Linux : task work 机制

task work机制可以在内核中向指定的进程添加一些任务函数，这些任务函数会在进程返回用户态时执行，使用的是该进程的上下文。包括下面的这些API：

• task_work_add
• task_work_cancel
• task_work_run

进程对象task_struct中有个字段用来存储这些待进行的任务列表头即task_works，这个结构体包含一个next指针和需要执行的函数指针。

205 /**
206  * struct callback_head - callback structure for use with RCU and task_work
207  * @next: next update requests in a list
208  * @func: actual update function to call after the grace period.
209  */
210 struct callback_head {
211         struct callback_head *next;
212         void (*func)(struct callback_head *head);
213 };

  4
  5 static struct callback_head work_exited; /* all we need is ->next == NULL */
  6
  7 /**
  8  * task_work_add - ask the @task to execute @work->func()
  9  * @task: the task which should run the callback
 10  * @work: the callback to run
 11  * @notify: send the notification if true
 12  *
 13  * Queue @work for task_work_run() below and notify the @task if @notify.
 14  * Fails if the @task is exiting/exited and thus it can‘t process this @work.
 15  * Otherwise @work->func() will be called when the @task returns from kernel
 16  * mode or exits.
 17  *
 18  * This is like the signal handler which runs in kernel mode, but it doesn‘t
 19  * try to wake up the @task.
 20  *
 21  * RETURNS:
 22  * 0 if succeeds or -ESRCH.
 23  */
 24 int
 25 task_work_add(struct task_struct *task, struct callback_head *work, bool notify)
 26 {
 27         struct callback_head *head;
 28
 29         do {
 30                 head = ACCESS_ONCE(task->task_works);
 31                 if (unlikely(head == &work_exited))
 32                         return -ESRCH;
 33                 work->next = head;
 34         } while (cmpxchg(&task->task_works, head, work) != head);
 35
 36         if (notify)
 37                 set_notify_resume(task);
 38         return 0;
 39 }

主要工作：

1. 通过CAS以无锁的形式添加了一个链表元素。（新元素排在原有链表头部）

2. set_notify_resume函数向指定的进程设置了一个_TIF_NOTIFY_RESUME标记。

task_work_run执行时机

在返回用户态之前会对当前进程的标记检查，如果相关标记置位则会调用do_notify_resume

595 int_signal:
596         testl $_TIF_DO_NOTIFY_MASK,%edx
597         jz 1f
598         movq %rsp,%rdi          # &ptregs -> arg1
599         xorl %esi,%esi          # oldset -> arg2
600         call do_notify_resume
601 1:      movl $_TIF_WORK_MASK,%edi
602 int_restore_rest:
603         RESTORE_REST
604         DISABLE_INTERRUPTS(CLBR_NONE)
605         TRACE_IRQS_OFF
606         jmp int_with_check
607         CFI_ENDPROC
608 END(system_call)

以上文件为entry_64.S，而标记定义在thread_info.c中

130 /* work to do on interrupt/exception return */
131 #define _TIF_WORK_MASK                                                  132         (0x0000FFFF &                                                   133          ~(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT|                       134            _TIF_SINGLESTEP|_TIF_SECCOMP|_TIF_SYSCALL_EMU))

 70 #define TIF_SYSCALL_TRACE       0       /* syscall trace active */
 71 #define TIF_NOTIFY_RESUME       1       /* callback before returning to user */
 72 #define TIF_SIGPENDING          2       /* signal pending */
 73 #define TIF_NEED_RESCHED        3       /* rescheduling necessary */
 74 #define TIF_SINGLESTEP          4       /* reenable singlestep on user return*/
 75 #define TIF_SYSCALL_EMU         6       /* syscall emulation active */
 76 #define TIF_SYSCALL_AUDIT       7       /* syscall auditing active */
 77 #define TIF_SECCOMP             8       /* secure computing */
 78 #define TIF_MCE_NOTIFY          10      /* notify userspace of an MCE */
 79 #define TIF_USER_RETURN_NOTIFY  11      /* notify kernel of userspace return */
 80 #define TIF_UPROBE              12      /* breakpointed or singlestepping */
 81 #define TIF_NOTSC               16      /* TSC is not accessible in userland */
 82 #define TIF_IA32                17      /* IA32 compatibility process */
 83 #define TIF_FORK                18      /* ret_from_fork */
 84 #define TIF_NOHZ                19      /* in adaptive nohz mode */
 85 #define TIF_MEMDIE              20      /* is terminating due to OOM killer */
 86 #define TIF_POLLING_NRFLAG      21      /* idle is polling for TIF_NEED_RESCHED */
 87 #define TIF_IO_BITMAP           22      /* uses I/O bitmap */
 88 #define TIF_FORCED_TF           24      /* true if TF in eflags artificially */
 89 #define TIF_BLOCKSTEP           25      /* set when we want DEBUGCTLMSR_BTF */
 90 #define TIF_LAZY_MMU_UPDATES    27      /* task is updating the mmu lazily */
 91 #define TIF_SYSCALL_TRACEPOINT  28      /* syscall tracepoint instrumentation */
 92 #define TIF_ADDR32              29      /* 32-bit address space on 64 bits */
 93 #define TIF_X32                 30      /* 32-bit native x86-64 binary */
 94 

