task_struct 代码位置概览
    include/linux/sched.h
    ┌────────────────────────────────────────────────┐
    820│  struct task_struct {                         │
       │                                              │
    826│    thread_info        ←── 第1字段（必须！）   │
    828│    __state            ←── 任务状态            │
    831│    saved_state        ←── 保存状态            │
    837│    [randomized start]                          │
    839│    stack, usage, flags, ptrace                 │
    849│    on_cpu, on_rq, prio, se, rt, dl, policy    │
    958│    mm, active_mm                               │
    961│    exit_state, exit_code, exit_signal          │
    973│    位字段: sched_reset_on_fork, in_execve...   │
   1059│    pid, tgid                                  │
   1072│    real_parent, parent, children, sibling      │
   1110│    utime, stime, nvcsw, start_time            │
   1146│    real_cred, cred                            │
   1185│    fs, files, nsproxy                         │
   1198│    signal, sighand, blocked, pending          │
   1227│    alloc_lock, pi_lock                        │
   1322│    cgroups, cg_list                           │
   1647│    thread (架构相关)                           │
   1653│    [randomized end]                           │
   1654│  }  __attribute__((aligned(64)));              │
    └────────────────────────────────────────────────┘

// include/linux/sched.h, 第 820-837 行
struct task_struct {
#ifdef CONFIG_THREAD_INFO_IN_TASK
    /*
     * For reasons of header soup (see current_thread_info()), this
     * must be the first element of task_struct.
     */
    struct thread_info     thread_info;
#endif
    unsigned int           __state;

    /* saved state for "spinlock sleepers" */
    unsigned int           saved_state;

    /*
     * This begins the randomizable portion of task_struct. Only
     * scheduling-critical items should be added above here.
     */
    randomized_struct_fields_start

// include/linux/sched.h, 第 107-141 行
#define TASK_RUNNING            0x00000000
#define TASK_INTERRUPTIBLE      0x00000001
#define TASK_UNINTERRUPTIBLE    0x00000002
#define __TASK_STOPPED          0x00000004
#define __TASK_TRACED           0x00000008
/* Used in tsk->exit_state: */
#define EXIT_DEAD               0x00000010
#define EXIT_ZOMBIE             0x00000020
#define EXIT_TRACE              (EXIT_ZOMBIE | EXIT_DEAD)
#define TASK_PARKED             0x00000040
#define TASK_DEAD               0x00000080
#define TASK_WAKEKILL           0x00000100
#define TASK_WAKING             0x00000200
#define TASK_NOLOAD             0x00000400
#define TASK_NEW                0x00000800
#define TASK_RTLOCK_WAIT        0x00001000
#define TASK_FREEZABLE          0x00002000
#define TASK_FROZEN             0x00008000
#define TASK_STATE_MAX          0x00010000

                       任务状态转换图
                              │
                              ▼
                        ┌──────────┐  fork()
                        │ TASK_NEW │
                        └────┬─────┘
                             │ wake_up_new_task()
                             ▼
                      ┌─────────────┐
                 ┌────│ TASK_RUNNING │◄─────── wake_up_process()
                 │    └──────┬──────┘
                 │           │ schedule() 将其从运行队列移出
                 │           ▼
                 │    ┌──────────────────┐
                 │    │TASK_INTERRUPTIBLE│──── 信号到达 ────┐
                 │    └──────────────────┘                   │
                 │    ┌────────────────────┐                 │
                 │    │TASK_UNINTERRUPTIBLE│                  │
                 │    └────────────────────┘                 │
                 │    ┌──────────────┐                       │
                 │    │TASK_PARKED   │                       │
                 │    └──────────────┘                       │
                 │           │                               │
                 │           │ wake_up()                     │
                 │           └──────────────────────────────┤
                 │                                          │
                 │    ┌──────────────┐                      │
                 └───►│TASK_RUNNING  │◄─────────────────────┘
                      └──────┬───────┘
                             │ do_exit()
                             ▼
                      ┌──────────────┐
                      │ EXIT_ZOMBIE  │─────── 父进程 wait() ───► EXIT_DEAD
                      └──────────────┘                            │
                                                                  ▼
                                                            释放 task_struct

// include/linux/sched.h, 第 839-843 行
void           *stack;          // 内核栈指针
refcount_t      usage;          // 引用计数
unsigned int    flags;          // PF_* 标志
unsigned int    ptrace;         // ptrace 标志

// include/linux/sched.h, 第 1759-1792 行
#define PF_VCPU              0x00000001  /* 我是虚拟 CPU */
#define PF_IDLE              0x00000002  /* 我是 idle 线程 */
#define PF_EXITING           0x00000004  /* 正在关闭 */
#define PF_POSTCOREDUMP      0x00000008  /* core dump 应忽略此任务 */
#define PF_IO_WORKER         0x00000010  /* IO 工作线程 (io_uring) */
#define PF_WQ_WORKER         0x00000020  /* workqueue 工作线程 */
#define PF_FORKNOEXEC        0x00000040  /* 已 fork 但尚未 exec */
#define PF_MCE_PROCESS       0x00000080  /* MCE 错误处理策略 */
#define PF_SUPERPRIV         0x00000100  /* 使用了超级用户权限 */
#define PF_DUMPCORE          0x00000200  /* 正在进行 core dump */
#define PF_SIGNALED          0x00000400  /* 被信号杀死 */
#define PF_MEMALLOC          0x00000800  /* 为释放内存而分配内存 */
#define PF_NPROC_EXCEEDED    0x00001000  /* 超过 RLIMIT_NPROC 限制 */
#define PF_USED_MATH         0x00002000  /* FPU 已使用 */
#define PF_USER_WORKER       0x00004000  /* 从用户线程克隆的内核线程 */
#define PF_NOFREEZE          0x00008000  /* 不应被冻结 */
#define PF_KCOMPACTD         0x00010000  /* 我是 kcompactd */
#define PF_KSWAPD            0x00020000  /* 我是 kswapd */
#define PF_MEMALLOC_NOFS     0x00040000  /* 继承 GFP_NOFS 语义 */
#define PF_MEMALLOC_NOIO     0x00080000  /* 继承 GFP_NOIO 语义 */
#define PF_LOCAL_THROTTLE    0x00100000  /* 仅对本 bdi 节流写 */
#define PF_KTHREAD           0x00200000  /* 我是内核线程 */
#define PF_RANDOMIZE         0x00400000  /* 随机化虚拟地址空间 */
#define PF_NO_SETAFFINITY    0x04000000  /* 禁止用户设置 CPU 亲和性 */
#define PF_MCE_EARLY         0x08000000  /* MCE 早期杀死策略 */
#define PF_MEMALLOC_PIN      0x10000000  /* 分配限于允许长期固定的区域 */
#define PF_BLOCK_TS          0x20000000  /* plug 有需要更新的时间戳 */
#define PF_SUSPEND_TASK      0x80000000  /* 调用 freeze_processes() 的线程 */

// include/linux/sched.h, 第 849-928 行
int                 on_cpu;         // 当前是否正在 CPU 上运行
struct __call_single_node wake_entry;
unsigned int        wakee_flips;
unsigned long       wakee_flip_decay_ts;
struct task_struct  *last_wakee;

int                 recent_used_cpu;
int                 wake_cpu;
int                 on_rq;          // 是否在运行队列上

int                 prio;           // 动态优先级
int                 static_prio;    // 静态优先级
int                 normal_prio;    // "正常"优先级
unsigned int        rt_priority;    // 实时优先级

struct sched_entity         se;     // CFS/EEVDF 调度实体
struct sched_rt_entity      rt;     // RT 调度实体
struct sched_dl_entity      dl;     // Deadline 调度实体
struct sched_dl_entity     *dl_server;  // DL server 指针
#ifdef CONFIG_SCHED_CLASS_EXT
struct sched_ext_entity     scx;    // Ext 可扩展调度实体
#endif
const struct sched_class   *sched_class; // 调度类指针

unsigned int        policy;         // 调度策略
int                 nr_cpus_allowed;
const cpumask_t    *cpus_ptr;       // 允许运行的 CPU 集合指针
cpumask_t          *user_cpus_ptr;
cpumask_t           cpus_mask;      // CPU 亲和性掩码
void               *migration_pending;
unsigned short      migration_disabled;
unsigned short      migration_flags;

  on_cpu=0, on_rq=0  →  睡眠中（阻塞或等待事件）
  on_cpu=0, on_rq=1  →  可运行，等待被调度
  on_cpu=1, on_rq=0  →  正在 CPU 上执行（被 dequeue 后）
  on_cpu=1, on_rq=1  →  短暂的重叠状态（enqueue 后、switch_to 前）

                    Linux 优先级体系结构

    优先级值      0         1    ...   99  │ 100  ...  139
                 │<--- 实时优先级范围 --->││<- 普通优先级范围 ->│
                                          │
    rt_priority  │  99  ...   1   (RT)    │  0    (非RT)      │
                 │                         │                    │
    prio         │  0(highest) ...  99     │ 100 ... 139(lowest)│
    static_prio  │  (不使用)               │ 100 ... 139        │
    normal_prio  │  = rt_priority 取反     │  = static_prio     │
                                          │
                 │<---- MAX_RT_PRIO=100 -->│<-- NICE_WIDTH=40 ->│
                                          │                    │
                                        DEFAULT_PRIO = 120 (nice=0)

