1. 比如，如果希望了解在执行pwd命令时都调用了哪些系统调用，可以使用下面的命令：
$strace pwd
chenliang@test:~$ strace pwd
execve("/bin/pwd", ["pwd"], [/* 21 vars */]) = 0
brk(0) = 0x8733000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb77b6000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=97914, ...}) = 0
mmap2(NULL, 97914, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb779e000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/i386-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\340\233\1\0004\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1758972, ...}) = 0
mmap2(NULL, 1763964, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb75ef000
mmap2(0xb7798000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1a9000) = 0xb7798000
mmap2(0xb779b000, 10876, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb779b000
close(3) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb75ee000
set_thread_area({entry_number:-1 -> 6, base_addr:0xb75ee940, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
mprotect(0xb7798000, 8192, PROT_READ) = 0
mprotect(0x804e000, 4096, PROT_READ) = 0
mprotect(0xb77d9000, 4096, PROT_READ) = 0
munmap(0xb779e000, 97914) = 0
brk(0) = 0x8733000
brk(0x8754000) = 0x8754000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=8752496, ...}) = 0
mmap2(NULL, 2097152, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb73ee000
close(3) = 0
getcwd("/home/chenliang", 4096) = 16
fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 15), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb77b5000
write(1, "/home/chenliang\n", 16/home/chenliang
) = 16
close(1) = 0
munmap(0xb77b5000, 4096) = 0
close(2) = 0
exit_group(0) = ?2. 对于export出来的内核函数，可以使用ksyms命令或通过/proc/ksyms文件查看。
[root@szclou /]#cat /proc/kallsyms
c0008400 T asm_do_IRQ
c0008400 T _stext
c0008400 T __exception_text_start
c0008414 T do_undefinstr
c00085d4 T do_PrefetchAbort
c0008674 T do_DataAbort
c0008714 T __exception_text_end
c0008718 t __do_fixup_smp_on_up
c000872c T fixup_smp
c0008744 t __fixup_a_pv_table
c0008768 T fixup_pv_table
c000878c T do_one_initcall
c00088dc T name_to_dev_t
c0008c78 t match_dev_by_uuid
c0008cac T SetRoundingMode
c0008ce8 T SetRoundingPrecision
c0008cfc T EmulateAll
c0008d54 T nwfpe_init_fpa
c0008db4 T EmulateCPDO
c0008f54 T PerformLDF
c000908c T PerformLFM
c0009220 T PerformSFM
c000938c T PerformSTF
c000953c T EmulateCPDT
......
[root@szclou /]#cat /proc/kallsyms
c0008400 T asm_do_IRQ
c0008400 T _stext
c0008400 T __exception_text_start
c0008414 T do_undefinstr
c00085d4 T do_PrefetchAbort
c0008674 T do_DataAbort
c0008714 T __exception_text_end
c0008718 t __do_fixup_smp_on_up
c000872c T fixup_smp
c0008744 t __fixup_a_pv_table
c0008768 T fixup_pv_table
c000878c T do_one_initcall
c00088dc T name_to_dev_t
c0008c78 t match_dev_by_uuid
c0008cac T SetRoundingMode
c0008ce8 T SetRoundingPrecision
c0008cfc T EmulateAll
c0008d54 T nwfpe_init_fpa
c0008db4 T EmulateCPDO
c0008f54 T PerformLDF
c000908c T PerformLFM
c0009220 T PerformSFM
c000938c T PerformSTF
c000953c T EmulateCPDT
......3. 系统调用表sys_call_table存储了所有系统调用对应的服务例程的函数地址，在arch/i386/kernel/syscall_table.S文件中被定义
例如avr32
/*
* AVR32 system call table
*
* Copyright (C) 2004-2006 Atmel Corporation
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*/
.section .rodata,"a",@progbits
.type sys_call_table,@object
.global sys_call_table
.align 2
sys_call_table:
.long sys_restart_syscall
.long sys_exit
.long sys_fork
.long sys_read
.long sys_write
.long sys_open /* 5 */
.long sys_close
.long sys_umask
.long sys_creat
.long sys_link
.long sys_unlink /* 10 */
.long sys_execve
.long sys_chdir
.long sys_time
.long sys_mknod
.long sys_chmod /* 15 */
.long sys_chown
.long sys_lchown
.long sys_lseek
.long sys_llseek
.long sys_getpid /* 20 */
.long sys_mount
.long sys_umount
.long sys_setuid
.long sys_getuid
