boot_alloc()
mem_init() (only up to the call to check_page_free_list(1))
page_init()
page_alloc()
page_free()

boot_alloc()
mem_init() // 只需要实现到check_page_free_list(1)这里。
page_init()
page_alloc()
page_free()

int *p = 0x3BD  << 22 | 0x3BD << 12 | 0;
for (int i = 0; i < 1024; i++) {
    p[i]; // 这里实际上就是在遍历kern_pgdir[i];    
}

int *p = 0x3BD  << 22 | 0x3BD << 12 | 0;
for (int i = 0; i < 1024; i++) {
    p[i]; // 这里实际上就是在遍历uint32_t kern_pgdir[i];    
}

int *p = 0x3BD  << 22 | 0x3BD << 12 | 0;
for (i = 0; i < 1024; i++) {
    if (*(p+i) & 0x01) {
        // 二级页表存在
    } else {
        // 二级页表不存在
    }
}

// This simple physical memory allocator is used only while JOS is setting
// up its virtual memory system.  page_alloc() is the real allocator.
//
// If n>0, allocates enough pages of contiguous physical memory to hold 'n'
// bytes.  Doesn't initialize the memory.  Returns a kernel virtual address.
//
// If n==0, returns the address of the next free page without allocating
// anything.
//
// If we're out of memory, boot_alloc should panic.
// This function may ONLY be used during initialization,
// before the page_free_list list has been set up.
static void *
boot_alloc(uint32_t n)
{
    static char *nextfree;    // virtual address of next byte of free memory
    char *result;
    // Initialize nextfree if this is the first time.
    // 'end' is a magic symbol automatically generated by the linker,
    // which points to the end of the kernel's bss segment:
    // the first virtual address that the linker did *not* assign
    // to any kernel code or global variables.
    if (!nextfree) {
        extern char end[];
        nextfree = ROUNDUP((char *) end, PGSIZE);
    }
    // Allocate a chunk large enough to hold 'n' bytes, then update
    // nextfree.  Make sure nextfree is kept aligned
    // to a multiple of PGSIZE.
    //
    // LAB 2: Your code here.
    if (0 == n) {
        return nextfree;
    }
    n = ROUNDUP(n, PGSIZE);
    result = nextfree;
    nextfree += n;
    return result;
}

// Your code goes here:
n = sizeof(struct PageInfo) * npages;
pages = (struct PageInfo*)boot_alloc(n);
memset(pagees, 0, n);

void
page_init(void)
{
    // The example code here marks all physical pages as free.
    // However this is not truly the case.  What memory is free?
    //  1) Mark physical page 0 as in use.
    //     This way we preserve the real-mode IDT and BIOS structures
    //     in case we ever need them.  (Currently we don't, but...)
    //  2) The rest of base memory, [PGSIZE, npages_basemem * PGSIZE)
    //     is free.
    //  3) Then comes the IO hole [IOPHYSMEM, EXTPHYSMEM), which must
    //     never be allocated.
    //  4) Then extended memory [EXTPHYSMEM, ...).
    //     Some of it is in use, some is free. Where is the kernel
    //     in physical memory?  Which pages are already in use for
    //     page tables and other data structures?
    //
    // Change the code to reflect this.
    // NB: DO NOT actually touch the physical memory corresponding to
    // free pages!
    size_t i;
    // 这里采用的思路是：凡是不能被分配的内存页，都不加到链表里面。
    // 只处理可以被使用的内存页。
    assert(!page_free_list);
    // 1. page 0是要被用来做实模式的IDT BIOS数据结构，尽管从来不会用，以后也不会用
    //    这不是浪费么。不管了。
    // 2. 接下来的[PGSIZE, npages_basemem * PGSIZE)是可用的。
    for (i = 1; i < npages_basemem; i++) {
        pages[i].pp_ref = 0;
        pages[i].pp_link = page_free_list;
        page_free_list = &pages[i];
    }
    // 3. IO空洞，绝对不能使用。
    //    链表直接跳过。不管。
    // 4. 直接找到kernel内存的尾巴
    //    注意这里取了PADDR之后要除PGSIZE.
    for (i = PADDR(boot_alloc(0))/PGSIZE; i < npages; i++) {        
        pages[i].pp_ref = 0;
        pages[i].pp_link = page_free_list;
        page_free_list = &pages[i];
    }
}