// include/linux/sched/prio.h, 第 27-28 行
#define NICE_TO_PRIO(nice)  ((nice) + DEFAULT_PRIO)    // DEFAULT_PRIO = 120
#define PRIO_TO_NICE(prio)  ((prio) - DEFAULT_PRIO)

    调度类优先级（从高到低）：
    ┌──────────────────────────┐
    │  dl_sched_class          │ ←─ SCHED_DEADLINE（最高优先级）
    ├──────────────────────────┤
    │  rt_sched_class          │ ←─ SCHED_FIFO / SCHED_RR
    ├──────────────────────────┤
    │  fair_sched_class        │ ←─ SCHED_NORMAL / SCHED_BATCH / SCHED_IDLE
    ├──────────────────────────┤
    │  ext_sched_class         │ ←─ SCHED_EXT (可编程调度)
    ├──────────────────────────┤
    │  idle_sched_class        │ ←─ idle 线程（最低优先级）
    └──────────────────────────┘

// include/uapi/linux/sched.h, 第 114-121 行
#define SCHED_NORMAL    0   // 普通进程（默认）
#define SCHED_FIFO      1   // 先进先出实时调度
#define SCHED_RR        2   // 时间片轮转实时调度
#define SCHED_BATCH     3   // 批处理进程（CPU 密集型）
/* SCHED_ISO: reserved but not implemented yet */
#define SCHED_IDLE      5   // 极低优先级（比 nice=19 还低）
#define SCHED_DEADLINE  6   // 截止时间调度（EDF 算法）
#define SCHED_EXT       7   // 可扩展 BPF 调度

// include/linux/sched.h, 第 958-959 行
struct mm_struct    *mm;          // 用户地址空间（内核线程为 NULL）
struct mm_struct    *active_mm;   // 内核线程的活跃 mm（借用的）

    用户进程 A → 内核线程 K → 用户进程 B 的调度序列

    时间轴 ──────────────────────────────────────────────►

    进程A运行        内核线程K运行         进程B运行
    ┌────────┐      ┌──────────┐        ┌────────┐
    │mm=A    │      │mm=NULL   │        │mm=B    │
    │active_mm=A│   │active_mm=A│       │active_mm=B│
    │CR3→A的页表│   │CR3→A的页表│       │CR3→B的页表│
    └────────┘      │(不刷新TLB!)│        └────────┘
         │          │(复用A的映射)│             │
         └──mm借用──►└──────────┘◄──mm借用─────┘
                   内核空间映射是共享的，
                   所以不切换CR3也能正常工作

// include/linux/sched.h, 第 961-967 行
int             exit_state;      // 退出状态: EXIT_ZOMBIE / EXIT_DEAD
int             exit_code;       // 退出码，传递给父进程
int             exit_signal;     // 退出时发送给父进程的信号（通常是 SIGCHLD）
int             pdeath_signal;   // 父进程死亡时发送的信号
unsigned long   jobctl;          // JOBCTL_* 标志

#define EXIT_DEAD       0x00000010  // 最终状态，task_struct 即将被释放
#define EXIT_ZOMBIE     0x00000020  // 僵尸状态，等待父进程 wait()
#define EXIT_TRACE      (EXIT_ZOMBIE | EXIT_DEAD)  // 正在被 ptrace 追踪的退出

// include/linux/sched.h, 第 1059-1060 行
pid_t   pid;           // 进程/线程 ID
pid_t   tgid;          // 线程组 ID（= 组 leader 的 pid）

    多线程进程示例（bash 中 PID=1000）：

    ┌────────────────────────────────────────────────────┐
    │  线程组（TGID = 1000）                              │
    │                                                    │
    │  task_struct          task_struct       task_struct│
    │  ┌────────────┐      ┌────────────┐   ┌──────────┐│
    │  │ pid=1000   │      │ pid=1001   │   │ pid=1002 ││
    │  │ tgid=1000  │      │ tgid=1000  │   │ tgid=1000││
    │  │ group_leader │    │ group_leader │  │ group_leader│
    │  │  -> self   │      │  -> T1000  │   │  -> T1000 ││
    │  │            │      │            │   │           ││
    │  │getpid()=1000│    │getpid()=1000│  │getpid()=1000│
    │  │gettid()=1000│    │gettid()=1001│  │gettid()=1002│
    │  └────────────┘      └────────────┘   └──────────┘│
    │       ▲                                    线程3    │
    │       │ group_leader                               │
    │    主线程（leader）                                │
    └────────────────────────────────────────────────────┘

struct pid        *thread_pid;                  // PID 结构体指针
struct hlist_node  pid_links[PIDTYPE_MAX];      // PID 哈希链表链接
struct list_head   thread_node;                 // 线程组链表节点

// include/linux/sched.h, 第 1072-1097 行
struct task_struct __rcu  *real_parent;   // 真实父进程
struct task_struct __rcu  *parent;        // ptrace 父进程或 real_parent
struct list_head           children;      // 子进程链表
struct list_head           sibling;       // 在父进程 children 链表中的链接
struct task_struct        *group_leader;  // 线程组 leader
struct list_head           ptraced;       // 被 ptrace 追踪的子进程
struct list_head           ptrace_entry;  // ptrace 链接
struct pid                *thread_pid;
struct hlist_node          pid_links[PIDTYPE_MAX];
struct list_head           thread_node;

                    进程树结构示例

    init (PID=1)
    ├── real_parent=NULL (内核线程)
    ├── children ──→ [systemd, bash, ...]
    │
    ├── bash (PID=1000)
    │   ├── real_parent → init
    │   ├── children ──→ [ls, grep, my_app]
    │   │
    │   └── my_app (PID=2000)
    │       ├── real_parent → bash
    │       ├── children ──→ [worker1, worker2]
    │       ├── group_leader → self
    │       │
    │       ├── worker1 (PID=2001, tgid=2000)
    │       │   ├── real_parent → my_app
    │       │   ├── group_leader → my_app
    │       │   └── sibling → worker2
    │       │
    │       └── worker2 (PID=2002, tgid=2000)
    │           ├── real_parent → my_app
    │           ├── group_leader → my_app
    │           └── sibling → (end)
    │
    └── gdb (PID=3000)
        ├── real_parent → init
        ├── parent → init
        └── ptraced ──→ [my_app]  ←── ptrace 追踪
            │
            my_app 此时:
            ├── real_parent → bash  (不变)
            └── parent → gdb        (被 ptrace 修改)

// include/linux/sched.h, 第 1146-1160 行
const struct cred __rcu  *ptracer_cred;   // tracer 的凭证
const struct cred __rcu  *real_cred;      // 客观凭证（真实 UID/GID）
const struct cred __rcu  *cred;           // 有效凭证（可被临时覆盖）

// include/linux/sched.h, 第 1185-1196 行
struct fs_struct    *fs;          // 文件系统根目录/cwd 信息
struct files_struct *files;       // 打开文件描述符表
struct nsproxy      *nsproxy;     // 命名空间代理

    struct nsproxy 中的命名空间指针：
    ┌─────────────────────────────────────┐
    │ uts_ns   → UTS 命名空间（主机名、域名）│
    │ ipc_ns   → IPC 命名空间（信号量、消息队列）│
    │ mnt_ns   → 挂载命名空间（文件系统挂载点）│
    │ pid_ns   → PID 命名空间（进程 ID 隔离） │
    │ net_ns   → 网络命名空间（网络栈隔离）  │
    │ cgroup_ns→ cgroup 命名空间（cgroup 根）│
    │ time_ns  → 时间命名空间（系统时间偏移）│
    └─────────────────────────────────────┘

// include/linux/sched.h, 第 1198-1208 行
struct signal_struct        *signal;      // 共享信号信息（整个线程组共享）
struct sighand_struct __rcu *sighand;     // 信号处理函数表（共享）
sigset_t                    blocked;      // 被阻塞的信号集（每线程独立）
sigset_t                    real_blocked; // 保存的阻塞信号集
sigset_t                    saved_sigmask;
struct sigpending           pending;      // 私有待处理信号队列
unsigned long               sas_ss_sp;    // 替代信号栈地址
size_t                      sas_ss_size;  // 替代信号栈大小
unsigned int                sas_ss_flags; // 替代信号栈标志

                    信号处理的层次结构

    ┌─────────────────────────────────────────────────┐
    │              signal_struct (共享)                  │
    │  ┌────────────────────────────────────────────┐  │
    │  │ 共享待处理信号队列 (shared pending)          │  │
    │  │ 由 kill()/sigqueue() 发送的信号放这里       │  │
    │  │ 线程组中任意一个未阻塞该信号的线程可处理     │  │
    │  └────────────────────────────────────────────┘  │
    │  线程组退出信号、资源限制统计等                    │
    └─────────────────────────────────────────────────┘
                        ▲ 共享
    ┌───────┬───────┬───┴───┬───────┐
    │ T1    │ T2    │ T3    │ T4    │  各线程独立的信号状态
    │       │       │       │       │
    │blocked│blocked│blocked│blocked│  ← 各线程独立的信号掩码
    │pend.  │pend.  │pend.  │pend.  │  ← 各线程独立的私有待处理信号
    └───────┴───────┴───────┴───────┘

