[Linux technology] explores the Linux kernel and super-detailed parsing Subsystem

Perface

I have already written an article titled five subsystems of the embedded Linux kernel, which is more general and simple. Now I want to explain it in detail.

Leave this note only for future reference and supplement!

Linux Kernel Subsystem

The kernel is the core of the operating system. The Linux Kernel provides many basic functions, such as virtual memory, multi-task, shared library, demand loading, Copy-On-Write during shared Write, and network functions. Various features are added, which leads to an increase in kernel code.

The Linux kernel divides different functions into different subsystems, and integrates various functions in a whole structure, improving the work efficiency. At the same time, it also provides a way to dynamically load modules, providing flexibility for dynamic kernel modification.

System Call Interface

After a user program is interrupted by software, it calls the functions provided by the system kernel. The interface between the user space and the services provided by the kernel is called the system call.

650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/131227/1R20C006-0.png "title =" linux "/>

System calls are provided by the Linux kernel and cannot be directly used by user space. When a user process uses a system call, it must cross the boundaries between the application and the kernel. The Linux Kernel provides users with a unified system call interface, but the system call methods on different processors are different. The Linux Kernel provides a large number of system calls.This article describes how to call a Linux System Based on the basic principle of system call.

650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/131227/1R20610U-1.jpg "title =" using a disconnected system calling process. jpg "/>

This is a system call performed in a user process through the gnu c library, and the system call is passed into the kernel through the same entry point. Taking the i386 architecture as an example, the EAX register is used to mark system calls.

When the index and parameters called by the system C library are loaded, the 0x80 software is called for interruption. It will execute the system_call function, which processes all system calls according to the EAX register content. After several unit tests, the system call entry is obtained using the index of the EAX register content to query the system_call_table table, and then the system call is executed. After returning from the system call, the system finally executes system_exit and calls the resume_userspace function to return to the user space.

The core of Linux kernel system calling is system multi-path decomposition tables. Finally, the system call ID and index value of the EAX register are used to find the corresponding entry address of the system call from the corresponding system call table, and then the system call is executed.

Linux system calls do not have a single-layer call relationship. Some system calls are decomposed multiple times by the kernel, such as socket calls. All socket-related system calls are associated with _ NR_socketcall system calls, use another appropriate parameter to obtain an appropriate call.

Process Management Subsystem

When you use the database functions provided by the system for process programming, You can dynamically create processes and wait and mutex among processes. These operations are implemented by the Linux kernel. The linux kernel implements process-related operations through the process management subsystem. On the linux system, all computing work is performed by processes, and processes can execute a short-term command ), it can also be a long-term network service ). Linux is a dynamic system that can adapt to changing computing requirements through process management.

In the user space, the process is represented by the process identifier PID. From the user's point of view, a PID is a digital value that uniquely identifies a process. a pid value is not changed throughout the lifecycle of the process, however, the PID can be reused after the process is destroyed. You can create a new process or a sub-process of the current process.

In the Linux kernel space, each process has an independent data structure to save the process's ID, priority, address space, and other information, this structure is also called Process Control Block ). Process Management is the management of process control blocks.

Linux processes are generated by calling the fork () function system. The process that calls fork () is called the parent process, and the generated process is called the child process. When a child process is created, the data structure except the process ID is exactly the same as that of the parent process. After the fork () System Call creates the memory, the sub-process is immediately added to the kernel process debugging queue and then called using the exec () system, add the code of the program to the address space of the sub-process, and then the sub-process starts to execute its own code.

There can be multiple processes in a system, but generally there is only one CPU. At the same time, only one process is working, even if there are multiple CPUs, it is impossible to have as many processes as possible. If several processes can work on the CPU, this is the work of the Process Management Subsystem. The Linux kernel designs a structure for storing process queues. There are several queues in a system that store processes in different States. A process can have several States, defined by the operating system, but at least three States are available: running state, ready state, and waiting state, the kernel designs a process control block for storing the corresponding status in the corresponding queue.

After a user process is loaded, it enters the ready state and is added to the ready state queue. After the CPU time is rotated to the ready state queue, the code is switched to the process and the process is executed, when the process time slice arrives, it is swapped out. If an I/O operation occurs to a process, it is also swapped out in advance and stored in the waiting queue. When an I/O request is returned, the process is put into the ready queue.

The linux system has designed several different methods for managing process queues. The main purpose is to improve the stability of process debugging.

