一. 关于fork调用
fork()调用建立一个新的进程，该进程几乎是当前进程的一个彻底拷贝。由fork()建立的新进程被称为子进程。fork函数被调用一次但返回两次。两次返回的惟一区别是子进程中返回0值，而父进程中返回子进程ID。子进程是父进程的副本，它将得到父进程数据空间、堆、栈等资源的副本。注意，子进程持有的是上述存储空间的“副本”，这意味着父子进程间不共享这些存储空间。Linux将复制父进程的地址空间内容给子进程，所以，子进程拥有独立的地址空间。node
咱们来看一个DEMO:linux
// fork_example.c#include <memory.h>#include <stdio.h>#include <stdlib.h>#include <sys/types.h>#include <unistd.h>int main(int argc, const char *argv[])
{
pid_t pid; char stack_data[] = "stack_data";char *heap_data = malloc(10 * sizeof(char));
strcpy(heap_data, "heap_data");
pid = fork();if (pid == 0) {
printf("CHILD PROCESS: %s, %s\n", stack_data, heap_data);
} else if (pid > 0) {
printf("PARENT PROCESS: %s, %s\n", stack_data, heap_data);
} else {
printf("FORK FAILED.");
}return 0;
}
运行的输出结果为：c#
CHILD PROCESS: stack_data, heap_data PARENT PROCESS: stack_data, heap_data
能够看出，父进程和子进程的栈和堆的数据是相同的。这些数据在建立子进程时是经过拷贝产生的。api
二. 关于execl调用
系统调用exec是以新的进程去代替原来的进程，但进程的PID保持不变。所以，能够这样认为，exec系统调用并无建立新的进程，只是替换了原来进程上下文的内容。原进程的代码段，数据段，堆栈段被新的进程所代替。安全
咱们来看一个例子：session
// execl_example.c#include <stdio.h>#include <stdlib.h>#include <unistd.h>int main(int argc, const char *argv[])
{
execl("./hello_world", NULL, NULL); /* We can only reach this code when there is an error in execl */
printf("The execl must be failed!\n");return 1;
}
咱们执行一个不存在的hello_world程序，看看输出结果：数据结构
The execl must be failed!
如今咱们建立一个hello_world程序，该程序简单的打印一个Hello World.多线程
// hello_world.c#include <stdio.h>int main(int argc, const char *argv[])
{
printf("Hello World!\n");
}
如今咱们继续运行execl_example程序，这时输出为：app
Hello World!
经过比较两次输出，咱们发现：当execl成功时，原有的进程执行就会被打断，替换为新的进程继续执行。less
三. 使用汇编进行系统调用
咱们知道在Linux中，每一个系统调用都对应一个系统调用号。这个系统调用号是在unistd.h中定义的。在个人机器上文件的位置是在：
/usr/src/linux-headers-2.6.28-11-generic/arch/x86/include/asm/unistd_32.h
若是找不到，能够尝试使用如下命令查找：
locate unistd.h | xargs grep -ri "__NR_fork"
下面是unistd.h的部份内容：
... ...#define __NR_restart_syscall 0#define __NR_exit 1#define __NR_fork 2#define __NR_read 3#define __NR_write 4#define __NR_open 5#define __NR_close 6#define __NR_waitpid 7#define __NR_creat 8#define __NR_link 9#define __NR_unlink 10#define __NR_execve 11... ...
使用汇编调用fork:
能够看到fork的系统调用号是2，咱们如今使用汇编代码从新编写fork_example.c
#include <memory.h>#include <stdio.h>#include <stdlib.h>#include <sys/types.h>#include <unistd.h>int main()
{
pid_t pid; char stack_data[] = "stack_data";char *heap_data = malloc(10 * sizeof(char));
strcpy(heap_data, "heap_data");// pid = fork();asm volatile("mov $0x2, %%eax\n\t" // 将fork的系统调用号2存到eax寄存器 "int $0x80\n\t" // 产生int 0x80中断"mov %%eax,%0\n\t" // 将结果存入pid中: "=m" (pid)
); if (pid == 0) {
printf("CHILD PROCESS: %s, %s\n", stack_data, heap_data);
} else if (pid > 0) {
printf("PARENT PROCESS: %s, %s\n", stack_data, heap_data);
} else {
printf("FORK FAILED.\n");
}return 0;
}
运行输出结果是：
CHILD PROCESS: stack_data, heap_data PARENT PROCESS: stack_data, heap_data
能够尝试将调用号替换一下，改为$0x3，获得的结果是：
FORK FAILED.
使用汇编调用execl:
咱们再尝试一下使用汇编调用execl。经过上面的观察咱们能够看到execl的系统调用号是11.