// include/linux/sched.h, 第 1110-1133 行
u64     utime;               // 用户态 CPU 时间（纳秒）
u64     stime;               // 内核态 CPU 时间（纳秒）
u64     gtime;               // 客户机时间（虚拟化场景）
struct prev_cputime  prev_cputime;  // 用于被节流的 cgroup
unsigned long   nvcsw;              // 自愿上下文切换次数
unsigned long   nivcsw;             // 非自愿上下文切换次数
u64     start_time;                // 单调时钟下的创建时间（纳秒）
u64     start_boottime;            // 启动时钟下的创建时间（纳秒）

// include/linux/sched.h, 第 1322-1330 行
#ifdef CONFIG_CGROUPS
struct css_set __rcu   *cgroups;    // cgroup 成员关系
struct list_head        cg_list;    // css_set 中的任务链接
#ifdef CONFIG_PREEMPT_RT
struct llist_node       cg_dead_lnode;
#endif
#endif

    cgroup 关联示意图

    ┌──────────────┐     ┌──────────────────────────────┐
    │ task_struct  │     │       css_set                 │
    │              │     │                               │
    │ cgroups ──────────►│ subsys[cpu_cgrp_id] → cpu_cg │
    │              │     │ subsys[mem_cgrp_id] → mem_cg │
    │ cg_list ─────┤     │ subsys[io_cgrp_id]  → io_cg  │
    └──────────────┘     │ ...                           │
                         │                               │
    ┌──────────────┐     │ tasks: [task1→cg_list,        │
    │ task_struct  │     │         task2→cg_list,        │
    │              │     │         ...]                   │
    │ cgroups ─────┼────►│                               │
    │              │     └──────────────────────────────┘
    │ cg_list ─────┤
    └──────────────┘
    (共享同一 css_set 的任务)

// include/linux/sched.h, 第 1227-1230 行
spinlock_t      alloc_lock;    // 保护 mm, files, fs 等资源的分配/释放
raw_spinlock_t  pi_lock;       // 保护优先级继承等待者

// include/linux/sched.h, 第 973-1051 行
unsigned    sched_reset_on_fork:1;       // fork 时重置调度策略
unsigned    sched_contributes_to_load:1; // 计入系统负载
unsigned    sched_migrated:1;            // 最近被迁移过
unsigned    sched_task_hot:1;            // 缓存热标记

unsigned    :0;   // 强制对齐到下一个边界

unsigned    sched_remote_wakeup:1;       // 远程唤醒标记
unsigned    sched_rt_mutex:1;            // RT mutex 相关
unsigned    user_dumpable:1;             // 保存 dumpable 属性
unsigned    in_execve:1;                 // 正在执行 execve()
unsigned    in_iowait:1;                 // 正在等待 I/O
unsigned    restore_sigmask:1;           // 需要恢复信号掩码
unsigned    in_user_fault:1;             // 在用户态页面错误中
unsigned    in_lru_fault:1;              // LRU 算法适用的缺页
unsigned    brk_randomized:1;            // brk 已随机化
unsigned    no_cgroup_migration:1;       // 禁止 cgroup 迁移
unsigned    frozen:1;                    // 被 cgroup freezer 冻结
unsigned    use_memdelay:1;              // 记录内存延迟
unsigned    in_memstall:1;               // 因内存不足而停顿
unsigned    in_page_owner:1;             // 页面所有者追踪递归检测
unsigned    in_eventfd:1;                // eventfd 递归防护
unsigned    in_thrashing:1;              // 因内存抖动而延迟

// include/linux/sched.h, 第 1646-1647 行
/* CPU-specific state of this task: */
struct thread_struct    thread;

// arch/x86/include/asm/processor.h, 第 448-517 行（x86_64）
struct thread_struct {
    /* Cached TLS descriptors: */
    struct desc_struct    tls_array[GDT_ENTRY_TLS_ENTRIES];

    unsigned long     sp;            // 内核栈指针
    unsigned short    es;            // ES 段选择子
    unsigned short    ds;            // DS 段选择子
    unsigned short    fsindex;       // FS 段选择子
    unsigned short    gsindex;       // GS 段选择子

    unsigned long     fsbase;        // FS 基地址（线程局部存储）
    unsigned long     gsbase;        // GS 基地址

    /* Save middle states of ptrace breakpoints */
    struct perf_event *ptrace_bps[HBP_NUM];
    /* Debug status used for traps, single steps, etc... */
    unsigned long      virtual_dr6;
    /* Keep track of the exact dr7 value set by the user */
    unsigned long      ptrace_dr7;
    /* Fault info: */
    unsigned long      cr2;          // 页面错误地址
    unsigned long      trap_nr;      // 陷阱/异常编号
    unsigned long      error_code;   // 错误码

    /* IO permissions: */
    struct io_bitmap  *io_bitmap;
    unsigned long      iopl_emul;    // IOPL 模拟
    unsigned int       iopl_warn:1;

    u32                pkru;         // Protection Keys for Userspace

#ifdef CONFIG_X86_USER_SHADOW_STACK
    unsigned long      features;
    unsigned long      features_locked;
    struct thread_shstk shstk;
#endif
};

// arch/x86/include/asm/processor.h, 第 522 行
# define x86_task_fpu(task)  ((struct fpu *)((void *)(task) + sizeof(*(task))))

char    comm[TASK_COMM_LEN];   // TASK_COMM_LEN = 16

#ifdef CONFIG_STACKPROTECTOR
unsigned long    stack_canary;
#endif

struct list_head    tasks;

struct completion  *vfork_done;

u64    parent_exec_id;
u64    self_exec_id;

    task_struct 的内存布局（概念性）
    ┌─────────────────────────────────────────────────────┐
    │ [非随机化区域]                                       │
    │  offset 0:  thread_info          (调度关键，必须第一) │
    │  offset X:  __state              (调度关键)          │
    │  offset Y:  saved_state          (调度关键)          │
    ├─────────────────────────────────────────────────────┤
    │ [randomized_struct_fields_start]                     │
    │                                                      │
    │  stack, usage, flags, ptrace                         │
    │  on_cpu, wake_entry, on_rq                           │
    │  prio, static_prio, normal_prio, rt_priority         │
    │  se, rt, dl, scx, sched_class                        │
    │  policy, cpus_ptr, cpus_mask                         │
    │  sched_info, tasks, pushable_tasks                   │
    │  mm, active_mm                                       │
    │  exit_state, exit_code, exit_signal                  │
    │  位字段 (sched_reset_on_fork, in_execve, ...)        │
    │  pid, tgid, stack_canary                             │
    │  real_parent, parent, children, sibling              │
    │  group_leader, ptraced, ptrace_entry                 │
    │  thread_pid, pid_links, thread_node                  │
    │  utime, stime, gtime, nvcsw, nivcsw                  │
    │  start_time, start_boottime                          │
    │  real_cred, cred                                     │
    │  comm[TASK_COMM_LEN]                                 │
    │  fs, files, nsproxy                                  │
    │  signal, sighand, blocked, pending                   │
    │  alloc_lock, pi_lock                                 │
    │  cgroups, cg_list                                    │
    │  ... (大量 #ifdef 条件编译字段)                       │
    │  thread (struct thread_struct, 架构相关)              │
    │                                                      │
    │ [randomized_struct_fields_end]                       │
    └──────────┬──────────────────────────────────────────┘
               │
               ▼
    ┌──────────────────────────────────────────────────────┐
    │  struct fpu (x86 特有，紧跟 task_struct 之后)         │
    │  XSAVE 区域: FPU/SSE/AVX/AMX 状态                    │
    └──────────────────────────────────────────────────────┘

// include/linux/sched.h, line 828
unsigned int    __state;

// include/linux/sched.h, line 961
int             exit_state;

/*
 * p->__state 是关于进程的可运行性（runnability），
 * 而 task->exit_state 是关于进程正在退出。
 * 这种分离看似令人困惑，但如此设计是为了防止
 * 修改一个字段时不小心修改了另一个字段。
 */
// include/linux/sched.h, lines 99-104

/* Used in tsk->__state: */
#define TASK_RUNNING            0x00000000
#define TASK_INTERRUPTIBLE      0x00000001
#define TASK_UNINTERRUPTIBLE    0x00000002
#define __TASK_STOPPED          0x00000004
#define __TASK_TRACED           0x00000008
/* Used in tsk->exit_state: */
#define EXIT_DEAD               0x00000010
#define EXIT_ZOMBIE             0x00000020
#define EXIT_TRACE              (EXIT_ZOMBIE | EXIT_DEAD)
/* Used in tsk->__state again: */
#define TASK_PARKED             0x00000040
#define TASK_DEAD               0x00000080
#define TASK_WAKEKILL           0x00000100
#define TASK_WAKING             0x00000200
#define TASK_NOLOAD             0x00000400
#define TASK_NEW                0x00000800
#define TASK_RTLOCK_WAIT        0x00001000
#define TASK_FREEZABLE          0x00002000
#define TASK_FROZEN             0x00008000
#define TASK_STATE_MAX          0x00010000

/* Convenience macros for the sake of set_current_state: */
#define TASK_KILLABLE   (TASK_WAKEKILL | TASK_UNINTERRUPTIBLE)
#define TASK_STOPPED    (TASK_WAKEKILL | __TASK_STOPPED)
#define TASK_TRACED     __TASK_TRACED

#define TASK_IDLE       (TASK_UNINTERRUPTIBLE | TASK_NOLOAD)

