8、理解进程调度时机跟踪分析进程调度与进程切换的过程

版权声明：本文为博主原创文章，未经博主允许不得转载。

姓名：周毅原创作品转载请注明出处 《Linux内核分析》MOOC课程http://mooc.study.163.com/course/USTC-1000029000

一、进程的切换

我们以前分析过中断的大致过程如下图：



而进程的切换过程就在如图所示中主要通过schedule来完成切换：

最一般的情况：正在运行的用户态进程X切换到运行用户态进程Y的过程：

1、正在运行的用户态进程X

2、发生中断——save cs:eip/esp/eflags(current) to kernel stack,then load cs:eip(entry of a specific ISR) and ss:esp(point to kernel stack).

3、SAVE_ALL //保存现场

4、中断处理过程中或中断返回前调用了schedule()，其中的switch_to做了关键的进程上下文切换

5、标号1之后开始运行用户态进程Y(这里Y曾经通过以上步骤被切换出去过因此可以从标号1继续执行)

6、restore_all //恢复现场

7、iret - pop cs:eip/ss:esp/eflags from kernel stack

8、继续运行用户态进程Y

几种特殊情况：

1、通过中断处理过程中的调度时机，用户态进程与内核线程之间互相切换和内核线程之间互相切换，与最一般的情况非常类似，只是内核线程运行过程中发生中断没有进程用户态和内核态的转换；

2、内核线程主动调用schedule()，只有进程上下文的切换，没有发生中断上下文的切换，与最一般的情况略简略；

3、创建子进程的系统调用在子进程中的执行起点及返回用户态，如fork；

4、加载一个新的可执行程序后返回到用户态的情况，如execve；

二、schedule()分析

要知道进程切换做了什么，我们就需要分析schedule()做了什么：

sechedule定义在linux-3.18.6/kernel/sched/core.c中：

asmlinkage __visible void __sched schedule(void)
{
struct task_struct *tsk = current;//当前进程地址

sched_submit_work(tsk);//提交调度工作
__schedule();//执行调度
}

可以看到，通过__schedule()执行调度，代码如下（主要过程是我注释的那几行）：

static void __sched __schedule(void)
{
struct task_struct *prev, *next;
unsigned long *switch_count;
struct rq *rq;
int cpu;

need_resched:
preempt_disable();
cpu = smp_processor_id();
rq = cpu_rq(cpu);
rcu_note_context_switch(cpu);
prev = rq->curr;

schedule_debug(prev);

if (sched_feat(HRTICK))
hrtick_clear(rq);

/*
* Make sure that signal_pending_state()->signal_pending() below
* can't be reordered with __set_current_state(TASK_INTERRUPTIBLE)
* done by the caller to avoid the race with signal_wake_up().
*/
smp_mb__before_spinlock();
raw_spin_lock_irq(&rq->lock);

switch_count = &prev->nivcsw;
if (prev->state && !(preempt_count() & PREEMPT_ACTIVE)) {
if (unlikely(signal_pending_state(prev->state, prev))) {
prev->state = TASK_RUNNING;
} else {
deactivate_task(rq, prev, DEQUEUE_SLEEP);
prev->on_rq = 0;

/*
* If a worker went to sleep, notify and ask workqueue
* whether it wants to wake up a task to maintain
* concurrency.
*/
if (prev->flags & PF_WQ_WORKER) {
struct task_struct *to_wakeup;

to_wakeup = wq_worker_sleeping(prev, cpu);
if (to_wakeup)
try_to_wake_up_local(to_wakeup);
}
}
switch_count = &prev->nvcsw;
}

if (task_on_rq_queued(prev) || rq->skip_clock_update < 0)
update_rq_clock(rq);

next = pick_next_task(rq, prev);//进程调度算法都封装这个函数内部
clear_tsk_need_resched(prev);
clear_preempt_need_resched();
rq->skip_clock_update = 0;

if (likely(prev != next)) {
rq->nr_switches++;
rq->curr = next;
++*switch_count;

context_switch(rq, prev, next); /* unlocks the rq 进程上下文的切换*/
/*
* The context switch have flipped the stack from under us
* and restored the local variables which were saved when
* this task called schedule() in the past. prev == current
* is still correct, but it can be moved to another cpu/rq.
*/
cpu = smp_processor_id();
rq = cpu_rq(cpu);
} else
raw_spin_unlock_irq(&rq->lock);

post_schedule(rq);

sched_preempt_enable_no_resched();
if (need_resched())
goto need_resched;
}

主要通过这两句进行切换：

next = pick_next_task(rq, prev);//进程调度算法都封装这个函数内部

context_switch(rq, prev, next);//进程上下文切换

我们主要看看进程上下文切换的context_switch函数：

static inline void
context_switch(struct rq *rq, struct task_struct *prev,
struct task_struct *next)
{
struct mm_struct *mm, *oldmm;//地址空间

