Pid Namespace 详解

while (t) {
    t = next_thread(t);
}

struct pid *pgrp;
struct task_struct *p = NULL;

do_each_pid_task(pgrp, PIDTYPE_PGID, p) {
    ...
} while_each_pid_task(pgrp, PIDTYPE_PGID, p);


#define do_each_pid_task(pid, type, task)                \
do {                                \
    if ((pid) != NULL)                    \
        hlist_for_each_entry_rcu((task),        \
            &(pid)->tasks[type], pids[type].node) {

        /*
         * Both old and new leaders may be attached to
         * the same pid in the middle of de_thread().
         */
#define while_each_pid_task(pid, type, task)                \
            if (type == PIDTYPE_PID)        \
                break;                \
        }                        \
} while (0)

struct pid *session
struct task_struct *p;

do_each_pid_task(session, PIDTYPE_SID, p) {
    ...
} while_each_pid_task(session, PIDTYPE_SID, p);

_do_fork() → copy_process()：

static __latent_entropy struct task_struct *copy_process(
    unsigned long clone_flags,
    unsigned long stack_start,
    unsigned long stack_size,
    int __user *child_tidptr,
    struct pid *pid,
    int trace,
    unsigned long tls,
    int node)
{

    /* (1) 分配一个新的task_struct结构，并且拷贝父进程task中所有内容
            所以接下来如果没有给新task_struct中的成员赋新值，那么它的值就是和父进程一样的
     */
    p = dup_task_struct(current, node);

    /* (2) 拷贝名空间 */
    retval = copy_namespaces(clone_flags, p);

    /* (3) 在名空间中分配一个`struct pid *`结构 */
    if (pid != &init_struct_pid) {
        pid = alloc_pid(p->nsproxy->pid_ns_for_children);
        if (IS_ERR(pid)) {
            retval = PTR_ERR(pid);
            goto bad_fork_cleanup_thread;
        }
    }

    /* (4.1) 取出`struct pid`中最顶层名空间的pid number，赋值给task_struct->pid
            task_struct->pid相当于是一个快捷方式，取最顶层的pid number不用每次去查询struct pid->numbers[].nr数组
     */
    p->pid = pid_nr(pid);
    /* (4.2) 线程组tgid的赋值，创建线程时：
            group_leader等于父进程的group_leader
            tgid等于父进程的tgid
     */
    if (clone_flags & CLONE_THREAD) {
        p->exit_signal = -1;
        p->group_leader = current->group_leader;
        p->tgid = current->tgid;
    } else {
    /* (4.3) 线程组tgid的赋值，创建进程(group_leader)时：
            group_leader等于本进程的group_leader
            tgid等于本进程的tgid
     */
        if (clone_flags & CLONE_PARENT)
            p->exit_signal = current->group_leader->exit_signal;
        else
            p->exit_signal = (clone_flags & CSIGNAL);
        p->group_leader = p;
        p->tgid = p->pid;
    }

    if (likely(p->pid)) {
        ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);

        /* (5.1) 赋值新结构task_struct->pids[PIDTYPE_PID].pid，将新分配的`struct pid`结构赋值给它 */
        init_task_pid(p, PIDTYPE_PID, pid);
        /* (5.2) 如果本进程是线程组的group leader进行pgid和sid的新赋值和链接操作
                如果本进程是线程组中一个普通线程，它的pgid和sid从group leader复制继承，并且不会加入到pgid和sid的链表当中
         */
        if (thread_group_leader(p)) {
            /* (5.2.1) 赋值新结构task_struct->pids[PIDTYPE_PGID].pid，
                        将当前进程的所在线程组的group_leader的pgid赋值给他：task->group_leader->pids[PIDTYPE_PGID].pid
             */
            init_task_pid(p, PIDTYPE_PGID, task_pgrp(current));
            /* (5.2.2) 赋值新结构task_struct->pids[PIDTYPE_SID].pid，
                        将当前进程的所在线程组的group_leader的sid赋值给他：task->group_leader->pids[PIDTYPE_SID].pid
             */
            init_task_pid(p, PIDTYPE_SID, task_session(current));

            if (is_child_reaper(pid)) {
                ns_of_pid(pid)->child_reaper = p;
                p->signal->flags |= SIGNAL_UNKILLABLE;
            }