/* Convenience macros for the sake of wake_up(): */
#define TASK_NORMAL     (TASK_INTERRUPTIBLE | TASK_UNINTERRUPTIBLE)

static const char state_char[] = "RSDTtXZPI";

// include/linux/sched.h, line 152
#define task_is_running(task)  (READ_ONCE((task)->__state) == TASK_RUNNING)

/*
 * set_current_state() 的典型用法：
 * 在条件检查之前设置睡眠状态，配合内存屏障
 * 确保不会错过唤醒事件
 */
for (;;) {
    set_current_state(TASK_INTERRUPTIBLE);
    if (CONDITION)    /* 检查等待条件 */
        break;

    schedule();       /* 让出 CPU，进入睡眠 */
}
__set_current_state(TASK_RUNNING);

#define TASK_KILLABLE   (TASK_WAKEKILL | TASK_UNINTERRUPTIBLE)

#define TASK_STOPPED    (TASK_WAKEKILL | __TASK_STOPPED)

// include/linux/sched.h, line 155
#define task_is_stopped(task)  ((READ_ONCE(task->jobctl) & JOBCTL_STOPPED) != 0)

// include/linux/sched.h, line 154
#define task_is_traced(task)  ((READ_ONCE(task->jobctl) & JOBCTL_TRACED) != 0)

// include/linux/sched.h, line 156
#define task_is_stopped_or_traced(task) \
    ((READ_ONCE(task->jobctl) & (JOBCTL_STOPPED | JOBCTL_TRACED)) != 0)

// kernel/exit.c, line 749
tsk->exit_state = EXIT_ZOMBIE;

// kernel/exit.c, lines 1199-1201
state = (ptrace_reparented(p) && thread_group_leader(p)) ?
        EXIT_TRACE : EXIT_DEAD;
if (cmpxchg(&p->exit_state, EXIT_ZOMBIE, state) != EXIT_ZOMBIE)
    return 0;

// kernel/exit.c, lines 766-769
if (autoreap) {
    tsk->exit_state = EXIT_DEAD;
    list_add(&tsk->ptrace_entry, &dead);
}

#define EXIT_TRACE  (EXIT_ZOMBIE | EXIT_DEAD)

// kernel/sched/core.c, lines 6901-6915
void __noreturn do_task_dead(void)
{
    /* Causes final put_task_struct in finish_task_switch(): */
    set_special_state(TASK_DEAD);

    /* Tell freezer to ignore us: */
    current->flags |= PF_NOFREEZE;

    __schedule(SM_NONE);
    BUG();

    for (;;)
        cpu_relax();
}

// kernel/sched/core.c, lines 4765-4772
void wake_up_new_task(struct task_struct *p)
{
    struct rq_flags rf;
    struct rq *rq;
    int wake_flags = WF_FORK;

    raw_spin_lock_irqsave(&p->pi_lock, rf.flags);
    WRITE_ONCE(p->__state, TASK_RUNNING);
    // ...
}

#define TASK_IDLE  (TASK_UNINTERRUPTIBLE | TASK_NOLOAD)

// include/linux/sched.h, lines 1688-1689
if ((tsk_state & TASK_RTLOCK_WAIT) || (tsk_state & TASK_FROZEN))
    state = TASK_UNINTERRUPTIBLE;

// include/linux/sched.h, lines 828-831
unsigned int    __state;

/* saved state for "spinlock sleepers" */
unsigned int    saved_state;

// include/linux/sched.h, lines 296-305
#define current_save_and_set_rtlock_wait_state()       \
    do {                                                \
        lockdep_assert_irqs_disabled();                 \
        raw_spin_lock(&current->pi_lock);              \
        current->saved_state = current->__state;       \
        debug_rtlock_wait_set_state();                  \
        trace_set_current_state(TASK_RTLOCK_WAIT);     \
        WRITE_ONCE(current->__state, TASK_RTLOCK_WAIT); \
        raw_spin_unlock(&current->pi_lock);            \
    } while (0);

// include/linux/sched.h, lines 307-314
#define current_restore_rtlock_saved_state()            \
    do {                                                \
        lockdep_assert_irqs_disabled();                 \
        raw_spin_lock(&current->pi_lock);              \
        debug_rtlock_wait_restore_state();              \
        WRITE_ONCE(current->__state, current->saved_state); \
        current->saved_state = TASK_RUNNING;           \
        raw_spin_unlock(&current->pi_lock);            \
    } while (0);

                          fork() / clone()
                                |
                                v
     +---------------------> TASK_NEW (0x800)
     |                          |
     |               wake_up_new_task()
     |                          |
     |                          v
     |    +==============> TASK_RUNNING (0x0) <==============+
     |    |               (R - 运行/就绪)                    |
     |    |                     |                            |
     |    |          +----------+----------+                 |
     |    |          |          |          |                 |
     |    |   schedule()  set_current_   信号到达             |
     |    |   (让出CPU)   state()       (SIGSTOP等)          |
     |    |          |          |          |                 |
     |    |          |          v          v                 |
     |    |          |  TASK_INTERRUPT  __TASK_STOPPED       |
     |    |          |  IBLE (0x1, S)   (0x4, T)            |
     |    |          |          |          |                 |
     |    |          |          |       SIGCONT              |
     |    |          |          |          |                 |
     |    |          |          +----+-----+                 |
     |    |          |          |    |                       |
     |    |          |   wake_up() / wake_up_process()      |
     |    |          |          |                            |
     |    |          v          v                            |
     |    |   TASK_UNINTERRUPTIBLE (0x2, D)                 |
     |    |          |                                     |
     |    |          |          ptrace attach               |
     |    |          |          +--------+                  |
     |    |          |          |        |                  |
     |    |          |          v        v                  |
     |    |          |     __TASK_TRACED (0x8, t)           |
     |    |          |          |        |                  |
     |    |          |   ptrace detach / SIGCONT            |
     |    |          |          |        |                  |
     |    |          +----------+--------+                  |
     |    |                     |                           |
     |    |          wake_up_process()                      |
     |    |                     |                           |
     |    +=====================+                           |
     |                                                    |
     |  do_exit()                                         |
     |      |                                             |
     |      v                                             |
     |  exit_notify()                                     |
     |      |                                             |
     |      v                                             |
     |  EXIT_ZOMBIE (0x20, Z)                             |
     |      |                                             |
     |      | 父进程 wait() / waitpid()                   |
     |      v                                             |
     |  EXIT_DEAD (0x10, X)  <-- EXIT_TRACE (0x30)        |
     |      |                    (被ptrace追踪时)          |
     |      v                                             |
     |  set_special_state(TASK_DEAD)                      |
     |      |                                             |
     |      v                                             |
     |  __schedule()                                      |
     |      |                                             |
     |      v                                             |
     |  finish_task_switch()                              |
     |      |                                             |
     |      v                                             |
     +-- put_task_struct() --> task_struct 被释放          |
                                                          |
    特殊路径：                                             |
                                                          |
    TASK_RUNNING ---> TASK_PARKED (0x40, P)  [kthread]    |
                         |                                |
                    kthread_unpark()                      |
                         |                                |
                         +-------> TASK_RUNNING           |
                                                          |
    TASK_RUNNING ---> TASK_WAKING (0x200)  [瞬时过渡]     |
                         |                                |
                    入队运行队列                            |
                         |                                |
                         +-------> TASK_RUNNING           |
                                                          |
    任何状态 ---> TASK_FROZEN (0x8000)  [cgroup freezer]  |
                         |                                |
                    解冻                                  |
                         |                                |
                         +-------> 恢复原状态              |

// include/linux/sched.h, lines 247-252
#define set_current_state(state_value)                  \
    do {                                                \
        debug_normal_state_change((state_value));       \
        trace_set_current_state(state_value);           \
        smp_store_mb(current->__state, (state_value));  \
    } while (0)

等待方（set_current_state）：         唤醒方（try_to_wake_up）：
  smp_store_mb(STATE, SLEEPING)         smp_mb__after_spinlock()
  if (!CONDITION)                        if (STATE & SLEEPING)
      schedule()                           STATE = RUNNING

// include/linux/sched.h, lines 240-245
#define __set_current_state(state_value)                \
    do {                                                \
        debug_normal_state_change((state_value));       \
        trace_set_current_state(state_value);           \
        WRITE_ONCE(current->__state, (state_value));    \
    } while (0)

// include/linux/sched.h, lines 260-269
#define set_special_state(state_value)                              \
    do {                                                            \
        unsigned long flags; /* may shadow */                       \
                                                                    \
        raw_spin_lock_irqsave(&current->pi_lock, flags);           \
        debug_special_state_change((state_value));                  \
        trace_set_current_state(state_value);                       \
        WRITE_ONCE(current->__state, (state_value));               \
        raw_spin_unlock_irqrestore(&current->pi_lock, flags);      \
    } while (0)

// include/linux/sched.h, lines 162-164
#define is_special_task_state(state)        \
    ((state) & (__TASK_STOPPED | __TASK_TRACED | TASK_PARKED | \
                TASK_DEAD | TASK_FROZEN))

// kernel/sched/core.c, lines 4372-4375
int wake_up_process(struct task_struct *p)
{
    return try_to_wake_up(p, TASK_NORMAL, 0);
}
EXPORT_SYMBOL(wake_up_process);

// kernel/sched/core.c, lines 4378-4381
int wake_up_state(struct task_struct *p, unsigned int state)
{
    return try_to_wake_up(p, state, 0);
}

