使用实验楼，配置menuOS：
打开gdb，设置断点，其中switch_to为宏定义，不能设置断点，需到context_switch函数中单步执行查看调用：
执行程序，停在了schedule函数处，查看代码发现调用了schedule函数，发生了进程调度：
继续执行程序，代码来到了pick_next_task断点处：
继续执行，来到了context_switch处：
在context_switch中单步执行，发现其中调用到了switch_to：
继续单步执行，结束切换：
context_switch函数部分
static inline void context_switch(struct rq *rq, struct task_struct *prev, struct task_struct *next)
{
struct mm_struct *mm, *oldmm;
prepare_task_switch(rq, prev, next);
mm = next->mm;
oldmm = prev->active_mm;
/*
* For paravirt, this is coupled with an exit in switch_to to
* combine the page table reload and the switch backend into
* one hypercall.
*/
arch_start_context_switch(prev);
if (!mm) { //如果被切换进来的进程的mm为空切换，内核线程mm为空
next->active_mm = oldmm; //将共享切换出去的进程的active_mm
atomic_inc(&oldmm->mm_count); //有一个进程共享，所有引用计数加一
enter_lazy_tlb(oldmm, next); //普通mm不为空，则调用switch_mm切换地址空间
} else
switch_mm(oldmm, mm, next);
if (!prev->mm) {
prev->active_mm = NULL;
rq->prev_mm = oldmm;
}
/*
* Since the runqueue lock will be released by the next
* task (which is an invalid locking op but in the case
* of the scheduler it‘s an obvious special-case), so we
* do an early lockdep release here:
*/
spin_release(&rq->lock.dep_map, 1, _THIS_IP_);
context_tracking_task_switch(prev, next);
// Here we just switch the register state and the stack.切换寄存器状态和栈
switch_to(prev, next, prev);
barrier();
/*
* this_rq must be evaluated again because prev may have moved
* CPUs since it called schedule(), thus the ‘rq‘ on its stack
* frame will be invalid.
*/
finish_task_switch(this_rq(), prev);
}schedule函数选择一个新的进程来运行，并调用context_switch函数进行上下文的切换
switch_to函数部分
#define switch_to(prev, next, last)
do {
/*
* Context-switching clobbers all registers, so we clobber
* them explicitly, via unused output variables.
* (EAX and EBP is not listed because EBP is saved/restored
* explicitly for wchan access and EAX is the return value of
* __switch_to())
*/
unsigned long ebx, ecx, edx, esi, edi;
asm volatile(
"pushfl\n\t" // 保存当前进程flags
"pushl %%ebp\n\t" // 当前进程堆栈基址压栈
"movl %%esp,%[prev_sp]\n\t" // 保存ESP，将当前堆栈栈顶保存起来
"movl %[next_sp],%%esp\n\t" // 更新ESP，将下一栈顶保存到ESP中
// 完成内核堆栈的切换
"movl $1f,%[prev_ip]\n\t" // 保存当前进程的EIP
"pushl %[next_ip]\n\t" // 将next进程起点压入堆栈，即next进程的栈顶为起点，next_ip一般为$1f，对于新创建的子进程是ret_from_fork
__switch_canary
"jmp __switch_to\n" // prve进程中，设置next进程堆栈，jmp与call不同，是通过寄存器传递参数（call通过堆栈），所以ret时弹出的是之前压入栈顶的next进程起点
// 完成EIP的切换
"1:\t" // next进程开始执行
"popl %%ebp\n\t" // restore EBP
"popfl\n" // restore flags
// 输出量
: [prev_sp] "=m" (prev->thread.sp), // 保存当前进程的esp
[prev_ip] "=m" (prev->thread.ip), // 保存当前进仓的eip
"=a" (last),
// 要破坏的寄存器
"=b" (ebx), "=c" (ecx), "=d" (edx),
"=S" (esi), "=D" (edi)
__switch_canary_oparam
// 输入量
: [next_sp] "m" (next->thread.sp), // next进程的内核堆栈栈顶地址，即esp
[next_ip] "m" (next->thread.ip), // next进程的eip
// regparm parameters for __switch_to():
[prev] "a" (prev),
[next] "d" (next)
__switch_canary_iparam
: // 重新加载段寄存器
"memory");
} while (0)context_switch调用宏switch_to进行硬件上下文切换，主要是内联汇编代码
原文：https://www.cnblogs.com/intoxication/p/10092016.html