Linux kernel Analysis--three layers of skin (top) that clawed the system call

Malmqvist + Original works reproduced please specify the source + "Linux kernel analysis" MOOC course http://mooc.study.163.com/course/USTC-1000029000

One, the user state, the kernel state and the interrupt processing process

1, the user through the library function and the system call to connect.

2, under the High execution level, the code can execute the privileged instruction, access any physical address, the CPU execution level corresponds to the kernel state. In the corresponding low-level execution state, the control of the code is limited. can only be active within the scope allowed by the corresponding level.

3, Intel x86 CPU has four different execution level 0-3. Linux only takes two kinds, 0 is kernel, and level 3 is User state.

4, how to distinguish between the user state and the kernel state?

The lowest two bits of the CS register indicate the privilege level of the current code

The CPU reads each instruction by CS:EIP the two registers: CS is the code segment selection Register, EIP is the offset register

The above judgment is done by hardware

Generally speaking, in Linux, the address space is a significant sign: The space above 0xc0000000 can only be accessed in the kernel state, and the 0X00000000-0XBFFFFFFF address space is accessible in both states (the address space described here is a logical address instead of a physical address).

5, interrupt processing is the main way to enter the kernel state from the user state.

6. Register context

When switching from the user state to the kernel state, the register context of the user state must be saved to the kernel stack, and some information about the current kernel state will be loaded, such as CS:EIP pointing to the interrupt handler entry.

Such as: User state stack top address, then the status word, then the value of the CS:EIP

7, the first thing after the interruption occurs is to save the scene-Save_all

The last thing before the end of interrupt processing is to restore the scene-Restore_all

II. Overview of System invocation

1. Meaning of the system call:

The operating system provides a set of interfaces-system calls-to interact with the hardware device for the user-state process.

(1) Freeing the user from the underlying hardware programming.

(2) Greatly improve the security of the system

(3) Portability of the user program

2. API (Application Programming Interface)

Differences from system calls:

(1) API is just a function definition

(2) The system call sends an explicit request to the kernel via a soft interrupt.

(3) API can directly provide user Configuration services; One API calls several system calls; different APIs invoke the same system call.

3. LIBC Library

(1) Some API definitions refer to the encapsulation routines (the only purpose is to publish system calls)

(2) In general, each system call corresponds to a package routine.

(3) The library then uses these encapsulation routines to define the API for the user;

4. Return value

(1) Most package routines return an integer whose value depends on the corresponding system call;

(2)-1 indicates that the kernel cannot satisfy the request of the process;

(3) The Errorno variable defined by LIBC contains a specific error code;

5, the system calls the three-layer skin

(1) 1API (XYZ)

(2) interrupt vector (System_call)

(3) Interrupt Service Program (SYS_XYZ)

(1) The interrupt vector 0x80 is bound to System_call in the service routine of the system call. (Linux can execute a system call by executing an int $128.) ）

(2) System_call is the entry point for all system calls in Linux, and each system call has at least one parameter, the system call number.

(3) The system call number Associates XYZ with SYS_XYZ. The call number is in the EAX register.

Parameter passing for system calls:

(1) Function call--pressure stack

(2) User state to kernel state--register pass.

The length of each parameter must not exceed 32 bits, the number cannot exceed 6.

Third, using the Library function API and C code embedded assembly code to trigger the same system call

1 , using the Library function API to get the current time of the system

Using time (), the code is as follows:

#include <stdio.h>

#include <time.h>

int main ()

{

time_t tt;

struct TM *t; Construct a structure for easy reading

tt = time (NULL); Time system call

t = localtime (&TT);

printf ("time:%d:%d:%d:%d:%d:%d\n", t->tm_year+1900, T->tm_mon, T->tm_mday, T->tm_hour, T->tm_min, t >TM_SEC);

return 0;

}

2 , using C code to embed assembly code to trigger system calls to get system current time

The code is as follows:

#include <stdio.h>

#include <time.h>

int main ()

{

time_t tt;

struct TM *t;

ASM volatile (

"mov $0,%%ebx\n\t"//ebx zero, equivalent to transfer parameters

"mov $0xd,%%eax\n\t"//Put 0xd into the eax, that is, the system call number 13, refers to time

"Int $0x80\n\t"

The "MOV%%eax,%0\n\t"//return value is in eax,%0 refers to TT, and the return value is placed in the TT.

: "=m" (TT)

);

t = localtime (&TT);

printf ("time:%d:%d:%d:%d:%d:%d\n", t->tm_year+1900, T->tm_mon, T->tm_mday, T->tm_hour, T->tm_min, t >TM_SEC);

return 0;

}

Iv. Summary

System call is a set of interfaces that the operating system provides to interact with hardware devices (such as CPUs, disks, printers, and so on) that are running in the user state. When a system call is required for a user process, the CPU switches to the kernel state through a soft interrupt to begin executing the kernel system call function. There are three ways to take a system call under Linux:

1. Library functions provided by glibc

GLIBC is the open source standard C library used under Linux, which is the GNU libc Library, the runtime library. GLIBC provides programmers with a rich API (application programming Interface) that, in addition to user-state services such as string processing, math, and most importantly, encapsulates the system services provided by the operating system, the encapsulation of system calls.

2. Direct call using Syscall

If GLIBC does not encapsulate a system call provided by a kernel, there is no way to invoke the system call through the method above. At this point we can call directly using the functions provided by glibc syscall .

3, through the INT command into

If we know the whole process of the system call, we should know that the user-state program through the soft interrupt instruction int 0x80 to fall into the kernel state (in the Intel Pentium II introduced the sysenter instructions), the parameter is passed through the register, EAX pass the system call number, EBX, ECX, edx, ESI, and EDI pass up to five parameters sequentially, and when the system call returns, the return value is stored in EAX.

Linux kernel Analysis--three layers of skin (top) that clawed the system call