstate;                  // Exit status to be returned to parent's wait
  int pid;                     // Process ID

  // these are private to the process, so p->lock need not be held.
  uint64 kstack;               // Bottom of kernel stack for this process
  uint64 ustackbase;
  uint64 sz;                   // Size of process memory (bytes)
  pagetable_t pagetable;       // Page table
  struct trapframe *tf;        // data page for trampoline.S
  struct context context;      // swtch() here to run process
  struct file *ofile[NOFILE];  // Open files
  struct inode *cwd;           // Current directory
  char name[16];               // Process name (debugging)
};

Modify uvmcopy() to map the parent's physical pages into the child, instead of allocating new pages, and clear PTE_W in the PTEs of both child and parent.
Modify usertrap() to recognize page faults. When a page-fault occurs on a COW page, allocate a new page with kalloc(), copy the old page to the new page,
and install the new page in the PTE with PTE_W set.

// kernel/riscv.h
#define PTE_V (1L << 0) // valid
#define PTE_R (1L << 1)
#define PTE_W (1L << 2)
#define PTE_X (1L << 3)
#define PTE_U (1L << 4) // 1 -> user can access
#define PTE_F (1L << 8) // copy-on-write flag

extern char end[]; // first address after kernel.
                   // defined by kernel.ld.

struct run {
  struct run *next;
};

struct {
  struct spinlock lock;
  struct run *freelist;
  int refcount[1 << 15];
  int used;
} kmem;

// Allocate one 4096-byte page of physical memory.
// Returns a pointer that the kernel can use.
// Returns 0 if the memory cannot be allocated.

int pa2pageid(void* pa);
void freerange(void *pa_start, void *pa_end);
void* allocpage();
void freepage(void* pa);

void
kinit()
{
  initlock(&kmem.lock, "kmem");
  freerange(end, (void*)PHYSTOP);
  memset(&kmem.refcount, 0, sizeof(kmem.refcount));
  kmem.used = 0;
}

void
freerange(void *pa_start, void *pa_end)
{
  char *p;
  p = (char*)PGROUNDUP((uint64)pa_start);
  for(; p + PGSIZE <= (char*)pa_end; p += PGSIZE)
    freepage(p);
}

// Free the page of physical memory pointed at by v,
// which normally should have been returned by a
// call to kalloc().  (The exception is when
// initializing the allocator; see kinit above.)
void
kfree(void* pa) 
{
  if(((uint64)pa % PGSIZE) != 0 || (char*)pa < end || (uint64)pa >= PHYSTOP)
    panic("kfree");

  acquire(&kmem.lock);
  if(decrease_ref(pa)) {
    kmem.used--;
    freepage(pa);
    // printf("free page %p\n", pa);
  }
  release(&kmem.lock);
}

void *
kalloc(void)
{
  acquire(&kmem.lock);
  void* page = allocpage();

  if(page) {
    increase_ref(page, 0);
  }

  release(&kmem.lock);
  return page;
}

int
pa2pageid(void* pa)
{
  return (pa - (void*)end) / PGSIZE;
}


void*
allocpage()
{
  struct run* r = kmem.freelist ? kmem.freelist : 0;
  if(r) {
    kmem.used++;
    kmem.freelist = r->next;
    memset((char*)r, 5, PGSIZE);
  }
  return r;
}

void
freepage(void* pa)
{
  memset(pa, 1, PGSIZE);
  struct run* r = (struct run*)pa;
  r->next = kmem.freelist;
  kmem.freelist = r;
}

void
increase_ref(void* pa, int exist)
{
  int idx = pa2pageid(pa);
  if(exist && kmem.refcount[idx] <= 0) {
    printf("page %p should exist", pa);
    panic("increase ref");
  } else if(!exist && kmem.refcount[idx] > 0) {
    printf("page %p should not exist", pa);
    panic("increase ref");
  }
  kmem.refcount[idx]++;
}

int
decrease_ref(void* pa)
{
  int idx = pa2pageid(pa);
  if(kmem.refcount[idx] <= 0) {
    printf("page %p should exist");
    panic("decrease ref");
  }
  
  return --kmem.refcount[idx] == 0;
}

kernel/kalloc.c

// Given a parent process's page table, copy
// its memory into a child's page table.
// Copies both the page table and the
// physical memory.
// returns 0 on success, -1 on failure.
// frees any allocated pages on failure.
int
uvmcopy(pagetable_t old, pagetable_t new, uint64 sz)
{
  pte_t *pte;
  uint64 pa, i;
  uint flags;

  for(i = 0; i < sz; i += PGSIZE) {
    if((pte = walk(old, i, 0)) == 0)
      panic("uvmcopy: pte should exist");
    if((*pte & PTE_V) == 0)
      panic("uvmcopy: page not present");

    pa = PTE2PA(*pte);
    flags = PTE_FLAGS(*pte);
  
