Linux : task work 机制

task work机制可以在内核中向指定的进程添加一些任务函数，这些任务函数会在进程返回用户态时执行，使用的是该进程的上下文。包括下面的这些API：

• task_work_add
• task_work_cancel
• task_work_run

进程对象task_struct中有个字段用来存储这些待进行的任务列表头即task_works，这个结构体包含一个next指针和需要执行的函数指针。

 /**
  * struct callback_head - callback structure for use with RCU and task_work
  * @next: next update requests in a list
  * @func: actual update function to call after the grace period.
  */
 struct callback_head {
         struct callback_head *next;
         void (*func)(struct callback_head *head);
 };

   
   static struct callback_head work_exited; /* all we need is ->next == NULL */
   
   /**
    * task_work_add - ask the @task to execute @work->func()
    * @task: the task which should run the callback
   * @work: the callback to run
   * @notify: send the notification if true
   *
   * Queue @work for task_work_run() below and notify the @task if @notify.
   * Fails if the @task is exiting/exited and thus it can't process this @work.
   * Otherwise @work->func() will be called when the @task returns from kernel
   * mode or exits.
   *
   * This is like the signal handler which runs in kernel mode, but it doesn't
   * try to wake up the @task.
   *
   * RETURNS:
   * 0 if succeeds or -ESRCH.
   */
  int
  task_work_add(struct task_struct *task, struct callback_head *work, bool notify)
  {
          struct callback_head *head;
  
          do {
                  head = ACCESS_ONCE(task->task_works);
                  if (unlikely(head == &work_exited))
                          return -ESRCH;
                  work->next = head;
          } while (cmpxchg(&task->task_works, head, work) != head);
  
          if (notify)
                  set_notify_resume(task);
          return 0;
  }

主要工作：

1. 通过CAS以无锁的形式添加了一个链表元素。（新元素排在原有链表头部）

2. set_notify_resume函数向指定的进程设置了一个_TIF_NOTIFY_RESUME标记。

task_work_run执行时机

在返回用户态之前会对当前进程的标记检查，如果相关标记置位则会调用do_notify_resume

 int_signal:
         testl $_TIF_DO_NOTIFY_MASK,%edx
         jz 1f
         movq %rsp,%rdi          # &ptregs -> arg1
         xorl %esi,%esi          # oldset -> arg2
         call do_notify_resume
 1:      movl $_TIF_WORK_MASK,%edi
 int_restore_rest:
         RESTORE_REST
         DISABLE_INTERRUPTS(CLBR_NONE)
         TRACE_IRQS_OFF
         jmp int_with_check
         CFI_ENDPROC
 END(system_call)

以上文件为entry_64.S，而标记定义在thread_info.c中

 /* work to do on interrupt/exception return */
 #define _TIF_WORK_MASK                                                  \
         (0x0000FFFF &                                                   \
          ~(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT|                       \
            _TIF_SINGLESTEP|_TIF_SECCOMP|_TIF_SYSCALL_EMU))

  #define TIF_SYSCALL_TRACE       0       /* syscall trace active */
  #define TIF_NOTIFY_RESUME       1       /* callback before returning to user */
  #define TIF_SIGPENDING          2       /* signal pending */
  #define TIF_NEED_RESCHED        3       /* rescheduling necessary */
  #define TIF_SINGLESTEP          4       /* reenable singlestep on user return*/
  #define TIF_SYSCALL_EMU         6       /* syscall emulation active */
  #define TIF_SYSCALL_AUDIT       7       /* syscall auditing active */
  #define TIF_SECCOMP             8       /* secure computing */
  #define TIF_MCE_NOTIFY          10      /* notify userspace of an MCE */
  #define TIF_USER_RETURN_NOTIFY  11      /* notify kernel of userspace return */
  #define TIF_UPROBE              12      /* breakpointed or singlestepping */
  #define TIF_NOTSC               16      /* TSC is not accessible in userland */
  #define TIF_IA32                17      /* IA32 compatibility process */
  #define TIF_FORK                18      /* ret_from_fork */
  #define TIF_NOHZ                19      /* in adaptive nohz mode */
  #define TIF_MEMDIE              20      /* is terminating due to OOM killer */
  #define TIF_POLLING_NRFLAG      21      /* idle is polling for TIF_NEED_RESCHED */
  #define TIF_IO_BITMAP           22      /* uses I/O bitmap */
  #define TIF_FORCED_TF           24      /* true if TF in eflags artificially */
  #define TIF_BLOCKSTEP           25      /* set when we want DEBUGCTLMSR_BTF */
  #define TIF_LAZY_MMU_UPDATES    27      /* task is updating the mmu lazily */
  #define TIF_SYSCALL_TRACEPOINT  28      /* syscall tracepoint instrumentation */
  #define TIF_ADDR32              29      /* 32-bit address space on 64 bits */
  #define TIF_X32                 30      /* 32-bit native x86-64 binary */
  

