Programs written in the procedural style (as opposed to object-oriented style) are organized as a logical hierarchy of subroutine calls. In general, each subroutine call involves passing arguments from the caller to the callee. In addition, the callee may declare temporary local variables. Subroutine arguments and automatic local variables are accommodated at the top of virtual memory in an area known as the stack segment or simply as the stack. See Figure 5.

Fig. 5 Memory map showing the stack segment.

The hierarchy of subroutine calls begins when the operating system invokes the program’s main() function in C or the MAIN program in Fortran. Under normal circumstances, it ends when “main” returns to the operating system. The entire sequence can be represented as a call graph like that in Figure 6.

1. OS calls main
2. main calls func1
3. func1 calls func2
4. func2 returns to func1
5. func1 calls func3
6. func3 returns to func1
7. func1 returns to main
8. main calls func4
9. func4 returns to main
10. main returns (exit status) to OS

Fig. 6 Typical subroutine call graph.

Before calling main, the operating system pushes the elements of the command line that was used to invoke the program on “top” of the initially empty stack. In C, the main() function has access to these arguments through the argc and argv parameters, while Fortran MAIN programs can use the IARGC and GETARG subroutines, which are non-standard extensions.

As execution commences, main pushes its automatic variables on top of the stack. This makes the stack “grow” towards lower addresses. Then, just prior to calling func1, main pushes the arguments to func1. Together, main’s automatic variables and the arguments to func1 constitute a stack frame. Stack frames accumulate on the stack as the program descends the call graph, and are dismantled as it ascends. The procedure is outlined in Figure 7 below.

Fig. 7 Evolution of the stack segment corresponding to the call graph shown in Figure 6.

By convention, the currently active subroutine can only reference the arguments it was passed and its own local automatic and static variables (plus any globally accessible data). For example, while func2 is executing, it can not access func1′s local variables, unless of course func1 passes references to its local variables in the argument list to func2.

When you are working on an already installed linux distribution, the grub package will be bydefault installed on the system.

I will be showing you, the example’s of working with grub-legacy. Because any grub version number thats in the form 0.9x is grub-legacy now.(Please note the fact that grub-legacy is no longer under active developement.)

For this example, i will be working on a Red hat enterprise linux 5.

[root@localhost ~]# rpm -qa | grep grub
grub-0.97-13.5
[root@localhost ~]#

the above shown package, will also provide you with a command called grub-install.

[root@localhost ~]# whereis grub-install
grub-install: /sbin/grub-install /usr/share/man/man8/grub-install.8.gz
[root@localhost ~]# rpm -qf /sbin/grub-install
grub-0.97-13.5

[root@localhost ~]# grub-install /dev/sda
Installation finished. No error reported.
This is the contents of the device map /boot/grub/device.map.
Check if this is correct or not. If any of the lines is incorrect,
fix it and re-run the script `grub-install'.
# this device map was generated by anaconda
(hd0)     /dev/sda
[root@localhost ~]#

In the above command, it will install grub in the MBR of the hard disk /dev/sda.
the above command result tells you an important fact to understand. It tells that, there is a device map file, and is asking us to check and confirm whether the file is correct or not.

Device map file is used by grub to identify the OS device names in a precise way. GRUB uses this file to map the device names of BIOS to operating system device names.This was devised, because there was inconstancies with, Linux operating system’s device naming convention.

This file is configurable as per your requirement.

In the above example output of the /boot/grub/device.map tells that (hd0) in grub means /dev/sda in the operating system.

Whenever you install GRUB, on any of your partition, it gets installed and images are put under the directory “boot” in that partition.
If you want to install grub, under a directory other than the default “boot”, you need to specify the boot directory with a command line argument to grub-install command.

Imagine that you want to install grub, on one of your external hard disk, and is currently mounted under /mydisk. lets see how to do it.

[root@localhost ~]# grub-install --root-directory=/mydisk/grub/ /dev/sdb

Example: Windows and Unix.

Micro kernel : Kernel Image = Kernel Core. Services are build in to special modules which can be loaded and unloaded as per need.

