What exactly happens in virtual memory when I call a function like printf in Linux? [on hold]

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
3
down vote

favorite
1












I'm asking about functions like printf that a lot of processes might use and also need the help of kernel for stuff like system calls.



What is the step-by-step description in detail for what happens? Because I'm a little confused in this area, I have these questions:



  1. Are the instructions for the printf function inside of the kernel part of our user process? And when it tries to execute printf, we do a JMP to that kernel location within the same user process, but we go into kernel mode? Or is there a context switch and a kernel process executes this?


  2. Do all of the processes that execute functions like printf map to the same physical memory location when they call printf in their virtual memory?


  3. Overall, what are the situations that non-kernel processes use the kernel part of the virtual memory?


Enter image description here






kernel memory virtual-memory







share|improve this question















put on hold as too broad by Goro, RalfFriedl, Isaac, Thomas, Shadur 16 hours ago


Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.














  • read the code of glibc you'll see. syscall instruction on x86_64, Intel's manual will tell you about it. Process don't get mapped into physical memory, don't know what you mean. Read Intel's manual.
    – ç¥žç§˜å¾·é‡Œå…‹
    yesterday






  • 2




    @神秘德里克 what do you mean processes don't get mapped into physical memory? when i said that i obviously meant pages of that virtual memory space belonging to that process get mapped into frames of physical memory.
    – John P
    yesterday










  • Process has tones of Pages, some may map to same physical address as other process(like the same file mmap), some may not, not so sure your question until I read the answer.
    – ç¥žç§˜å¾·é‡Œå…‹
    yesterday














up vote
3
down vote

favorite
1












I'm asking about functions like printf that a lot of processes might use and also need the help of kernel for stuff like system calls.



What is the step-by-step description in detail for what happens? Because I'm a little confused in this area, I have these questions:



  1. Are the instructions for the printf function inside of the kernel part of our user process? And when it tries to execute printf, we do a JMP to that kernel location within the same user process, but we go into kernel mode? Or is there a context switch and a kernel process executes this?


  2. Do all of the processes that execute functions like printf map to the same physical memory location when they call printf in their virtual memory?


  3. Overall, what are the situations that non-kernel processes use the kernel part of the virtual memory?


Enter image description here






kernel memory virtual-memory







share|improve this question















put on hold as too broad by Goro, RalfFriedl, Isaac, Thomas, Shadur 16 hours ago


Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.














  • read the code of glibc you'll see. syscall instruction on x86_64, Intel's manual will tell you about it. Process don't get mapped into physical memory, don't know what you mean. Read Intel's manual.
    – ç¥žç§˜å¾·é‡Œå…‹
    yesterday






  • 2




    @神秘德里克 what do you mean processes don't get mapped into physical memory? when i said that i obviously meant pages of that virtual memory space belonging to that process get mapped into frames of physical memory.
    – John P
    yesterday










  • Process has tones of Pages, some may map to same physical address as other process(like the same file mmap), some may not, not so sure your question until I read the answer.
    – ç¥žç§˜å¾·é‡Œå…‹
    yesterday












up vote
3
down vote

favorite
1









up vote
3
down vote

favorite
1






1





I'm asking about functions like printf that a lot of processes might use and also need the help of kernel for stuff like system calls.



What is the step-by-step description in detail for what happens? Because I'm a little confused in this area, I have these questions:



  1. Are the instructions for the printf function inside of the kernel part of our user process? And when it tries to execute printf, we do a JMP to that kernel location within the same user process, but we go into kernel mode? Or is there a context switch and a kernel process executes this?


  2. Do all of the processes that execute functions like printf map to the same physical memory location when they call printf in their virtual memory?


  3. Overall, what are the situations that non-kernel processes use the kernel part of the virtual memory?


Enter image description here






kernel memory virtual-memory







share|improve this question















I'm asking about functions like printf that a lot of processes might use and also need the help of kernel for stuff like system calls.



What is the step-by-step description in detail for what happens? Because I'm a little confused in this area, I have these questions:



  1. Are the instructions for the printf function inside of the kernel part of our user process? And when it tries to execute printf, we do a JMP to that kernel location within the same user process, but we go into kernel mode? Or is there a context switch and a kernel process executes this?


  2. Do all of the processes that execute functions like printf map to the same physical memory location when they call printf in their virtual memory?


