作者：王鶴樓
原創作品轉載請注明出處 《Linux內核分析》MOOC課程
http://mooc.study.163.com/course/USTC-1000029000

操作系統的三大功能

進程管理
內存管理
文件系統

task_struct

用來描寫敘述進程的數據結構，能夠理解為進程的屬性。

進程狀態、進程調度信息、各種標識符、進程通信有關信息、時間和定時器信息、進程鏈接信息、文件系統信息、虛擬內存信息、頁面管理信息、對稱多處理器和處理器相關的環境等，該數據結構被定義為task_struct

進程控制塊 PCB

是操作系統核心中一種數據結構，主要表示進程狀態。

進程狀態

在實驗樓里進行例如以下操作，因為進行到一半環境太卡，沒有充分截圖
運行操作：
rm -rf menu
然后克隆一份新的代碼：
git clone https://github.com/mengning/menu.git
cd menu
mv fork_test.c test.c
make rootfs
出現菜單后運行fork命令，能夠看出信息打印，已經創建了子進程

qemu -kernel linux-3.18.6/arch/x86/boot/bzImage -initrd rootfs.img -s -S

gdb
target remote:1234
file linux-3.18.6/vmlinux
b sys_clone
b do_fork
b dup_task_struct
b copy_process
b copy_thread
b ret_from_fork
c //開始運行

fork函數

調用一次返回兩次，父進程中返加子進程的pid,子進程中返回0

//fork #ifdef __ARCH_WANT_SYS_FORK SYSCALL_DEFINE0(fork) { #ifdef CONFIG_MMUreturn do_fork(SIGCHLD, 0, 0, NULL, NULL); #else/* can not support in nommu mode */return -EINVAL; #endif } #endif//vfork #ifdef __ARCH_WANT_SYS_VFORK SYSCALL_DEFINE0(vfork) {return do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD, 0,0, NULL, NULL); } #endif//clone #ifdef __ARCH_WANT_SYS_CLONE #ifdef CONFIG_CLONE_BACKWARDS SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp,int __user *, parent_tidptr,int, tls_val,int __user *, child_tidptr) #elif defined(CONFIG_CLONE_BACKWARDS2) SYSCALL_DEFINE5(clone, unsigned long, newsp, unsigned long, clone_flags,int __user *, parent_tidptr,int __user *, child_tidptr,int, tls_val) #elif defined(CONFIG_CLONE_BACKWARDS3) SYSCALL_DEFINE6(clone, unsigned long, clone_flags, unsigned long, newsp,int, stack_size,int __user *, parent_tidptr,int __user *, child_tidptr,int, tls_val) #else SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp,int __user *, parent_tidptr,int __user *, child_tidptr,int, tls_val) #endif {return do_fork(clone_flags, newsp, 0, parent_tidptr, child_tidptr); } #endif

從以上代碼中能夠看出fork,vfork,clone終于都是調用 do_fork來創建新進程

do_fork

long do_fork(unsigned long clone_flags,unsigned long stack_start,unsigned long stack_size,int __user *parent_tidptr,int __user *child_tidptr) {//創建進程描寫敘述符指針struct task_struct *p;//……//復制進程描寫敘述符。copy_process()的返回值是一個 task_struct 指針。p = copy_process(clone_flags, stack_start, stack_size,child_tidptr, NULL, trace);if (!IS_ERR(p)) {struct completion vfork;struct pid *pid;trace_sched_process_fork(current, p);//得到新創建的進程描寫敘述符中的pidpid = get_task_pid(p, PIDTYPE_PID);nr = pid_vnr(pid);if (clone_flags & CLONE_PARENT_SETTID)put_user(nr, parent_tidptr);//假設調用的 vfork()方法，初始化 vfork 完畢處理信息。if (clone_flags & CLONE_VFORK) {p->vfork_done = &vfork;init_completion(&vfork);get_task_struct(p);}//將子進程增加到調度器中，為其分配 CPU，準備運行wake_up_new_task(p);//fork 完畢，子進程即將開始運行if (unlikely(trace))ptrace_event_pid(trace, pid);//假設是 vfork，將父進程增加至等待隊列，等待子進程完畢if (clone_flags & CLONE_VFORK) {if (!wait_for_vfork_done(p, &vfork))ptrace_event_pid(PTRACE_EVENT_VFORK_DONE, pid);}put_pid(pid);} else {nr = PTR_ERR(p);}return nr; }

