|
fork：通过fork创建新进程
vfork：主要用于马上执行exec的情况，因为马上就exec装入新的程序，所以可以去掉fork中分配新的地址空间等操作，进而加速进程创建
clone：功能更强，参数更多；主要用于创建线程/父子进程资源共享等，可以通过设置相应的参数实现fork、vfork的功能
I.系统调用
i.系统调用
- arch/x86/kernel/syscall_table_32.S
- 1 ENTRY(sys_call_table)
- 4 .long ptregs_fork /* 3 */
- 122 .long ptregs_clone /* 120 */
- 192 .long ptregs_vfork /* 190 */
-
- arch/x86/kernel/entry_32.S
- 709 /*
- 710 * System calls that need a pt_regs pointer.
- 711 */
- 712 #define PTREGSCALL(name) \
- 713 ALIGN; \
- 714 ptregs_##name: \
- 715 leal 4(%esp),%eax; \
- 716 jmp sys_##name;
- 717
- 718 PTREGSCALL(iopl)
- 719 PTREGSCALL(fork)
- 720 PTREGSCALL(clone)
- 721 PTREGSCALL(vfork)
-
- arch/x86/kernel/process.c
- 217 int sys_fork(struct pt_regs *regs)
- 218 {
- 219 return do_fork(SIGCHLD, regs->sp, regs, 0, NULL, NULL);
- 220 }
- 221
- 222 /*
- 223 * This is trivial, and on the face of it looks like it
- 224 * could equally well be done in user mode.
- 225 *
- 226 * Not so, for quite unobvious reasons - register pressure.
- 227 * In user mode vfork() cannot have a stack frame, and if
- 228 * done by calling the "clone()" system call directly, you
- 229 * do not have enough call-clobbered registers to hold all
- 230 * the information you need.
- 231 */
- 232 int sys_vfork(struct pt_regs *regs)
- 233 {
- 234 return do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD, regs->sp, regs, 0,
- 235 NULL, NULL);
- 236 }
-
- arch/x86/kernel/process_32.c
- 432 int sys_clone(struct pt_regs *regs)
- 433 {
- 434 unsigned long clone_flags;
- 435 unsigned long newsp;
- 436 int __user *parent_tidptr, *child_tidptr;
- 437
- 438 clone_flags = regs->bx;
- 439 newsp = regs->cx;
- 440 parent_tidptr = (int __user *)regs->dx;
- 441 child_tidptr = (int __user *)regs->di;
- 442 if (!newsp)
- 443 newsp = regs->sp;
- 444 return do_fork(clone_flags, newsp, regs, 0, parent_tidptr, child_tidptr);
- 445 }
可以看出fork,vfork,clone都是通过do_fork实现，只是传入参数不同而已
ii.do_fork
- kernel/fork.c
- 1363 * Ok, this is the main fork-routine.
- 1364 *
- 1365 * It copies the process, and if successful kick-starts
- 1366 * it and waits for it to finish using the VM if required.
- 1367 */
- 1368 long do_fork(unsigned long clone_flags,
- 1369 unsigned long stack_start,
- 1370 struct pt_regs *regs,
- 1371 unsigned long stack_size,
- 1372 int __user *parent_tidptr,
- 1373 int __user *child_tidptr)
- 1374 {
- 1375 struct task_struct *p;
- 1376 int trace = 0;
- 1377 long nr;
- 1378
- 1379 /*
- 1380 * Do some preliminary argument and permissions checking before we
- 1381 * actually start allocating stuff
- 1382 */
- 1383 if (clone_flags & CLONE_NEWUSER) {
- 1384 if (clone_flags & CLONE_THREAD)
- 1385 return -EINVAL;
- 1386 /* hopefully this check will go away when userns support is
- 1387 * complete
- 1388 */
- 1389 if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SETUID) ||
- 1390 !capable(CAP_SETGID))
- 1391 return -EPERM;
- 1392 }
- 1393
- 1394 /*
- 1395 * We hope to recycle these flags after 2.6.26
- 1396 */
- 1397 if (unlikely(clone_flags & CLONE_STOPPED)) {
- 1398 static int __read_mostly count = 100;
- 1399
- 1400 if (count > 0 && printk_ratelimit()) {
- 1401 char comm[TASK_COMM_LEN];
- 1402
- 1403 count--;
- 1404 printk(KERN_INFO "fork(): process `%s' used deprecated "
- 1405 "clone flags 0x%lx\n",
- 1406 get_task_comm(comm, current),
- 1407 clone_flags & CLONE_STOPPED);
- 1408 }
- 1409 }
- 1410
- 1411 /*
- 1412 * When called from kernel_thread, don't do user tracing stuff.
- 1413 */
- 1414 if (likely(user_mode(regs)))
- 1415 trace = tracehook_prepare_clone(clone_flags);
- 1416
- 1417 p = copy_process(clone_flags, stack_start, regs, stack_size,
- 1418 child_tidptr, NULL, trace);
- 1419 /*
- 1420 * Do this prior waking up the new thread - the thread pointer
- 1421 * might get invalid after that point, if the thread exits quickly.
- 1422 */
- 1423 if (!IS_ERR(p)) {
- 1424 struct completion vfork;
- 1425
- 1426 trace_sched_process_fork(current, p);
- 1427
- 1428 nr = task_pid_vnr(p);
- 1429
- 1430 if (clone_flags & CLONE_PARENT_SETTID)
- 1431 put_user(nr, parent_tidptr);
- 1432
- 1433 if (clone_flags & CLONE_VFORK) {
- 1434 p->vfork_done = &vfork;
- 1435 init_completion(&vfork);
- 1436 }
- 1437
- 1438 audit_finish_fork(p);
- 1439 tracehook_report_clone(regs, clone_flags, nr, p);
- 1440
- 1441 /*
- 1442 * We set PF_STARTING at creation in case tracing wants to
- 1443 * use this to distinguish a fully live task from one that
- 1444 * hasn't gotten to tracehook_report_clone() yet. Now we
- 1445 * clear it and set the child going.
- 1446 */
- 1447 p->flags &= ~PF_STARTING;
- 1449 if (unlikely(clone_flags & CLONE_STOPPED)) {
- 1450 /*
- 1451 * We'll start up with an immediate SIGSTOP.