// kernel/sched/core.c, lines 4061-4063
/*
 * Conceptually does:
 *
 *   If (@state & @p->state) @p->state = TASK_RUNNING.
 */

// include/linux/sched.h, lines 1672-1689
static inline unsigned int __task_state_index(unsigned int tsk_state,
                                              unsigned int tsk_exit_state)
{
    unsigned int state = (tsk_state | tsk_exit_state) & TASK_REPORT;

    BUILD_BUG_ON_NOT_POWER_OF_2(TASK_REPORT_MAX);

    if ((tsk_state & TASK_IDLE) == TASK_IDLE)
        state = TASK_REPORT_IDLE;

    if ((tsk_state & TASK_RTLOCK_WAIT) || (tsk_state & TASK_FROZEN))
        state = TASK_UNINTERRUPTIBLE;

    return fls(state) - 1;
}

// include/linux/sched.h, lines 147-150
#define TASK_REPORT  (TASK_RUNNING | TASK_INTERRUPTIBLE | \
                      TASK_UNINTERRUPTIBLE | __TASK_STOPPED | \
                      __TASK_TRACED | EXIT_DEAD | EXIT_ZOMBIE | \
                      TASK_PARKED)

/*
 * What is struct pid?
 *
 * A struct pid is the kernel's internal notion of a process identifier.
 * It refers to individual tasks, process groups, and sessions.  While
 * there are processes attached to it the struct pid lives in a hash
 * table, so it and then the processes that it refers to can be found
 * quickly from the numeric pid value.
 *
 * Storing pid_t values in the kernel and referring to them later has a
 * problem. The process originally with that pid may have exited and the
 * pid allocator wrapped, and another process could have come along
 * and been assigned that pid.
 *
 * Referring to user space processes by holding a reference to struct
 * task_struct has a problem. When the user space process exits
 * the now useless task_struct is still kept. A task_struct plus a
 * stack consumes around 10K of low kernel memory.
 *
 * Holding a reference to struct pid solves both of these problems.
 * It is small so holding a reference does not consume a lot of
 * resources, and since a new struct pid is allocated when the numeric
 * pid value is reused (when pids wrap around) we don't mistakenly
 * refer to new processes.
 */
// include/linux/pid.h, lines 13-40

// include/linux/pid_types.h, lines 5-11
enum pid_type {
    PIDTYPE_PID,    // individual process/thread —— 线程级标识
    PIDTYPE_TGID,   // thread group (process)    —— 线程组标识
    PIDTYPE_PGID,   // process group             —— 进程组标识
    PIDTYPE_SID,    // session                   —— 会话标识
    PIDTYPE_MAX,
};

// include/linux/sched.h, line 1059
pid_t    pid;

// include/linux/sched.h, line 1060
pid_t    tgid;

// include/linux/pid.h, lines 250-253
static inline pid_t task_tgid_nr(struct task_struct *tsk)
{
    return tsk->tgid;
}

// include/linux/pid.h, lines 234-237
static inline pid_t task_pid_nr(struct task_struct *tsk)
{
    return tsk->pid;
}

# 以下三个命令属于同一个进程组
cat file.txt | grep pattern | sort

// include/linux/pid.h, lines 58-75
struct pid {
    refcount_t      count;          // 引用计数
    unsigned int    level;          // 命名空间层级深度
    spinlock_t      lock;           // 自旋锁保护
    struct {
        u64 ino;                    // pidfs inode 号
        struct rhash_head pidfs_hash;  // pidfs 哈希链
        struct dentry *stashed;     // 缓存的 dentry
        struct pidfs_attr *attr;    // pidfs 属性
    };
    /* lists of tasks that use this pid */
    struct hlist_head tasks[PIDTYPE_MAX];   // 按类型链接的 task 链表头
    struct hlist_head inodes;               // 关联的 inode 链表
    /* wait queue for pidfd notifications */
    wait_queue_head_t wait_pidfd;           // pidfd 通知等待队列
    struct rcu_head rcu;                    // RCU 回收头
    struct upid numbers[];                  // 灵活数组，每层命名空间一个
};

// include/linux/pid.h, lines 53-56
struct upid {
    int nr;                     // 该命名空间中的数值 PID
    struct pid_namespace *ns;   // 所属的 PID 命名空间
};

struct pid (level=1)
  |
  +-- numbers[0]: { nr=1500, ns=&init_pid_ns }    ← 全局命名空间中 PID 为 1500
  +-- numbers[1]: { nr=100,   ns=&child_ns }      ← 子命名空间中 PID 为 100

// include/linux/sched.h, lines 1059-1060
pid_t    pid;            // 数值 PID（线程级）
pid_t    tgid;           // 数值 TGID（线程组）

// include/linux/sched.h, lines 1095-1097
struct pid         *thread_pid;              // 指向 PIDTYPE_PID 对应的 struct pid
struct hlist_node   pid_links[PIDTYPE_MAX];  // 挂入 struct pid 的 tasks[] 链表
struct list_head    thread_node;             // 线程组内的线程链表

// include/linux/sched/signal.h, line 166
struct pid *pids[PIDTYPE_MAX];

// kernel/pid.c, lines 373-378
static struct pid **task_pid_ptr(struct task_struct *task, enum pid_type type)
{
    return (type == PIDTYPE_PID) ?
        &task->thread_pid :
        &task->signal->pids[type];
}

数值 PID + 命名空间 → struct pid → task_struct

// kernel/pid.c, lines 361-364
struct pid *find_pid_ns(int nr, struct pid_namespace *ns)
{
    return idr_find(&ns->idr, nr);
}

// kernel/pid.c, lines 367-370
struct pid *find_vpid(int nr)
{
    return find_pid_ns(nr, task_active_pid_ns(current));
}

// kernel/pid.c, lines 457-469
struct task_struct *pid_task(struct pid *pid, enum pid_type type)
{
    struct task_struct *result = NULL;
    if (pid) {
        struct hlist_node *first;
        first = rcu_dereference_check(
                    hlist_first_rcu(&pid->tasks[type]),
                    lockdep_tasklist_lock_is_held());
        if (first)
            result = hlist_entry(first, struct task_struct,
                                 pid_links[(type)]);
    }
    return result;
}

// kernel/pid.c, lines 474-479
struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
{
    RCU_LOCKDEP_WARN(!rcu_read_lock_held(),
                     "find_task_by_pid_ns() needs rcu_read_lock() protection");
    return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
}

struct task_struct *find_task_by_vpid(pid_t vnr)
{
    return find_task_by_pid_ns(vnr, task_active_pid_ns(current));
}

  pid_t (数值)  +  pid_namespace
        |              |
        v              |
    find_pid_ns() -----+
        |
        v
    struct pid
        |
        |  pid->tasks[PIDTYPE_PID]
        v
    hlist_head → task_struct.pid_links[PIDTYPE_PID]
                      |
                      v
                  task_struct


  pid_t (数值)  +  pid_namespace
        |              |
        v              |
    find_pid_ns() -----+
        |
        v
    struct pid
        |
        |  pid->tasks[PIDTYPE_TGID]
        v
    hlist_head → task_struct.pid_links[PIDTYPE_TGID]
                      |
                      v
    线程组 leader 的 task_struct

// include/linux/pid.h, line 49
#define RESERVED_PIDS 300

// kernel/pid.c, lines 160-161
struct pid *alloc_pid(struct pid_namespace *ns, pid_t *arg_set_tid,
                      size_t arg_set_tid_size)

// kernel/pid.c, lines 189-201
pid = kmem_cache_alloc(ns->pid_cachep, GFP_KERNEL);
if (!pid)
    return ERR_PTR(retval);

get_pid_ns(ns);
pid->level = ns->level;
refcount_set(&pid->count, 1);
spin_lock_init(&pid->lock);
for (type = 0; type < PIDTYPE_MAX; ++type)
    INIT_HLIST_HEAD(&pid->tasks[type]);
init_waitqueue_head(&pid->wait_pidfd);
INIT_HLIST_HEAD(&pid->inodes);

// kernel/pid.c, lines 239-302
for (tmp = ns, i = ns->level; i >= 0;) {
    int tid = set_tid[ns->level - i];

    if (tid) {
        nr = idr_alloc(&tmp->idr, NULL, tid,
                       tid + 1, GFP_ATOMIC);
    } else {
        int pid_min = 1;
        if (idr_get_cursor(&tmp->idr) > RESERVED_PIDS)
            pid_min = RESERVED_PIDS;

        nr = idr_alloc_cyclic(&tmp->idr, NULL, pid_min,
                              pid_max[ns->level - i], GFP_ATOMIC);
    }
    // ...
    pid->numbers[i].nr = nr;
    pid->numbers[i].ns = tmp;
    tmp = tmp->parent;
    i--;
}

// kernel/pid.c, lines 318-322
for (upid = pid->numbers + ns->level; upid >= pid->numbers; --upid) {
    /* Make the PID visible to find_pid_ns. */
    idr_replace(&upid->ns->idr, pid, upid->nr);
    upid->ns->pid_allocated++;
}