  3. Overall, what are the situations that non-kernel processes use the kernel part of the virtual memory?


Enter image description here






kernel memory virtual-memory




kernel memory virtual-memory






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited yesterday









Peter Mortensen

82558




82558










asked yesterday









John P

1608




1608




put on hold as too broad by Goro, RalfFriedl, Isaac, Thomas, Shadur 16 hours ago


Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.






put on hold as too broad by Goro, RalfFriedl, Isaac, Thomas, Shadur 16 hours ago


Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.













  • read the code of glibc you'll see. syscall instruction on x86_64, Intel's manual will tell you about it. Process don't get mapped into physical memory, don't know what you mean. Read Intel's manual.
    – ç¥žç§˜å¾·é‡Œå…‹
    yesterday






  • 2




    @神秘德里克 what do you mean processes don't get mapped into physical memory? when i said that i obviously meant pages of that virtual memory space belonging to that process get mapped into frames of physical memory.
    – John P
    yesterday










  • Process has tones of Pages, some may map to same physical address as other process(like the same file mmap), some may not, not so sure your question until I read the answer.
    – ç¥žç§˜å¾·é‡Œå…‹
    yesterday
















  • read the code of glibc you'll see. syscall instruction on x86_64, Intel's manual will tell you about it. Process don't get mapped into physical memory, don't know what you mean. Read Intel's manual.
    – ç¥žç§˜å¾·é‡Œå…‹
    yesterday






  • 2




    @神秘德里克 what do you mean processes don't get mapped into physical memory? when i said that i obviously meant pages of that virtual memory space belonging to that process get mapped into frames of physical memory.
    – John P
    yesterday










  • Process has tones of Pages, some may map to same physical address as other process(like the same file mmap), some may not, not so sure your question until I read the answer.
    – ç¥žç§˜å¾·é‡Œå…‹
    yesterday















read the code of glibc you'll see. syscall instruction on x86_64, Intel's manual will tell you about it. Process don't get mapped into physical memory, don't know what you mean. Read Intel's manual.
– ç¥žç§˜å¾·é‡Œå…‹
yesterday




read the code of glibc you'll see. syscall instruction on x86_64, Intel's manual will tell you about it. Process don't get mapped into physical memory, don't know what you mean. Read Intel's manual.
– ç¥žç§˜å¾·é‡Œå…‹
yesterday




2




2




@神秘德里克 what do you mean processes don't get mapped into physical memory? when i said that i obviously meant pages of that virtual memory space belonging to that process get mapped into frames of physical memory.
– John P
yesterday




@神秘德里克 what do you mean processes don't get mapped into physical memory? when i said that i obviously meant pages of that virtual memory space belonging to that process get mapped into frames of physical memory.
– John P
yesterday












Process has tones of Pages, some may map to same physical address as other process(like the same file mmap), some may not, not so sure your question until I read the answer.
– ç¥žç§˜å¾·é‡Œå…‹
yesterday




Process has tones of Pages, some may map to same physical address as other process(like the same file mmap), some may not, not so sure your question until I read the answer.
– ç¥žç§˜å¾·é‡Œå…‹
yesterday










1 Answer
1






active

oldest

votes

















up vote
16
down vote



accepted










  1. printf is implemented by the C library, it’s not part of the kernel. (The kernel does have its own equivalent, more or less, but that’s not available to user processes.) So a user process calling printf doesn’t call into the kernel immediately. If printf’s output gets written¹, that happens by calling write, which is handled by the kernel (well, there’s a small wrapper in the C library, but it’s minimal); the process invokes the corresponding system call, and control switches to the kernel, but still within the context of the same process.


  2. Code pages from executables or libraries are only loaded once into memory (for the same version of the underlying file), so yes, printf maps to the same physical address, if it’s provided by the same library.


  3. The kernel part of virtual memory is only accessible from kernel code.


¹ Strictly speaking, printf writes its output to a buffer, which might not be written anywhere.






share|improve this answer






















  • Thanks for answer, So regarding question 1 : at which point we jump into kernel section of our process virtual space? when we call write or only when we do a system call?
    – John P
    yesterday










  • Generally, the process calls write, which is a wrapper in the C library; that sets everything up as appropriate, and invokes the system call. The switch to the kernel happens as a result of the system call (that’s why it’s a system call).
    – Stephen Kitt
    yesterday







  • 2




    printf may end-up calling write(). It adds some text to a stdio buffer which may eventually be written.
    – Stéphane Chazelas
    yesterday