- 1452 */
- 1453 sigaddset(&p->pending.signal, SIGSTOP);
- 1454 set_tsk_thread_flag(p, TIF_SIGPENDING);
- 1455 __set_task_state(p, TASK_STOPPED);
- 1456 } else {
- 1457 wake_up_new_task(p, clone_flags);
- 1458 }
- 1459
- 1460 tracehook_report_clone_complete(trace, regs,
- 1461 clone_flags, nr, p);
- 1462
- 1463 if (clone_flags & CLONE_VFORK) {
- 1464 freezer_do_not_count();
- 1465 wait_for_completion(&vfork);
- 1466 freezer_count();
- 1467 tracehook_report_vfork_done(p, nr);
- 1468 }
- 1469 } else {
- 1470 nr = PTR_ERR(p);
- 1471 }
- 1472 return nr;
- 1473 }
1.输入参数及权限检查
2.复制进程
3.取子进程id
4.如果设置CLONE_PARENT_SETTID，则将子进程id放入parent_tidptr中
5.如果是vfork系统调用/带CLONE_VFORK标识的clone，初始化completion；用于暂停父进程在vfork/clone中，在子进程执行exec/exit后父进程再继续执行
6.唤醒子进程，在copy_thread中设置子进程的运行环境；子进程从ret_from_fork执行，内核堆栈与父进程刚进入fork/vfork/clone的内核堆栈相同（返回值ax设置成0,sp设置成新的用户堆栈），直接退出系统调用即可。
7.如果是vfork系统调用/带CLONE_VFORK标识的clone，等待子进程执行exec/exit
II.复制进程copy_process
- kernel/fork.c
- 973 /*
- 974 * This creates a new process as a copy of the old one,
- 975 * but does not actually start it yet.
- 976 *
- 977 * It copies the registers, and all the appropriate
- 978 * parts of the process environment (as per the clone
- 979 * flags). The actual kick-off is left to the caller.
- 980 */
- 981 static struct task_struct *copy_process(unsigned long clone_flags,
- 982 unsigned long stack_start,
- 983 struct pt_regs *regs,
- 984 unsigned long stack_size,
- 985 int __user *child_tidptr,
- 986 struct pid *pid,
- 987 int trace)
- 988 {
- 989 int retval;
- 990 struct task_struct *p;
- 991 int cgroup_callbacks_done = 0;
- 992
- 993 if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
- 994 return ERR_PTR(-EINVAL);
- 995
- 996 /*
- 997 * Thread groups must share signals as well, and detached threads
- 998 * can only be started up within the thread group.
- 999 */
- 1000 if ((clone_flags & CLONE_THREAD) && !(clone_flags & CLONE_SIGHAND))
- 1001 return ERR_PTR(-EINVAL);
- 1002
- 1003 /*
- 1004 * Shared signal handlers imply shared VM. By way of the above,
- 1005 * thread groups also imply shared VM. Blocking this case allows
- 1006 * for various simplifications in other code.
- 1007 */
- 1008 if ((clone_flags & CLONE_SIGHAND) && !(clone_flags & CLONE_VM))
- 1009 return ERR_PTR(-EINVAL);
- 1010
- 1011 /*
- 1012 * Siblings of global init remain as zombies on exit since they are
- 1013 * not reaped by their parent (swapper). To solve this and to avoid
- 1014 * multi-rooted process trees, prevent global and container-inits
- 1015 * from creating siblings.
- 1016 */
- 1017 if ((clone_flags & CLONE_PARENT) &&
- 1018 current->signal->flags & SIGNAL_UNKILLABLE)
- 1019 return ERR_PTR(-EINVAL);
- 1020
- 1021 retval = security_task_create(clone_flags);
- 1022 if (retval)
- 1023 goto fork_out;
- 1024
- 1025 retval = -ENOMEM;
- 1026 p = dup_task_struct(current);
- 1027 if (!p)
- 1028 goto fork_out;
- 1029
- 1030 ftrace_graph_init_task(p);
- 1031
- 1032 rt_mutex_init_task(p);
- 1033
- 1034 #ifdef CONFIG_PROVE_LOCKING
- 1035 DEBUG_LOCKS_WARN_ON(!p->hardirqs_enabled);
- 1036 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
- 1037 #endif
- 1038 retval = -EAGAIN;
- 1039 if (atomic_read(&p->real_cred->user->processes) >=
- 1040 p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
- 1041 if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
- 1042 p->real_cred->user != INIT_USER)
- 1043 goto bad_fork_free;
- 1044 }
- 1045
- 1046 retval = copy_creds(p, clone_flags);
- 1047 if (retval < 0)
- 1048 goto bad_fork_free;
- 1049
- 1050 /*
- 1051 * If multiple threads are within copy_process(), then this check
- 1052 * triggers too late. This doesn't hurt, the check is only there
- 1053 * to stop root fork bombs.
- 1054 */
- 1055 retval = -EAGAIN;
- 1056 if (nr_threads >= max_threads)
- 1057 goto bad_fork_cleanup_count;
- 1058
- 1059 if (!try_module_get(task_thread_info(p)->exec_domain->module))
- 1060 goto bad_fork_cleanup_count;
- 1061
- 1062 p->did_exec = 0;
- 1063 delayacct_tsk_init(p); /* Must remain after dup_task_struct() */
- 1064 copy_flags(clone_flags, p);
- 1065 INIT_LIST_HEAD(&p->children);
- 1066 INIT_LIST_HEAD(&p->sibling);
- 1067 rcu_copy_process(p);
- 1068 p->vfork_done = NULL;
- 1069 spin_lock_init(&p->alloc_lock);
- 1070
- 1071 init_sigpending(&p->pending);
- 1072
- 1073 p->utime = cputime_zero;
- 1074 p->stime = cputime_zero;
- 1075 p->gtime = cputime_zero;
- 1076 p->utimescaled = cputime_zero;
- 1077 p->stimescaled = cputime_zero;
- 1078 p->prev_utime = cputime_zero;
- 1079 p->prev_stime = cputime_zero;
- 1080
- 1081 p->default_timer_slack_ns = current->timer_slack_ns;
- 1082
- 1083 task_io_accounting_init(&p->ioac);
- 1084 acct_clear_integrals(p);
- 1085
- 1086 posix_cpu_timers_init(p);
- 1087
- 1088 p->lock_depth = -1; /* -1 = no lock */
- 1089 do_posix_clock_monotonic_gettime(&p->start_time);
- 1090 p->real_start_time = p->start_time;
- 1091 monotonic_to_bootbased(&p->real_start_time);
- 1092 p->io_context = NULL;
- 1093 p->audit_context = NULL;
- 1094 cgroup_fork(p);
- 1095 #ifdef CONFIG_NUMA
- 1096 p->mempolicy = mpol_dup(p->mempolicy);
- 1097 if (IS_ERR(p->mempolicy)) {