// kernel/pid.c, lines 110-146
void free_pid(struct pid *pid)
{
    int i;
    struct pid_namespace *active_ns;

    active_ns = pid->numbers[pid->level].ns;
    ns_ref_active_put(active_ns);

    spin_lock(&pidmap_lock);
    for (i = 0; i <= pid->level; i++) {
        struct upid *upid = pid->numbers + i;
        struct pid_namespace *ns = upid->ns;
        switch (--ns->pid_allocated) {
        case 2:
        case 1:
            wake_up_process(ns->child_reaper);
            break;
        case PIDNS_ADDING:
            WARN_ON(ns->child_reaper);
            ns->pid_allocated = 0;
            break;
        }
        idr_remove(&ns->idr, upid->nr);
    }
    spin_unlock(&pidmap_lock);

    pidfs_remove_pid(pid);
    call_rcu(&pid->rcu, delayed_put_pid);
}

  init_pid_ns (level=0)
    |
    +-- PID 1500 = bash
    |     |
    |     +-- child_ns (level=1)
    |           |
    |           +-- PID 100 = nginx (全局 PID 1501)
    |           +-- PID 101 = app   (全局 PID 1502)
    |
    +-- child_ns2 (level=1)
          |
          +-- PID 1 = init   (全局 PID 1600)

numbers[0] = { nr=1501, ns=&init_pid_ns }
numbers[1] = { nr=100,  ns=&child_ns }

// 全局 ID（init 命名空间视角）
static inline pid_t pid_nr(struct pid *pid)
{
    pid_t nr = 0;
    if (pid)
        nr = pid->numbers[0].nr;   // 第 0 层 = 根命名空间
    return nr;
}

// include/linux/pid.h, lines 187-188
pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns);
pid_t pid_vnr(struct pid *pid);

// include/linux/pid.h
task_pid_nr(tsk)          // 全局视角的线程 PID
task_pid_vnr(tsk)         // 当前命名空间视角的线程 PID
task_pid_nr_ns(tsk, ns)   // 指定命名空间视角的线程 PID
task_tgid_nr(tsk)         // 全局视角的 TGID
task_tgid_vnr(tsk)        // 当前命名空间视角的 TGID
task_tgid_nr_ns(tsk, ns)  // 指定命名空间视角的 TGID
task_pgrp_vnr(tsk)        // 当前命名空间视角的 PGID
task_session_vnr(tsk)     // 当前命名空间视角的 SID

// include/linux/pid.h, lines 301-311
static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk,
                                     struct pid_namespace *ns)
{
    pid_t pid = 0;

    rcu_read_lock();
    if (pid_alive(tsk))
        pid = task_tgid_nr_ns(rcu_dereference(tsk->real_parent), ns);
    rcu_read_unlock();

    return pid;
}

// include/linux/pid.h, lines 265-268
static inline int pid_alive(const struct task_struct *p)
{
    return p->thread_pid != NULL;
}

// kernel/pid.c, lines 383-391
void attach_pid(struct task_struct *task, enum pid_type type)
{
    struct pid *pid;

    lockdep_assert_held_write(&tasklist_lock);

    pid = *task_pid_ptr(task, type);
    hlist_add_head_rcu(&task->pid_links[type], &pid->tasks[type]);
}

// kernel/pid.c, lines 393-413
static void __change_pid(struct pid **pids, struct task_struct *task,
                         enum pid_type type, struct pid *new)
{
    struct pid **pid_ptr, *pid;

    lockdep_assert_held_write(&tasklist_lock);

    pid_ptr = task_pid_ptr(task, type);
    pid = *pid_ptr;

    hlist_del_rcu(&task->pid_links[type]);
    *pid_ptr = new;

    for (tmp = PIDTYPE_MAX; --tmp >= 0; )
        if (pid_has_task(pid, tmp))
            return;

    WARN_ON(pids[type]);
    pids[type] = pid;
}

// kernel/pid.c, lines 447-455
void exchange_tids(struct task_struct *task, struct task_struct *old)
{
    /* ... */
    hlist_replace_rcu(&old->pid_links[PIDTYPE_PID],
                       &task->pid_links[PIDTYPE_PID]);
    /* ... */
}

// kernel/pid.c, lines 49-61
struct pid init_struct_pid = {
    .count      = REFCOUNT_INIT(1),
    .tasks      = {
        { .first = NULL },   // PIDTYPE_PID
        { .first = NULL },   // PIDTYPE_TGID
        { .first = NULL },   // PIDTYPE_PGID
    },
    .level      = 0,
    .numbers    = { {
        .nr     = 0,
        .ns     = &init_pid_ns,
    }, }
};

// kernel/pid.c, lines 72-83
struct pid_namespace init_pid_ns = {
    .ns = NS_COMMON_INIT(init_pid_ns),
    .idr = IDR_INIT(init_pid_ns.idr),
    .pid_allocated = PIDNS_ADDING,
    .level = 0,
    .child_reaper = &init_task,
    .user_ns = &init_user_ns,
    .pid_max = PID_MAX_DEFAULT,
};

// kernel/pid.c, lines 688-707
SYSCALL_DEFINE2(pidfd_open, pid_t, pid, unsigned int, flags)
{
    int fd;
    struct pid *p;

    if (flags & ~(PIDFD_NONBLOCK | PIDFD_THREAD))
        return -EINVAL;

    if (pid <= 0)
        return -EINVAL;

    p = find_get_pid(pid);
    if (!p)
        return -ESRCH;

    fd = pidfd_create(p, flags);

    put_pid(p);
    return fd;
}

// kernel/pid.c, lines 662-673
static int pidfd_create(struct pid *pid, unsigned int flags)
{
    int pidfd;
    struct file *pidfd_file;

    pidfd = pidfd_prepare(pid, flags, &pidfd_file);
    if (pidfd < 0)
        return pidfd;

    fd_install(pidfd, pidfd_file);
    return pidfd;
}

// include/linux/pid.h, line 72
wait_queue_head_t wait_pidfd;

// kernel/exit.c, line 763
do_notify_pidfd(tsk);

// include/linux/pid.h, lines 190-204
#define do_each_pid_task(pid, type, task)              \
    do {                                                \
        if ((pid) != NULL)                              \
            hlist_for_each_entry_rcu((task),            \
                &(pid)->tasks[type], pid_links[type]) {

        #define while_each_pid_task(pid, type, task)   \
                if (type == PIDTYPE_PID)                \
                    break;                              \
            }                                           \
    } while (0)

// include/linux/pid.h, lines 206-214
#define do_each_pid_thread(pid, type, task)             \
    do_each_pid_task(pid, type, task) {                 \
        struct task_struct *tg___ = task;               \
        for_each_thread(tg___, task) {

#define while_each_pid_thread(pid, type, task)          \
        }                                               \
        task = tg___;                                   \
    } while_each_pid_task(pid, type, task)

// include/linux/pid.h, lines 338-341
static inline int is_global_init(struct task_struct *tsk)
{
    return task_tgid_nr(tsk) == 1;
}

// include/linux/pid.h, lines 163-166
static inline bool is_child_reaper(struct pid *pid)
{
    return pid->numbers[pid->level].nr == 1;
}

                          PID 命名空间层级
                          ================
                          init_pid_ns (level=0)
                               |
                    idr         |          idr
                  +-------+    |     +-------+
                  | 1500  |----+     | 1600  |
                  +-------+          +-------+
                      |              child_ns (level=1)
                      |                   |
                      |               idr +-------+
                      |                  | 100    |
                      |                  +-------+
                      |                      |
                      v                      v
                 +---------+            +---------+
                 |struct pid|           |struct pid|
                 | level=0  |           | level=1  |
                 | count=1  |           | count=1  |
                 +---------+            +---------+
                 |tasks[0] |→ NULL      |tasks[0] |→ NULL
                 |tasks[1] |→ NULL      |tasks[1] |→ NULL
                 |tasks[2] |→ NULL      |tasks[2] |→ NULL
                 |tasks[3] |→ NULL      |tasks[3] |→ NULL
                 +---------+            +---------+
                 |numbers[0]|           |numbers[0]|
                 | nr=1500  |           | nr=1600  |
                 | ns=init  |           | ns=init  |
                 +---------+            |numbers[1]|
                                        | nr=100   |
                                        | ns=child |
                                        +---------+
                      |                      |
                      |  pid->tasks[type]    |
                      |  哈希链表            |
                      v                      v
                 +------------------+   +------------------+
                 |  task_struct     |   |  task_struct     |
                 |  pid = 1500      |   |  pid = 100       |
                 |  tgid = 1500     |   |  tgid = 100      |
                 |  thread_pid ────────→|  thread_pid ──────→struct pid
                 |  pid_links[0] ◄─|   |  pid_links[0] ◄──|
                 |  pid_links[1] ◄─|   |  pid_links[1] ◄──|
                 |  pid_links[2] ◄─|   |  pid_links[2] ◄──|
                 |  pid_links[3] ◄─|   |  pid_links[3] ◄──|
                 +------------------+   +------------------+
                 |  signal_struct   |   |  signal_struct   |
                 |  pids[TGID] ───────→ |  pids[TGID] ──────→struct pid
                 |  pids[PGID] ──→ ...  |  pids[PGID] ──→ ...
                 |  pids[SID] ──→ ...   |  pids[SID] ──→ ...
                 +------------------+   +------------------+


    pidfd 层：
    ==========
    用户进程                    内核
    +-----------+         +-----------+
    | fd = 3    |--------→| file      |
    | (pidfd)   |         | f_inode   |
    +-----------+         +-----+-----+
                                |
                                v
                          +-----------+
                          | struct pid|
                          | wait_pidfd|← poll/epoll 监听
                          +-----------+
                                |
                          idr_find() 可查找
                                |
                                v
                          task_struct