struct PageInfo *
page_alloc(int alloc_flags)
{
    // Fill this function in
    struct PageInfo *ret = page_free_list;
    if (!page_free_list) {
        return NULL;
    }
    page_free_list = ret->pp_link;
    ret->pp_link = NULL;
    if (alloc_flags & ALLOC_ZERO) {
        memset(page2kva(ret), 0, PGSIZE);
    }
    return ret;
}

void
page_free(struct PageInfo *pp)
{
    // Fill this function in
    // Hint: You may want to panic if pp->pp_ref is nonzero or
    // pp->pp_link is not NULL.
    assert(!pp->pp_ref);
    assert(!pp->pp_link);
    pp->pp_link = page_free_list;
    page_free_list = pp;
}

pte_t *
pgdir_walk(pde_t *pgdir, const void *va, int create)
{
    // Fill this function in
    assert(pgdir);
    pde_t *pde = &pgdir[PDX(va)];
    if (!(*pde & PTE_P)) {
        if (!create) return NULL;
        struct PageInfo *page = page_alloc(ALLOC_ZERO);
        if (!page) return NULL;
        page->pp_ref++;
        assert(page->pp_ref == 1);
        assert(page->pp_link == NULL);
        *pde = page2pa(page) | PTE_P | PTE_U | PTE_W;
    }
    // 获取页表项
    return (pte_t*)(KADDR(PTE_ADDR(*pde))) + PTX(va);
}

static void
boot_map_region(pde_t *pgdir, uintptr_t va, size_t size, physaddr_t pa, int perm)
{
    // Fill this function in
    for (uint32_t i = 0; i < size; i += PGSIZE) {
        pte_t *pte = pgdir_walk(pgdir, (const void *)va, true);
        *pte = pa | perm | PTE_P;
        va += PGSIZE;
        pa += PGSIZE;
    }
}

int
page_insert(pde_t *pgdir, struct PageInfo *pp, void *va, int perm)
{
    // Fill this function in
    pte_t *pte = pgdir_walk(pgdir, va, true);
    if (!pte)
        return -E_NO_MEM;
    pp->pp_ref++;
    if (*pte & PTE_P)
        page_remove(pgdir, va);
    *pte = page2pa(pp) | perm | PTE_P;
    tlb_invalidate(pgdir, va);
    return 0;
}

struct PageInfo *
page_lookup(pde_t *pgdir, void *va, pte_t **pte_store)
{
    // Fill this function in
    pte_t *pte = pgdir_walk(pgdir, va, false);
    if (!pte || !(*pte & PTE_P)) return NULL;
    if (pte_store) *pte_store = pte;
    return pa2page(PTE_ADDR(*pte));
}

void
page_remove(pde_t *pgdir, void *va)
{
    // Fill this function in
    pte_t *pte = NULL;
    struct PageInfo *pp = page_lookup(pgdir, va, &pte);
    if (!pp) return;
    *pte = 0;
    page_decref(pp);
    tlb_invalidate(pgdir, va);
}

// Your code goes here:
// 注意这里用的是PTSIZE
// 一种保守的作法是把pages align到页大小之后再进行映射。
boot_map_region(kern_pgdir, UPAGES, PTSIZE, PADDR(pages), PTE_U);
//////////////////////////////////////////////////////////////////////
// Use the physical memory that 'bootstack' refers to as the kernel
// stack.  The kernel stack grows down from virtual address KSTACKTOP.
// We consider the entire range from [KSTACKTOP-PTSIZE, KSTACKTOP)
// to be the kernel stack, but break this into two pieces:
//     * [KSTACKTOP-KSTKSIZE, KSTACKTOP) -- backed by physical memory
//     * [KSTACKTOP-PTSIZE, KSTACKTOP-KSTKSIZE) -- not backed; so if
//       the kernel overflows its stack, it will fault rather than
//       overwrite memory.  Known as a "guard page".
//     Permissions: kernel RW, user NONE
// Your code goes here:
boot_map_region(kern_pgdir, KSTACKTOP-KSTKSIZE, KSTKSIZE, PADDR(bootstack), PTE_W);    
//////////////////////////////////////////////////////////////////////
// Map all of physical memory at KERNBASE.
// Ie.  the VA range [KERNBASE, 2^32) should map to
//      the PA range [0, 2^32 - KERNBASE)
// We might not have 2^32 - KERNBASE bytes of physical memory, but
// we just set up the mapping anyway.
// Permissions: kernel RW, user NONE
// Your code goes here:
// KERNBASE    0x F0000000
// 2^32 =      0x 1000 0000
// 256MB
boot_map_region(kern_pgdir, KERNBASE, 0x10000000, 0, PTE_W);

