- For eg. To send ‘hangup’ signal to shell running on PID 1001, we use command :-
kill(1001,HUP);
- killall is used to send signal to all the processes running.

- The signal() command can be used in 3 modes :-
(i) Default mode (Terminate the process)
SIG_DFL –> is used in place of func.
(ii) Ignore the signal
SIG_IGN –> is used in place of func.
(iii) User defined mode
User defined function is used in place of func.

- The signal command returns the function which is setup to handle the signal, SIG_DFL or SIG_IGN in 3rd, 1st and 2nd cases respectively.

- They can also be used to sent from one process to another as a way of passing information or modifying behaviour.

- As default, if a process receives any signal, process will be terminated immediately.
- Usually a core dump file is created.

- The signals are defined by including header file signal.h
- They all begn with “SIG”.
- There are 64 signals in LINUX.
- The can be listed using command :-
kill -l
- Some of the signals are :-

Signal Name       Description
SIGABORT          Process Abort
SIGALRM           Alarm Clock
SIGFPE            Floating Point Exception
SIGHUP            Hangup
SIGILL            Illegal Instruction
SIGINT            Terminal Interrupt
SIGKILL           Kill (can’t be caught or ignored)
SIGPIPE           Write on a pipe with no reader
SIGQUIT           Terminal Quit
SIGSEGV           Invalid memory segment access (Segmentation Fault)
SIGTERM           Termination
SIGUSR1           User-defined signal 1
SIGUSR2           User-defined signal 2

SIGCHLD           Child process has stopped or exited
SIGCONT           Continue exexuting, if stopped
SIGSTOP           Stop Executing (Can’t be caught or ignored)
SIGTSTP           Terminal stop signal
SIGTTIN           Background process trying to read
SIGTTOU           Background process trying to write

- SIGINT can be called using Ctrl-C
- A signal has 3 steps:-
1) raise
2) catch
3) ignore/handle

- The suffix p means to search PATH environmental variable.

- If the exec is executed successfully the statements after it will not be executed.
- It is because the current process is replaced.
- The arguments given to exec are used by main() function of new process as command line argument.
- If exec fails, it returns -1
- The open file descriptors remain open after the exec command.
- These file descriptors can be passed to exec as command and can be used by the replaced process to read/write from opened file.
- The argument is passed to exec as character.
- For this sprintf() is used.
- And for getting the file descriptors back , atoi() or integer typecasting can be used on the arguments of main().

calls wait.
- The process becomes defunct or zombie process.
- It is shown by ‘Z’ or ‘Z+’ in process table.

- If the parent is terminated abnormally, the zombie child process will not be terminated (which is not good).

Macro                                        Defination
WIFEXITED(stat_val)          Nonzero if child terminated normally
WEXITSTATUS(stat_val)    If WIFEXITED is nonzero, this returns child exit code

WIFSIGNALED(stat_val)    Nonzero if child is terminated on an uncaught signal
WTERMSIG(stat_val)           If WIFSIGNALED is nonzero, this returns signal number

WIFSTOPPED(stat_val)       Nonzero if the child has stopped
WSTOPSIG(stat_val)            If WIFSTOPPED is nonzero, this returns signal number

- The wait() is used when a result of process done by child is used by the parent for further processing.
- For eg :-
In a program child process write to file1 and parent has to read from (the written data of)file1.
If the scheduler runs read() command of the parent process before the write() command of child process, it reads nothing.
- So, wait() is used before read() statement in parent process to avoid the unnecessory error.

attributes as current process.
- The new process (known as child process) is almost identical to

original process (known as parent process).
- PPID (Parent Process Identification) of new process is PID of

original process.
- PID (Process Identification) of new process is lowest PID

available after the PID of original process .Mostly it is 1 greater

than the original process(If available).
- Prototype of fork :-
pid_t fork(void);
- Function fork() is declared in header:
#include<unistd.h>
- It has a return type pid_t .
- System type pid_t is declared in header :
#include<sys/types.h>
- The Process counter of new process starts from fork() statement.
- So, fork() is executed twice.
- When fork() is executed by parent, it returns PID of child

process on success.
- When fork() is executed by child, it returns 0 for success.
- If fork fails, it returns -1.
- Falure may be due to :-
* Limit on the number of child processes that a parent may

have (CHILD_MAX), in which errno will be set to “EAGAIN”