即_TIF_WORK_MASK表示除开（_TIF_SYSCALL_TRACE, _TIF_SYSCALL_AUDIT, _TIF_SINGLESTEP, _TIF_SECCOMP, _TIF_SYSCALL_EMU）之外的所有标记。自然包括了_TIF_NOTIFY_RESUME标记。

do_notify_resume函数

729 /*
730  * notification of userspace execution resumption
731  * - triggered by the TIF_WORK_MASK flags
732  */
733 __visible void
734 do_notify_resume(struct pt_regs *regs, void *unused, __u32 thread_info_flags)
735 {
736         user_exit();
737
738 #ifdef CONFIG_X86_MCE
739         /* notify userspace of pending MCEs */
740         if (thread_info_flags & _TIF_MCE_NOTIFY)
741                 mce_notify_process();
742 #endif /* CONFIG_X86_64 && CONFIG_X86_MCE */
743
744         if (thread_info_flags & _TIF_UPROBE)
745                 uprobe_notify_resume(regs);
746
747         /* deal with pending signal delivery */
748         if (thread_info_flags & _TIF_SIGPENDING)
749                 do_signal(regs);
750
751         if (thread_info_flags & _TIF_NOTIFY_RESUME) {
752                 clear_thread_flag(TIF_NOTIFY_RESUME);
753                 tracehook_notify_resume(regs);
754         }
755         if (thread_info_flags & _TIF_USER_RETURN_NOTIFY)
756                 fire_user_return_notifiers();
757
758         user_enter();
759 }

可以看到在其中调用tracehook_notify_resume函数，也包括其他一些如信号处理相关的函数。

tracehook_notify_resume

174 /**
175  * tracehook_notify_resume - report when about to return to user mode
176  * @regs:               user-mode registers of @current task
177  *
178  * This is called when %TIF_NOTIFY_RESUME has been set.  Now we are
179  * about to return to user mode, and the user state in @regs can be
180  * inspected or adjusted.  The caller in arch code has cleared
181  * %TIF_NOTIFY_RESUME before the call.  If the flag gets set again
182  * asynchronously, this will be called again before we return to
183  * user mode.
184  *
185  * Called without locks.
186  */
187 static inline void tracehook_notify_resume(struct pt_regs *regs)
188 {
189         /*
190          * The caller just cleared TIF_NOTIFY_RESUME. This barrier
191          * pairs with task_work_add()->set_notify_resume() after
192          * hlist_add_head(task->task_works);
193          */
194         smp_mb__after_atomic();
195         if (unlikely(current->task_works))
196                 task_work_run();
197 }

在进程对象的task_works不为null的情况下才有任务需要执行。

task_work_run

 77 /**
 78  * task_work_run - execute the works added by task_work_add()
 79  *
 80  * Flush the pending works. Should be used by the core kernel code.
 81  * Called before the task returns to the user-mode or stops, or when
 82  * it exits. In the latter case task_work_add() can no longer add the
 83  * new work after task_work_run() returns.
 84  */
 85 void task_work_run(void)
 86 {
 87         struct task_struct *task = current;
 88         struct callback_head *work, *head, *next;
 89
 90         for (;;) {
 91                 /*
 92                  * work->func() can do task_work_add(), do not set
 93                  * work_exited unless the list is empty.
 94                  */
 95                 do {
 96                         work = ACCESS_ONCE(task->task_works);
 97                         head = !work && (task->flags & PF_EXITING) ?
 98                                 &work_exited : NULL;
 99                 } while (cmpxchg(&task->task_works, work, head) != work);
100
101                 if (!work)
102                         break;
103                 /*
104                  * Synchronize with task_work_cancel(). It can‘t remove
105                  * the first entry == work, cmpxchg(task_works) should
106                  * fail, but it can play with *work and other entries.
107                  */
108                 raw_spin_unlock_wait(&task->pi_lock);
109                 smp_mb();
110
111                 /* Reverse the list to run the works in fifo order */
112                 head = NULL;
113                 do {
114                         next = work->next;
115                         work->next = head;
116                         head = work;
117                         work = next;
118                 } while (work);
119
120                 work = head;
121                 do {
122                         next = work->next;
123                         work->func(work);
124                         work = next;
125                         cond_resched();
126                 } while (work);
127         }
128 }

1. 通过CAS，以无锁的方式取得task_works链表

2. 因为原链表是按元素添加到链表的时间逆序排列的（见task_work_add），先把链表反转一遍

3. 反转链表后，遍历链表，执行各个元素的任务函数即work->func(work)