"Three layers of skin" in the fourth week of the "Linux kernel Analysis" system call

"Liu Weihan Original works reproduced please indicate the source" Linux kernel Analysis "MOOC course http://mooc.study.163.com/course/USTC-1000029000"

WEEK Four (3.14--3.20) clawed the system called "three-layer Skin" section 1 user-state, kernel-state, and interrupt-handling process 1. User-State, kernel-state differences

2. In a high-level state, code can execute privileged instructions and access arbitrary physical addresses;
4. Under the corresponding low-level execution state, the control of the code will be limited.
6. Why do you have this level of division?
   • It is easy to confuse the system without access permissions (after all, the functions written by ordinary programmers may have obvious omissions)
8. Intel x86 CPUs have four different levels of execution 0--3,linux just use 0 and three to represent the kernel state and the user state
   • How to differentiate? CPU each instruction is read by the CS:EIP two registers (code Snippet Selection Register: Offset register). Generally in Linux, the address above 0xc0000000 (refers to the logical address) space can only be accessed in the kernel state (that is, all 4G memory can be accessed)
   • How to contact? Interrupt handling is the primary way to enter the kernel state from the user state. System calls are a special kind of interrupt.

2. Interrupt Handling

1. The interrupt instruction stores the value of some registers on the register into the kernel stack, such as the user-state stack top address (SS:ESP), the flag register (EFLAGS), and the Cs:eip (popl pops up the saved return address in order to return). At the same time, the portal of the associated midrange service journey is loaded into the CS:EIP, and the current stack segment ESP is loaded into the CPU.
2. （）
3. The first thing that happens after an outage is to save the scene; again, the last thing before the end of the interrupt process is to restore the scene. That is, after SAVE all is the kernel state, and restore all returns to the user state.

Section 2 system invocation overview and system call three layer Skins 1. System Invocation Overview

1. （）
   • Explanation: System calls reduce the coupling between the system and the hardware, so the system portability is greatly improved
2. The relationship between the API and system calls provided by the operating system
   • （）
   • （）
   • Explanation: The API defined by the LIBC library allows programmers not to make system calls in assembly code, but directly in the form of function calls.

2. Three-layer skins for system calls

1. （）
2. System call three-layer skin: Xyz,systemcall,sysxyz. namely: API, interrupt vector, service program

3. Parameter passing method of system call (difficulty)

2. （）
4. （）
5. Additional explanations:
   • Why set the value of the EAX register to 2?
     • reference http://www.cnblogs.com/bastard/archive/2012/08/31/2664896.html
     • What if there are more than 6 parameters?

Section 3 uses the Library function API and the C code to embed assembly code to trigger system calls 1. Use the Library function API to get the current system time (this is a relatively simple system call)

Code:

time.c#include <stdio.h>#include <time.h>int main(){    time_t tt;//int型数值    struct tm *t;    tt = time(NULL);    t = localtime(&tt);//强制类型转换，便于输出    printf("time:%d:%d:%d:%d:%d:%d:\n",t->tm_year+1960,t->tm_mon,t->tm_mda,t->tm_hour,t->tm_min,t->tm_sec);    return 0;}

Compile:

GCC Time.c-o time-m32

Results:

The printout is the year of the system time: Month: Day: Hours: minutes: seconds

Review of embedded assembly code in 2.C code

1. （）
2. Assembly code is equivalent to a function

3. Assemble to trigger system call get system Current time

Code:

time_asm.c#include <stdio.h>#include <time.h>int main(){    time_t tt;//int型数值    struct tm *t;    asm volatile(        "mov $0,%%ebx\n\t"//系统调用传递第一个参数使用ebx，这里是null        "mov $0xd,%%eax\n\t"//传递系统调用号13（16进制即0xd）        "int $0x80\n\t"        "mov %%eax,%0\n\t"//通过eax这个寄存器返回系统调用值，和普通函数一样        :"=m"(tt)    );    t = localtime(&tt);    printf("time:%d:%d:%d:%d:%d:%d:\n",t->tm_year+1960,t->tm_mon,t->tm_mda,t->tm_hour,t->tm_min,t->tm_sec);    return 0;}

The compilation and structure are the same as the code above.

This code gives us a clearer idea of what the user state does to the kernel state.

Experiment

Writing an instance of a system call through the API in both C and embedded assembly methods

"Analysis: Although this experiment has a part of the autonomy, but the overall is not difficult, as long as the two pieces of code can understand the" essence "-the use of the API can be easily written"

Process:

2. According to the system call table, choose the number 27th system call alarm (before the function has some knowledge, mainly in and sleep with the use of aspects);
4. Check and review the function and usage of alarm () functions. Reference http://www.linuxidc.com/Linux/2012-07/66837.htm;
6. The alarm function is different from the time () function in the example, the former is parameter (the parameter represents the timer value), so the embedded assembly is a little more complicated than the C language code.
10. ()
11. compilation process & results:
12. ()
15. code (try):
16. ()
17. compiler error, in fact, I did not add "" cause, after the following:
18. ()
19. explanation: In the example given, I saw ebx. This register is used as the first parameter (of course, the time () function has no arguments and is passed in 0 or null), so I'm thinking that the step that looks like "superfluous" should be used to pass the function arguments. Here I pass the value of parameter 3 to EBX;
20. result:
21. ()

"Three layers of skin" in the fourth week of the Linux kernel analysis system call