1. Operating Systems for Computer Engineering 151
Practical Session 1, System Calls

2. A few administrative notes…
Course homepage:
Assignments:
Extending xv6 (a pedagogical OS)
Submission in pairs.
Frontal checking:
Assume the grader may ask anything.
Must register to exactly one checking session.

3. System Calls
A System Call is an interface between a user application and a service provided by the operating system (or kernel).
These can be roughly grouped into five major categories:
Process control (e.g. create/terminate process)
File Management (e.g. read, write)
Device Management (e.g. logically attach a device)
Information Maintenance (e.g. set time or date)
Communications (e.g. send messages)

4. System Calls - motivation
A process is not supposed to access the kernel. It can’t access the kernel memory or functions.
This is strictly enforced (‘protected mode’) for good reasons:
Can jeopardize other processes running.
Cause physical damage to devices.
Alter system behavior.
The system call mechanism provides a safe mechanism to request specific kernel operations.

5. System Calls - interface
Calls are usually made with C/C++ library functions:
User Application
C - Library
Kernel
System Call
getpid()
Load arguments, eax  _NR_getpid, kernel mode (int 80)
Call Sys_Call_table[eax]
sys_getpid()
return
syscall_exit
_NR_getpid – the number of the system call getpid
0x80 – interrupt on Intel’s CPUs
resume_userspace
return
User-Space
Kernel-Space
Remark: Invoking int 0x80 is common although newer techniques for “faster” control transfer are provided by both AMD’s and Intel’s architecture.

6. System Calls - interface
usys.S
#define SYSCALL(name) \
.globl name; \
name: \
movl $SYS_ ## name, %eax; \
int $T_SYSCALL; \
ret
SYSCALL(fork)
SYSCALL(exit)
SYSCALL(wait)
SYSCALL(pipe)
SYSCALL(read)
SYSCALL(write)
SYSCALL(close)
SYSCALL(kill)
SYSCALL(exec)
SYSCALL(open)
SYSCALL(mknod)
SYSCALL(unlink)
SYSCALL(fstat)
SYSCALL(link)
SYSCALL(mkdir)
SYSCALL(chdir)
SYSCALL(dup)
SYSCALL(getpid)
SYSCALL(sbrk)
SYSCALL(sleep)
SYSCALL(uptime)
System Calls - interface
syscall.h
#define SYS_fork 1
#define SYS_exit 2
#define SYS_wait 3
#define SYS_pipe 4
#define SYS_read 5
#define SYS_kill 6
#define SYS_exec 7
#define SYS_fstat 8
#define SYS_chdir 9
#define SYS_dup 10
#define SYS_getpid 11
#define SYS_sbrk 12
#define SYS_sleep 13
#define SYS_uptime 14
#define SYS_open 15
#define SYS_write 16
#define SYS_mknod 17
#define SYS_unlink 18
#define SYS_link 19
#define SYS_mkdir 20
#define SYS_close 21
Calls are usually made with C/C++ library functions:
User Application
C - Library
Kernel
System Call
getpid()
Load arguments, eax  _NR_getpid, kernel mode (int 80)
Call Sys_Call_table[eax]
sys_getpid()
return
syscall_exit
_NR_getpid – the number of the system call getpid
0x80 – interrupt on Intel’s CPUs
resume_userspace
return
User-Space
Kernel-Space
Remark: Invoking int 0x80 is common although newer techniques for “faster” control transfer are provided by both AMD’s and Intel’s architecture.

7. System Calls - interface
trapasm.S
# vectors.S sends all traps here.
.globl alltraps
alltraps:
# Build trap frame.
pushl %ds
pushl %es
pushl %fs
pushl %gs
pushal
# Set up data and per-cpu segments.
movw $(SEG_KDATA<<3), %ax
movw %ax, %ds
movw %ax, %es
movw $(SEG_KCPU<<3), %ax
movw %ax, %fs
movw %ax, %gs
# Call trap(tf), where tf=%esp
pushl %esp
call trap .
Calls are usually made with C/C++ library functions:
User Application
C - Library
Kernel
System Call
getpid()
Load arguments, eax  _NR_getpid, kernel mode (int 80)
Call Sys_Call_table[eax]
sys_getpid()
return
syscall_exit
_NR_getpid – the number of the system call getpid
0x80 – interrupt on Intel’s CPUs
resume_userspace
return
User-Space
Kernel-Space
Remark: Invoking int 0x80 is common although newer techniques for “faster” control transfer are provided by both AMD’s and Intel’s architecture.