* If process table or virtual memory is filled (not enough

space), errno variable will be set to “ENOMEM”.
- The return value of fork() can be used to determine whether child

or parent is executing.
- For eg. :-
#include<stdio.h>
#include<unistd.h>
#include<sys/types.h>
int main()
{
pid_t fret;
printf(“Only parent execute\n”);
fret = fork();//Fork statement
printf(“Both parent and child execute this statement.\n”);
switch(fork)
{
case -1 :
perror(“fork”);
exit(EXIT_FAILURE);
break;
case 0 :
printf(“Child executing\n”);
break;
default :
printf(“Parent executing\n”);
break;
}
return 0;
}

If we talk about firewall the first thing that comes to our mind is a software “Barrier” between a system and a network it may be either internal or external. The purpose of this software is to protect our system from various threats. This network security system, can be used to control incoming and outgoing network traffic based on a specific set of rules. This firewall can be used in various devices like routers .

Now if we talk about it is a kernel (or in other word a piece of software )acting on hardware.

So the kernel provides us with XTABLES which stores chins and all the rule ,act as a firewall in system. XTABLE consist of different modules for different protocols. The various modules are:-

1 > iptables applies to IPv4

2> ip6tables to IPv6

3> arptables to ARP

4> ebtables for Ethernet frames

SO our current focus will be on iptables ,what is IPTABLES ???

Its a built in firewall application fro configuring the tables provided by the LINUX KERNEL FIREWALL . Two major things associated with these utilities or application are its chain and rule.

iptables is command that uses the concept of chains to handle the network traffic .It places the rules into chains which are checked against the network traffic.Decisions are made as to what to do with the packets based on these rules (i.e whether the packet should be accepted or dropped). The predefined chains  are as follows

PREROUTING: Packets will enter this chain before a routing decision is made.

INPUT: Packet is going to be locally delivered. It does not have anything to do with processes having an opened socket; local delivery is controlled by the “local-delivery” routing table: ip route show table local.

FORWARD: All packets that have been routed and were not for local delivery will traverse this chain.

OUTPUT: Packets sent from the machine itself will be visiting this chain.

POSTROUTING: Routing decision has been made. Packets enter this chain just before handing them off to the hardware.

Tables associated with Iptables are :-

Filter table , NAT table, Raw Table, Mangle Table

Rules are :- ACCEPT , DROP, QUEUE, RETURN

Their are various flags associated with iptables like

-A      to add a rule

-p      to indicate the protocol

-s       to indicate the source of packet

-d      to indicate the destination

-dport    port number of the destination port

-sport     port number of the source port

their are various other flags for which u can refer the man page

You can use the iptables service using command:-

service iptables start/stop/restart/status

RCS file: adder.c,v
Working file: adder.c
head: 1.4
branch:
locks: strict
root: 1.4
access list:
symbolic names:
keyword substitution: kv
total revisions: 4; selected revisions: 4
description:
this is adder.c file
execl will run this process
—————————-
revision 1.4 locked by: root;
date: 2015/02/27 10:53:04; author: root; state: Exp; lines: +12 -5
write sum into pipe through wfd
—————————-
revision 1.3
date: 2015/02/27 10:27:33; author: root; state: Exp; lines: +5 -0
read struct message m through rfd.
print each element of m
—————————-
revision 1.2
date: 2015/02/27 09:55:22; author: root; state: Exp; lines: +4 -2
pass rfd to execl
—————————-
revision 1.1
date: 2015/02/27 09:46:47; author: root; state: Exp;
Initial revision
=============================================================================

RCS file: main.c,v
Working file: main.c
head: 1.8
branch:
locks: strict
root: 1.8
access list:
symbolic names:
keyword substitution: kv
total revisions: 8; selected revisions: 8
description:
This is main.c
child process is created using fork
—————————-
revision 1.8 locked by: root;
date: 2015/02/27 10:54:13; author: root; state: Exp; lines: +2 -0
close rfd and wfd
—————————-
revision 1.7
date: 2015/02/27 10:52:25; author: root; state: Exp; lines: +6 -4
read pipe through rfd
—————————-
revision 1.6
date: 2015/02/27 10:26:56; author: root; state: Exp; lines: +9 -2
write struct message m to wfd
—————————-
revision 1.5
date: 2015/02/27 09:55:15; author: root; state: Exp; lines: +3 -1
print rfd
—————————-
revision 1.4
date: 2015/02/27 09:46:33; author: root; state: Exp; lines: +1 -1
print hello.
—————————-
revision 1.3
date: 2015/02/27 09:30:46; author: root; state: Exp; lines: +4 -3
print the rfd and wfd
—————————-
revision 1.2
date: 2015/02/27 09:27:38; author: root; state: Exp; lines: +2 -1
create a pipe
print rfd and wfd
—————————-
revision 1.1
date: 2015/02/27 09:22:38; author: root; state: Exp;
Initial revision
=============================================================================

