版权声明：本文为博主原创文章，未经博主允许不得转载。
目录(?)[-]
应用层怎样使用fork and execve
fork的返回值怎样区分0pid
fork系统调用的入口参数来自哪里
how to implement do_fork
copy_process
How to check the kernel stack correctivity
How to set the new process entry
new process entry point
sys_execve
对elf 格式文件而言
应用层怎样使用fork and execve
/**************************************************************************/
main()
{
int ret_from_fork,mypid;
mypid = getPid();
printf("before:my pid is d%\n",mypid);
ret_from_fork = fork();
/*该方法返回生成的子进程的进程id号。用于复制出一个进程后，他们都运行到同样的地方，
*所以父进程中的ret_from_fork的值是id值，而不时初值0，
*而子进程的ret_from_fork却没有获得值，还是0.通过这样就可以区别两个进程改变两个进程的走向
**/
switch(ret_from_fork){
case -1:
perror(" fork failed");
exit(1);
/*以下就是子进程要执行的代码，他调用exec载入用户输入的命令指定的程序，
*清除进程空间执行用户指定的程序
**/
case 0:
execvp(arglist[0],arglist);//arglist[0]中指定用户想执行的命令名。
perror("execvp failed");
exit(1);
default:
while(wait(&exitstatus)!=ret_from_fork);
/*shell程序，等待子进程运行结束后，再接受用户输入*/
}
}
fork的返回值怎样区分0/pid
/*
*用户空间fork函数调用时，返回的0也不是内核的do_fork返回的，do_fork只会返回新进程的pid，
*而 fork的0返回值是内核在ret_from_fork之后进入用户空间前RESTORE_ALL的时候pop到eax中的，
*然后库实现的fork将 eax作为返回值;
*实际上，fork的子进程在进入用户空间前从来不经过do_fork这条路，可以看看它的thread的eip是 ret_from_fork，
*也就是只要开始运行子进程，就在switch_to中会执行ret_from_fork，而从ret_from_fork顺 着看，
*一直就到了RESTORE_ALL从 而返回用户空间
**/
fork系统调用的入口，参数来自哪里？
入口参数保存在当前的内核栈中：结构为struct pt_regs
系统调用的入口：
arch/arm/kernel/entry-common.S
sys_fork_wrapper:
add r0, sp, #S_OFF
b sys_fork
ENDPROC(sys_fork_wrapper)
crash> dis sys_fork_wrapper
0xc000e800 <sys_fork_wrapper>: add r0, sp, #8
0xc000e804 <sys_fork_wrapper+4>: b 0xc0011d28 <sys_fork>
arch/arm/kernel/sys_arm.c
/* Fork a new task - this creates a new program thread.
* This is called indirectly via a small wrapper
*/
asmlinkage int sys_fork(struct pt_regs *regs)
{
#ifdef CONFIG_MMU
return do_fork(SIGCHLD, regs->ARM_sp, regs, 0, NULL, NULL);
#else
/* can not support in nommu mode */
return(-EINVAL);
#endif
}
crash> dis sys_fork
0xc0011d28 <sys_fork>: mov r12, sp
0xc0011d2c <sys_fork+4>: push {r11, r12, lr, pc}
0xc0011d30 <sys_fork+8>: sub r11, r12, #4
0xc0011d34 <sys_fork+12>: sub sp, sp, #8
0xc0011d38 <sys_fork+16>: mov r12, #0
0xc0011d3c <sys_fork+20>: mov r1, r0
0xc0011d40 <sys_fork+24>: ldr r1, [r1, #52] ; 0x34
0xc0011d44 <sys_fork+28>: mov r2, r0
0xc0011d48 <sys_fork+32>: mov r3, r12
0xc0011d4c <sys_fork+36>: mov r0, #17
0xc0011d50 <sys_fork+40>: str r12, [sp]
0xc0011d54 <sys_fork+44>: str r12, [sp, #4]
0xc0011d58 <sys_fork+48>: bl 0xc0027550 <do_fork>
0xc0011d5c <sys_fork+52>: sub sp, r11, #12
0xc0011d60 <sys_fork+56>: ldm sp, {r11, sp, pc}
/**************************************************************/
/arch/arm/kernel/entry-header.s
@
@ Most of the stack format comes from struct pt_regs, but with
@ the addition of 8 bytes for storing syscall args 5 and 6.
@ This _must_ remain a multiple of 8 for EABI.
@
#define S_OFF 8
/**************************************************************/
/arch/arm/include/asm/ptrace.h
/*
* This struct defines the way the registers are stored on the
* stack during a system call. Note that sizeof(struct pt_regs)
* has to be a multiple of 8.
