Tag Info

Hot answers tagged

17

System calls per se are a concept. They represent actions that processes can ask the kernel to perform. Those system calls are implemented in the kernel of the UNIX-like system. This implementation (written in C, and in asm for small parts) actually performs the action in the system. Then, processes use an interface to ask the system for the execution of ...


15

/bin/ls usually sorts the output. I'm not sure if your "efficient" question is just over system calls or the entire work that is done, but /bin/ls -f would probably do the least work. It only returns the filenames in directory order. No sorting, no additional inode lookups to get metadata (as ls -l would do). Also, if your default ls is colorizing, it ...


13

ls -l is definitely more expensive, since it has to query the file system for metadata such as owner, group, permissions, access time, etc. Vanilla /bin/ls only has to look up the names of the entries in the directory being listed. Note that ls may be aliased on your system to something less vanilla than /bin/ls. Run type ls to see if that's the case.


7

No. Trivial counter example, this will interact with the kernel: int main() { volatile char *silly = 0; *silly = 'a'; } That'll call the kernel's page fault handler, ultimately resulting in your process getting a SIGSEGV (presuming the compiler doesn't "optimize" that code to do something other than the obvious, since that's undefined behavior by ...


6

The Linux kernel syscall API is the the primary API (though hidden under libc, and rarely used directly by programmers), and most standard IPC mechanisms are heavily biased toward the everything is a file approach, which eliminates them here as they ultimately require read/write (and more) calls. However, on most platforms (if you exclude all the system ...


6

Directories are special in the sense that within a directory you can have references to several files and directories, so, if you remove the parent directory, all those files lose their reference point from where they can be accessed, the same with process. For such cases, rmdir() have different checks, that are different from unlink(): If the directory is ...


5

As it so happens, there is another significant interface with the kernel: the /proc and /sys virtual filesystems. While they do not hold regular files, their contents are direct gateways to the kernel: to act on them is to act directly on kernel-allocated memory. For instance, if you want to drop all memory caches, you may use... echo 3 > ...


5

A system call is a way to ask your operating system (kernel) to do some operation on behalf of your program, that the program can't do by itself (or is just inconvenient). The reason for not being able to do some operation is normally that allowing a random program to do them might compromise the integrity of the system, like doing I/O (directly to RAM, ...


4

Ambition or a overly severe urge for purity can lead you to do in-line assembly. For example, on x86_64 systems, you can do an open(2) system call like this: #include <sys/syscall.h> int linux_open(const char *pathname, unsigned long flags, unsigned long mode) { long ret; asm volatile ("syscall" : "=a" (ret) : "a" (__NR_open), ...


4

Sure, let's do the how-many-directions-can-we-look-at-this-elephant-from? thing. The actual system call is, in your built program, the machine instruction that triggers the privilege escalation into kernel mode, and in the kernel itself it's the code that instruction invokes. The libc code (and every language runtime) sets up the machine registers and ...


4

I will try to answer questions as briefly as possible. The questions you are asking are usually addressed in introductory operating systems courses at universities but I will assume you have not taken such a course. Memory isolation for userspace processes is very desirable - not only to protect the kernel from malicious userspace programs, but also to ...


4

This is all perfectly normal. You aren't supposed to prevent the failing library lookups from happening. execve("./hello", ["./hello"], [/* 62 vars */]) = 0 This is your program starting. Since it is dynamically linked, the first code to execute is from the dynamic loader. brk(0) = 0x85a5000 mmap2(NULL, 4096, ...


3

In order to do system calls you normally have to execute some functions on the CPU that are not part of the C language specification. The system calls are either written in assembly for the CPU, and linked against, or some CPU specific inline assembly within a C function is used. Within the Linux kernel there are various macros defined to support this, ...


3

The file /proc/kallsyms lists all the symbols of the running kernel. By convention, system calls have a name that begin with sys_. On a 64-bit system, system calls for 32-bit programs have a name that begin with sys32_. Strictly speaking, this lists internal kernel functions, not system call, but I think that the correspondence does work (every system call ...


3

The raw system calls, like read(2), are defined in the C library (usually glibc under Linux). But what the definition in the library does is just to collect arguments, set them up for the special way in which they are passed to the kernel, and use a special mechanism to ask the kernel to do the job. It collects the results (including possible error ...


