xcode-select --install</code></pre> 之后通过官方脚本安装包管理器Homebrew

/bin/bash</span> -c "</span>$(</span>curl</span> -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh</span>)</span>"</span></span></code></pre>

[!TIP] 提示
Homebrew官方脚本默认使用官方源安装，国内访问速度较慢。网络环境不行的可以使用此仓库</a>国内源脚本。</p>
</blockquote>
安装 RISC-V compiler toolchain</h2>
之后使用brew安装riscv编译工具链</p>
brew</span> tap riscv/riscv</span></span>
brew</span> install riscv-tools</span></span></code></pre>

[!TIP] 提示
Homebrew不会把工具自动链接到/usr/local</code>，需要手动在~/.zshrc</code>中添加环境变量PATH=$PATH:/usr/local/opt/riscv-gnu-toolchain/bin</code></p>
</blockquote>
安装 QEMU</h2>
之后安装QEMU虚拟机以运行系统</p>
brew</span> install qemu</span></span></code></pre>安装GDB调试器</h2>
macOS下，brew安装的riscv编译工具链并不包含GDB调试器。为了以后的调试，需要额外安装GDB调试器</p>
brew</span> install riscv64-elf-gdb</span></span></code></pre>配置并运行</h1>
拉取项目代码</h2>
使用git从MIT的仓库拉取项目源码</p>
git</span> clone git://g.csail.mit.edu/xv6-labs-2025</span></span></code></pre>在终端中编译运行</h2>
先切换到仓库目录</p>
cd</span> xv6-labs-2025</span></span></code></pre>
之后直接使用make qemu</code>即可自动编译系统并在qemu中运行</p>
❯</span> make qemu</span></span>
mv</span> -f fs.img fs.img.bk</span></span>
mkfs/mkfs</span> fs.img README  user/findtest.sh user/sixfive.txt user/_cat user/_echo user/_forktest user/_grep user/_init user/_kill user/_ln user/_ls user/_mkdir user/_rm user/_sh user/_stressfs user/_usertests user/_grind user/_wc user/_zombie user/_logstress user/_forphan user/_dorphan  user/_memdump</span></span>
nmeta</span> 47</span> (boot,</span> super, log blocks 31, inode blocks 13, bitmap blocks</span> 1</span>) blocks 1953 total 2000</span></span>
balloc:</span> first</span> 990</span> blocks have been allocated</span></span>
balloc:</span> write bitmap block at sector</span> 46</span></span>
qemu-system-riscv64</span> -machine virt -bios none -kernel kernel/kernel -m 128M -smp</span> 3</span> -nographic -global virtio-mmio.force-legacy=</span>false</span> -drive file=fs.img,if=none,format=raw,id=x0 -device virtio-blk-device,drive=x0,bus=virtio-mmio-bus.0</span></span>
</span>
xv6</span> kernel is booting</span></span>
</span>
hart</span> 1</span> starting</span></span>
hart</span> 2</span> starting</span></span>
init:</span> starting sh</span></span>
$</span> </span></span></code></pre>调试代码</h1>
在终端中使用GDB调试</h2>
在终端中调试，先使用make qemu-gdb</code>编译运行xv6系统，并等待调试器链接</p>
make</span> qemu-gdb</span></span></code></pre>
之后打开另一个终端，运行gdb来连接调试</p>
riscv64-elf-gdb</span> kernel/kernel</span></span></code></pre>
连接成功后xv6系统会开始运行，之后即可进行调试和分析。</p>
使用VSCode运行并调试</h2>
目前已经xv6已经可以正常运行和调试了，但为了以后学习的方便，配置一个顺手的工具还是很必要的。这里选用VSCode进行调试和开发。
先在仓库根目录下建立.vscode</code>配置文件夹</p>
mkdir</span> .vscode</span></span></code></pre>
创建.vscode/launch.json</code>，并写入以下内容</p>
{</span></span>
    "</span>version</span>":</span> "0.2.0"</span>,</span></span>
    "</span>configurations</span>": [</span></span>
        {</span></span>
            "</span>name</span>":</span> "debug xv6"</span>,</span></span>
            "</span>type</span>":</span> "cppdbg"</span>,</span></span>
            "</span>request</span>":</span> "launch"</span>,</span></span>
            "</span>program</span>":</span> "${workspaceFolder}/kernel/kernel"</span>,</span></span>
            "</span>args</span>": [],</span></span>
            "</span>stopAtEntry</span>":</span> true</span>,</span></span>
            "</span>cwd</span>":</span> "${workspaceFolder}"</span>,</span></span>
            "</span>miDebuggerServerAddress</span>":</span> "localhost:25501"</span>,</span></span>
            "</span>preLaunchTask</span>":</span> "xv6: qemu-gdb CPUS=1"</span>,</span></span>
            "</span>miDebuggerPath</span>":</span> "riscv64-elf-gdb"</span>,</span></span>
            "</span>environment</span>": [],</span></span>
            "</span>externalConsole</span>":</span> false</span>,</span></span>
            "</span>MIMode</span>":</span> "gdb"</span>,</span></span>
            "</span>setupCommands</span>": [</span></span>
                {</span></span>
                    "</span>description</span>":</span> "pretty printing"</span>,</span></span>
                    "</span>text</span>":</span> "-enable-pretty-printing"</span>,</span></span>
                    "</span>ignoreFailures</span>":</span> true</span></span>
                }</span></span>
            ]</span></span>
        }</span></span>
    ]</span></span>
}</span></span></code></pre>