#include <stdio.h>#include <stdlib.h>#include <unistd.h>int main(int argc, const char *argv[])
{// execl("./hello_world", NULL, NULL);const char *program = "./hello_world";
asm volatile ("mov %0,%%ebx\n\t" // 使用program作为参数1"mov $0,%%ecx\n\t" // 参数2为NULL"mov $0,%%edx\n\t" // 参数3为NULL"mov $0xb,%%eax\n\t" // 将execl的系统调用好11存入eax中"int $0x80\n\t" // 产生0x80中断: "=m" (program)
); /* We can only reach this code when there is an error in execl */
printf("The execl must be failed!\n");return 1;
}
运行结果为：
Hello World!
若是将系统调用号改成0x3，输出结果为：
The execl must be failed!
四.系统调用过程详解
经过第三步的过程，咱们了解到，系统调用在内核中的执行是依靠中断实现的。若是咱们想进一步定位fork和execl的代码，咱们须要先了解系统调用的详细过程。即回答如下两个问题：
1.中断是怎么工做的？
2.int 0x80中断是怎么工做的？
中断是怎么工做的
在Linux操做系统中，中断是经过中断描述符表工做的。中断描述符表（Interrupt Descriptor Table, IDT）是一个系统表，它与每个中断或者异常向量相联系，每个向量在表中有相应的中断或者异常处理程序的入口地址。内核在容许中断发生前，必须适当的初始化IDT。对于每一个中断，都会有对应的中断处理程序。当产生一个中断时，Linux根据中断向量表中对应的项找到存储中断处理程序的地址，而后调用相应的中断处理程序。中段描述符表在内存中的地址存储在idtr寄存器中。内核在启动中断前，必须初始化IDT，而后将IDT的地址壮载到idtr中。
内核初始化的时候调用trap_init()函数和init_IRQ()函数初始化中断向量表。
int 0x80中断是怎么工做的
经过上面的分析，咱们知道每一个中断都有对应的处理程序。在系统调用的过程当中，会有一个系统调用分派表，每一个表项存储了一个系统调用。系统调用中断处理程序，根据系统调用号找到对应的系统调用执行。对于系统调用，参数的传递是经过寄存器ebx ecx edx进行传递的。eax中存储的是系统调用号。系统调用最大为__NR_syscalls个。
在arch/x86/include/asm/irq_vectors.h中定义了
# define SYSCALL_VECTOR 0x80
如今咱们查找trap_init函数，在arch/x86/kernel/traps.c中
set_system_trap_gate(SYSCALL_VECTOR, &system_call);
如今，查找system_call函数，在arch/x86/kernel/entry_32.s中：
ENTRY(system_call) RING0_INT_FRAME # can't unwind into user space anyway ASM_CLAC pushl_cfi %eax # save orig_eax SAVE_ALL GET_THREAD_INFO(%ebp) # system call tracing in operation / emulation testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp) jnz syscall_trace_entry cmpl $(NR_syscalls), %eax jae syscall_badsys syscall_call: call *sys_call_table(,%eax,4) movl %eax,PT_EAX(%esp) # store the return value syscall_exit: LOCKDEP_SYS_EXIT DISABLE_INTERRUPTS(CLBR_ANY) # make sure we don't miss an interrupt # setting need_resched or sigpending # between sampling and the iret TRACE_IRQS_OFF movl TI_flags(%ebp), %ecx testl $_TIF_ALLWORK_MASK, %ecx # current->work jne syscall_exit_work
在include/uapi/asm_generic/unistd.h中找到：
__SYSCALL(__NR_fork, sys_fork)
fork的系统调用号是2，对应的系统调用分派表中为sys_fork函数。在kernel/fork.c中找到以下代码：
#ifdef __ARCH_WANT_SYS_FORK
SYSCALL_DEFINE0(fork)
{
#ifdef CONFIG_MMUreturn do_fork(SIGCHLD, 0, 0, NULL, NULL);#else/* can not support in nommu mode */return(-EINVAL);#endif}#endif
四.do_fork源码分析
如今查找do_fork函数，也在kernel/fork.c中：
/*
* Ok, 这就是fork例程的主要部分。
*
* 函数执行进程的复制，若是成功则启动新进程。而且等待新进程完成VM的使用。 */long do_fork(unsigned long clone_flags,
unsigned long stack_start,
unsigned long stack_size, int __user *parent_tidptr, int __user *child_tidptr)
{struct task_struct *p;int trace = 0;long nr;/* * 在分配以前作一些参数和权限检查。 */if (clone_flags & (CLONE_NEWUSER | CLONE_NEWPID)) {if (clone_flags & (CLONE_THREAD|CLONE_PARENT))return -EINVAL;
}/* * 肯定是否须要报告给ptracer，或者哪些须要汇报给ptracer。若是是调用者内核线程
* 或者标志了CLONE_UNTRACED，则不报告任何跟踪信息。不然，报告相应fork的跟踪信息。 */if (!(clone_flags & CLONE_UNTRACED)) {if (clone_flags & CLONE_VFORK)
