首页
登录 | 注册

内核线程函数kernel_thread解析

设备驱动程序中,如果需要几个并发执行的任务,可以启动内核线程,启动内核线程的函数为:<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />

  int kernel_thread (int ( * fn )( void * ), void * arg, unsigned long flags);

  kernel_thread函数的作用是产生一个新的线程

  内核线程实际上就是一个共享父进程地址空间的进程,它有自己的系统堆栈.

  内核线程和进程都是通过do_fork()函数来产生的,系统中规定的最大进程数与线程数由fork_init来决定:

  [/arch/kernel/process.c/fork_init()]

  void __init fork_init(unsigned long mempages)

  {

  #ifndef __HAVE_ARCH_TASK_STRUCT_ALLOCATOR

  #ifndef ARCH_MIN_TASKALIGN

  #define ARCH_MIN_TASKALIGN   L1_CACHE_BYTES

  #endif

  /* slab高速缓存中建立task_struct结构专用的缓冲区队列 */

  task_struct_cachep =

  kmem_cache_create("task_struct", sizeof(struct task_struct),

  ARCH_MIN_TASKALIGN, SLAB_PANIC, NULL, NULL);

  #endif

  /*

  把默认线程数设置到一个安全值,因为内核中总的线程占用的空间

  可能要内存一半还要多.

 

参数mempages系统中总的物理内存结构大小,它等于mempages/PAGESIZE.

  比如我机器的内存是<?xml:namespace prefix = st1 ns = "urn:schemas-microsoft-com:office:smarttags" />512m,那么在我的系统最多能同时产生线程数为

  (512*2^20/2^12) / 2^3 = 512*2^5 = 16384

  */

  max_threads = mempages / (8 * THREAD_SIZE / PAGE_SIZE);

  /*

  * 启动系统的时候至少需要20个线程

  */

  if(max_threads < 20)

  max_threads = 20;

  /*

  * 每个进程最多产生max_threads/2,也就是线程总数的一半,在我的机器上为8192.

  */

  init_task.signal->rlim[RLIMIT_NPROC].rlim_cur = max_threads/2;

  init_task.signal->rlim[RLIMIT_NPROC].rlim_max = max_threads/2;

  }

  kernel_thread原形在/arch/kernel/process.c.

  (*fn)(void *)为要执行的函数的指针,arg为函数参数,flagsdo_fork产生线程时的标志.

  int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags)

  {

  struct pt_regs regs;

  memset(&regs, 0, sizeof(regs));

  regs.ebx = (unsigned long) fn;   /* ebx指向函数地址 */

  regs.edx = (unsigned long) arg;   /* edx指向参数 */

  regs.xds = __USER_DS;

  regs.xes = __USER_DS;

  regs.orig_eax = -1;

  regs.eip = (unsigned long) kernel_thread_helper;

  regs.xcs = __KERNEL_CS;

  regs.eflags = X86_EFLAGS_IF | X86_EFLAGS_SF | X86_EFLAGS_PF | 0x2;

  /* 利用do_fork来产生一个新的线程,共享父进程地址空间,并且不允许调试子进程 */

  return do_fork(flags | CLONE_VM | CLONE_UNTRACED, 0, &regs, 0, NULL, NULL);

  }

  [/arch/i386/kernel/process.c/kernel_thread_helper]

  extern void kernel_thread_helper(void); /* 定义成全局变量 */

  __asm__(".section .text\n"

  ".align 4\n"

  "kernel_thread_helper:\n\t"

  "movl %edx,%eax\n\t"

  "pushl %edx\n\t"   /* edx指向参数,压入堆栈 */

  "call *%ebx\n\t"   /* ebx指向函数地址,执行函数 */

  "pushl %eax\n\t"

  "call do_exit\n"   /* 结束线程 */

  ".previous");

 

kernel_thread中调用了do_fork,那么do_fork是怎样转入kernel_thread_helper去执行的呢,继续跟踪下do_fork函数.

  [kernel/fork.c/do_fork()]

  long do_fork(unsigned long clone_flags,

  unsigned long stack_start,

  struct pt_regs *regs,

  unsigned long stack_size,

  int __user *parent_tidptr,

  int __user *child_tidptr)

  {

  ....

  ....

  p = copy_process(clone_flags, stack_start, regs, stack_size, parent_tidptr, child_tidptr, pid);

  ....

  ....

  }

 

它调用copy_process函数来向子进程拷贝父进程的进程环境和全部寄存器副本.

