6.1 Process virtual address space
After each program runs, it will have its own independent virtual address space, the size of the virtual address space is determined by the computer's hardware platform, specifically by the number of CPU bits
For Windows, the process virtual address space partition is the operating system occupies 2GB, then the process is only 2GB space.
Windows has a startup parameter to reduce the virtual address space occupied by the operating system to 1GB, which is the same as the Linux distribution. Here's how:
Modify the boot. INI under the Windows system's packing directory, plus the "/3g" parameter
[boot loader]
Timeout=30
Default=multi (0) disk (0) rdisk (0) partition (1) \ Windows
[Operating Systems]
multi (0) disk (0) rdisk (0) partition (1) \windows= "Microsoft WINDOWS XP Professional"/3g/noexecute=optin/fastdetect
AWE (Windows):
The operating system provides a way for window mapping to use those larger than normal memory space
Linux and other Unix-like operating systems with MMAP () system calls to implement
6.2 Load Way
Dynamic loading:
The program is run with a local principle, you can place the most common part of the program in memory, and some of the less common data on disk, which is the basic principle of dynamic loading
Overlay loading and page mapping are two typical dynamic loading methods
The overlay manager needs to guarantee two points:
1), tree structure from any module to the root module of the tree is called the call path
2), prohibit calls across trees, any one module is not allowed to cross the tree structure to call
Page mappings are part of the virtual storage mechanism
6.4 Loading of executable files
The establishment of the process
From the operating system point of view, the most critical feature of a process is that it has a separate virtual address space, which makes it different from other processes
Create a process and then load the appropriate executable file and execute it, in case of virtual storage:
1) Create a separate virtual address space
2) Read the executable header and establish a mapping between the virtual space and the executable file
3) Set the instruction register of the CPU to the entry address of the executable file, start running
Create a virtual address space
Creating a virtual address space is not actually creating space but the corresponding data structure needed to create a mapping function, and under Linux, creating a virtual address space is actually just assigning a page directory to it.
Reads the executable header and establishes a mapping between the virtual space and the executable file
When the operating system captures a page fault, it should know where the program is currently needed in the executable, which is the mapping between the virtual space and the executables
Because executables are actually mapped to virtual space when they are loaded, executables are often referred to as "map files"
In Linux, a segment in a process virtual space called a virtual memory region (VMA) is called the entire virtual segment in Windows.
Set the CPU instruction register to the entry of the executable file, start the Run
The operating system transfers control to the process by setting the CPU's instruction register, and the process begins execution. From a process point of view, the operating system executes a jump instruction and jumps directly to the entry address of the executable file.
6.5 process virtual memory space distribution
Elf executables introduce a concept called "Segment", and a "Segment" that contains one or more properties similar to "section" has the benefit of significantly reducing page memory fragmentation
6.6 stacks and stacks
The operating system uses VMA to manage the space of the process address, and the process needs to use the stack, heap and other space when executing them.
Anonymous virtual memory Area (VMA): The main device number and the secondary device number and the file node number for the three-segment file are 0, indicating that they are not mapped to a file.
A process can basically be divided into the following VMA areas:
Code VMA, data VMA, heap VMA, stack VMA
6.7 Maximum number of applications to be piled
Use the following program to detect the number of malloc maximum memory requests:
#include <stdio.h>
#include <stdlib.h>
unsigned maximum = 0;
int main (int argc, char *argv[])
{
unsigned blocksize[] = {1024*1024,1024,1};
int i,count;
for (i = 0;i < 3; i++)
for (count = 1;; count++)
{
void *block = malloc (maximum + blocksize[i]*count);
if (block)
{
Maximum = maximum + Blocksize[i]*count;
Free (block);
}
Else
{
Break
}
}
printf ("Maximum malloc size =%u bytes\n", maximum);
}
The result on the Linux machine is about 2.9GB, about 1.5GB on Windows.
6.8 Initialization of the process stack
When the process is started, the most basic is the system environment variables and the running parameters of the process
After the process is started, the library portion of the program passes the parameter information from the initialization information in the stack to the main () function, which is the two argc and argv parameters of the main () function that we know, which correspond to the number of command-line arguments here and the array of pointers to the command-line argument string, respectively.
6.9 Linux Kernel loading elf process introduction
The bash process calls the fork () system call to create a new process, and then the new process calls the EXECVE () system call to execute the specified elf file, and the original bash process continues to return to the end of the new process that was just started
The first few bytes of the format of each executable are very special, especially the first 4 bytes, often called the magic number, can determine the format and type of the file by judging the magic number.
Elf's first 4 bytes are 0x7f, ' e ', ' l ', ' F ' Java's executable file with the first 4 bytes of ' C ', ' A ', ' f ', ' e '
Shell, Perl, Python, and other interpreted scripting language, the first line is often "#!/bin/sh", "#!/usr/bin/perl" or "#!/usr/bin/python" in front of this time 2 bytes "#" and "! "The magic number is formed, the system resolves to these 2 bytes, and the subsequent string is parsed to determine the path of the specific interpreter.
The main steps are:
1), check the effectiveness of the ELF executable file format, such as magic number, the number of middle of the program header (Segment)
2), find the dynamic link ". Interp" segment, set the path of the dynamic linker
3), according to the elf executable file of the Program Header table description, the elf file mapping,
4), initialize the ELF process environment, such as the address of the EDX register should be dt_fini when the process starts
5), modify the return address of the system call to the entry address of the elf executable file
6.10 Loading of Windows PE
RVA represents a relative virtual address, relative to the PE file's mount base address offset addresses, each PE file will be loaded with a load destination address, this is the base site
To load the PE executable file:
1), read the first page of the file, the page contains the DOS header, PE head and Cong
2), check the process address space, the destination address is available, if not available, select another Mount address
3), use the information provided in the paragraph table to map all segments one by one in the PE file to the corresponding location in the address space
4), if the load is not the target location, then the rebasing
5), loaded in all the PE files required by the DLL file
6), the analysis of all import symbols in the PE file
7), according to the parameters specified in the PE header, set up the initialization stack and heap
8), establish the main thread and start the process
Executable files are loaded on the process