  • 1




    @John I was referring to the part of memory reserved for the kernel.
    – Stephen Kitt
    22 hours ago






  • 1




    @John a system call doesn’t involve a normal process jumping into the kernel. A system call involves a normal process asking the CPU to switch to the kernel and run a call, identified by number, on its behalf. You don’t jump to an address in the kernel’s end of the address space (at least, not in Linux on x86); you invoke some other mechanism (on x86, INT 0x80, SYSENTER, or SYSCALL, depending on the specific ABI being used). See this article and its follow-up for details.
    – Stephen Kitt
    22 hours ago

















1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes








up vote
16
down vote



accepted










  1. printf is implemented by the C library, it’s not part of the kernel. (The kernel does have its own equivalent, more or less, but that’s not available to user processes.) So a user process calling printf doesn’t call into the kernel immediately. If printf’s output gets written¹, that happens by calling write, which is handled by the kernel (well, there’s a small wrapper in the C library, but it’s minimal); the process invokes the corresponding system call, and control switches to the kernel, but still within the context of the same process.


  2. Code pages from executables or libraries are only loaded once into memory (for the same version of the underlying file), so yes, printf maps to the same physical address, if it’s provided by the same library.


  3. The kernel part of virtual memory is only accessible from kernel code.


¹ Strictly speaking, printf writes its output to a buffer, which might not be written anywhere.






share|improve this answer






















  • Thanks for answer, So regarding question 1 : at which point we jump into kernel section of our process virtual space? when we call write or only when we do a system call?
    – John P
    yesterday










  • Generally, the process calls write, which is a wrapper in the C library; that sets everything up as appropriate, and invokes the system call. The switch to the kernel happens as a result of the system call (that’s why it’s a system call).
    – Stephen Kitt
    yesterday







  • 2




    printf may end-up calling write(). It adds some text to a stdio buffer which may eventually be written.
    – Stéphane Chazelas
    yesterday






  • 1




    @John I was referring to the part of memory reserved for the kernel.
    – Stephen Kitt
    22 hours ago






  • 1




    @John a system call doesn’t involve a normal process jumping into the kernel. A system call involves a normal process asking the CPU to switch to the kernel and run a call, identified by number, on its behalf. You don’t jump to an address in the kernel’s end of the address space (at least, not in Linux on x86); you invoke some other mechanism (on x86, INT 0x80, SYSENTER, or SYSCALL, depending on the specific ABI being used). See this article and its follow-up for details.
    – Stephen Kitt
    22 hours ago














up vote
16
down vote



accepted










  1. printf is implemented by the C library, it’s not part of the kernel. (The kernel does have its own equivalent, more or less, but that’s not available to user processes.) So a user process calling printf doesn’t call into the kernel immediately. If printf’s output gets written¹, that happens by calling write, which is handled by the kernel (well, there’s a small wrapper in the C library, but it’s minimal); the process invokes the corresponding system call, and control switches to the kernel, but still within the context of the same process.


  2. Code pages from executables or libraries are only loaded once into memory (for the same version of the underlying file), so yes, printf maps to the same physical address, if it’s provided by the same library.


  3. The kernel part of virtual memory is only accessible from kernel code.


¹ Strictly speaking, printf writes its output to a buffer, which might not be written anywhere.






share|improve this answer






















  • Thanks for answer, So regarding question 1 : at which point we jump into kernel section of our process virtual space? when we call write or only when we do a system call?
    – John P
    yesterday










  • Generally, the process calls write, which is a wrapper in the C library; that sets everything up as appropriate, and invokes the system call. The switch to the kernel happens as a result of the system call (that’s why it’s a system call).
    – Stephen Kitt
    yesterday







  • 2




    printf may end-up calling write(). It adds some text to a stdio buffer which may eventually be written.
    – Stéphane Chazelas
    yesterday






  • 1




    @John I was referring to the part of memory reserved for the kernel.
    – Stephen Kitt
    22 hours ago






  • 1




    @John a system call doesn’t involve a normal process jumping into the kernel. A system call involves a normal process asking the CPU to switch to the kernel and run a call, identified by number, on its behalf. You don’t jump to an address in the kernel’s end of the address space (at least, not in Linux on x86); you invoke some other mechanism (on x86, INT 0x80, SYSENTER, or SYSCALL, depending on the specific ABI being used). See this article and its follow-up for details.
    – Stephen Kitt
    22 hours ago












up vote
16
down vote



accepted







up vote
16
down vote



accepted






  1. printf is implemented by the C library, it’s not part of the kernel. (The kernel does have its own equivalent, more or less, but that’s not available to user processes.) So a user process calling printf doesn’t call into the kernel immediately. If printf’s output gets written¹, that happens by calling write, which is handled by the kernel (well, there’s a small wrapper in the C library, but it’s minimal); the process invokes the corresponding system call, and control switches to the kernel, but still within the context of the same process.