3

In Linux at least the system call mechanism works under most architectures by placing some specifically formatted data (usually some kind of c struct) in either some registers or predefined memory addresses. The issue comes however in actually forcing the CPU to do the switch into kernel space so it can run the privileged kernel code to service the call. ...


3

NOTE: ALL THE BELOW INFORMATION IS FROM THE REFERENCED SITE From this link, I found the below information. A system call is an interface between a user-space application and a service that the kernel provides. Because the service is provided in the kernel, a direct call cannot be performed; instead, you must use a process of crossing the ...


3

The read() function is implemented in a shared library (libc) which makes available wrapped functions into userspace. This exposes "access" to these functions which physically reside within the kernel. You can convince yourself of this by taking a look at this diagram and noting that there are 2 tools for tracing these types of calls (system vs. shared ...


2

The time in poll is not wasted - it is the time the process waits for input data to "arrive" or for output buffers to be ready for new output data. You can use lsof to list the open descriptors (including sockets). How many CPU cores do you have in the system? How many cores can ccsm use? Your top listing shows around 100% CPU usage for ccsm.exe ...


2

This question has been answered in this Super User question: What is the purpose of the magic numbers in Linux reboot? Basically, a bit flip in an address can cause a program to think it is calling one system call when, in fact, it's calling the reboot() system call. Because reboot() is a very destructive, non-syncing operation that erases the state of ...


2

Most of the time your language of choice will provide functions (of some sort) that eventually map to the relevant syscalls. In those cases, just use those and call it a day; no need to consider syscall interfaces at all. In fact, I'd argue that unless you're writing a standard library, there should be no need to consider the lower-level details in the first ...


2

TL;DR I kept finding new alternatives when writing this answer, so I just wrote a bit of details about each of them, and made some stats. Basically, you can either: Read Gilles' answer, which provides a clean and fast way to do it (relies on /proc). Use the documentation resources. Use your system's C header files. Use the kernel source code itself. Use ...


2

In order to read /proc/[pid]/mem, a process must now PTRACE_ATTACH to it. A commonly available utility that does this is gdb Pick a running process (in my case I just opened cat in another window), then attach gdb to that process: [root@qemu ~]# gdb --pid 423 #MORE OUTPUT 0xb771dbac in __kernel_vsyscall () As part of its output while loading symbols, gdb ...


2

In theory, if the application obeys certain constraints, yes. In general, no. The most common way to invoke system calls is via the standard-library wrappers for the same. So for example, read(fd,buf,BUFLEN) compiles to assembly call read, and in amd64 object code that would be e8 00 00 00 00 (where the zeroes are covered by a symbol-table entry for read). ...


2

It doesn't as much "get" CPU, as it just runs on it. The kernel decides on which core and when and for how long the process runs. It schedules the tasks so that each process gets its time slices on the CPU: it runs for a while, then either after the time slice expires, or a system call occurs, the context is switched to another process. The state of the ...


1

CPU A process can lower its CPU priority (but not decrease it, man 2 setpriority). Furthermore it can put itself to sleep for a certain time. But it cannot decide how the CPU time it saves is given to other processes. For the situation with threads see psusi's comment. memory A new process gets an initial amount of RAM (I don't know, though, whether this ...


1

It depends. What do you mean by 'verify'? If you just want to monitor what syscalls some process is triggering then it's possible.. usually.... But if you feel like digging deeper then you're in trouble... I have not heard of any tools that could do that. You can use strace to see what syscalls some particular process is firing. Of course you'll have to ...


1

As @Patrick stated in the comments, you can use the command line tool strace to produce a dump of the system calls that are made by a program as it runs. Example Here's an example showing the command echo hi being run. $ strace echo "hi" execve("/usr/bin/echo", ["echo", "hi"], [/* 94 vars */]) = 0 brk(0) = 0xf73000 ...


1

Changing process groups has no effect on the process hierarchy. The parent is still P0. It's important that the process hierarchy stays the same. When a shell implements job control, each job is put in its own process group. But the shell must still be the parent of the process group leader, so that the shell gets a SIGCHLD signal when it exits.


1

I looked at the Gnu core-utils source code, particularly at the df command. It recursively descends the hierarchy until the device IDs change. At the point where the IDs change is the mount point. I just tried to find the mount point of the filesystem that ~/home/me/a-dir/another-dir is in. I did: stat . #noting device IDs while id not changes and root ...



Only top voted, non community-wiki answers of a minimum length are eligible