Linux-based process analysis

What is a process?

A process is an instance of program execution and a transition process of a finite state machine. The difference between process and program: dynamic and static; many-to-one.

Windows 10 related processes

List all running/active processes with ps -a in Linux

Using the top command in Linux, you can monitor the resources used by different processes. (including: PID, priority, %CPU, %memory, etc.)

Process running process:

 

process creation

A process can be created in user space by executing a program, or by calling the fork (or exec) system call within the program. The fork call causes the creation of a child process, and the exec call replaces the current process context with the new program. The birth of a new process can also be done via vfork() and clone() respectively. The three user-mode functions fork, vfork and clone are all provided by the libc library, and they respectively call the system calls of the same name provided by the Linux kernel fork, vfork and clone. The following takes the fork system call as an example to introduce.

In the end, do_fork is called directly. The function hierarchy created by the process is as follows:

 As can be seen from the figure, do_fork is the basis for process creation. The do_fork function (and the cooperating function copy_process) can be found in ./linux/kernel/fork.c.

code show as below:

 

(1) Before the system_call function is executed, the CPU control unit has automatically saved the values ​​of the eflags, cs, eip, ss and esp registers to the kernel stack corresponding to the process. Subsequently, the system call number stored in the eax register is first pushed onto the stack inside system_call. Then execute the SAVE_ALL macro. This macro saves on the stack all CPU registers that may be used by subsequent system calls.
    (2) Obtain the address of the thread_inof structure of the current process through the GET_THREAD_INFO macro; then check whether the current process is tracked by other processes (for example, when debugging a program, the debugged program is in a tracked state), that is, the flag field in the thread_info structure _TIF_ALLWORK_MASK is set to 1. If a trace occurs, turn to the processing command marked by syscall_trace_entry.
    (3) Check the validity of the system call number passed by the user mode process. If it is illegal, jump to the command marked by syscall_badsys.
    (4) If the system call is legal, search the system call table sys_call_table in ./linux/arch/x86/kernel/syscall_table_32.S according to the system call number, find the corresponding function entry point, and jump into the service routine of sys_fork . Since the entry of the sys_call_table table occupies 4 bytes, the specific method to obtain the service routine pointer is to multiply the system call number saved by eax by 4 and add it to the base address of the sys_call_table table. The code in syscall_table_32.S is as follows:

 

Process scheduling:

The created process is finally inserted into the run queue, which is scheduled by the Linux scheduler. The Linux scheduler maintains a set of lists for each priority level in which task_struct references are kept. When the time slice of the running process runs out, the clock tick generates an interrupt, and the interrupt processing of the process scheduler is called by kernel/sched.c:scheduler_tick(), and schedule() is called after the interrupt returns. Tasks in the run queue are called through the schedule function (in ./linux/kernel/sched.c), which determines the best process based on the load and process execution history.

Process destruction:

 Process status:

R running state (running): indicates that the process is either running or in the run queue

S sleep state (sleeping): means that the process is waiting for the completion of the event, this sleep is also called interruptible sleep

D disk sleep state (Disk sleep): sleep in this state is usually waiting for the end of I/O, also known as uninterruptible sleep

T stopped state (stopped): You can send a SIGSTOP signal to the process to stop the process. You can also send the SIGCONT signal to keep the process running.

X dead state (dead): this state is just a return state, you will not see this state in the task list

Z zombie state (zombie): the child process exits, the parent process does not read the exit code of the child process, and the child process enters the Z state

Linux is still evolving, and one area for further innovation and optimization is process management. While adhering to the principles of UNIX, Linux is constantly breaking through. New processor architectures, symmetric multiprocessing (SMP), and virtualization will all lead to new advances in the kernel space. An example of this is the new O(1) scheduler introduced in Linux version 2.6, which provides scalability for systems with a large number of tasks.

 

Guess you like

Origin http://43.154.161.224:23101/article/api/json?id=325044513&siteId=291194637