    // if PTE_W or PTE_F is set, then this page doesn't cow-fork and maybe be shared
    // so simply increase refcount is ok
    // if page could write, set PTE_F flag and clean PTE_W flag for both old and new pagetable
    if(*pte & PTE_F || *pte & PTE_W) {
      if(0 != mappages(new, i, PGSIZE, pa, (flags & (~PTE_W)) | PTE_F))
        goto err;
    // we need also adjust page perm for parent process
      *pte = PA2PTE(pa) | (flags & (~PTE_W)) | PTE_F;
    } else {
      if(0 != mappages(new, i, PGSIZE, pa, flags))
        goto err;
    }

    increase_ref((void*)pa, 1);
  }


  return 0;

 err:
  uvmunmap(new, 0, i, 1);
  // withdraw cow-fork's change on origin thread
  for(int j = 0; j <= i; j += PGSIZE) {
    pte = walk(old, j, 0);
    flags = PTE_FLAGS(*pte);
    if(flags & PTE_F) {
      flags = (flags & (~PTE_F)) | PTE_W;
      pa = PTE2PA(*pte);
      *pte = PA2PTE(pa) | flags;
    }
  }
  return -1;
}

int
cowhandler(pagetable_t pagetable, uint64 va)
{
   if(situation1)
      return -1;
   if(situation2)
      return -1;
   
   ........

   finally , this should be a cow-page-fault
   if is not a cow-page-fault {
      panic("not a cow-pate-fault");
  }

   handle it
}

// kernel/vm.c
// success return 0, failed return -1
int
cow_handler(pagetable_t pagetable, uint64 va)
{
  // return 0;
  if(0 == pagetable)
    panic("no page table\n");
  
  // out of range access
  if(myproc()->sz <= va) {
    printf("process %d , assess %d\n", myproc()->pid, (uint64)va);
    printf("process size %d, stack guard %d\n", myproc()->sz, myproc()->ustackbase);
    printf("usertrap(): unexpected scause %p pid=%d\n", r_scause(), myproc()->pid);
    printf("            sepc=%p stval=%p\n", r_sepc(), r_stval());
    myproc()->killed = 1;
    return -1;
  }

  // find corresponding pte
  uint64 vabase = PGROUNDDOWN(va);
  pte_t* pte;
  if((pte = walk(pagetable, vabase, 0)) == 0)
    panic("page should exist");

  // cow pagefault situation:  
  uint flags = PTE_FLAGS(*pte);
  if(!(flags & PTE_F && (flags & PTE_W) == 0)) {
    return -1;
  }

  // allocate a new page and recalculate it's perm
  void* mem = kalloc();
  if(0 == mem)
    panic("no memory avaliable");

  // free origin pte and page
  memmove(mem, (void*)PTE2PA(*pte), PGSIZE);
  kfree((void*)PTE2PA(*pte));
  *pte = 0;

  // map it
  flags = (flags & (~PTE_F)) | PTE_W;
  if(mappages(pagetable, vabase, PGSIZE, (uint64)mem, flags))
    return -1;

  return 0;
}

void
usertrap(void)
{
  int which_dev = 0;

  if((r_sstatus() & SSTATUS_SPP) != 0)
    panic("usertrap: not from user mode");

  // send interrupts and exceptions to kerneltrap(),
  // since we're now in the kernel.
  w_stvec((uint64)kernelvec);

  struct proc *p = myproc();
  
  // save user program counter.
  p->tf->epc = r_sepc();
  
  if(r_scause() == 8){
    // system call

    if(p->killed)
      exit(-1);

    // sepc points to the ecall instruction,
    // but we want to return to the next instruction.
    p->tf->epc += 4;

