Linux内核分析之六——进程的描述与进程的创建

作者：姚开健

原创作品转载请注明出处

《Linux内核分析》MOOC课程http://mooc.study.163.com/course/USTC-1000029000

进程的描述

Linux系统的进程由一个进程描述符PCB，即task_struct结构体来描述，其在内核中代码实现如下：

struct task_struct {
1236 volatile long state; /* -1 unrunnable, 0 runnable, >0 stopped */
1237 void *stack;
1238 atomic_t usage;
1239 unsigned int flags; /* per process flags, defined below */
1240 unsigned int ptrace;
1241
1242#ifdef CONFIG_SMP
1243 struct llist_node wake_entry;
1244 int on_cpu;
1245 struct task_struct *last_wakee;
1246 unsigned long wakee_flips;
1247 unsigned long wakee_flip_decay_ts;
1248
1249 int wake_cpu;
1250#endif
1251 int on_rq;
1252
1253 int prio, static_prio, normal_prio;
1254 unsigned int rt_priority;
1255 const struct sched_class *sched_class;
1256 struct sched_entity se;
1257 struct sched_rt_entity rt;
1258#ifdef CONFIG_CGROUP_SCHED
1259 struct task_group *sched_task_group;
1260#endif
1261 struct sched_dl_entity dl;
1262
1263#ifdef CONFIG_PREEMPT_NOTIFIERS
1264 /* list of struct preempt_notifier: */
1265 struct hlist_head preempt_notifiers;
1266#endif
1267
1268#ifdef CONFIG_BLK_DEV_IO_TRACE
1269 unsigned int btrace_seq;
1270#endif
1271
1272 unsigned int policy;
1273 int nr_cpus_allowed;
1274 cpumask_t cpus_allowed;
1275
1276#ifdef CONFIG_PREEMPT_RCU
1277 int rcu_read_lock_nesting;
1278 union rcu_special rcu_read_unlock_special;
1279 struct list_head rcu_node_entry;
1280#endif /* #ifdef CONFIG_PREEMPT_RCU */
1281#ifdef CONFIG_TREE_PREEMPT_RCU
1282 struct rcu_node *rcu_blocked_node;
1283#endif /* #ifdef CONFIG_TREE_PREEMPT_RCU */
1284#ifdef CONFIG_TASKS_RCU
1285 unsigned long rcu_tasks_nvcsw;
1286 bool rcu_tasks_holdout;
1287 struct list_head rcu_tasks_holdout_list;
1288 int rcu_tasks_idle_cpu;
1289#endif /* #ifdef CONFIG_TASKS_RCU */
1290
1291#if defined(CONFIG_SCHEDSTATS) || defined(CONFIG_TASK_DELAY_ACCT)
1292 struct sched_info sched_info;
1293#endif
1294
1295 struct list_head tasks;
1296#ifdef CONFIG_SMP
1297 struct plist_node pushable_tasks;
1298 struct rb_node pushable_dl_tasks;
1299#endif
1300
1301 struct mm_struct *mm, *active_mm;
1302#ifdef CONFIG_COMPAT_BRK
1303 unsigned brk_randomized:1;
1304#endif
1305 /* per-thread vma caching */
1306 u32 vmacache_seqnum;
1307 struct vm_area_struct *vmacache[VMACACHE_SIZE];
1308#if defined(SPLIT_RSS_COUNTING)
1309 struct task_rss_stat rss_stat;
1310#endif
1311/* task state */
1312 int exit_state;
1313 int exit_code, exit_signal;
1314 int pdeath_signal; /* The signal sent when the parent dies */
1315 unsigned int jobctl; /* JOBCTL_*, siglock protected */
1316
1317 /* Used for emulating ABI behavior of previous Linux versions */
1318 unsigned int personality;
1319
1320 unsigned in_execve:1; /* Tell the LSMs that the process is doing an
1321 * execve */
1322 unsigned in_iowait:1;
1323
1324 /* Revert to default priority/policy when forking */
1325 unsigned sched_reset_on_fork:1;
1326 unsigned sched_contributes_to_load:1;
1327
1328 unsigned long atomic_flags; /* Flags needing atomic access. */
1329
1330 pid_t pid;
1331 pid_t tgid;
1332
1333#ifdef CONFIG_CC_STACKPROTECTOR
1334 /* Canary value for the -fstack-protector gcc feature */
1335 unsigned long stack_canary;
1336#endif
1337 /*
1338 * pointers to (original) parent process, youngest child, younger sibling,
1339 * older sibling, respectively. (p->father can be replaced with
1340 * p->real_parent->pid)
1341 */
1342 struct task_struct __rcu *real_parent; /* real parent process */
1343 struct task_struct __rcu *parent; /* recipient of SIGCHLD, wait4() reports */