- 1098 retval = PTR_ERR(p->mempolicy);
- 1099 p->mempolicy = NULL;
- 1100 goto bad_fork_cleanup_cgroup;
- 1101 }
- 1102 mpol_fix_fork_child_flag(p);
- 1103 #endif
- 1104 #ifdef CONFIG_TRACE_IRQFLAGS
- 1105 p->irq_events = 0;
- 1106 #ifdef __ARCH_WANT_INTERRUPTS_ON_CTXSW
- 1107 p->hardirqs_enabled = 1;
- 1108 #else
- 1109 p->hardirqs_enabled = 0;
- 1110 #endif
- 1111 p->hardirq_enable_ip = 0;
- 1112 p->hardirq_enable_event = 0;
- 1113 p->hardirq_disable_ip = _THIS_IP_;
- 1114 p->hardirq_disable_event = 0;
- 1115 p->softirqs_enabled = 1;
- 1116 p->softirq_enable_ip = _THIS_IP_;
- 1117 p->softirq_enable_event = 0;
- 1118 p->softirq_disable_ip = 0;
- 1119 p->softirq_disable_event = 0;
- 1120 p->hardirq_context = 0;
- 1121 p->softirq_context = 0;
- 1122 #endif
- 1123 #ifdef CONFIG_LOCKDEP
- 1124 p->lockdep_depth = 0; /* no locks held yet */
- 1125 p->curr_chain_key = 0;
- 1126 p->lockdep_recursion = 0;
- 1127 #endif
- 1128
- 1129 #ifdef CONFIG_DEBUG_MUTEXES
- 1130 p->blocked_on = NULL; /* not blocked yet */
- 1131 #endif
- 1132
- 1133 p->bts = NULL;
- 1134
- 1135 /* Perform scheduler related setup. Assign this task to a CPU. */
- 1136 sched_fork(p, clone_flags);
- 1137
- 1138 retval = perf_event_init_task(p);
- 1139 if (retval)
- 1140 goto bad_fork_cleanup_policy;
- 1141
- 1142 if ((retval = audit_alloc(p)))
- 1143 goto bad_fork_cleanup_policy;
- 1144 /* copy all the process information */
- 1145 if ((retval = copy_semundo(clone_flags, p)))
- 1146 goto bad_fork_cleanup_audit;
- 1147 if ((retval = copy_files(clone_flags, p)))
- 1148 goto bad_fork_cleanup_semundo;
- 1149 if ((retval = copy_fs(clone_flags, p)))
- 1150 goto bad_fork_cleanup_files;
- 1151 if ((retval = copy_sighand(clone_flags, p)))
- 1152 goto bad_fork_cleanup_fs;
- 1153 if ((retval = copy_signal(clone_flags, p)))
- 1154 goto bad_fork_cleanup_sighand;
- 1155 if ((retval = copy_mm(clone_flags, p)))
- 1156 goto bad_fork_cleanup_signal;
- 1157 if ((retval = copy_namespaces(clone_flags, p)))
- 1158 goto bad_fork_cleanup_mm;
- 1159 if ((retval = copy_io(clone_flags, p)))
- 1160 goto bad_fork_cleanup_namespaces;
- 1161 retval = copy_thread(clone_flags, stack_start, stack_size, p, regs);
- 1162 if (retval)
- 1163 goto bad_fork_cleanup_io;
- 1164
- 1165 if (pid != &init_struct_pid) {
- 1166 retval = -ENOMEM;
- 1167 pid = alloc_pid(p->nsproxy->pid_ns);
- 1168 if (!pid)
- 1169 goto bad_fork_cleanup_io;
- 1170
- 1171 if (clone_flags & CLONE_NEWPID) {
- 1172 retval = pid_ns_prepare_proc(p->nsproxy->pid_ns);
- 1173 if (retval < 0)
- 1174 goto bad_fork_free_pid;
- 1175 }
- 1176 }
- 1177
- 1178 p->pid = pid_nr(pid);
- 1179 p->tgid = p->pid;
- 1180 if (clone_flags & CLONE_THREAD)
- 1181 p->tgid = current->tgid;
- 1182
- 1183 if (current->nsproxy != p->nsproxy) {
- 1184 retval = ns_cgroup_clone(p, pid);
- 1185 if (retval)
- 1186 goto bad_fork_free_pid;
- 1187 }
- 1188
- 1189 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
- 1190 /*
- 1191 * Clear TID on mm_release()?
- 1192 */
- 1193 p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr: NULL;
- 1194 #ifdef CONFIG_FUTEX
- 1195 p->robust_list = NULL;
- 1196 #ifdef CONFIG_COMPAT
- 1197 p->compat_robust_list = NULL;
- 1198 #endif
- 1199 INIT_LIST_HEAD(&p->pi_state_list);
- 1200 p->pi_state_cache = NULL;
- 1201 #endif
- 1202 /*
- 1203 * sigaltstack should be cleared when sharing the same VM
- 1204 */
- 1205 if ((clone_flags & (CLONE_VM|CLONE_VFORK)) == CLONE_VM)
- 1206 p->sas_ss_sp = p->sas_ss_size = 0;
- 1207
- 1208 /*
- 1209 * Syscall tracing should be turned off in the child regardless
- 1210 * of CLONE_PTRACE.
- 1211 */
- 1212 clear_tsk_thread_flag(p, TIF_SYSCALL_TRACE);
- 1213 #ifdef TIF_SYSCALL_EMU
- 1214 clear_tsk_thread_flag(p, TIF_SYSCALL_EMU);
- 1215 #endif
- 1216 clear_all_latency_tracing(p);
- 1217
- 1218 /* ok, now we should be set up.. */
- 1219 p->exit_signal = (clone_flags & CLONE_THREAD) ? -1 : (clone_flags & CSIGNAL);
- 1220 p->pdeath_signal = 0;
- 1221 p->exit_state = 0;
- 1222
- 1223 /*
- 1224 * Ok, make it visible to the rest of the system.
- 1225 * We dont wake it up yet.
- 1226 */
- 1227 p->group_leader = p;
- 1228 INIT_LIST_HEAD(&p->thread_group);
- 1229
- 1230 /* Now that the task is set up, run cgroup callbacks if
- 1231 * necessary. We need to run them before the task is visible
- 1232 * on the tasklist. */
- 1233 cgroup_fork_callbacks(p);
- 1234 cgroup_callbacks_done = 1;
- 1235
- 1236 /* Need tasklist lock for parent etc handling! */
- 1237 write_lock_irq(&tasklist_lock);
- 1238
- 1239 /* CLONE_PARENT re-uses the old parent */
- 1240 if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
- 1241 p->real_parent = current->real_parent;
- 1242 p->parent_exec_id = current->parent_exec_id;
- 1243 } else {
- 1244 p->real_parent = current;
- 1245 p->parent_exec_id = current->self_exec_id;
- 1246 }
- 1247
- 1248 spin_lock(?t->sighand->siglock);
- 1249
- 1250 /*
- 1251 * Process group and session signals need to be delivered to just the
- 1252 * parent before the fork or both the parent and the child after the
- 1253 * fork. Restart if a signal comes in before we add the new process to
- 1254 * it's process group.