—————————-
revision 1.1
date: 2015/02/26 14:24:00; author: root; state: Exp;
Initial revision
=============================================================================

RCS file: replace.c,v
Working file: replace.c
head: 1.5
branch:
locks: strict
root: 1.5
access list:
symbolic names:
keyword substitution: kv
total revisions: 5; selected revisions: 5
description:
replace file
—————————-
revision 1.5 locked by: root;
date: 2015/02/26 14:50:03; author: root; state: Exp; lines: +1 -1
read from file
print file content
—————————-
revision 1.4
date: 2015/02/26 14:45:12; author: root; state: Exp; lines: +18 -18
open a file
pas file discriptor to execl() process
—————————-
revision 1.3
date: 2015/02/26 14:35:06; author: root; state: Exp; lines: +1 -1
new process is created in child using execl()
—————————-
revision 1.2
date: 2015/02/26 14:30:28; author: root; state: Exp; lines: +19 -19
new process is created using fork()
—————————-
revision 1.1
date: 2015/02/26 14:24:00; author: root; state: Exp;
Initial revision
=============================================================================

RCS file: new.c,v
Working file: new.c
head: 1.3
branch:
locks: strict
root: 1.3
access list:
symbolic names:
keyword substitution: kv
total revisions: 3; selected revisions: 3
description:
new process file
—————————-
revision 1.3 locked by: root;
date: 2015/02/26 14:47:43; author: root; state: Exp; lines: +13 -13
lseek file discriptor
read file
write into file
—————————-
revision 1.2
date: 2015/02/26 14:45:50; author: root; state: Exp; lines: +13 -13
print hello
—————————-
revision 1.1
date: 2015/02/26 14:24:00; author: root; state: Exp;
Initial revision
=============================================================================

Note:
1.You can see the list of object files in your library using
ar -t libststlib.a
2.ar is archive is single file holding a collection of other files.

Kernel Space and User Space

Understanding of Kernel space and User space in detail is very important if you wish to have a strong base of Linux Kernel.

• Here Kernel Space and User Space corresponds to their Virtual address space.
• Every process in linux utilizes  its own separate virtual space.
• In a linux system based on 32 bit Architecture, user space address space corresponds to lower 3GB of virtual space and kernel space the upper 1GB.(general way)
• The kernel space virtual address space is shared between all the processes.
• When a process is active, it can either be running in “user mode” or “kernel mode”.
• In a process is running in User mode it means that the CPU is running the user space side of code.
• A process running in the user mode has limited capability and is controlled by a flag in the CPU.
• Even though the kernel memory is present in the process’s memory map the user space code is not allowed to access the kernel space code.(can do in some special way).
• When a process wants to do something other than move data around in its own (userspace) virtual memory, like opening a file for example, it must make a syscall to communicate with the kernel space.
• Each CPU architecture has it’s unique way of making a system call but the basic remains the same i.e.
• A magic instruction is executed, the CPU turns on the “privileged mode” flag, and jumps to a special address in kernel space, the “syscall entry point”.( read another post to understand what syscall is)
• Now when the syscall has reached the kernel space then the process is running in kernel mode and executing instructions from the kernel space memory.
• Taking the same example of open system call, to find the requested file, the kernel may consult with filesystem drivers (to figure out where the file is) and block device drivers (to load the necessary blocks from disk) or network device drivers and protocols (to load the file from a remote source).
• These drivers can be either built in or can be loaded as module but the key point that remains it that they are the part of kernel space.
• Loading a module is done with a syscall that asks the kernel to copy the module’s code and data into kernel space and run its initialization code in kernel mode.
• If the kernel can’t process the request then the process is made to sleep by the kernel and when the request is complete then the syscall returns back to the user space.
• Returning back to user mode means restoring the CPU registers to what they were before coming to Kernel Mode and changing the CPU privilege level to non-privilege .
• Apart from syscalls there are some other things that take CPU to kernel mode eg. 

1. Page faults- If the process tries to access a virtual memory address that doesn’t have a physical address assigned to it then the CPU enters the Kernel mode  and jumps to page fault handler and the kernel sees whether the virtual addresss is valid or not and depending upon this it either tries to create a physical page for the given virtual address or if it can’t then sends a segmentation fault signal (SIGSEGV).

The memory management subsystem is one of the most important parts of the operating system. Since the early days of computing, there has been a need for more memory than exists physically in a system. Strategies have been developed to overcome this limitation and the most successful of these is virtual memory. Virtual memory makes the system appear to have more memory than is physically present by sharing it among competing processes as they need it.

