Execution mechanism of applications on Linux

Execution mechanism of applications on Linux

How the execution file is "executed" in the shell. In this article, as little as possible to use some source code, lest too

Chat, mainly to clarify the process, interested students can go to see the corresponding source code to learn more information.

1. Behavior of Parent process : copy, wait

There are many ways to execute an application, and executing from the shell is a common scenario. The interactive shell is an in-

Process (all processes are obtained from the INIT process with PID number 1, which involves Linux startup and initial

initialization, and idle processes, etc.) when the user is typing in the shell./test executes the program, the shell first

Fork () Out of a subprocess (which is also a child shell in many articles), and wait () This child process ends, so

When test execution is finished, it goes back to the shell and waits for user input (if you create a so-called background process, the shell

Will not wait for the child process to end and proceed directly down). So the main job of the shell process is to replicate a

A new process and wait for it to end.

2. Child process behavior : "Execute " application 2.1 execve ()

On the other hand, the EXECVE () load test is called in the child process and begins execution. This is the key to test being executed, under

We analyze it in detail.

Execve () is a very important system call that is provided by the operating system, and in many articles it is called the exec () department

System call (note is not the same as the shell Internal EXEC command), in fact, there is no exec () call in Linux,

exec is simply used to describe a set of functions that start with Exec, namely:

#include

int execl (const char *path, const char *arg, ...);

int EXECLP (const char *file, const char *arg, ...);

int execle (const char *path, const char *arg, ..., Char *const envp[]);

int execv (const char *path, char *const argv[]);

int EXECVP (const char *file, char *const argv[]);

int Execve (const char *path, char *const argv[], char *const envp[]);

These are all library functions packaged in the LIBC, and finally implemented by the system call EXECVE () (#define

__nr_evecve 11, System Call of Number 11).

The function of the EXEC function is to execute the executable file in the current process, which is to find the specified file name

Executes the file, substituting it for the contents of the current process, and the substitution is irreversible, that is, the replaced

The content is no longer saved, and the entire process is dead when the executable file finishes. Because the code snippet for the current process

, data segments and stacks have been replaced by new content, so the function of the EXEC function family will not be executed successfully.

Returns, the failure is returned-1. Executable files can be either binaries or executable feet this article

, the two are slightly different at load time, where binary files are mainly analyzed.

　　

2.2 Do_execve ()

Call Execve () in the user state, the corresponding function that executes in the kernel state after the system interrupt is triggered is

Do_sys_execve (), and Do_sys_execve () calls the Do_execve () function. Do_execve () will first read into an

Executes the file, if the executable file does not exist, will be an error. The permissions for the executable file are then checked.

If the file is not the current user is executable, then EXECVE () returns 1, permission denied error.

Otherwise continue to read into the information required to run the executable (see struct LINUX_BINPRM).

Execve ()->do_sys_execve ()->do_execve () (check if file exist and if can be runed by current user)

2.3 Search_binary_handler ()

Then the system calls Search_binary_handler (), depending on the type of executable file (e.g. shell,a.out,elf, etc.), check

Find the appropriate handler function (the system creates a struct linux_binfmt for each file type and strings it

On a linked list, when executed, traverse the list to find the appropriate type of structure. If you want to define a

Execute the file format, also need to implement such a handler). Then execute the corresponding load_binary () function to start

Loads the executable file.

Build a list of known files struct linux_binfmt, traverse execution

2.4 load_elf_binary ()

The handler that loads the elf type file is Load_elf_binary (), which is read first into the elf file's head, according to the elf file

The header information is read into various data (header information). Scan the program Segment Description table again to find the type

Pt_load the segment, Mapping it (Elf_map ()) to the fixed address of the memory. If no dynamic linker's stroke

The return entry address is set to the application portal. This function is done by start_thread

(), Start_thread () does not start a thread, but only modifies the registers of a PC such as the one stored in Pt_regs.

Value so that it points to the portal of the loaded application. This way, when the kernel operation is finished and the user state is returned,

The next thing to do is the application.

2.5 Load_elf_interp ()

If you use a dynamic-link library in your application, it is not as simple as the kernel, except to load the specified

and give control to the Dynamic Connector (program interpreter,ld.so in Linux) to handle the dynamic

The linked program. Kernel Search Section table, locate the corresponding dynamic connector in the segment labeled Pt_interp.

Name, and use Load_elf_interp () to load its image and set the returned entry address to Load_elf_interp

The return value of (), which is the dynamic linker entry. The dynamic linker then runs when Execve exits. Dynamic connection

The adapter checks the dependencies of the application on the shared connection library and loads it as needed, to the external

Reference for relocation. The dynamic connector then gives control to the application, defined from the elf file header

Program entry point to start execution. (for example, in TEST.c, the function foo () is used in the userlib.so, and at compile time this

The information is put into the test elf file, and the corresponding statement becomes call Fakefoo (). When the test is loaded

Wait, know that foo () is an external call, so turn to the dynamic linker, load userlib.so, parse the foo () function

Address, then let Fakefoo () redirect to Foo (), so call Foo () succeeds. )

Briefly, the whole type in the shell./test the process of executing an application is: The current shell process fork out a

Child process (child shell), the child process uses EXECVE to detach from the parent process, load the test file (elf format) to

In memory. If test uses a dynamic-link library, it needs to load the dynamic linker (or the program interpreter),

Further load the dynamic link library used by test to memory and reposition it for test invocation. Finally, from the test's entry

The port address begins execution test.

PS: Modern dynamic linker uses delay load and delay parsing technology for performance and other reasons to delay

Load is the dynamic connection library is loaded into the memory space (via the page exception mechanism) when needed, the deferred solution

When a function in a dynamic link library (to load) is called, the function's starting point is

Address, which is used by the caller. The implementation of dynamic linker is quite complex, for performance and other reasons, the

The direct operation of the stack is heavily used and interested can look for relevant code.

Popular article:

Linux, when you use the./xxx to run a program, the first is the shell to take over your input, and then fork

Derived subprocess, and finally the code of your program is handed to the kernel using the EXECV series

1. Check the properties of the file you are running, its properties are described in its I node, if your file is not

The executable property, the result will be rejected, if there are executable properties, but the permissions can be higher than you

Permissions for the user currently in use, refusing to execute

2. is the shell file checked? If yes, call the appropriate shell to parse your script file

3. is the elf file format?? is COFF file format? is a.out file format? If it is any of these

, and the current Linux kernel supports these three file formats, which are analyzed by the operating system kernel

Your file format, remove the file header information, load real code, data etc into the memory (the actual process and

This is not the case, just to describe the simple, so omit a lot of details, more detailed instructions, see

EXECV system calls in the kernel) ...

4. Wait for the system to schedule the process, when the kernel selects your program, your program will be shipped

Come on

The file extension under Linux is a fake, but a habit, in order to give users a better understanding of their

, such as configuration files, usually end in. conf, and "text files" are generally terminated with a. txt (mainly to

Windows users are accustomed to), elf files do not have extensions, so when you say the executable file

Do not say is EXE file, that is very not strict argument, only show that you are only a Windows programmer

Only

Execution mechanism of applications on Linux