进程切换之奥秘解析

学号：SA12**6112

前面一篇博文分析了进程从用户态切换到内核态时，内核所做的主要的事，本文将研究在进程切换时，内核所做的事。

在内核态，进程切换主要分两步：

1：切换页全局目录

2：切换内核堆栈和硬件上下文

 

用prev指向被替换进程的表述符，next指向被激活进程的描述符

下面分析进程切换的第二步

第二步主要由switch_to宏实现：

3.3内核中X86体系下：/arch/x86/include/asm/system.h文件的第48行处：

 48 #define switch_to(prev, next, last)                                     \

 49 do {                                                                    \

 50         /*                                                              \

 51          * Context-switching clobbers all registers, so we clobber      \

 52          * them explicitly, via unused output variables.                \

 53          * (EAX and EBP is not listed because EBP is saved/restored     \

 54          * explicitly for wchan access and EAX is the return value of   \

 55          * __switch_to())                                               \

 56          */                                                             \

 57         unsigned long ebx, ecx, edx, esi, edi;                          \

 58                                                                         \

 59         asm volatile("pushfl\n\t"               /* save    flags */     \

 60                      "pushl %%ebp\n\t"          /* save    EBP   */     \

 61                      "movl %%esp,%[prev_sp]\n\t"        /* save    ESP   */ \

 62                      "movl %[next_sp],%%esp\n\t"        /* restore ESP   */ \

 63                      "movl $1f,%[prev_ip]\n\t"  /* save    EIP   */     \

 64                      "pushl %[next_ip]\n\t"     /* restore EIP   */     \

 65                      __switch_canary                                    \

 66                      "jmp __switch_to\n"        /* regparm call  */     \

 67                      "1:\t"                                             \

 68                      "popl %%ebp\n\t"           /* restore EBP   */     \

 69                      "popfl\n"                  /* restore flags */     \

 70                                                                         \

 71                      /* output parameters */                            \

 72                      : [prev_sp] "=m" (prev->thread.sp),                \

 73                        [prev_ip] "=m" (prev->thread.ip),                \

 74                        "=a" (last),                                     \

 75                                                                         \

 76                        /* clobbered output registers: */                \

 77                        "=b" (ebx), "=c" (ecx), "=d" (edx),              \

 78                        "=S" (esi), "=D" (edi)                           \

 79                                                                         \

 80                        __switch_canary_oparam                           \

 81                                                                         \

 82                        /* input parameters: */                          \

 83                      : [next_sp]  "m" (next->thread.sp),                \

 84                        [next_ip]  "m" (next->thread.ip),                \

 85                                                                         \

 86                        /* regparm parameters for __switch_to(): */      \

 87                        [prev]     "a" (prev),                           \

 88                        [next]     "d" (next)                            \

 89                                                                         \

 90                        __switch_canary_iparam                           \

 91                                                                         \

 92                      : /* reloaded segment registers */                 \

 93                         "memory");                                      \

 94 } while (0)

 

一：由上面的代码可以看出，切换内核堆栈主要工作是：

1：把eflags和ebp寄存器保存到prev内核栈中。

2：把esp保存到prev->thread.sp中，eip保存到prev->thread.ip中。

3：把next指向的新进程的thread.esp保存到esp中，把next->thread.ip保存到eip中

至此已经完成了内核堆栈的切换。

 

二：切换内核堆栈之后，TSS段也要相应的改变：

这是因为对于linux系统来说同一个CPU上所有的进程共用一个TSS，进程切换了，因此TSS需要随之改变。

linux系统中主要从两个方面用到了TSS：

(1)任何进程从用户态陷入内核态都必须从TSS获得内核堆栈指针

(2)用户态读写IO需要访问TSS的权限位图。

所以在进程切换时也要更新TSS中的esp0和IO权位图的值，这主要在_switch_to函数中完成：

3.3内核X86体系下：/arch/x86/kernel/process_32.c文件中第296行处：

296 __notrace_funcgraph struct task_struct *

297 __switch_to(struct task_struct *prev_p, struct task_struct *next_p)

298 {

299         struct thread_struct *prev = &prev_p->thread,

300                                  *next = &next_p->thread;

301         int cpu = smp_processor_id();

302         struct tss_struct *tss = &per_cpu(init_tss, cpu);

303         fpu_switch_t fpu;

304 

305         /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */

306 

307         fpu = switch_fpu_prepare(prev_p, next_p, cpu);

308 

309         /*

310          * Reload esp0.

311          */

312         load_sp0(tss, next);

313 

314         /*

315          * Save away %gs. No need to save %fs, as it was saved on the

316          * stack on entry.  No need to save %es and %ds, as those are

317          * always kernel segments while inside the kernel.  Doing this

318          * before setting the new TLS descriptors avoids the situation

319          * where we temporarily have non-reloadable segments in %fs

320          * and %gs.  This could be an issue if the NMI handler ever

321          * used %fs or %gs (it does not today), or if the kernel is

322          * running inside of a hypervisor layer.

323          */

324         lazy_save_gs(prev->gs);

325 

326         /*

327          * Load the per-thread Thread-Local Storage descriptor.

328          */

329         load_TLS(next, cpu);

330 

331         /*

332          * Restore IOPL if needed.  In normal use, the flags restore

333          * in the switch assembly will handle this.  But if the kernel

334          * is running virtualized at a non-zero CPL, the popf will

335          * not restore flags, so it must be done in a separate step.

336          */

337         if (get_kernel_rpl() && unlikely(prev->iopl != next->iopl))

338                 set_iopl_mask(next->iopl);

339 

340         /*

341          * Now maybe handle debug registers and/or IO bitmaps

342          */

343         if (unlikely(task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV ||

344                      task_thread_info(next_p)->flags & _TIF_WORK_CTXSW_NEXT))

345                 __switch_to_xtra(prev_p, next_p, tss);

346 

347         /*

348          * Leave lazy mode, flushing any hypercalls made here.

349          * This must be done before restoring TLS segments so

350          * the GDT and LDT are properly updated, and must be

351          * done before math_state_restore, so the TS bit is up

352          * to date.

353          */

354         arch_end_context_switch(next_p);

355 

356         /*

357          * Restore %gs if needed (which is common)

358          */

359         if (prev->gs | next->gs)

360                 lazy_load_gs(next->gs);

361 

362         switch_fpu_finish(next_p, fpu);

363 

364         percpu_write(current_task, next_p);

365 

366         return prev_p;

367 }

 由上面的代码可看出：TSS的更新主要是

1： load_sp0(tss, next); 从下一个进程的thread字段中获取它的sp0，并用它来更新TSS中的sp0

2： __switch_to_xtra(prev_p, next_p, tss);必要的时候会更新IO权位值。