Yanyg - SAN Software Engineer

LINUX内核进程创建分析

目录

1 函数跟踪

几乎所有的工作都由 copy_process 完成。

kernel/fork.c:

SYSCALL_DEFINE0(fork)
{
        return _do_fork(SIGCHLD, 0, 0, NULL, NULL, 0);
}
SYSCALL_DEFINE0(vfork)
{
        return _do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD, 0,
                        0, NULL, NULL, 0);
}
SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp,
                 int __user *, parent_tidptr,
                 int __user *, child_tidptr,
                 unsigned long, tls)
{
        return _do_fork(clone_flags, newsp, 0, parent_tidptr, child_tidptr, tls);
}

clone/fork
└─ do_fork
     copy_process
     dd_latent_entropy(void) // Randomize Entrypy
     init_completion depends on flags
     wake_up_new_task(struct task_struct *p)
     wait_for_vfork_done

copy_process
├─ flags check
├─ dup_task_struct(struct task_struct *orig, int node)
│   ├─ alloc_thread_stack_node(struct task_struct *tsk, int node)
│   ├─ setup_thread_stack(struct task_struct *p, struct task_struct *org)
│   ├─ clear_user_return_notifier(struct task_struct *p)
│   ├─ clear_tsk_need_resched(struct task_struct *tsk)
│   ├─ setup_thread_stack(struct task_struct *p, struct task_struct *org)
│     // Notes: set stack end to 0x57AC6E9D for overflow detection   ├─ tsk->stack_canary = get_random_canary(); // randomize 0-255 bytes   ├─ account_kernel_stack(struct task_struct *tsk, int account)
│     // Notes: Update page statistics   └─ kcov_task_init(struct task_struct *t) // coverage
├─ ftrace_graph_init_task(struct task_struct *t) // Function Tracer
├─ rt_mutex_init_task(struct task_struct *p)
├─ copy_creds(struct task_struct *p, unsigned long clone_flags)
├─ delayacct_tsk_init(struct task_struct *tsk)
├─ rcu_copy_process(struct task_struct *p)
├─ init_sigpending(struct sigpending *sig)
├─ misc accounts init ...
├─ sched_fork(unsigned long clone_flags, struct task_struct *p)
├─ copy files, fs, sighand, signal, mm, ns, io, tls, init tracer
└─ uprobe_copy_process(struct task_struct *t, unsigned long flags)