struct task_struct {
 ? ?/*
 ? ? * offsets of these are hardcoded elsewhere - touch with care
 ? ? */
 ? ? volatile long state; ? ?/* -1 unrunnable, 0 runnable, >0 stopped */
 ? ? unsigned long flags; ? ?/* per process flags, defined below */
 ? ? int sigpending;
 ? ? mm_segment_t addr_limit; ? ?/* thread address space:
 ? ? ? ? ? ? ? ? ? ? ? ?0-0xBFFFFFFF for user-thead
 ? ? ? ? ? ? ? ? ? ? ? ?0-0xFFFFFFFF for kernel-thread
 ? ? ? ? ? ? ? ? ? ? */
 ? ? struct exec_domain *exec_domain;
 ? ? volatile long need_resched;
 ? ? unsigned long ptrace;

 ? ? int lock_depth; ? ? /* Lock depth */

/*
 * offset 32 begins here on 32-bit platforms. We keep
 * all fields in a single cacheline that are needed for
 * the goodness() loop in schedule().
 */
 ? ? long counter;
 ? ? long nice;
 ? ? unsigned long policy;
 ? ? struct mm_struct *mm;
 ? ? int processor;
 ? ? ...
}

static inline struct task_struct * get_current(void)
{
 ? ? struct task_struct *current;
 ? ? __asm__("andl %%esp,%0; ":"=r" (current) : "0" (~8191UL));
 ? ? return current;
}

asmlinkage int sys_fork(struct pt_regs regs)
{
 ? ? return do_fork(SIGCHLD, regs.esp, ?s, 0);
}

int do_fork(unsigned long clone_flags, unsigned long stack_start,
 ? ? ? ?struct pt_regs *regs, unsigned long stack_size)
{
 ? ? ...
 ? ? p = alloc_task_struct(); // 申請(qǐng)進(jìn)程描述符
 ? ? ...
 ? ? if (copy_files(clone_flags, p))
 ? ? ? ? ?goto bad_fork_cleanup;
 ? ? if (copy_fs(clone_flags, p))
 ? ? ? ? ?goto bad_fork_cleanup_files;
 ? ? if (copy_sighand(clone_flags, p))
 ? ? ? ? ?goto bad_fork_cleanup_fs;
 ? ? if (copy_mm(clone_flags, p))
 ? ? ? ? ?goto bad_fork_cleanup_sighand;
 ? ? if (copy_namespace(clone_flags, p))
 ? ? ? ? ?goto bad_fork_cleanup_mm;
 ? ? retval = copy_thread(0, clone_flags, stack_start, stack_size, p, regs);
 ? ? ...
 ? ? wake_up_process(p);
 ? ? ...
}

int copy_thread(int nr, unsigned long clone_flags, unsigned long esp,
 ? ?unsigned long unused,
 ? ?struct task_struct * p, struct pt_regs * regs)
{
 ? ? struct pt_regs * childregs;

 ? ? // 指向棧頂(見(jiàn)圖2)
 ? ? childregs = ((struct pt_regs *) (THREAD_SIZE + (unsigned long) p)) - 1;
 ? ? struct_cpy(childregs, regs); ?// 復(fù)制父進(jìn)程的棧信息
 ? ? childregs->eax = 0; ? // 這個(gè)是子進(jìn)程調(diào)用fork()之后的返回值, 也就是0
 ? ? childregs->esp = esp; // 設(shè)置新的棧空間

 ? ? p->thread.esp = (unsigned long) childregs; ? ? ?// 子進(jìn)程當(dāng)前的棧地址, 調(diào)用switch_to()的時(shí)候esp設(shè)置為這個(gè)地址
 ? ? p->thread.esp0 = (unsigned long) (childregs+1); // 子進(jìn)程內(nèi)核空間棧地址
 ? ? p->thread.eip = (unsigned long) ret_from_fork; ?// 子進(jìn)程將要執(zhí)行的代碼地址

 ? ? savesegment(fs,p->thread.fs);
 ? ? savesegment(gs,p->thread.gs);

 ? ? unlazy_fpu(current);
 ? ? struct_cpy(&p->thread.i387, ¤t->thread.i387);

 ? ? return 0;
}

int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags)
{
 ? ?long retval, d0;

 ? ?__asm__ __volatile__(
 ? ? ? ?"movl %%esp,%%esi\n\t"
 ? ? ? ?"int $0x80\n\t" ? ? ? ?/* Linux/i386 system call */
 ? ? ? ?"cmpl %%esp,%%esi\n\t" ?/* child or parent? */
 ? ? ? ?"je 1f\n\t" ? ? /* parent - jump */
 ? ? ? ?/* Load the argument into eax, and push it. ?That way, it does
 ? ? ? ? * not matter whether the called function is compiled with
 ? ? ? ? * -mregparm or not. ?*/
 ? ? ? ?"movl %4,%%eax\n\t"
 ? ? ? ?"pushl %%eax\n\t" ? ? ?
 ? ? ? ?"call *%5\n\t" ? ? ?/* call fn */
 ? ? ? ?"movl %3,%0\n\t" ? ?/* exit */
 ? ? ? ?"int $0x80\n"
 ? ? ? ?"1:\t"
 ? ?:"=&a" (retval), "=&S" (d0)
 ? ?:"0" (__NR_clone), "i" (__NR_exit),
 ? ?"r" (arg), "r" (fn),
 ? ?"b" (flags | CLONE_VM)
 ? ?: "memory");
 ? ?return retval;
}