// include/linux/sched.h (lines 1072-1105)
/*
 * Pointers to the (original) parent process, youngest child, younger sibling,
 * older sibling, respectively.  (p->father can be replaced with
 * p->real_parent->pid)
 */

/* Real parent process: */
struct task_struct __rcu    *real_parent;

/* Recipient of SIGCHLD, wait4() reports: */
struct task_struct __rcu    *parent;

/*
 * Children/sibling form the list of natural children:
 */
struct list_head        children;
struct list_head        sibling;
struct task_struct      *group_leader;

/*
 * 'ptraced' is the list of tasks this task is using ptrace() on.
 *
 * This includes both natural children and PTRACE_ATTACH targets.
 * 'ptrace_entry' is this task's link on the p->parent->ptraced list.
 */
struct list_head        ptraced;
struct list_head        ptrace_entry;

/* PID/PID hash table linkage. */
struct pid             *thread_pid;
struct hlist_node       pid_links[PIDTYPE_MAX];
struct list_head        thread_node;

struct completion      *vfork_done;

/* CLONE_CHILD_SETTID: */
int __user             *set_child_tid;

/* CLONE_CHILD_CLEARTID: */
int __user             *clear_child_tid;

// include/linux/sched.h (lines 1222-1224)
/* Thread group tracking: */
u64    parent_exec_id;
u64    self_exec_id;

// 正常情况下二者相同
assert(current->parent == current->real_parent);

// 当被 ptrace 跟踪时
// current->real_parent 仍指向创建者
// current->parent 指向 tracer (如 gdb)

// kernel/exit.c (lines 698-731)
static void forget_original_parent(struct task_struct *father,
                    struct list_head *dead)
{
    struct task_struct *p, *t, *reaper;

    if (unlikely(!list_empty(&father->ptraced)))
        exit_ptrace(father, dead);

    /* Can drop and reacquire tasklist_lock */
    reaper = find_child_reaper(father, dead);
    if (list_empty(&father->children))
        return;

    reaper = find_new_reaper(father, reaper);
    list_for_each_entry(p, &father->children, sibling) {
        for_each_thread(p, t) {
            RCU_INIT_POINTER(t->real_parent, reaper);
            BUG_ON((!t->ptrace) != (rcu_access_pointer(t->parent) == father));
            if (likely(!t->ptrace))
                t->parent = t->real_parent;
            if (t->pdeath_signal)
                group_send_sig_info(t->pdeath_signal,
                            SEND_SIG_NO_INFO, t,
                            PIDTYPE_TGID);
        }
        if (!same_thread_group(reaper, father))
            reparent_leader(father, p, dead);
    }
    list_splice_tail_init(&father->children, &reaper->children);
}

// kernel/exit.c (lines 636-669)
static struct task_struct *find_new_reaper(struct task_struct *father,
                       struct task_struct *child_reaper)
{
    struct task_struct *thread, *reaper;

    thread = find_alive_thread(father);
    if (thread)
        return thread;

    if (father->signal->has_child_subreaper) {
        unsigned int ns_level = task_pid(father)->level;
        for (reaper = father->real_parent;
             task_pid(reaper)->level == ns_level;
             reaper = reaper->real_parent) {
            if (reaper == &init_task)
                break;
            if (!reaper->signal->is_child_subreaper)
                continue;
            thread = find_alive_thread(reaper);
            if (thread)
                return thread;
        }
    }

    return child_reaper;
}

// include/linux/sched/signal.h (lines 133-134)
unsigned int    is_child_subreaper:1;
unsigned int    has_child_subreaper:1;

父进程 task_struct
├── children (list_head, 链表头)
│     ├── next ──→ child_A.sibling
│     └── prev ──→ child_C.sibling
│
├── child_A.sibling ⇄ child_B.sibling ⇄ child_C.sibling
│     ↓ children                       ↓ children
│   [grandchild]                     [grandchild]

init_task (PID 0, swapper)
  │
  ├── children ──→ [PID 1 init] ⇄ [PID 2 kthreadd] ⇄ [PID N ...]
  │                   │
  │                   ├── children ──→ [PID 100 bash] ⇄ [PID 200 sshd]
  │                   │                    │
  │                   │                    ├── children ──→ [PID 101 ls]
  │                   │                    ├── children ──→ [PID 102 grep]
  │                   │                    └── children ──→ [PID 103 pipe]
  │                   │
  │                   └── children ──→ [PID 300 systemd]
  │                                        │
  │                                        ├── children ──→ [PID 301 service_a]
  │                                        └── children ──→ [PID 302 service_b]
  │
  └── (所有内核线程也在 children 链表中)

struct task_struct *child;

// 遍历 parent 的所有子进程
list_for_each_entry(child, &parent->children, sibling) {
    // 处理每个子进程
    printk("child PID = %d\n", child->pid);
}

struct task_struct *t;

// 遍历线程组中的所有线程
for_each_thread(group_leader, t) {
    printk("thread PID = %d\n", t->pid);
}

线程组组长 (tgid=1000, pid=1000)
  │
  │  signal_struct.thread_head
  │     │
  │     ├── thread_node ← leader(pid=1000)
  │     ├── thread_node ← thread2(pid=1001)
  │     └── thread_node ← thread3(pid=1002)
  │
  │  ┌───────────────────────────────────────────┐
  │  │           共享资源 (Shared)                │
  │  │                                           │
  │  │  • mm_struct *mm      (地址空间)           │
  │  │  • files_struct *files (文件描述符表)      │
  │  │  • fs_struct *fs      (根目录/当前目录)    │
  │  │  • signal_struct *signal (信号处理)        │
  │  │  • sighand_struct *sighand (信号处理函数)  │
  │  │  • nsproxy *nsproxy   (命名空间)          │
  │  └───────────────────────────────────────────┘
  │
  │  ┌───────────────────────────────────────────┐
  │  │           私有资源 (Private)               │
  │  │                                           │
  │  │  • void *stack          (内核栈)          │
  │  │  • thread_info          (低层架构信息)    │
  │  │  • thread_struct thread (寄存器保存区)    │
  │  │  • sigpending pending   (私有待处理信号)  │
  │  │  • pid / tid            (线程ID)          │
  │  │  • pt_regs              (用户态寄存器)    │
  │  └───────────────────────────────────────────┘

// init/init_task.c (lines 20-50)
static struct signal_struct init_signals = {
    .nr_threads     = 1,
    .thread_head    = LIST_HEAD_INIT(init_task.thread_node),
    // ...
};

// init/init_task.c (line 174)
.thread_node = LIST_HEAD_INIT(init_signals.thread_head),

// 判断 task 是否是线程组组长
static inline bool thread_group_leader(struct task_struct *tsk)
{
    return tsk->group_leader == tsk;
}

// 判断两个任务是否属于同一线程组
static inline bool same_thread_group(struct task_struct *p1, struct task_struct *p2)
{
    return p1->group_leader == p2->group_leader;
}

// include/linux/pid_types.h
enum pid_type {
    PIDTYPE_PID,     // 进程/线程 ID
    PIDTYPE_TGID,    // 线程组 ID
    PIDTYPE_PGID,    // 进程组 ID
    PIDTYPE_SID,     // 会话 ID
    PIDTYPE_MAX,     // 枚举上限
};

Session (SID=1000, 控制终端=/dev/tty1)
  │
  ├── 前台进程组 (PGID=1000)
  │     ├── bash (PID=1000, 组长)
  │     ├── vim  (PID=1050)
  │     └── shell pipeline 组件
  │
  ├── 后台进程组 1 (PGID=1100)
  │     ├── make (PID=1100, 组长)
  │     └── gcc  (PID=1101)
  │
  └── 后台进程组 2 (PGID=1200)
        ├── webpack (PID=1200, 组长)
        └── node   (PID=1201)

// kill(-pgid, sig) 的实现路径
// → kill_something_info() → __kill_pgrp_info() → group_send_sig_info()

// task_struct 中的 ptrace 相关字段
struct list_head    ptraced;       // 本进程正在跟踪的进程链表 (链表头)
struct list_head    ptrace_entry;  // 本进程在 tracer 的 ptraced 链表中的节点
unsigned int        ptrace;        // ptrace 标志位

正常状态:
  real_parent → parent → 创建者进程

ptrace 跟踪状态:
  real_parent → 创建者进程 (不变)
  parent      → tracer (gdb/strace)

ptrace 脱离后:
  real_parent → parent → 创建者进程 (恢复)

// kernel/exit.c (lines 714-717)
RCU_INIT_POINTER(t->real_parent, reaper);
BUG_ON((!t->ptrace) != (rcu_access_pointer(t->parent) == father));
if (likely(!t->ptrace))
    t->parent = t->real_parent;

Tracer (gdb, PID=500)
  │
  └── ptraced (链表头)
        ├── ptrace_entry ← tracee_A (PID=600)
        ├── ptrace_entry ← tracee_B (PID=700)
        └── ptrace_entry ← tracee_C (PID=800)

每个 tracee 的 task_struct:
  .parent      → tracer (PID=500)
  .real_parent → 原始父进程 (不变)

// task_struct 中的 vfork_done 字段
struct completion  *vfork_done;