do_fork 流程

調用 copy_process 為子進程復制出一份進程信息
假設是 vfork 初始化完畢處理信息
調用 wake_up_new_task 將子進程增加調度器。為之分配 CPU
假設是 vfork，父進程等待子進程完畢 exec 替換自己的地址空間

進入到copy_process函數

static struct task_struct *copy_process(unsigned long clone_flags,unsigned long stack_start,unsigned long stack_size,int __user *child_tidptr,struct pid *pid,int trace) {int retval;//創建進程描寫敘述符指針struct task_struct *p;if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))return ERR_PTR(-EINVAL);if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))return ERR_PTR(-EINVAL);/** Thread groups must share signals as well, and detached threads* can only be started up within the thread group.*/if ((clone_flags & CLONE_THREAD) && !(clone_flags & CLONE_SIGHAND))return ERR_PTR(-EINVAL);/** Shared signal handlers imply shared VM. By way of the above,* thread groups also imply shared VM. Blocking this case allows* for various simplifications in other code.*/if ((clone_flags & CLONE_SIGHAND) && !(clone_flags & CLONE_VM))return ERR_PTR(-EINVAL);/** Siblings of global init remain as zombies on exit since they are* not reaped by their parent (swapper). To solve this and to avoid* multi-rooted process trees, prevent global and container-inits* from creating siblings.*/if ((clone_flags & CLONE_PARENT) &&current->signal->flags & SIGNAL_UNKILLABLE)return ERR_PTR(-EINVAL);/** If the new process will be in a different pid namespace* don't allow the creation of threads.*/if ((clone_flags & (CLONE_VM|CLONE_NEWPID)) &&(task_active_pid_ns(current) != current->nsproxy->pid_ns))return ERR_PTR(-EINVAL);retval = security_task_create(clone_flags);if (retval)goto fork_out;retval = -ENOMEM;//復制當前的 task_structp = dup_task_struct(current);if (!p)goto fork_out;ftrace_graph_init_task(p);get_seccomp_filter(p);//初始化相互排斥變量 rt_mutex_init_task(p);#ifdef CONFIG_PROVE_LOCKINGDEBUG_LOCKS_WARN_ON(!p->hardirqs_enabled);DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled); #endifretval = -EAGAIN;//檢查進程數是否超過限制。由操作系統定義if (atomic_read(&p->real_cred->user->processes) >=task_rlimit(p, RLIMIT_NPROC)) {if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&p->real_cred->user != INIT_USER)goto bad_fork_free;}current->flags &= ~PF_NPROC_EXCEEDED;retval = copy_creds(p, clone_flags);if (retval < 0)goto bad_fork_free;/** If multiple threads are within copy_process(), then this check* triggers too late. This doesn't hurt, the check is only there* to stop root fork bombs.*/retval = -EAGAIN;//檢查進程數是否超過 max_threads 由內存大小決定if (nr_threads >= max_threads)goto bad_fork_cleanup_count;if (!try_module_get(task_thread_info(p)->exec_domain->module))goto bad_fork_cleanup_count;p->did_exec = 0;delayacct_tsk_init(p); /* Must remain after dup_task_struct() */copy_flags(clone_flags, p);INIT_LIST_HEAD(&p->children);INIT_LIST_HEAD(&p->sibling);rcu_copy_process(p);p->vfork_done = NULL;//初始化自旋鎖spin_lock_init(&p->alloc_lock);//初始化掛起信號init_sigpending(&p->pending);p->utime = p->stime = p->gtime = 0;p->utimescaled = p->stimescaled = 0; #ifndef CONFIG_VIRT_CPU_ACCOUNTINGp->prev_cputime.utime = p->prev_cputime.stime = 0; #endif #ifdef CONFIG_VIRT_CPU_ACCOUNTING_GENseqlock_init(&p->vtime_seqlock);p->vtime_snap = 0;p->vtime_snap_whence = VTIME_SLEEPING; #endif#if defined(SPLIT_RSS_COUNTING)memset(&p->rss_stat, 0, sizeof(p->rss_stat)); #endifp->default_timer_slack_ns = current->timer_slack_ns;task_io_accounting_init(&p->ioac);acct_clear_integrals(p);//初始化CPU定時器posix_cpu_timers_init(p);do_posix_clock_monotonic_gettime(&p->start_time);p->real_start_time = p->start_time;monotonic_to_bootbased(&p->real_start_time);p->io_context = NULL;p->audit_context = NULL;if (clone_flags & CLONE_THREAD)threadgroup_change_begin(current);cgroup_fork(p); #ifdef CONFIG_NUMAp->mempolicy = mpol_dup(p->mempolicy);if (IS_ERR(p->mempolicy)) {retval = PTR_ERR(p->mempolicy);p->mempolicy = NULL;goto bad_fork_cleanup_cgroup;}mpol_fix_fork_child_flag(p); #endif #ifdef CONFIG_CPUSETSp->cpuset_mem_spread_rotor = NUMA_NO_NODE;p->cpuset_slab_spread_rotor = NUMA_NO_NODE;seqcount_init(&p->mems_allowed_seq); #endif #ifdef CONFIG_TRACE_IRQFLAGSp->irq_events = 0;p->hardirqs_enabled = 0;p->hardirq_enable_ip = 0;p->hardirq_enable_event = 0;p->hardirq_disable_ip = _THIS_IP_;p->hardirq_disable_event = 0;p->softirqs_enabled = 1;p->softirq_enable_ip = _THIS_IP_;p->softirq_enable_event = 0;p->softirq_disable_ip = 0;p->softirq_disable_event = 0;p->hardirq_context = 0;p->softirq_context = 0; #endif #ifdef CONFIG_LOCKDEPp->lockdep_depth = 0; /* no locks held yet */p->curr_chain_key = 0;p->lockdep_recursion = 0; #endif#ifdef CONFIG_DEBUG_MUTEXESp->blocked_on = NULL; /* not blocked yet */ #endif #ifdef CONFIG_MEMCGp->memcg_batch.do_batch = 0;p->memcg_batch.memcg = NULL; #endif/* Perform scheduler related setup. Assign this task to a CPU. *///初始化進程數據結構，并把進程狀態設置為 TASK_RUNNINGsched_fork(p);retval = perf_event_init_task(p);//復制全部進程信息。包含文件系統、信號處理函數、信號、內存管理等if (retval)goto bad_fork_cleanup_policy;retval = audit_alloc(p);if (retval)goto bad_fork_cleanup_policy;/* copy all the process information */retval = copy_semundo(clone_flags, p);if (retval)goto bad_fork_cleanup_audit;retval = copy_files(clone_flags, p);if (retval)goto bad_fork_cleanup_semundo;retval = copy_fs(clone_flags, p);if (retval)goto bad_fork_cleanup_files;retval = copy_sighand(clone_flags, p);if (retval)goto bad_fork_cleanup_fs;retval = copy_signal(clone_flags, p);if (retval)goto bad_fork_cleanup_sighand;retval = copy_mm(clone_flags, p);if (retval)goto bad_fork_cleanup_signal;retval = copy_namespaces(clone_flags, p);if (retval)goto bad_fork_cleanup_mm;retval = copy_io(clone_flags, p);if (retval)goto bad_fork_cleanup_namespaces;//初始化子進程內核棧retval = copy_thread(clone_flags, stack_start, stack_size, p);if (retval)goto bad_fork_cleanup_io;if (pid != &init_struct_pid) {retval = -ENOMEM;//為新進程分配新的 pidpid = alloc_pid(p->nsproxy->pid_ns);if (!pid)goto bad_fork_cleanup_io;}//設置子進程 pid p->pid = pid_nr(pid);p->tgid = p->pid;if (clone_flags & CLONE_THREAD)p->tgid = current->tgid;p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ?

child_tidptr : NULL; /* * Clear TID on mm_release()?