Virtual memory does more than just make your computer’s memory go farther. The memory management subsystem provides:

Large Address Spaces

The operating system makes the system appear as if it has a larger amount of memory than it actually has. The virtual memory can be many times larger than the physical memory in the system. 

Protection

Each process in the system has its own virtual address space. These virtual address spaces are completely separate from each other and so a process running one application cannot affect another. Also, the hardware virtual memory mechanisms allow areas of memory to be protected against writing. This protects code and data from being overwritten by rogue applications. 

Memory Mapping

Memory mapping is used to map image and data files into a process’ address space. In memory mapping, the contents of a file are linked directly into the virtual address space of a process. 

Fair Physical Memory Allocation

The memory management subsystem allows each running process in the system a fair share of the physical memory of the system. 

Shared Virtual Memory

Although virtual memory allows processes to have separate (virtual) address spaces, there are times when you need processes to share memory. For example there could be several processes in the system running the bash command shell. Rather than have several copies of bash, one in each process’s virtual address space, it is better to have only one copy in physical memory and all of the processes running bash share it. Dynamic libraries are another common example of executing code shared between several processes.Shared memory can also be used as an Inter Process Communication (IPC) mechanism, with two or more processes exchanging information via memory common to all of them. Linux supports the Unix System V shared memory IPC.

Virtual Memory

 

An Abstract Model of Virtual Memory

 

s

Figure: Abstract model of Virtual to Physical address mapping

 

Before considering the methods that Linux uses to support virtual memory it is useful to consider an abstract model that is not cluttered by too much detail.

As the processor executes a program it reads an instruction from memory and decodes it. In decoding the instruction, the processor may need to fetch or store the contents of a location in memory. The processor then executes the instruction and moves on to the next instruction in the program. In this way the processor is always accessing memory either to fetch instructions or to fetch and store data.

In a virtual memory system all of these addresses are virtual addresses and not physical addresses. These virtual addresses are converted into physical addresses by the processor based on information held in a set of tables maintained by the operating system.

To make this translation easier, virtual and physical memory are divided into handy sized chunks called pages. These pages are all the same size. They need not be but if they were not, the system would be very hard to administer. Linux on Alpha AXP systems uses 8 Kbyte pages and on Intel x86 systems it uses 4 Kbyte pages. Each of these pages is given a unique number: the page frame number (PFN).

In this paged model, a virtual address is composed of two parts: an offset and a virtual page frame number. If the page size is 4 Kbytes, bits 1-10 of the virtual address contain the offset and bits 12 and above are the virtual page frame number. The processor extracts the virtual page frame number and offset from a virtual address every time it encounters one. Then it matches the virtual page frame number to a physical page and uses the offset to specify how far to go into the page. The processor uses page tables to match the virtual page frame number to the physical page.

The figure above shows the virtual address spaces of two processes, process X and process Y, each with their own page tables. These page tables map each process’ virtual pages into physical pages in memory. This shows that process X’s virtual page frame number 0 is mapped into memory in physical page frame number 1 and that process Y’s virtual page frame number 1 is mapped into physical page frame number 4. Each entry in the page table contains the following information:

 

• Valid flag. This indicates if this page table entry (PTE) is valid,
• The physical page frame number that this entry describes
• Access control information. This describes how the page may be used. Can it be written to? Does it contain executable code?

The page table is accessed using the virtual page frame number as an offset. Virtual page frame 5 would be the 6th element of the table (0 is the first element).

To translate a virtual address into a physical one, the processor must first work out the virtual address’ page frame number and the offset within that virtual page. By making the page size a power of 2 this can be easily done by masking and shifting. Looking again at the figures and assuming a page size of 0×2000 bytes (which is decimal 8192) and an address of 0×2194 in process Y’s virtual address space then the processor would translate that address into offset 0×194 into virtual page frame number 1.

The processor uses the virtual page frame number as an index into the process’ page table to retrieve its page table entry. If the page table entry at that offset is valid, the processor takes the physical page frame number from this entry. If the entry is invalid, the process has accessed a non-existent area of its virtual memory. In this case, the processor cannot resolve the address and must pass control to the operating system so that it can fix things up.

Just how the processor notifies the operating system that the correct process has attempted to access a virtual address for which there is no valid translation is specific to the processor. However the processor delivers it, this is known as a page fault and the operating system is notified of the faulting virtual address and the reason for the page fault.

For a valid page table entry, the processor takes that physical page frame number and multiplies it by the page size to get the address of the base of the page in physical memory. Finally, the processor adds in the offset to the instruction or data that it needs.