*/
struct pt_regs {
unsigned long uregs[18];
};
#define ARM_cpsr uregs[16]
#define ARM_pc uregs[15]
#define ARM_lr uregs[14]
#define ARM_sp uregs[13]
#define ARM_ip uregs[12]/*?*/
#define ARM_fp uregs[11]/*frame point*/
#define ARM_r10 uregs[10]
#define ARM_r9 uregs[9]
#define ARM_r8 uregs[8]
#define ARM_r7 uregs[7]
#define ARM_r6 uregs[6]
#define ARM_r5 uregs[5]
#define ARM_r4 uregs[4]
#define ARM_r3 uregs[3]
#define ARM_r2 uregs[2]
#define ARM_r1 uregs[1]
#define ARM_r0 uregs[0]
#define ARM_ORIG_r0 uregs[17]
how to implement do_fork
/**************************************************************/
do_fork(SIGCHLD, regs->ARM_sp, regs, 0, NULL, NULL);
/*
* Ok, this is the main fork-routine.
*
* It copies the process, and if successful kick-starts
* it and waits for it to finish using the VM if required.
*/
long do_fork(unsigned long clone_flags,
unsigned long stack_start,
struct pt_regs *regs,
unsigned long stack_size,
int __user *parent_tidptr,
int __user *child_tidptr)
{
struct task_struct *p;
int trace = 0;
long nr;
p = copy_process(clone_flags, stack_start, regs, stack_size,
child_tidptr, NULL, trace);
/*
* Do this prior waking up the new thread - the thread pointer
* might get invalid after that point, if the thread exits quickly.
*/
if (!IS_ERR(p)) {
nr = task_pid_vnr(p);
wake_up_new_task(p);
}
return nr;
}
copy_process
/*
* This creates a new process as a copy of the old one,
* but does not actually start it yet.
*
* It copies the registers, and all the appropriate
* parts of the process environment (as per the clone
* flags). The actual kick-off is left to the caller.
*/
static struct task_struct *copy_process(unsigned long clone_flags,
unsigned long stack_start,
struct pt_regs *regs,
unsigned long stack_size,
int __user *child_tidptr,
struct pid *pid,
int trace)
{/*分配了相关结构体的memory;并用原来的赋值*/
struct task_struct *p;
p = dup_task_struct(current);
----
/* Perform scheduler related setup. Assign this task to a CPU. */
sched_fork(p);
retval = perf_event_init_task(p);
if (retval)
goto bad_fork_cleanup_policy;
retval = audit_alloc(p);
if (retval)
goto bad_fork_cleanup_policy;
/* copy all the process information */
retval = copy_semundo(clone_flags, p);
if (retval)
goto bad_fork_cleanup_audit;
retval = copy_files(clone_flags, p);
if (retval)
goto bad_fork_cleanup_semundo;
retval = copy_fs(clone_flags, p);
if (retval)
goto bad_fork_cleanup_files;
retval = copy_sighand(clone_flags, p);
if (retval)
goto bad_fork_cleanup_fs;
retval = copy_signal(clone_flags, p);
if (retval)
goto bad_fork_cleanup_sighand;
retval = copy_mm(clone_flags, p);
if (retval)
goto bad_fork_cleanup_signal;
retval = copy_namespaces(clone_flags, p);
if (retval)
goto bad_fork_cleanup_mm;
retval = copy_io(clone_flags, p);
if (retval)
goto bad_fork_cleanup_namespaces;
retval = copy_thread(clone_flags, stack_start, stack_size, p, regs);
}
static struct task_struct *dup_task_struct(struct task_struct *orig)
{
struct task_struct *tsk;
struct thread_info *ti;
unsigned long *stackend;
int node = tsk_fork_get_node(orig);
int err;
/*分配了memory for task_struct and thread_info*/
tsk = alloc_task_struct_node(node);
if (!tsk)
return NULL;
ti = alloc_thread_info_node(tsk, node);
if (!ti) {
free_task_struct(tsk);
return NULL;
}
/*
int arch_dup_task_struct(struct task_struct *dst,
struct task_struct *src)
{
*dst = *src;
return 0;
}
*/
err = arch_dup_task_struct(tsk, orig);
if (err)
goto out;
tsk->stack = ti;
setup_thread_stack(tsk, orig);
clear_user_return_notifier(tsk);
clear_tsk_need_resched(tsk);
stackend = end_of_stack(tsk);
*stackend = STACK_END_MAGIC; /* for overflow detection */
/*
* One for us, one for whoever does the "release_task()" (usually
* parent)
*/
atomic_set(&tsk->usage, 2);
tsk->splice_pipe = NULL;
account_kernel_stack(ti, 1);