Q: 在哪里CPU开始进入到32位模式。
   哪条指令是带来了16位到32位的切换。
A: 
movl    %eax, %cr0

void bootmain(void)
{
        struct Proghdr *ph, *eph;
        // 这里把ELF文件的头读到内存里面。
        readseg((uint32_t) ELFHDR, SECTSIZE*8, 0);
        // is this a valid ELF?
        // 检查一下ELF头文件的magic是不是与指定的ELF的格式相等。
        if (ELFHDR->e_magic != ELF_MAGIC)
                goto bad;
        // load each program segment (ignores ph flags)
        // ELF header里面指明了第一个program section header的位置。
        // 也指明了最后一个位置在哪里
        // [ph, end_of_program_header)
        // 这里面表明了每个程序段的大小以及位置。
        ph = (struct Proghdr *) ((uint8_t *) ELFHDR + ELFHDR->e_phoff);
        eph = ph + ELFHDR->e_phnum;
        for (; ph < eph; ph++)
                // p_pa是需要被加载的地址。
                // p_memsz指的是需要的物理内存的大小
                // p_offset指的是在逻辑上相对于整个文件头的偏移量。
                // 虽然这里p_memsz表示的时候需要占用的内存的大小。
                // 实际上也是磁盘上需要读取的数据量的大小。
                readseg(ph->p_pa, ph->p_memsz, ph->p_offset);
        // 当把内存加载到内存里面之后。开始从这里开始执行第一条指令。
        ((void (*)(void)) (ELFHDR->e_entry))();
bad:
        outw(0x8A00, 0x8A00);
        outw(0x8A00, 0x8E00);
        while (1)
                /* do nothing */;
}
// pa表示的是内存地址开始放磁盘内容的地方。
// count表示需要读的内容的长度。
// offset表示相对程序文件头的偏移量。这个传进来的参数还没有考虑到
// kernel在磁盘便移量。
void readseg(uint32_t pa, uint32_t count, uint32_t offset)
{
        uint32_t end_pa;
        // pa是开始放内容的内存起始地址
        // end_pa是指末尾地址
        end_pa = pa + count;
        // 操作的时候，起始地址取一个512byte对齐的边界
        // 比如，如果起始地址addr =256, 那么内存开始放的地址就是addr = 0
        pa &= ~(SECTSIZE - 1);
        // 注意，这里把offset修正过了。由于第一个扇区放的是
        // boot loader。所以内存实际上是从第2个扇区开始放的。
        // 如果代码要更加友好一点。应该改成。
        // kernel_start_sector = 1;
        // offset = (offset / SECTSIZE) + kernel_start_sector;
        // 这样代码就比较容易理解了。
        offset = (offset / SECTSIZE) + 1;
        // 本来这里可以用不着一个扇区一个扇区读的。
        // 可以读得快一点的。linux kernel里面就是利用较
        // 复杂的代码来加速了这个读取过程。
        while (pa < end_pa) {
                // 这里把磁盘扇区，注意，这个时候offset表示的是哪个扇区
                // 把这个扇区的内容读到内存地址pa处。
                readsect((uint8_t*) pa, offset);
                // 读完之后，移动内存地址以及扇区。
                pa += SECTSIZE;
                offset++;
        }
}

int a[10];
int *p = a;

__attribute__((__aligned__(PGSIZE)))
pde_t entry_pgdir[NPDENTRIES] = {
        // Map VA's [0, 4MB) to PA's [0, 4MB) 
        [0]
                = ((uintptr_t)entry_pgtable - KERNBASE) + PTE_P,
        // Map VA's [KERNBASE, KERNBASE+4MB) to PA's [0, 4MB)
        [KERNBASE>>PDXSHIFT]
                = ((uintptr_t)entry_pgtable - KERNBASE) + PTE_P + PTE_W
};

#define MULTIBOOT_HEADER_MAGIC (0x1BADB002)
#define MULTIBOOT_HEADER_FLAGS (0)
#define CHECKSUM (-(MULTIBOOT_HEADER_MAGIC + MULTIBOOT_HEADER_FLAGS))