1344 /*
1345 * children/sibling forms the list of my natural children
1346 */
1347 struct list_head children; /* list of my children */
1348 struct list_head sibling; /* linkage in my parent's children list */
1349 struct task_struct *group_leader; /* threadgroup leader */
1350
1351 /*
1352 * ptraced is the list of tasks this task is using ptrace on.
1353 * This includes both natural children and PTRACE_ATTACH targets.
1354 * p->ptrace_entry is p's link on the p->parent->ptraced list.
1355 */
1356 struct list_head ptraced;
1357 struct list_head ptrace_entry;
1358
1359 /* PID/PID hash table linkage. */
1360 struct pid_link pids[PIDTYPE_MAX];
1361 struct list_head thread_group;
1362 struct list_head thread_node;
1363
1364 struct completion *vfork_done; /* for vfork() */
1365 int __user *set_child_tid; /* CLONE_CHILD_SETTID */
1366 int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
1367
1368 cputime_t utime, stime, utimescaled, stimescaled;
1369 cputime_t gtime;
1370#ifndef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE
1371 struct cputime prev_cputime;
1372#endif
1373#ifdef CONFIG_VIRT_CPU_ACCOUNTING_GEN
1374 seqlock_t vtime_seqlock;
1375 unsigned long long vtime_snap;
1376 enum {
1377 VTIME_SLEEPING = 0,
1378 VTIME_USER,
1379 VTIME_SYS,
1380 } vtime_snap_whence;
1381#endif
1382 unsigned long nvcsw, nivcsw; /* context switch counts */
1383 u64 start_time; /* monotonic time in nsec */
1384 u64 real_start_time; /* boot based time in nsec */
1385/* mm fault and swap info: this can arguably be seen as either mm-specific or thread-specific */
1386 unsigned long min_flt, maj_flt;
1387
1388 struct task_cputime cputime_expires;
1389 struct list_head cpu_timers[3];
1390
1391/* process credentials */
1392 const struct cred __rcu *real_cred; /* objective and real subjective task
1393 * credentials (COW) */
1394 const struct cred __rcu *cred; /* effective (overridable) subjective task
1395 * credentials (COW) */
1396 char comm[TASK_COMM_LEN]; /* executable name excluding path
1397 - access with [gs]et_task_comm (which lock
1398 it with task_lock())
1399 - initialized normally by setup_new_exec */
1400/* file system info */
1401 int link_count, total_link_count;
1402#ifdef CONFIG_SYSVIPC
1403/* ipc stuff */
1404 struct sysv_sem sysvsem;
1405 struct sysv_shm sysvshm;
1406#endif
1407#ifdef CONFIG_DETECT_HUNG_TASK
1408/* hung task detection */
1409 unsigned long last_switch_count;
1410#endif
1411/* CPU-specific state of this task */
1412 struct thread_struct thread;
1413/* filesystem information */
1414 struct fs_struct *fs;
1415/* open file information */
1416 struct files_struct *files;
1417/* namespaces */
1418 struct nsproxy *nsproxy;
1419/* signal handlers */
1420 struct signal_struct *signal;
1421 struct sighand_struct *sighand;
1422
1423 sigset_t blocked, real_blocked;
1424 sigset_t saved_sigmask; /* restored if set_restore_sigmask() was used */
1425 struct sigpending pending;
1426
1427 unsigned long sas_ss_sp;
1428 size_t sas_ss_size;
1429 int (*notifier)(void *priv);
1430 void *notifier_data;
1431 sigset_t *notifier_mask;
1432 struct callback_head *task_works;
1433
1434 struct audit_context *audit_context;
1435#ifdef CONFIG_AUDITSYSCALL
1436 kuid_t loginuid;
1437 unsigned int sessionid;
1438#endif
1439 struct seccomp seccomp;
1440
1441/* Thread group tracking */
1442 u32 parent_exec_id;
1443 u32 self_exec_id;
1444/* Protection of (de-)allocation: mm, files, fs, tty, keyrings, mems_allowed,
1445 * mempolicy */
1446 spinlock_t alloc_lock;