8. System Calls - interface
syscall.c
static int (*syscalls[])(void) = {
[SYS_fork] sys_fork,
[SYS_exit] sys_exit, .
[SYS_close] sys_close, };
void
syscall(void) {
int num;
num = proc->tf->eax;
if(num >= 0 && num < SYS_open && syscalls[num]) {
proc->tf->eax = syscalls[num]();
} else if (num >= SYS_open && num < NELEM(syscalls) && syscalls[num]) {
} else {
cprintf("%d %s: unknown sys call %d\n",
proc->pid, proc->name, num);
proc->tf->eax = -1; }
trap.c .
void
trap(struct trapframe *tf) {
if(tf->trapno == T_SYSCALL){
if(proc->killed)
exit();
proc->tf = tf;
syscall();
return;
} .
Calls are usually made with C/C++ library functions:
User Application
C - Library
Kernel
System Call
getpid()
Load arguments, eax  _NR_getpid, kernel mode (int 80)
Call Sys_Call_table[eax]
sys_getpid()
return
syscall_exit
_NR_getpid – the number of the system call getpid
0x80 – interrupt on Intel’s CPUs
resume_userspace
return
User-Space
Kernel-Space
Remark: Invoking int 0x80 is common although newer techniques for “faster” control transfer are provided by both AMD’s and Intel’s architecture.

9. System Calls - interface
Calls are usually made with C/C++ library functions:
trapasm.S .
addl $4, %esp
# Return falls through to trapret...
.globl trapret
trapret:
popal
popl %gs
popl %fs
popl %es
popl %ds
addl $0x8, %esp # trapno and errcode
iret
User Application
C - Library
Kernel
System Call
getpid()
Load arguments, eax  _NR_getpid, kernel mode (int 80)
Call Sys_Call_table[eax]
sys_getpid()
return
syscall_exit
_NR_getpid – the number of the system call getpid
0x80 – interrupt on Intel’s CPUs
resume_userspace
return
User-Space
Kernel-Space
Remark: Invoking int 0x80 is common although newer techniques for “faster” control transfer are provided by both AMD’s and Intel’s architecture.

10. System Calls – tips
Kernel behavior can be enhanced by altering the system calls themselves: imagine we wish to write a message (or add a log entry) whenever a specific user is opening a file. We can re-write the system call open with our new open function and load it to the kernel (need administrative rights). Now all “open” requests are passed through our function.
We can examine which system calls are made by a program by invoking strace<arguments>.
Strace –c <cmd> will give a summary of all sys calls

11. Process control
Fork
pid_t fork(void);
Fork is used to create a new process. It creates a duplicate of the original process (including all file descriptors, registers, instruction pointer, etc’).
Once the call is finished, the process and its copy go their separate ways. Subsequent changes to one should not effect the other.
The fork call returns a different value to the original process (parent) and its copy (child): in the child process this value is zero, and in the parent process it is the PID of the child process.
When fork is invoked the parent’s information should be copied to its child – however, this can be wasteful if the child will not need this information (see exec()…). To avoid such situations, Copy On Write (COW) is used for the data section.
How do I find out the type of pid_t?
Simple:
Find out what’s needed: “man fork”
The man page specifies ‘unistd.h’,
Locate unistd by typing: “whereis unistd.h”
Open the file: /usr/include/unistd.h
pid_t is redefined with __pid_t
Check out all of its included headers
You will see that one of the included headers is ‘types.h’ --> sounds relevant ;)
Locate ‘types.h’ (/usr/include/bits/types.h) and see that pid_t is simply an int

12. Copy On Write (COW) How does Linux manage COW?
fork()
Parent Process DATA STRUCTURE (task_struct)
Child Process DATA STRUCTURE (task_struct)
write information RW RW RO
protection fault!
Copying is expensive. The child process will point to the parent’s pages
Well, no other choice but to allocate a new RW copy of each required page

13. Process control An example: Output: my process pid is 8864
int i = 3472;
printf("my process pid is %d\n",getpid());
fork_id=fork();
if (fork_id==0){
i= 6794;
printf(“child pid %d, i=%d\n",getpid(),i); }
else
printf(“parent pid %d, i=%d\n",getpid(),i);
return 0;
Output: my process pid is 8864
child pid 8865, i=6794
parent pid 8864, i=3472
Program flow:
PID = 8864
i = 3472
fork ()
PID = 8865
Answer – expects exec, will show next
fork_id=0 i = 6794
fork_id = 8865 i=3472
Is this the only possible output?
Running the above code on some systems will almost always return this value. Why?