return tsk;
out:
free_thread_info(ti);
free_task_struct(tsk);
return NULL;
}
How to check the kernel stack correctivity
static inline unsigned long *end_of_stack(struct task_struct *p)
{
return (unsigned long *)(task_thread_info(p) + 1);
}
#define STACK_END_MAGIC 0x57AC6E9D
COMMAND: "dwc_otg"
TASK: ee1a3420 [THREAD_INFO: ee1c6000]
CPU: 0
STATE: TASK_INTERRUPTIBLE
crash> thread_info ee1c6000
struct thread_info {
flags = 0,
preempt_count = 1,
addr_limit = 0,
task = 0xee1a3420,
crash> struct task_struct.stack 0xee1a3420
stack = 0xee1c6000
crash> bt -r
PID: 760 TASK: ee1a3420 CPU: 0 COMMAND: "dwc_otg"
ee1c6000: 00000000 00000001 00000000 ee1a3420
ee1c6010: default_exec_domain 00000000 00000015 ee1a3420
ee1c6020: c0f88420 init_task ee1c6000 00000000
ee1c6030: 00000001 init_mm ee1c7f5c ee1c7f18
ee1c6040: __schedule+1412 00000000 00000000 00000000
ee1c6050: 00000000 00000000 00000000 00000000
ee1c6060: 00000000 00000000 00000000 00000000
ee1c6070: 00000000 00000000 00000000 00000000
ee1c6080: 00000000 00000000 00000000 00000000
ee1c6090: 00000000 00000000 00000000 00000000
ee1c60a0: 00000000 00000000 00000000 00000000
ee1c60b0: 00000000 00000000 00000000 00000000
ee1c60c0: 00000000 00000000 00000000 00000000
ee1c60d0: 00000000 00000000 00000000 00000000
ee1c60e0: 00000000 00000000 00000000 00000000
ee1c60f0: 00000000 00000000 00000000 00000000
ee1c6100: 00000000 00000000 00000000 00000000
ee1c6110: 00000000 00000000 00000000 00000000
ee1c6120: 00000000 00000000 00000000 00000000
ee1c6130: 00000000 00000000 00000000 00000000
ee1c6140: 00000000 00000000 00000000 00000000
ee1c6150: 00000000 00000000 00000000 00000000
ee1c6160: 00000000 00000000 00000000 00000000
ee1c6170: 00000000 00000000 00000000 00000000
ee1c6180: 00000000 00000000 00000000 00000000
ee1c6190: 00000000 00000000 00000000 00000000
ee1c61a0: 00000000 00000000 00000000 00000000
ee1c61b0: 00000000 00000000 00000000 00000000
ee1c61c0: 00000000 00000000 00000000 00000000
ee1c61d0: 00000000 00000000 00000000 00000000
ee1c61e0: 00000000 00000000 00000000 00000000
ee1c61f0: 00000000 00000000 00000000 00000000
ee1c6200: 00000000 00000000 00000000 00000000
ee1c6210: 00000000 00000000 00000000 00000000
ee1c6220: 00000000 00000000 00000000 00000000
ee1c6230: 00000000 00000000 00000000 00000000
ee1c6240: 00000000 00000000 00000000 00000000
ee1c6250: 00000000 00000000 00000000 00000000
ee1c6260: 00000000 00000000 00000000 00000000
ee1c6270: 00000000 00000000 00000000 00000000
ee1c6280: 00000000 00000000 00000000 00000000
ee1c6290: 00000000 00000000 00000000 00000000
ee1c62a0: 00000000 00000000 00000000 00000000
ee1c62b0: 00000000 00000000 00000000 00000000
ee1c62c0: 00000000 00000000 do_no_restart_syscall 00000000
ee1c62d0: 00000000 00000000 00000000 00000000
ee1c62e0: 00000000 00000000 00000000 00000000
ee1c62f0: 57ac6e9d/*STACK_END_MAGIC*/
asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
How to set the new process entry
int
copy_thread(unsigned long clone_flags, unsigned long stack_start,
unsigned long stk_sz, struct task_struct *p, struct pt_regs *regs)
{
struct thread_info *thread = task_thread_info(p);
struct pt_regs *childregs = task_pt_regs(p);
*childregs = *regs;
childregs->ARM_r0 = 0;
childregs->ARM_sp = stack_start;
memset(&thread->cpu_context, 0, sizeof(struct cpu_context_save));
thread->cpu_context.sp = (unsigned long)childregs;
thread->cpu_context.pc = (unsigned long)ret_from_fork;
clear_ptrace_hw_breakpoint(p);
if (clone_flags & CLONE_SETTLS)
thread->tp_value = regs->ARM_r3;
thread_notify(THREAD_NOTIFY_COPY, thread);
return 0;
}
/*8K内核栈的最后是 struct pt_regs
*对它进行赋值：返回到用户空间后使用的栈，返回地址
**/
#define task_pt_regs(p) \
((struct pt_regs *)(THREAD_START_SP + task_stack_page(p)) - 1)
/*
* low level task data that entry.S needs immediate access to.
