操作系统——内核级线程实现

末蓝、 2024-04-01 08:56 39阅读 0赞

**写在前面：**

**建议看原课件梳理！！！**

**一、内核级线程具体实现**

> **例（在这里printf("A")和printf("B")变为 exec(cmd1)和exec(cmd2)）：**
> 
> ![1fc6c814f2984443833bea4c1b0ad956.png][]
> 
> ![0e3a6bbe69014c9998e020bfea1029b2.png][]

**1. 正在执行int 0x80**

> ![832329ff0c3c4c34910fb2c04e73ffcb.png][]
> 
> **SS:SP、EFLAGS和 ret = 100都是通过 int0x80 硬件自动压栈**
> 
> ![a87bd4152a2041ee830af60652f4a0aa.png][]

**2.中断处理：system\_call**

> ![137658f0521040e69a190156bcf05bb3.png][]

**3.sys\_fork:CreateThread**

> ![f1125cfac4b445c9b7beea904a9653e3.png][]

**4.copy\_process:在执行子程序前的准备工作**

*  **申请内存空间；**
 *  **创建TCB(TSS：TASK\_STRUCT);**
 *  **创建内核栈和用户栈**
 *  **关联栈和TCB**

> ![7c110a77fbf64fa6bcac915bbcca075d.png][]
> 
> ![df6f642fc96d415b941db9c1d9a0ab10.png][]
> 
>  *  **fork和父进程共用用户栈**
>  *  **fork创建自己的内核栈**
> 
> **TASK\_STRUCT(TSS结构):**
> 
> ![d009f3bd8efd4dd6abe75d1631a60ec9.png][]
> 
>  *  **通过sys\_fork函数，执行子程序exec(cmd1)的准备工作已经完成，此时父进程未堵塞，执行：**
> 
>  **push %eax**
> 
>  **cmpl $0,counter(%eax)**
> 
>  **ret\_from\_sys\_call**
> 
> **未跳转执行子程序，****ret\_from\_sys\_call是恢复父进程执行现场，并通过iret回到用户栈，即int 0x80后面的执行程序！**
> 
> ![04db6cefbae54000a5a30e6e72a5c198.png][]
> 
>  *  **返回到父进程 100：mov %eax,res（即ret=100）处，此时res!=0，执行父进程；若res=0，即%eax被置为0时，执行子程序；**
>  *  **继续创建子程序exec(cmd2)执行前的准备工作（TSS和内核栈）****，放入就绪队列**
> 
> ![29cd725542f44ec68e3dbdb6492fc2f6.png][]
> 
> 至此，**exec(cmd1)和exec(cmd2)的TSS被初始化完成（即sys\_fork执行完毕）**
> 
> ![137658f0521040e69a190156bcf05bb3.png][]
> 
> 然后继续向下执行：
> 
>  **push %eax** 
> 
>  **mov1 \_current,%eax**
> 
>  **cmpl $0,state(%eax)**
> 
>  **jne reschedule**
> 
>  **cmpl $0,counter(%eax)**
> 
>  **jne reschedule**
> 
>  **ret\_from\_sys\_call**
> 
> 假设此时父进程发生堵塞（wait（）函数），则要执行子进程，即执行 **jne reschedule**

**5.进入子进程，父进程等待**

> ![e5973bfd092c4597bb1253ff9a0ef325.png][]
> 
>  *  **将 $ret\_from\_sys\_call压栈，方便后续从内核栈回到用户栈，恢复父进程执行现场**
>  *  **跳到schedule函数**
>     
>      *  **next = i //涉及到调度算法，即从就绪队列选择一个程序执行（exec(cmd1)和exec(cmd2)）**
>      *  **switch\_to（next） //线程切换,即父进程、exec(cmd1)和****exec(cmd2)互相切换**

**6.switch\_to：//线程切换**

> ![ae7fa490af134cd9a64677df47611b64.png][]

**7.执行子进程**

*  **首先通过system\_call调用 sys\_execve函数**
 *  **其次将%eax赋值为EIP+esp，即 %eax = esp+0x1C = 28，即原先返回父进程的地址（int0x80 后面的执行程序）** 
 *  **最后 eip\[0\] = ex.a\_entry，即将原先返回父进程的地址变为执行子程序的入口；eip\[3\] = p，即为栈顶SP**
 *  **此时，ret返回的地址从原来的父进程变为子程序的入口，再次返回到用户栈时，就变为执行子程序**

> ![f42cf28bfd134a46bbbf045dc884f163.png][]
> 
> ![ef06e229c6314336bcc6bfa5e9a86063.png][]

**二、内核级线程实现大致梳理**

*  **首先通过int 0x80进行中断进入内核，建立用户栈和内核栈的联系，并进行相应的中断处理（sys\_call）**
 *  **中断处理，引发切换（保护进程现场，判断进程状态从而决定是否切换进程）**
 *  **调用schedule函数选择要切换到的线程并调用switch\_to函数**
 *  **通过switch\_to函数完成相应TCB切换，即相应线程切换**
 *  **然后通过中断出口iret，完成内核栈到用户栈的二级转换**

> ![cd20ef014f9d4b8ebb314fcaad75fea9.png][]

参考文章：

[L12 内核级线程实现\_哔哩哔哩\_bilibili][L12 _bilibili]

[L13 操作系统之“树”\_哔哩哔哩\_bilibili][L13 _bilibili]

[1fc6c814f2984443833bea4c1b0ad956.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/a4f90eb5e59343cb8400cb24e6c561eb.png
[0e3a6bbe69014c9998e020bfea1029b2.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/21816231b72040f49f45d286994314f2.png
[832329ff0c3c4c34910fb2c04e73ffcb.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/a341a5cb1fd14ca4be239ac4770ee83c.png
[a87bd4152a2041ee830af60652f4a0aa.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/fd7fa19cb1fc449cb45124c16cd1b756.png
[137658f0521040e69a190156bcf05bb3.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/7bead4b26a574dd789e9047fc5e556a1.png
[f1125cfac4b445c9b7beea904a9653e3.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/65802256e94d4dcfa22e91bee0bb7427.png
[7c110a77fbf64fa6bcac915bbcca075d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/4d37d709c0a94369b34c35571c854aa8.png
[df6f642fc96d415b941db9c1d9a0ab10.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/ec6fd0cb7dc049cebd46c56928406a30.png
[d009f3bd8efd4dd6abe75d1631a60ec9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/5abcb79c23e94d429fe10334cb68b023.png
[04db6cefbae54000a5a30e6e72a5c198.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/928e9223474544a8a58c53f3fa56c3d9.png
[29cd725542f44ec68e3dbdb6492fc2f6.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/49ce92714d4043c6955129a31582b214.png
[e5973bfd092c4597bb1253ff9a0ef325.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/3e0ca8a6fbaf4929ab2de2614bf98394.png
[ae7fa490af134cd9a64677df47611b64.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/fc8b837d7b79409a9fee35c75f41e7e4.png
[f42cf28bfd134a46bbbf045dc884f163.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/3d91480615154fc6b56797aac7c86de9.png
[ef06e229c6314336bcc6bfa5e9a86063.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/026ec8f9db194bed98def0a3277e1345.png
[cd20ef014f9d4b8ebb314fcaad75fea9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/01/d3ca91d216b74f7882004ddf50c3e014.png
[L12 _bilibili]: https://www.bilibili.com/video/BV1d4411v7u7/?p=12
[L13 _bilibili]: https://www.bilibili.com/video/BV1d4411v7u7/?p=13