kernel_thread函数简单分析

r囧r小猫 2022-08-24 05:24 198阅读 0赞

[http://hi.baidu.com/wzt85/blog/item/c1f7b75515bc01c1b645ae17.html][http_hi.baidu.com_wzt85_blog_item_c1f7b75515bc01c1b645ae17.html]

<table style="TABLE-LAYOUT: fixed"> 
 <tbody> 
 <tr> 
 <td> 
 <div>
 kernel_thread函数的作用是产生一个新的线程 
 
 内核线程实际上就是一个共享父进程地址空间的进程,它有自己的系统堆栈. 
 
 内核线程和进程都是通过do_fork()函数来产生的，系统中规定的最大进程数与 
 线程数由fork_init来决定: 
 
 [/arch/kernel/process.c/fork_init()] 
 void __init fork_init(unsigned long mempages) 
 { 
 #ifndef __HAVE_ARCH_TASK_STRUCT_ALLOCATOR 
 #ifndef ARCH_MIN_TASKALIGN 
 #define ARCH_MIN_TASKALIGN&nbsp;&nbsp; L1_CACHE_BYTES 
 #endif 
 &nbsp;&nbsp; /* 在slab高速缓存中建立task_struct结构专用的缓冲区队列 */ 
 &nbsp;&nbsp; task_struct_cachep = 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp; kmem_cache_create("task_struct", sizeof(struct task_struct), 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; ARCH_MIN_TASKALIGN, SLAB_PANIC, NULL, NULL); 
 #endif 
 
 &nbsp;&nbsp; /* 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 把默认线程数设置到一个安全值,因为内核中总的线程占用的空间 
 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 可能要内存一半还要多. 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 参数mempages系统中总的物理内存结构大小，它等于mempages/PAGESIZE. 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 比如我机器的内存是512m，那么在我的系统最多能同时产生线程数为&nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp; 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp; (512*2^20/2^12) / 2^3 = 512*2^5 = 16384 
 &nbsp;&nbsp; */ 
 &nbsp;&nbsp; max_threads = mempages / (8 * THREAD_SIZE / PAGE_SIZE); 
 
 &nbsp;&nbsp; /* 
 &nbsp;&nbsp; * 启动系统的时候至少需要20个线程 
 &nbsp;&nbsp; */ 
 &nbsp;&nbsp; if(max_threads &lt; 20) 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp; max_threads = 20; 
 
 &nbsp;&nbsp; /* 
 &nbsp;&nbsp; * 每个进程最多产生max_threads/2,也就是线程总数的一半,在我的机器上为8192. 
 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; */ 
 &nbsp;&nbsp; init_task.signal-&gt;rlim[RLIMIT_NPROC].rlim_cur = max_threads/2; 
 &nbsp;&nbsp; init_task.signal-&gt;rlim[RLIMIT_NPROC].rlim_max = max_threads/2; 
 } 
 
 kernel_thread原形在/arch/kernel/process.c中. 
 (*fn)(void *)为要执行的函数的指针,arg为函数参数，flags为do_fork产生线程时的标志. 
 
 int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags) 
 { 
 &nbsp;&nbsp; struct pt_regs regs; 
 
 &nbsp;&nbsp; memset(&amp;regs, 0, sizeof(regs)); 
 
 &nbsp;&nbsp; regs.ebx = (unsigned long) fn;&nbsp;&nbsp; /* ebx指向函数地址 */ 
 &nbsp;&nbsp; regs.edx = (unsigned long) arg;&nbsp;&nbsp; /* edx指向参数 */ 
 
 &nbsp;&nbsp; regs.xds = __USER_DS; 
 &nbsp;&nbsp; regs.xes = __USER_DS; 
 &nbsp;&nbsp; regs.orig_eax = -1; 
 &nbsp;&nbsp; regs.eip = (unsigned long) kernel_thread_helper; 
 &nbsp;&nbsp; regs.xcs = __KERNEL_CS; 
 &nbsp;&nbsp; regs.eflags = X86_EFLAGS_IF | X86_EFLAGS_SF | X86_EFLAGS_PF | 0x2; 
 
