Linux内核源代码情景分析-exit()
执行完/bin/echo之后,会调动do_exit,销毁子进程:
我们还是先从系统调用exit()说起,先来看exit()的实现,进入到内核态执行sys_exit。
asmlinkage long sys_exit(int error_code)
{
do_exit((error_code&0xff)<< 8);
}
NORET_TYPE void do_exit(long code) { struct task_struct *tsk = current; if (in_interrupt())//中断服务不能中断 panic("Aiee, killing interrupt handler!"); if (!tsk->pid)//空转idle进程是不允许退出的 panic("Attempted to kill the idle task!"); if (tsk->pid == 1)//init进程是不允许退出的 panic("Attempted to kill init!"); tsk->flags |= PF_EXITING; del_timer_sync(&tsk->real_timer); fake_volatile: #ifdef CONFIG_BSD_PROCESS_ACCT acct_process(code); #endif __exit_mm(tsk);//如果通过指针共享,只是减少共享计数mm->mm_users。如果自立门户,则释放mm_struct,vm_struct;释放页目录表,页表 lock_kernel(); sem_exit();//信号相关,看完进程间通信再说 __exit_files(tsk);//如果通过指针共享,只是减少共享计数files->count。如果自立门户,那就要释放files_struct数据结构 __exit_fs(tsk);//如果通过指针共享,只是减少共享计数fs->count。如果自立门户,那就要释放fs_struct数据结构 exit_sighand(tsk);//如果通过指针共享,只是减少共享计数sig->count。如果自立门户,那就要释放signal_struct数据结构 exit_thread();//空函数 if (current->leader) disassociate_ctty(1); put_exec_domain(tsk->exec_domain); if (tsk->binfmt && tsk->binfmt->module) __MOD_DEC_USE_COUNT(tsk->binfmt->module); tsk->exit_code = code; exit_notify();//将当前进程设置为僵死状态;并给父进程发信号;其当前进程的子进程的父进程设置为init进程 schedule(); BUG(); /* * In order to get rid of the "volatile function does return" message * I did this little loop that confuses gcc to think do_exit really * is volatile. In fact it‘s schedule() that is volatile in some * circumstances: when current->state = ZOMBIE, schedule() never * returns. * * In fact the natural way to do all this is to have the label and the * goto right after each other, but I put the fake_volatile label at * the start of the function just in case something /really/ bad * happens, and the schedule returns. This way we can try again. I‘m * not paranoid: it‘s just that everybody is out to get me. */ goto fake_volatile; }
static inline void __exit_mm(struct task_struct * tsk) { struct mm_struct * mm = tsk->mm; mm_release(); if (mm) { atomic_inc(&mm->mm_count); if (mm != tsk->active_mm) BUG(); /* more a memory barrier than a real lock */ task_lock(tsk); tsk->mm = NULL; task_unlock(tsk); enter_lazy_tlb(mm, current, smp_processor_id()); mmput(mm);//主要是这句 } }
void mmput(struct mm_struct *mm) { if (atomic_dec_and_lock(&mm->mm_users, &mmlist_lock)) {//mm->mm_users为1 list_del(&mm->mmlist); spin_unlock(&mmlist_lock); exit_mmap(mm);//释放vm_struct,并把页目录表项和页表项都清0 mmdrop(mm);//释放mm_struct和页目录表,页表 } }
void exit_mmap(struct mm_struct * mm) { struct vm_area_struct * mpnt; release_segments(mm); spin_lock(&mm->page_table_lock); mpnt = mm->mmap; mm->mmap = mm->mmap_avl = mm->mmap_cache = NULL; spin_unlock(&mm->page_table_lock); mm->rss = 0; mm->total_vm = 0; mm->locked_vm = 0; while (mpnt) { struct vm_area_struct * next = mpnt->vm_next; unsigned long start = mpnt->vm_start; unsigned long end = mpnt->vm_end; unsigned long size = end - start; if (mpnt->vm_ops) { if (mpnt->vm_ops->close) mpnt->vm_ops->close(mpnt); } mm->map_count--; remove_shared_vm_struct(mpnt); flush_cache_range(mm, start, end); zap_page_range(mm, start, size); if (mpnt->vm_file) fput(mpnt->vm_file); kmem_cache_free(vm_area_cachep, mpnt); mpnt = next; } /* This is just debugging */ if (mm->map_count) printk("exit_mmap: map count is %d\n", mm->map_count); clear_page_tables(mm, FIRST_USER_PGD_NR, USER_PTRS_PER_PGD); }
static inline void mmdrop(struct mm_struct * mm) { if (atomic_dec_and_test(&mm->mm_count)) __mmdrop(mm); }
