在大家都进入了kdb之后,in control的那个cpu就开始执行1566行的kdb_local()函数了.依然定义于kdb/kdbmain.c:
1134 /*
1135 * kdb_local
1136 *
1137 * The main code for kdb. This routine is invoked on a specific
1138 * processor, it is not global. The main kdb() routine ensures
1139 * that only one processor at a time is in this routine. This
1140 * code is called with the real reason code on the first entry
1141 * to a kdb session, thereafter it is called with reason SWITCH,
1142 * even if the user goes back to the original cpu.
1143 *
1144 * Inputs:
1145 * reason The reason KDB was invoked
1146 * error The hardware-defined error code
1147 * regs The exception frame at time of fault/breakpoint. NULL
1148 * for reason SILENT or CPU_UP, otherwise valid.
1149 * db_result Result code from the break or debug point.
1150 * Returns:
1151 * 0 KDB was invoked for an event which it wasn't responsible
1152 * 1 KDB handled the event for which it was invoked.
1153 * KDB_CMD_GO User typed 'go'.
1154 * KDB_CMD_CPU User switched to another cpu.
1155 * KDB_CMD_SS Single step.
1156 * KDB_CMD_SSB Single step until branch.
1157 * Locking:
1158 * none
1159 * Remarks:
1160 * none
1161 */
1162
1163 static int
1164 kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs, kdb_dbtrap_t db_result)
1165 {
1166 char *cmdbuf;
1167 int diag;
1168 struct task_struct *kdb_current = kdb_curr_task(smp_processor_id());
1169
1170 /* If kdb has been entered for an event which has been/will be
1171 * recovered then silently return. We have to get this far into kdb in
1172 * order to synchronize all the cpus, typically only one cpu (monarch)
1173 * knows that the event is recoverable but the other cpus (slaves) may
1174 * also be driven into kdb before that decision is made by the monarch.
1175 *
1176 * To pause in kdb even for recoverable events, 'set RECOVERY_PAUSE 1'
1177 */
1178 KDB_DEBUG_STATE("kdb_local 1", reason);
1179 if (reason == KDB_REASON_ENTER
1180 && KDB_FLAG(RECOVERY)
1181 && !KDB_FLAG(CATASTROPHIC)) {
1182 int recovery_pause = 0;
1183 kdbgetintenv("RECOVERY_PAUSE", &recovery_pause);
1184 if (recovery_pause == 0)
1185 reason = KDB_REASON_SILENT;
1186 else
1187 kdb_printf("%s: Recoverable error detected but"
1188 " RECOVERY_PAUSE is set, staying in KDB/n",
1189 __FUNCTION__);
1190 }
1191
1192 KDB_DEBUG_STATE("kdb_local 2", reason);
1193 kdb_go_count = 0;
1194 if (kdb_quiet(reason)) {
1195 /* no message */
1196 } else if (reason == KDB_REASON_DEBUG) {
1197 /* special case below */
1198 } else {
1199 kdb_printf("/nEntering kdb (current=0x%p, pid %d) ", kdb_current, kdb_current->pid);
1200 #if defined(CONFIG_SMP)
1201 kdb_printf("on processor %d ", smp_processor_id());
1202 #endif
1203 }
1204
1205 switch (reason) {
1206 case KDB_REASON_DEBUG:
1207 {
1208 /*
1209 * If re-entering kdb after a single step
1210 * command, don't print the message.
1211 */
1212 switch(db_result) {
1213 case KDB_DB_BPT:
1214 kdb_printf("/nEntering kdb (0x%p, pid %d) ", kdb_current, kdb_current->pid);
1215 #if defined(CONFIG_SMP)
1216 kdb_printf("on processor %d ", smp_processor_id());
1217 #endif
1218 kdb_printf("due to Debug @ " kdb_machreg_fmt "/n", kdba_getpc(regs));
1219 break;
1220 case KDB_DB_SSB:
1221 /*
1222 * In the midst of ssb command. Just return.