* __switch_to() assumes cpu_context follows immediately after cpu_domain.
*/
crash> struct thread_info -o
struct thread_info {
[0] unsigned long flags;
[4] int preempt_count;
[8] mm_segment_t addr_limit;
[12] struct task_struct *task;
[16] struct exec_domain *exec_domain;
[20] __u32 cpu;
[24] __u32 cpu_domain;
[28] struct cpu_context_save cpu_context;
[76] __u32 syscall;
[80] __u8 used_cp[16];
[96] unsigned long tp_value;
[100] struct crunch_state crunchstate;
[288] union fp_state fpstate;
[432] union vfp_state vfpstate;
[712] struct restart_block restart_block;
}
new process entry point
/*
* This is how we return from a fork.
*/
ENTRY(ret_from_fork)
bl schedule_tail
get_thread_info tsk
ldr r1, [tsk, #TI_FLAGS] @ check for syscall tracing
mov why, #1
tst r1, #_TIF_SYSCALL_WORK @ are we tracing syscalls?
beq ret_slow_syscall
mov r1, sp
mov r0, #1 @ trace exit [IP = 1]
bl syscall_trace
b ret_slow_syscall
ENDPROC(ret_from_fork)
sys_execve
/**************************************************************/
arch/arm/kernel/sys_arm.c
/* sys_execve() executes a new program.
* This is called indirectly via a small wrapper
*/
asmlinkage int sys_execve(const char __user *filenamei,
const char __user *const __user *argv,
const char __user *const __user *envp, struct pt_regs *regs)
{
int error;
char * filename;
filename = getname(filenamei);
error = PTR_ERR(filename);
if (IS_ERR(filename))
goto out;
error = do_execve(filename, argv, envp, regs);
putname(filename);
out:
return error;
}
int do_execve(const char *filename,
const char __user *const __user *__argv,
const char __user *const __user *__envp,
struct pt_regs *regs)
{
struct user_arg_ptr argv = { .ptr.native = __argv };
struct user_arg_ptr envp = { .ptr.native = __envp };
return do_execve_common(filename, argv, envp, regs);
}
/**************************************************************/
/*
* sys_execve() executes a new program.
*/
static int do_execve_common(const char *filename,
struct user_arg_ptr argv,
struct user_arg_ptr envp,
struct pt_regs *regs)
{
struct linux_binprm *bprm;
struct file *file;
bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
file = open_exec(filename);
sched_exec();
bprm->file = file;
bprm->filename = filename;
bprm->interp = filename;
bprm_mm_init(bprm);
bprm->argc = count(argv, MAX_ARG_STRINGS);
bprm->envc = count(envp, MAX_ARG_STRINGS);
prepare_binprm(bprm);
search_binary_handler(bprm,regs);
}
/*
* Create a new mm_struct and populate it with a temporary stack
* vm_area_struct. We don't have enough context at this point to set the stack
* flags, permissions, and offset, so we use temporary values. We'll update
* them later in setup_arg_pages().
*/
int bprm_mm_init(struct linux_binprm *bprm)
{
int err;
struct mm_struct *mm = NULL;
/*mm_struct*/
bprm->mm = mm = mm_alloc();
/*vma_struct*/
err = __bprm_mm_init(bprm);
return 0;
}
/*
* cycle the list of binary formats handler, until one recognizes the image
*/
int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
{
struct linux_binfmt *fmt;
list_for_each_entry(fmt, &formats, lh)
int (*fn)(struct linux_binprm *, struct pt_regs *) = fmt->load_binary;
fn(bprm, regs);
}
对elf 格式文件而言
fs/binfmt_elf.c
static struct linux_binfmt elf_format = {
.module = THIS_MODULE,
.load_binary = load_elf_binary,
.load_shlib = load_elf_library,
.core_dump = elf_core_dump,
.min_coredump = ELF_EXEC_PAGESIZE,
};
static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
{
----
kernel_read();
start_thread(regs, elf_entry, bprm->p);
