How the Linux kernel loads and launches an executable program

Pan Junyang

Original works reproduced please indicate the source
"Linux kernel Analysis" MOOC course http://mooc.study.163.com/course/USTC-1000029000

Experimental Purpose:

Use GDB to track the processing of SYS_EXECVE kernel functions, analyze the system call processing of the exec* function, and understand how the Linux kernel loads and launches an executable program.

Experimental process:

Landing Lab Building Virtual machine http://www.shiyanlou.com/courses/195

Open the shell terminal and execute the following command:

CD Linuxkernel

RM-RF Menu

git clone https://github.com/mengning/menu.git

CD Menu

MV TEST_EXEC.C test.c

Make Rootfs

1

You can see that the menuos after startup already contains the EXEC command.

Debug mode can be opened by adding-s-s startup parameters

Qemu-kernel. /linux-3.18.6/arch/x86/boot/bzimage-initrd. /rootfs.img-s-S

Open GDB for remote debugging

Gdb

File: /linux-3.18.6/vmlinux

Target remote:1234

3

Set breakpoints

b sys_execve

b do_execve

b Do_execve_common

b EXEC_BINPRM

b Search_binary_handler

b load_elf_binary

b start_thread

Experimental Analysis:

By looking at the source code, you can see that the EXEC command is implemented by calling the EXECLP function, which belongs to the exec* of the library function, which is the EXECVE package routine.

In Linux, fork is the only way for a process to create another process. Only the first process is the process called Init that needs to be created manually. All other processes are created with the fork, the system call. The fork system call simply replicates the data and stack of the parent process and shares the text area between the two processes. The fork system calls in a smarter way-write-time copy (copy-on-write) technology, so that the fork after the end does not immediately copy the contents of the parent process, but to the real practical when the copy, so that the efficiency greatly improved. After the fork function creates a child process, the child process calls the Exec family function to execute another program.
After a multi-process, multi-user, virtual storage operating system appears, the loading process of the executable file becomes very complex. The virtual address space of the process is introduced, and then based on how the operating system allocates code, data, heaps, stacks, and the process address space of the program, how they are distributed, and finally, the program maps the process virtual address space in a page-map manner.
Dynamic linking is a different concept from static linker, that is, a single executable module is split into several modules, a way to link when the program runs. Then, according to the practical example, Do_exece () analyzes the approximate process of elf loading, and realizes dynamic link in the middle.
Reference links

/linux/p6.htm

/morphad/article/details/

/titer1/article/details/

/titer1/article/details/

How the Linux kernel loads and launches an executable program