Kernel Management Subsystem

Memory is an important computer resource and an important part of the kernel. For computers using the virtual memory technology, memory management hardware manages the memory by page. By paging, the physical memory of the computer system is divided by the same size. Each memory partition is called a memory page. Generally, the size of the Memory Page is 4 kb. The memory management subsystem of the Linux kernel manages the ing between virtual memory and physical memory, and the available memory space of the system.

Memory Management requires not only a 4 KB buffer. Linux provides an abstraction of a 4 KB buffer, such as an slab distributor. This memory management mode uses a 4 KB buffer as the base, then allocates the structure from it, and tracks the Memory Page usage, such as which memory pages are full and which pages are not fully used, which pages are empty. In this way, the memory usage can be dynamically adjusted according to the system requirements.

In a system that supports multiple users, physical memory consumption is likely to be exhausted due to the increase in memory usage. To solve the problem of physical memory depletion, the memory management subsystem requires that the page can be removed from the memory and put into the disk. This process is called swap. The source code for memory management can be found in./linux/mm.

Virtual File System

In different format file partitions, the program can read and write files correctly, and the results are the same. Sometimes, when using linux, we find that we can directly copy files in different types of file partitions. For applications, we do not know the type of the file system, or even the file type, this is the work behind the virtual file system. The Virtual File System shields the differences between different file systems and provides users with a unified interface.

Virtual File System (VFSVirtual File System) is a software abstraction layer in the Linux kernel. It provides interface mechanisms to actual file systems such as ext2 and vfat through some data structures and methods. You can use the same file I/O system to operate any file in Linux without considering the specific file system format. Further, file operations can be performed between different file systems.

650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/131227/1R20C124-2.jpg "title =" the relationship between the VFS and the local file system in the kernel. jpg "/>

In linux, everything can be viewed as a file. Not only can common text files and directories be processed as files, but also character devices, Block devices, sockets, and so on can all be processed as files. Although these files are of different types, they use the same operation method. This is also one of the basic philosophies of UNIX/Linux design.

A Virtual File System (VFS) is the key to implementing the "Everything is a file" feature. It is a software layer of the Linux kernel that provides file system interfaces to user space programs; it also provides an abstract function in the kernel, allowing different types of file systems to exist. VFS can be understood as an abstract interface standard. All file systems in the system depend not only on VFS but also on VFS for collaborative work.

To support different file systems, VFS defines the most basic conceptual interface and data structure supported by all file systems. when implementing a specific file system, VFS must be provided with interfaces and data structures that comply with VFS standards. Different file systems may have different physical concepts. However, when using VFS interfaces, they must be consistent with the concepts defined by VFS, only in this way can the user's file system be unrelated. VFS hides the operation details of a specific file system. Therefore, in the VFS layer and other parts of the kernel, all file systems are the same.

System calls to file system access are processed through the VFS software layer. VFS calls different file system-driven functions to process user requests based on access requests. When accessing a physical device, the file system code needs to use a physical device driver to access the real hardware.

Network stack

Write network applications and use socket to communicate with other machines through the TCP/IP protocol. Similar to the kernel subsystem described earlier, socket-related functions are also completed through the kernel subsystem, the core network subsystem is responsible for this part of the task, and sometimes this part of the code is called "network stack ".

The Linux Kernel provides excellent network processing capabilities and functions, which are inseparable from the design idea of the network stack code. The network stack part of Linux follows the traditional hierarchy, there are four layers for network data to arrive at the actual network device from the user process.

650) this. width = 650; "src =" http://img1.51cto.com/attachment/201305/123533585.jpg "title =" linuxinner core network subsystem structure .jpg "/>

In fact, each layer can be divided into multiple layers. The data transmission path is hierarchical and cannot span a certain level.

The linux network subsystem uses an object-oriented design idea for network layers. It abstracts the layers to be processed into different entities and defines the relationships between entities and data processing procedures.

650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/131227/1R2063956-4.jpg "title =" linuxinner core network sub-system relations. jpg "/>

We can see that the Linux kernel network subsystem defines four entities:

Ingress network protocol

A network protocol can be understood as a language used for communication between different devices in a network. It is a specification for communication.

Accept socket

A socket is the interface between the kernel and the user program. A socket corresponds to a data connection and provides the user with file I/O. The user can send and receive data on the data connection like an operating file, the specific protocol processing is done in the network protocol section. Socket is the network interface used by the user.