}
#define start_thread(regs,pc,sp) \
({ \
unsigned long *stack = (unsigned long *)sp; \
memset(regs->uregs, 0, sizeof(regs->uregs)); \
if (current->personality & ADDR_LIMIT_32BIT) \
regs->ARM_cpsr = USR_MODE; \
else \
regs->ARM_cpsr = USR26_MODE; \
if (elf_hwcap & HWCAP_THUMB && pc & 1) \
regs->ARM_cpsr |= PSR_T_BIT; \
regs->ARM_cpsr |= PSR_ENDSTATE; \
regs->ARM_pc = pc & ~1; /* pc */ \
regs->ARM_sp = sp; /* sp */ \
regs->ARM_r2 = stack[2]; /* r2 (envp) */ \
regs->ARM_r1 = stack[1]; /* r1 (argv) */ \
regs->ARM_r0 = stack[0]; /* r0 (argc) */ \
})
总结：当运行execve时已经运行新创建的进程，不是说在old进程中加载后，再运行新进程的。
版权声明：本文为博主原创文章，未经博主允许不得转载。
- How to check the kernel stack correctivity
- How to set the new process entry
- new process entry point
/**************************************************************************/
main()
{
int ret_from_fork,mypid;
mypid = getPid();
printf("before:my pid is d%\n",mypid);
ret_from_fork = fork();
/*该方法返回生成的子进程的进程id号。用于复制出一个进程后，他们都运行到同样的地方，
*所以父进程中的ret_from_fork的值是id值，而不时初值0，
*而子进程的ret_from_fork却没有获得值，还是0.通过这样就可以区别两个进程改变两个进程的走向
**/
switch(ret_from_fork){
case -1:
perror(" fork failed");
exit(1);
/*以下就是子进程要执行的代码，他调用exec载入用户输入的命令指定的程序，
*清除进程空间执行用户指定的程序
**/
case 0:
execvp(arglist[0],arglist);//arglist[0]中指定用户想执行的命令名。
perror("execvp failed");
exit(1);
default:
while(wait(&exitstatus)!=ret_from_fork);
/*shell程序，等待子进程运行结束后，再接受用户输入*/
}
}
fork的返回值怎样区分0/pid
/*
*用户空间fork函数调用时，返回的0也不是内核的do_fork返回的，do_fork只会返回新进程的pid，
*而 fork的0返回值是内核在ret_from_fork之后进入用户空间前RESTORE_ALL的时候pop到eax中的，
*然后库实现的fork将 eax作为返回值;
*实际上，fork的子进程在进入用户空间前从来不经过do_fork这条路，可以看看它的thread的eip是 ret_from_fork，
*也就是只要开始运行子进程，就在switch_to中会执行ret_from_fork，而从ret_from_fork顺 着看，
*一直就到了RESTORE_ALL从 而返回用户空间
**/
入口参数保存在当前的内核栈中：结构为struct pt_regs
系统调用的入口：
arch/arm/kernel/entry-common.S
sys_fork_wrapper:
add r0, sp, #S_OFF
b sys_fork
ENDPROC(sys_fork_wrapper)
crash> dis sys_fork_wrapper
0xc000e800 <sys_fork_wrapper>: add r0, sp, #8
0xc000e804 <sys_fork_wrapper+4>: b 0xc0011d28 <sys_fork>
arch/arm/kernel/sys_arm.c
/* Fork a new task - this creates a new program thread.
* This is called indirectly via a small wrapper
*/
asmlinkage int sys_fork(struct pt_regs *regs)
{
#ifdef CONFIG_MMU
return do_fork(SIGCHLD, regs->ARM_sp, regs, 0, NULL, NULL);
#else
/* can not support in nommu mode */
return(-EINVAL);
#endif
}
crash> dis sys_fork
0xc0011d28 <sys_fork>: mov r12, sp
0xc0011d2c <sys_fork+4>: push {r11, r12, lr, pc}
0xc0011d30 <sys_fork+8>: sub r11, r12, #4
0xc0011d34 <sys_fork+12>: sub sp, sp, #8
0xc0011d38 <sys_fork+16>: mov r12, #0
0xc0011d3c <sys_fork+20>: mov r1, r0
0xc0011d40 <sys_fork+24>: ldr r1, [r1, #52] ; 0x34
0xc0011d44 <sys_fork+28>: mov r2, r0
0xc0011d48 <sys_fork+32>: mov r3, r12
0xc0011d4c <sys_fork+36>: mov r0, #17
0xc0011d50 <sys_fork+40>: str r12, [sp]
0xc0011d54 <sys_fork+44>: str r12, [sp, #4]
0xc0011d58 <sys_fork+48>: bl 0xc0027550 <do_fork>
0xc0011d5c <sys_fork+52>: sub sp, r11, #12
0xc0011d60 <sys_fork+56>: ldm sp, {r11, sp, pc}
/**************************************************************/
/arch/arm/kernel/entry-header.s
@
@ Most of the stack format comes from struct pt_regs, but with
@ the addition of 8 bytes for storing syscall args 5 and 6.
@ This _must_ remain a multiple of 8 for EABI.
@
#define S_OFF 8
/**************************************************************/
/arch/arm/include/asm/ptrace.h
/*
* This struct defines the way the registers are stored on the
* stack during a system call. Note that sizeof(struct pt_regs)
* has to be a multiple of 8.