trace = PTRACE_EVENT_VFORK;else if ((clone_flags & CSIGNAL) != SIGCHLD)
trace = PTRACE_EVENT_CLONE;elsetrace = PTRACE_EVENT_FORK;if (likely(!ptrace_event_enabled(current, trace)))
trace = 0;
}
// copy_process函数建立进程描述符和子进程须要的其余数据结构。p = copy_process(clone_flags, stack_start, stack_size,
child_tidptr, NULL, trace); /* 如今唤醒新线程。*/if (!IS_ERR(p)) {struct completion vfork;
trace_sched_process_fork(current, p);
nr = task_pid_vnr(p);if (clone_flags & CLONE_PARENT_SETTID)
put_user(nr, parent_tidptr);if (clone_flags & CLONE_VFORK) {
p->vfork_done = &vfork;
init_completion(&vfork);
get_task_struct(p);
}
wake_up_new_task(p);/* fork已经完成，子进程也已经启动。如今通知ptracer。 */if (unlikely(trace))
ptrace_event(trace, nr);if (clone_flags & CLONE_VFORK) {if (!wait_for_vfork_done(p, &vfork))
ptrace_event(PTRACE_EVENT_VFORK_DONE, nr);
}
} else {
nr = PTR_ERR(p);
}return nr;
}
能够看到do_fork调用了copy_process完成了绝大部分的工做。copy_process位于同一个文件当中：
/*
* 以复制的方式建立一个新的进程。但不启动运行新建立的进程。
*
* 主要复制寄存器和其它进程环境中的相应的合适部分。真正的
* 启动工做则交由调用者完成。 */static struct task_struct *copy_process(unsigned long clone_flags,
unsigned long stack_start,
unsigned long stack_size,int __user *child_tidptr,struct pid *pid,int trace)
{int retval;struct task_struct *p; // 保存新的进程描述符。/* 删除了对标志位的一致性和合法性的检查 */// security_task_create和security_task_alloc()执行全部附加的安全检查。retval = security_task_create(clone_flags);// dup_task_struct为子进程获取进程描述符。稍后分析。p = dup_task_struct(current);// task结构中ftrace_ret_stack结构变量的初始化，即函数返回用的栈。 ftrace_graph_init_task(p);
get_seccomp_filter(p);// task中互斥变量的初始化。 rt_mutex_init_task(p);// 第1个if对进程占用的资源数作出限制，task_rlimit(p, RLIMIT_NPROC)// 限制了改进程用户能够拥有的进程总数。 if (atomic_read(&p->real_cred->user->processes) >= task_rlimit(p, RLIMIT_NPROC)) {// 第2个if使用了capable（）函数来对权限作出检查，检查是否有权对指定// 的资源进行操做，该函数返回0则表明无权操做。if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) && p->real_cred->user != INIT_USER)goto bad_fork_free;
}
current->flags &= ~PF_NPROC_EXCEEDED; // 将当前进程标志位中的PF_NPROC_EXCEEDED置0。copy_creds(p, clone_flags); // copy_creds()复制证书，应该是复制权限及身份信息。// 检查建立的线程是否超过了系统进程总量。if (nr_threads >= max_threads)goto bad_fork_cleanup_count; // 增长执行实体的模块引用计数。if (!try_module_get(task_thread_info(p)->exec_domain->module))goto bad_fork_cleanup_count;
p->did_exec = 0;
delayacct_tsk_init(p); /* Must remain after dup_task_struct() */copy_flags(clone_flags, p); // 更新task_struct结构中flags成员INIT_LIST_HEAD(&p->children); // 初始化task_struct结构中的子进程链表INIT_LIST_HEAD(&p->sibling); // 初始化task_struct结构中的兄弟进程链表rcu_copy_process(p); // rcu相关变量的初始化p->vfork_done = NULL;
spin_lock_init(&p->alloc_lock);
init_sigpending(&p->pending);
p->utime = p->stime = p->gtime = 0;
p->utimescaled = p->stimescaled = 0;
p->prev_cputime.utime = p->prev_cputime.stime = 0;
seqlock_init(&p->vtime_seqlock);
p->vtime_snap = 0;
p->vtime_snap_whence = VTIME_SLEEPING;
memset(&p->rss_stat, 0, sizeof(p->rss_stat));
p->default_timer_slack_ns = current->timer_slack_ns;
task_io_accounting_init(&p->ioac); // 进程描述符中的io数据记录的初始化 acct_clear_integrals(p);