- 1255 * A fatal signal pending means that current will exit, so the new
- 1256 * thread can't slip out of an OOM kill (or normal SIGKILL).
- 1257 */
- 1258 recalc_sigpending();
- 1259 if (signal_pending(current)) {
- 1260 spin_unlock(?t->sighand->siglock);
- 1261 write_unlock_irq(&tasklist_lock);
- 1262 retval = -ERESTARTNOINTR;
- 1263 goto bad_fork_free_pid;
- 1264 }
- 1265
- 1266 if (clone_flags & CLONE_THREAD) {
- 1267 atomic_inc(?t->signal->count);
- 1268 atomic_inc(?t->signal->live);
- 1269 p->group_leader = current->group_leader;
- 1270 list_add_tail_rcu(&p->thread_group, &p->group_leader->thread_group);
- 1271 }
- 1272
- 1273 if (likely(p->pid)) {
- 1274 list_add_tail(&p->sibling, &p->real_parent->children);
- 1275 tracehook_finish_clone(p, clone_flags, trace);
- 1276
- 1277 if (thread_group_leader(p)) {
- 1278 if (clone_flags & CLONE_NEWPID)
- 1279 p->nsproxy->pid_ns->child_reaper = p;
- 1280
- 1281 p->signal->leader_pid = pid;
- 1282 tty_kref_put(p->signal->tty);
- 1283 p->signal->tty = tty_kref_get(current->signal->tty);
- 1284 attach_pid(p, PIDTYPE_PGID, task_pgrp(current));
- 1285 attach_pid(p, PIDTYPE_SID, task_session(current));
- 1286 list_add_tail_rcu(&p->tasks, &init_task.tasks);
- 1287 __get_cpu_var(process_counts)++;
- 1288 }
- 1289 attach_pid(p, PIDTYPE_PID, pid);
- 1290 nr_threads++;
- 1291 }
- 1292
- 1293 total_forks++;
- 1294 spin_unlock(?t->sighand->siglock);
- 1295 write_unlock_irq(&tasklist_lock);
- 1296 proc_fork_connector(p);
- 1297 cgroup_post_fork(p);
- 1298 perf_event_fork(p);
- 1299 return p;
- 1300
- 1301 bad_fork_free_pid:
- 1302 if (pid != &init_struct_pid)
- 1303 free_pid(pid);
- 1304 bad_fork_cleanup_io:
- 1305 if (p->io_context)
- 1306 exit_io_context(p);
- 1307 bad_fork_cleanup_namespaces:
- 1308 exit_task_namespaces(p);
- 1309 bad_fork_cleanup_mm:
- 1310 if (p->mm)
- 1311 mmput(p->mm);
- 1312 bad_fork_cleanup_signal:
- 1313 if (!(clone_flags & CLONE_THREAD))
- 1314 __cleanup_signal(p->signal);
- 1315 bad_fork_cleanup_sighand:
- 1316 __cleanup_sighand(p->sighand);
- 1317 bad_fork_cleanup_fs:
- 1318 exit_fs(p); /* blocking */
- 1319 bad_fork_cleanup_files:
- 1320 exit_files(p); /* blocking */
- 1321 bad_fork_cleanup_semundo:
- 1322 exit_sem(p);
- 1323 bad_fork_cleanup_audit:
- 1324 audit_free(p);
- 1325 bad_fork_cleanup_policy:
- 1326 perf_event_free_task(p);
- 1327 #ifdef CONFIG_NUMA
- 1328 mpol_put(p->mempolicy);
- 1329 bad_fork_cleanup_cgroup:
- 1330 #endif
- 1331 cgroup_exit(p, cgroup_callbacks_done);
- 1332 delayacct_tsk_free(p);
- 1333 module_put(task_thread_info(p)->exec_domain->module);
- 1334 bad_fork_cleanup_count:
- 1335 atomic_dec(&p->cred->user->processes);
- 1336 exit_creds(p);
- 1337 bad_fork_free:
- 1338 free_task(p);
- 1339 fork_out:
- 1340 return ERR_PTR(retval);
- 1341 }
i.clone_flags共存标识检查
ii.复制进程描述符dup_task_struct
iii.检查用户当前进程数未超限
iv.复制凭证copy_creds
v.检查当前系统范围内进程数未超限；max_threads在fork_init中初始化，=可用内存/内核椎栈大小/8（每个进程都有自己的内核椎栈，每个椎栈大小是4k或8k），即内核堆栈大小不能超过可用内存的1/8
vi.初始化子进程进程描述符，即与父进程不同的地方复制成新值；清空子进程链表、清空pending的信号、设置时间等
vii.初始化进程调度信息sched_fork
viii.复制信号量撤销链表copy_semundo
ix.复制打开文件信息copy_files
x.复制文件系统信息copy_fs
xi.复制信号处理描述符copy_sighand
xii.复制信号描述符copy_signal
xiii.复制地址空间信息copy_mm
xiv.复制命名空间copy_namespaces
xv.复制子进程运行环境copy_thread
xvi.分配子进程id，并设置相应的进程号pid、线程组长号tgid、线程组长group_leader、父进程real_parent
xvii.将进程链入父进程的子进程链表、进程组成员链表、会话组成员链表、进程链表
ii.dup_task_struct
- kernel/fork.c
- 222 static struct task_struct *dup_task_struct(struct task_struct *orig)
- 223 {
- 224 struct task_struct *tsk;
- 225 struct thread_info *ti;
- 226 unsigned long *stackend;
- 227
- 228 int err;
- 229
- 230 prepare_to_copy(orig);
- 231
- 232 tsk = alloc_task_struct();
- 233 if (!tsk)
- 234 return NULL;
- 235
- 236 ti = alloc_thread_info(tsk);
- 237 if (!ti) {
- 238 free_task_struct(tsk);
- 239 return NULL;
- 240 }
- 241
- 242 err = arch_dup_task_struct(tsk, orig);
- 243 if (err)
- 244 goto out;
- 245
- 246 tsk->stack = ti;
- 247
- 248 err = prop_local_init_single(&tsk->dirties);
- 249 if (err)
- 250 goto out;
- 251
- 252 setup_thread_stack(tsk, orig);
- 253 stackend = end_of_stack(tsk);
- 254 *stackend = STACK_END_MAGIC; /* for overflow detection */
- 255
- 256 #ifdef CONFIG_CC_STACKPROTECTOR
- 257 tsk->stack_canary = get_random_int();
- 258 #endif
- 259
- 260 /* One for us, one for whoever does the "release_task()" (usually parent) */
- 261 atomic_set(&tsk->usage,2);
- 262 atomic_set(&tsk->fs_excl, 0);
- 263 #ifdef CONFIG_BLK_DEV_IO_TRACE
- 264 tsk->btrace_seq = 0;
- 265 #endif
- 266 tsk->splice_pipe = NULL;
- 267
- 268 account_kernel_stack(ti, 1);
- 269
- 270 return tsk;
- 271
- 272 out:
- 273 free_thread_info(ti);
- 274 free_task_struct(tsk);
- 275 return NULL;
- 276 }
1.分配进程描述符
2.分配thread_info及内核堆栈
3.复制父进程描述符信息
4.进程描述符与内核堆栈关联起来
5.复制thread_info信息
6.内核堆栈设置幻数，以防堆栈越界
7.设置进程描述符引用计数
iv.copy_creds
- kernel/cred.c
- 427 /*
- 428 * Copy credentials for the new process created by fork()
- 429 *
- 430 * We share if we can, but under some circumstances we have to generate a new
- 431 * set.