14. Fork – example (1)
How many lines of “Hello” will be printed in the following example: int main(int argc, char **argv){ int i; for (i=0; i<10; i++){ fork(); printf(“Hello \n”); } return 0;

15. Fork – example (1)
How many lines of “Hello” will be printed in the following example: int main(int argc, char **argv){ int i; for (i=0; i<10; i++){ fork(); printf(“Hello \n”); } return 0;
Program flow: Total number of printf calls:
i=0
i=1
i=2

16. Fork – example (2)
How many lines of “Hello” will be printed in the following example: int main(int argc, char **argv){ int i; for (i=0; i<10; i++){ printf(“Hello \n”); fork(); } return 0;

17. Fork – example (2)
How many lines of “Hello” will be printed in the following example: int main(int argc, char **argv){ int i; for (i=0; i<10; i++){ printf(“Hello \n”); fork(); } return 0;
Program flow: Total number of printf calls:
i=0
i=1
i=2

18. Fork – example (3)
How many lines of “Hello” will be printed in the following example: int main(int argc, char **argv){ int i; for (i=0; i<10; i++) fork(); printf(“Hello \n”); return 0; }

19. Fork – example (3)
How many lines of “Hello” will be printed in the following example: int main(int argc, char **argv){ int i; for (i=0; i<10; i++) fork(); printf(“Hello \n”); return 0; }
Program flow: Total number of printf calls:
i=0
i=1
i=2

20. Process control - zombies
When a process ends, the memory and resources associated with it are deallocated.
However, the entry for that process is not removed from the process table.
This allows the parent to collect the child’s exit status.
When this data is not collected by the parent the child is called a “zombie”. Such a leak is usually not worrisome in itself, however, it is a good indicator for problems to come.

21. Process control - zombies
In some (rare) occasions, a zombie is actually desired – it may, for example, prevent the creation of another child process with the same pid.
Zombies are not the same as orphan processes (a process whose parent ended and is then adopted by init (process id 1)).
Zombies can be detected with ps –el (marked with ‘Z’).
Zombies can be collected with the wait system call.

22. Process control
Wait
pid_t wait(int *status);
pid_t waitpid(pid_t pid, int *status, int options);
The wait command is used for waiting on child processes whose state changed (the process terminated, for example).
The process calling wait will suspend execution until one of its children (or a specific one) terminates.
Waiting can be done for a specific process, a group of processes or on any arbitrary child with waitpid.
Once the status of a process is collected that process is removed from the process table by the collecting process.
Kernel and later also introduced waitid(…) which gives finer control.
If the child already changed state than the call is returned immediately

23. Process control
exec*
int execv(const char *path, char *const argv[]);
int execvp(const char *file, char *const argv[]);
exec….
The exec() family of function replaces current process image with a new process image (text, data, bss, stack, etc).
Since no new process is created, PID remains the same.
Exec functions do not return to the calling process unless an error occurred (in which case -1 is returned and errno is set with a special value).
The system call is execve(…)
With execv(), the first argument is a path to the executable. With execvp(), the first argument is a filename. It must be converted to a path before it can used. This involves looking for the filename in all of the directories in the PATH environment variable.
Bss – all uninitialized data such as static and global variables

24. errno
The <errno.h> header file includes the integer errno variable.
This variable is set by many functions (including sys calls) in the event of an error to indicate what went wrong.
errnos value is only relevant when the call returned an error (usually -1).
A successful call to a function may also change the errno value.
errno may be a macro.
errno is thread local meaning that setting it in one thread does not affect its value in any other thread.
Be wary of mistakes such as:
If (call()==-1){ printf(“failed…”); if (errno==…..) }
Code defensively! Use errno often!

25. Process control – simple shell
#define… … int main(int argc, char **argv){ while(true){ type_prompt(); read_command(command, params); pid=fork(); if (pid<0){ if (errno==EAGAIN) printf(“ERROR cannot allocate sufficient memory\n”); continue; } if (pid>0) wait(&status); else execvp(command,params);

26. File management
In POSIX operating systems files are accessed via a file descriptor (Microsoft Windows uses a slightly different object: file handle).
A file descriptor is an integer specifying the index of an entry in the file descriptor table held by each process.
A file descriptor table is held by each process, and contains details of all open files. The following is an example of such a table:
File descriptors can refer to files, directories, sockets and a few more data objects. FD
Name
Other information
Standard Input (stdin) … 1
Standard Output (stdout) 2
Standard Error (stderr)

27. File management Open Close
int open(const char *pathname, int flags, mode_t mode);
Open returns a file descriptor for a given pathname.
This file descriptor will be used in subsequent system calls (according to the flags and mode)
Flags define the access mode: O_RDONLY (read only), O_WRONLY (write only), O_RDRW (read write). These can be bit-wised or’ed with more creation and status flags such as O_APPEND, O_TRUNC, O_CREAT.
Close
Int close(int fd);
Closes a file descriptor so it no longer refers to a file.
Returns 0 on success or -1 in case of failure (errno is set).
Mode - the permissions in case a new file is created using the O_CREAT flag.