posix_cpu_timers_init(p); // timer初始化do_posix_clock_monotonic_gettime(&p->start_time);
p->real_start_time = p->start_time;
monotonic_to_bootbased(&p->real_start_time);
p->io_context = NULL;
p->audit_context = NULL;if (clone_flags & CLONE_THREAD)
threadgroup_change_begin(current);
cgroup_fork(p);
#ifdef CONFIG_NUMA
p->mempolicy = mpol_dup(p->mempolicy);if (IS_ERR(p->mempolicy)) {
retval = PTR_ERR(p->mempolicy);
p->mempolicy = NULL;goto bad_fork_cleanup_cgroup;
}
mpol_fix_fork_child_flag(p);#endif/* 设置CPU */p->cpuset_mem_spread_rotor = NUMA_NO_NODE;
p->cpuset_slab_spread_rotor = NUMA_NO_NODE;
seqcount_init(&p->mems_allowed_seq);/* 设置跟踪中断标志 */
p->irq_events = 0;
p->hardirqs_enabled = 0;
p->hardirq_enable_ip = 0;
p->hardirq_enable_event = 0;
p->hardirq_disable_ip = _THIS_IP_;
p->hardirq_disable_event = 0;
p->softirqs_enabled = 1;
p->softirq_enable_ip = _THIS_IP_;
p->softirq_enable_event = 0;
p->softirq_disable_ip = 0;
p->softirq_disable_event = 0;
p->hardirq_context = 0;
p->softirq_context = 0;/* 设置锁深度 */p->lockdep_depth = 0; /* no locks held yet */p->curr_chain_key = 0;
p->lockdep_recursion = 0;
#ifdef CONFIG_DEBUG_MUTEXES
p->blocked_on = NULL; /* not blocked yet */#endif#ifdef CONFIG_MEMCG
p->memcg_batch.do_batch = 0;
p->memcg_batch.memcg = NULL;#endifsched_fork(p); // 调度相关初始化,将新进程分配到某个CPU上。perf_event_init_task(p);
audit_alloc(p); /* 如下根据clone_flags的设置复制相应的部分，进行从新分配或者共享父进程的内容 */copy_semundo(clone_flags, p);
copy_files(clone_flags, p);
copy_fs(clone_flags, p);
copy_sighand(clone_flags, p);
copy_signal(clone_flags, p);
copy_mm(clone_flags, p);
copy_namespaces(clone_flags, p);
copy_io(clone_flags, p);
copy_thread(clone_flags, stack_start, stack_size, p);if (pid != &init_struct_pid) {
retval = -ENOMEM;
pid = alloc_pid(p->nsproxy->pid_ns);if (!pid)goto bad_fork_cleanup_io;
}
p->pid = pid_nr(pid);
p->tgid = p->pid;// 若是设置了同在一个线程组则继承TGID。 // 对于普通进程来讲TGID和PID相等， // 对于线程来讲，同一线程组内的全部线程的TGID都相等， // 这使得这些多线程能够经过调用getpid()得到相同的PID。if (clone_flags & CLONE_THREAD)
p->tgid = current->tgid;
p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;/* * Clear TID on mm_release()? */p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
uprobe_copy_process(p);/* * sigaltstack should be cleared when sharing the same VM */if ((clone_flags & (CLONE_VM|CLONE_VFORK)) == CLONE_VM)
p->sas_ss_sp = p->sas_ss_size = 0;/* * Syscall tracing and stepping should be turned off in the
* child regardless of CLONE_PTRACE. */user_disable_single_step(p);
clear_tsk_thread_flag(p, TIF_SYSCALL_TRACE);
#ifdef TIF_SYSCALL_EMU
clear_tsk_thread_flag(p, TIF_SYSCALL_EMU);#endifclear_all_latency_tracing(p);/* ok, now we should be set up.. */if (clone_flags & CLONE_THREAD)
p->exit_signal = -1;else if (clone_flags & CLONE_PARENT)
p->exit_signal = current->group_leader->exit_signal;elsep->exit_signal = (clone_flags & CSIGNAL);
p->pdeath_signal = 0;
p->exit_state = 0;
p->nr_dirtied = 0;
p->nr_dirtied_pause = 128 >> (PAGE_SHIFT - 10);
p->dirty_paused_when = 0;/* * Ok, make it visible to the rest of the system.