            /* (5.2.3) 给线程组group_leader的leader_pid赋值`struct pid`结构
                        p->signal保存的是这个线程组公共的信号
                        p->pending保存的是每个进程私有的信号
             */
            p->signal->leader_pid = pid;
            p->signal->tty = tty_kref_get(current->signal->tty);
            /*
             * Inherit has_child_subreaper flag under the same
             * tasklist_lock with adding child to the process tree
             * for propagate_has_child_subreaper optimization.
             */
            p->signal->has_child_subreaper = p->real_parent->signal->has_child_subreaper ||
                             p->real_parent->signal->is_child_subreaper;
            list_add_tail(&p->sibling, &p->real_parent->children);
            list_add_tail_rcu(&p->tasks, &init_task.tasks);
            /* (5.2.4) 当前是线程组的group_leader
                        将新进程的task_struct结构加入到进程所在pgid的pid->tasks[PIDTYPE_PGID]链表当中
             */
            attach_pid(p, PIDTYPE_PGID);
            /* (5.2.5) 当前是线程组的group_leader
                        将新进程的task_struct结构加入到进程所在pgid的pid->tasks[PIDTYPE_SID]链表当中
             */
            attach_pid(p, PIDTYPE_SID);
            __this_cpu_inc(process_counts);
        } else {
            current->signal->nr_threads++;
            atomic_inc(&current->signal->live);
            atomic_inc(&current->signal->sigcnt);
            /* (5.3.1) 将线程加入group_leader的thread_group链表 */
            list_add_tail_rcu(&p->thread_group,
                      &p->group_leader->thread_group);
            list_add_tail_rcu(&p->thread_node,
                      &p->signal->thread_head);
        }
        /* (5.4) 将新进程的task_struct结构加入到pid->tasks[PIDTYPE_PID]链表当中
        */
        attach_pid(p, PIDTYPE_PID);
        nr_threads++;
    }

}

__do_fork() → copy_process() → copy_namespaces() → create_new_namespaces() → copy_pid_ns():

static struct nsproxy *create_new_namespaces(unsigned long flags,
    struct task_struct *tsk, struct user_namespace *user_ns,
    struct fs_struct *new_fs)
{
    struct nsproxy *new_nsp;
    int err;

    /* (1) 分配一个进程的名空间代理 */
    new_nsp = create_nsproxy();
    if (!new_nsp)
        return ERR_PTR(-ENOMEM);

    new_nsp->mnt_ns = copy_mnt_ns(flags, tsk->nsproxy->mnt_ns, user_ns, new_fs);
    if (IS_ERR(new_nsp->mnt_ns)) {
        err = PTR_ERR(new_nsp->mnt_ns);
        goto out_ns;
    }

    new_nsp->uts_ns = copy_utsname(flags, user_ns, tsk->nsproxy->uts_ns);
    if (IS_ERR(new_nsp->uts_ns)) {
        err = PTR_ERR(new_nsp->uts_ns);
        goto out_uts;
    }

    new_nsp->ipc_ns = copy_ipcs(flags, user_ns, tsk->nsproxy->ipc_ns);
    if (IS_ERR(new_nsp->ipc_ns)) {
        err = PTR_ERR(new_nsp->ipc_ns);
        goto out_ipc;
    }

    /* (2) 根据flags，判断当前pid名空间是引用旧的，还是创建一个新的
     */
    new_nsp->pid_ns_for_children =
        copy_pid_ns(flags, user_ns, tsk->nsproxy->pid_ns_for_children);
    if (IS_ERR(new_nsp->pid_ns_for_children)) {
        err = PTR_ERR(new_nsp->pid_ns_for_children);
        goto out_pid;
    }

    new_nsp->cgroup_ns = copy_cgroup_ns(flags, user_ns,
                        tsk->nsproxy->cgroup_ns);
    if (IS_ERR(new_nsp->cgroup_ns)) {
        err = PTR_ERR(new_nsp->cgroup_ns);
        goto out_cgroup;
    }