#define    RELOC(x) ((x) - KERNBASE)

root@debug:~/6.828/lab# git diff
diff --git a/lib/printfmt.c b/lib/printfmt.c
index 28e01c9..1d3a5fa 100644
--- a/lib/printfmt.c
+++ b/lib/printfmt.c
@@ -206,10 +206,13 @@ vprintfmt(void (*putch)(int, void*), void *putdat, const char *fmt, va_list ap)
                // (unsigned) octal
                case 'o':
                        // Replace this with your code.
-                       putch('X', putdat);
-                       putch('X', putdat);
-                       putch('X', putdat);
-                       break;
+                       num = getint(&ap, lflag);
+                       if ((long long) num < 0) {
+                               putch('-', putdat);
+                               num = -(long long) num;
+                       }
+                       base = 8;
+                       goto number;
                // pointer
                case 'p':

cprintf -> vcprintf -> vprintfmt -> putch -> cputchar

./inc/stdio.h:11:void    cputchar(int c);

void cputchar(int c)
{
        cons_putc(c);
}
// output a character to the console
static void
cons_putc(int c)
{
        serial_putc(c);
        lpt_putc(c);
        cga_putc(c);
}

static void cga_init(void)
{
        volatile uint16_t *cp;
        uint16_t was;
        unsigned pos;
        cp = (uint16_t*) (KERNBASE + CGA_BUF);
        was = *cp;
        *cp = (uint16_t) 0xA55A;
        if (*cp != 0xA55A) {
                cp = (uint16_t*) (KERNBASE + MONO_BUF);
                addr_6845 = MONO_BASE;
        } else {
                *cp = was;
                addr_6845 = CGA_BASE;
        }
        /* Extract cursor location */
        outb(addr_6845, 14);
        pos = inb(addr_6845 + 1) << 8;
        outb(addr_6845, 15);
        pos |= inb(addr_6845 + 1);
        crt_buf = (uint16_t*) cp;
        crt_pos = pos;
}

./kern/console.h:14:#define CGA_BUF        0xB8000

static void cga_putc(int c)
{
        // if no attribute given, then use black on white
        if (!(c & ~0xFF))
                c |= 0x0700;
        switch (c & 0xff) {
        case '\b':
                if (crt_pos > 0) {
                        crt_pos--;
                        crt_buf[crt_pos] = (c & ~0xff) | ' ';
                }
                break;
        case '\n':
                crt_pos += CRT_COLS;
                /* fallthru */
        case '\r':
                crt_pos -= (crt_pos % CRT_COLS);
                break;
        case '\t':
                cons_putc(' ');
                cons_putc(' ');
                cons_putc(' ');
                cons_putc(' ');
                cons_putc(' ');
                break;
        default:
                crt_buf[crt_pos++] = c;         /* write the character */
                break;
        }
        // What is the purpose of this?
        if (crt_pos >= CRT_SIZE) {
                int i;
                memmove(crt_buf, crt_buf + CRT_COLS, (CRT_SIZE - CRT_COLS) * sizeof(uint16_t));
                for (i = CRT_SIZE - CRT_COLS; i < CRT_SIZE; i++)
                        crt_buf[i] = 0x0700 | ' ';
                crt_pos -= CRT_COLS;
        }
        /* move that little blinky thing */
        outb(addr_6845, 14);
        outb(addr_6845 + 1, crt_pos >> 8);
        outb(addr_6845, 15);
        outb(addr_6845 + 1, crt_pos);
}

// 一页写满，滚动一行。
if (crt_pos >= CRT_SIZE) {
    int i;
    // 把从第1~n行的内容复制到0~(n-1)行，第n行未变化
    // 通过这一行代码完成了整个屏幕向上移动一行的操作。
    memmove(crt_buf, crt_buf + CRT_COLS, (CRT_SIZE - CRT_COLS) * sizeof(uint16_t));
    // 把最后一行清空
    for (i = CRT_SIZE - CRT_COLS; i < CRT_SIZE; i++)
        crt_buf[i] = 0x0700 | ' ';
    // 清空了最后一行，同步crt_pos
    crt_pos -= CRT_COLS;
}

int x = 1, y = 3, z = 4;
cprintf("x %d, y %x, z %d\n", x, y, z);

static void
putch(int ch, int *cnt)
{
        cputchar(ch);
        *cnt++;
}
int
vcprintf(const char *fmt, va_list ap)
{
        int cnt = 0;
        vprintfmt((void*)putch, &cnt, fmt, ap);
        return cnt;
}
int
cprintf(const char *fmt, ...)
{
        va_list ap;
        int cnt;
        va_start(ap, fmt);
        cnt = vcprintf(fmt, ap);
        va_end(ap);
        return cnt;
}

typedef __builtin_va_list va_list;
#define va_start(ap, last) __builtin_va_start(ap, last)
#define va_arg(ap, type) __builtin_va_arg(ap, type)
#define va_end(ap) __builtin_va_end(ap)