* We dont wake it up yet. */p->group_leader = p;
INIT_LIST_HEAD(&p->thread_group);
p->task_works = NULL;/* Need tasklist lock for parent etc handling! */write_lock_irq(&tasklist_lock);// 若是这两个标志设定了，那么和父进程有相同的父进程if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
p->real_parent = current->real_parent;
p->parent_exec_id = current->parent_exec_id;
} else { // 不然父进程为实际父进程p->real_parent = current;
p->parent_exec_id = current->self_exec_id;
}
spin_lock(¤t->sighand->siglock);/* * Process group and session signals need to be delivered to just the
* parent before the fork or both the parent and the child after the
* fork. Restart if a signal comes in before we add the new process to
* it's process group.
* A fatal signal pending means that current will exit, so the new
* thread can't slip out of an OOM kill (or normal SIGKILL).*/recalc_sigpending();if (signal_pending(current)) {
spin_unlock(¤t->sighand->siglock);
write_unlock_irq(&tasklist_lock);
retval = -ERESTARTNOINTR;goto bad_fork_free_pid;
} // 若是和父进程有相同的线程组if (clone_flags & CLONE_THREAD) {
current->signal->nr_threads++;
atomic_inc(¤t->signal->live);
atomic_inc(¤t->signal->sigcnt);
p->group_leader = current->group_leader;
list_add_tail_rcu(&p->thread_group, &p->group_leader->thread_group);
}if (likely(p->pid)) {
ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace); // ptrace的相关初始化 // 若是进程p是线程组leaderif (thread_group_leader(p)) {if (is_child_reaper(pid)) {
ns_of_pid(pid)->child_reaper = p;
p->signal->flags |= SIGNAL_UNKILLABLE;
}
p->signal->leader_pid = pid;
p->signal->tty = tty_kref_get(current->signal->tty); /* 加入对应的PID哈希表 */attach_pid(p, PIDTYPE_PGID, task_pgrp(current));
attach_pid(p, PIDTYPE_SID, task_session(current));
list_add_tail(&p->sibling, &p->real_parent->children);
list_add_tail_rcu(&p->tasks, &init_task.tasks); // 加入队列__this_cpu_inc(process_counts); // 将per cpu变量加一 }
attach_pid(p, PIDTYPE_PID, pid); // 维护pid变量nr_threads++; // 线程数加1。 }
total_forks++; // 将全局变量total_forks加1.spin_unlock(¤t->sighand->siglock);
write_unlock_irq(&tasklist_lock);
proc_fork_connector(p);
cgroup_post_fork(p);if (clone_flags & CLONE_THREAD)
threadgroup_change_end(current);
perf_event_fork(p);
trace_task_newtask(p, clone_flags);return p;
}
dup_task_struct也在fork.c文件中
static struct task_struct *dup_task_struct(struct task_struct *orig)
{struct task_struct *tsk; // 存放新的task_sturct结构体struct thread_info *ti; // 存放线程信息unsigned long *stackend; int node = tsk_fork_get_node(orig); int err;
tsk = alloc_task_struct_node(node); // 经过alloc_task_struct()函数建立task_struct结构空间ti = alloc_thread_info_node(tsk, node); // 分配thread_info结构空间err = arch_dup_task_struct(tsk, orig); // 关于浮点结构的复制
tsk->stack = ti; // task的对应栈setup_thread_stack(tsk, orig);
clear_user_return_notifier(tsk);
clear_tsk_need_resched(tsk);
stackend = end_of_stack(tsk);*stackend = STACK_END_MAGIC; /* for overflow detection */#ifdef CONFIG_CC_STACKPROTECTOR
tsk->stack_canary = get_random_int(); // 金丝雀的设置，用于防护栈溢出攻击#endif/* * One for us, one for whoever does the "release_task()" (usually
* parent) */atomic_set(&tsk->usage, 2); // 设置进程块的使用计数。#ifdef CONFIG_BLK_DEV_IO_TRACE
tsk->btrace_seq = 0;#endiftsk->splice_pipe = NULL;
tsk->task_frag.page = NULL;
account_kernel_stack(ti, 1);return tsk;
}
经过上面的代码，能够总结出fork的工做的基本流程是：
五.do_execve的分析
execve对应的内核服务例程位于fs/exec.c中。
/*
* sys_execve() 服务例程执行一个程序.
