long do_fork(unsigned long clone_flags,
        unsigned long stack_start,
        unsigned long stack_size,
        int __user *parent_tidptr,
        int __user *child_tidptr)
{//生成一个子进程，然后把它加入到CPU就绪队列，等待CPU调度，然后系统调用就返回了。
  struct task_struct *p;
  int trace = 0;
  long nr;
/*
   * Determine whether and which event to report to ptracer.  When
   * called from kernel_thread or CLONE_UNTRACED is explicitly
   * requested, no event is reported; otherwise, report if the event
   * for the type of forking is enabled.
   */
  if (!(clone_flags & CLONE_UNTRACED)) {
    if (clone_flags & CLONE_VFORK)
      trace = PTRACE_EVENT_VFORK;
    else if ((clone_flags & CSIGNAL) != SIGCHLD)
      trace = PTRACE_EVENT_CLONE;
    else
      trace = PTRACE_EVENT_FORK;
    if (likely(!ptrace_event_enabled(current, trace)))
      trace = 0;
  }
  p = copy_process(clone_flags, stack_start, stack_size,
       child_tidptr, NULL, trace);//将父进程的相关资源复制到子进程，执行生成子进程的工作；
  /*
   * Do this prior waking up the new thread - the thread pointer
   * might get invalid after that point, if the thread exits quickly.
   */
  if (!IS_ERR(p)) {
    struct completion vfork;
    struct pid *pid;
    trace_sched_process_fork(current, p);
    pid = get_task_pid(p, PIDTYPE_PID);
    nr = pid_vnr(pid);
    if (clone_flags & CLONE_PARENT_SETTID)
      put_user(nr, parent_tidptr);
    if (clone_flags & CLONE_VFORK) {
      p->vfork_done = &vfork;
      init_completion(&vfork);
      get_task_struct(p);
    }
    wake_up_new_task(p);//将子进程加入到CPU就绪队列。
    /* forking complete and child started to run, tell ptracer */
    if (unlikely(trace))
      ptrace_event_pid(trace, pid);
    if (clone_flags & CLONE_VFORK) {
      if (!wait_for_vfork_done(p, &vfork))
        ptrace_event_pid(PTRACE_EVENT_VFORK_DONE, pid);
    }
    put_pid(pid);
  } else {
    nr = PTR_ERR(p);
  }
  return nr;
}

void do_exit(long code)
{
  struct task_struct *tsk = current;
  int group_dead;
  TASKS_RCU(int tasks_rcu_i);
  profile_task_exit(tsk);//触发task_exit_nb通知链实例的处理函数
  WARN_ON(blk_needs_flush_plug(tsk));//检查进程的blk_plug是否为空
//保证task_struct中的plug字段是空的，或者plug字段指向的队列是空的。plug字段的意义是stack plugging
  if (unlikely(in_interrupt()))//OOPS消息,中断上下文不能执行do_exit函数, 也不能终止PID为0的进程
    panic("Aiee, killing interrupt handler!");
  if (unlikely(!tsk->pid))
    panic("Attempted to kill the idle task!");
  /*
   * If do_exit is called because this processes oopsed, it's possible
   * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
   * continuing. Amongst other possible reasons, this is to prevent
   * mm_release()->clear_child_tid() from writing to a user-controlled
   * kernel address.
   */
  set_fs(USER_DS);//设定进程可以使用的虚拟地址的上限（用户空间）
  ptrace_event(PTRACE_EVENT_EXIT, code);
  validate_creds_for_do_exit(tsk);
  /*
   * We're taking recursive faults here in do_exit. Safest is to just
   * leave this task alone and wait for reboot.
   */
   //检查进病设置进程程PF_EXITING
   /*/*current->flags的PF_EXITING标志表示进程正在被删除*/
  if (unlikely(tsk->flags & PF_EXITING)) {/*  检查PF_EXITING标志是否未被设置  */
    pr_alert("Fixing recursive fault but reboot is needed!\n");
    /*
     * We can do this unlocked here. The futex code uses
     * this flag just to verify whether the pi state
     * cleanup has been done or not. In the worst case it
     * loops once more. We pretend that the cleanup was
     * done as there is no way to return. Either the
     * OWNER_DIED bit is set by now or we push the blocked
     * task into the wait for ever nirwana as well.
     */
    tsk->flags |= PF_EXITPIDONE;/*  设置进程标识为PF_EXITPIDONE*/
    set_current_state(TASK_UNINTERRUPTIBLE);/*  设置进程状态为不可中断的等待状态 */
    schedule();/*  调度其它进程  */
  }
//如果此标识未被设置, 则通过exit_signals来设置
  exit_signals(tsk);  /* sets PF_EXITING */
  /*
   * tsk->flags are checked in the futex code to protect against
   * an exiting task cleaning up the robust pi futexes.
