陈铁+ 原创作品转载请注明出处 + 《Linux内核分析》MOOC课程http://mooc.study.163.com/course/USTC-1000029000

对于现代操作系统，多任务是必备的，在linux系统下，进程会不断的被内核调度，从X进程切换为Y进程，以实现用户所见到的多任务状态，下面我们就看一看这样的过程，分析一下内核如何对进程调度，以及进程间如何切换。

内核使用schedule()函数实现进程的调度，而通常的用户进程要无法主动调度这个函数，只能通过中断处理过程（包括时钟中断、I/O中断、系统调用和异常）在某个合适的时机点被动调度；对于现代操作系统，还有内核线程，而内核线程是可以直接调度schedule函数的，只有内核态，当然也可以象用户态进程一样在中断处理过程中被动调度。

为了控制进程的执行，内核必须有能力挂起正在CPU上执行的进程，并恢复以前挂起的某个进程的执行，这叫做进程切换、任务切换、上下文切换；挂起正在CPU上执行的进程，与中断时保存现场不同的，中断前后是在同一个进程上下文中，只是由用户态转向内核态执行；而进程切换是在两个进程之间进行转换，切换前后的上下文是在不同的进程空间。进程上下文包含了进程执行需要的所有信息：用户地址空间：包括程序代码，数据，用户堆栈等；控制信息：进程描述符，内核堆栈等；硬件上下文。

下面将进程切换的关键代码摘录如下：

1、schedule函数

asmlinkage __visible void __sched schedule(void)
{struct task_struct *tsk = current;sched_submit_work(tsk);__schedule();
}

2、__schedule()函数

2770static void __sched __schedule(void)
2771{
2772    struct task_struct *prev, *next;
2773    unsigned long *switch_count;
2774    struct rq *rq;
2775    int cpu;
2776
2777need_resched:
2778    preempt_disable();
2779    cpu = smp_processor_id();
2780    rq = cpu_rq(cpu);
2781    rcu_note_context_switch(cpu);
2782    prev = rq->curr;
2783
2784    schedule_debug(prev);
2785
2786    if (sched_feat(HRTICK))
2787        hrtick_clear(rq);
2788
2789    /*
2790     * Make sure that signal_pending_state()->signal_pending() below
2791     * can't be reordered with __set_current_state(TASK_INTERRUPTIBLE)
2792     * done by the caller to avoid the race with signal_wake_up().
2793     */
2794    smp_mb__before_spinlock();
2795    raw_spin_lock_irq(&rq->lock);
2796
2797    switch_count = &prev->nivcsw;
2798    if (prev->state && !(preempt_count() & PREEMPT_ACTIVE)) {
2799        if (unlikely(signal_pending_state(prev->state, prev))) {
2800            prev->state = TASK_RUNNING;
2801        } else {
2802            deactivate_task(rq, prev, DEQUEUE_SLEEP);
2803            prev->on_rq = 0;
2804
2805            /*
2806             * If a worker went to sleep, notify and ask workqueue
2807             * whether it wants to wake up a task to maintain
2808             * concurrency.
2809             */
2810            if (prev->flags & PF_WQ_WORKER) {
2811                struct task_struct *to_wakeup;
2812
2813                to_wakeup = wq_worker_sleeping(prev, cpu);
2814                if (to_wakeup)
2815                    try_to_wake_up_local(to_wakeup);
2816            }
2817        }
2818        switch_count = &prev->nvcsw;
2819    }
2820
2821    if (task_on_rq_queued(prev) || rq->skip_clock_update < 0)
2822        update_rq_clock(rq);
2823
2824    next = pick_next_task(rq, prev);
2825    clear_tsk_need_resched(prev);
2826    clear_preempt_need_resched();
2827    rq->skip_clock_update = 0;
2828
2829    if (likely(prev != next)) {
2830        rq->nr_switches++;
2831        rq->curr = next;
2832        ++*switch_count;
2833
2834        context_switch(rq, prev, next); /* unlocks the rq */
2835        /*
2836         * The context switch have flipped the stack from under us
2837         * and restored the local variables which were saved when
2838         * this task called schedule() in the past. prev == current
2839         * is still correct, but it can be moved to another cpu/rq.
2840         */
2841        cpu = smp_processor_id();
2842        rq = cpu_rq(cpu);
2843    } else
2844        raw_spin_unlock_irq(&rq->lock);
2845
2846    post_schedule(rq);
2847
2848    sched_preempt_enable_no_resched();
2849    if (need_resched())
2850        goto need_resched;
2851}

其中关键语句：

struct task_struct *prev, *next;
next = pick_next_task(rq, prev);        //进程调度算法
context_switch(rq, prev, next); /* unlocks the rq */ //进程上下文切换

