陈铁+ 原创作品转载请注明出处 + 《Linux内核分析》MOOC课程
对于现代操作系统，多任务是必备的，在linux系统下，进程会不断的被内核调度，从X进程切换为Y进程，以实现用户所见到的多任务状态，下面我们就看一看这样的过程，分析一下内核如何对进程调度，以及进程间如何切换。
内核使用schedule()函数实现进程的调度，而通常的用户进程要无法主动调度这个函数，只能通过中断处理过程（包括时钟中断、I/O中断、系统调用和异常）在某个合适的时机点被动调度；对于现代操作系统，还有内核线程，而内核线程是可以直接调度schedule函数的，只有内核态，当然也可以象用户态进程一样在中断处理过程中被动调度。
为了控制进程的执行，内核必须有能力挂起正在CPU上执行的进程，并恢复以前挂起的某个进程的执行，这叫做进程切换、任务切换、上下文切换；挂起正在CPU上执行的进程，与中断时保存现场不同的，中断前后是在同一个进程上下文中，只是由用户态转向内核态执行；而进程切换是在两个进程之间进行转换，切换前后的上下文是在不同的进程空间。进程上下文包含了进程执行需要的所有信息：用户地址空间：包括程序代码，数据，用户堆栈等；控制信息：进程描述符，内核堆栈等；硬件上下文。
下面将进程切换的关键代码摘录如下：
1、schedule函数
asmlinkage __visible void __sched schedule(void){ struct task_struct *tsk = current; sched_submit_work(tsk); __schedule();} 2、__schedule()函数
2770static void __sched __schedule(void)2771{2772 struct task_struct *prev, *next;2773 unsigned long *switch_count;2774 struct rq *rq;2775 int cpu;27762777need_resched:2778 preempt_disable();2779 cpu = smp_processor_id();2780 rq = cpu_rq(cpu);2781 rcu_note_context_switch(cpu);2782 prev = rq->curr;27832784 schedule_debug(prev);27852786 if (sched_feat(HRTICK))2787 hrtick_clear(rq);27882789 /*2790 * Make sure that signal_pending_state()->signal_pending() below2791 * can't be reordered with __set_current_state(TASK_INTERRUPTIBLE)2792 * done by the caller to avoid the race with signal_wake_up().2793 */2794 smp_mb__before_spinlock();2795 raw_spin_lock_irq(&rq->lock);27962797 switch_count = &prev->nivcsw;2798 if (prev->state && !(preempt_count() & PREEMPT_ACTIVE)) {2799 if (unlikely(signal_pending_state(prev->state, prev))) {2800 prev->state = TASK_RUNNING;2801 } else {2802 deactivate_task(rq, prev, DEQUEUE_SLEEP);2803 prev->on_rq = 0;28042805 /*2806 * If a worker went to sleep, notify and ask workqueue2807 * whether it wants to wake up a task to maintain2808 * concurrency.2809 */2810 if (prev->flags & PF_WQ_WORKER) {2811 struct task_struct *to_wakeup;28122813 to_wakeup = wq_worker_sleeping(prev, cpu);2814 if (to_wakeup)2815 try_to_wake_up_local(to_wakeup);2816 }2817 }2818 switch_count = &prev->nvcsw;2819 }28202821 if (task_on_rq_queued(prev) || rq->skip_clock_update < 0)2822 update_rq_clock(rq);28232824 next = pick_next_task(rq, prev);2825 clear_tsk_need_resched(prev);2826 clear_preempt_need_resched();2827 rq->skip_clock_update = 0;28282829 if (likely(prev != next)) {2830 rq->nr_switches++;2831 rq->curr = next;2832 ++*switch_count;28332834 context_switch(rq, prev, next); /* unlocks the rq */2835 /*2836 * The context switch have flipped the stack from under us2837 * and restored the local variables which were saved when2838 * this task called schedule() in the past. prev == current2839 * is still correct, but it can be moved to another cpu/rq.2840 */2841 cpu = smp_processor_id();2842 rq = cpu_rq(cpu);2843 } else2844 raw_spin_unlock_irq(&rq->lock);28452846 post_schedule(rq);28472848 sched_preempt_enable_no_resched();2849 if (need_resched())2850 goto need_resched;2851} 其中关键语句：
struct task_struct *prev, *next; next = pick_next_task(rq, prev); //进程调度算法context_switch(rq, prev, next); /* unlocks the rq */ //进程上下文切换
3、context_switch函数