*/

p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL; #ifdef CONFIG_BLOCK p->plug = NULL; #endif #ifdef CONFIG_FUTEX p->robust_list = NULL; #ifdef CONFIG_COMPAT p->compat_robust_list = NULL; #endif INIT_LIST_HEAD(&p->pi_state_list); p->pi_state_cache = NULL; #endif uprobe_copy_process(p); /* * sigaltstack should be cleared when sharing the same VM */ if ((clone_flags & (CLONE_VM|CLONE_VFORK)) == CLONE_VM) p->sas_ss_sp = p->sas_ss_size = 0; /* * Syscall tracing and stepping should be turned off in the * child regardless of CLONE_PTRACE. */ user_disable_single_step(p); clear_tsk_thread_flag(p, TIF_SYSCALL_TRACE); #ifdef TIF_SYSCALL_EMU clear_tsk_thread_flag(p, TIF_SYSCALL_EMU); #endif clear_all_latency_tracing(p); /* ok, now we should be set up.. */ if (clone_flags & CLONE_THREAD) p->exit_signal = -1; else if (clone_flags & CLONE_PARENT) p->exit_signal = current->group_leader->exit_signal; else p->exit_signal = (clone_flags & CSIGNAL); p->pdeath_signal = 0; p->exit_state = 0; p->nr_dirtied = 0; p->nr_dirtied_pause = 128 >> (PAGE_SHIFT - 10); p->dirty_paused_when = 0; /* * Ok, make it visible to the rest of the system. * We dont wake it up yet. */ p->group_leader = p; INIT_LIST_HEAD(&p->thread_group); p->task_works = NULL; /* Need tasklist lock for parent etc handling! */ write_lock_irq(&tasklist_lock); /* CLONE_PARENT re-uses the old parent */ if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) { p->real_parent = current->real_parent; p->parent_exec_id = current->parent_exec_id; } else { p->real_parent = current; p->parent_exec_id = current->self_exec_id; } spin_lock(&current->sighand->siglock); /* * Process group and session signals need to be delivered to just the * parent before the fork or both the parent and the child after the * fork. Restart if a signal comes in before we add the new process to * it's process group. * A fatal signal pending means that current will exit, so the new * thread can't slip out of an OOM kill (or normal SIGKILL). */ recalc_sigpending(); if (signal_pending(current)) { spin_unlock(&current->sighand->siglock); write_unlock_irq(&tasklist_lock); retval = -ERESTARTNOINTR; goto bad_fork_free_pid; } if (clone_flags & CLONE_THREAD) { current->signal->nr_threads++; atomic_inc(&current->signal->live); atomic_inc(&current->signal->sigcnt); p->group_leader = current->group_leader; list_add_tail_rcu(&p->thread_group, &p->group_leader->thread_group); } if (likely(p->pid)) { ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace); if (thread_group_leader(p)) { if (is_child_reaper(pid)) { ns_of_pid(pid)->child_reaper = p; p->signal->flags |= SIGNAL_UNKILLABLE; } p->signal->leader_pid = pid; p->signal->tty = tty_kref_get(current->signal->tty); attach_pid(p, PIDTYPE_PGID, task_pgrp(current)); attach_pid(p, PIDTYPE_SID, task_session(current)); list_add_tail(&p->sibling, &p->real_parent->children); list_add_tail_rcu(&p->tasks, &init_task.tasks); __this_cpu_inc(process_counts); } attach_pid(p, PIDTYPE_PID, pid); nr_threads++; } total_forks++; spin_unlock(&current->sighand->siglock); write_unlock_irq(&tasklist_lock); proc_fork_connector(p); cgroup_post_fork(p); if (clone_flags & CLONE_THREAD) threadgroup_change_end(current); perf_event_fork(p); trace_task_newtask(p, clone_flags); return p; bad_fork_free_pid: if (pid != &init_struct_pid) free_pid(pid); bad_fork_cleanup_io: if (p->io_context) exit_io_context(p); bad_fork_cleanup_namespaces: exit_task_namespaces(p); bad_fork_cleanup_mm: if (p->mm) mmput(p->mm); bad_fork_cleanup_signal: if (!(clone_flags & CLONE_THREAD)) free_signal_struct(p->signal); bad_fork_cleanup_sighand: __cleanup_sighand(p->sighand); bad_fork_cleanup_fs: exit_fs(p); /* blocking */ bad_fork_cleanup_files: exit_files(p); /* blocking */ bad_fork_cleanup_semundo: exit_sem(p); bad_fork_cleanup_audit: audit_free(p); bad_fork_cleanup_policy: perf_event_free_task(p); #ifdef CONFIG_NUMA mpol_put(p->mempolicy); bad_fork_cleanup_cgroup: #endif if (clone_flags & CLONE_THREAD) threadgroup_change_end(current); cgroup_exit(p, 0); delayacct_tsk_free(p); module_put(task_thread_info(p)->exec_domain->module); bad_fork_cleanup_count: atomic_dec(&p->cred->user->processes); exit_creds(p); bad_fork_free: free_task(p); fork_out: return ERR_PTR(retval); }