// kernel/fork.c (简化)
if (clone_flags & CLONE_VFORK) {
    vfork = kzalloc(sizeof(*vfork), GFP_KERNEL);
    init_completion(vfork);
    p->vfork_done = vfork;
}

// kernel/fork.c (lines 1415-1426)
static void complete_vfork_done(struct task_struct *tsk)
{
    struct completion *vfork;

    task_lock(tsk);
    vfork = tsk->vfork_done;
    if (likely(vfork)) {
        tsk->vfork_done = NULL;
        complete(vfork);  // 唤醒等待的父进程
    }
    task_unlock(tsk);
}

// task_struct 中
int __user  *set_child_tid;    // CLONE_CHILD_SETTID
int __user  *clear_child_tid;  // CLONE_CHILD_CLEARTID

// 线程退出时的处理 (kernel/fork.c 中的 mm_release)
if (tsk->clear_child_tid) {
    if (!(tsk->flags & PF_SIGNALED) &&
        put_user(0, tsk->clear_child_tid) != 0) {
        // 写入失败，发送 SIGSEGV
    }
    // 唤醒 futex 等待者
    futex_wake(tsk->clear_child_tid, 1, FUTEX_BITSET_MATCH_ANY);
}

u64    parent_exec_id;
u64    self_exec_id;

// init/init_task.c (lines 96-253)
struct task_struct init_task __aligned(L1_CACHE_BYTES) = {
#ifdef CONFIG_THREAD_INFO_IN_TASK
    .thread_info    = INIT_THREAD_INFO(init_task),
    .stack_refcount = REFCOUNT_INIT(1),
#endif
    .__state        = 0,
    .stack          = init_stack,
    .usage          = REFCOUNT_INIT(2),
    .flags          = PF_KTHREAD,
    // ...
    .ptraced        = LIST_HEAD_INIT(init_task.ptraced),
    .ptrace_entry   = LIST_HEAD_INIT(init_task.ptrace_entry),
    .real_parent    = &init_task,      // 指向自身！
    .parent         = &init_task,      // 指向自身！
    .children       = LIST_HEAD_INIT(init_task.children),
    .sibling        = LIST_HEAD_INIT(init_task.sibling),
    .group_leader   = &init_task,      // 指向自身
    // ...
    .thread_pid     = &init_struct_pid,
    .thread_node    = LIST_HEAD_INIT(init_signals.thread_head),
    // ...
};
EXPORT_SYMBOL(init_task);

init_task (PID 0, swapper/0)
  │
  ├── [CPU 0 idle]
  │
  └── children ──→ init (PID 1) ⇄ kthreadd (PID 2) ⇄ ...
                     │                                │
                     ├── children ──→ 用户进程...      └── children ──→ 内核线程...
                     │
                     └── 作为 child_reaper 接管孤儿进程

init_task 的关键特性:
  • real_parent = &init_task (指向自身)
  • parent      = &init_task (指向自身)
  • group_leader = &init_task (指向自身)
  • 所有 PID 类型的 pid 都指向 init_struct_pid

// fs/proc/base.c (简化)
// 通过迭代 PID 命名空间中的 PID 来枚举进程
static struct tgid_iter next_tgid(struct pid_namespace *ns, struct tgid_iter iter)
{
    struct pid *pid;

    // 在 PID 命名空间中查找下一个 TGID
    rcu_read_lock();
retry:
    iter.task = NULL;
    pid = find_ge_pid(iter.tgid, ns);
    if (pid) {
        iter.tgid = pid_nr_ns(pid, ns);
        iter.task = pid_task(pid, PIDTYPE_TGID);
        if (!iter.task || !has_group_leader_pid(iter.task)) {
            iter.tgid++;
            goto retry;
        }
    }
    rcu_read_unlock();
    return iter;
}

// pid_links 数组的含义:
// pid_links[PIDTYPE_PID]  - 按进程/线程 ID 链接
// pid_links[PIDTYPE_TGID] - 按线程组 ID 链接
// pid_links[PIDTYPE_PGID] - 按进程组 ID 链接
// pid_links[PIDTYPE_SID]  - 按会话 ID 链接

struct pid (PID=1000)
  ├── tasks[PIDTYPE_PID]  → process_A.pid_links[0]
  ├── tasks[PIDTYPE_TGID] → process_A.pid_links[1] → thread2.pid_links[1]
  ├── tasks[PIDTYPE_PGID] → process_A.pid_links[2] → process_B.pid_links[2]
  └── tasks[PIDTYPE_SID]  → process_A.pid_links[3] → process_C.pid_links[3]

// 系统调用入口：获取调用者信息
SYSCALL_DEFINE0(getpid)
{
    return task_tgid_vnr(current);  // 从 current 获取 PID
}

// 虚拟内存：检查地址空间归属
static inline bool access_ok(const void __user *addr, size_t size)
{
    // 使用 current->mm 检查用户空间地址合法性
}

// 信号处理：向当前进程发送信号
void force_sig(int sig)
{
    force_sig_info(sig, SEND_SIG_PRIV, current);
}

// 调度器：检查是否需要重新调度
static __always_inline bool need_resched(void)
{
    return unlikely(tif_need_resched());  // 访问 current_thread_info()->flags
}

// include/linux/percpu-defs.h (lines 113-114)
// 基本的 per-CPU 变量定义
#define DEFINE_PER_CPU(type, name)          \
    DEFINE_PER_CPU_SECTION(type, name, "")

// include/linux/percpu-defs.h (lines 123-127)
// 针对频繁访问的"热"变量的优化版本
#define DECLARE_PER_CPU_CACHE_HOT(type, name)   \
    DECLARE_PER_CPU_SECTION(type, name, "..hot.." #name)

#define DEFINE_PER_CPU_CACHE_HOT(type, name)    \
    DEFINE_PER_CPU_SECTION(type, name, "..hot.." #name)

per-CPU 内存区域:

  CPU 0 的 per-CPU 块                    CPU 1 的 per-CPU 块
  ┌─────────────────────┐               ┌─────────────────────┐
  │ current_task (hot)  │               │ current_task (hot)  │
  │ process_count       │               │ process_count       │
  │ ...                 │               │ ...                 │
  │ other percpu vars   │               │ other percpu vars   │
  └─────────────────────┘               └─────────────────────┘

  CPU N-1 的 per-CPU 块
  ┌─────────────────────┐
  │ current_task (hot)  │
  │ process_count       │
  │ ...                 │
  │ other percpu vars   │
  └─────────────────────┘

// 读取当前 CPU 的 per-CPU 变量
this_cpu_read(var)

// 写入当前 CPU 的 per-CPU 变量
this_cpu_write(var, val)

// 稳定读取（不受抢占影响）
this_cpu_read_stable(var)

// 原子读取（使用段寄存器优化）
this_cpu_read_const(var)

// arch/x86/include/asm/current.h (完整文件)
#ifndef _ASM_X86_CURRENT_H
#define _ASM_X86_CURRENT_H

#include <linux/build_bug.h>
#include <linux/compiler.h>

#ifndef __ASSEMBLER__

#include <linux/cache.h>
#include <asm/percpu.h>

struct task_struct;

DECLARE_PER_CPU_CACHE_HOT(struct task_struct *, current_task);
/* const-qualified alias provided by the linker. */
DECLARE_PER_CPU_CACHE_HOT(struct task_struct * const __percpu_seg_override,
              const_current_task);

static __always_inline struct task_struct *get_current(void)
{
    if (IS_ENABLED(CONFIG_USE_X86_SEG_SUPPORT))
        return this_cpu_read_const(const_current_task);

    return this_cpu_read_stable(current_task);
}

#define current get_current()

#endif /* __ASSEMBLER__ */

#endif /* _ASM_X86_CURRENT_H */

CPU 0: GS base → per-CPU block 0
CPU 1: GS base → per-CPU block 1
CPU N: GS base → per-CPU block N

访问 const_current_task:
  movq %gs:const_current_task_offset, %rax
  → 自动访问当前 CPU 的 current_task

; this_cpu_read_const(const_current_task) 编译结果:
movq    %gs:const_current_task(%rip), %rax    ; 单条指令完成读取

// this_cpu_read_stable 的简化实现
#define this_cpu_read_stable(var) \
    (*({                                  \
        typeof(var) *__p = &(var);        \
        __p + __per_cpu_offset[raw_smp_processor_id()]; \
    }))

// arch/x86/kernel/process_64.c (lines 610-671)
__switch_to(struct task_struct *prev_p, struct task_struct *next_p)
{
    struct thread_struct *prev = &prev_p->thread;
    struct thread_struct *next = &next_p->thread;
    int cpu = smp_processor_id();

    switch_fpu(prev_p, cpu);
    save_fsgs(prev_p);
    load_TLS(next, cpu);
    arch_end_context_switch(next_p);

    savesegment(es, prev->es);
    if (unlikely(next->es | prev->es))
        loadsegment(es, next->es);

    savesegment(ds, prev->ds);
    if (unlikely(next->ds | prev->ds))
        loadsegment(ds, next->ds);

    x86_fsgsbase_load(prev, next);
    x86_pkru_load(prev, next);

    /*
     * Switch the PDA and FPU contexts.
     */
    raw_cpu_write(current_task, next_p);            // ← 更新 current_task!
    raw_cpu_write(cpu_current_top_of_stack, task_top_of_stack(next_p));

    update_task_stack(next_p);
    // ...
}