    // an interrupt will change sstatus &c registers,
    // so don't enable until done with those registers.
    intr_on();

    syscall();
  } else if((which_dev = devintr()) != 0){
    // ok
  } else if(r_scause() == 13 || r_scause() == 15) {
    // printf("usertrap(): unexpected scause %p pid=%d\n", r_scause(), p->pid);
    // printf("            sepc=%p stval=%p\n", r_sepc(), r_stval());
    if(cow_handler(myproc()->pagetable, r_stval()) != 0) {
      p->killed = 1;
    }
  } else {
    printf("usertrap(): unexpected scause %p pid=%d\n", r_scause(), p->pid);
    printf("            sepc=%p stval=%p\n", r_sepc(), r_stval());
    vmprint(p->pagetable);
    p->killed = 1;
  }

  if(p->killed)
    exit(-1);

  // give up the CPU if this is a timer interrupt.
  if(which_dev == 2)
    yield();

  usertrapret();
}

// kernel/vm.c
// Copy from kernel to user.
// Copy len bytes from src to virtual address dstva in a given page table.
// Return 0 on success, -1 on error.
int
copyout(pagetable_t pagetable, uint64 dstva, char *src, uint64 len)
{
  uint64 n, va0, pa0;
  pte_t* pte;
  if(dstva > MAXVA)
    return -1;

  while(len > 0){
    va0 = PGROUNDDOWN(dstva);
    pte = walk(pagetable, va0, 0);

    if(0 == pte) {
      panic("copyout : pte should exist");
    }
    if(*pte & PTE_F) {
      if(cow_handler(pagetable, va0) != 0) {
        panic("copyout : handle cow failed");
      }
      pa0 = walkaddr(pagetable, va0);
    } else {
      pa0 = walkaddr(pagetable, va0);
    }

    if(pa0 == 0)
      return -1;

    n = PGSIZE - (dstva - va0);
    if(n > len)
      n = len;
    memmove((void *)(pa0 + (dstva - va0)), src, n);

    len -= n;
    src += n;
    dstva = va0 + PGSIZE;
  }
  return 0;
}

$ usertests
usertests starting
test reparent2: OK
test pgbug: OK
test sbrkbugs: usertrap(): unexpected scause 0x000000000000000c pid=3220
            sepc=0x0000000000004430 stval=0x0000000000004430
page table 0x00000000861f5000
..0: pte 0x0000000021882801 pa 0x000000008620a000 perm : PTE_V|
.. ..0: pte 0x0000000021882c01 pa 0x000000008620b000 perm : PTE_V|
..255: pte 0x0000000021fd1001 pa 0x0000000087f44000 perm : PTE_V|
.. ..511: pte 0x0000000021882401 pa 0x0000000086209000 perm : PTE_V|
.. .. ..510: pte 0x00000000218830c7 pa 0x000000008620c000 perm : PTE_V|PTE_R|PTE_W|
.. .. ..511: pte 0x000000002000204b pa 0x0000000080008000 perm : PTE_V|PTE_R|PTE_X|
usertrap(): unexpected scause 0x000000000000000c pid=3221
            sepc=0x0000000000004430 stval=0x0000000000004430
page table 0x00000000861e2000
..0: pte 0x0000000021877c01 pa 0x00000000861df000 perm : PTE_V|
.. ..0: pte 0x0000000021878001 pa 0x00000000861e0000 perm : PTE_V|
.. .. ..0: pte 0x00000000216d2d1b pa 0x0000000085b4b000 perm : PTE_V|PTE_R|PTE_X|PTE_U|PTE_F|
..255: pte 0x0000000021878c01 pa 0x00000000861e3000 perm : PTE_V|
.. ..511: pte 0x0000000021876c01 pa 0x00000000861db000 perm : PTE_V|
.. .. ..510: pte 0x00000000218830c7 pa 0x000000008620c000 perm : PTE_V|PTE_R|PTE_W|
.. .. ..511: pte 0x000000002000204b pa 0x0000000080008000 perm : PTE_V|PTE_R|PTE_X|
OK
test badarg: OK
test reparent: OK
test twochildren: OK

........

test sbrkarg: OK
test validatetest: OK
test stacktest: OK
test opentest: OK
test writetest: OK
test writebig: OK
test createtest: OK
test openiput: OK
test exitiput: OK
test iput: OK
test mem: OK
test pipe1: OK
test preempt: kill... wait... OK
test exitwait: OK
test rmdot: OK
test fourteen: OK
test bigfile: OK
test dirfile: OK
test iref: OK
test forktest: OK
test bigdir: OK
ALL TESTS PASSED