✓ Device Interface

Device interfaces are software and hardware interfaces in the network subsystem. User data must be sent and received through network hardware devices. network devices vary widely and device drivers vary, the device interface shields the driver differences between specific devices.

Worker network Buffer

Network buffer, also known as socket buffer sk_buff), is an important structure in the network subsystem. There are many uncertainties in data transmission over the network. In addition to restrictions on data transmission by physical devices, such as MMU, network interference, packet loss, and retransmission, these factors may cause data instability, by reorganizing network data, the network buffer makes the data packets processed by the service complete. A network buffer is a buffer in the memory and an interface between the network system and the memory management.

Device Driver

With the increasing number of modern computer external devices, more and more devices have been developed, and the computer bus has developed rapidly. The functions of the operating system have been constantly improved, and the system software has become more and more complex, access to external devices is no longer as direct access to the device's hardware as in the DOS era. Almost all devices require device drivers. Almost all modern operating systems provide hardware-independent Device Driver interfaces. This feature shields the operation details of specific devices and allows users to access devices through the interfaces provided by the operating system, the operation details of a specific device are driven by the device. The driver developer only needs to provide the corresponding interface to the operating system.

Different from other operating systems, Linux kernel classifies devices into three categories: Block devices, character devices, and network devices. This is an abstract classification method that abstracts three different data read/write methods from device features.

Block devices

The concept of a block device is that one I/O operation can operate on multiple bytes of data. Data read/write is buffered. Data is transmitted only when the read/write buffer is full, for example, a hard disk can read data from one sector at a time, and block devices support random read/write operations to read and write data from a specified location;

Delimiter character device

The access method of character devices is linear and can be accessed in bytes. For example, a serial device can read and write data by character, but can only perform operations in sequence, and cannot specify an address for access;

✓ Network Device

Compared with the previous two methods, network devices are special. The kernel divides these drivers separately, and network devices can read and write data through interfaces.

The Linux kernel accesses the device according to the master device number and slave device number. The master device number describes the driver that controls the device, and the device number distinguishes different devices with the same driver. That is to say, the main device number corresponds to the device driver, representing a certain type of device. The device number corresponds to a specific device, representing the same type of device number. For example, two hard disks using the IDE interface have the same master device number, but different slave device numbers. Linux provides the mknod command to create a description file for the device driver. Linux Kernel supports the classification of Master/Slave Device numbers to manage devices.

650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/131227/1R2062320-5.jpg "title =" linuxinner driver .jpg "/>

For the user program to request data from external devices, we can see that user processes access external devices through device-independent software, and device-independent software is various software abstraction layers in the kernel, such as VFS. When a user initiates a data request to an external device, the corresponding driver of the device is called through the device-independent software. The driver accesses the external hardware device through the bus or register and initiates a request, during initialization, the driver registers an interrupt handler to the interrupt table of the system. When the external hardware sends an interrupt signal when a request is returned, the kernel calls the response interrupt handler, the interrupt handler reads the returned data from the hardware register and transfers the data to the device service program in the kernel. The device Service Program delivers the data to the device-independent software and finally reaches the user process.

Linux Device Drivers involve other subsystems, such as memory management, interrupt management, hardware registers, and bus access. In addition, most drivers are designed as modules for ease of use, it also needs to be designed to process the kernel module.

Writing and debugging drivers is a complex task. The driver code occupies more than half of the Linux kernel code.

Code that depends on the Architecture

The Linux kernel supports many architectures. The kernel stores device-independent code in the arch directory and the corresponding header file in the include/asm-<system name> directory. The Code Division structure is clear and the code reuse rate is improved. In the arch directory, each subdirectory corresponds to an architecture and stores the code corresponding to this architecture. If there are many codes, a separate directory will be created, such as under the arch/arm directory, there is a kernel directory that stores functions or implementation methods specific to the arm architecture in the kernel directory; the Intel X86 architecture code is stored in the arch/i386 directory, not only the kernel directory, there are also multiple directories. For example, the mm directory contains the implementation method of memory management on the x86 system, and math-emu contains the implementation of floating point simulation on the x86 system. When reading the kernel code, you can start with an architecture code. The main task of porting code to different architectures is the code in arch.

This article from the "Cheng Peng Zhiyuan" blog, please be sure to keep this source http://infohacker.blog.51cto.com/6751239/1203700