    new_nsp->net_ns = copy_net_ns(flags, user_ns, tsk->nsproxy->net_ns);
    if (IS_ERR(new_nsp->net_ns)) {
        err = PTR_ERR(new_nsp->net_ns);
        goto out_net;
    }

    return new_nsp;
}

↓

struct pid_namespace *copy_pid_ns(unsigned long flags,
    struct user_namespace *user_ns, struct pid_namespace *old_ns)
{
    /* (2.1) 如果没有设置CLONE_NEWPID标志，引用旧的pid_namespace */
    if (!(flags & CLONE_NEWPID))
        return get_pid_ns(old_ns);
    if (task_active_pid_ns(current) != old_ns)
        return ERR_PTR(-EINVAL);
    /* (2.2) 如果设置了CLONE_NEWPID标志，创建一个新的pid_namespace并引用 */
    return create_pid_namespace(user_ns, old_ns);
}

↓

static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns,
    struct pid_namespace *parent_pid_ns)
{
    struct pid_namespace *ns;
    /* (2.2.1) 在父名空间的基础上，将level加1 */
    unsigned int level = parent_pid_ns->level + 1;
    struct ucounts *ucounts;
    int err;

    err = -EINVAL;
    if (!in_userns(parent_pid_ns->user_ns, user_ns))
        goto out;

    err = -ENOSPC;
    if (level > MAX_PID_NS_LEVEL)
        goto out;
    ucounts = inc_pid_namespaces(user_ns);
    if (!ucounts)
        goto out;

    err = -ENOMEM;
    ns = kmem_cache_zalloc(pid_ns_cachep, GFP_KERNEL);
    if (ns == NULL)
        goto out_dec;

    idr_init(&ns->idr);

    /* (2.2.2) 根据名空间level层级，创建对应的struct pid的slub内存池
                因为level不一样，struct pid中包含的pid number数组大小也不一样，所以实际struct pid大小是根据level动态变化的
     */
    ns->pid_cachep = create_pid_cachep(level + 1);
    if (ns->pid_cachep == NULL)
        goto out_free_idr;

    err = ns_alloc_inum(&ns->ns);
    if (err)
        goto out_free_idr;
    ns->ns.ops = &pidns_operations;

    kref_init(&ns->kref);
    ns->level = level;
    ns->parent = get_pid_ns(parent_pid_ns);
    ns->user_ns = get_user_ns(user_ns);
    ns->ucounts = ucounts;
    ns->pid_allocated = PIDNS_ADDING;
    INIT_WORK(&ns->proc_work, proc_cleanup_work);

    return ns;

out_free_idr:
    idr_destroy(&ns->idr);
    kmem_cache_free(pid_ns_cachep, ns);
out_dec:
    dec_pid_namespaces(ucounts);
out:
    return ERR_PTR(err);
}

copy_process()
{

    if (pid != &init_struct_pid) {
        pid = alloc_pid(p->nsproxy->pid_ns_for_children);
        if (IS_ERR(pid)) {
            retval = PTR_ERR(pid);
            goto bad_fork_cleanup_thread;
        }
    }

}

↓

struct pid *alloc_pid(struct pid_namespace *ns)
{
    struct pid *pid;
    enum pid_type type;
    int i, nr;
    struct pid_namespace *tmp;
    struct upid *upid;
    int retval = -ENOMEM;

    /* (1) 从名空间中分配一个对应的struct pid数据 */
    pid = kmem_cache_alloc(ns->pid_cachep, GFP_KERNEL);
    if (!pid)
        return ERR_PTR(retval);

    tmp = ns;
    pid->level = ns->level;

    /* (2) 在每个层级名空间，分配一个对应的pid number，存储到struct pid中的number数组 */
    for (i = ns->level; i >= 0; i--) {
        int pid_min = 1;

        idr_preload(GFP_KERNEL);
        spin_lock_irq(&pidmap_lock);

        /*
         * init really needs pid 1, but after reaching the maximum
         * wrap back to RESERVED_PIDS
         */
        if (idr_get_cursor(&tmp->idr) > RESERVED_PIDS)
            pid_min = RESERVED_PIDS;