[!TIP] 提示
miDebuggerPath参数为gdb调试器的路径，请根据你具体安装的调试器更改。</p>
</blockquote>
创建.vscode/tasks.json</code>，并写入以下内容</p>
{</span></span>
  "</span>version</span>":</span> "2.0.0"</span>,</span></span>
  "</span>tasks</span>": [</span></span>
    {</span></span>
      "</span>label</span>":</span> "xv6: qemu-gdb CPUS=1"</span>,</span></span>
      "</span>type</span>":</span> "shell"</span>,</span></span>
      "</span>command</span>":</span> "make CPUS=1 qemu-gdb"</span>,</span></span>
      "</span>isBackground</span>":</span> true</span>,</span></span>
      "</span>problemMatcher</span>": {</span></span>
        "</span>pattern</span>": [</span></span>
          {</span></span>
            "</span>regexp</span>":</span> "."</span>,</span></span>
            "</span>file</span>":</span> 1</span>,</span></span>
            "</span>location</span>":</span> 2</span>,</span></span>
            "</span>message</span>":</span> 3</span></span>
          }</span></span>
        ],</span></span>
        "</span>background</span>": {</span></span>
          "</span>activeOnStart</span>":</span> true</span>,</span></span>
          "</span>beginsPattern</span>":</span> ".*"</span>,</span></span>
          "</span>endsPattern</span>":</span> ".*gdb.*"</span></span>
        }</span></span>
      }</span></span>
    }</span></span>
  ]</span></span>
}</span></span></code></pre>

[!TIP] 提示
这里make qemu 的参数CPUS=1是为了限制xv6运行时的cpu个数。xv6支持多cpu，默认情况下会启用3个cpu。这里为了便于调试设置为1个cpu。</p>
</blockquote>
之后在VSCode里面直接点击调试即可开始调试</p>
调试用户程序</h2>
因为xv6系统程序和用户程序是两套elf符号，所以要调试用户程序需要先导入用户程序的符号表，之后才能进行调试。
符号表一般在编译时会生成在源文件目录下，以cat举例，编译后他的符号表会生成在/user/_cat。
在GDB终端中输入</p>
-exec</span> file /user/_cat</span></span></code></pre>
导入符号表，之后即可正常调试。</p>
参考资料</h1>

6.1810: Operating System Engineering</a></li>
Xv6 代码导读 (调试工具配置；调试系统调用执行) [南京大学2022操作系统-P18]</a></li>
</ul>

yubikey配置：基于resident-key实现在任意设备上安全使用ssh密钥。

2026-05-26T00:00:00+00:00

前言</h1>
YubiKey 是一款由 Yubico 出品的硬件安全密钥，主要用于多因素认证（MFA）、密码管理、数字签名以及 SSH 身份验证等场景。它通过 USB、NFC 或 Lightning 接口与设备连接，可以生成一次性密码（OTP）、支持 FIDO2/WebAuthn、PIV（智能卡）以及 OpenPGP 等多种安全协议。YubiKey 的核心优势在于私钥永不离开硬件设备，即使电脑或网络被攻破，密钥仍然安全。
驻留密钥（Resident Key, RK）是 YubiKey 和 OpenSSH 中的一项功能，允许将 SSH 私钥直接存储在硬件设备内部，而不是依赖本地文件系统。与传统的 SSH 私钥文件不同，驻留密钥具备以下特点：