- 432 *
- 433 * The new process gets the current process's subjective credentials as its
- 434 * objective and subjective credentials
- 435 */
- 436 int copy_creds(struct task_struct *p, unsigned long clone_flags)
- 437 {
- 438 #ifdef CONFIG_KEYS
- 439 struct thread_group_cred *tgcred;
- 440 #endif
- 441 struct cred *new;
- 442 int ret;
- 443
- 444 mutex_init(&p->cred_guard_mutex);
- 445
- 446 p->replacement_session_keyring = NULL;
- 447
- 448 if (
- 449 #ifdef CONFIG_KEYS
- 450 !p->cred->thread_keyring &&
- 451 #endif
- 452 clone_flags & CLONE_THREAD
- 453 ) {
- 454 p->real_cred = get_cred(p->cred);
- 455 get_cred(p->cred);
- 456 alter_cred_subscribers(p->cred, 2);
- 457 kdebug("share_creds(%p{%d,%d})",
- 458 p->cred, atomic_read(&p->cred->usage),
- 459 read_cred_subscribers(p->cred));
- 460 atomic_inc(&p->cred->user->processes);
- 461 return 0;
- 462 }
- 463
- 464 new = prepare_creds();
- 465 if (!new)
- 466 return -ENOMEM;
- 467
- 468 if (clone_flags & CLONE_NEWUSER) {
- 469 ret = create_user_ns(new);
- 470 if (ret < 0)
- 471 goto error_put;
- 472 }
- 473
- 474 #ifdef CONFIG_KEYS
- 475 /* new threads get their own thread keyrings if their parent already
- 476 * had one */
- 477 if (new->thread_keyring) {
- 478 key_put(new->thread_keyring);
- 479 new->thread_keyring = NULL;
- 480 if (clone_flags & CLONE_THREAD)
- 481 install_thread_keyring_to_cred(new);
- 482 }
- 483
- 484 /* we share the process and session keyrings between all the threads in
- 485 * a process - this is slightly icky as we violate COW credentials a
- 486 * bit */
- 487 if (!(clone_flags & CLONE_THREAD)) {
- 488 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
- 489 if (!tgcred) {
- 490 ret = -ENOMEM;
- 491 goto error_put;
- 492 }
- 493 atomic_set(&tgcred->usage, 1);
- 494 spin_lock_init(&tgcred->lock);
- 495 tgcred->process_keyring = NULL;
- 496 tgcred->session_keyring = key_get(new->tgcred->session_keyring);
- 497
- 498 release_tgcred(new);
- 499 new->tgcred = tgcred;
- 500 }
- 501 #endif
- 502
- 503 atomic_inc(&new->user->processes);
- 504 p->cred = p->real_cred = get_cred(new);
- 505 alter_cred_subscribers(new, 2);
- 506 validate_creds(new);
- 507 return 0;
- 508
- 509 error_put:
- 510 put_cred(new);
- 511 return ret;
- 512 }
子进程的主/客体凭证复制自父进程的主体凭证
1.如果是创建线程
父进程的主体凭证引用计数器加1，将子进程的主/客体凭证指向父进程的主体凭证即可
2.如果是创建进程
a.分配凭证描述符并初始化，复制父进程主体凭证、引用计数器置1等
b.子进程主/客体凭证指向新的凭证描述符
用户进程数计数器加1
viii.copy_semundo
- /* ipc/sem.c */
- 1244 /* If CLONE_SYSVSEM is set, establish sharing of SEM_UNDO state between
- 1245 * parent and child tasks.
- 1246 */
- 1247
- 1248 int copy_semundo(unsigned long clone_flags, struct task_struct *tsk)
- 1249 {
- 1250 struct sem_undo_list *undo_list;
- 1251 int error;
- 1252
- 1253 if (clone_flags & CLONE_SYSVSEM) {
- 1254 error = get_undo_list(&undo_list);
- 1255 if (error)
- 1256 return error;
- 1257 atomic_inc(&undo_list->refcnt);
- 1258 tsk->sysvsem.undo_list = undo_list;
- 1259 } else
- 1260 tsk->sysvsem.undo_list = NULL;
- 1261
- 1262 return 0;
- 1263 }
1.如果与父进程共享信号量，将子进程的信号量撤销链表指向父进程的撤销链表
2.如果不与父进程共享信号量，清空子进程的信号量撤销链表
ix.copy_files
- /* kernel/fork.c */
- 748 static int copy_files(unsigned long clone_flags, struct task_struct * tsk)
- 749 {
- 750 struct files_struct *oldf, *newf;
- 751 int error = 0;
- 752
- 753 /*
- 754 * A background process may not have any files ...
- 755 */
- 756 oldf = current->files;
- 757 if (!oldf)
- 758 goto out;
- 759
- 760 if (clone_flags & CLONE_FILES) {
- 761 atomic_inc(&oldf->count);
- 762 goto out;
- 763 }
- 764
- 765 newf = dup_fd(oldf, &error);
- 766 if (!newf)
- 767 goto out;
- 768
- 769 tsk->files = newf;
- 770 error = 0;
- 771 out:
- 772 return error;
- 773 }
-
- /* fs/file.c */
- 289 /*
- 290 * Allocate a new files structure and copy contents from the
- 291 * passed in files structure.
- 292 * errorp will be valid only when the returned files_struct is NULL.