3、context_switch函数

2332 * context_switch - switch to the new MM and the new
2333 * thread's register state.
2334 */
2335static inline void
2336context_switch(struct rq *rq, struct task_struct *prev,
2337           struct task_struct *next)
2338{
2339    struct mm_struct *mm, *oldmm;
2340
2341    prepare_task_switch(rq, prev, next);
2342
2343    mm = next->mm;
2344    oldmm = prev->active_mm;
2345    /*
2346     * For paravirt, this is coupled with an exit in switch_to to
2347     * combine the page table reload and the switch backend into
2348     * one hypercall.
2349     */
2350    arch_start_context_switch(prev);
2351
2352    if (!mm) {
2353        next->active_mm = oldmm;
2354        atomic_inc(&oldmm->mm_count);
2355        enter_lazy_tlb(oldmm, next);
2356    } else
2357        switch_mm(oldmm, mm, next);
2358
2359    if (!prev->mm) {
2360        prev->active_mm = NULL;
2361        rq->prev_mm = oldmm;
2362    }
2363    /*
2364     * Since the runqueue lock will be released by the next
2365     * task (which is an invalid locking op but in the case
2366     * of the scheduler it's an obvious special-case), so we
2367     * do an early lockdep release here:
2368     */
2369    spin_release(&rq->lock.dep_map, 1, _THIS_IP_);
2370
2371    context_tracking_task_switch(prev, next);
2372    /* Here we just switch the register state and the stack. */
2373    switch_to(prev, next, prev);
2374
2375    barrier();
2376    /*
2377     * this_rq must be evaluated again because prev may have moved
2378     * CPUs since it called schedule(), thus the 'rq' on its stack
2379     * frame will be invalid.
2380     */
2381    finish_task_switch(this_rq(), prev);
2382}

4、switch_to宏定义了一段内联汇编代码

31#define switch_to(prev, next, last)                   \
32do {                                  \
33  /*                              \
34   * Context-switching clobbers all registers, so we clobber  \
35   * them explicitly, via unused output variables.        \
36   * (EAX and EBP is not listed because EBP is saved/restored \
37   * explicitly for wchan access and EAX is the return value of   \
38   * __switch_to())                       \
39   */                             \
40  unsigned long ebx, ecx, edx, esi, edi;              \
41                                  \
42  asm volatile("pushfl\n\t"     /* save    flags */ \
43           "pushl %%ebp\n\t"        /* save    EBP   */ \
44           "movl %%esp,%[prev_sp]\n\t"  /* save    ESP   */ \
45           "movl %[next_sp],%%esp\n\t"  /* restore ESP   */ \
46           "movl $1f,%[prev_ip]\n\t"    /* save    EIP   */ \
47           "pushl %[next_ip]\n\t"   /* restore EIP   */ \
48           __switch_canary                    \
49           "jmp __switch_to\n"  /* regparm call  */ \
50           "1:\t"                       \
51           "popl %%ebp\n\t"     /* restore EBP   */ \
52           "popfl\n"            /* restore flags */ \
53                                  \
54           /* output parameters */                \
55           : [prev_sp] "=m" (prev->thread.sp),      \
56             [prev_ip] "=m" (prev->thread.ip),      \
57             "=a" (last),                  \
58                                  \
59             /* clobbered output registers: */        \
60             "=b" (ebx), "=c" (ecx), "=d" (edx),     \
61             "=S" (esi), "=D" (edi)             \
62                                      \
63             __switch_canary_oparam               \
64                                  \
65             /* input parameters: */              \
66           : [next_sp]  "m" (next->thread.sp),       \
67             [next_ip]  "m" (next->thread.ip),       \
68                                      \
69             /* regparm parameters for __switch_to(): */  \
70             [prev]     "a" (prev),             \
71             [next]     "d" (next)              \
72                                  \
73             __switch_canary_iparam               \
74                                  \
75           : /* reloaded segment registers */         \
76          "memory");                    \
77} while (0)

通过以上代码，我们可以看到，当cpu由正在运行的X进程切换到Y进程的大致步骤，其中X，Y是哪一个进程是由调度算法决定的。

进程X正在中运行->发生中断->进行中断处理（保存当前的eflag，eip，esp；加载内核中特定的eflag，eip，esp）->执行SAVE ALL->中断处理过程中或中断返回前调用了schedule(),switch_to实现关键的进程上下文切换->开始从标号1之后运行用户态进程Y->restore all->iret从内核堆栈中返回eflag，eip，esp->继续执行Y进程。对于前面提到的内核线程，以及系统中的特殊调用fork和execve会有些特殊，但大致原则是相同的。