便携性：密钥随 YubiKey 携带，无需在每台设备上复制私钥。</li>
安全性：私钥不会离开硬件设备，即使设备被接入不可信计算机，也无法导出密钥。</li>
便捷性：支持在陌生设备上即插即用，通过硬件认证即可完成 SSH 登录，无需额外传输私钥。</li>
多密钥管理：同一个 YubiKey 可存储多个 SSH 驻留密钥，并通过用户名或服务器标识选择使用。</li> </ul>

[!IMPORTANT] 问题背景传统ssh需要在设备上提前配置好ssh密钥，与设备绑定在一起。一旦遇到突发情况，身边没有自己设备，需要在陌生设备上使用ssh密钥就会非常麻烦。 </blockquote>

[!TIP] 解决方案通过yubikey驻留密钥将ssh私钥储存在物理密钥中，这样只需要携带有yubikey，可以在任何设备上使用ssh密钥，也可以有效避免对密钥的误操作。 </blockquote>
准备环境</h1>
openSSH在8.2后添加了对fido驻留密钥的支持，只需要安装openSSH版本大于8.2，并启用fido库即可使用。
Windows</h2>
Window11自带全部环境，插上即用，无须配置。（win易用性这块还是不错的）
Linux</h2>
主流发行版openSSH均支持驻留密钥，只需要安装fido库即可。如果不确定自己的openSSH版本是否支持可以使用`ssh -V</code>来检查。`
`Debian/Ubuntu`
sudo apt install libfido2-1</code></pre> Fedora/RHEL sudo dnf install libfido2</code></pre>macOS</h2> [!IMPORTANT] 警告从macOS12开始，默认openSSH已经支持驻留密钥。但不幸的，苹果出于一些原因在编译openSSH时添加了--disable-security-key</code>参数禁用了安全密钥的支持。这使得在macOS12无法使用安全密钥功能，除非重新编译安装openSSH。但已有openSSH和icloud钥匙串存在联系，重新编译会破坏功能。我认为这并不是一个好的解决方案，所以不在考虑。幸运的，社区对苹果禁用安全密钥的问题作出了许多积极的反馈，在macOS Sonoma中安全密钥重新可用，只是不再提供中间件。本文基于此解决方案编写，仅适用于macOS Sonoma及以上。 </blockquote> 基于社区的讨论</a>，在macOS Sonoma之后的openSSH中已经可以使用安全密钥，只需要自己编译 libfido2 来提供自己的 SSH_SK_PROVIDER。可以使用如下脚本来实现编译安装，脚本来自GitHub</a>。 #!/bin/bash ################################################################################################ # macskeyinstaller.sh # Last Updated: January 13, 2025 # # macOS OpenSSH Client Patcher for Hardware Security Key Support (ED25519-SK With YubiKey Etc.) # Check out https://gist.github.com/BertanT/9d222da115ca2d1274ef34735c4260cf for details! # # Copyright 2025 Mehmet Bertan Tarakcioglu (github.com/BertanT), under the MIT License. ################################################################################################ # Exit early if there is an error set -e printf "\n* Hello! This script compiles and installs the security key provider for the built-in macOS Open SSH client to enable support for hardware security keys (such as a YubiKey)." # Check if the script is running as root if [ "$(id -u)" -eq 0 ]; then printf "\n!!! Error: For safety reasons, this script cannot be run as root. If using sudo, please try again without it.\n" >&2 exit 1 fi # Function to compare macOS version strings version_ge() { [[ "$(echo -e "$1\n$2" | sort -V | head -n1)" == "$2" ]] } # function to get the current macOS Version macos_version=$(sw_vers -productVersion | cut -d '.' -f1,2) # Check if running at least macOS Sonoma if ! version_ge "$macos_version" "14.0"; then printf "\n!!! Error: macOS version is $macos_version. This script requires at least macOS Sonoma (14.0).\n" >&2 exit 1 fi printf "\n* macOS version is supported!" # Check if Homebrew is installed if ! which brew &>/dev/null; then printf "\n!!! Error: This script requires Homebrew to install dependencies! Please install Homebrew and try again\n" >&2 exit 1 fi printf "\n* Homebrew is installed!" printf "\n* Cloning the latest main branch of openssh-portable from GitHub. This may take a while..." git clone --quiet https://github.com/openssh/openssh-portable.git cd openssh-portable printf "\n* Installing dependencies from Homebrew: libfido2, openssl, autoconf, automake, libtool\n" brew install libfido2 openssl autoconf automake libtool pkgconf printf "\n* Generating configuration script." autoreconf -i printf "\n* Exporting flags." # Determine the CPU architecture and set the appropriate Homebrew base path if [[ "$(uname -m)" == "arm64" ]]; then BREW_PREFIX="/opt/homebrew" elif [[ "$(uname -m)" == "x86_64" ]]; then BREW_PREFIX="/usr/local" else echo "!!! Error: Unknown CPU architecture $(uname -m).