Linux Kernel Architecture

Chapter 2: Process Management and Scheduling

1. forkis the heavy-weight call because it creates a full copy of the parent process that then
   executes as a child process. To reduce the effort associated with this call, Linux uses thecopy-
   on-writetechnique, discussed below.


2. vforkis similar to fork but does not create a copy of the data of the parent process. Instead,
   it shares the data between the parent and child process. This saves a great deal of CPU time
   (and if one of the processes were to manipulate the shared data, the other would notice auto-
   matically).
   vforkis designed for the situation in which a child process just generated immediately exe-
   cutes anexecvesystem call to load a new program. The kernel also guarantees that the
   parent process is blocked until the childprocess exits or starts a new program.
   Quoting the manual pagevfork(2), it is ‘‘rather unfortunate that Linux revived this specter
   from the past.’’ Sinceforkuses copy-on-write, the speed argument forvforkdoes not really
   count anymore, and its use should therefore be avoided.


3. clonegenerates threads and enables a decision to be made as to exactly which elements are
   to be shared between the parent and the child process and which are to be copied.

Copy on Write

The kernel uses thecopy-on-writetechnique (COW) to preventalldata of the parent process from being

copied whenforkis executed. This technique exploits the fact that processes normally use only a fraction

of their pages in memory.^8 Whenforkis called, the kernel would usually create an identical copy of each

memory page of the parent process for the child process. This has two very negative effects:

1. A large amount of RAM, a scarce resource, is used.


2. The copy operation takes a long time.

The negative impact is even greater if the application loads a new program usingexecimmediately after

process duplication. This means, in effect, that the preceding copy operation was totally superfluous as

the process address space is reinitialized and the data copied are no longer needed.

The kernel can get around this problem by using a trick. Not the entire address space of the process but

only its page tables are copied. These establish the link between virtual address space and physical pages

as described briefly in Chapter 1 and at length in Chapters 3 and 4. The address spaces of parent and

child processes then point to the same physical pages.

Of course, parent and child processes must not be allowed to modify each other’s pages,^9 which is why

the page tables ofbothprocesses indicate that only read access is allowed to the pages — even though

they could be written to in normal circumstances.

Providing that both processes have only read access to their pages in memory, data sharing between the

two is not a problem because no changes can be made.

As soon as one of the processes attempts to write to thecopied pages, the processor reports an access error

to the kernel (errors of this kind are calledpage faults). The kernel then references additional memory

management data structures (see Chapter 4) to check whether the page can be accessed in Read and

Write mode or in Read mode only — if the latter is true, asegmentation faultmust be reported to the

(^8) The pages most frequently accessed by the process are called theworking set.
(^9) With the exception of pages explicitly shared by both processes.