.long sys_stime /* 25 */
.long sys_ptrace
.long sys_alarm
.long sys_pause
.long sys_utime
.long sys_newstat /* 30 */
.long sys_newfstat
.long sys_newlstat
.long sys_access
.long sys_chroot
.long sys_sync /* 35 */
.long sys_fsync
.long sys_kill
.long sys_rename
.long sys_mkdir
.long sys_rmdir /* 40 */
.long sys_dup
.long sys_pipe
.long sys_times
.long sys_clone
.long sys_brk /* 45 */
.long sys_setgid
.long sys_getgid
.long sys_getcwd
.long sys_geteuid
.long sys_getegid /* 50 */
.long sys_acct
.long sys_setfsuid
.long sys_setfsgid
.long sys_ioctl
.long sys_fcntl /* 55 */
.long sys_setpgid
.long sys_mremap
.long sys_setresuid
.long sys_getresuid
.long sys_setreuid /* 60 */
.long sys_setregid
.long sys_ustat
.long sys_dup2
.long sys_getppid
.long sys_getpgrp /* 65 */
.long sys_setsid
.long sys_rt_sigaction
.long __sys_rt_sigreturn
.long sys_rt_sigprocmask
.long sys_rt_sigpending /* 70 */
.long sys_rt_sigtimedwait
.long sys_rt_sigqueueinfo
.long __sys_rt_sigsuspend
.long sys_sethostname
.long sys_setrlimit /* 75 */
.long sys_getrlimit
.long sys_getrusage
.long sys_gettimeofday
.long sys_settimeofday
.long sys_getgroups /* 80 */
.long sys_setgroups
.long sys_select
.long sys_symlink
.long sys_fchdir
.long sys_readlink /* 85 */
.long sys_pread64
.long sys_pwrite64
.long sys_swapon
.long sys_reboot
.long __sys_mmap2 /* 90 */
.long sys_munmap
.long sys_truncate
.long sys_ftruncate
.long sys_fchmod
.long sys_fchown /* 95 */
.long sys_getpriority
.long sys_setpriority
.long sys_wait4
.long sys_statfs
.long sys_fstatfs /* 100 */
.long sys_vhangup
.long sys_sigaltstack
.long sys_syslog
.long sys_setitimer
.long sys_getitimer /* 105 */
.long sys_swapoff
.long sys_sysinfo
.long sys_ni_syscall /* was sys_ipc briefly */
.long sys_sendfile
.long sys_setdomainname /* 110 */
.long sys_newuname
.long sys_adjtimex
.long sys_mprotect
.long sys_vfork
.long sys_init_module /* 115 */
.long sys_delete_module
.long sys_quotactl
.long sys_getpgid
.long sys_bdflush
.long sys_sysfs /* 120 */
.long sys_personality
.long sys_ni_syscall /* reserved for afs_syscall */
.long sys_getdents
.long sys_flock
.long sys_msync /* 125 */
.long sys_readv
.long sys_writev
.long sys_getsid
.long sys_fdatasync
.long sys_sysctl /* 130 */
.long sys_mlock
.long sys_munlock
.long sys_mlockall
.long sys_munlockall
.long sys_sched_setparam /* 135 */
.long sys_sched_getparam
.long sys_sched_setscheduler
.long sys_sched_getscheduler
.long sys_sched_yield
.long sys_sched_get_priority_max /* 140 */
.long sys_sched_get_priority_min
.long sys_sched_rr_get_interval
.long sys_nanosleep
.long sys_poll
.long sys_ni_syscall /* 145 was nfsservctl */
.long sys_setresgid
.long sys_getresgid
.long sys_prctl
.long sys_socket
.long sys_bind /* 150 */
.long sys_connect
.long sys_listen
.long sys_accept
.long sys_getsockname
.long sys_getpeername /* 155 */
.long sys_socketpair
.long sys_send
.long sys_recv
.long __sys_sendto
.long __sys_recvfrom /* 160 */
.long sys_shutdown
.long sys_setsockopt
.long sys_getsockopt
.long sys_sendmsg
.long sys_recvmsg /* 165 */
.long sys_truncate64
.long sys_ftruncate64
.long sys_stat64
.long sys_lstat64
.long sys_fstat64 /* 170 */
.long sys_pivot_root
.long sys_mincore
.long sys_madvise
.long sys_getdents64
.long sys_fcntl64 /* 175 */
.long sys_gettid
.long sys_readahead
.long sys_setxattr
.long sys_lsetxattr
.long sys_fsetxattr /* 180 */
.long sys_getxattr
.long sys_lgetxattr
.long sys_fgetxattr
.long sys_listxattr
.long sys_llistxattr /* 185 */
.long sys_flistxattr
.long sys_removexattr
.long sys_lremovexattr
.long sys_fremovexattr
.long sys_tkill /* 190 */
.long sys_sendfile64
.long sys_futex
.long sys_sched_setaffinity
.long sys_sched_getaffinity
.long sys_capget /* 195 */
.long sys_capset
.long sys_io_setup
.long sys_io_destroy
.long sys_io_getevents