即_TIF_WORK_MASK表示除开（_TIF_SYSCALL_TRACE, _TIF_SYSCALL_AUDIT, _TIF_SINGLESTEP, _TIF_SECCOMP, _TIF_SYSCALL_EMU）之外的所有标记。自然包括了_TIF_NOTIFY_RESUME标记。

do_notify_resume函数

 /*
  * notification of userspace execution resumption
  * - triggered by the TIF_WORK_MASK flags
  */
 __visible void
 do_notify_resume(struct pt_regs *regs, void *unused, __u32 thread_info_flags)
 {
         user_exit();
 
 #ifdef CONFIG_X86_MCE
         /* notify userspace of pending MCEs */
         if (thread_info_flags & _TIF_MCE_NOTIFY)
                 mce_notify_process();
 #endif /* CONFIG_X86_64 && CONFIG_X86_MCE */
 
         if (thread_info_flags & _TIF_UPROBE)
                 uprobe_notify_resume(regs);
 
         /* deal with pending signal delivery */
         if (thread_info_flags & _TIF_SIGPENDING)
                 do_signal(regs);
 
         if (thread_info_flags & _TIF_NOTIFY_RESUME) {
                 clear_thread_flag(TIF_NOTIFY_RESUME);
                 tracehook_notify_resume(regs);
         }
         if (thread_info_flags & _TIF_USER_RETURN_NOTIFY)
                 fire_user_return_notifiers();
 
         user_enter();
 }

可以看到在其中调用tracehook_notify_resume函数，也包括其他一些如信号处理相关的函数。

tracehook_notify_resume

 /**
  * tracehook_notify_resume - report when about to return to user mode
  * @regs:               user-mode registers of @current task
  *
  * This is called when %TIF_NOTIFY_RESUME has been set.  Now we are
  * about to return to user mode, and the user state in @regs can be
  * inspected or adjusted.  The caller in arch code has cleared
  * %TIF_NOTIFY_RESUME before the call.  If the flag gets set again
  * asynchronously, this will be called again before we return to
  * user mode.
  *
  * Called without locks.
  */
 static inline void tracehook_notify_resume(struct pt_regs *regs)
 {
         /*
          * The caller just cleared TIF_NOTIFY_RESUME. This barrier
          * pairs with task_work_add()->set_notify_resume() after
          * hlist_add_head(task->task_works);
          */
         smp_mb__after_atomic();
         if (unlikely(current->task_works))
                 task_work_run();
 }

在进程对象的task_works不为null的情况下才有任务需要执行。

task_work_run

  /**
   * task_work_run - execute the works added by task_work_add()
   *
   * Flush the pending works. Should be used by the core kernel code.
   * Called before the task returns to the user-mode or stops, or when
   * it exits. In the latter case task_work_add() can no longer add the
   * new work after task_work_run() returns.
   */
  void task_work_run(void)
  {
          struct task_struct *task = current;
          struct callback_head *work, *head, *next;
  
          for (;;) {
                  /*
                   * work->func() can do task_work_add(), do not set
                   * work_exited unless the list is empty.
                   */
                  do {
                          work = ACCESS_ONCE(task->task_works);
                          head = !work && (task->flags & PF_EXITING) ?
                                  &work_exited : NULL;
                  } while (cmpxchg(&task->task_works, work, head) != work);
 
                 if (!work)
                         break;
                 /*
                  * Synchronize with task_work_cancel(). It can't remove
                  * the first entry == work, cmpxchg(task_works) should
                  * fail, but it can play with *work and other entries.
                  */
                 raw_spin_unlock_wait(&task->pi_lock);
                 smp_mb();
 
                 /* Reverse the list to run the works in fifo order */
                 head = NULL;
                 do {
                         next = work->next;
                         work->next = head;
                         head = work;
                         work = next;
                 } while (work);
 
                 work = head;
                 do {
                         next = work->next;
                         work->func(work);
                         work = next;
                         cond_resched();
                 } while (work);
         }
 }

1. 通过CAS，以无锁的方式取得task_works链表

2. 因为原链表是按元素添加到链表的时间逆序排列的（见task_work_add），先把链表反转一遍

3. 反转链表后，遍历链表，执行各个元素的任务函数即work->func(work)