*/
struct pt_regs {
unsigned long uregs[18];
};
#define ARM_cpsr uregs[16]
#define ARM_pc uregs[15]
#define ARM_lr uregs[14]
#define ARM_sp uregs[13]
#define ARM_ip uregs[12]/*?*/
#define ARM_fp uregs[11]/*frame point*/
#define ARM_r10 uregs[10]
#define ARM_r9 uregs[9]
#define ARM_r8 uregs[8]
#define ARM_r7 uregs[7]
#define ARM_r6 uregs[6]
#define ARM_r5 uregs[5]
#define ARM_r4 uregs[4]
#define ARM_r3 uregs[3]
#define ARM_r2 uregs[2]
#define ARM_r1 uregs[1]
#define ARM_r0 uregs[0]
#define ARM_ORIG_r0 uregs[17]
how to implement do_fork
/**************************************************************/
do_fork(SIGCHLD, regs->ARM_sp, regs, 0, NULL, NULL);
/*
* Ok, this is the main fork-routine.
*
* It copies the process, and if successful kick-starts
* it and waits for it to finish using the VM if required.
*/
long do_fork(unsigned long clone_flags,
unsigned long stack_start,
struct pt_regs *regs,
unsigned long stack_size,
int __user *parent_tidptr,
int __user *child_tidptr)
{
struct task_struct *p;
int trace = 0;
long nr;
p = copy_process(clone_flags, stack_start, regs, stack_size,
child_tidptr, NULL, trace);
/*
* Do this prior waking up the new thread - the thread pointer
* might get invalid after that point, if the thread exits quickly.
*/
if (!IS_ERR(p)) {
nr = task_pid_vnr(p);
wake_up_new_task(p);
}
return nr;
}
copy_process
/*
* This creates a new process as a copy of the old one,
* but does not actually start it yet.
*
* It copies the registers, and all the appropriate
* parts of the process environment (as per the clone
* flags). The actual kick-off is left to the caller.
*/
static struct task_struct *copy_process(unsigned long clone_flags,
unsigned long stack_start,
struct pt_regs *regs,
unsigned long stack_size,
int __user *child_tidptr,
struct pid *pid,
int trace)
{/*分配了相关结构体的memory;并用原来的赋值*/
struct task_struct *p;
p = dup_task_struct(current);
----
/* Perform scheduler related setup. Assign this task to a CPU. */
sched_fork(p);
retval = perf_event_init_task(p);
if (retval)
goto bad_fork_cleanup_policy;
retval = audit_alloc(p);
if (retval)
goto bad_fork_cleanup_policy;
/* copy all the process information */
retval = copy_semundo(clone_flags, p);
if (retval)
goto bad_fork_cleanup_audit;
retval = copy_files(clone_flags, p);
if (retval)
goto bad_fork_cleanup_semundo;
retval = copy_fs(clone_flags, p);
if (retval)
goto bad_fork_cleanup_files;
retval = copy_sighand(clone_flags, p);
if (retval)
goto bad_fork_cleanup_fs;
retval = copy_signal(clone_flags, p);
if (retval)
goto bad_fork_cleanup_sighand;
retval = copy_mm(clone_flags, p);
if (retval)
goto bad_fork_cleanup_signal;
retval = copy_namespaces(clone_flags, p);
if (retval)
goto bad_fork_cleanup_mm;
retval = copy_io(clone_flags, p);
if (retval)
goto bad_fork_cleanup_namespaces;
retval = copy_thread(clone_flags, stack_start, stack_size, p, regs);
}
static struct task_struct *dup_task_struct(struct task_struct *orig)
{
struct task_struct *tsk;
struct thread_info *ti;
unsigned long *stackend;
int node = tsk_fork_get_node(orig);
int err;
/*分配了memory for task_struct and thread_info*/
tsk = alloc_task_struct_node(node);
if (!tsk)
return NULL;
ti = alloc_thread_info_node(tsk, node);
if (!ti) {
free_task_struct(tsk);
return NULL;
}
/*
int arch_dup_task_struct(struct task_struct *dst,
struct task_struct *src)
{
*dst = *src;
return 0;
}
*/
err = arch_dup_task_struct(tsk, orig);
if (err)
goto out;
tsk->stack = ti;
setup_thread_stack(tsk, orig);
clear_user_return_notifier(tsk);
clear_tsk_need_resched(tsk);
stackend = end_of_stack(tsk);
*stackend = STACK_END_MAGIC; /* for overflow detection */
/*
* One for us, one for whoever does the "release_task()" (usually
* parent)
*/
atomic_set(&tsk->usage, 2);
tsk->splice_pipe = NULL;
account_kernel_stack(ti, 1);
return tsk;
out:
free_thread_info(ti);