28. File management Read Write
ssize_t read(int fd, void *buf, size_t count);
Attempts to read up to count bytes from the file descriptor fd, into the buffer buf.
Returns the number of bytes actually read (can be less than requested if read was interrupted by a signal, close to EOF, reading from pipe or terminal).
On error -1 is returned (and errno is set).
Note: The file position advances according to the number of bytes read.
Write
ssize_t write(int fd, const void *buf, size_t count);
Writes up to count bytes to the file referenced to by fd, from the buffer positioned at buf.
Returns the number of bytes actually wrote, or -1 (and errno) on error.

29. File management
lseek
off_t lseek(int fd, off_t offset, int whence);
This function repositions the offset of the file position of the file associated with fd to the argument offset according to the directive whence.
Whence can be set to SEEK_SET (directly to offset), SEEK_CUR (current+offset), SEEK_END (end+offset).
Positioning the offset beyond file end is allowed. This does not change the size of the file.
Writing to a file beyond its end results in a “hole” filled with ‘\0’ characters (null bytes).
Returns the location as measured in bytes from the beginning of the file, or -1 in case of error (and set errno).

30. File management
Dup
int dup(int oldfd);
int dup2(int oldfd, int newfd);
The dup commands create a copy of the file descriptor oldfd.
After a successful dup command is executed the old and new file descriptors may be used interchangeably.
They refer to the same open file descriptions and thus share information such as offset and status. That means that using lseek on one will also affect the other!
They do not share descriptor flags (FD_CLOEXEC).
Dup uses the lowest numbered unused file descriptor, and dup2 uses newfd (closing current newfd if necessary).
Returns the new file descriptor, or -1 in case of an error (and set errno).
A dup3() command exists in kernel 3.0
Examples for dup:

31. File management Consider the following example:
fileFD= open(“file.txt”…);
close(1); /* closes file handle 1, which is stdout.*/
fd =dup(fileFD); /* will create another file handle. File handle 1 is free, so it will be allocated. */
close(fileFD); /* don’t need this descriptor anymore.*/
printf(“this did not go to stdout”);
As a result (abstract):
stdin … 1
stdout 2
stderr 3
file.txt
stdin … 1
file.txt 2
stderr

32. File management - example
#define… … #define RW_BLOCK 10 int main(int argc, char **argv){ int fdsrc, fddst; ssize_t readBytes, wroteBytes; char *buf[RW_BLOCK]; char *source = argv[1]; char *dest = argv[2]; fdsrc=open(source,O_RDONLY); if (fdsrc<0){ perror("ERROR while trying to open source file:"); exit(-1); } fddst=open(dest,O_RDWR|O_CREAT|O_TRUNC, 0666); if (fddst<0){ perror("ERROR while trying to open destination file:"); exit(-2);
perror() produces a message on the standard error output describing the last error encountered during a call to a system call. Use with care: the message is not cleared when non erroneous calls are made.
exit() system call.
Bitwise OR: open for both reading and writing, if the file does not exist create it and always start at 0.

33. File management - example
lseek(fddst,20,SEEK_SET);
do{
readBytes=read(fdsrc, buf, RW_BLOCK);
if (readBytes<0){
if (errno == EIO){
printf("I/O errors detected, aborting.\n");
exit(-10); }
exit (-11);
wroteBytes=write(fddst, buf, readBytes);
if (wroteBytes<RW_BLOCK)
if (errno == EDQUOT)
printf("ERROR: out of quota.\n");
else if (errno == ENOSPC)
printf("ERROR: not enough disk space.\n");
} while (readBytes>0);
lseek(fddst,0,SEEK_SET);
write(fddst,"\\*WRITE START*\\\n",16);
close(fddst);
close(fdsrc);
return 0;
Change the offset to 20.
Using errno directly.
Start writing at offset 20. If the file is opened with hexedit, the first 20 bytes will be 00.
Adding an extra comment at the beginning of the file.