// 指针定义为char *可以指向任意一个内存地址。
typedef char *va_list;
// 类型大小，注意这里是与CPU位数对齐 ＝ sizeof(long)的作用。
#define    __va_size(type) \
    (((sizeof(type) + sizeof(long) - 1) / sizeof(long)) * sizeof(long))
// 这里个宏并不是取得参数的起始地址。而是说参数将从什么地址开始放。
#define    va_start(ap, last) \
    ((ap) = (va_list)&(last) + __va_size(last))
// va_arg就是用来取参数的起始地址的。然后返回type类型。
// 从整个表达式的意义来说没有什么好用的。
// 其实等价于(*(type*)ap)
// 但是实际上使ap指针移动一个参数大小。
#define    va_arg(ap, type) \
    (*(type *)((ap) += __va_size(type), (ap) - __va_size(type)))
// 空指令，没有什么用
#define    va_end(ap)    ((void)0)

int x = 1, y = 3, z = 4;
cprintf("x %d, y %x, z %d\n", x, y, z);

+-----------------+
|                 |
|     Z           |
|                 |
|                 |
+-----------------+
|                 |
|     Y           |
|                 |
|                 |
+-----------------+
|                 |
|     X           |
|                 |
|                 |
+-----------------+
|                 |
|     fmt         |
|                 |
|                 |
+-----------------+ <-----------+&fmt

va_start(fmt, ap) 作用如下
#define    va_start(ap, last) \
    ((ap) = (va_list)&(last) + __va_size(last))
展开就是
ap = (char *)(&fmt) + align_long(fmt);
+-----------------+
|                 |
|     Z           |
|                 |
|                 |
+-----------------+
|                 |
|     Y           |
|                 |
|                 |
+-----------------+
|                 |
|     X           |
|                 |
|                 |
+-----------------+ <--------------+ap
|                 |
|     fmt         |
|                 |
|                 |
+-----------------+

va_arg(ap, int) 展开后就是
#define    va_arg(ap, type) \
    (*(type *)((ap) += __va_size(type), (ap) - __va_size(type)))
// putat用来统计输出的字符的个数。在这里可以不用去管
char temp = *(char*)ap;
putch(temp, putdat); // 输出到console上。
ap += align_long(char);
执行完成之后。
+-----------------+
|                 |
|     Z           |
|                 |
|                 |
+-----------------+
|                 |
|     Y           |
|                 |
|                 |
+-----------------+ <------+ap
|                 |
|     X           |   这个x会被%d提出来进行输出。
|                 |
|                 |
+-----------------+
|                 |
|     fmt         |
|                 |
|                 |
+-----------------+

57616 = 0xE110。
i = 0x00646c72
那么如果把i占用的4byte转换成为char[4]数组。结果就是：
char str[4] = {0x72, 0x6c, 0x64, 0x00}; // = {'r', 'l', 'd', 0}
所以输出就是
Hell0 World

cprintf("x=%d y=%d", 3);

// 指针定义为char *可以指向任意一个内存地址。
typedef char *va_list;
// 类型大小，注意这里是与CPU位数对齐 ＝ sizeof(long)的作用。
#define    __va_size(type) \
    (((sizeof(type) + sizeof(long) - 1) / sizeof(long)) * sizeof(long))
// 这里个宏并不是取得参数的起始地址。而是说参数将从什么地址开始放。
#define    va_start(ap, last) \
    ((ap) = (va_list)&(last) + __va_size(last))
// va_arg就是用来取参数的起始地址的。然后返回type类型。
// 从整个表达式的意义来说没有什么好用的。
// 其实等价于(*(type*)ap)
// 但是实际上使ap指针移动一个参数大小。
#define    va_arg(ap, type) \
    (*(type *)((ap) += __va_size(type), (ap) - __va_size(type)))
// 空指令，没有什么用
#define    va_end(ap)    ((void)0)