   */
  smp_mb();/*  内存屏障，用于确保在它之后的操作开始执行之前，它之前的操作已经完成*/
  raw_spin_unlock_wait(&tsk->pi_lock); /*  一直等待，直到获得current->pi_lock自旋锁*/
  if (unlikely(in_atomic()))
    pr_info("note: %s[%d] exited with preempt_count %d\n",
      current->comm, task_pid_nr(current),
      preempt_count());
  acct_update_integrals(tsk);//获取current->mm->rss_stat.count[member]计数
  /* sync mm's RSS info before statistics gathering */
  if (tsk->mm)//同步进程的mm的rss_stat
    sync_mm_rss(tsk->mm);
  group_dead = atomic_dec_and_test(&tsk->signal->live);//清除定时器
  if (group_dead) {
    hrtimer_cancel(&tsk->signal->real_timer);
    exit_itimers(tsk->signal);
    if (tsk->mm)
      setmax_mm_hiwater_rss(&tsk->signal->maxrss, tsk->mm);
  }
  acct_collect(code, group_dead);//收集进程会计信息
  if (group_dead)//审计
    tty_audit_exit();//记录审计事件
  audit_free(tsk);//  释放struct audit_context结构体
  tsk->exit_code = code;
  taskstats_exit(tsk, group_dead);
//释放进程占用的资源
  exit_mm(tsk);/*  释放存储空间
    放弃进程占用的mm,如果没有其他进程使用该mm，则释放它。
     */
  if (group_dead)//输出进程会计信息
    acct_process();
  trace_sched_process_exit(tsk);
  exit_sem(tsk);/*  释放用户空间的“信号量”  */
  exit_shm(tsk);/* 释放锁  */
  exit_files(tsk);/*  释放已经打开的文件   */
  exit_fs(tsk); /*  释放用于表示工作目录等结构*/
  if (group_dead)//脱离控制终端
    disassociate_ctty(1);
  exit_task_namespaces(tsk);//释放命名空间
  exit_task_work(tsk);
  exit_thread();//释放task_struct中的thread_struct结构
/*触发thread_notify_head链表中所有通知链实例的处理函数，用于处理struct thread_info结构体*/
  /*
   * Flush inherited counters to the parent - before the parent
   * gets woken up by child-exit notifications.
   *
   * because of cgroup mode, must be called before cgroup_exit()
   */
  perf_event_exit_task(tsk);//Performance Event功能相关资源的释放
  cgroup_exit(tsk);//Performance Event功能相关资源的释放
  /*
   * FIXME: do that only when needed, using sched_exit tracepoint
   */
  flush_ptrace_hw_breakpoint(tsk);//注销断点
  TASKS_RCU(tasks_rcu_i = __srcu_read_lock(&tasks_rcu_exit_srcu));
  exit_notify(tsk, group_dead);//更新所有子进程的父进程
  proc_exit_connector(tsk);//进程事件连接器（通过它来报告进程fork、exec、exit以及进程用户ID与组ID的变化
#ifdef CONFIG_NUMA//用于NUMA，当引用计数为0时，释放mempolicy结构体所占用的资源
  task_lock(tsk);
  mpol_put(tsk->mempolicy);
  tsk->mempolicy = NULL;
  task_unlock(tsk);
#endif
#ifdef CONFIG_FUTEX
  if (unlikely(current->pi_state_cache))
    kfree(current->pi_state_cache);
#endif
  /*
   * Make sure we are holding no locks:
   */
  debug_check_no_locks_held();
  /*
   * We can do this unlocked here. The futex code uses this flag
   * just to verify whether the pi state cleanup has been done
   * or not. In the worst case it loops once more.
   */
  tsk->flags |= PF_EXITPIDONE;
  if (tsk->io_context)//释放struct futex_pi_state结构体所占用的内存
    exit_io_context(tsk);
  if (tsk->splice_pipe)//释放与进程描述符splice_pipe字段相关的资源
    free_pipe_info(tsk->splice_pipe);
  if (tsk->task_frag.page)
    put_page(tsk->task_frag.page);
  validate_creds_for_do_exit(tsk);
  check_stack_usage();//检查有多少未使用的进程内核栈
  preempt_disable();
  if (tsk->nr_dirtied)
    __this_cpu_add(dirty_throttle_leaks, tsk->nr_dirtied);
  exit_rcu();
  TASKS_RCU(__srcu_read_unlock(&tasks_rcu_exit_srcu, tasks_rcu_i));
  /*
   * The setting of TASK_RUNNING by try_to_wake_up() may be delayed
   * when the following two conditions become true.
   *   - There is race condition of mmap_sem (It is acquired by
   *     exit_mm()), and
   *   - SMI occurs before setting TASK_RUNINNG.
   *     (or hypervisor of virtual machine switches to other guest)
   *  As a result, we may become TASK_RUNNING after becoming TASK_DEAD
   *
   * To avoid it, we have to wait for releasing tsk->pi_lock which
   * is held by try_to_wake_up()
   */
  smp_mb();
  raw_spin_unlock_wait(&tsk->pi_lock);
  /* causes final put_task_struct in finish_task_switch(). */
  tsk->state = TASK_DEAD;//调度其它进程
  tsk->flags |= PF_NOFREEZE;/*重新调度，因为该进程已经被设置成了僵死状态，因此永远都不会再把它调度回来运行了，也就实现了do_exit不会有返回的目标    */  /* tell freezer to ignore us */
  schedule();
  BUG();
  /* Avoid "noreturn function does return".  */
  for (;;)
    cpu_relax();  /* For when BUG is null */
}