1223 */
1224 KDB_DEBUG_STATE("kdb_local 3", reason);
1225 return KDB_CMD_SSB; /* Continue with SSB command */
1226
1227 break;
1228 case KDB_DB_SS:
1229 break;
1230 case KDB_DB_SSBPT:
1231 KDB_DEBUG_STATE("kdb_local 4", reason);
1232 return 1; /* kdba_db_trap did the work */
1233 default:
1234 kdb_printf("kdb: Bad result from kdba_db_trap: %d/n",
1235 db_result);
1236 break;
1237 }
1238
1239 }
1240 break;
1241 case KDB_REASON_ENTER:
1242 if (KDB_STATE(KEYBOARD))
1243 kdb_printf("due to Keyboard Entry/n");
1244 else
1245 kdb_printf("due to KDB_ENTER()/n");
1246 break;
1247 case KDB_REASON_KEYBOARD:
1248 KDB_STATE_SET(KEYBOARD);
1249 kdb_printf("due to Keyboard Entry/n");
1250 break;
1251 case KDB_REASON_ENTER_SLAVE: /* drop through, slaves only get released via cpu switch */
1252 case KDB_REASON_SWITCH:
1253 kdb_printf("due to cpu switch/n");
1254 if (KDB_STATE(GO_SWITCH)) {
1255 KDB_STATE_CLEAR(GO_SWITCH);
1256 KDB_DEBUG_STATE("kdb_local 5", reason);
1257 return KDB_CMD_GO;
1258 }
1259 break;
1260 case KDB_REASON_OOPS:
1261 kdb_printf("Oops: %s/n", kdb_diemsg);
1262 kdb_printf("due to oops @ " kdb_machreg_fmt "/n", kdba_getpc(regs));
1263 kdba_dumpregs(regs, NULL, NULL);
1264 break;
1265 case KDB_REASON_NMI:
1266 kdb_printf("due to NonMaskable Interrupt @ " kdb_machreg_fmt "/n",
1267 kdba_getpc(regs));
1268 kdba_dumpregs(regs, NULL, NULL);
1269 break;
1270 case KDB_REASON_BREAK:
1271 kdb_printf("due to Breakpoint @ " kdb_machreg_fmt "/n", kdba_getpc(regs));
1272 /*
1273 * Determine if this breakpoint is one that we
1274 * are interested in.
1275 */
1276 if (db_result != KDB_DB_BPT) {
1277 kdb_printf("kdb: error return from kdba_bp_trap: %d/n", db_result);
1278 KDB_DEBUG_STATE("kdb_local 6", reason);
1279 return 0; /* Not for us, dismiss it */
1280 }
1281 break;
1282 case KDB_REASON_RECURSE:
1283 kdb_printf("due to Recursion @ " kdb_machreg_fmt "/n", kdba_getpc(regs));
1284 break;
1285 case KDB_REASON_CPU_UP:
1286 case KDB_REASON_SILENT:
1287 KDB_DEBUG_STATE("kdb_local 7", reason);
1288 if (reason == KDB_REASON_CPU_UP)
1289 kdba_cpu_up();
1290 return KDB_CMD_GO; /* Silent entry, silent exit */
1291 break;
1292 default:
1293 kdb_printf("kdb: unexpected reason code: %d/n", reason);
1294 KDB_DEBUG_STATE("kdb_local 8", reason);
1295 return 0; /* Not for us, dismiss it */
1296 }
1297
1298 kdba_local_arch_setup();
1299
1300 kdba_set_current_task(kdb_current);
1301
1302 while (1) {
1303 /*
1304 * Initialize pager context.
1305 */
1306 kdb_nextline = 1;
1307 KDB_STATE_CLEAR(SUPPRESS);
1308 #ifdef kdba_setjmp
1309 /*
1310 * Use kdba_setjmp/kdba_longjmp to break out of
1311 * the pager early and to attempt to recover from kdb errors.
1312 */
1313 KDB_STATE_CLEAR(LONGJMP);
1314 if (kdbjmpbuf) {
1315 if (kdba_setjmp(&kdbjmpbuf[smp_processor_id()])) {
1316 /* Command aborted (usually in pager) */
1317 continue;
1318 }
1319 else
1320 KDB_STATE_SET(LONGJMP);
1321 }
1322 #endif /* kdba_setjmp */
1323
1324 cmdbuf = cmd_cur;
1325 *cmdbuf = '/0';
1326 *(cmd_hist[cmd_head])='/0';
1327
1328 if (KDB_FLAG(ONLY_DO_DUMP)) {
1329 /* kdb is off but a catastrophic error requires a dump.
1330 * Take the dump and reboot.
1331 * Turn on logging so the kdb output appears in the log
1332 * buffer in the dump.