free_task_struct(tsk);
return NULL;
}
How to check the kernel stack correctivity
static inline unsigned long *end_of_stack(struct task_struct *p)
{
return (unsigned long *)(task_thread_info(p) + 1);
}
#define STACK_END_MAGIC 0x57AC6E9D
COMMAND: "dwc_otg"
TASK: ee1a3420 [THREAD_INFO: ee1c6000]
CPU: 0
STATE: TASK_INTERRUPTIBLE
crash> thread_info ee1c6000
struct thread_info {
flags = 0,
preempt_count = 1,
addr_limit = 0,
task = 0xee1a3420,
crash> struct task_struct.stack 0xee1a3420
stack = 0xee1c6000
crash> bt -r
PID: 760 TASK: ee1a3420 CPU: 0 COMMAND: "dwc_otg"
ee1c6000: 00000000 00000001 00000000 ee1a3420
ee1c6010: default_exec_domain 00000000 00000015 ee1a3420
ee1c6020: c0f88420 init_task ee1c6000 00000000
ee1c6030: 00000001 init_mm ee1c7f5c ee1c7f18
ee1c6040: __schedule+1412 00000000 00000000 00000000
ee1c6050: 00000000 00000000 00000000 00000000
ee1c6060: 00000000 00000000 00000000 00000000
ee1c6070: 00000000 00000000 00000000 00000000
ee1c6080: 00000000 00000000 00000000 00000000
ee1c6090: 00000000 00000000 00000000 00000000
ee1c60a0: 00000000 00000000 00000000 00000000
ee1c60b0: 00000000 00000000 00000000 00000000
ee1c60c0: 00000000 00000000 00000000 00000000
ee1c60d0: 00000000 00000000 00000000 00000000
ee1c60e0: 00000000 00000000 00000000 00000000
ee1c60f0: 00000000 00000000 00000000 00000000
ee1c6100: 00000000 00000000 00000000 00000000
ee1c6110: 00000000 00000000 00000000 00000000
ee1c6120: 00000000 00000000 00000000 00000000
ee1c6130: 00000000 00000000 00000000 00000000
ee1c6140: 00000000 00000000 00000000 00000000
ee1c6150: 00000000 00000000 00000000 00000000
ee1c6160: 00000000 00000000 00000000 00000000
ee1c6170: 00000000 00000000 00000000 00000000
ee1c6180: 00000000 00000000 00000000 00000000
ee1c6190: 00000000 00000000 00000000 00000000
ee1c61a0: 00000000 00000000 00000000 00000000
ee1c61b0: 00000000 00000000 00000000 00000000
ee1c61c0: 00000000 00000000 00000000 00000000
ee1c61d0: 00000000 00000000 00000000 00000000
ee1c61e0: 00000000 00000000 00000000 00000000
ee1c61f0: 00000000 00000000 00000000 00000000
ee1c6200: 00000000 00000000 00000000 00000000
ee1c6210: 00000000 00000000 00000000 00000000
ee1c6220: 00000000 00000000 00000000 00000000
ee1c6230: 00000000 00000000 00000000 00000000
ee1c6240: 00000000 00000000 00000000 00000000
ee1c6250: 00000000 00000000 00000000 00000000
ee1c6260: 00000000 00000000 00000000 00000000
ee1c6270: 00000000 00000000 00000000 00000000
ee1c6280: 00000000 00000000 00000000 00000000
ee1c6290: 00000000 00000000 00000000 00000000
ee1c62a0: 00000000 00000000 00000000 00000000
ee1c62b0: 00000000 00000000 00000000 00000000
ee1c62c0: 00000000 00000000 do_no_restart_syscall 00000000
ee1c62d0: 00000000 00000000 00000000 00000000
ee1c62e0: 00000000 00000000 00000000 00000000
ee1c62f0: 57ac6e9d/*STACK_END_MAGIC*/
asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
How to set the new process entry
int
copy_thread(unsigned long clone_flags, unsigned long stack_start,
unsigned long stk_sz, struct task_struct *p, struct pt_regs *regs)
{
struct thread_info *thread = task_thread_info(p);
struct pt_regs *childregs = task_pt_regs(p);
*childregs = *regs;
childregs->ARM_r0 = 0;
childregs->ARM_sp = stack_start;
memset(&thread->cpu_context, 0, sizeof(struct cpu_context_save));
thread->cpu_context.sp = (unsigned long)childregs;
thread->cpu_context.pc = (unsigned long)ret_from_fork;
clear_ptrace_hw_breakpoint(p);
if (clone_flags & CLONE_SETTLS)
thread->tp_value = regs->ARM_r3;
thread_notify(THREAD_NOTIFY_COPY, thread);
return 0;
}
/*8K内核栈的最后是 struct pt_regs
*对它进行赋值：返回到用户空间后使用的栈，返回地址
**/
#define task_pt_regs(p) \
((struct pt_regs *)(THREAD_START_SP + task_stack_page(p)) - 1)
/*
* low level task data that entry.S needs immediate access to.
* __switch_to() assumes cpu_context follows immediately after cpu_domain.