        /*
         * Store a null pointer so find_pid_ns does not find
         * a partially initialized PID (see below).
         */
        /* (2.1) 分配pid number */
        nr = idr_alloc_cyclic(&tmp->idr, NULL, pid_min,
                      pid_max, GFP_ATOMIC);
        spin_unlock_irq(&pidmap_lock);
        idr_preload_end();

        if (nr < 0) {
            retval = (nr == -ENOSPC) ? -EAGAIN : nr;
            goto out_free;
        }

        pid->numbers[i].nr = nr;
        pid->numbers[i].ns = tmp;
        tmp = tmp->parent;
    }

    if (unlikely(is_child_reaper(pid))) {
        if (pid_ns_prepare_proc(ns))
            goto out_free;
    }

    ...
}

SYSCALL_DEFINE2(setns, int, fd, int, nstype)
{
    struct task_struct *tsk = current;
    struct nsproxy *new_nsproxy;
    struct file *file;
    struct ns_common *ns;
    int err;

    /* (1) 根据fd找到对应的名空间 */
    file = proc_ns_fget(fd);
    if (IS_ERR(file))
        return PTR_ERR(file);

    err = -EINVAL;
    ns = get_proc_ns(file_inode(file));
    if (nstype && (ns->ops->type != nstype))
        goto out;

    /* (1) 创建新的进程名空间代理结构 */
    new_nsproxy = create_new_namespaces(0, tsk, current_user_ns(), tsk->fs);
    if (IS_ERR(new_nsproxy)) {
        err = PTR_ERR(new_nsproxy);
        goto out;
    }

    /* (2) 安装新的进程名空间代理 */
    err = ns->ops->install(new_nsproxy, ns);
    if (err) {
        free_nsproxy(new_nsproxy);
        goto out;
    }
    /* (3) 把进程名空间代理切换成新的
            需要注意的是pid_namespace的特殊性，只有在子进程创建时才会生效
     */
    switch_task_namespaces(tsk, new_nsproxy);

    perf_event_namespaces(tsk);
out:
    fput(file);
    return err;
}

SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
{

    err = unshare_nsproxy_namespaces(unshare_flags, &new_nsproxy,
                     new_cred, new_fs);

}

↓

int unshare_nsproxy_namespaces(unsigned long unshare_flags,
    struct nsproxy **new_nsp, struct cred *new_cred, struct fs_struct *new_fs)
{
    struct user_namespace *user_ns;
    int err = 0;

    if (!(unshare_flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
                   CLONE_NEWNET | CLONE_NEWPID | CLONE_NEWCGROUP)))
        return 0;

    user_ns = new_cred ? new_cred->user_ns : current_user_ns();
    if (!ns_capable(user_ns, CAP_SYS_ADMIN))
        return -EPERM;

    *new_nsp = create_new_namespaces(unshare_flags, current, user_ns,
                     new_fs ? new_fs : current->fs);
    if (IS_ERR(*new_nsp)) {
        err = PTR_ERR(*new_nsp);
        goto out;
    }

out:
    return err;
}

SYSCALL_DEFINE0(getpid)
{
    return task_tgid_vnr(current);
}

↓

static inline pid_t task_tgid_vnr(struct task_struct *tsk)
{
    return __task_pid_nr_ns(tsk, __PIDTYPE_TGID, NULL);
}

↓

pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
            struct pid_namespace *ns)
{
    pid_t nr = 0;

    rcu_read_lock();
    /* (1) 如果ns为NULL，则ns为当前名空间 */
    if (!ns)
        ns = task_active_pid_ns(current);
    if (likely(pid_alive(task))) {
        if (type != PIDTYPE_PID) {
            if (type == __PIDTYPE_TGID)
                type = PIDTYPE_PID;

            task = task->group_leader;
        }
        /* (1) 根据type找到对应的struct pid结构：task->pids[type].pid
                根据名空间的level，找到struct pid中对应名空间的pid number
         */
        nr = pid_nr_ns(rcu_dereference(task->pids[type].pid), ns);
    }
    rcu_read_unlock();

    return nr;
}

↓

pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns)
{
    struct upid *upid;
    pid_t nr = 0;

    if (pid && ns->level <= pid->level) {
        upid = &pid->numbers[ns->level];
        if (upid->ns == ns)
            nr = upid->nr;
    }
    return nr;
}