Library functions and system calls

System Call is a function provided by the operating system kernel. It runs in kernel mode and belongs to the lower-level personnel in the function, with a lifetime code of 9527, but no one can do without them, because they can't deal with the kernel as they leave, and there is no way to deal with the kernel to get a stop...

Linux3.0.0-14 system calls there are 346, you can find all the system call numbers in the source code linux-3.0/ARCH/x86/kernel/syscall_table_32.s file, if you call these system functions by means of assembly, the value placed in the eax register is the number of the function to be called, and the first 20 are pasted below. Many seem familiar to me :)

ENTRY(sys_call_table).long sys_restart_syscall/* 0 - old "setup()" system call, used for restarting */.long sys_exit.long ptregs_fork.long sys_read.long sys_write.long sys_open/* 5 */.long sys_close.long sys_waitpid.long sys_creat.long sys_link.long sys_unlink/* 10 */.long ptregs_execve.long sys_chdir.long sys_time.long sys_mknod.long sys_chmod/* 15 */.long sys_lchown16.long sys_ni_syscall/* old break syscall holder */.long sys_stat.long sys_lseek.long sys_getpid/* 20 */

Library functions are packaged on the System Call layer and run in the user mode. For example, library functions are equivalent to the Contractor header, and system calls are workers, we can find workers to divide jobs by ourselves, but we generally share jobs with the contractor, and then assign jobs to the workers.

So although all the work in the end is done by system calling, we usually call library functions for the following reasons:

1. Library functions provide abstraction. abstraction is a good thing. It allows us to focus more on the core of the problem to be solved.
2. The interfaces provided by library functions are more user-friendly, so it is easier to call them.
3. Calling database functions is safer, so you don't have to worry too much about memory management.
4. The calling of database functions is more efficient and the program runs faster. Although library functions call system functions in the end, library functions call system functions in a better way than ours.

The previous blog is an example. For more information, see: Enter

Library functions can be packaged not only on the basis of system calls, but also on the basis of other library functions to provide more advanced abstraction and more powerful functions. For example, ogre's OpenGL and QT's xlib packaging are similar to the process from the boss to the secretary to the department supervisor to the contractor and then to the worker. Of course, we are the boss, as long as we are happy, not only call the Secretary (good and evil ...), You can directly call the supervisor, the contractor header, or even be a worker. You can write a system call, re-compile the kernel, and then call the system call you have written. For more information, see this article, and this article.

Finally, we will introduce the two tools, strace, ltrace, and strace, to check which system calls are called for our executable files, and ltrace to check which library functions are called by the executable files, those who like reverse engineering must like it. The usage is very simple, just follow the command with the executable file path.