Tag Info

Hot answers tagged

15

/bin/ls usually sorts the output. I'm not sure if your "efficient" question is just over system calls or the entire work that is done, but /bin/ls -f would probably do the least work. It only returns the filenames in directory order. No sorting, no additional inode lookups to get metadata (as ls -l would do). Also, if your default ls is colorizing, it ...


13

ls -l is definitely more expensive, since it has to query the file system for metadata such as owner, group, permissions, access time, etc. Vanilla /bin/ls only has to look up the names of the entries in the directory being listed. Note that ls may be aliased on your system to something less vanilla than /bin/ls. Run type ls to see if that's the case.


6

Directories are special in the sense that within a directory you can have references to several files and directories, so, if you remove the parent directory, all those files lose their reference point from where they can be accessed, the same with process. For such cases, rmdir() have different checks, that are different from unlink(): If the directory is ...


5

This is all perfectly normal. You aren't supposed to prevent the failing library lookups from happening. execve("./hello", ["./hello"], [/* 62 vars */]) = 0 This is your program starting. Since it is dynamically linked, the first code to execute is from the dynamic loader. brk(0) = 0x85a5000 mmap2(NULL, 4096, ...


5

The file /proc/kallsyms lists all the symbols of the running kernel. By convention, system calls have a name that begin with sys_. On a 64-bit system, system calls for 32-bit programs have a name that begin with sys32_. Strictly speaking, this lists internal kernel functions, not system call, but I think that the correspondence does work (every system call ...


5

As it so happens, there is another significant interface with the kernel: the /proc and /sys virtual filesystems. While they do not hold regular files, their contents are direct gateways to the kernel: to act on them is to act directly on kernel-allocated memory. For instance, if you want to drop all memory caches, you may use... echo 3 > ...


4

I will try to answer questions as briefly as possible. The questions you are asking are usually addressed in introductory operating systems courses at universities but I will assume you have not taken such a course. Memory isolation for userspace processes is very desirable - not only to protect the kernel from malicious userspace programs, but also to ...


4

Ambition or a overly severe urge for purity can lead you to do in-line assembly. For example, on x86_64 systems, you can do an open(2) system call like this: #include <sys/syscall.h> int linux_open(const char *pathname, unsigned long flags, unsigned long mode) { long ret; asm volatile ("syscall" : "=a" (ret) : "a" (__NR_open), ...


3

These numbers disambiguate manual pages that have the same name. They represent the manual section that the page should be retrieved from. As an excerpt from Wikipedia states: The manual is generally split into eight numbered sections, organized as follows [...]


3

In order to do system calls you normally have to execute some functions on the CPU that are not part of the C language specification. The system calls are either written in assembly for the CPU, and linked against, or some CPU specific inline assembly within a C function is used. Within the Linux kernel there are various macros defined to support this, ...


2

This question has been answered in this Super User question: What is the purpose of the magic numbers in Linux reboot? Basically, a bit flip in an address can cause a program to think it is calling one system call when, in fact, it's calling the reboot() system call. Because reboot() is a very destructive, non-syncing operation that erases the state of ...


2

Most of the time your language of choice will provide functions (of some sort) that eventually map to the relevant syscalls. In those cases, just use those and call it a day; no need to consider syscall interfaces at all. In fact, I'd argue that unless you're writing a standard library, there should be no need to consider the lower-level details in the first ...


2

TL;DR I kept finding new alternatives when writing this answer, so I just wrote a bit of details about each of them, and made some stats. Basically, you can either: Read Gilles' answer, which provides a clean and fast way to do it (relies on /proc). Use the documentation resources. Use your system's C header files. Use the kernel source code itself. Use ...


2

In theory, if the application obeys certain constraints, yes. In general, no. The most common way to invoke system calls is via the standard-library wrappers for the same. So for example, read(fd,buf,BUFLEN) compiles to assembly call read, and in amd64 object code that would be e8 00 00 00 00 (where the zeroes are covered by a symbol-table entry for read). ...


