Profiling the process of Linux system calls

Suppose we write an application that has a read system call, let's see how to find the corresponding read from many file_operations structures.

We can use the disassembly arm-linux-objdump-d-s xxx >dump, output to the dump file, open the dump file, locate to the read assembly, there is the following sentence:

BL <_libc_read>

OK, then go to the _libc_read assembly and find the most important two-line Assembly statement:

mov r7, #3 //read system call number is 3 svc 0x00000000 //System call Entry Linux has a fixed system call entry ENTRY (VECTOR_SWI), {available in entry-common.s file} let's see what entry (VECTOR_SWI) has done:1) Get the system call number, that is, before MOV r7, #3  2) jump to sys_call_table table
ADR tbl, sys_call_table @ load syscall table pointer  Find the Sys_call_table table entryENTRY (sys_call_table)#include "calls. S "table defined in calls. S file Open calls. S,Call (Sys_read), and sys_read is defined by a macro in read-write.c:SYSCALL_DEFINE3 macro definition function, the read front plus sys becomes sys_readThe Open function of the application call creates a file structure, and the following function uses FD to find the corresponding file structurefile = Fget_light (fd, &fput_needed); Find the corresponding file structure--------------------------------------------------------------loff_t pos = file_pos_read (file); Read FoPs, file pointer position--------------------------------------------------------------
ret = vfs_read (file, buf, Count, &pos); Call Vfs_read   The most useful are:if (file->f_op->read)ret = file->f_op->read (file, buf, Count, POS); Find the FILE_OPERATIONS function structure inside the file structure read  after the call, the last file_pos_write (file, POS); Write back FoPs save     

Profiling the process of Linux system calls