LINUX内核分析第三周学习总结——构造一个简单的Linux系统MenuOS

LINUX内核分析第三周学习总结——构造一个简单的Linux系统MenuOS

张忻（原创作品转载请注明出处）

《Linux内核分析》MOOC课程http://mooc.study.163.com/course/USTC-1000029000

一、使用gdb跟踪调试内核从start_kernel到init进程启动

使用实验楼的虚拟机打开shell

cd LinuxKernel/
qemu -kernel linux-3.18./arch/x86/boot/bzImage -initrd rootfs.img

内核启动完成后进入menu程序,支持三个命令help、version和quit。

qemu -kernel linux-3.18./arch/x86/boot/bzImage -initrd rootfs.img -s -S # 关于-s和-S选项的说明：
 -S freeze CPU at startup (use ’c’ to start execution)
 -s shorthand for -gdb tcp:: 若不想使用1234端口，则可以使用-gdb tcp:xxxx来取代-s选项

现在系统是stop的状态，如下图：

按c后系统开始运行，启动到start_cernel的位置，如下：

list之后看到执行的位置

再设一个断点，系统执行到rest_init的位置，如下：

二、详细分析从start_kernel到init进程启动的过程

start_kernel函数的执行过程

代码在init目录下的main.c

500asmlinkage __visible void __init start_kernel(void)
{
    char *command_line;
    char *after_dashes;

    /*
506     * Need to run as early as possible, to initialize the
507     * lockdep hash:
508     */
    lockdep_init();
    set_task_stack_end_magic(&init_task);     init_task即手工创建的PCB，0号进程即最终的idle进程。
    smp_setup_processor_id();
    debug_objects_early_init();

    /*
515     * Set up the the initial canary ASAP:
516     */
    boot_init_stack_canary();

    cgroup_init_early();

    local_irq_disable();
    early_boot_irqs_disabled = true;

/*
525 * Interrupts are still disabled. Do necessary setups, then
526 * enable them
527 */
    boot_cpu_init();
    page_address_init();
    pr_notice("%s", linux_banner);
    setup_arch(&command_line);
    mm_init_cpumask(&init_mm);
    setup_command_line(command_line);
    setup_nr_cpu_ids();
    setup_per_cpu_areas();
    smp_prepare_boot_cpu();    /* arch-specific boot-cpu hooks */

    build_all_zonelists(NULL, NULL);
    page_alloc_init();

    pr_notice("Kernel command line: %s\n", boot_command_line);
    parse_early_param();
    after_dashes = parse_args("Booting kernel",
                  static_command_line, __start___param,
                  __stop___param - __start___param,
                  -, -, &unknown_bootoption);
    if (!IS_ERR_OR_NULL(after_dashes))
        parse_args("Setting init args", after_dashes, NULL, , -, -,
               set_init_arg);

    jump_label_init();

    /*
554     * These use large bootmem allocations and must precede
555     * kmem_cache_init()
556     */
    setup_log_buf();
    pidhash_init();
    vfs_caches_init_early();
    sort_main_extable();
    trap_init();   涉及到中断的初始化
    mm_init();

    /*
565     * Set up the scheduler prior starting any interrupts (such as the
566     * timer interrupt). Full topology setup happens at smp_init()
567     * time - but meanwhile we still have a functioning scheduler.
568     */
    sched_init();
    /*
571     * Disable preemption - early bootup scheduling is extremely
572     * fragile until we cpu_idle() for the first time.
573     */
    preempt_disable();
    if (WARN(!irqs_disabled(),
         "Interrupts were enabled *very* early, fixing it\n"))
        local_irq_disable();
    idr_init_cache();
    rcu_init();
    context_tracking_init();
    radix_tree_init();
    /* init some links before init_ISA_irqs() */
    early_irq_init();
    init_IRQ();
    tick_init();
    rcu_init_nohz();
    init_timers();
    hrtimers_init();
    softirq_init();
    timekeeping_init();
    time_init();
    sched_clock_postinit();
    perf_event_init();
    profile_init();
    call_function_init();
    WARN(!irqs_disabled(), "Interrupts were enabled early\n");
    early_boot_irqs_disabled = false;
    local_irq_enable();

    kmem_cache_init_late();

    /*
603     * HACK ALERT! This is early. We're enabling the console before
604     * we've done PCI setups etc, and console_init() must be aware of
605     * this. But we do want output early, in case something goes wrong.
606     */
    console_init();
    if (panic_later)
        panic("Too many boot %s vars at `%s'", panic_later,
              panic_param);

    lockdep_info();