1333 */
1334 const char *setargs[] = { "set", "LOGGING", "1" };
1335 kdb_set(2, setargs);
1336 kdb_do_dump();
1337 kdb_reboot(0, NULL);
1338 /*NOTREACHED*/
1339 }
1340
1341 do_full_getstr:
1342 #if defined(CONFIG_SMP)
1343 snprintf(kdb_prompt_str, CMD_BUFLEN, kdbgetenv("PROMPT"), smp_processor_id());
1344 #else
1345 snprintf(kdb_prompt_str, CMD_BUFLEN, kdbgetenv("PROMPT"));
1346 #endif
1347 if (defcmd_in_progress)
1348 strncat(kdb_prompt_str, "[defcmd]", CMD_BUFLEN);
1349
1350 /*
1351 * Fetch command from keyboard
1352 */
1353 cmdbuf = kdb_getstr(cmdbuf, CMD_BUFLEN, kdb_prompt_str);
1354 if (*cmdbuf != '/n') {
1355 if (*cmdbuf < 32) {
1356 if(cmdptr == cmd_head) {
1357 strncpy(cmd_hist[cmd_head], cmd_cur, CMD_BUFLEN);
1358 *(cmd_hist[cmd_head]+strlen(cmd_hist[cmd_head])-1) = '/0';
1359 }
1360 if(!handle_ctrl_cmd(cmdbuf))
1361 *(cmd_cur+strlen(cmd_cur)-1) = '/0';
1362 cmdbuf = cmd_cur;
1363 goto do_full_getstr;
1364 }
1365 else
1366 strncpy(cmd_hist[cmd_head], cmd_cur, CMD_BUFLEN);
1367
1368 cmd_head = (cmd_head+1) % KDB_CMD_HISTORY_COUNT;
1369 if (cmd_head == cmd_tail) cmd_tail = (cmd_tail+1) % KDB_CMD_HISTORY_COUNT;
1370
1371 }
1372
1373 cmdptr = cmd_head;
1374 diag = kdb_parse(cmdbuf);
1375 if (diag == KDB_NOTFOUND) {
1376 kdb_printf("Unknown kdb command: '%s'/n", cmdbuf);
1377 diag = 0;
1378 }
1379 if (diag == KDB_CMD_GO
1380 || diag == KDB_CMD_CPU
1381 || diag == KDB_CMD_SS
1382 || diag == KDB_CMD_SSB)
1383 break;
1384
1385 if (diag)
1386 kdb_cmderror(diag);
1387 }
1388
1389 kdba_local_arch_cleanup();
1390
1391 KDB_DEBUG_STATE("kdb_local 9", diag);
1392 return diag;
1393 }
我承认一开始我看到这些几百行的函数是有一些害怕,但是慢慢的我发现,其实Kernel中出现这种几百行的函数,就好比华为死一个人一样,再正常不过了.倒是假如哪天写代码的不写这种暴长的函数了,就好似不了,又如同嫖客不了,人们反而会说她们不正常,人们反而会说他们不务正业.
我们能做的只是让一切继续,继续往下看,由于我们的reason是KDB_REASON_KEYBOARD,所以我们会执行1199行,会执行1249行,从而在屏幕上我们总能看到类似下面这样的信息被打印出来:
Entering kdb (current=0xffff81022fcab7e0, pid 0) on processor 7 due to Keyboard Entry
[7]kdb>
而如果我们是从KDB_ENTER()进来的,那么1245行的信息就会打印出来,因为我们的reason是KDB_REASON_ENTER.
下一个需要关注的函数是kdba_set_current_task().来自arch/i386/kdb/kdbasupport.c
944 void
945 kdba_set_current_task(const struct task_struct *p)
946 {
947 kdb_current_task = p;
948 if (kdb_task_has_cpu(p)) {
949 struct kdb_running_process *krp = kdb_running_process + kdb_process_cpu(p);
950 kdb_current_regs = krp->regs;
951 return;
952 }
953 kdb_current_regs = NULL;
954 }
如果你看不明白这个函数那我也没话说,其实我相信湖北天门市的城管都能看懂的.无非就是为了保存一个作案现场,以便日后使用.用kdb_current_task保存了当前的这个进程,用kdb_current_regs保存了当前的寄存器.天门城管就是看明白了魏文华把他们的作案现场(粗暴执法)给保存(拍摄)了下来所以才会恼羞成怒,若是他们没进监狱,我倒是希望他们给个面子,来给大家讲解Linux Kernel代码.
从1302行开始,我们发现我们又将进入一个死循环了.先不用看具体的代码,想想也能知道,kdb提示符已经可以打印出来,接下来,kdb进入一个死循环的目的就是为了时时刻刻等待着我们输入kdb那些命令,一个命令执行完了之后,继续循环,继续等待.这种意境很美好,相当于kdb用玫瑰铺满道路,期待你输入的命令,如果你什么也不输入,那么她只会等到心碎的花瓣在寒风中哭泣.
而具体的代码也确实如我们所说的那样,1343行snprintf就是准备打印kdb提示符,默认的就是”[n]kdb> “,n表示处理器的编号.然后1353行kdb_getstr()就是如注释说的那样,从键盘获取命令.(当然你会看到,实际上kdb提示符也是在kdb_getstr()中打印出来的.)假如你什么也没输入,那么cmdbuf就是空.