Using the above example again, process Y’s virtual page frame number 1 is mapped to physical page frame number 4 which starts at0×8000 (4 x 0×2000). Adding in the 0×194 byte offset gives us a final physical address of 0×8194.

By mapping virtual to physical addresses this way, the virtual memory can be mapped into the system’s physical pages in any order. In the figure above, process X’s virtual page frame number 0 is mapped to physical page frame number 1, whereas virtual page frame number 7 is mapped to physical page frame number 0 although it is higher in virtual memory than virtual page frame number 0. This demonstrates an interesting byproduct of virtual memory; the pages of virtual memory do not have to be present in physical memory in any particular order.

 

Shared Virtual Memory

Virtual memory makes it easy for several processes to share memory. All memory access are made via page tables and each process has its own separate page table. For two processes sharing a physical page of memory, its physical page frame number must appear in a page table entry in both of their page tables.

The figure above shows two processes that each share physical page frame number 4. For process X this is virtual page frame number 4 whereas for process Y this is virtual page frame number 6. This illustrates an interesting point about sharing pages: the shared physical page does not have to exist at the same place in virtual memory for any or all of the processes sharing it.

 

Physical and Virtual Addressing Modes

It does not make much sense for the operating system itself to run in virtual memory. This would be a nightmare situation where the operating system must maintain page tables for itself. Most multi-purpose processors support the notion of a physical address mode as well as a virtual address mode. Physical addressing mode requires no page tables and the processor does not attempt to perform any address translations in this mode. The Linux kernel is linked to run in physical address space.

The Alpha AXP processor does not have a special physical addressing mode. Instead, it divides up the memory space into several areas and designates two of them as physically mapped addresses. This kernel address space is known as KSEG address space and it encompasses all addresses upwards from 0xfffffc0000000000. In order to execute from code linked in KSEG (by definition, kernel code) or access data there, the code must be executing in kernel mode. The Linux kernel on Alpha is linked to execute from address0xfffffc0000310000.

 

Access Control

The page table entries also contain access control information. As the processor is already using the page table entry to map a process’ virtual address to a physical one, it can easily use the access control information to check that the process is not accessing memory in a way that it should not.

There are many reasons why you would want to restrict access to areas of memory. Some memory, such as that containing executable code, is naturally read only memory; the operating system should not allow a process to write data over its executable code. By contrast, pages containing data can be written to, but attempts to execute that memory as instructions should fail. Most processors have at least two modes of execution: kernel and user. This adds a level of security to your operating system. Because it is the core of the operating system and therefore can do most anything, kernel code is only run when the CPU is in kernel mode. You would not want kernel code executed by a user or kernel data structures to be accessible except when the processor is running in kernel mode.

1. What is the difference between Swapping and Paging?

 

Swapping: Whole process is moved from the swap device to the main memory for execution. Process size must be less than or equal to the available main memory. It is easier to implementation and overhead to the system. Swapping systems does not handle the memory more flexibly as compared to the paging systems.

Paging: Only the required memory pages are moved to main memory from the swap device for execution. Process size does not matter. Gives the concept of the virtual memory. It provides greater flexibility in mapping the virtual address space into the physical memory of the machine. Allows more number of processes to fit in the main memory simultaneously. Allows the greater process size than the available physical memory. Demand paging systems handle the memory more flexibly.

 3.What is the main goal of the Memory Management?

 

1. It decides which process should reside in the main memory,
2. Manages the parts of the virtual address space of a process which is non-core resident,
3. Monitors the available main memory and periodically write the processes into the swap device to provide more processes fit in the main memory simultaneously.

 

4. What is a Map?

 

A Map is an Array, which contains the addresses of the free space in the swap device that are allocatable resources, and the number of the resource units available there.

Address Units
1     10,000

This allows First-Fit allocation of contiguous blocks of a resource. Initially the Map contains one entry – address (block offset from the starting of the swap area) and the total number of resources.

Kernel treats each unit of Map as a group of disk blocks. On the allocation and freeing of the resources Kernel updates the Map for accurate information.

5. What is a Region?

A Region is a continuous area of a process’s address space (such as text, data and stack). The kernel in a “Region Table” that is local to the process maintains region. Regions are sharable among the process.

 What is Fork swap?

“fork()” is a system call to create a child process. When the parent process calls “fork()” system call, the child process is created and if there is short of memory then the child process is sent to the read-to-run state in the swap device, and return to the user state without swapping the parent process. When the memory will be available the child process will be swapped into the main memory.