* filename须要执行的文件的绝对路径
* argv传入系统调用的参数
* regs是系统调用时系统堆栈的状况 */static int do_execve_common(const char *filename,struct user_arg_ptr argv,struct user_arg_ptr envp)
{struct linux_binprm *bprm;struct file *file;struct files_struct *displaced;bool clear_in_exec;int retval;const struct cred *cred = current_cred();
unshare_files(&displaced); // 动态分配一个linux_binprm数据结构，并用新的可执行文件的数据填充这个结构bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
retval = prepare_bprm_creds(bprm);
retval = check_unsafe_exec(bprm);
clear_in_exec = retval;
current->in_execve = 1;
file = open_exec(filename); // 打开可执行文件并读入到内存。retval = PTR_ERR(file);
sched_exec(); // 肯定最小负载的CPU以执行新程序，并把当前进程转移过去。bprm->file = file;
bprm->filename = filename;
bprm->interp = filename;
bprm_mm_init(bprm);
bprm->argc = count(argv, MAX_ARG_STRINGS);
bprm->envc = count(envp, MAX_ARG_STRINGS); // prepare_binprm()填充linux_binprm数据结构，这个函数依次执行：// a.检查文件是否可执行。// b.初始化bprm的e_uid和e_gid字段。// c.用可执行文件的前128个字节填充bprm的buf字段。 prepare_binprm(bprm);
/* 把文件路径名拷贝、命令行参数及环境串拷贝到一个或多个新分配的页框中 */copy_strings_kernel(1, &bprm->filename, bprm);
bprm->exec = bprm->p;
copy_strings(bprm->envc, envp, bprm);
copy_strings(bprm->argc, argv, bprm); // 扫描formats链表，并尽力应用每一个元素的load_binary方法，把bprm传递给这个// 函数。只要load_binary方法成功应答了文件的可执行格式，对formats扫描终止。 search_binary_handler(bprm);/* 成功,释放bprm，返回从该文件可执行格式的load_binary方法中所得到的代码。 */current->fs->in_exec = 0;
current->in_execve = 0;
acct_update_integrals(current);
free_bprm(bprm);if (displaced)
put_files_struct(displaced);return retval;
}
下面咱们看看load_elf_binary函数，该函数位于fs/binfmt_elf.c中
static int load_elf_binary(struct linux_binprm *bprm)
{struct file *interpreter = NULL; /* to shut gcc up */ unsigned long load_addr = 0, load_bias = 0;int load_addr_set = 0;char * elf_interpreter = NULL;
unsigned long error;struct elf_phdr *elf_ppnt, *elf_phdata;
unsigned long elf_bss, elf_brk;int retval, i;
unsigned int size;
unsigned long elf_entry;
unsigned long interp_load_addr = 0;
unsigned long start_code, end_code, start_data, end_data;
unsigned long reloc_func_desc __maybe_unused = 0;int executable_stack = EXSTACK_DEFAULT;
unsigned long def_flags = 0;struct pt_regs *regs = current_pt_regs();struct {struct elfhdr elf_ex;struct elfhdr interp_elf_ex;
} *loc;
loc = kmalloc(sizeof(*loc), GFP_KERNEL); /* 读取可执行文件的首部。首部描述程序的段和所需的共享库。 */loc->elf_ex = *((struct elfhdr *)bprm->buf);/* 检测一致性 */if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)goto out;if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)goto out;if (!elf_check_arch(&loc->elf_ex))goto out;if (!bprm->file->f_op || !bprm->file->f_op->mmap)goto out;/* 读取全部的首部信息 */loc->elf_ex.e_phentsize != sizeof(struct elf_phdr);if (loc->elf_ex.e_phnum < 1 || loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))goto out;
size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr);
retval = -ENOMEM;
elf_phdata = kmalloc(size, GFP_KERNEL);
retval = kernel_read(bprm->file, loc->elf_ex.e_phoff, (char *)elf_phdata, size);if (retval != size) {if (retval >= 0)
retval = -EIO;goto out_free_ph;
}
elf_ppnt = elf_phdata;
elf_bss = 0;
elf_brk = 0;
start_code = ~0UL;
end_code = 0;
start_data = 0;
end_data = 0;for (i = 0; i < loc->elf_ex.e_phnum; i++) {if (elf_ppnt->p_type == PT_INTERP) {/* This is the program interpreter used for
* shared libraries - for now assume that this
* is an a.out format binary */retval = -ENOEXEC;if (elf_ppnt->p_filesz > PATH_MAX ||
elf_ppnt->p_filesz < 2)goto out_free_ph;
retval = -ENOMEM;
elf_interpreter = kmalloc(elf_ppnt->p_filesz,
GFP_KERNEL);if (!elf_interpreter)goto out_free_ph;
retval = kernel_read(bprm->file, elf_ppnt->p_offset,
elf_interpreter,
