A Unix Process

A process is defined as a program in execution. Processes help in carrying out the tasks in a system. A process includes a program counter (PC), CPU registers, and process stacks, which contains temporary data.

A process uses many resources like memory space, CPU, files, etc., during its lifetime and the Kernel should keep track of the processes and the usage of system resources.

Program Memory (Executable Image)

(Source)

Text

The code segment, also known as a text segment or simply as text, is where a portion of an object file or the corresponding section of the program's address space that contains executable instructions is stored and is generally read-only and fixed size.

When a program is executed by the OS, the text portion is read into memory from its disk file.

Data

The .data segment contains any global or local static variables which have a pre-defined value and can be modified. The values for these variables are initially stored within the read-only memory (typically within .text) and are copied into the .data segment during the start-up routine of the program.

BSS

The BSS segment, also known as uninitialized data, is usually adjacent to the data segment. The BSS segment contains all global variables and static variables that are initialized to zero or do not have explicit initialization in source code (Ex: static int i).

Heap

The heap area commonly begins at the end of the .bss and .data segments and grows to larger addresses from there. The heap area is shared by all threads, shared libraries, and dynamically loaded modules in a process.

Stack

The stack area contains the program stack, typically located in the higher parts of memory.

A stack pointer register tracks the top of the stack; it is adjusted each time a value is pushed onto the stack.

The set of values pushed for one function call is termed a stack frame. A stack frame consists of at least a return address.

Automatic variables (i.e., local variables) are also allocated on the stack.

The size command is used to list section sizes and the total size of binary files. The dec and hex columns are the size of the text, data, and BSS size added together in decimal & hexadecimal respectively.

The file command is used to determine file type.

The Linux Kernel is Re-entrant

(Source)

A re-entrant kernel enables processes to give away the CPU while in kernel mode. They do not hinder other processes from also entering kernel mode.

If the kernel is not re-entrant, a process can only be suspended while it is in user mode. Although it could be suspended in kernel mode, that would still block kernel mode execution on all other processes. The reason for this is that all kernel threads share the same memory. If execution would jump between them arbitrarily, corruption might occur.

The fork() & wait() system calls

(Source)

System call fork() is used to create new processes. It takes no arguments and returns a process ID. The creator process is known as the parent process and the new process is called the child process.

A call to the fork() function returns to us one of the three values -

• If fork() returns a negative value, the creation of a child process was unsuccessful.
• fork() returns a zero to the newly created child process.
• fork() returns a positive value, the process ID of the child process, to the parent.

If the call to fork() is executed successfully, Unix will do the following -

• Create two identical copies of address spaces, one for the parent and the other for the child.
• Both processes will start their execution at the next statement following the fork() call.

Since both processes have identical but separate address spaces, those variables initialized before the fork() call have the same values in both address spaces. Since every process has its own address space, any modifications will be independent of the others. In other words, if the parent changes the value of its variable, the modification will only affect the variable in the parent process's address space. Other address spaces created by fork() calls will not be affected even though they have identical variable names.

<aside> 🕵🏽‍♂️ Fun Read - Fork Bomb is a denial-of-service attack wherein a process continually replicates itself to deplete available system resources, slowing down or crashing the system due to resource starvation. (Source)

</aside>

(Source - man pages for wait & waitpid [man 2 wait])

The wait() and waitpid() system calls are used to wait for state changes in a child of the calling process, and obtain information about the child whose state has changed.

A state change is considered to be:

• The child terminated
• The child was stopped by a signal