/*
 * Virtual memory map:                                Permissions
 *                                                    kernel/user
 *
 *    4 Gig -------->  +------------------------------+
 *                     |                              | RW/--
 *                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 *                     :              .               :
 *                     :              .               :
 *                     :              .               :
 *                     |~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| RW/--
 *                     |                              | RW/--
 *                     |   Remapped Physical Memory   | RW/--
 *                     |                              | RW/--
 *    KERNBASE, ---->  +------------------------------+ 0xf0000000      --+
 *    KSTACKTOP        |     CPU0's Kernel Stack      | RW/--  KSTKSIZE   |
 *                     | - - - - - - - - - - - - - - -|                   |
 *                     |      Invalid Memory (*)      | --/--  KSTKGAP    |
 *                     +------------------------------+                   |
 *                     |     CPU1's Kernel Stack      | RW/--  KSTKSIZE   |
 *                     | - - - - - - - - - - - - - - -|                 PTSIZE
 *                     |      Invalid Memory (*)      | --/--  KSTKGAP    |
 *                     +------------------------------+                   |
 *                     :              .               :                   |
 *                     :              .               :                   |
 *    MMIOLIM ------>  +------------------------------+ 0xefc00000      --+
./inc/memlayout.h:97:#define KSTKSIZE    (8*PGSIZE)           // size of a kernel stack

// Test the stack backtrace function (lab 1 only)
void
test_backtrace(int x)
{
    cprintf("entering test_backtrace %d\n", x);
    if (x > 0)
        test_backtrace(x-1);
    else
        mon_backtrace(0, 0, 0);
    cprintf("leaving test_backtrace %d\n", x);
}

int
mon_backtrace(int argc, char **argv, struct Trapframe *tf)
{
    // Your code here.
  uint32_t ebp = read_ebp();
  #define TO_INT(x)  *((uint32_t*)(x))
  while (ebp) {
    // ebp f0109e58  eip f0100a62  args 00000001 f0109e80 f0109e98 f0100ed2 00000031
    cprintf("ebp %08x  eip %08x  args %08x %08x %08x %08x %08x\n",
            TO_INT(ebp),       /*ebp*/
            TO_INT((ebp+4)),   /*eip*/
            TO_INT((ebp+8)),   /*arg1*/
            TO_INT((ebp+12)),  /*arg2*/
            TO_INT((ebp+16)),  /*arg3*/
            TO_INT((ebp+20)),  /*arg4*/
            TO_INT((ebp+24)));  /*arg5*/
    ebp = TO_INT(ebp);
  }
    return 0;
}

// Search the entire set of stabs for the source file (type N_SO).
lfile = 0;
rfile = (stab_end - stabs) - 1;
stab_binsearch(stabs, &lfile, &rfile, N_SO, addr);
if (lfile == 0)
  return -1;

// Search within that file's stabs for the function definition
// (N_FUN).
lfun = lfile;
rfun = rfile;
stab_binsearch(stabs, &lfun, &rfun, N_FUN, addr);
if (lfun <= rfun) {
  // stabs[lfun] points to the function name
  // in the string table, but check bounds just in case.
  if (stabs[lfun].n_strx < stabstr_end - stabstr)
    info->eip_fn_name = stabstr + stabs[lfun].n_strx;
  info->eip_fn_addr = stabs[lfun].n_value;
  addr -= info->eip_fn_addr;
  // Search within the function definition for the line number.
  lline = lfun;
  rline = rfun;
} else {
  // Couldn't find function stab!  Maybe we're in an assembly
  // file.  Search the whole file for the line number.
  info->eip_fn_addr = addr;
  lline = lfile;
  rline = rfile;
}
// Ignore stuff after the colon.
info->eip_fn_namelen = strfind(info->eip_fn_name, ':') - info->eip_fn_name;

// Entries in the STABS table are formatted as follows.
struct Stab {
    uint32_t n_strx;        // index into string table of name
    uint8_t n_type;         // type of symbol
    uint8_t n_other;        // misc info (usually empty)
    uint16_t n_desc;        // description field
    uintptr_t n_value;        // value of symbol --> 这里就是指地址。
};

