Linux进程的创建函数fork()及其fork内核实现解析

#include <unistd.h>
pid_t fork(void); 

/proc/sys/kernel/sched_child_runs_first 

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <sys/types.h>
#include <wait.h>
int g_int = 1;//数据段的全局变量
int main()
{
    int local_int = 1;//栈上的局部变量
    int *malloc_int = malloc(sizeof(int));//通过malloc动态分配在堆上的变量
    *malloc_int = 1;
    pid_t pid = fork();
    if(pid == 0) /*子进程*/
    {
        local_int = 0;
        g_int = 0;
        *malloc_int = 0;
        fprintf(stderr,"[CHILD ] child change local global malloc value to 0\n");
        free(malloc_int);
        sleep(10);
        fprintf(stderr,"[CHILD ] child exit\n");
        exit(0);
    }
    else if(pid < 0)
    {
        printf("fork failed (%s)",strerror(errno));
        return 1;
    }
    fprintf(stderr,"[PARENT] wait child exit\n");
    waitpid(pid,NULL,0);
    fprintf(stderr,"[PARENT] child have exit\n");
    printf("[PARENT] g_int = %d\n",g_int);
    printf("[PARENT] local_int = %d\n",local_int);
    printf("[PARENT] malloc_int = %d\n",local_int);
    free(malloc_int);
    return 0;
} 

[PARENT] wait child exit
[CHILD ] child change local global malloc value to 0
[CHILD ] child exit
[PARENT] child have exit
[PARENT] g_int = 1
[PARENT] local_int = 1
[PARENT] malloc_int = 1 

/*如果是写时拷贝, 那么无论是初始页表, 还是拷贝的页表, 都设置了写保护
    *后面无论父子进程, 修改页表对应位置的内存时, 都会触发page fault
    */
    if (is_cow_mapping(vm_flags)) {
        ptep_set_wrprotect(src_mm, addr, src_pte);//设置为写保护
        pte = pte_wrprotect(pte);
    } 

struct task_struct {
    ...struct files_struct *files;...
} 

static int copy_files(unsigned long clone_flags,
                struct task_struct *tsk)
{
    struct files_struct *oldf, *newf;
    int error = 0;
    oldf = current->files;//获取父进程的文件结构体
    if (!oldf)
        goto out;
 /*创建线程和vfork, 都不用复制父进程的文件描述符, 增加引用计数即可*/
    if (clone_flags & CLONE_FILES) {
        atomic_inc(&oldf->count);
        goto out;
    }
    /*对于fork而言, 需要复制父进程的文件描述符*/
    newf = dup_fd(oldf, &error); //复制一份文件描述符
    if (!newf)
        goto out;
    tsk->files = newf;
    error = 0;
out:
    return error;
} 

struct files_struct *dup_fd(struct files_struct *oldf,
                  int *errorp)
{
    struct files_struct *newf;
    struct file **old_fds, **new_fds;
    int open_files, size, i;
    struct fdtable *old_fdt, *new_fdt;
    *errorp = -ENOMEM;
    newf = kmem_cache_alloc(files_cachep, GFP_KERNEL);
    if (!newf)
        goto out; 

struct files_struct {
    atomic_t count;
    struct fdtable __rcu *fdt;
    struct fdtable fdtab;
    spinlock_t file_lock ____cacheline_aligned_in_smp;
    int next_fd;
    struct embedded_fd_set close_on_exec_init;
    struct embedded_fd_set open_fds_init;
    struct file __rcu * fd_array[NR_OPEN_DEFAULT];
};
struct fdtable //文件描述符表
{
    unsigned int max_fds;
    struct file __rcu **fd;      /* current fd array */
    fd_set *close_on_exec;
    fd_set *open_fds;
    struct rcu_head rcu;
    struct fdtable *next;
};
struct embedded_fd_set {
    unsigned long fds_bits[1];
}; 

atomic_set(&newf->count, 1);
spin_lock_init(&newf->file_lock);
newf->next_fd = 0;
new_fdt = &newf->fdtab;
new_fdt->max_fds = NR_OPEN_DEFAULT;
new_fdt->close_on_exec = (fd_set *)&newf->close_on_exec_init;
new_fdt->open_fds = (fd_set *)&newf->open_fds_init;
new_fdt->fd = &newf->fd_array[0];
new_fdt->next = NULL;
 

spin_lock(&oldf->file_lock);
    old_fdt = files_fdtable(oldf);
    open_files = count_open_files(old_fdt);
   /*如果父进程打开文件的个数超过NR_OPEN_DEFAULT*/
    while (unlikely(open_files > new_fdt->max_fds)) {
        spin_unlock(&oldf->file_lock);  /* 如果不是自带的fdtable而是曾经分配的fdtable, 则需要先释放*/
 if (new_fdt != &newf->fdtab)
        __free_fdtable(new_fdt);
       /*创建新的fdtable*/
        new_fdt = alloc_fdtable(open_files - 1);
        if (!new_fdt) {
        *errorp = -ENOMEM;
        goto out_release;
        }
        /*如果超出了系统限制, 则返回EMFILE*/
        if (unlikely(new_fdt->max_fds < open_files)) {
        __free_fdtable(new_fdt);
        *errorp = -EMFILE;
        goto out_release;
        }
        spin_lock(&oldf->file_lock);
        old_fdt = files_fdtable(oldf);
        open_files = count_open_files(old_fdt);
    } 

old_fds = old_fdt->fd;  /*父进程的struct file 指针数组*/
new_fds = new_fdt->fd;  /*子进程的struct file 指针数组*/
/* 拷贝打开文件位图 */
memcpy(new_fdt->open_fds->fds_bits,old_fdt->open_fds->fds_bits, open_files/8);
/* 拷贝 close_on_exec位图 */
memcpy(new_fdt->close_on_exec->fds_bits,old_fdt->close_on_exec->fds_bits, open_files/8);
for (i = open_files; i != 0; i--) {
    struct file *f = *old_fds++;
    if (f) {
        get_file(f); /* f对应的文件的引用计数加1 */
    } else {
        FD_CLR(open_files - i, new_fdt->open_fds);
    }
/* 子进程的struct file类型指针, *指向和父进程相同的struct file 结构体*/
    rcu_assign_pointer(*new_fds++, f);   
}
spin_unlock(&oldf->file_lock);/* compute the remainder to be cleared */
size = (new_fdt->max_fds - open_files) * sizeof(struct file *);
/*将尚未分配到的struct file结构的指针清零*/
    memset(new_fds, 0, size);/*将尚未分配到的位图区域清零*/
    if (new_fdt->max_fds > open_files) {
    int left = (new_fdt->max_fds-open_files)/8;
    int start = open_files / (8 * sizeof(unsigned long)); 
    memset(&new_fdt->open_fds->fds_bits[start], 0, left);
    memset(&new_fdt->close_on_exec->fds_bits[start], 0, left);
}
    rcu_assign_pointer(newf->fdt, new_fdt);
    return newf;
out_release:
    kmem_cache_free(files_cachep, newf);
out:
    return NULL;
} 

#include<stdio.h>
#include <stdlib.h>
#include <unistd.h>
int glob = 88 ;
int main(void) {
    int var;
    var = 88;
    pid_t pid;
    if ((pid = vfork()) < 0) {
        printf("vfork error");
        exit(-1);
    } else if (pid == 0) { /* 子进程 */
        var++;
        glob++;
        return 0;
    }printf("pid=%d, glob=%d, var=%d\n",getpid(), glob, var);
    return 0;
}