  2. Code pages from executables or libraries are only loaded once into memory (for the same version of the underlying file), so yes, printf maps to the same physical address, if it’s provided by the same library.


  3. The kernel part of virtual memory is only accessible from kernel code.


¹ Strictly speaking, printf writes its output to a buffer, which might not be written anywhere.






share|improve this answer














  1. printf is implemented by the C library, it’s not part of the kernel. (The kernel does have its own equivalent, more or less, but that’s not available to user processes.) So a user process calling printf doesn’t call into the kernel immediately. If printf’s output gets written¹, that happens by calling write, which is handled by the kernel (well, there’s a small wrapper in the C library, but it’s minimal); the process invokes the corresponding system call, and control switches to the kernel, but still within the context of the same process.


  2. Code pages from executables or libraries are only loaded once into memory (for the same version of the underlying file), so yes, printf maps to the same physical address, if it’s provided by the same library.


  3. The kernel part of virtual memory is only accessible from kernel code.


¹ Strictly speaking, printf writes its output to a buffer, which might not be written anywhere.







share|improve this answer














share|improve this answer



share|improve this answer








edited 22 hours ago

























answered yesterday









Stephen Kitt

149k23332399




149k23332399











  • Thanks for answer, So regarding question 1 : at which point we jump into kernel section of our process virtual space? when we call write or only when we do a system call?
    – John P
    yesterday










  • Generally, the process calls write, which is a wrapper in the C library; that sets everything up as appropriate, and invokes the system call. The switch to the kernel happens as a result of the system call (that’s why it’s a system call).
    – Stephen Kitt
    yesterday







  • 2




    printf may end-up calling write(). It adds some text to a stdio buffer which may eventually be written.
    – Stéphane Chazelas
    yesterday






  • 1




    @John I was referring to the part of memory reserved for the kernel.
    – Stephen Kitt
    22 hours ago






  • 1




    @John a system call doesn’t involve a normal process jumping into the kernel. A system call involves a normal process asking the CPU to switch to the kernel and run a call, identified by number, on its behalf. You don’t jump to an address in the kernel’s end of the address space (at least, not in Linux on x86); you invoke some other mechanism (on x86, INT 0x80, SYSENTER, or SYSCALL, depending on the specific ABI being used). See this article and its follow-up for details.
    – Stephen Kitt
    22 hours ago
















  • Thanks for answer, So regarding question 1 : at which point we jump into kernel section of our process virtual space? when we call write or only when we do a system call?
    – John P
    yesterday










  • Generally, the process calls write, which is a wrapper in the C library; that sets everything up as appropriate, and invokes the system call. The switch to the kernel happens as a result of the system call (that’s why it’s a system call).
    – Stephen Kitt
    yesterday







  • 2




    printf may end-up calling write(). It adds some text to a stdio buffer which may eventually be written.
    – Stéphane Chazelas
    yesterday






  • 1




    @John I was referring to the part of memory reserved for the kernel.
    – Stephen Kitt
    22 hours ago






  • 1




    @John a system call doesn’t involve a normal process jumping into the kernel. A system call involves a normal process asking the CPU to switch to the kernel and run a call, identified by number, on its behalf. You don’t jump to an address in the kernel’s end of the address space (at least, not in Linux on x86); you invoke some other mechanism (on x86, INT 0x80, SYSENTER, or SYSCALL, depending on the specific ABI being used). See this article and its follow-up for details.
    – Stephen Kitt
    22 hours ago















Thanks for answer, So regarding question 1 : at which point we jump into kernel section of our process virtual space? when we call write or only when we do a system call?
– John P
yesterday




Thanks for answer, So regarding question 1 : at which point we jump into kernel section of our process virtual space? when we call write or only when we do a system call?
– John P
yesterday












Generally, the process calls write, which is a wrapper in the C library; that sets everything up as appropriate, and invokes the system call. The switch to the kernel happens as a result of the system call (that’s why it’s a system call).
– Stephen Kitt
yesterday