1447
1448 /* Protection of the PI data structures: */
1449 raw_spinlock_t pi_lock;
1450
1451#ifdef CONFIG_RT_MUTEXES
1452 /* PI waiters blocked on a rt_mutex held by this task */
1453 struct rb_root pi_waiters;
1454 struct rb_node *pi_waiters_leftmost;
1455 /* Deadlock detection and priority inheritance handling */
1456 struct rt_mutex_waiter *pi_blocked_on;
1457#endif
1458
1459#ifdef CONFIG_DEBUG_MUTEXES
1460 /* mutex deadlock detection */
1461 struct mutex_waiter *blocked_on;
1462#endif
1463#ifdef CONFIG_TRACE_IRQFLAGS
1464 unsigned int irq_events;
1465 unsigned long hardirq_enable_ip;
1466 unsigned long hardirq_disable_ip;
1467 unsigned int hardirq_enable_event;
1468 unsigned int hardirq_disable_event;
1469 int hardirqs_enabled;
1470 int hardirq_context;
1471 unsigned long softirq_disable_ip;
1472 unsigned long softirq_enable_ip;
1473 unsigned int softirq_disable_event;
1474 unsigned int softirq_enable_event;
1475 int softirqs_enabled;
1476 int softirq_context;
1477#endif
1478#ifdef CONFIG_LOCKDEP
1479# define MAX_LOCK_DEPTH 48UL
1480 u64 curr_chain_key;
1481 int lockdep_depth;
1482 unsigned int lockdep_recursion;
1483 struct held_lock held_locks[MAX_LOCK_DEPTH];
1484 gfp_t lockdep_reclaim_gfp;
1485#endif
1486
1487/* journalling filesystem info */
1488 void *journal_info;
1489
1490/* stacked block device info */
1491 struct bio_list *bio_list;
1492
1493#ifdef CONFIG_BLOCK
1494/* stack plugging */
1495 struct blk_plug *plug;
1496#endif
1497
1498/* VM state */
1499 struct reclaim_state *reclaim_state;
1500
1501 struct backing_dev_info *backing_dev_info;
1502
1503 struct io_context *io_context;
1504
1505 unsigned long ptrace_message;
1506 siginfo_t *last_siginfo; /* For ptrace use. */
1507 struct task_io_accounting ioac;
1508#if defined(CONFIG_TASK_XACCT)
1509 u64 acct_rss_mem1; /* accumulated rss usage */
1510 u64 acct_vm_mem1; /* accumulated virtual memory usage */
1511 cputime_t acct_timexpd; /* stime + utime since last update */
1512#endif
1513#ifdef CONFIG_CPUSETS
1514 nodemask_t mems_allowed; /* Protected by alloc_l
db62
ock */
1515 seqcount_t mems_allowed_seq; /* Seqence no to catch updates */
1516 int cpuset_mem_spread_rotor;
1517 int cpuset_slab_spread_rotor;
1518#endif
1519#ifdef CONFIG_CGROUPS
1520 /* Control Group info protected by css_set_lock */
1521 struct css_set __rcu *cgroups;
1522 /* cg_list protected by css_set_lock and tsk->alloc_lock */
1523 struct list_head cg_list;
1524#endif
1525#ifdef CONFIG_FUTEX
1526 struct robust_list_head __user *robust_list;
1527#ifdef CONFIG_COMPAT
1528 struct compat_robust_list_head __user *compat_robust_list;
1529#endif
1530 struct list_head pi_state_list;
1531 struct futex_pi_state *pi_state_cache;
1532#endif
1533#ifdef CONFIG_PERF_EVENTS
1534 struct perf_event_context *perf_event_ctxp[perf_nr_task_contexts];
1535 struct mutex perf_event_mutex;
1536 struct list_head perf_event_list;
1537#endif
1538#ifdef CONFIG_DEBUG_PREEMPT
1539 unsigned long preempt_disable_ip;
1540#endif
1541#ifdef CONFIG_NUMA
1542 struct mempolicy *mempolicy; /* Protected by alloc_lock */
1543 short il_next;
1544 short pref_node_fork;
1545#endif
1546#ifdef CONFIG_NUMA_BALANCING
1547 int numa_scan_seq;
1548 unsigned int numa_scan_period;
1549 unsigned int numa_scan_period_max;
1550 int numa_preferred_nid;
1551 unsigned long numa_migrate_retry;
1552 u64 node_stamp; /* migration stamp */
1553 u64 last_task_numa_placement;
1554 u64 last_sum_exec_runtime;
1555 struct callback_head numa_work;
1556
1557 struct list_head numa_entry;