  [kernel/fork.c/do_fork()->copy_process]

  static task_t *copy_process(unsigned long clone_flags,

  unsigned long stack_start,

  struct pt_regs *regs,

  unsigned long stack_size,

  int __user *parent_tidptr,

  int __user *child_tidptr,

  int pid)

  {

  ...

  ...

  retval = copy_thread(0, clone_flags, stack_start, stack_size, p, regs);

  ...

  ...

  }

  它又调用copy_thread来拷贝父进程的系统堆栈并做相应的调整.

  [/arch/i386/kernel/process.c/copy_thread]:

  int copy_thread(int nr, unsigned long clone_flags, unsigned long esp,

  unsigned long unused,

  struct task_struct * p, struct pt_regs * regs)

  {

  ...

  ...

  p->thread.eip = (unsigned long) ret_from_fork;

  }

  在这里把ret_from_fork的地址赋值给p->thread.eip,p->thread.eip表示当进程下一次调度时的指令开始地址,

  所以当线程创建后被调度时,是从ret_from_fork地址处开始的.

  [/arch/i386/kernel/entry.s]

  到这里说明,新的线程已经产生了.

  ENTRY(ret_from_fork)

  pushl %eax

  call schedule_tail

  GET_THREAD_INFO(%ebp)

  popl %eax

  jmp syscall_exit

  syscall_exit:

  ...

  work_resched:

  call schedule

  ...

  当它从ret_from_fork退出时,会从堆栈中弹出原来保存的ip,而ip指向kernel_thread_helper,

  至此kernel_thread_helper被调用,它就可以运行我们的指定的函数了.

 

请注意在kernel_thread是如何调用系统调用的,我们知道kernel_thread是在内核中
调用,所以他是可以直接调用系统调用的,像sys_open()等

 

关于kernel的flags的标志,做如下记述:

 /*
* cloning flags:
*/
#define CSIGNAL        0x000000ff    /* signal mask to be sent at exit */
#define CLONE_VM    0x00000100    /* set if VM shared between processes */
#define CLONE_FS    0x00000200    /* set if fs info shared between processes */
#define CLONE_FILES    0x00000400    /* set if open files shared between processes */
#define CLONE_SIGHAND    0x00000800    /* set if signal handlers and blocked signals shared */
#define CLONE_IDLETASK    0x00001000    /* set if new pid should be 0 (kernel only)*/
#define CLONE_PTRACE    0x00002000    /* set if we want to let tracing continue on the child too */
#define CLONE_VFORK    0x00004000    /* set if the parent wants the child to wake it up on mm_release */
#define CLONE_PARENT    0x00008000    /* set if we want to have the same parent as the cloner */
#define CLONE_THREAD    0x00010000    /* Same thread group? */
#define CLONE_NEWNS    0x00020000    /* New namespace group? */
#define CLONE_SYSVSEM    0x00040000    /* share system V SEM_UNDO semantics */
#define CLONE_SETTLS    0x00080000    /* create a new TLS for the child */
#define CLONE_PARENT_SETTID    0x00100000    /* set the TID in the parent */
#define CLONE_CHILD_CLEARTID    0x00200000    /* clear the TID in the child */
#define CLONE_DETACHED        0x00400000    /* Unused, ignored */
#define CLONE_UNTRACED        0x00800000    /* set if the tracing process can’t force CLONE_PTRACE on this clone */
#define CLONE_CHILD_SETTID    0x01000000    /* set the TID in the child */
#define CLONE_STOPPED        0x02000000    /* Start in stopped state */
/*
* List of flags we want to share for kernel threads,
* if only because they are not used by them anyway.
*/
#define CLONE_KERNEL    (CLONE_FS | CLONE_FILES | CLONE_SIGHAND)
内核线程常用的flags就是CLONE_KERNEL。

<script>window._bd_share_config={"common":{"bdSnsKey":{},"bdText":"","bdMini":"2","bdMiniList":false,"bdPic":"","bdStyle":"0","bdSize":"16"},"share":{}};with(document)0[(getElementsByTagName('head')[0]||body).appendChild(createElement('script')).src='http://bdimg.share.baidu.com/static/api/js/share.js?v=89860593.js?cdnversion='+~(-new Date()/36e5)];</script>
阅读(3426) | 评论(0) | 转发(1) |
0linux内核中likely和unlikely的含义

下一篇:对netdev_priv的分析

相关热门文章
  • linux 常见服务端口
  • xmanager 2.0 for linux配置
  • 【ROOTFS搭建】busybox的httpd...
  • openwrt中luci学习笔记
  • 什么是shell
给主人留下些什么吧!~~
评论热议


2020 jeepxie.net webmaster#jeepxie.net
10 q. 0.010 s.
京ICP备10005923号