从整理上理解进程创建、可执行文件的加载和进程执行进程切换，重点理解分析fork、execve和进程切换

struct task_struct {
volatile long state; //进程状态    /* -1 unrunnable, 0 runnable, >0 stopped */
    void *stack;   //进程内核堆栈
    atomic_t usage;
    unsigned int flags; //进程标识符    /* per process flags, defined below */
　　　　....

    unsigned int ptrace;    
    struct list_head tasks;    //进程链表
    struct thread_struct thread; //在进行进程切换时与CPU状态相关的代码结构体
         /* filesystem information */
    struct fs_struct *fs; //文件系统相关数据结构
        /* open file information */
        struct files_struct *files; //文件描述列表
        /* namespaces */
    struct nsproxy *nsproxy;
        /* signal handlers */
    struct signal_struct *signal;
    struct sighand_struct *sighand;  //信号处理相关代码
        ....
}

 1 long do_fork(unsigned long clone_flags,
 2           unsigned long stack_start,
 3           unsigned long stack_size,
 4           int __user *parent_tidptr,
 5           int __user *child_tidptr)
 6 {
 7     struct task_struct *p;
 8     int trace = 0;
 9     long nr;
10 
11     // ...
12     
13     // 复制进程描述符，返回创建的task_struct的指针
14     p = copy_process(clone_flags, stack_start, stack_size,
15              child_tidptr, NULL, trace); //复制子进程
16 
17     if (!IS_ERR(p)) {
18         struct completion vfork;
19         struct pid *pid;
20 
21         trace_sched_process_fork(current, p);
22 
23         // 取出task结构体内的pid
24         pid = get_task_pid(p, PIDTYPE_PID);
25         nr = pid_vnr(pid);
26 
27         if (clone_flags & CLONE_PARENT_SETTID)
28             put_user(nr, parent_tidptr);
29 
30         // 如果使用的是vfork，那么必须采用某种完成机制，确保父进程后运行
31         if (clone_flags & CLONE_VFORK) {
32             p->vfork_done = &vfork;
33             init_completion(&vfork);
34             get_task_struct(p);
35         }
36 
37         // 将子进程添加到调度器的队列，使得子进程有机会获得CPU
38         wake_up_new_task(p);
39 
40         // ...
41 
42         // 如果设置了 CLONE_VFORK 则将父进程插入等待队列，并挂起父进程直到子进程释放自己的内存空间
43         // 保证子进程优先于父进程运行
44         if (clone_flags & CLONE_VFORK) {
45             if (!wait_for_vfork_done(p, &vfork))
46                 ptrace_event_pid(PTRACE_EVENT_VFORK_DONE, pid);
47         }
48 
49         put_pid(pid);
50     } else {
51         nr = PTR_ERR(p);
52     }
53     return nr;
54 }

132int copy_thread(unsigned long clone_flags, unsigned long sp,
133    unsigned long arg, struct task_struct *p)
134{
135    struct pt_regs *childregs = task_pt_regs(p);
136    struct task_struct *tsk;
137    int err;
138
139    p->thread.sp = (unsigned long) childregs;
140    p->thread.sp0 = (unsigned long) (childregs+1);
141    memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps));
142
143    if (unlikely(p->flags & PF_KTHREAD)) {
144        /* kernel thread */
145        memset(childregs, 0, sizeof(struct pt_regs));
146        p->thread.ip = (unsigned long) ret_from_kernel_thread;
147        task_user_gs(p) = __KERNEL_STACK_CANARY;
148        childregs->ds = __USER_DS;
149        childregs->es = __USER_DS;
150        childregs->fs = __KERNEL_PERCPU;
151        childregs->bx = sp;    /* function */
152        childregs->bp = arg;
153        childregs->orig_ax = -1;
154        childregs->cs = __KERNEL_CS | get_kernel_rpl();
155        childregs->flags = X86_EFLAGS_IF | X86_EFLAGS_FIXED;
156        p->thread.io_bitmap_ptr = NULL;
157        return 0;
158    }
159    *childregs = *current_pt_regs();
160    childregs->ax = 0;
161    if (sp)
162        childregs->sp = sp;
163
164    p->thread.ip = (unsigned long) ret_from_fork;
165    task_user_gs(p) = get_user_gs(current_pt_regs());
166
167    p->thread.io_bitmap_ptr = NULL;
168    tsk = current;
169    err = -ENOMEM;
170
171    if (unlikely(test_tsk_thread_flag(tsk, TIF_IO_BITMAP))) {
172        p->thread.io_bitmap_ptr = kmemdup(tsk->thread.io_bitmap_ptr,
173                        IO_BITMAP_BYTES, GFP_KERNEL);
174        if (!p->thread.io_bitmap_ptr) {
175            p->thread.io_bitmap_max = 0;
176            return -ENOMEM;
177        }
178        set_tsk_thread_flag(p, TIF_IO_BITMAP);
179    }
180
181    err = 0;
182
183    /*
184     * Set a new TLS for the child thread?
185     */
186    if (clone_flags & CLONE_SETTLS)
187        err = do_set_thread_area(p, -1,
188            (struct user_desc __user *)childregs->si, 0);
189
190    if (err && p->thread.io_bitmap_ptr) {
191        kfree(p->thread.io_bitmap_ptr);
192        p->thread.io_bitmap_max = 0;
193    }
194    return err;
195}

