分析Linux系统的执行过程

volatile long state;

#define TASK_RUNNING		    0    //进程要么正在执行，要么正要准备执行
#define TASK_INTERRUPTIBLE	    1    //进程被阻塞（睡眠），直到某个条件变为真
#define TASK_UNINTERRUPTIBLE    2    //与TASK_INTERRUPTIBLE类似，但不能通过接受一个信号来唤醒以外
#define __TASK_STOPPED		    4    //进程被停止执行
#define __TASK_TRACED		    8    //进程被debugger等进程监视
/* in tsk->exit_state */
#define EXIT_ZOMBIE		       16    //进程的执行被终止，但是其父进程还没有使用wait()等系统调用来获知它的终止信息（僵尸模式）
#define EXIT_DEAD		       32    //进程的最终状态
/* in tsk->state again */
#define TASK_DEAD		       64    
#define TASK_WAKEKILL	      128    
#define TASK_WAKING		      256    

pid_t pid; 
pid_t tgid;    #一个线程组中的所有线程使用和该线程组的领头线程（该组中的第一个轻量级进程）相同的PID

void *stack;

static inline struct thread_info *alloc_thread_info(struct task_struct *tsk)  
{  
#ifdef CONFIG_DEBUG_STACK_USAGE  
    gfp_t mask = GFP_KERNEL | __GFP_ZERO;  
#else  
    gfp_t mask = GFP_KERNEL;  
#endif  
    return (struct thread_info *)__get_free_pages(mask, THREAD_SIZE_ORDER);  
}  
static inline void free_thread_info(struct thread_info *ti)  
{  
    free_pages((unsigned long)ti, THREAD_SIZE_ORDER);  
}

//标记
unsigned int flags; /* per process flags, defined below */    

//进程亲属关系的成员 
struct task_struct *real_parent; /* real parent process */  
struct task_struct *parent; /* recipient of SIGCHLD, wait4() reports */  
struct list_head children;  /* list of my children */  
struct list_head sibling;   /* linkage in my parent's children list */  
struct task_struct *group_leader;   /* threadgroup leader */ 

//进程调度 
int prio, static_prio, normal_prio;  
unsigned int rt_priority;  
const struct sched_class *sched_class;  
struct sched_entity se;  
struct sched_rt_entity rt;  
unsigned int policy;  
cpumask_t cpus_allowed;

//进程地址空间
    struct mm_struct *mm, *active_mm;  
#ifdef CONFIG_COMPAT_BRK  
    unsigned brk_randomized:1;  
#endif  
#if defined(SPLIT_RSS_COUNTING)  
    struct task_rss_stat    rss_stat;  
#endif 

//信号处理
/* signal handlers */  
    struct signal_struct *signal;    //指向进程的信号描述符
    struct sighand_struct *sighand;  //指向进程的信号处理程序描述符
  
    sigset_t blocked, real_blocked;  //blocked表示被阻塞信号的掩码，real_blocked表示临时掩码
    sigset_t saved_sigmask; /* restored if set_restore_sigmask() was used */  
    struct sigpending pending;       //存放私有挂起信号的数据结构
  
    unsigned long sas_ss_sp;         //信号处理程序备用堆栈的地址
    size_t sas_ss_size;              //表示堆栈的大小
    int (*notifier)(void *priv);     //指向的函数来阻塞进程的某些信号
    void *notifier_data;             //notifier所指向的函数可能使用的数据
    sigset_t *notifier_mask;         //位掩码

long do_fork(unsigned long clone_flags,
          unsigned long stack_start,
          unsigned long stack_size,
          int __user *parent_tidptr,
          int __user *child_tidptr)
{
    struct task_struct *p;
    int trace = 0;
    long nr;

    // ...

    //copy PCB and return a created task_struct point
    p = copy_process(clone_flags, stack_start, stack_size,
             child_tidptr, NULL, trace);

    if (!IS_ERR(p)) {
        struct completion vfork;
        struct pid *pid;

        trace_sched_process_fork(current, p);

        //get pid of task struct
        pid = get_task_pid(p, PIDTYPE_PID);
        nr = pid_vnr(pid);

        if (clone_flags & CLONE_PARENT_SETTID)
            put_user(nr, parent_tidptr);

        //if use vfork
        if (clone_flags & CLONE_VFORK) {
            p->vfork_done = &vfork;
            init_completion(&vfork);
            get_task_struct(p);
        }

        //add child process to queue and ready to get CPU
        wake_up_new_task(p);

        // ...

