Linux Kernel knowledge point recording [memory management] [process scheduling] [Exception debugging] [lock] [kvm virtualization] [kernel startup], linuxkvm

Linux Kernel knowledge point recording [memory management] [process scheduling] [Exception debugging] [lock] [kvm virtualization] [kernel startup], linuxkvm

1. How do I understand memory management?

. Hardware principle and paging mechanism Principle

Kernel memory management is supported by MMU hardware. MMU implements virtual/virtual address VA => PA conversion and permission check. The ing between virtual addresses and physical addresses is a page table mechanism, each page table item maintains the physical address page and its access permissions. The page table mechanism and library borrowing are a principle. Why should we use multi-level page tables? Assuming that there is only one level, like an array, and each item is recorded using a [I], it is unrealistic to record all ing relationships I = 4 GB/4 kb = 1000*1000 items, the linear array query efficiency is low. The benefit of classification is that the linear query is converted to a binary query. The time required is log 2 ^ n, which greatly improves the efficiency. This is why the tree structure is used for memory management, an example of library borrowing: first, on the computer, find the book on the 4th floor-Lane 13-5-6-100, then we can get this address to the corresponding floor (level 1 page table), lane number (level 2 page table), disk (level 3 page table), layer (Level 4 page table ), finally, find the book numbered 100 (offset in the page ).

 

After mmu is enabled, only the mmu itself can see the physical address, and the CPU sends out the virtual address. mmu's page table register records the location where the page table itself is stored in the physical memory.

Each process has 4G address space, 0-3G is the user address space, and 3-4G is the shared kernel address space. Each process has its own independent page table. During process switching, the kernel will enter the page table address of the Process in MMU for process switching. in this way, the address space of each process is isolated.

How does MMU implement memory permission protection? For example, if a const constant is defined, the C compiler will link this const constant to rodata (read-only data segment) and mark it as readonly when loading the memory to create a page table. MMU provides runtime check, if someone tries to write it, it will be blocked by MMU and sent out segmentfault. implements the memory protection mechanism.

TLB stores the most frequently used page table data, which belongs to the MMU cache.

 

Physical memory partition areas: DMA zone, normal zone, highmem zone,

Virtual Address Space refers to the 0-4g virtual address space of each process, which belongs to the concept of virtual address, while low-end and high-end memory are physical memory.

The management of physical memory in the kernel is implemented by the buudy algorithm. buddy manages idle memory by the Npower of 2. The allocation granularity is 1 page, that is, 4 k, the slub algorithm is a secondary Management Based on the buddy algorithm, which is used to allocate smaller memory granularity.

 

. The features and relationships of the memory Dynamic Allocation and release, kmalloc, vmalloc, slub, and buddy system are described. What happens after the user space malloc is 1 MB memory?

The memory obtained from buddy is in the unit granularity of 1 page, while slub uses buddy to take a large block of memory for secondary management, so that it can be allocated and recycled at a smaller allocation granularity, kmallc gets the memory from slub. kmallc/kfree and buddy do not have the same relationship. If kfree is executed, it is not necessarily returned to buddy. When is it determined by the slub algorithm, the purpose of this operation is to cope with the impact on the performance of scenarios that frequently apply for memory release.

 

The memory applied for by kmalloc is a linear ing relationship. It is suitable for applications that release small pieces of memory frequently, with high efficiency. However, note that kmalloc can sleep, especially when the memory is tight.

The memory applied for by vmalloc is a non-linear ing relationship. It is managed using a red/black tree data structure. It is used to apply for scenarios where large blocks do not have continuous requirements for physical memory. It is preferentially obtained from the highmem area, use alloc_page to get memory from buddy.

Malloc is a library function of libc, not a system call. The libc library performs secondary management on the Applied memory, and eventually requests memory from the kernel through brk and mmap. malloc/free is not a one-to-one correspondence between system calls and the kernel. after free, the kernel is not necessarily returned. The specific time is determined by the libc algorithm. This is for performance consideration because frequent physical memory application and release affect the performance.

 

When malloc memory is 1 MB, physical memory is not actually obtained, but the allocated continuous VMA is mapped to a blank physical address and marked as readonly. Only when someone writes this VMA, the read-only permission is detected during the MMU address translation check and the page fault is triggered by MMU blocking. However, the kernel checks that the current address permission is R + W and that the page fault is caused by malloc, then allocate the physical memory page and modify the permissions. Now, the physical memory is actually available. This is also called the lazzy ability of memory allocation by the kernel. The purpose of this is that the kernel cannot control the application behavior and tries its best to prevent unnecessary waste of applications.

The kernel does not trust the application and only trust the kernel itself. Lazzy only applies to applications, and does not apply to the kernel. The kernel calls kmalloc or vmalloc to get the memory immediately.

 

. Virtual memory VMA (virtual memory areas) of a process)

There is a user space in the VMA area, which can be exclusive or shared. A process has multiple VMA instances in a 0-3G address space. The segments and data segments of each process are scattered, the heap is a VMA instance,

How to view vma:

/Proc/pid/maps,/proc/pid/smaps

 

The possibility of page fault:

A: dynamic memory allocation and copy at write time are secondary pages fault, because you do not need to load data on the hard disk, resulting in low overhead.