*childregs = *current_pt_regs(); 复制内核堆栈（复制的pt_regs，是SAVE_ALL中系统调用压栈的那一部分。）
childregs->ax = 0; 子进程的fork返回0
p->thread.sp = (unsigned long) childregs; 调度到子进程时的内核栈顶
p->thread.ip = (unsigned long) ret_from_fork; 调度到子进程时的第一条指令地址
ip指向的是ret_from_fork，所以是从这里开始执行的。

31#define switch_to(prev, next, last)                    \
32do {                                    33    /*                                34     * Context-switching clobbers all registers, so we clobber    35     * them explicitly, via unused output variables.        36     * (EAX and EBP is not listed because EBP is saved/restored    37     * explicitly for wchan access and EAX is the return value of    38     * __switch_to())                        39     */                                40    unsigned long ebx, ecx, edx, esi, edi;                41                                    42    asm volatile("pushfl\n\t"        /* save    flags */    43             "pushl %%ebp\n\t"        /* save    EBP   */    44             "movl %%esp,%[prev_sp]\n\t"    /* save    ESP   */ 45             "movl %[next_sp],%%esp\n\t"    /* restore ESP   */ 46             "movl $1f,%[prev_ip]\n\t"    /* save    EIP   */   "保存当前进程的eip，恢复的时候从prev_ip来恢复eip
47             "pushl %[next_ip]\n\t"    /* restore EIP   */    \把下个进程的起点ip位置压到next进程堆栈栈顶（起点）
48             __switch_canary                    49             "jmp __switch_to\n"    /* regparm call  */    \jmp通过prev和next寄存器的方式传递参数
50             "1:\t"                        51             "popl %%ebp\n\t"        /* restore EBP   */    \恢复上下文，next曾经push过ebp
52             "popfl\n"            /* restore flags */    53                                    54             /* output parameters */                55             : [prev_sp] "=m" (prev->thread.sp),       
56               [prev_ip] "=m" (prev->thread.ip),        \prev_sp是内核堆栈栈顶 prev_ip是当前进程的eip */
57               "=a" (last),                    58                                    59               /* clobbered output registers: */        60               "=b" (ebx), "=c" (ecx), "=d" (edx),        61               "=S" (esi), "=D" (edi)                62                                           63               __switch_canary_oparam                64                                    65               /* input parameters: */                66             : [next_sp]  "m" (next->thread.sp),        \next_sp下一个进程的内核堆栈的栈顶
67               [next_ip]  "m" (next->thread.ip),        \next_ip下一个进程执行的起点，一般是$1f，对于新创建的子进程是ret_from_fork*/
68                                           69               /* regparm parameters for __switch_to(): */    70               [prev]     "a" (prev),                71               [next]     "d" (next)                72                                    73               __switch_canary_iparam                74                                    75             : /* reloaded segment registers */            76            "memory");                    77}