\n" >&2 exit 1 fi # Get the appropriate paths for the Homebrew dependecies as they differ through version BREW_OPENSSL_PATH=$(ls -d $BREW_PREFIX/Cellar/openssl@3/) BREW_LIBFIDO2_PATH=$(ls -d $BREW_PREFIX/Cellar/libfido2/) export CFLAGS="-L$BREW_OPENSSL_PATH/lib -I$BREW_OPENSSL_PATH/include -L$BREW_LIBFIDO2_PATH/lib -I$BREW_LIBFIDO2_PATH/include -Wno-error=implicit-function-declaration" export LDFLAGS="-L$BREW_OPENSSL_PATH/lib -L$BREW_LIBFIDO2_PATH/lib" printf "\n* Configuring build. This may take a while..." ./configure --quiet --with-security-key-standalone printf "\n* Cleaning previous build for good measure." make --quiet clean printf "\n* Building OpenSSH Portable." make --quiet printf "\n* Copying the Security Key Provider library to /usr/local/lib." printf "\n We need root privileges to modify system files.\n" sudo mkdir -p /usr/local/lib sudo mv sk-libfido2.dylib /usr/local/lib/ # Check if the script is running in ZSH. If not, give the user instructions. # Otherwise, modify .zshenv to set the environment variable if not already present. if [[ "$SHELL" == zsh ]]; then printf "\n* Configuring the ~/.zshenv for the System SSH use the Security Key Provider we just built" if ! grep -q "export SSH_SK_PROVIDER=/usr/local/lib/sk-libfido2.dylib" "$HOME/.zshenv" &>/dev/null; then echo "export SSH_SK_PROVIDER=/usr/local/lib/sk-libfido2.dylib" >> "$HOME/.zshenv" printf "\n* Added SSH_SK_PROVIDER to ~/.zshenv." else printf "\n* SSH_SK_PROVIDER is already configured in ~/.zshenv." fi else printf "\n Since you are not on ZSH, you will need to manually configure your shell profile to tell the System SSH client to use the Security Key Provider we just built." printf "\n The shell profile should export the environment variable as follows:" printf "\n export SSH_SK_PROVIDER=/usr/local/lib/sk-libfido2.dylib" fi printf "\n Exiting the directory and deleting the repository we cloned. We don't need it anymore" cd .. rm -rf openssh-portable printf "\n\n* That's it! After restarting your terminal session, you can plug in your hardware security key and test the installation using:" printf "\n ssh-keygen -t ed25519-sk -O resident -O verify-required -C \"Your Comment\"" printf "\n\nHave a nice day! :)\n\n"</code></pre>yubikey配置</h1> 生成驻留密钥</h2> 创建 SSH 驻留密钥（Resident Key）非常简单，只需要在生成密钥时添加 -O resident 选项。 ssh-keygen \ -t ed25519-sk \ -O resident \ -O verify-required</code></pre> 参数说明 -t ed25519-sk：指定证书类型为Ed25519</li> -O resident：将私钥存储在 YubiKey 内部（驻留密钥）</li> -O verify-required：每次使用时需要验证pin码</li> </ul> 之后安装提示输入PIN码并触碰金属触点即可完成配置。 从yubikey导出驻留密钥公钥</h2> 在新设备上使用驻留密钥也很简单，只需要使用使用 ssh-keygen -K</code></pre> 即可从yubikey中导出所有驻留密钥的公钥。之后把导出的文件移动到~/.ssh文件夹下，并重命名为id_ed25519_sk即可被ssh-agent自动加载。 到此配置完成，是不是非常简单。从此走向忘记密码的道路，enjoy it！ 参考资料</h1> Securing SSH Authentication with FIDO2 Security Keys</a></li> macOS bundled OpenSSH 8.6p1 seems don't support FIDO keys</a></li> Bundled version of OpenSSH with macOS Monterey doesn't support FIDO2 yubikeys</a></li> </ul>

配置并运行</h1>

调试代码</h1>

参考资料</h1>

6.1810: Operating System Engineering</a></li>
Xv6 代码导读 (调试工具配置；调试系统调用执行) [南京大学2022操作系统-P18]</a></li> </ul>