We have another type of kernel integration technique called

Modular, this is derived from best of micro and monolithic kernel) In

Modular kernel integration:  Kernel Image = (Kernel core + IPC service modules +Memory  module +Process Management module). All other modules are loadable kernel modules.

Example: Linux kernel

What do we mean by data alignment, structure packing and padding?

Predict the output of following program.

Before moving further, write down your answer on a paper, and read on. If you urge to see explanation, you may miss to understand any lacuna in your analogy. Also read the post by Kartik.

Data Alignment:

Every data type in C/C++ will have alignment requirement (infact it is mandated by processor architecture, not by language). A processor will have processing word length as that of data bus size. On a 32 bit machine, the processing word size will be 4 bytes.

Historically memory is byte addressable and arranged sequentially. If the memory is arranged as single bank of one byte width, the processor needs to issue 4 memory read cycles to fetch an integer. It is more economical to read all 4 bytes of integer in one memory cycle. To take such advantage, the memory will be arranged as group of 4 banks as shown in the above figure.

The memory addressing still be sequential. If bank 0 occupies an address X, bank 1, bank 2 and bank 3 will be at (X + 1), (X + 2) and (X + 3) addresses. If an integer of 4 bytes is allocated on X address (X is multiple of 4), the processor needs only one memory cycle to read entire integer.

Where as, if the integer is allocated at an address other than multiple of 4, it spans across two rows of the banks as shown in the below figure. Such an integer requires two memory read cycle to fetch the data.

A variable’s data alignment deals with the way the data stored in these banks. For example, the natural alignment of int on 32-bit machine is 4 bytes. When a data type is naturally aligned, the CPU fetches it in minimum read cycles.

Similarly, the natural alignment of short int is 2 bytes. It means, a short int can be stored in bank 0 – bank 1 pair or bank 2 – bank 3 pair. A double requires 8 bytes, and occupies two rows in the memory banks. Any misalignment of double will force more than two read cycles to fetch double data.

Note that a double variable will be allocated on 8 byte boundary on 32 bit machine and requires two memory read cycles. On a 64 bit machine, based on number of banks, double variable will be allocated on 8 byte boundary and requires only one memory read cycle.

Structure Padding:

In C/C++ a structures are used as data pack. It doesn’t provide any data encapsulation or data hiding features (C++ case is an exception due to its semantic similarity with classes).

Because of the alignment requirements of various data types, every member of structure should be naturally aligned. The members of structure allocated sequentially increasing order. Let us analyze each struct declared in the above program.

Output of Above Program:

For the sake of convenience, assume every structure type variable is allocated on 4 byte boundary (say 0×0000), i.e. the base address of structure is multiple of 4 (need not necessary always, see explanation of structc_t).

structure A

The structa_t first element is char which is one byte aligned, followed by short int. short int is 2 byte aligned. If the the short int element is immediately allocated after the char element, it will start at an odd address boundary. The compiler will insert a padding byte after the char to ensure short int will have an address multiple of 2 (i.e. 2 byte aligned). The total size of structa_t will be sizeof(char) + 1 (padding) + sizeof(short), 1 + 1 + 2 = 4 bytes.

structure B

The first member of structb_t is short int followed by char. Since char can be on any byte boundary no padding required in between short int and char, on total they occupy 3 bytes. The next member is int. If the int is allocated immediately, it will start at an odd byte boundary. We need 1 byte padding after the char member to make the address of next int member is 4 byte aligned. On total, the structb_t requires 2 + 1 + 1 (padding) + 4 = 8 bytes.

structure C – Every structure will also have alignment requirements

Applying same analysis, structc_t needs sizeof(char) + 7 byte padding + sizeof(double) + sizeof(int) = 1 + 7 + 8 + 4 = 20 bytes. However, the sizeof(structc_t) will be 24 bytes. It is because, along with structure members, structure type variables will also have natural alignment. Let us understand it by an example. Say, we declared an array of structc_t as shown below

structc_t structc_array[3];

Assume, the base address of structc_array is 0×0000 for easy calculations. If the structc_t occupies 20 (0×14) bytes as we calculated, the second structc_t array element (indexed at 1) will be at 0×0000 + 0×0014 = 0×0014. It is the start address of index 1 element of array. The double member of this structc_t will be allocated on 0×0014 + 0×1 + 0×7 = 0x001C (decimal 28) which is not multiple of 8 and conflicting with the alignment requirements of double. As we mentioned on the top, the alignment requirement of double is 8 bytes.