- 293 */
- 294 struct files_struct *dup_fd(struct files_struct *oldf, int *errorp)
- 295 {
- 296 struct files_struct *newf;
- 297 struct file **old_fds, **new_fds;
- 298 int open_files, size, i;
- 299 struct fdtable *old_fdt, *new_fdt;
- 300
- 301 *errorp = -ENOMEM;
- 302 newf = kmem_cache_alloc(files_cachep, GFP_KERNEL);
- 303 if (!newf)
- 304 goto out;
- 305
- 306 atomic_set(&newf->count, 1);
- 307
- 308 spin_lock_init(&newf->file_lock);
- 309 newf->next_fd = 0;
- 310 new_fdt = &newf->fdtab;
- 311 new_fdt->max_fds = NR_OPEN_DEFAULT;
- 312 new_fdt->close_on_exec = (fd_set *)&newf->close_on_exec_init;
- 313 new_fdt->open_fds = (fd_set *)&newf->open_fds_init;
- 314 new_fdt->fd = &newf->fd_array[0];
- 315 INIT_RCU_HEAD(&new_fdt->rcu);
- 316 new_fdt->next = NULL;
- 317
- 318 spin_lock(&oldf->file_lock);
- 319 old_fdt = files_fdtable(oldf);
- 320 open_files = count_open_files(old_fdt);
- 321
- 322 /*
- 323 * Check whether we need to allocate a larger fd array and fd set.
- 324 */
- 325 while (unlikely(open_files > new_fdt->max_fds)) {
- 326 spin_unlock(&oldf->file_lock);
- 327
- 328 if (new_fdt != &newf->fdtab) {
- 329 free_fdarr(new_fdt);
- 330 free_fdset(new_fdt);
- 331 kfree(new_fdt);
- 332 }
- 333
- 334 new_fdt = alloc_fdtable(open_files - 1);
- 335 if (!new_fdt) {
- 336 *errorp = -ENOMEM;
- 337 goto out_release;
- 338 }
- 339
- 340 /* beyond sysctl_nr_open; nothing to do */
- 341 if (unlikely(new_fdt->max_fds < open_files)) {
- 342 free_fdarr(new_fdt);
- 343 free_fdset(new_fdt);
- 344 kfree(new_fdt);
- 345 *errorp = -EMFILE;
- 346 goto out_release;
- 347 }
- 348
- 349 /*
- 350 * Reacquire the oldf lock and a pointer to its fd table
- 351 * who knows it may have a new bigger fd table. We need
- 352 * the latest pointer.
- 353 */
- 354 spin_lock(&oldf->file_lock);
- 355 old_fdt = files_fdtable(oldf);
- 356 open_files = count_open_files(old_fdt);
- 357 }
- 358
- 359 old_fds = old_fdt->fd;
- 360 new_fds = new_fdt->fd;
- 361
- 362 memcpy(new_fdt->open_fds->fds_bits,
- 363 old_fdt->open_fds->fds_bits, open_files/8);
- 364 memcpy(new_fdt->close_on_exec->fds_bits,
- 365 old_fdt->close_on_exec->fds_bits, open_files/8);
- 366
- 367 for (i = open_files; i != 0; i--) {
- 368 struct file *f = *old_fds++;
- 369 if (f) {
- 370 get_file(f);
- 371 } else {
- 372 /*
- 373 * The fd may be claimed in the fd bitmap but not yet
- 374 * instantiated in the files array if a sibling thread
- 375 * is partway through open(). So make sure that this
- 376 * fd is available to the new process.
- 377 */
- 378 FD_CLR(open_files - i, new_fdt->open_fds);
- 379 }
- 380 rcu_assign_pointer(*new_fds++, f);
- 381 }
- 382 spin_unlock(&oldf->file_lock);
- 383
- 384 /* compute the remainder to be cleared */
- 385 size = (new_fdt->max_fds - open_files) * sizeof(struct file *);
- 386
- 387 /* This is long word aligned thus could use a optimized version */
- 388 memset(new_fds, 0, size);
- 389
- 390 if (new_fdt->max_fds > open_files) {
- 391 int left = (new_fdt->max_fds-open_files)/8;
- 392 int start = open_files / (8 * sizeof(unsigned long));
- 393
- 394 memset(&new_fdt->open_fds->fds_bits[start], 0, left);
- 395 memset(&new_fdt->close_on_exec->fds_bits[start], 0, left);
- 396 }
- 397
- 398 rcu_assign_pointer(newf->fdt, new_fdt);
- 399
- 400 return newf;
- 401
- 402 out_release:
- 403 kmem_cache_free(files_cachep, newf);
- 404 out:
- 405 return NULL;
- 406 }
1.如果共享打开文件，将父进程打开文件描述符引用计数器加1
2.如果不共享，复制父进程打开文件描述符；
A.分配打开文件描述符
B.初始化打开文件描述符
a.打开文件描述符引用计数器置1
b.将打开文件描述符表指向预分配的文件描述符表，并初始化描述符表的打开文件位图、exec关闭文件位图、file数组指向预分配结构
C.如果预分配的文件描述符表小于父进程已经打开的文件，则重新分配打开文件描述符表
D.复制父进程打开文件位图、exec关闭文件位图信息
E.将父进程打开的文件引用计数器加1，并添加到子进程打开文件描述符表中
F.将文件描述符表中多出的file数组、打开文件位图、exec关闭文件位图清空
G.将打开文件描述符中的fdt指向文件描述符表
下图表示files_struct与file之间的关系：
x.copy_fs- /* kernel/fork.c */
- 728 static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
- 729 {
- 730 struct fs_struct *fs = current->fs;
- 731 if (clone_flags & CLONE_FS) {
- 732 /* tsk->fs is already what we want */
- 733 write_lock(&fs->lock);
- 734 if (fs->in_exec) {
- 735 write_unlock(&fs->lock);
- 736 return -EAGAIN;
- 737 }
- 738 fs->users++;
- 739 write_unlock(&fs->lock);
- 740 return 0;
- 741 }
- 742 tsk->fs = copy_fs_struct(fs);
- 743 if (!tsk->fs)
- 744 return -ENOMEM;
- 745 return 0;
- 746 }
1.如果CLONE_FS，文件系统描述符引用计数器加1
2.复制文件系统描述符，包含当前目录及根目录信息
xi.copy_sighand
- /* kernel/fork.c */
- 800 static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
- 801 {
- 802 struct sighand_struct *sig;
- 803
- 804 if (clone_flags & CLONE_SIGHAND) {
- 805 atomic_inc(?t->sighand->count);
- 806 return 0;
- 807 }
- 808 sig = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
- 809 rcu_assign_pointer(tsk->sighand, sig);
- 810 if (!sig)
- 811 return -ENOMEM;
- 812 atomic_set(&sig->count, 1);
- 813 memcpy(sig->action, current->sighand->action, sizeof(sig->action));