准备环境</h1>
openSSH在8.2后添加了对fido驻留密钥的支持，只需要安装openSSH版本大于8.2，并启用fido库即可使用。</p>

Windows</h2>
Window11自带全部环境，插上即用，无须配置。（win易用性这块还是不错的）</p>

yubikey配置</h1>

参考资料</h1>

Securing SSH Authentication with FIDO2 Security Keys</a></li>
macOS bundled OpenSSH 8.6p1 seems don't support FIDO keys</a></li>
Bundled version of OpenSSH with macOS Monterey doesn't support FIDO2 yubikeys</a></li> </ul>

服务器配置</h1>

客户端配置</h1>

参考资料</h1>
使用 wg-quick 服务配置 WireGuard 服务器</a></li>
What does 'firewall-cmd --add-masquerade' do?</a></li> </ul>

佩璃的小屋

MIT 6.1810：macOS 下环境准备与XV6源码运行

yubikey配置：基于resident-key实现在任意设备上安全使用ssh密钥。

零信任内网远程访问:基于WireGuard部署私有网络远程接入，并实现远程访问内网设备

佩璃的小屋

MIT 6.1810：macOS 下环境准备与XV6源码运行

安装 QEMU</h2> 之后安装QEMU虚拟机以运行系统</p> brew</span> install qemu</span></span></code></pre>安装GDB调试器</h2> macOS下，brew安装的riscv编译工具链并不包含GDB调试器。为了以后的调试，需要额外安装GDB调试器</p>

安装GDB调试器</h2> macOS下，brew安装的riscv编译工具链并不包含GDB调试器。为了以后的调试，需要额外安装GDB调试器</p>

配置并运行</h1>

拉取项目代码</h2> 使用git从MIT的仓库拉取项目源码</p>

调试代码</h1>

参考资料</h1> 6.1810: Operating System Engineering</a></li> Xv6 代码导读 (调试工具配置；调试系统调用执行) [南京大学2022操作系统-P18]</a></li> </ul>

yubikey配置：基于resident-key实现在任意设备上安全使用ssh密钥。

准备环境</h1> openSSH在8.2后添加了对fido驻留密钥的支持，只需要安装openSSH版本大于8.2，并启用fido库即可使用。</p>

Windows</h2> Window11自带全部环境，插上即用，无须配置。（win易用性这块还是不错的）</p>

Linux</h2> 主流发行版openSSH均支持驻留密钥，只需要安装fido库即可。如果不确定自己的openSSH版本是否支持可以使用ssh -V</code>来检查。</p> Debian/Ubuntu</strong></p>

yubikey配置</h1>

生成驻留密钥</h2> 创建 SSH 驻留密钥（Resident Key）非常简单，只需要在生成密钥时添加 -O resident 选项。</p>

从yubikey导出驻留密钥公钥</h2> 在新设备上使用驻留密钥也很简单，只需要使用使用</p>

参考资料</h1> Securing SSH Authentication with FIDO2 Security Keys</a></li> macOS bundled OpenSSH 8.6p1 seems don't support FIDO keys</a></li> Bundled version of OpenSSH with macOS Monterey doesn't support FIDO2 yubikeys</a></li> </ul>

零信任内网远程访问:基于WireGuard部署私有网络远程接入，并实现远程访问内网设备

服务器配置</h1>

客户端配置</h1>

参考资料</h1> 使用 wg-quick 服务配置 WireGuard 服务器</a></li> What does 'firewall-cmd --add-masquerade' do?</a></li> </ul>

参考资料</h1>

6.1810: Operating System Engineering</a></li>
Xv6 代码导读 (调试工具配置；调试系统调用执行) [南京大学2022操作系统-P18]</a></li> </ul>

准备环境</h1>
openSSH在8.2后添加了对fido驻留密钥的支持，只需要安装openSSH版本大于8.2，并启用fido库即可使用。</p>

Windows</h2>
Window11自带全部环境，插上即用，无须配置。（win易用性这块还是不错的）</p>

参考资料</h1>

Securing SSH Authentication with FIDO2 Security Keys</a></li>
macOS bundled OpenSSH 8.6p1 seems don't support FIDO keys</a></li>
Bundled version of OpenSSH with macOS Monterey doesn't support FIDO2 yubikeys</a></li> </ul>

参考资料</h1>
使用 wg-quick 服务配置 WireGuard 服务器</a></li>
What does 'firewall-cmd --add-masquerade' do?</a></li> </ul>