Inorder to avoid such misalignment, compiler will introduce alignment requirement to every structure. It will be as that of the largest member of the structure. In our case alignment of structa_t is 2, structb_t is 4 and structc_t is 8. If we need nested structures, the size of largest inner structure will be the alignment of immediate larger structure.

In structc_t of the above program, there will be padding of 4 bytes after int member to make the structure size multiple of its alignment. Thus the sizeof (structc_t) is 24 bytes. It guarantees correct alignment even in arrays. You can cross check.

structure D - How to Reduce Padding?

By now, it may be clear that padding is unavoidable. There is a way to minimize padding. The programmer should declare the structure members in their increasing/decreasing order of size. An example is structd_t given in our code, whose size is 16 bytes in lieu of 24 bytes of structc_t.

Unlike with a foreground process, the shell does not have to wait for a background process to end before it can run more processes. Within the limit of the amount of memory available, you can enter many background commands one after another. To run a command as a background process, type the command and add a space and an ampersand to the end of the command. For example:

$ command1 &

Immediately after entering the above command, the shell will execute the command. While that is running in the background, the shell prompt (% for the C Shell, and $ for the Bourne Shell and the Korn Shell) will return. At this point, you can enter another command for either foreground or background process. Background jobs are run at a lower priority to the foreground jobs.

You will see a message on the screen when a background process is finished running.

Foreground Process

A foreground process is different from a background process in two ways:

1. Some foreground processes show the user an interface, through which the user can interact with the program.
2. The user must wait for one foreground process to complete before running another one.

To start a foreground process, enter a command at the prompt, e.g.,

$ command1

The next prompt will not appear until command1 finishes running.

Sometimes a target does not mean a file but it might represent an action to be performed. When a target  is not related to a file it is called phony target.

For instance:

getobj:
	mv obj/*.o .  2>/dev/null

getobj target move all files with .o extension from obj directory to current directory — not a big deal. However, you should be asking yourself: “What if there is no file in obj ?” That is a good question. In that case, the mv command would return an error that would be passed to the make command.

Note: make command default behavior is to abort the processing when an error is detected while executing commands in rules.

Of course, there will be situations that the obj directory will be empty. How will you avoid the make command from aborting when an error happens?

You can use a special character - (minus) preceding the mv command. Thus:

getobj:
	-mv obj/*.o .  2>/dev/null

- Tells the make to ignore errors. There is another special character: @ – Tells make not to print the command to standard output before executing. You can combine both always preceding the command:

getobj:
	-@mv obj/*.o .  2>/dev/null

There is a special phony target called all where you can group several main targets and phony targets. all phony target  is often used to lead make command while reading makefile.

For instance:

all: getobj app install putobj

The make command will execute the targets in sequence: getobj, app, install and putobj.

Another interesting feature, make command supports is the concept of MACRO in makefiles. We can define a MACRO by writing:

MACRONAME=value

and access the value of MACRONAME by writing either $(MACRONAME) or ${MACRONAME}.

For instance:

EXECPATH=./bin

INCPATH=./include

OBJPATH=./obj

CC=cc

CFLAGS=-g -Wall -I$(INCPATH)

While executing, make replaces $(MACRONAME) with the appropriated definition. Now we know what phony targets and macros are we can move to the next sample.

A make file consists of a set of targets, dependencies and rules. A target most of time is a file to be created/updated. target depends upon a set of source files or even others targets described in Dependency List. Rules are the necessary commands to create the target file by using Dependency List.

As you see in figure 1 each command in the Rules part must be on lines that start with a TAB character. Space issue errors. Also, a space at end of the rule line may cause make issues an error message.