 &nbsp;&nbsp; /* 利用do_fork来产生一个新的线程,共享父进程地址空间,并且不允许调试子进程 */ 
 &nbsp;&nbsp; return do_fork(flags | CLONE_VM | CLONE_UNTRACED, 0, &amp;regs, 0, NULL, NULL); 
 } 
 
 [/arch/i386/kernel/process.c/kernel_thread_helper] 
 
 extern void kernel_thread_helper(void); /* 定义成全局变量 */ 
 __asm__(".section .text/n" 
 &nbsp;&nbsp; ".align 4/n" 
 &nbsp;&nbsp; "kernel_thread_helper:/n/t" 
 &nbsp;&nbsp; "movl %edx,%eax/n/t" 
 &nbsp;&nbsp; "pushl %edx/n/t"&nbsp;&nbsp; /* edx指向参数,压入堆栈 */ 
 &nbsp;&nbsp; "call *%ebx/n/t"&nbsp;&nbsp; /* ebx指向函数地址,执行函数 */ 
 &nbsp;&nbsp; "pushl %eax/n/t" 
 &nbsp;&nbsp; "call do_exit/n"&nbsp;&nbsp; /* 结束线程 */ 
 &nbsp;&nbsp; ".previous"); 
 
 在kernel_thread中调用了do_fork，那么do_fork是怎样转入kernel_thread_helper去执行的呢，继续跟踪下do_fork函数. 
 
 [kernel/fork.c/do_fork()] 
 
 long do_fork(unsigned long clone_flags, 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; unsigned long stack_start, 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; struct pt_regs *regs, 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; unsigned long stack_size, 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; int __user *parent_tidptr, 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; int __user *child_tidptr) 
 { 
 .... 
 .... 
 &nbsp;&nbsp; p = copy_process(clone_flags, stack_start, regs, stack_size, parent_tidptr, child_tidptr, pid); 
 .... 
 .... 
 } 
 
 
 它调用copy_process函数来向子进程拷贝父进程的进程环境和全部寄存器副本. 
 [kernel/fork.c/do_fork()-&gt;copy_process] 
 
 static task_t *copy_process(unsigned long clone_flags, 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; unsigned long stack_start, 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; struct pt_regs *regs, 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; unsigned long stack_size, 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; int __user *parent_tidptr, 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; int __user *child_tidptr, 
 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; int pid) 
 { 
 ... 
 ... 
 retval = copy_thread(0, clone_flags, stack_start, stack_size, p, regs); 
 ... 
 ... 
 } 
 
 它又调用copy_thread来拷贝父进程的系统堆栈并做相应的调整. 
 [/arch/i386/kernel/process.c/copy_thread]: 
 
 int copy_thread(int nr, unsigned long clone_flags, unsigned long esp, 
 &nbsp;&nbsp; unsigned long unused, 
 &nbsp;&nbsp; struct task_struct * p, struct pt_regs * regs) 
 { 
 ... 
 ... 
 &nbsp;&nbsp; p-&gt;thread.eip = (unsigned long) ret_from_fork; 
 } 
 在这里把ret_from_fork的地址赋值给p-&gt;thread.eip,p-&gt;thread.eip表示当进程下一次调度时的指令开始地址， 
 所以当线程创建后被调度时，是从ret_from_fork地址处开始的. 
 
 [/arch/i386/kernel/entry.s] 
 
 到这里说明，新的线程已经产生了. 
 ENTRY(ret_from_fork) 
 &nbsp;&nbsp; pushl %eax 
 &nbsp;&nbsp; call schedule_tail 
 &nbsp;&nbsp; GET_THREAD_INFO(%ebp) 
 &nbsp;&nbsp; popl %eax 
 &nbsp;&nbsp; jmp syscall_exit 
 
 syscall_exit: 
 ... 
 work_resched: 
 &nbsp;&nbsp; call schedule 
 ... 
 当它从ret_from_fork退出时，会从堆栈中弹出原来保存的ip，而ip指向kernel_thread_helper, 
 至此kernel_thread_helper被调用，它就可以运行我们的指定的函数了. 
 </div></td> 
 </tr> 
 </tbody> 
</table>

[http_hi.baidu.com_wzt85_blog_item_c1f7b75515bc01c1b645ae17.html]: http://hi.baidu.com/wzt85/blog/item/c1f7b75515bc01c1b645ae17.html