B: illegal IP addresses that cannot be read or written by processes are blocked by MMU. The kernel sends a segment fault signal, causing oops.

C: The process accesses the VMA region, but the permission is incorrect. For example, the code snippet permission is R + X. However, if you try to write the code, it will end up like the above.

D: when a process accesses the VMA region, the permission check is successful, but the data needs to be loaded from the hard disk to the memory. This is a very large sale. The so-called main page fault, such as when the code segment is first loaded into the memory, this is why the process is slower than the second time. (one of the reasons why memory-intensive Mobile Phones run more smoothly)

 

VSS-Virtual Set Size Virtual memory consumption

RSS-Resident Set Size actually uses physical memory (including memory occupied by shared libraries)

PSS-Proportional Set Size physical memory actually used (Proportional allocation of memory occupied by the Shared Library)

USS-Unique Set Size physical memory occupied by the process (heap memory, exclusive)

VSS> = RSS> = PSS> = USS

You can use the smem tool to view the VSS, RSS. PSS, and USS values of the process. The USS value is the heap memory usage. This is the only option for Memory leakage.

Install: $ sudo apt-get install smem

Memory leakage determination, check USS, multi-time point sampling, fluctuation and divergence memory consumption is there leakage.

 

. Memory and IO Switching

There are two types:

A. a page with a file background (such as file-backed), such as reading and writing files, program code segments belong to this type, and there are real files on the hard disk;

B. pages without a file background, commonly known as anonymous pages, such as stack memory and heap memory. This type of memory interaction achieves anonymous page exchange through swap partitions on the hard disk.

 

When a file is loaded into the page cache of the memory for the first time, the page cache is equivalent to a copy of the file in the memory. The process operates the page cache to read and write the file.

$ Free

Total used free shared buffers cached

Mem: 16340236 14154128 2186108 482520 1835924

-/+ Buffers/cache: 8372116 7968120

Swap: 31875068 384264 31490804

Total physical memory size = total + shared + buffers + cached

Total = used + free

Buffers: directly reads data from the raw partition to the page cache in the memory;

Cached: reads the page cache from the file background to the memory;

The two are two things with different backgrounds.

 

Page switching uses the LRU algorithm, and the least recently used is switched out.

Kswapd process is used in the kernel as memory recycle. Two types of memory pages can be recycled.

Zram principle: divide a region from the memory for anonymous page exchange instead of swap partition in the hard disk, compress anonymous pages to be exchanged, zram can provide memory available space, but it will consume CPU performance, balance required.

 

2. Process Management

. Data Structure

A process is the unit of resource allocation and a thread is the unit of scheduling. This is a classic definition.

Each process in the kernel has a Data Structure of task_struct. Each task_struct contains mm resources, file resources, and signal resource pointers. Each task_struct has three relationships:

A: form a double-stranded table-facilitate fast traversal of all processes;

B: Build a tree to facilitate query by Parent and Child processes;

C: generate a hash to facilitate the process from the pid, for example, kill-9 $ pid;

This is a typical space-for-time algorithm that provides the shortest time query from different perspectives.

. Lifecycle

Six types: ready, run, stop, sleep, disk-sleep (deep sleep)

Sleep can be interrupted or awakened by signals, while deep sleep can only be awakened by resources. Here, resources are what you have to wait for, such as mutex lock and page fault of code segments.

Zombie process: a temporary state in which the child dead parent is not cleared in time. After the child process crashes, the parent process needs to call the wait4pid interface to disappear. The zombie process basically does not use system resources for the moment.

. Differences between processes and threads

The process and thread in the kernel are described by task_struct. The difference is whether memory resources, file resources, and signal resources are shared. Therefore, a thread is also called a lightweight process. for the scheduler, it can be scheduled as long as it is task_struct. in the kernel, processes and threads can be understood as synonyms.

. Process 0, process 1

After the boot, the first process is process 0, which is finally called the idle process. The idle process has the lowest priority. After the idle process obtains the cpu, it executes the WFI command to enter the low power consumption status, any interruption will wake up the scheduling to a new process, which is very conducive to the design of power management.

Process 1 is the init process. In user space, all processes are directly or indirectly fork.

 

. Process Scheduling

Throughput and response are a pair of conflicting behaviors, which need to be selected based on business needs.

The process scheduling types include kernel RT processes and common user processes. The process has IO consumption (Mouse) and CPU consumption (Compilation ).

A: The RT process scheduling policies can be classified into sched_fifo and sched rr types,

Sched_fifo: after a process with the same priority receives the cpu, the CPU must be handed over until the current process stops running;

Sched_rr: processes with the same priority rotate directly to obtain the CPU time slice.

0-99 indicates the priority of the RT process, and-indicates the priority of the normal user process. The higher the number, the higher the priority, the higher the priority process can seize the lower priority process.