34. Xv6 code

35. the shell
int
main(void) {
static char buf[100];
int fd;
// Assumes three file descriptors open.
while((fd = open("console", O_RDWR)) >= 0){
if(fd >= 3){
close(fd);
break; }
// Read and run input commands.
while(getcmd(buf, sizeof(buf)) >= 0){
if(buf[0] == 'c' && buf[1] == 'd' && buf[2] == ' '){
// Clumsy but will have to do for now.
// Chdir has no effect on the parent if run in the child.
buf[strlen(buf)-1] = 0; // chop \n
if(chdir(buf+3) < 0)
printf(2, "cannot cd %s\n", buf+3);
continue;
if(fork1() == 0)
runcmd(parsecmd(buf));
wait();
exit();
The xv6 shell uses the above calls to run programs on behalf of users. The main structure of the shell is simple; see main on line (7801). The main loop reads the input on the command line using getcmd. Then it calls fork, which creates another running shell program. The parent shell calls wait, while the child process runs the command. For example, if the user had typed "echo hello" at the prompt, runcmd would have been called with "echo hello" as the argument. runcmd (7706) runs the actual command. For the simple example, it would call exec on line (7726), which loads and starts the program echo, changing the program counter to the first instruction of echo. If exec succeeds then the child will be running echo and the child will not execute the next line of runcmd. Instead, it will be running instructions of echo and at some point in the future, echo will call exit, which will cause the parent to return from wait in main (7801).

36. the scheduler
// Per-CPU process scheduler.
// Each CPU calls scheduler() after setting itself up.
// Scheduler never returns. It loops, doing:
// - choose a process to run
// - swtch to start running that process
// - eventually that process transfers control
// via swtch back to the scheduler.
void
scheduler(void) {
struct proc *p;
for(;;){
// Enable interrupts on this processor.
sti();
// Loop over process table looking for process to run.
acquire(&ptable.lock);
for(p = ptable.proc; p < &ptable.proc[NPROC]; p++){
if(p->state != RUNNABLE)
continue;
// Switch to chosen process. It is the process's job
// to release ptable.lock and then reacquire it
// before jumping back to us.
proc = p;
switchuvm(p);
p->state = RUNNING;
swtch(&cpu->scheduler, proc->context);
switchkvm();
// Process is done running for now.
// It should have changed its p->state before coming back.
proc = 0; }
release(&ptable.lock);
Scheduler (line 2108) looks for a process with p->state set to RUNNABLE, and there’s only one it can find: initproc. It sets the per-cpu variable proc to the process it found and calls switchuvm to tell the hardware to start using the target process’s page table (line 2636). Changing page tables while executing in the kernel works because setupkvm causes all processes’ page tables to have identical mappings for kernel code and data. switchuvm also creates a new task state segment SEG_TSS that instructs the hardware to handle an interrupt by returning to kernel mode with ss and esp set to SEG_KDATA<<3 and (uint)proc->kstack+KSTACKSIZE, the top of this process’s kernel stack.

37. The Kill SYSTEM CALL
/*** sysproc.c ***/
int
sys_kill(void) {
int pid;
if(argint(0, &pid) < 0)
return -1;
return kill(pid); }
/*** syscall.c ***/
static int (*syscalls[])(void) = {
[SYS_chdir] sys_chdir,
[SYS_close] sys_close,
[SYS_dup] sys_dup,
[SYS_exec] sys_exec,
[SYS_exit] sys_exit,
[SYS_fork] sys_fork,
[SYS_fstat] sys_fstat,
[SYS_getpid] sys_getpid,
[SYS_kill] sys_kill,
[SYS_link] sys_link,
[SYS_mkdir] sys_mkdir,
[SYS_mknod] sys_mknod,
[SYS_open] sys_open,
[SYS_pipe] sys_pipe,
[SYS_read] sys_read,
[SYS_sbrk] sys_sbrk,
[SYS_sleep] sys_sleep,
[SYS_unlink] sys_unlink,
[SYS_wait] sys_wait,
[SYS_write] sys_write,
[SYS_uptime] sys_uptime, };
/*** proc.c ***/
// Kill the process with the given pid.
// Process won't exit until it returns
// to user space (see trap in trap.c).
int
kill(int pid) {
struct proc *p;
acquire(&ptable.lock);
for(p = ptable.proc; p < &ptable.proc[NPROC]; p++){
if(p->pid == pid){
p->killed = 1;
// Wake process from sleep if necessary.
if(p->state == SLEEPING)
p->state = RUNNABLE;
release(&ptable.lock);
return 0; }
return -1;
The collection of system calls that a kernel provides is the interface that user programs see. The xv6 kernel provides a subset of the services and system calls that Unix kernels traditionally offer.