Generally, the process calls write, which is a wrapper in the C library; that sets everything up as appropriate, and invokes the system call. The switch to the kernel happens as a result of the system call (that’s why it’s a system call).
– Stephen Kitt
yesterday





2




2




printf may end-up calling write(). It adds some text to a stdio buffer which may eventually be written.
– Stéphane Chazelas
yesterday




printf may end-up calling write(). It adds some text to a stdio buffer which may eventually be written.
– Stéphane Chazelas
yesterday




1




1




@John I was referring to the part of memory reserved for the kernel.
– Stephen Kitt
22 hours ago




@John I was referring to the part of memory reserved for the kernel.
– Stephen Kitt
22 hours ago




1




1




@John a system call doesn’t involve a normal process jumping into the kernel. A system call involves a normal process asking the CPU to switch to the kernel and run a call, identified by number, on its behalf. You don’t jump to an address in the kernel’s end of the address space (at least, not in Linux on x86); you invoke some other mechanism (on x86, INT 0x80, SYSENTER, or SYSCALL, depending on the specific ABI being used). See this article and its follow-up for details.
– Stephen Kitt
22 hours ago




@John a system call doesn’t involve a normal process jumping into the kernel. A system call involves a normal process asking the CPU to switch to the kernel and run a call, identified by number, on its behalf. You don’t jump to an address in the kernel’s end of the address space (at least, not in Linux on x86); you invoke some other mechanism (on x86, INT 0x80, SYSENTER, or SYSCALL, depending on the specific ABI being used). See this article and its follow-up for details.
– Stephen Kitt
22 hours ago


-

Popular posts from this blog

How to check contact read email or not when send email to Individual?

Image
Clash Royale CLAN TAG #URR8PPP up vote 1 down vote favorite I'm using WordPress 4.9.8, CiviCRM to 5.5.1, I usually send email to contact by Search> Find contacts View contact details Action> Send email Send email ok, Contact received mail ok like picture But status only Email sent though contact read email or not. So, can CiviCRM can change status to Email read when contact read email? wordpress email share | improve this question asked Sep 26 at 0:12 ToanLuong 49 9 add a comment  |  up vote 1 down vote favorite I'm using WordPress 4.9.8, CiviCRM to 5.5.1, I usually send email to contact by Search> Find contacts View contact details Action> Send email Send email ok, Contact received mail ok like picture But status only Email sent though contact read email or not. So, can CiviCRM can change status to Email read when contact read email? wordpress email share | improve this questi...
Read more

Displaying single band from multi-band raster using QGIS

Image
Clash Royale CLAN TAG #URR8PPP 1 How can I extract a single band from multi-band raster in QGIS? I have an remote sensed image which has 6 bands (including NDVI band), I want to display each band separately, but have no idea how to do. I have seen some questions similar here but none worked for me. The original image (has 6 bands) is: I want to display the band 6 which should be like this: But I tried gdal_translate, and couldn't get the correct result. What I have got is: qgis raster multi-band share | improve this question edited Mar 5 at 0:53 Summer asked Mar 4 at 6:42 Summer Summer 23 6 Is this any help gis.stackexchange.com/questions/220658/… ? if not gis.stackexchange.com/questions/62133/… might help. – Michael Stimson Mar 4 at 6:46 Thanks for answering but when I used gdal_translate, qgis showed that 'Error 4: Kayena.tif: No such file or directory". Would you know how to fi...
Read more

How many registers does an x86_64 CPU actually have?

Image
Clash Royale CLAN TAG #URR8PPP up vote 2 down vote favorite I am currently learning reverse engineering and am studying the flags register. I had in my mind that rflags was just another name for one of the 16 general purpose registers, for example rax or rbx . But it looks like rflags is actually an additional register. So that makes 17 registers in total... how many more could there be? I have spent at least an hour on this and found numerous different answers. The best answer so far is this, which says that there are 40 registers in total. 16 General Purpose Registers 2 Status Registers 6 Code Segment Registers 16 SSE Registers 8 FPU/MMX Registers But if I add that up, I get 48. Could anybody provide an official answer on how many registers an x86_64 CPU has (e.g. an Intel i7). Additionally, I have seen references to 'hardware' and 'architectural' registers. What are those registers and how many are there? register x86-64 share | improve this...
Read more