prepare_task_switch(rq, prev, next);//任务切换准备工作

mm = next->mm;//修改地址空间
oldmm = prev->active_mm;
/*
* For paravirt, this is coupled with an exit in switch_to to
* combine the page table reload and the switch backend into
* one hypercall.
*/
arch_start_context_switch(prev);

if (!mm) {
next->active_mm = oldmm;
atomic_inc(&oldmm->mm_count);
enter_lazy_tlb(oldmm, next);
} else
switch_mm(oldmm, mm, next);//地址空间切换

if (!prev->mm) {
prev->active_mm = NULL;
rq->prev_mm = oldmm;
4000

}
/*
* Since the runqueue lock will be released by the next
* task (which is an invalid locking op but in the case
* of the scheduler it's an obvious special-case), so we
* do an early lockdep release here:
*/
spin_release(&rq->lock.dep_map, 1, _THIS_IP_);

context_tracking_task_switch(prev, next);
/* Here we just switch the register state and the stack. */
switch_to(prev, next, prev);  //进行切换

barrier();
/*
* this_rq must be evaluated again because prev may have moved
* CPUs since it called schedule(), thus the 'rq' on its stack
* frame will be invalid.
*/
finish_task_switch(this_rq(), prev);
}

上述过程主要完成了地址空间的切换和一些准备工作，然后进入switch_to进行进程上下文切换，switch_to是一个宏定义，定义在linux-3.18.6/arch/x86/include/asm/switch_to.h中：

#define switch_to(prev, next, last)                 \
do {                                    \
/*                              \
* Context-switching clobbers all registers, so we clobber  \
* them explicitly, via unused output variables.        \
* (EAX and EBP is not listed because EBP is saved/restored \
* explicitly for wchan access and EAX is the return value of   \
* __switch_to())                       \
*/                             \
unsigned long ebx, ecx, edx, esi, edi;              \
\
asm volatile(
"pushfl\n\t"        /* save    flags */ \
"pushl %%ebp\n\t"      /* save    EBP   */ \
"movl %%esp,%[prev_sp]\n\t"    /* save    ESP   */ \
"movl %[next_sp],%%esp\n\t"    /* restore ESP   */ \
"movl $1f,%[prev_ip]\n\t" /* save    EIP   */ \
"pushl %[next_ip]\n\t" /* restore EIP   */ \
__switch_canary                    \
"jmp __switch_to\n"    /* regparm call  */ \
"1:\t"                     \
"popl %%ebp\n\t"       /* restore EBP   */ \
"popfl\n"          /* restore flags */ \
\
/* output parameters */                \
: [prev_sp] "=m" (prev->thread.sp),        \
[prev_ip] "=m" (prev->thread.ip),        \
"=a" (last),                 \
\
/* clobbered output registers: */        \
"=b" (ebx), "=c" (ecx), "=d" (edx),      \
"=S" (esi), "=D" (edi)               \
\
__switch_canary_oparam               \
\
/* input parameters: */              \
: [next_sp]  "m" (next->thread.sp),        \
[next_ip]  "m" (next->thread.ip),        \
\
/* regparm parameters for __switch_to(): */  \
[prev]     "a" (prev),               \
[next]     "d" (next)                \
\
__switch_canary_iparam               \
\
: /* reloaded segment registers */         \
"memory");                  \
} while (0)

我们主要分析这段汇编代码：

其中：

[next_sp] “m” (next->thread.sp)//next_sp字符串表示next->thread.sp

[next_ip] “m” (next->thread.ip)//next_ip字符串表示next->thread.ip

[prev] “a” (prev), //prev进程

[next] “d” (next) //next进程

那么分析过程如下：

“pushfl\n\t” /* 保存flags*/

“pushl %%ebp\n\t” /* 保存prev栈底ebp */ \

“movl %%esp,%[prev_sp]\n\t” /* 保存prev栈顶esp */ \

“movl %[next_sp],%%esp\n\t” /* 恢复next->sp到栈顶esp中 */ \

“movl $1f,%[prev_ip]\n\t” /* 保存1:地址到prev->ip中，实际上是当进程切换回到prev时，从1:处开始执行 */ \

“pushl %[next_ip]\n\t” /* 恢复next->ip，实际上是将next进程的运行地址压栈 */ \

__switch_canary \

“jmp __switch_to\n” /跳转到__switch_to函数处执行 / \

“1:\t” \

“popl %%ebp\n\t” /* 恢复 EBP */ \

“popfl\n” /* 恢复 flags */ \

实际上上述过程主要是prev进程的进程堆栈寄存器和运行断点的保存，然后切换至next进程的堆栈寄存器和断点，而__switch_to函数主要做了一些硬件环境的切换，至此schedule函数的主要过程执行完毕，然后通过中断的Iret恢复执行next进程。