root@debug:~/6.828/lab# git diff
diff --git a/kern/kdebug.c b/kern/kdebug.c
index 9547143..f85b570 100644
--- a/kern/kdebug.c
+++ b/kern/kdebug.c
@@ -180,6 +180,25 @@ debuginfo_eip(uintptr_t addr, struct Eipdebuginfo *info)
        //      which one.
        // Your code here.
+  int olline = lline, orline = rline;
+  stab_binsearch(stabs, &olline, &orline, N_SOL, (!(lline == lfile && rline == rfile))*addr + info->eip_fn_addr);
+  // 如果没有找到N_SOL
+  if (olline > orline) {
+    stab_binsearch(stabs, &lline, &rline, N_SLINE, addr);
+    // 如果在N_SLINE也没有找到
+    if (lline > rline) {
+       return -1;
+    }
+  }
+  // 记录找到的行号
+  info->eip_line = stabs[lline].n_desc;
+
        // Search backwards from the line number for the relevant filename
        // stab.
diff --git a/kern/monitor.c b/kern/monitor.c
index e137e92..a0f188d 100644
--- a/kern/monitor.c
+++ b/kern/monitor.c
@@ -24,6 +24,7 @@ struct Command {
 static struct Command commands[] = {
        { "help", "Display this list of commands", mon_help },
        { "kerninfo", "Display information about the kernel", mon_kerninfo },
+  { "backtrace", "Display backtrace info", mon_backtrace },
 };
 /***** Implementations of basic kernel monitor commands *****/
@@ -58,6 +59,30 @@ int
 mon_backtrace(int argc, char **argv, struct Trapframe *tf)
 {
        // Your code here.
+  uint32_t ebp = read_ebp();
+  uint32_t eip = 0;
+  struct Eipdebuginfo info;
+  #define TO_INT(x)  *((uint32_t*)(x))
+  while (ebp) {
+    eip = TO_INT((ebp+4));
+    cprintf("ebp %08x  eip %08x  args %08x %08x %08x %08x %08x\n",
+            ebp,                /*ebp*/
+            eip,                /*eip*/
+            TO_INT((ebp+8)),    /*arg1*/
+            TO_INT((ebp+12)),   /*arg2*/
+            TO_INT((ebp+16)),   /*arg3*/
+            TO_INT((ebp+20)),   /*arg4*/
+            TO_INT((ebp+24)));  /*arg5*/
+
+    if(!debuginfo_eip(eip, &info)) {
+      cprintf("%s:%d: %.*s+%d\n",
+              info.eip_file,
+              info.eip_line,
+              info.eip_fn_namelen, info.eip_fn_name,
+              eip - info.eip_fn_addr);
+    }
+    ebp = TO_INT(ebp);
+  }
        return 0;
 }
diff --git a/lib/printfmt.c b/lib/printfmt.c
index 28e01c9..1d3a5fa 100644
--- a/lib/printfmt.c
+++ b/lib/printfmt.c
@@ -206,10 +206,13 @@ vprintfmt(void (*putch)(int, void*), void *putdat, const char *fmt, va_list ap)
                // (unsigned) octal
                case 'o':
                        // Replace this with your code.
-                       putch('X', putdat);
-                       putch('X', putdat);
-                       putch('X', putdat);
-                       break;
+                       num = getint(&ap, lflag);
+                       if ((long long) num < 0) {
+                               putch('-', putdat);
+                               num = -(long long) num;
+                       }
+                       base = 8;
+                       goto number;
                // pointer
                case 'p':

// 注意前面的处理：如果是能够找到相应的函数定义，那么
// addr -= info->eip_fn_addr;
/*
468    FUN    0      0      f0100690 3954   mon_backtrace:F(0,1)
472    SLINE  0      60     00000000 0
473    SLINE  0      80     00000007 0
474    SOL    0      0      f01006a3 2929   ./inc/x86.h
475    SLINE  0      214    00000013 0  <-- 这一行是在x86.h里面的read_ebp()
476    SOL    0      0      f01006a5 3661   kern/monitor.c
477    SLINE  0      82     00000015 0
478    SLINE  0      84     00000017 0
479    SLINE  0      85     00000051 0
480    SLINE  0      82     00000053 0
481    SLINE  0      88     00000057 0
483    LBRAC  0      0      00000000 0      // 左花括号
484    RBRAC  0      0      00000062 0      // 左花括号
*/
// 是不是应该先找一下SOL?
/*
if (lline == lfile && rline == rfile) {
    // 如果没有找到函数，那么addr就没有被减过
    stab_binsearch(stabs, &lline, &rline, N_SOL, info->eip_fn_addr);
} else {
    // 如果找到过函数，那么addr就被减过了
    stab_binsearch(stabs, &lline, &rline, N_SOL, addr += info->eip_fn_addr);
}这段代码可以简化成如下代码