        //if set a CLONE_VFORK
        if (clone_flags & CLONE_VFORK) {
            if (!wait_for_vfork_done(p, &vfork))
                ptrace_event_pid(PTRACE_EVENT_VFORK_DONE, pid);
        }

        put_pid(pid);
    } else {
        nr = PTR_ERR(p);
    }
    return nr;
}

fork() -> sys_clone() -> do_fork() -> dup_task_struct() -> copy_process() -> copy_thread() -> ret_from_fork()

int Fork(int argc, char *argv[])
{
        int pid;
        /* fork another process */
        pid = fork();
        if (pid<0)
        {
                /* error occurred */
                fprintf(stderr,"Fork Failed!");
                exit(-1);
        }
        else if (pid==0)
        {
                /*       child process  */
        printf("This is Child Process, and my pid is %d\n", pid);
        }
        else
        {
                /*      parent process   */
        printf("This is Parent Process, and my pid is %d\n", pid);
                /* parent will wait for the child to complete*/
                wait(NULL);
                printf("Child Complete!\n");
        }
}

$ make rootfs    #重新编译

$ qemu -kernel linux-5.0.1/arch/x86/boot/bzImage -initrd rootfs.img -S -s -append nokaslr    
$ gdb vmlinux    #启动gdb调试
(gdb)b sys_clone    #设置断点
(gdb)b _do_fork
(gdb)b dup_task_struct
(gdb)b copy_process
(gdb)b copy_thread
 b ret_from_for
(gdb)target remote:1234    #设置远程链接
(gdb)c            #continue，跳到端点处
(gdb)s            #step，一步步调试

#include <stdio.h>
#include <stdlib.h>
int main()
{
        printf("test for linux...");
        return 0;
}

$ gcc -E -o test.cpp test.c -m32

$ gcc -x cpp-output -S -o test.s test.cpp -m32

$ gcc -x assembler -c test.s -o test.o -m32

$ gcc -o test test.o -m32

$ ./test

$ gcc -o test.static test.o -m32 -static

$ b do_execve

$ b schedule
$ b pick_next_task
$ b context_switch
$ b __switch_to

schedule() --> context_switch() --> switch_to --> __switch_to()

asm volatile("pushfl\n\t"      /* 保存当前进程的标志位 */   
         "pushl %%ebp\n\t"        /* 保存当前进程的堆栈基址EBP   */ 
         "movl %%esp,%[prev_sp]\n\t"  /* 保存当前栈顶ESP   */ 
         "movl %[next_sp],%%esp\n\t"  /* 把下一个进程的栈顶放到esp寄存器中，完成了内核堆栈的切换，从此往下压栈都是在next进程的内核堆栈中。   */ 
       

		 "movl $1f,%[prev_ip]\n\t"    /* 保存当前进程的EIP   */ 
         "pushl %[next_ip]\n\t"   /* 把下一个进程的起点EIP压入堆栈   */    
         __switch_canary                   
         "jmp __switch_to\n"  /* 因为是函数所以是jmp，通过寄存器传递参数，寄存器是prev-a，next-d，当函数执行结束ret时因为没有压栈当前eip，所以需要使用之前压栈的eip，就是pop出next_ip。  */ 


		 "1:\t"               /* 认为next进程开始执行。 */         
		 "popl %%ebp\n\t"     /* restore EBP   */    
		 "popfl\n"         /* restore flags */  
                                    
		 /* output parameters 因为处于中断上下文，在内核中
		 prev_sp是内核堆栈栈顶
		 prev_ip是当前进程的eip */                
		 : [prev_sp] "=m" (prev->thread.sp),     
		 [prev_ip] "=m" (prev->thread.ip),  //[prev_ip]是标号        
		 "=a" (last),                 
                                    
		/* clobbered output registers: */     
		 "=b" (ebx), "=c" (ecx), "=d" (edx),      
		 "=S" (esi), "=D" (edi)             
                                       
		 __switch_canary_oparam                
                                    
		 /* input parameters: 
		 next_sp下一个进程的内核堆栈的栈顶
		 next_ip下一个进程执行的起点，一般是$1f，对于新创建的子进程是ret_from_fork*/                
		 : [next_sp]  "m" (next->thread.sp),        
		 [next_ip]  "m" (next->thread.ip),       
                                        
	     /* regparm parameters for __switch_to(): */  
		 [prev]     "a" (prev),              
		 [next]     "d" (next)               
                                    
		 __switch_canary_iparam                
                                    
		 : /* reloaded segment registers */           
		 "memory");                  
} while (0)