inline void __mmdrop(struct mm_struct *mm) { if (mm == &init_mm) BUG(); pgd_free(mm->pgd); destroy_context(mm); free_mm(mm); }
回到do_exit,继续执行__exit_files,子进程自立门户,释放files_struct数据结构,代码如下:
static inline void __exit_files(struct task_struct *tsk) { struct files_struct * files = tsk->files; if (files) { task_lock(tsk); tsk->files = NULL; task_unlock(tsk); put_files_struct(files); } }
void put_files_struct(struct files_struct *files) { if (atomic_dec_and_test(&files->count)) {//files->count为1 close_files(files); /* * Free the fd and fdset arrays if we expanded them. */ if (files->fd != &files->fd_array[0]) free_fd_array(files->fd, files->max_fds); if (files->max_fdset > __FD_SETSIZE) { free_fdset(files->open_fds, files->max_fdset); free_fdset(files->close_on_exec, files->max_fdset); } kmem_cache_free(files_cachep, files); } }
static inline void __exit_fs(struct task_struct *tsk) { struct fs_struct * fs = tsk->fs; if (fs) { task_lock(tsk); tsk->fs = NULL; task_unlock(tsk); __put_fs_struct(fs); } }
static inline void __put_fs_struct(struct fs_struct *fs) { /* No need to hold fs->lock if we are killing it */ if (atomic_dec_and_test(&fs->count)) {//fs->count为1 dput(fs->root); mntput(fs->rootmnt); dput(fs->pwd); mntput(fs->pwdmnt); if (fs->altroot) { dput(fs->altroot); mntput(fs->altrootmnt); } kmem_cache_free(fs_cachep, fs); } }
void exit_sighand(struct task_struct *tsk) { struct signal_struct * sig = tsk->sig; spin_lock_irq(&tsk->sigmask_lock); if (sig) { tsk->sig = NULL; if (atomic_dec_and_test(&sig->count))//sig->count为1 kmem_cache_free(sigact_cachep, sig); } tsk->sigpending = 0; flush_sigqueue(&tsk->pending); spin_unlock_irq(&tsk->sigmask_lock); }
static void exit_notify(void) { struct task_struct * p, *t; forget_original_parent(current);//其当前进程的子进程的父进程设置为init进程 /* * Check to see if any process groups have become orphaned * as a result of our exiting, and if they have any stopped * jobs, send them a SIGHUP and then a SIGCONT. (POSIX 3.2.2.2) * * Case i: Our father is in a different pgrp than we are * and we were the only connection outside, so our pgrp * is about to become orphaned. */ t = current->p_pptr;//通知的是p_pptr,在forget_original_parent设置的是p->p_opptr = reaper if ((t->pgrp != current->pgrp) && (t->session == current->session) && will_become_orphaned_pgrp(current->pgrp, current) && has_stopped_jobs(current->pgrp)) { kill_pg(current->pgrp,SIGHUP,1); kill_pg(current->pgrp,SIGCONT,1); } /* Let father know we died * * Thread signals are configurable, but you aren‘t going to use * that to send signals to arbitary processes. * That stops right now. * * If the parent exec id doesn‘t match the exec id we saved * when we started then we know the parent has changed security * domain. * * If our self_exec id doesn‘t match our parent_exec_id then * we have changed execution domain as these two values started * the same after a fork. * */ if(current->exit_signal != SIGCHLD && ( current->parent_exec_id != t->self_exec_id || current->self_exec_id != current->parent_exec_id) && !capable(CAP_KILL)) current->exit_signal = SIGCHLD;//给父进程发的信号是SIGCHLD /* * This loop does two things: * * A. Make init inherit all the child processes * B. Check to see if any process groups have become orphaned * as a result of our exiting, and if they have any stopped * jobs, send them a SIGHUP and then a SIGCONT. (POSIX 3.2.2.2) */ write_lock_irq(&tasklist_lock); current->state = TASK_ZOMBIE;//当前进程设置为僵死状态 do_notify_parent(current, current->exit_signal);//给父进程发信号 while (current->p_cptr != NULL) { p = current->p_cptr; current->p_cptr = p->p_osptr; p->p_ysptr = NULL; p->ptrace = 0; p->p_pptr = p->p_opptr;//这里,把p_pptr和p_opptr统一了,都是reaper p->p_osptr = p->p_pptr->p_cptr; if (p->p_osptr) p->p_osptr->p_ysptr = p; p->p_pptr->p_cptr = p; if (p->state == TASK_ZOMBIE) do_notify_parent(p, p->exit_signal); /* * process group orphan check * Case ii: Our child is in a different pgrp * than we are, and it was the only connection * outside, so the child pgrp is now orphaned. */ if ((p->pgrp != current->pgrp) && (p->session == current->session)) { int pgrp = p->pgrp; write_unlock_irq(&tasklist_lock); if (is_orphaned_pgrp(pgrp) && has_stopped_jobs(pgrp)) { kill_pg(pgrp,SIGHUP,1); kill_pg(pgrp,SIGCONT,1); } write_lock_irq(&tasklist_lock); } } write_unlock_irq(&tasklist_lock); }
static inline void forget_original_parent(struct task_struct * father) { struct task_struct * p, *reaper; read_lock(&tasklist_lock); /* Next in our thread group */ reaper = next_thread(father); if (reaper == father) reaper = child_reaper;//init进程 for_each_task(p) { if (p->p_opptr == father) { /* We dont want people slaying init */ p->exit_signal = SIGCHLD; p->self_exec_id++; p->p_opptr = reaper;//其当前进程的子进程的父进程设置为init进程,这里设置的p_opptr if (p->pdeath_signal) send_sig(p->pdeath_signal, p, 0); } } read_unlock(&tasklist_lock); }
void do_notify_parent(struct task_struct *tsk, int sig)//sig为SIGCHLD { struct siginfo info; int why, status; info.si_signo = sig; info.si_errno = 0; info.si_pid = tsk->pid; info.si_uid = tsk->uid; /* FIXME: find out whether or not this is supposed to be c*time. */ info.si_utime = tsk->times.tms_utime; info.si_stime = tsk->times.tms_stime; status = tsk->exit_code & 0x7f; why = SI_KERNEL; /* shouldn‘t happen */ switch (tsk->state) { case TASK_STOPPED: /* FIXME -- can we deduce CLD_TRAPPED or CLD_CONTINUED? */ if (tsk->ptrace & PT_PTRACED) why = CLD_TRAPPED; else why = CLD_STOPPED; break; default: if (tsk->exit_code & 0x80) why = CLD_DUMPED; else if (tsk->exit_code & 0x7f) why = CLD_KILLED; else { why = CLD_EXITED; status = tsk->exit_code >> 8; } break; } info.si_code = why; info.si_status = status; send_sig_info(sig, &info, tsk->p_pptr);//给父进程发送SIGCHLD信号 wake_up_parent(tsk->p_pptr);//唤醒父进程,父进程在wait时,将状态设置为TASK_INTERRUPTIBLE,现在设置为TASK_RUNNING }至此,进程的基本资源都已经释放了,但是当前进程的残骸仍旧占用着最低限度的资源,包括其task_struct数据结构和系统空间堆栈所在的两个页面。当前进程自己不释放这两个页面,就像人们自己并不在临终注销自己的户口一样,而是通知其父进程,让父进程料理后事。当前进程状态为 TASK_ZOMBIE,schedule时,无限延迟调度该进程。
下面,最后执行schedule,假设只有父进程和子进程,父进程的状态已经是TASK_RUNNING,切换到父进程继续执行。
#define switch_to(prev,next,last) do { asm volatile("pushl %%esi\n\t" \ //把esi存入现在进程prev的堆栈 "pushl %%edi\n\t" \ //把edi存入现在进程prev的堆栈 "pushl %%ebp\n\t" \ //把ebp存入现在进程prev的堆栈 "movl %%esp,%0\n\t" /* save ESP */ \ //现在进程prev的esp保存在prev->thread.esp "movl %3,%%esp\n\t" /* restore ESP */ \ //将要切换的进程next->thread.esp保存在esp中,堆栈已经切换了 "movl $1f,%1\n\t" /* save EIP */ \ //现在进程prev的eip(也就是"1:\t"地址)保存在prev->thread.eip "pushl %4\n\t" /* restore EIP */ \ //将要切换的进程next->thread.eip保存在eip中 "jmp __switch_to\n" \ //且不说__switch_to中干了些什么,当CPU执行到那里的ret指令时,由于是通过jmp指令转过去的,最后进入堆栈的next->thread.eip就变成了返回地址 "1:\t" \ //如果切换的不是子进程,next->thread.eip实际上就是上一次保存在prev->thread.eip,也就是这一行语句 "popl %%ebp\n\t" \ //由于堆栈已经切换过来,pop出的都是上面存入进程prev堆栈的内容 "popl %%edi\n\t" "popl %%esi\n\t" :"=m" (prev->thread.esp),"=m" (prev->thread.eip), "=b" (last) :"m" (next->thread.esp),"m" (next->thread.eip), "a" (prev), "d" (next), "b" (prev)); } while (0)父进程在sys_wait4等待,父进程从"1:\t"继续执行,继续执行sys_wait4函数。
郑重声明:本站内容如果来自互联网及其他传播媒体,其版权均属原媒体及文章作者所有。转载目的在于传递更多信息及用于网络分享,并不代表本站赞同其观点和对其真实性负责,也不构成任何其他建议。