The makefile is read by make command which determines target files to be built by comparing the dates and times (timestamp) of source files in Dependency List.If any dependency has a changed timestamp since the last build make command will execute the rule associated with the target.

Linux processes generally go through six major states, which are listed below:

1. Running or Runnable ( R ) – A running state has a broader concept here. Running always does not mean utilising the CPU. Even while a process is ready to run, the state is running state.

Hence, there are two sub-states, when the process is queued in the ready queue to run and when the process is actually being executed, it is in the executing sub-state as has been scheduled by the scheduler.

2. Stopped (T) – If a running process receives a stop signal, it is moved to the stopped state. A process can also be in stopped state if it has been halted by a trace while debugging. .

3. Uninterruptible sleep (D) – It is a sleeping state, process has been blocked. Mostly, process goes into an uninterruptible sleep during an IO operation.

4. Interruptible sleep (S) – It is a sleeping state i.e. a blocking state where the process is waiting for an event to occur.

5. Zombie/Defunct state(Z) – It is the process state in which process has been terminated but not reaped by its parent process.

6. Dead (X) – A process never reaches this state, as as soon as it is dead, it is gone.

Note: For BSD formats and when the stat keyword is used, additional characters may be displayed:

• < high-priority (not nice to other users)

• N low-priority (nice to other users)

• L has pages locked into memory (for real-time and custom IO)

• s is a session leader

• l is multi-threaded (using CLONE_THREAD, like NPTL pthreads do)

• + is in the foreground process group.

It’s a pretty much common question asked in most of the interviews related to Linux, and most of the time people got it confused with Orphan Process. But these two are totally different from each other. A Zombie Process is nearly the same thing which we see in lot of horror movies. Like the dead people which don’t have any life force left, Zombie processes are the dead processes sitting in the process table and doing nothing.

To explain this in much better way, “Zombie process or defunct process is a process that have completed the execution, have released all the resources (CPU, memory) but still had an entry in the process table.”

Reasons of Zombie Process:

Most of the time, the reason for existence of Zombie process is bad coding. Normally, when a child (subprocess) finishes it’s task and exits, then it’s parent is suppose to use the “wait” system call and get the status of the process. So, until the parent process don’t check for the child’s exit status, the process is a Zombie process, but it usually is very small duration. But if due to any reason (bad programming or a bug), the parent process didn’t check the status of the child and don’t call “wait”, the child process stays in the state of Zombie waiting for parent to check it’s status.

Finding Zombie processes:

To check whether you have any Zombie processes in your system, simply run linux command line utility “top”. It shows the number of zombie processes at the upper-right side of its output.

At the same time, you can use one more command to check that

# ps aux

All the processes which are having “z” in their Stat column are Zombie processes.

Killing a Zombie Process:

Well, before taking any decision of killing the Zombie process, you should wait, as it is possible that the parent process is intentionally leaving the process in a zombie state to ensure that future children that it may create will not receive the same pid. Or perhaps the parent is occupied, and will reap the child process momentarily.

If that didn’t happen then you can send a SIGCHLD signal to the parent process of zombie which will instruct parents to reap their zombie children.

# kill -s SIGCHLD <PPID>

Even if this don’t work, then the last option you will have is to kill the parent process. You can easily find out the parent’s process ID with this command:

# ps aux -eo ppid | grep <Zombie Process ID>
# kill -9 <PPID>

So when a Zombie process loses it’s parent process, it becomes orphan and adopted by “init”. Init periodically executes the wait system call to reap any zombies with init as parent.

• A process is a program (object code stored on some media) in execution.
•  Processes are, however, more than just the executing program code (often called the text section in Unix). They also include a set of resources such as open files and pending signals, internal kernel data, processor state, an address space, one or more threads of execution, and a data section containing global variables. Processes, in effect, are the living result of running program code.