elf_ppnt->p_filesz);if (retval != elf_ppnt->p_filesz) {if (retval >= 0)
retval = -EIO;goto out_free_interp;
}/* make sure path is NULL terminated */retval = -ENOEXEC;if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')goto out_free_interp;
interpreter = open_exec(elf_interpreter);
retval = PTR_ERR(interpreter);if (IS_ERR(interpreter))goto out_free_interp;/* * If the binary is not readable then enforce
* mm->dumpable = 0 regardless of the interpreter's
* permissions. */would_dump(bprm, interpreter);
retval = kernel_read(interpreter, 0, bprm->buf,
BINPRM_BUF_SIZE);if (retval != BINPRM_BUF_SIZE) {if (retval >= 0)
retval = -EIO;goto out_free_dentry;
}/* Get the exec headers */loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);break;
}
elf_ppnt++;
}
elf_ppnt = elf_phdata;for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)if (elf_ppnt->p_type == PT_GNU_STACK) {if (elf_ppnt->p_flags & PF_X)
executable_stack = EXSTACK_ENABLE_X;elseexecutable_stack = EXSTACK_DISABLE_X;break;
}/* Some simple consistency checks for the interpreter */if (elf_interpreter) {
retval = -ELIBBAD;/* Not an ELF interpreter */if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)goto out_free_dentry;/* Verify the interpreter has a valid arch */if (!elf_check_arch(&loc->interp_elf_ex))goto out_free_dentry;
}// 释放前一个计算所占用的几乎全部资源retval = flush_old_exec(bprm);/* OK, This is the point of no return */current->mm->def_flags = def_flags;/* Do this immediately, since STACK_TOP as used in setup_arg_pages
may depend on the personality. */SET_PERSONALITY(loc->elf_ex);if (elf_read_implies_exec(loc->elf_ex, executable_stack))
current->personality |= READ_IMPLIES_EXEC;if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
current->flags |= PF_RANDOMIZE;
setup_new_exec(bprm);/* Do this so that we can load the interpreter, if need be. We will
change some of these later */current->mm->free_area_cache = current->mm->mmap_base;
current->mm->cached_hole_size = 0;// 为进程的用户态堆栈分配一个新的线性区描述符，并把那个线性区插入到进程的地址空间。 setup_arg_pages(bprm, randomize_stack_top(STACK_TOP), executable_stack);
current->mm->start_stack = bprm->p;/* 如今将ELF镜像文件映射到内存中正确的位置 */for(i = 0, elf_ppnt = elf_phdata;
i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {int elf_prot = 0, elf_flags;
unsigned long k, vaddr;if (elf_ppnt->p_type != PT_LOAD)continue;if (unlikely (elf_brk > elf_bss)) {
unsigned long nbyte; /* There was a PT_LOAD segment with p_memsz > p_filesz
before this one. Map anonymous pages, if needed,
and clear the area. */retval = set_brk(elf_bss + load_bias,
elf_brk + load_bias);if (retval) {
send_sig(SIGKILL, current, 0);goto out_free_dentry;
}
nbyte = ELF_PAGEOFFSET(elf_bss);if (nbyte) {
nbyte = ELF_MIN_ALIGN - nbyte;if (nbyte > elf_brk - elf_bss)
nbyte = elf_brk - elf_bss;if (clear_user((void __user *)elf_bss +load_bias, nbyte)) {/* * This bss-zeroing can fail if the ELF
* file specifies odd protections. So
* we don't check the return value */}
}
}if (elf_ppnt->p_flags & PF_R)
elf_prot |= PROT_READ;if (elf_ppnt->p_flags & PF_W)
elf_prot |= PROT_WRITE;if (elf_ppnt->p_flags & PF_X)
elf_prot |= PROT_EXEC;
elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
vaddr = elf_ppnt->p_vaddr;if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
elf_flags |= MAP_FIXED;
} else if (loc->elf_ex.e_type == ET_DYN) {/* Try and get dynamic programs out of the way of the
* default mmap base, as well as whatever program they
* might try to exec. This is because the brk will
* follow the loader, and is not movable. */#ifdef CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE/* Memory randomization might have been switched off
* in runtime via sysctl.
