Linux Process Management Knowledge sorting (1)

1. What are the statuses of processes? What is the stoppedwait status of a process? After a process exits, why wait for the scheduler to delete its task_struct structure? What are the exit statuses of a process?

TASK_RUNNING running status)

TASK_INTERRUPTIBLE can interrupt the wait state)

TASK_UNINTERRUPTIBLE: The wait state cannot be interrupted)

The TASK_STOPPED process is set as paused by other processes)

The TASK_TRACED process is set to paused by the debugger)

TASK_DEAD exit status)

The process enters the waiting queue because the required resources are not met, but the status can be interrupted by signals. For example, if a running process is interrupted due to disk I/O operations, you can send SIGKILL to the process before the I/O operation is complete, in this way, the process ends the waiting state ahead of schedule and enters the runable State to respond to SIGKILL and execute the process exit code to end the process.

When a process exits, for example, calling exit or returning from the main function), it needs to send a signal to the parent process. When the parent process processes the signal, it needs to obtain the information of the child process, therefore, the task _ struct of the sub-process cannot be deleted. In addition, each process has a kernel-state stack. When the process calls exit (), it always needs to use the kernel-state stack before switching to another process. Therefore, when the process calls exit () after necessary processing, set the state to TASK_DEAD and switch to another process. After the process is successfully switched to another process, the process is not scheduled because the status of the process is set to TASK_DEAD. Then, when the scheduler checks the process in the status of TASK_DEAD, the task_struct structure of the process will be deleted, so that the process will completely disappear.

EXIT_ZOMBIE: Specifies the SIGCHLD signal sent by the parent process when the child process ends.By default, the creation process sets the flag to send signals to the parent process when the process exits, unless the creation of a Lightweight ProcessAt this time, the sub-process has exited and the SIGCHLD signal has been sent, but the parent process has not been scheduled to run; EXIT_DEAD is in the dead-end revocation status ): the exit signal of the parent process is "not interested", or when the child process exits, the parent process calls the SIGCHLD signal waiting for the child process through waitpid.

2. botnets

1) how to generate zombie Processes

When a process stops itself by calling the exit command, it is not actually destroyed, but the process cannot be scheduled and in the EXIT_ZOMBIE state, all the memory it occupies is the kernel stack, thread_info structure, and task_struct structure. At this time, the only purpose of a process is to provide information to its parent process. If its parent process does not call wait or waitpid and waits for the child process to end, the signal is not explicitly ignored, then it will remain in the EXIT_ZOMBIE state.

2) how to view zombie Processes

Using the command ps, we can see that the process marked as Z is a zombie process.

3) how to clean up zombie Processes

• The parent process can call the waitpid and wait functions to wait until the child process ends.
• The parent process is killed. After the death of the parent process, the zombie process becomes an orphan process. After the process passes through to the init process, the init process is always responsible for cleaning up the zombie process, and all the zombie processes generated by the process also disappear.

3. PID Management

In Linux, the pid struct is used to identify a process and manage all process numbers through the pidmap Bitmap (I .e., pid: not the same as the previous pid struct ), the goal is to quickly find the target process. The advantage of using a pid struct to represent a process: it is easier to manage than simply using a number pid_t (pid recovery and redistribution efficiency is high when the process exits), and it takes less space to identify a process using task_struct directly.

The pid structure is as follows:

 
 

  
  
Struct pid
  
  
{
  
  
Atomic_t count;
  
  
Int nr;/* store the pid value */
  
  
Struct hlist_node pid_chain;/* chain the pid to the hash table */
  
  
Struct hlist_head tasks [PIDTYPE_MAX];
  
  
Struct rcu_head rcu;
  
  
};
 
 

For 32-bit systems, the default maximum pid is 32768. Because every bit in the pidmap bitmap indicates whether the pid is available, a total of 32768 digits are required, the size of a physical page (4*1024*8 ).

The pidmap struct is as follows:

 
 

  
  
Struct pidmap {
  
  
/*
  
  
* This variable is used to count the number of physical memory locations on the page corresponding to this struct.
  
  
* The value is 0, that is, the number of idle PIDs.
  
  
*/
  
  
Atomic_t nr_free;
  
  
Void * page;/* This is the pointer to the Memory page storing the bitmap */
  
  
};
 
 

Next, let's take a look at the beginning of Linux kernel startup.In the start_kernel functionThe initialization function pidmap_init for pidmap bitmap is as follows:

 
 

  
  
Void _ init pidmap_init (void)
  
  
{
  
  
/* Apply for one page of physical memory and initialize it to 0 */
  
  
Init_pid_ns.pidmap [0]. page = kzarloc (PAGE_SIZE, GFP_KERNEL );
  
  
/* Set the 0th-bit value to 1, indicating that the current process uses a pid of 0, that is, the current process is a process of 0 */
  
  
Set_bit (0, init_pid_ns.pidmap [0]. page );
  
  
/* Update the idle pid value for nr_free statistics at the same time */
  
  
Atomic_dec (& init_pid_ns.pidmap [0]. nr_free );
  
  
Pid_cache= KMEM_CACHE (pid, SLAB_PANIC );
  
  
}
 
 

Let's look at the beginning of Linux kernel startup.In the start_kernel function, the pid hash table initialization function pidhash_init is as follows:

 
 

  
  
Void _ init pidhash_init (void)
  
  
{
  
  
Int I, pidhash_size;
  
  
/*
  
  
* Nr_kernel_pages indicates the total number of kernel memory pages, that is, within the system DMA and NORMAL
  
  
* Total number of actual physical memory pages in the page Area
  
  
* Megabytes: calculates the size of the kernel memory in MB.
  
  
*/
  
  
Unsigned long megabytes = nr_kernel_pages> (20-PAGE_SHIFT );
  
  
/* The following two lines of code show that pidhash_shift is in 4 ~ Between 12 */
  
  
Pidhash_shift = max (4, fls (megabytes * 4 ));
  
  
Pidhash_shift = min (12, pidhash_shift );
  
  
Pidhash_size = 1 <pidhash_shift;
  
  
Printk ("PID hash table entries: % d (order: % d, % Zd bytes) \ n ",
  
  
Pidhash_size, pidhash_shift,
  
  
Pidhash_size * sizeof (struct hlist_head ));
  
  
/*
  
  
* It can be seen from alloc_bootmem that pid_hash is applied for in the low-end physical memory, because
  
  
* The pidhash_init function is called before the mem_init function is executed. Therefore, we apply
  
  
* The memory will not be recycled.
  
  
*/
  
  
Pid_hash = alloc_bootmem (pidhash_size * sizeof (* (pid_hash )));
  
  
If (! Pid_hash)
  
  
Panic ("cocould not alloc pidhash! \ N ");
  
  
For (I = 0; I <pidhash_size; I ++)
  
  
/* Initialize the linked list of each table item in each table */
  
  
INIT_HLIST_HEAD (& pid_hash [I]);
  
  
}
 
 

Summary:The kernel maintains two data structures to maintain the process ID. One is the hash table pid_hash and the other is the bitmap pidmap. In do_fork (), every time alloc_pid () is called, alloc_pidmap () is called to modify the corresponding bitmap. The main idea of this function is to record the last allocated pid, the assigned pid is last + 1. If the pid exceeds the maximum value, the system cyclically returns to the initial value (RESERVED_PIDS) and tests whether the bit corresponding to the pid on pidmap is 0, until it is found. Then, use the hlist_add_head_rcu function to add an item to the pid_hash table.