• Threads of execution, often shortened to threads, are the objects of activity within the process.
•  Each thread includes a unique program counter, process stack, and set of processor registers. The kernel schedules individual threads, not processes.
•  In traditional Unix systems, each process consists of one thread. In modern systems, however, multithreaded programs those that consist of more than one thread are common.
•  But,to Linux, a thread is just a special kind of process.
• People generally are confused that a program is a process but a process is an active program and related resources. Indeed, two or more processes can exist that are executing the same program. In fact, two or more processes can exist that share various resources, such as open files or an address space.
• A process begins its life when, not surprisingly, it is created. In Linux, this occurs by means of the fork() system call, which creates a new process by duplicating an existing one.
• The new process is an exact copy of the old process. (Now, a question might come immediately to our mind- who creates the first process?? The first process is the init process which is literally created from scratch during booting).
• The process that calls fork() is the parent, whereas the new process is the child. The parent resumes execution and the child starts execution at the same place, where the call returns. The fork() system call returns from the kernel twice: once in the parent process and again in the newborn child.
• Often, immediately after a fork it is desirable to execute a new, different, program. The exec*() family of function calls is used to create a new address space and load a new program into it. In modern Linux kernels, fork() is actually implemented via the clone() system call,
• Finally, a program exits via the exit() system call. This function terminates the process and frees all its resources.
• A parent process can inquire about the status of a terminated child via the wait4()system call, which enables a process to wait for the termination of a specific process.
•  When a process exits, it is placed into a special zombie state that is used to represent terminated processes until the parent calls wait() or waitpid().
• The kernel implements the wait4() system call. Linux systems, via the C library, typically provide the wait(),waitpid(),wait3() , and wait4() functions. All these functions return status about a terminated process, albeit with slightly different semantics.
• Another name for a process is a task.  although when we say task we generally mean a process from the kernel’s point of view

Kernel Space and User Space

Understanding of Kernel space and User space in detail is very important if you wish to have a strong base of Linux Kernel.

• Here Kernel Space and User Space corresponds to their Virtual address space.
• Every process in linux utilizes  its own separate virtual space.
• In a linux system based on 32 bit Architecture, user space address space corresponds to lower 3GB of virtual space and kernel space the upper 1GB.(general way)
• The kernel space virtual address space is shared between all the processes.
• When a process is active, it can either be running in “user mode” or “kernel mode”.
• In a process is running in User mode it means that the CPU is running the user space side of code.
• A process running in the user mode has limited capability and is controlled by a flag in the CPU.
• Even though the kernel memory is present in the process’s memory map the user space code is not allowed to access the kernel space code.(can do in some special way).
• When a process wants to do something other than move data around in its own (userspace) virtual memory, like opening a file for example, it must make a syscall to communicate with the kernel space.
• Each CPU architecture has it’s unique way of making a system call but the basic remains the same i.e.
• A magic instruction is executed, the CPU turns on the “privileged mode” flag, and jumps to a special address in kernel space, the “syscall entry point”.( read another post to understand what syscall is)
• Now when the syscall has reached the kernel space then the process is running in kernel mode and executing instructions from the kernel space memory.
• Taking the same example of open system call, to find the requested file, the kernel may consult with filesystem drivers (to figure out where the file is) and block device drivers (to load the necessary blocks from disk) or network device drivers and protocols (to load the file from a remote source).
• These drivers can be either built in or can be loaded as module but the key point that remains it that they are the part of kernel space.
• Loading a module is done with a syscall that asks the kernel to copy the module’s code and data into kernel space and run its initialization code in kernel mode.
• If the kernel can’t process the request then the process is made to sleep by the kernel and when the request is complete then the syscall returns back to the user space.
• Returning back to user mode means restoring the CPU registers to what they were before coming to Kernel Mode and changing the CPU privilege level to non-privilege .
• Apart from syscalls there are some other things that take CPU to kernel mode eg. 

1. Page faults- If the process tries to access a virtual memory address that doesn’t have a physical address assigned to it then the CPU enters the Kernel mode  and jumps to page fault handler and the kernel sees whether the virtual addresss is valid or not and depending upon this it either tries to create a physical page for the given virtual address or if it can’t then sends a segmentation fault signal (SIGSEGV).