*/
crash> struct thread_info -o
struct thread_info {
[0] unsigned long flags;
[4] int preempt_count;
[8] mm_segment_t addr_limit;
[12] struct task_struct *task;
[16] struct exec_domain *exec_domain;
[20] __u32 cpu;
[24] __u32 cpu_domain;
[28] struct cpu_context_save cpu_context;
[76] __u32 syscall;
[80] __u8 used_cp[16];
[96] unsigned long tp_value;
[100] struct crunch_state crunchstate;
[288] union fp_state fpstate;
[432] union vfp_state vfpstate;
[712] struct restart_block restart_block;
}
new process entry point
/*
* This is how we return from a fork.
*/
ENTRY(ret_from_fork)
bl schedule_tail
get_thread_info tsk
ldr r1, [tsk, #TI_FLAGS] @ check for syscall tracing
mov why, #1
tst r1, #_TIF_SYSCALL_WORK @ are we tracing syscalls?
beq ret_slow_syscall
mov r1, sp
mov r0, #1 @ trace exit [IP = 1]
bl syscall_trace
b ret_slow_syscall
ENDPROC(ret_from_fork)
sys_execve
/**************************************************************/
arch/arm/kernel/sys_arm.c
/* sys_execve() executes a new program.
* This is called indirectly via a small wrapper
*/
asmlinkage int sys_execve(const char __user *filenamei,
const char __user *const __user *argv,
const char __user *const __user *envp, struct pt_regs *regs)
{
int error;
char * filename;
filename = getname(filenamei);
error = PTR_ERR(filename);
if (IS_ERR(filename))
goto out;
error = do_execve(filename, argv, envp, regs);
putname(filename);
out:
return error;
}
int do_execve(const char *filename,
const char __user *const __user *__argv,
const char __user *const __user *__envp,
struct pt_regs *regs)
{
struct user_arg_ptr argv = { .ptr.native = __argv };
struct user_arg_ptr envp = { .ptr.native = __envp };
return do_execve_common(filename, argv, envp, regs);
}
/**************************************************************/
/*
* sys_execve() executes a new program.
*/
static int do_execve_common(const char *filename,
struct user_arg_ptr argv,
struct user_arg_ptr envp,
struct pt_regs *regs)
{
struct linux_binprm *bprm;
struct file *file;
bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
file = open_exec(filename);
sched_exec();
bprm->file = file;
bprm->filename = filename;
bprm->interp = filename;
bprm_mm_init(bprm);
bprm->argc = count(argv, MAX_ARG_STRINGS);
bprm->envc = count(envp, MAX_ARG_STRINGS);
prepare_binprm(bprm);
search_binary_handler(bprm,regs);
}
/*
* Create a new mm_struct and populate it with a temporary stack
* vm_area_struct. We don't have enough context at this point to set the stack
* flags, permissions, and offset, so we use temporary values. We'll update
* them later in setup_arg_pages().
*/
int bprm_mm_init(struct linux_binprm *bprm)
{
int err;
struct mm_struct *mm = NULL;
/*mm_struct*/
bprm->mm = mm = mm_alloc();
/*vma_struct*/
err = __bprm_mm_init(bprm);
return 0;
}
/*
* cycle the list of binary formats handler, until one recognizes the image
*/
int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
{
struct linux_binfmt *fmt;
list_for_each_entry(fmt, &formats, lh)
int (*fn)(struct linux_binprm *, struct pt_regs *) = fmt->load_binary;
fn(bprm, regs);
}
对elf 格式文件而言
fs/binfmt_elf.c
static struct linux_binfmt elf_format = {
.module = THIS_MODULE,
.load_binary = load_elf_binary,
.load_shlib = load_elf_library,
.core_dump = elf_core_dump,
.min_coredump = ELF_EXEC_PAGESIZE,
};
static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
{
----
kernel_read();
start_thread(regs, elf_entry, bprm->p);
}
#define start_thread(regs,pc,sp) \
({ \
unsigned long *stack = (unsigned long *)sp; \
memset(regs->uregs, 0, sizeof(regs->uregs)); \
if (current->personality & ADDR_LIMIT_32BIT) \
regs->ARM_cpsr = USR_MODE; \
else \
regs->ARM_cpsr = USR26_MODE; \
if (elf_hwcap & HWCAP_THUMB && pc & 1) \
regs->ARM_cpsr |= PSR_T_BIT; \
regs->ARM_cpsr |= PSR_ENDSTATE; \
regs->ARM_pc = pc & ~1; /* pc */ \
regs->ARM_sp = sp; /* sp */ \
regs->ARM_r2 = stack[2]; /* r2 (envp) */ \
regs->ARM_r1 = stack[1]; /* r1 (argv) */ \
regs->ARM_r0 = stack[0]; /* r0 (argc) */ \
})
总结：当运行execve时已经运行新创建的进程，不是说在old进程中加载后，再运行新进程的。