.long sys_io_submit /* 200 */
.long sys_io_cancel
.long sys_fadvise64
.long sys_exit_group
.long sys_lookup_dcookie
.long sys_epoll_create /* 205 */
.long sys_epoll_ctl
.long sys_epoll_wait
.long sys_remap_file_pages
.long sys_set_tid_address
.long sys_timer_create /* 210 */
.long sys_timer_settime
.long sys_timer_gettime
.long sys_timer_getoverrun
.long sys_timer_delete
.long sys_clock_settime /* 215 */
.long sys_clock_gettime
.long sys_clock_getres
.long sys_clock_nanosleep
.long sys_statfs64
.long sys_fstatfs64 /* 220 */
.long sys_tgkill
.long sys_ni_syscall /* reserved for TUX */
.long sys_utimes
.long sys_fadvise64_64
.long sys_cacheflush /* 225 */
.long sys_ni_syscall /* sys_vserver */
.long sys_mq_open
.long sys_mq_unlink
.long sys_mq_timedsend
.long sys_mq_timedreceive /* 230 */
.long sys_mq_notify
.long sys_mq_getsetattr
.long sys_kexec_load
.long sys_waitid
.long sys_add_key /* 235 */
.long sys_request_key
.long sys_keyctl
.long sys_ioprio_set
.long sys_ioprio_get
.long sys_inotify_init /* 240 */
.long sys_inotify_add_watch
.long sys_inotify_rm_watch
.long sys_openat
.long sys_mkdirat
.long sys_mknodat /* 245 */
.long sys_fchownat
.long sys_futimesat
.long sys_fstatat64
.long sys_unlinkat
.long sys_renameat /* 250 */
.long sys_linkat
.long sys_symlinkat
.long sys_readlinkat
.long sys_fchmodat
.long sys_faccessat /* 255 */
.long __sys_pselect6
.long sys_ppoll
.long sys_unshare
.long sys_set_robust_list
.long sys_get_robust_list /* 260 */
.long __sys_splice
.long __sys_sync_file_range
.long sys_tee
.long sys_vmsplice
.long __sys_epoll_pwait /* 265 */
.long sys_msgget
.long sys_msgsnd
.long sys_msgrcv
.long sys_msgctl
.long sys_semget /* 270 */
.long sys_semop
.long sys_semctl
.long sys_semtimedop
.long sys_shmat
.long sys_shmget /* 275 */
.long sys_shmdt
.long sys_shmctl
.long sys_utimensat
.long sys_signalfd
.long sys_ni_syscall /* 280, was sys_timerfd */
.long sys_eventfd
.long sys_recvmmsg
.long sys_setns
.long sys_ni_syscall /* r8 is saturated at nr_syscalls */
......4. 内核提供的系统调用数目非常有限，到2.6.23版本的内核也不过才达到仅仅325个，使用“man 2 syscalls”命令即可以浏览到所有系统调用
chenliang@test:/proc$ ^C
chenliang@test:/proc$ man 2 syscalls
SYSCALLS(2) Linux Programmer's Manual SYSCALLS(2)
NAME
syscalls - Linux system calls
SYNOPSIS
Linux system calls.
DESCRIPTION
The system call is the fundamental interface between an application and the Linux kernel.
System calls and library wrapper functions
System calls are generally not invoked directly, but rather via wrapper functions in glibc (or perhaps some other library). For details of direct invocation of a
system call, see intro(2). Often, but not always, the name of the wrapper function is the same as the name of the system call that it invokes. For example, glibc
contains a function truncate() which invokes the underlying "truncate" system call.
Often the glibc wrapper function is quite thin, doing little work other than copying arguments to the right registers before invoking the system call, and then set‐
ting errno appropriately after the system call has returned. (These are the same steps that are performed by syscall(2), which can be used to invoke system calls
for which no wrapper function is provided.) Note: system calls indicate a failure by returning a negative error number to the caller; when this happens, the wrapper
function negates the returned error number (to make it positive), copies it to errno, and returns -1 to the caller of the wrapper.
Sometimes, however, the wrapper function does some extra work before invoking the system call. For example, nowadays there are (for reasons described below) two
related system calls, truncate(2) and truncate64(2), and the glibc truncate() wrapper function checks which of those system calls are provided by the kernel and
determines which should be employed.
