The fourth week of Linux kernel and analysis

20135130 Wangkuandong

One, the user state, the kernel state and the interrupt processing process

Several different levels of execution of the CPU:

High execution level, the code can execute privileged instructions, access to any physical address, the level of execution corresponding to the kernel State;

In the low-level execution state, the code is limited in scope and can only be active within the scope allowed by the corresponding level.

Example: Intel x86 CPU has four different execution levels 0-3,linux only use the level 0 and Level 3 respectively to represent the kernel state and the user state.

Differentiate between user state and kernel state:

The lowest two bits of the CS register indicate the privilege level of the current code

The CPU reads each instruction by CS:EIP two registers: CS: Code selection Register, EIP: Offset register.

The address space above 0xc0000000 can only be accessed in the kernel State,

The 0X0000000-0XBFFFFFFF address space can be accessed in both states (note: The address space here is the logical address is not the physical address)

Interrupt handling is the primary way to enter the kernel state from the user state

system calls are just a special kind of interrupt

Register context

-When switching from the user state to the kernel State,

The user-State register context must be saved, and the corresponding value of the corresponding register of the kernel state

The Interrupt/int command saves some register values on the stack. Such as: The user state stack top address, the current status word, then the value of the CS:EIP.

Interrupt Occurrence and end:

The first thing to do after an outage is to save the field (the data of the register to be used to save the interrupt program)

The last thing before the end of interrupt processing is to resume the scene (exit the interrupt program to recover the data from the Save Register)

II. Overview of System invocation

Meaning: The operating system provides a set of interfaces for user-state processes to interact with hardware devices-system calls

API-: Application Programming Interface

Differences from system calls:

  API只是一个函数定义

 系统调用是通过软中断向内核发出一个明确的请求。

Not every API corresponds to a system call:

　　API可能直接提供用户态服务。如一个数学函数　　一个单独的API可能调用几个系统调用　　不同的API可能调用了同一个系统调用

return value: 大部分封装例程返回一个整数，含义依赖于相应的系统调用

 -1在大多数情况下表示内核不能满足进程的请求  Libc中errno变量包含特定出错码
传参：
内核实现很多不同的系统调用，需要传递一个名为系统调用号的参数，
使用eax寄存器传递
实验：
选用24号系统调用：getuid。
代码如下：
1、使用库函数API：

2，嵌入汇编代码：

The fourth week of Linux kernel and analysis