376 /*
377 * kdb_getstr
378 *
379 * Print the prompt string and read a command from the
380 * input device.
381 *
382 * Parameters:
383 * buffer Address of buffer to receive command
384 * bufsize Size of buffer in bytes
385 * prompt Pointer to string to use as prompt string
386 * Returns:
387 * Pointer to command buffer.
388 * Locking:
389 * None.
390 * Remarks:
391 * For SMP kernels, the processor number will be
392 * substituted for %d, %x or %o in the prompt.
393 */
394
395 char *
396 kdb_getstr(char *buffer, size_t bufsize, char *prompt)
397 {
398 if(prompt && kdb_prompt_str!=prompt)
399 strncpy(kdb_prompt_str, prompt, CMD_BUFLEN);
400 kdb_printf(kdb_prompt_str);
401 kdb_nextline = 1; /* Prompt and input resets line number */
402 return kdb_read(buffer, bufsize);
403 }
而kdb_read()中具体是怎么读的呢?其它不用说,还是凭男人的直觉就知道,一定是轮询.事实也的确是如此,不过我们暂且不去深究,先把这个函数跳过去,以尽快结束我们kdb()这个大函数.
甭管读到什么,总之当且仅当我们读到一些东西的时候,kdb_getstr()才会返回,从而cmdbuf里是一定有东西了,也就是说你一定是输入了一些东西了,而在1374行,kdb_parse(),就会执行命令.执行命令的返回值赋给了diag.当然有很多种情况,最后1392行,也就把diag给返回了.也就是说我们回到了kdb_main_loop().
在这里kdb_local的返回值赋给了result,下面的代码就是拿着result去分析来分析去,设置各种flag,然后最终又把result作为返回值给返回了.如果你想退出kdb,你可以输入”go”,这种情况diag以及之后的result就都是KDB_CMD_GO.
我们继续回溯,kdb_main_loop的结束引发了kdba_main_loop()也返回.返回值都是一样的.直到此刻,我们终于再一次回到了kdb().
这之后,kdba_adjust_ip()被调用,不过对x86来说,这是个空函数,飘过.
再之后,我们看到WAIT_IPI,HOLD_CPU给清掉了.与此同时,设置了LEAVING flag.
然后又出现了一个疑似死循环,while中调用了一个比较重要的函数,kdb_previous_event(),来自kdb/kdbmain.c:
1418 /*
1419 * kdb_previous_event
1420 *
1421 * Return a count of cpus that are leaving kdb, i.e. the number
1422 * of processors that are still handling the previous kdb event.
1423 *
1424 * Inputs:
1425 * None.
1426 * Returns:
1427 * Count of cpus in previous event.
1428 * Locking:
1429 * none
1430 * Remarks:
1431 * none
1432 */
1433
1434 static int
1435 kdb_previous_event(void)
1436 {
1437 int i, leaving = 0;
1438 for (i = 0; i < NR_CPUS; ++i) {
1439 if (KDB_STATE_CPU(LEAVING, i))
1440 ++leaving;
1441 }
1442 return leaving;
1443 }
这个函数统计的就是有几个cpu对应的LEAVING flag被设置了,实际情况是我们刚刚为每个CPU设置了LEAVING,因此对于多处理器的机器来说,这里的返回值肯定不是1.而while循环中说,如果kdb_previous_event返回值不为1,则while循环就像永不消逝的电波一样,它反反复复,它生生不息,它试图摆脱轮回的束缚,但是,它能摆脱吗?
为了看看这个循环是否真的是死循环,我们得先回去看一下那些spin in kdb_main_loop()中的cpu,要知道它们循环的条件是HOLD_CPU被设置了,而我们现在看到这个flag终于被清除掉了,这就意味着各个cpu都将结束该循环.
而回过去仔细看kdb_main_loop(),你会发现由于LEAVING flag的设置,使得各个cpu将结束kdb_main_loop(),返回值result为1,然后kdba_main_loop()也返回了,然后由于返回值为1,使得kdb()也将最终返回.但是在返回之前,2091行,LEAVING也将被清除.也就是说,对于那些spin的cpu,它们所对应的LEAVING flag是已经被清除掉了,只剩下这个in control的cpu还设置了这个flag,因此,这时候,kdb_previous_event()将等于1,于是,这个疑似死循环终于可以结束了.
最后作一些恢复工作之后,永垂不朽的kdb()函数也终于垂了朽了.到这一刻,所有的cpu都正式离开了kdb(),从此世界清静了,人们群众的生活再次回归宁静,各个进程又按着往日的习惯运转着,执行着,睡眠着.