Nutt 1

1. Observing Linux Behavior, also contains nice info about the kernel Nutt 1

2. Structure of the Linux Kernel • The Linux kernel is a collection of data structures (kernel variables) and functions • The collective kernel variables define the kernel’s perspective of the entire computer system • If you could inspect the kernel variables, then you could infer the state of the whole system • Each externally-invoked function (system call or IRQ) • provides a prescribed service • causes system state to be changed by having the kernel code change its kernel variables

3. The kernel state • Many variables make up the entire kernel state. There are variables representing… • Each process • Each open file • Memory • CPU

4. Implementation of kernel variables • They’re just ordinary C program variables • But are kept in kernel space • Mostly structs (extensible data structures), but some are of primitive types • Can be allocated on a stack (in kernel space), or in static memory so they won’t disappear when a stack frame is destroyed • Many are declared as global static variables

5. Where kernel variables are defined • Generally the extensible data structures (structs) are defined in C header files (include files) in the Linux source code tree • The Linux source code may be loaded in any subdirectory on a machine, though the conventional location is in /usr/src/linux • Most of the system’s include files are stored in the .../linux/include directory

6. Content of …/linux/include directory • The directory’s exact contents depend on the version of the source. • May include the directories asm-generic, asm-i386, linux, net, scsi, and video, and the symlink called asm pointing to asm-i386 • All machine-independent include files are in the linux subdirectory • Most machine-dependent include files are in asm-i386

7. A data structure used in the process descriptor • The include file include/linux/sched.h is very important • It contains a data structure used for the process descriptor, struct task-struct (like the PCB – process control block in Stallings’ book) • See line 287 on our system, as of Feb 2004 struct task_struct { volatile long state; /*-1 unrunnable, 0 runnable, >0 stopped */ … int pid; … uid_t uid, …; gid_t gid, ...; };

8. The source code file …/linux/kernel/sched.c • We’ve looked at sched.h, which contains important kernel variable definitions • Now let’s look at sched.c • It has a data structure (like an array or linked list) of all task_structs Array version: struct task_struct * task[NR_TASKS] = {&init_task….}; Linked List version, (I think) On CS01, Feb '04 struct task_struct * init_tasks[NR_CPUS] = {&init_task, };

9. sched.c (cont’d) • The task kernel array variable points to all process descriptors • If you could read the task kernel variable and wanted to know the state of the process 1234, then… • You find index I such that task[I]-> pid==1234. • Knowing I you can now read task[I]->state (process state) and task[I]->uid (user ID of process owner), etc.

10. Other interesting kernel variables declared in …/linux/kernel/sched.c(In timer.c on CS01!) • long tick, defines the amount of time between timer interrupts • struct timeval xtime, the current system time

11. Other files • …/linux/kernel/fork.c • int nr_tasks, not on CS01, but got nr_threads instead • int nr_running • …/linux/fs/buffer.c • Hash_table where file descriptors (called inodes, for info nodes) are kept • Each hash_table entry includes a struct inode *inode field defined in …/linux/include/fs.h • Other source files in …/linux/kernel directory

12. Definition of the inode struct inode { … uid_t i_uid; gid_t i_gid: … time_t i_atime; /* last accessed */ time_t i_mtime; /* last modified */ time_t i_ctime; /* last created */ };

13. Kernel var pointing to list of all file descriptors in the system • This variable is static struct file * inuse_filps • Declared in fs/file_table.c • The struct file itself is defined in include/fs.h, and looks like this: struct file { struct file *f_next, *f_prev; … mode_t f_mode; … struct dentry *f_dentry; struct file_operations *f_op; … };

14. The /proc directory • The /proc directory appears to be a normal directory, with files. • These “files” are actually pseudofiles. • “Reading” one of these pseudofiles actually runs a program that reads a kernel variable and reports it as an ASCII string! • Some of these routines read kernel vars only when file is “opened,” while others read them each time the “file” is “read.”

15. Subdirectories of /proc • /proc also has subdirectories • Subdirectories with numeric names contains pseudofiles to read info on processes whose process numbers are those numeric names! • Subdirectory self contains process-specific info on the process that’s reading /proc • Contents on /proc on each system is a little different • Thus, must experiment to find out!