- 814 return 0;
- 815 }
1.如果共享信号处理，父进程信号处理描述符引用计数器加1即可
2.分配信号处理描述符，复制父进程信号处理描述符表；新的信号处理描述符表引用计数器置1，并与子进程关联
xii.copy_signal
- /* kernel/fork.c */
- 857 static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
- 858 {
- 859 struct signal_struct *sig;
- 860
- 861 if (clone_flags & CLONE_THREAD)
- 862 return 0;
- 863
- 864 sig = kmem_cache_alloc(signal_cachep, GFP_KERNEL);
- 865 tsk->signal = sig;
- 866 if (!sig)
- 867 return -ENOMEM;
- 868
- 869 atomic_set(&sig->count, 1);
- 870 atomic_set(&sig->live, 1);
- 871 init_waitqueue_head(&sig->wait_chldexit);
- 872 sig->flags = 0;
- 873 if (clone_flags & CLONE_NEWPID)
- 874 sig->flags |= SIGNAL_UNKILLABLE;
- 875 sig->group_exit_code = 0;
- 876 sig->group_exit_task = NULL;
- 877 sig->group_stop_count = 0;
- 878 sig->curr_target = tsk;
- 879 init_sigpending(&sig->shared_pending);
- 880 INIT_LIST_HEAD(&sig->posix_timers);
- 881
- 882 hrtimer_init(&sig->real_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
- 883 sig->it_real_incr.tv64 = 0;
- 884 sig->real_timer.function = it_real_fn;
- 885
- 886 sig->leader = 0; /* session leadership doesn't inherit */
- 887 sig->tty_old_pgrp = NULL;
- 888 sig->tty = NULL;
- 889
- 890 sig->utime = sig->stime = sig->cutime = sig->cstime = cputime_zero;
- 891 sig->gtime = cputime_zero;
- 892 sig->cgtime = cputime_zero;
- 893 #ifndef CONFIG_VIRT_CPU_ACCOUNTING
- 894 sig->prev_utime = sig->prev_stime = cputime_zero;
- 895 #endif
- 896 sig->nvcsw = sig->nivcsw = sig->cnvcsw = sig->cnivcsw = 0;
- 897 sig->min_flt = sig->maj_flt = sig->cmin_flt = sig->cmaj_flt = 0;
- 898 sig->inblock = sig->oublock = sig->cinblock = sig->coublock = 0;
- 899 sig->maxrss = sig->cmaxrss = 0;
- 900 task_io_accounting_init(&sig->ioac);
- 901 sig->sum_sched_runtime = 0;
- 902 taskstats_tgid_init(sig);
- 903
- 904 task_lock(current->group_leader);
- 905 memcpy(sig->rlim, current->signal->rlim, sizeof sig->rlim);
- 906 task_unlock(current->group_leader);
- 907
- 908 posix_cpu_timers_init_group(sig);
- 909
- 910 acct_init_pacct(&sig->pacct);
- 911
- 912 tty_audit_fork(sig);
- 913
- 914 sig->oom_adj = current->signal->oom_adj;
- 915
- 916 return 0;
- 917 }
1.如果创建线程，跳过
2.分配信号描述符
3.初始化信号描述符，引用计数器置1、清空共享信号pending
xiii.copy_mm
- /* kernel/fork.c */
- 681 static int copy_mm(unsigned long clone_flags, struct task_struct * tsk)
- 682 {
- 683 struct mm_struct * mm, *oldmm;
- 684 int retval;
- 685
- 686 tsk->min_flt = tsk->maj_flt = 0;
- 687 tsk->nvcsw = tsk->nivcsw = 0;
- 688 #ifdef CONFIG_DETECT_HUNG_TASK
- 689 tsk->last_switch_count = tsk->nvcsw + tsk->nivcsw;
- 690 #endif
- 691
- 692 tsk->mm = NULL;
- 693 tsk->active_mm = NULL;
- 694
- 695 /*
- 696 * Are we cloning a kernel thread?
- 697 *
- 698 * We need to steal a active VM for that..
- 699 */
- 700 oldmm = current->mm;
- 701 if (!oldmm)
- 702 return 0;
- 703
- 704 if (clone_flags & CLONE_VM) {
- 705 atomic_inc(&oldmm->mm_users);
- 706 mm = oldmm;
- 707 goto good_mm;
- 708 }
- 709
- 710 retval = -ENOMEM;
- 711 mm = dup_mm(tsk);
- 712 if (!mm)
- 713 goto fail_nomem;
- 714
- 715 good_mm:
- 716 /* Initializing for Swap token stuff */
- 717 mm->token_priority = 0;
- 718 mm->last_interval = 0;
- 719
- 720 tsk->mm = mm;
- 721 tsk->active_mm = mm;
- 722 return 0;
- 723
- 724 fail_nomem:
- 725 return retval;
- 726 }
1.分配地址空间描述符mm_struct
2.复制父进程地址空间描述符信息
3.初始化子进程地址空间描述符，覆盖从父进程地址空间描述符那里复制的部分；如引用数、map读写信号等
4.可执行文件引用计数器加1，以便在父进程退出后可执行文件也不会关闭
5.复制地址空间的映射区
遍历地址空间段
A.分配地址空间段描述符
B.复制地址空间段描述符信息
C.初始化地址空间段描述符，如将描述符从父进程链表&红黑树中删除、指向子进程的地址空间描述符等
D.如果是文件映射；文件引用计数器加1等
E.将地址空间段描述符添加到描述符链表及描述符红黑树中
F.映射区计数加1
G.复制页表copy_page_range
修改可写页表项，添加页保护标志，当往该页写数据时产生缺页异常，缺页异常处理会为进程分配新的页帧，这就是COW(copy on write)技术，这样做即加速了fork过程并且又节省了内存；而只读页帧会在进程间共享，如代码段
dup_mm->dup_mmap->copy_page_range->copy_pud_range->copy_pmd_range->copy_pte_range->copy_one_pte->ptep_set_wrprotect&pte_wrprotect
H.回调地址空间的open函数
xiv.copy_namespaces
- /* kernel/nsproxy.c */
- 103 /*
- 104 * called from clone. This now handles copy for nsproxy and all
- 105 * namespaces therein.
- 106 */
- 107 int copy_namespaces(unsigned long flags, struct task_struct *tsk)
- 108 {
- 109 struct nsproxy *old_ns = tsk->nsproxy;
- 110 struct nsproxy *new_ns;
- 111 int err = 0;
- 112
- 113 if (!old_ns)
- 114 return 0;
- 115
- 116 get_nsproxy(old_ns);
- 117
- 118 if (!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
- 119 CLONE_NEWPID | CLONE_NEWNET)))
- 120 return 0;
- 121
- 122 if (!capable(CAP_SYS_ADMIN)) {
- 123 err = -EPERM;
- 124 goto out;
- 125 }
- 126
- 127 /*
- 128 * CLONE_NEWIPC must detach from the undolist: after switching
- 129 * to a new ipc namespace, the semaphore arrays from the old
- 130 * namespace are unreachable. In clone parlance, CLONE_SYSVSEM
- 131 * means share undolist with parent, so we must forbid using
- 132 * it along with CLONE_NEWIPC.