* If that is the case, retain the original non-zero
* load_bias value in order to establish proper
* non-randomized mappings. */if (current->flags & PF_RANDOMIZE)
load_bias = 0;elseload_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);#elseload_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);#endif}
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
elf_prot, elf_flags, 0);if (BAD_ADDR(error)) {
send_sig(SIGKILL, current, 0);
retval = IS_ERR((void *)error) ?PTR_ERR((void*)error) : -EINVAL;goto out_free_dentry;
}if (!load_addr_set) {
load_addr_set = 1;
load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);if (loc->elf_ex.e_type == ET_DYN) {
load_bias += error - ELF_PAGESTART(load_bias + vaddr);
load_addr += load_bias;
reloc_func_desc = load_bias;
}
}
k = elf_ppnt->p_vaddr;if (k < start_code)
start_code = k;if (start_data < k)
start_data = k;/* * Check to see if the section's size will overflow the
* allowed task size. Note that p_filesz must always be
* <= p_memsz so it is only necessary to check p_memsz. */if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||elf_ppnt->p_memsz > TASK_SIZE ||TASK_SIZE - elf_ppnt->p_memsz < k) {/* set_brk can never work. Avoid overflows. */send_sig(SIGKILL, current, 0);
retval = -EINVAL;goto out_free_dentry;
}
k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;if (k > elf_bss)
elf_bss = k;if ((elf_ppnt->p_flags & PF_X) && end_code < k)
end_code = k;if (end_data < k)
end_data = k;
k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;if (k > elf_brk)
elf_brk = k;
}
loc->elf_ex.e_entry += load_bias;
elf_bss += load_bias;
elf_brk += load_bias;
start_code += load_bias;
end_code += load_bias;
start_data += load_bias;
end_data += load_bias;/* Calling set_brk effectively mmaps the pages that we need
* for the bss and break sections. We must do this before
* mapping in the interpreter, to make sure it doesn't wind
* up getting placed where the bss needs to go. */retval = set_brk(elf_bss, elf_brk);if (retval) {
send_sig(SIGKILL, current, 0);goto out_free_dentry;
}if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
send_sig(SIGSEGV, current, 0);
retval = -EFAULT; /* Nobody gets to see this, but.. */goto out_free_dentry;
}// 调用一个动态连接程序的函数。若是动态连接程序是elf可执行的，这// 个函数就叫作load_elf_interp()。if (elf_interpreter) {
unsigned long interp_map_addr = 0;
elf_entry = load_elf_interp(&loc->interp_elf_ex,
interpreter,&interp_map_addr,
load_bias);if (!IS_ERR((void *)elf_entry)) {/* * load_elf_interp() returns relocation
* adjustment */interp_load_addr = elf_entry;
elf_entry += loc->interp_elf_ex.e_entry;
}if (BAD_ADDR(elf_entry)) {
force_sig(SIGSEGV, current);
retval = IS_ERR((void *)elf_entry) ?(int)elf_entry : -EINVAL;goto out_free_dentry;
}
reloc_func_desc = interp_load_addr;
allow_write_access(interpreter);
fput(interpreter);
kfree(elf_interpreter);
} else {
elf_entry = loc->elf_ex.e_entry;if (BAD_ADDR(elf_entry)) {
force_sig(SIGSEGV, current);
retval = -EINVAL;goto out_free_dentry;
}
}
kfree(elf_phdata);// 把可执行格式的linux_binfmt对象的地址存放在进程描述符的binfmt字段中。set_binfmt(&elf_format);
#ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
retval = arch_setup_additional_pages(bprm, !!elf_interpreter);if (retval < 0) {
send_sig(SIGKILL, current, 0);goto out;
}#endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */install_exec_creds(bprm);
retval = create_elf_tables(bprm, &loc->elf_ex,
load_addr, interp_load_addr);if (retval < 0) {
send_sig(SIGKILL, current, 0);goto out;
}/* N.B. passed_fileno might not be initialized? */current->mm->end_code = end_code;
current->mm->start_code = start_code;
current->mm->start_data = start_data;
current->mm->end_data = end_data;
current->mm->start_stack = bprm->p;
#ifdef arch_randomize_brkif ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
current->mm->brk = current->mm->start_brk =arch_randomize_brk(current->mm);
#ifdef CONFIG_COMPAT_BRK
current->brk_randomized = 1;#endif}#endifif (current->personality & MMAP_PAGE_ZERO) {/* Why this, you ask??? Well SVr4 maps page 0 as read-only,
and some applications "depend" upon this behavior.
Since we do not have the power to recompile these, we
emulate the SVr4 behavior. Sigh. */error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
MAP_FIXED | MAP_PRIVATE, 0);
}
#ifdef ELF_PLAT_INIT/* * The ABI may specify that certain registers be set up in special
* ways (on i386 %edx is the address of a DT_FINI function, for
* example. In addition, it may also specify (eg, PowerPC64 ELF)
* that the e_entry field is the address of the function descriptor
* for the startup routine, rather than the address of the startup
* routine itself. This macro performs whatever initialization to
* the regs structure is required as well as any relocations to the
* function descriptor entries when executing dynamically links apps. */ELF_PLAT_INIT(regs, reloc_func_desc);#endifstart_thread(regs, elf_entry, bprm->p);
retval = 0;out:
kfree(loc);
out_ret:return retval;/* error cleanup */out_free_dentry:
allow_write_access(interpreter);if (interpreter)
fput(interpreter);
out_free_interp:
kfree(elf_interpreter);
out_free_ph:
kfree(elf_phdata);goto out;
}