1558 struct numa_group *numa_group;
1559
1560 /*
1561 * Exponential decaying average of faults on a per-node basis.
1562 * Scheduling placement decisions are made based on the these counts.
1563 * The values remain static for the duration of a PTE scan
1564 */
1565 unsigned long *numa_faults_memory;
1566 unsigned long total_numa_faults;
1567
1568 /*
1569 * numa_faults_buffer records faults per node during the current
1570 * scan window. When the scan completes, the counts in
1571 * numa_faults_memory decay and these values are copied.
1572 */
1573 unsigned long *numa_faults_buffer_memory;
1574
1575 /*
1576 * Track the nodes the process was running on when a NUMA hinting
1577 * fault was incurred.
1578 */
1579 unsigned long *numa_faults_cpu;
1580 unsigned long *numa_faults_buffer_cpu;
1581
1582 /*
1583 * numa_faults_locality tracks if faults recorded during the last
1584 * scan window were remote/local. The task scan period is adapted
1585 * based on the locality of the faults with different weights
1586 * depending on whether they were shared or private faults
1587 */
1588 unsigned long numa_faults_locality[2];
1589
1590 unsigned long numa_pages_migrated;
1591#endif /* CONFIG_NUMA_BALANCING */
1592
1593 struct rcu_head rcu;
1594
1595 /*
1596 * cache last used pipe for splice
1597 */
1598 struct pipe_inode_info *splice_pipe;
1599
1600 struct page_frag task_frag;
1601
1602#ifdef CONFIG_TASK_DELAY_ACCT
1603 struct task_delay_info *delays;
1604#endif
1605#ifdef CONFIG_FAULT_INJECTION
1606 int make_it_fail;
1607#endif
1608 /*
1609 * when (nr_dirtied >= nr_dirtied_pause), it's time to call
1610 * balance_dirty_pages() for some dirty throttling pause
1611 */
1612 int nr_dirtied;
1613 int nr_dirtied_pause;
1614 unsigned long dirty_paused_when; /* start of a write-and-pause period */
1615
1616#ifdef CONFIG_LATENCYTOP
1617 int latency_record_count;
1618 struct latency_record latency_record[LT_SAVECOUNT];
1619#endif
1620 /*
1621 * time slack values; these are used to round up poll() and
1622 * select() etc timeout values. These are in nanoseconds.
1623 */
1624 unsigned long timer_slack_ns;
1625 unsigned long default_timer_slack_ns;
1626
1627#ifdef CONFIG_FUNCTION_GRAPH_TRACER
1628 /* Index of current stored address in ret_stack */
1629 int curr_ret_stack;
1630 /* Stack of return addresses for return function tracing */
1631 struct ftrace_ret_stack *ret_stack;
1632 /* time stamp for last schedule */
1633 unsigned long long ftrace_timestamp;
1634 /*
1635 * Number of functions that haven't been traced
1636 * because of depth overrun.
1637 */
1638 atomic_t trace_overrun;
1639 /* Pause for the tracing */
1640 atomic_t tracing_graph_pause;
1641#endif
1642#ifdef CONFIG_TRACING
1643 /* state flags for use by tracers */
1644 unsigned long trace;
1645 /* bitmask and counter of trace recursion */
1646 unsigned long trace_recursion;
1647#endif /* CONFIG_TRACING */
1648#ifdef CONFIG_MEMCG /* memcg uses this to do batch job */
1649 unsigned int memcg_kmem_skip_account;
1650 struct memcg_oom_info {
1651 struct mem_cgroup *memcg;
1652 gfp_t gfp_mask;
1653 int order;
1654 unsigned int may_oom:1;
1655 } memcg_oom;
1656#endif
1657#ifdef CONFIG_UPROBES
1658 struct uprobe_task *utask;
1659#endif
1660#if defined(CONFIG_BCACHE) || defined(CONFIG_BCACHE_MODULE)
1661 unsigned int sequential_io;
1662 unsigned int sequential_io_avg;
1663#endif
1664};代码很长，这里不一一分析其结构，可参考网上的其他相关文章。我们可以从代码知道一般的进程信息包括进程状态，进程调度信息，进程标识符，进程通信有关信息，进程链接信息，时间和定时器信息，文件系统信息，虚拟内存信息，页面管理信息，对称处理机信息，和处理器相关的上下文信息等。如下图简略图所示：