    /*
615     * Need to run this when irqs are enabled, because it wants
616     * to self-test [hard/soft]-irqs on/off lock inversion bugs
617     * too:
618     */
    locking_selftest();

#ifdef CONFIG_BLK_DEV_INITRD
    if (initrd_start && !initrd_below_start_ok &&
        page_to_pfn(virt_to_page((void *)initrd_start)) < min_low_pfn) {
        pr_crit("initrd overwritten (0x%08lx < 0x%08lx) - disabling it.\n",
            page_to_pfn(virt_to_page((void *)initrd_start)),
            min_low_pfn);
        initrd_start = ;
    }
#endif
    page_cgroup_init();
    debug_objects_mem_init();
    kmemleak_init();
    setup_per_cpu_pageset();
    numa_policy_init();
    if (late_time_init)
        late_time_init();
    sched_clock_init();
    calibrate_delay();
    pidmap_init();
    anon_vma_init();
    acpi_early_init();
#ifdef CONFIG_X86
    if (efi_enabled(EFI_RUNTIME_SERVICES))
        efi_enter_virtual_mode();
#endif
#ifdef CONFIG_X86_ESPFIX64
    /* Should be run before the first non-init thread is created */
    init_espfix_bsp();
#endif
    thread_info_cache_init();
    cred_init();
    fork_init(totalram_pages);
    proc_caches_init();
    buffer_init();
    key_init();
    security_init();
    dbg_late_init();
    vfs_caches_init(totalram_pages);
    signals_init();
    /* rootfs populating might need page-writeback */
    page_writeback_init();
    proc_root_init();
    cgroup_init();
    cpuset_init();
    taskstats_init_early();
    delayacct_init();

    check_bugs();

    sfi_init_late();

    if (efi_enabled(EFI_RUNTIME_SERVICES)) {
        efi_late_init();
        efi_free_boot_services();
    }

    ftrace_init();

    /* Do the rest non-__init'ed, we're now alive */
    rest_init();
}

不管分析内核的哪一部分都会涉及到start_cernel。

（1）561 trap_init();

涉及到中断的初始化

只需查看 /linux-3.18.6/arch/x86/kernel/

其中设置了很多中断门。

设置系统陷阱门：

    set_system_trap_gate(SYSCALL_VECTOR, &system_call);
    set_bit(SYSCALL_VECTOR, used_vectors);

（2）562 mm_init();

系统管理模块；

（3）569 sched_init();

调度模块；

（4）680 rest_init();

403 kernel_thread(kernel_init, NULL, CLONE_FS);

kernel_init里：

    if (ramdisk_execute_command) {
        ret = run_init_process(ramdisk_execute_command);
        if (!ret)
            return ;
        pr_err("Failed to execute %s (error %d)\n",
               ramdisk_execute_command, ret);
    }

以上创建用户态的一号进程

405 pid = kernel_thread(kthreadd, NULL, CLONE_FS | CLONE_FILES);

以上创建内核线程

    /* Call into cpu_idle with preempt disabled */
    cpu_startup_entry(CPUHP_ONLINE);

418行函数 具体代码为：

256void cpu_startup_entry(enum cpuhp_state state)
{
    /*
259     * This #ifdef needs to die, but it's too late in the cycle to
260     * make this generic (arm and sh have never invoked the canary
261     * init for the non boot cpus!). Will be fixed in 3.11
262     */
#ifdef CONFIG_X86
    /*
265     * If we're the non-boot CPU, nothing set the stack canary up
266     * for us. The boot CPU already has it initialized but no harm
267     * in doing it again. This is a good place for updating it, as
268     * we wont ever return from this function (so the invalid
269     * canaries already on the stack wont ever trigger).
270     */
    boot_init_stack_canary();
#endif
    arch_cpu_idle_prepare();
    cpu_idle_loop();
}

其中第274行函数代码实现0号进程

当系统没有进程需要执行时就调度到idle进程。

（5）回顾总结

start_kernel启动时，0号进程——rest_init()会一直存在。0号进程创建了1号进程kernel_init()。

三、总结

对“Linux系统启动过程”的理解。

task 0 的进程结构(task_struct init_task)由INIT_TASK宏静态定义。该结构体(init_task)在linux 启动时被设置为current_task。当初始化到rest_init函数中时，通过kernel_thread函数启动第一个内核线程 kernel_init。kernel_init再通过do_execve启动/sbin/init。这就是我们看到的init进程，进程号为1。初始化 的最后linux调用scheule()整个系统就运行起来了。