2332 * context_switch - switch to the new MM and the new2333 * thread's register state.2334 */2335static inline void2336context_switch(struct rq *rq, struct task_struct *prev,2337 struct task_struct *next)2338{2339 struct mm_struct *mm, *oldmm;23402341 prepare_task_switch(rq, prev, next);23422343 mm = next->mm;2344 oldmm = prev->active_mm;2345 /*2346 * For paravirt, this is coupled with an exit in switch_to to2347 * combine the page table reload and the switch backend into2348 * one hypercall.2349 */2350 arch_start_context_switch(prev);23512352 if (!mm) {2353 next->active_mm = oldmm;2354 atomic_inc(&oldmm->mm_count);2355 enter_lazy_tlb(oldmm, next);2356 } else2357 switch_mm(oldmm, mm, next);23582359 if (!prev->mm) {2360 prev->active_mm = NULL;2361 rq->prev_mm = oldmm;2362 }2363 /*2364 * Since the runqueue lock will be released by the next2365 * task (which is an invalid locking op but in the case2366 * of the scheduler it's an obvious special-case), so we2367 * do an early lockdep release here:2368 */2369 spin_release(&rq->lock.dep_map, 1, _THIS_IP_);23702371 context_tracking_task_switch(prev, next);2372 /* Here we just switch the register state and the stack. */2373 switch_to(prev, next, prev);23742375 barrier();2376 /*2377 * this_rq must be evaluated again because prev may have moved2378 * CPUs since it called schedule(), thus the 'rq' on its stack2379 * frame will be invalid.2380 */2381 finish_task_switch(this_rq(), prev);2382} 4、switch_to宏定义了一段内联汇编代码
31#define switch_to(prev, next, last) \32do { \33 /* \34 * Context-switching clobbers all registers, so we clobber \35 * them explicitly, via unused output variables. \36 * (EAX and EBP is not listed because EBP is saved/restored \37 * explicitly for wchan access and EAX is the return value of \38 * __switch_to()) \39 */ \40 unsigned long ebx, ecx, edx, esi, edi; \41 \42 asm volatile("pushfl\n\t" /* save flags */ \43 "pushl %%ebp\n\t" /* save EBP */ \44 "movl %%esp,%[prev_sp]\n\t" /* save ESP */ \45 "movl %[next_sp],%%esp\n\t" /* restore ESP */ \46 "movl $1f,%[prev_ip]\n\t" /* save EIP */ \47 "pushl %[next_ip]\n\t" /* restore EIP */ \48 __switch_canary \49 "jmp __switch_to\n" /* regparm call */ \50 "1:\t" \51 "popl %%ebp\n\t" /* restore EBP */ \52 "popfl\n" /* restore flags */ \53 \54 /* output parameters */ \55 : [prev_sp] "=m" (prev->thread.sp), \56 [prev_ip] "=m" (prev->thread.ip), \57 "=a" (last), \58 \59 /* clobbered output registers: */ \60 "=b" (ebx), "=c" (ecx), "=d" (edx), \61 "=S" (esi), "=D" (edi) \62 \63 __switch_canary_oparam \64 \65 /* input parameters: */ \66 : [next_sp] "m" (next->thread.sp), \67 [next_ip] "m" (next->thread.ip), \68 \69 /* regparm parameters for __switch_to(): */ \70 [prev] "a" (prev), \71 [next] "d" (next) \72 \73 __switch_canary_iparam \74 \75 : /* reloaded segment registers */ \76 "memory"); \77} while (0) 通过以上代码，我们可以看到，当cpu由正在运行的X进程切换到Y进程的大致步骤，其中X，Y是哪一个进程是由调度算法决定的。
进程X正在中运行->发生中断->进行中断处理（保存当前的eflag，eip，esp；加载内核中特定的eflag，eip，esp）->执行SAVE ALL->中断处理过程中或中断返回前调用了schedule(),switch_to实现关键的进程上下文切换->开始从标号1之后运行用户态进程Y->restore all->iret从内核堆栈中返回eflag，eip，esp->继续执行Y进程。对于前面提到的内核线程，以及系统中的特殊调用fork和execve会有些特殊，但大致原则是相同的。