进程的创建

当说明了进程的描述之后，来分析一下进程的创建过程。

创建进程的系统调用有fork（），vfork（）和clone（）这三个。fork和vfork的区别在于fork需要拷贝父进程的内核数据空间，而vfork在exec与exit之前与父进程共用数据空间，fork创建了子进程后不限定父进程与子进程的执行顺序，而vfork需要在子进程exec与exit之前让父进程阻塞，子进程先执行。clone只要是对简单的进程进行创建。三个系统调用都是调用do_fork()来进行进程的创建。

long do_fork(unsigned long clone_flags,
unsigned long stack_start,
unsigned long stack_size,
int __user *parent_tidptr,
int __user *child_tidptr)
{

...

p = copy_process(clone_flags, stack_start, stack_size,
child_tidptr, NULL, trace);
...
}真正执行进程创建的是copy_process函数调用，完成子进程对父进程的PCB的复制与修改并初始化。接着执行调用dup_task_struct()为新进程创建一个内核栈

p = dup_task_struct(current);

retval = copy_thread(clone_flags,
stack_start, stack_size, p);

复制父进程堆栈的内容到子进程的堆栈中去.这其中,copy_thread()函数中的语句

p->thread.ip = (unsigned long) ret_from_fork;

决定了新进程的第一条指令地址

static struct task_struct *dup_task_struct(struct task_struct *orig)
{
struct task_struct *tsk;
struct thread_info *ti;
int node = tsk_fork_get_node(orig);
int err;

tsk = alloc_task_struct_node(node);
if (!tsk)
return NULL;

ti = alloc_thread_info_node(tsk, node);
if (!ti)
goto free_tsk;

err = arch_dup_task_struct(tsk, orig);
if (err)
goto free_ti;

tsk->stack = ti;
# ifdef CONFIG_SECCOMP

tsk->seccomp.filter = NULL;
# endif

setup_thread_stack(tsk, orig);
clear_user_return_notifier(tsk);
clear_tsk_need_resched(tsk);
set_task_stack_end_magic(tsk);

# ifdef CONFIG_CC_STACKPROTECTOR
tsk->stack_canary = get_random_int();
# endif

atomic_set(&tsk->usage, 2);
# ifdef CONFIG_BLK_DEV_IO_TRACE
tsk->btrace_seq = 0;
# endif
tsk->splice_pipe = NULL;
tsk->task_frag.page = NULL;

account_kernel_stack(ti, 1);

return tsk;

free_ti:
free_thread_info(ti);
free_tsk:
free_task_struct(tsk);
return NULL;
}

新进程的PCB和内核堆栈在分配的页表中的分布地址如下所示：

        

task_struct结构体是按page分配的，多余的部分作为该进程的内核堆栈，从底向task_struct延伸。

新进程的执行

在之前的函数分析已经说明了新进程的堆栈ip指针初始化为ret_from_fork，这是一个汇编程序

在之前的分析中,谈到copy_process中的copy_thread()函数,正是这个函数决定了子进程从系统调用中返回后的执行.

int copy_thread(unsigned long clone_flags, unsigned long sp,
unsigned long arg, struct task_struct *p)
{
...

*childregs = *current_pt_regs();
childregs->ax = 0;
if (sp)
childregs->sp = sp;

p->thread.ip = (unsigned long) ret_from_fork;

...
}

ENTRY(ret_from_fork)
CFI_STARTPROC
pushl_cfi %eax
call schedule_tail
GET_THREAD_INFO(%ebp)
popl_cfi %eax
pushl_cfi $0x0202 # Reset kernel eflags
popfl_cfi
jmp syscall_exit
CFI_ENDPROC
END(ret_from_fork)

上述的ret_from_fork就是新进程的执行点。

新进程的内核堆栈初始为父进程的保存现场SAVE_ALL的堆栈数据，所以新进程执行ret_from_fork后有一个RESTORE_ALL，把内核堆栈的数据恢复之后就可以离开内核态进入到用户态执行。

总结

1、Linux内核创建一个新进程时有三个系统调用fork（）,vfork（）,clone（）fork和vfork的区别上面已分析。他们之间都是通过do_fork（）来创建进程。
2、创建进程往往把父进程的PCB拷贝给子进程，然后再拷贝内核堆栈，子进程需要对其修改并初始化，这样才能是一个可以运行的进程。通常实现的时候是写时复制，就是当子进程需要用到一些数据结构时，才创建一个新的数据结构给它。
3、新进程的执行点是ret_from_fork，恢复堆栈数据后就可以离开内核返回到用户态执行。