Question

Friends, I am trying to trace the complete execution of an operating system including the processes running on top of it. For this I want the instructions executed by each process and its execution trace and I want to do this without having to go and take objdump of each process.

So my goals are :
1) Building address space of each pid.
2) Tracking execution of each pid.

For accomplishing above goals, I am running a linux-based operating system on top of an emulator Qemu.

When qemu encounters an instruction for the first time, i will check the pid of the process running this instruction using an io-port or a known physical memory address in the guest. I can then use this information to do the stuff that I want.

My problem is ….
where in the kernel/sched.c can i know the pid of the process that is going to be executed next. Means i am not able to figure a function call like -> launch_process(pid).Can somebody please point me to this location in the kernel. Or is there a known location in the system where we can track the address space. One is CR3 but i really cannot trust it.

For some guys this may seem to be a trivial pointer to this location but I am not able to find this location myself.

Answer 1

Each process has appropriate struct task_struct. You can use find_task_by_*() functions to find struct task_struct by PID or task_pid_*() to get PID of given task. See also “What is struct pid?” section in include/linux/pid.h.

Running tasks are in per-CPU runqueue: see struct rq definition in kernel/sched.c.

Functions try_to_wake_up(), wake_up_process(), wake_up_new_task(), context_switch() and others are also related to your task.