- 133 */
- 134 if ((flags & CLONE_NEWIPC) && (flags & CLONE_SYSVSEM)) {
- 135 err = -EINVAL;
- 136 goto out;
- 137 }
- 138
- 139 new_ns = create_new_namespaces(flags, tsk, tsk->fs);
- 140 if (IS_ERR(new_ns)) {
- 141 err = PTR_ERR(new_ns);
- 142 goto out;
- 143 }
- 144
- 145 tsk->nsproxy = new_ns;
- 146
- 147 out:
- 148 put_nsproxy(old_ns);
- 149 return err;
- 150 }
1.如果clone_flags没有使用新命名空间标识，直接返回
2.根据clone_flags中使用新命名空间标识，创建新的命名空间；修改子进程的命名空间nsproxy为新命名空间
xv.复制子进程运行环境copy_thread
- /* arch/x86/kernel/process_32.c */
- 242 int copy_thread(unsigned long clone_flags, unsigned long sp,
- 243 unsigned long unused,
- 244 struct task_struct *p, struct pt_regs *regs)
- 245 {
- 246 struct pt_regs *childregs;
- 247 struct task_struct *tsk;
- 248 int err;
- 249
- 250 childregs = task_pt_regs(p);
- 251 *childregs = *regs;
- 252 childregs->ax = 0;
- 253 childregs->sp = sp;
- 254
- 255 p->thread.sp = (unsigned long) childregs;
- 256 p->thread.sp0 = (unsigned long) (childregs+1);
- 257
- 258 p->thread.ip = (unsigned long) ret_from_fork;
- 259
- 260 task_user_gs(p) = get_user_gs(regs);
- 261
- 262 tsk = current;
- 263 if (unlikely(test_tsk_thread_flag(tsk, TIF_IO_BITMAP))) {
- 264 p->thread.io_bitmap_ptr = kmemdup(tsk->thread.io_bitmap_ptr,
- 265 IO_BITMAP_BYTES, GFP_KERNEL);
- 266 if (!p->thread.io_bitmap_ptr) {
- 267 p->thread.io_bitmap_max = 0;
- 268 return -ENOMEM;
- 269 }
- 270 set_tsk_thread_flag(p, TIF_IO_BITMAP);
- 271 }
- 272
- 273 err = 0;
- 274
- 275 /*
- 276 * Set a new TLS for the child thread?
- 277 */
- 278 if (clone_flags & CLONE_SETTLS)
- 279 err = do_set_thread_area(p, -1,
- 280 (struct user_desc __user *)childregs->si, 0);
- 281
- 282 if (err && p->thread.io_bitmap_ptr) {
- 283 kfree(p->thread.io_bitmap_ptr);
- 284 p->thread.io_bitmap_max = 0;
- 285 }
- 286
- 287 clear_tsk_thread_flag(p, TIF_DS_AREA_MSR);
- 288 p->thread.ds_ctx = NULL;
- 289
- 290 clear_tsk_thread_flag(p, TIF_DEBUGCTLMSR);
- 291 p->thread.debugctlmsr = 0;
- 292
- 293 return err;
- 294 }
1.将父进程内核堆栈中保存的寄存器值，复制到子进程的内核堆栈中；以便子进程在fork返回时与原进程状态一致
2.设置子进程fork/vfork/clone返回值为0（系统调用返回值放在ax中）
3.设置子进程用户空间的堆栈；fork、vfork的父进程与子进程的堆栈值一样，因为他们使用不同的进程地址空间，所以不会存在冲突；
4.设置子进程的内核堆栈，因为子进程直接从fork返回，所以将栈顶设置成保存寄存器的起始位置
5.设置子进程被调用后从ret_from_fork开始执行
dup_task_struct及copy_thread之后进程描述符及内核堆栈，如下图所示：
xvi.alloc_pid
- /* kernel/pid.c */
- 245 struct pid *alloc_pid(struct pid_namespace *ns)
- 246 {
- 247 struct pid *pid;
- 248 enum pid_type type;
- 249 int i, nr;
- 250 struct pid_namespace *tmp;
- 251 struct upid *upid;
- 252
- 253 pid = kmem_cache_alloc(ns->pid_cachep, GFP_KERNEL);
- 254 if (!pid)
- 255 goto out;
- 256
- 257 tmp = ns;
- 258 for (i = ns->level; i >= 0; i--) {
- 259 nr = alloc_pidmap(tmp);
- 260 if (nr < 0)
- 261 goto out_free;
- 262
- 263 pid->numbers[i].nr = nr;
- 264 pid->numbers[i].ns = tmp;
- 265 tmp = tmp->parent;
- 266 }
- 267
- 268 get_pid_ns(ns);
- 269 pid->level = ns->level;
- 270 atomic_set(&pid->count, 1);
- 271 for (type = 0; type < PIDTYPE_MAX; ++type)
- 272 INIT_HLIST_HEAD(&pid->tasks[type]);
- 273
- 274 spin_lock_irq(&pidmap_lock);
- 275 for (i = ns->level; i >= 0; i--) {
- 276 upid = &pid->numbers[i];
- 277 hlist_add_head_rcu(&upid->pid_chain,
- 278 &pid_hash[pid_hashfn(upid->nr, upid->ns)]);
- 279 }
- 280 spin_unlock_irq(&pidmap_lock);
- 281
- 282 out:
- 283 return pid;
- 284
- 285 out_free:
- 286 while (++i <= ns->level)
- 287 free_pidmap(pid->numbers + i);
- 288
- 289 kmem_cache_free(ns->pid_cachep, pid);
- 290 pid = NULL;
- 291 goto out;
- 292 }
1.分配pid，从pidmap中查找空闲id，并赋给pid
2.将pid链入pid哈希表中，方便根据id打到进程描述符
pid分配如下图所示：
xvii.attach_pid
- /* kernel/pid.c */
- 315 /*
- 316 * attach_pid() must be called with the tasklist_lock write-held.
- 317 */
- 318 void attach_pid(struct task_struct *task, enum pid_type type,
- 319 struct pid *pid)
- 320 {
- 321 struct pid_link *link;
- 322
- 323 link = &task->pids[type];
- 324 link->pid = pid;
- 325 hlist_add_head_rcu(&link->node, &pid->tasks[type]);
- 326 }
1.取进程描述符中类型为type的pid_link
2.将link->pid置成pid
3.将link链入相应的pid中
下图表示进程添加到相应的进程、进程组、会话组后的关系：
|