copy_thread函數

int copy_thread(unsigned long clone_flags, unsigned long sp,unsigned long arg, struct task_struct *p) {//獲取寄存器信息struct pt_regs *childregs = task_pt_regs(p);struct task_struct *tsk;int err;p->thread.sp = (unsigned long) childregs;p->thread.sp0 = (unsigned long) (childregs+1);memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps));if (unlikely(p->flags & PF_KTHREAD)) {//內核線程memset(childregs, 0, sizeof(struct pt_regs));p->thread.ip = (unsigned long) ret_from_kernel_thread;task_user_gs(p) = __KERNEL_STACK_CANARY;childregs->ds = __USER_DS;childregs->es = __USER_DS;childregs->fs = __KERNEL_PERCPU;childregs->bx = sp; /* function */childregs->bp = arg;childregs->orig_ax = -1;childregs->cs = __KERNEL_CS | get_kernel_rpl();childregs->flags = X86_EFLAGS_IF | X86_EFLAGS_FIXED;p->thread.io_bitmap_ptr = NULL;return 0;}//將當前寄存器信息復制給子進程*childregs = *current_pt_regs();//子進程 eax 置 0，因此fork 在子進程返回0childregs->ax = 0;if (sp)childregs->sp = sp;//子進程ip 設置為ret_from_fork，因此子進程從ret_from_fork開始運行p->thread.ip = (unsigned long) ret_from_fork;//……return err; }

ret_from_fork

ENTRY(ret_from_fork)CFI_STARTPROCpushl_cfi %eaxcall schedule_tailGET_THREAD_INFO(%ebp)popl_cfi %eaxpushl_cfi $0x0202 # Reset kernel eflagspopfl_cfijmp syscall_exitCFI_ENDPROC END(ret_from_fork)

總結

dup_task_struct中為子進程分配了新的堆棧
調用了sched_fork。將其置為TASK_RUNNING
copy_thread中將父進程的寄存器上下文復制給子進程。保證了父子進程的堆棧信息是一致的
將ret_from_fork的地址設置為eip寄存器的值
終于子進程從ret_from_fork開始運行

總結

以上是生活随笔為你收集整理的Linux内核创建一个新进程的过程的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。