B: The scheduling of common processes is a CFS-completely fair scheduling algorithm, which uses a red-black data structure. The basic principle is simple and always schedules processes with the smallest vrruntime, vrruntime = physical runtime/(nice weight coefficient), so the longer a common process runs, the lower its priority. The longer a process sleeps, the higher its priority, the higher its scheduling probability, the process with the highest priority is the IO-consuming process with a longer sleep and a higher nice value.

. SMP Load Balancing

A: RT process: n rt processes with the highest priority are evenly distributed to each core;

B: general process: the core idea is to "take pride in labor". For example, when a new fork comes out of a process, it will be pushed to the idle core for running during exec.

. Cgroup-resource control.

The core is hierarchical scheduling.

. RT-OS

Why is linux not a hardware real-time operating system?

Hard Real-time stresses that scheduling must be completed within a certain period of time, and the process is always running in four intervals:

A: Hard interrupt-External Interrupt

B: Soft Interrupt-system call

C: The context of an unschedulable process, such as the core's spinlock protection zone.

D: scheduling process context

Only 4th categories of intervals can be preemptible and scheduled in real time. The time of the first three categories cannot be determined, so it cannot meet the requirements of hard real-time OS.

 

Principles of RT-patch:

A: interrupt the thread. It can be grabbed by a thread.

B: Priority Inheritance Protocol-temporarily raise the priority level and is not affected by medium-priority processes

C: replace spinlock with mutex. mutex can sleep.

After the patch is installed, the hardware Real-Time OS needs to be basically met.

 

3. the kernel startup process starts from head. S to the init process creation.

A: Switch the CPU to svc mode to enable d-cache and I-cache to enable MMU;

B: Jump to the start_kernel function execution and initialize the settings of the specific architecture;

C: parse the command line parameters passed in by uboot to determine whether to enable early serial port printing;

D: Initialize various core data structures, such as memory management, exception handling, interrupt vectors, dts, and cgroup;

E: Create the init process No. 1 and kthread process No. 2 to start driver initialization.

F: Finally, the user space initialization, process 0 evolved into an idle process.

 

4. kernel crash and other exception analysis methods and policies

Shard type:

A: The exception in calling BUG () is manually reported. Generally, you can find the problem in oops information;

B: exceptions that overlap with actual causes. You can determine whether the exception type is undefined command exception, data abort, or other types based on oops's pc pointer position and related register information;

C: The type of the exception scene does not overlap with the actual cause. Capture ramdump and use the tool to analyze the register information offline to confirm the exception type and check whether the variable parameter of the exception thread is abnormal, check whether the memory is trampled. If the memory is trampled due to kmalloc, you can enable slub debug to capture the problem.

D: if there is a deadlock problem, you need to capture the calling stack of the process in the D state, troubleshoot the lock relationship one by one, and further analyze the cause. If necessary, you need to turn on the mutex debug switch to assist debugging.

 

5. Knowledge about KVM and qemu virtualization architectures and implementation principles

Kvm-kernel-based virtual machine (kernel-based virtual machine)

The virtualization platform provided by intel and AMD does not provide hardware virtualization operations. I/O operations are completed by QEMU.

 

Guest runs on the host machine as a common process.

The CPU (vCPU) of guest exists as the thread of the process and is scheduled by the kernel of the host machine.

Overall KVM architecture:

Kvm provides CPU, memory simulation, and qemu provides IO simulation.

Kvm provides a/dev/kvm character device. qemu interacts with the kernel kvm driver through ioctl to perform initialization, memory allocation, Instruction Set loading, and other operations.

Therefore, the hardware operations of guest are all taken over by qemu, which is responsible for real hardware interaction with the host.

 

KVM consists of two parts:

A: The KVM driver is already part of the kernel and is responsible for VM creation, memory allocation, virtual register read/write, and virtual cpu operation;

B: qemu simulates the user space components of virtual machines, and simulates the path for I/O operations to access peripherals.

 

QEMU is a complete software-only virtualization solution with low performance. KVM provides CPU and memory simulation + QEMU provides IO simulation to complement each other.

 

KVM running mode:

Customer mode: guest OS Operating mode, which includes user mode and Kernel Mode

User Mode: linux OS user mode. qemu runs in this mode.

Kernel Mode: linux kernel running mode. The kvm kernel driver module runs in this mode.

 

The ARM processor has a hypervisor layer and virtualization hardware support.

 

6. kernel lock

A. Type: semaphore lock (less used now)

B. mutex lock, which can be sleep and may cause context switching, which is less efficient than spinlock.

C. spinlock, which does not allow sleep, will be disconnected, use spin lock/unlock during interruption, and use spinlock irq save/restore in process context. -- If the currently protected function is not interrupted by the interrupt context, you do not need to use irqsave. Otherwise, you need to use spinlock irqsave, because the interrupt interrupts the spinlock and then enters the waiting status, causing dead lock.

D. rcu, read-copy-update, a protection mechanism supporting concurrency, very complicated.

E. atomic locks and atomic are rarely used.

Note:

If the protected Code does not allow sleep and pursues efficiency, it uses a spinlock and does not switch the context. For example, the mutex lock is unavailable when the context is interrupted.