2

It doesn't as much "get" CPU, as it just runs on it. The kernel decides on which core and when and for how long the process runs. It schedules the tasks so that each process gets its time slices on the CPU: it runs for a while, then either after the time slice expires, or a system call occurs, the context is switched to another process. The state of the ...


2

Most of them used to be implemented at some point in Linux kernel history time, but some like at least vserver are still implemented in specific kernels. The majority of these calls is now essentially obsolete but their slot remains and contains a stub which role is not to break old code and allow a re-implementation in a specialized or new kernel should it ...


2

Does a system call function often but not always have a command or utility in shell? Sometimes. System calls that are useful to expose, are usually exposed. A shell that couldn't change directories would not be a very useful shell. Some of them, like chdir, are implemented as shell builtins, because they can only affect the process that called them. ...


2

In order to read /proc/[pid]/mem, a process must now PTRACE_ATTACH to it. A commonly available utility that does this is gdb Pick a running process (in my case I just opened cat in another window), then attach gdb to that process: [root@qemu ~]# gdb --pid 423 #MORE OUTPUT 0xb771dbac in __kernel_vsyscall () As part of its output while loading symbols, gdb ...


2

Read more carefully close(2) and Advanced Linux Programming Your formulation is wrong: close is a system call (listed in syscalls(2) for Linux) by which the application tells the kernel to release a resource (not the other way round). You could use strace(1) to understand the system calls executed by some command or process. See also pthreads(7), ...


1

There's a fantastic pair of articles on LWN that describe how syscalls work on Linux: "Anatomy of a system call", part 1 and part 2.


1

It's in kernel space. This article from Linux Device Drivers is a bit dated but still should generally apply: https://lwn.net/images/pdf/LDD3/ch18.pdf However, there is some effort recently towards replacing the kernel driver with a userspace console called "KMSCON" -- see that project's site for more: http://cgit.freedesktop.org/~dvdhrm/kmscon/tree/README


1

exec here could be a system call or a bash built-in or something else from this . And respective man pages related to system call or bash built-in refer to the exec's man page with numbers in the brackets. So if I want to refer to manpage of bash built-in, I would say exec(1) and if I want to refer to manpage of system call exec() i would say exec(2) The ...


1

The numbers are the sections in the manual. (1), for example, are commands.


1

CPU A process can lower its CPU priority (but not decrease it, man 2 setpriority). Furthermore it can put itself to sleep for a certain time. But it cannot decide how the CPU time it saves is given to other processes. For the situation with threads see psusi's comment. memory A new process gets an initial amount of RAM (I don't know, though, whether this ...


1

It depends. What do you mean by 'verify'? If you just want to monitor what syscalls some process is triggering then it's possible.. usually.... But if you feel like digging deeper then you're in trouble... I have not heard of any tools that could do that. You can use strace to see what syscalls some particular process is firing. Of course you'll have to ...


1

As @Patrick stated in the comments, you can use the command line tool strace to produce a dump of the system calls that are made by a program as it runs. Example Here's an example showing the command echo hi being run. $ strace echo "hi" execve("/usr/bin/echo", ["echo", "hi"], [/* 94 vars */]) = 0 brk(0) = 0xf73000 ...


1

There is good deep and detailed description about system call at kernel side in recent lwn article: http://lwn.net/Articles/604287/ .


1

Changing process groups has no effect on the process hierarchy. The parent is still P0. It's important that the process hierarchy stays the same. When a shell implements job control, each job is put in its own process group. But the shell must still be the parent of the process group leader, so that the shell gets a SIGCHLD signal when it exits.


1

Basically there are two modes of linux kernel viz. User mode, Kernel mode. Any linux kernel switches itself back and forth between these two modes. Generally, Library calls get executed in User mode and System calls get executed in Kernel mode. In operating system terms, Kernel mode is Atomic in nature and its in Supervisory mode. Almost all Library ...



Only top voted, non community-wiki answers of a minimum length are eligible