System call list
Below is a list of the Linux system calls. In the list, the Kernel column indicates the kernel version for those system calls that were new in Linux 2.2, or have
appeared since that kernel version. Note the following points:
* Where no kernel version is indicated, the system call appeared in kernel 1.0 or earlier.
* Where a system call is marked "1.2" this means the system call probably appeared in a 1.1.x kernel version, and first appeared in a stable kernel with 1.2.
(Development of the 1.2 kernel was initiated from a branch of kernel 1.0.6 via the 1.1.x unstable kernel series.)
* Where a system call is marked "2.0" this means the system call probably appeared in a 1.3.x kernel version, and first appeared in a stable kernel with 2.0.
(Development of the 2.0 kernel was initiated from a branch of kernel 1.2.x, somewhere around 1.2.10, via the 1.3.x unstable kernel series.)
* Where a system call is marked "2.2" this means the system call probably appeared in a 2.1.x kernel version, and first appeared in a stable kernel with 2.2.0.
(Development of the 2.2 kernel was initiated from a branch of kernel 2.0.21 via the 2.1.x unstable kernel series.)
* Where a system call is marked "2.4" this means the system call probably appeared in a 2.3.x kernel version, and first appeared in a stable kernel with 2.4.0.
(Development of the 2.4 kernel was initiated from a branch of kernel 2.2.8 via the 2.3.x unstable kernel series.)
* Where a system call is marked "2.6" this means the system call probably appeared in a 2.5.x kernel version, and first appeared in a stable kernel with 2.6.0.
(Development of kernel 2.6 was initiated from a branch of kernel 2.4.15 via the 2.5.x unstable kernel series.)
* Starting with kernel 2.6.0, the development model changed, and new system calls may appear in each 2.6.x release. In this case, the exact version number where
the system call appeared is shown. This convention continues with the 3.x kernel series, which followed on from kernel 2.6.39.
* In some cases, a system call was added to a stable kernel series after it branched from the previous stable kernel series, and then backported into the earlier
stable kernel series. For example some system calls that appeared in 2.6.x were also backported into a 2.4.x release after 2.4.15. When this is so, the version
where the system call appeared in both of the major kernel series is listed.
The list of system calls that are available as at kernel 3.9 (or in a few cases only on older kernels) is as follows:
System call Kernel Notes
────────────────────────────────────────────────────────────────────────────
_llseek(2) 1.2
_newselect(2) 2.0
_sysctl(2) 2.0
accept(2) 2.0 See notes on socketcall(2)
accept4(2) 2.6.28
access(2) 1.0
acct(2) 1.0
add_key(2) 2.6.11
adjtimex(2) 1.0
alarm(2) 1.0
alloc_hugepages(2) 2.5.36 Removed in 2.5.44
bdflush(2) 1.2 Deprecated (does nothing)
since 2.6
bind(2) 2.0 See notes on socketcall(2)
brk(2) 1.0
cacheflush(2) 1.2 Not on x86
capget(2) 2.2
capset(2) 2.2
chdir(2) 1.0
chmod(2) 1.0
chown(2) 2.2 See chown(2) for
version details
chown32(2) 2.4
chroot(2) 1.0
clock_adjtime(2) 2.6.39
clock_getres(2) 2.6
clock_gettime(2) 2.6
clock_nanosleep(2) 2.6
clock_settime(2) 2.6
clone(2) 1.0
close(2) 1.0
connect(2) 2.0 See notes on socketcall(2)
creat(2) 1.0
create_module(2) Removed in 2.6
delete_module(2) 1.0
dup(2) 1.0
dup2(2) 1.0
dup3(2) 2.6.27
epoll_create(2) 2.6
epoll_create1(2) 2.6.27
epoll_ctl(2) 2.6
epoll_pwait(2) 2.6.19
epoll_wait(2) 2.6
eventfd(2) 2.6.22
eventfd2(2) 2.6.27
execve(2) 1.0
exit(2) 1.0
exit_group(2) 2.6
faccessat(2) 2.6.16
fadvise64(2) 2.6
fadvise64_64(2) 2.6
fallocate(2) 2.6.23
fanotify_init(2) 2.6.37
fanotify_mark(2) 2.6.37
fchdir(2) 1.0
fchmod(2) 1.0
fchmodat(2) 2.6.16
fchown(2) 1.0
fchown32(2) 2.4
fchownat(2) 2.6.16
fcntl(2) 1.0
fcntl64(2) 2.4
fdatasync(2) 2.0
fgetxattr(2) 2.6; 2.4.18
finit_module(2) 3.8
flistxattr(2) 2.6; 2.4.18
flock(2) 2.0
fork(2) 1.0
free_hugepages(2) 2.5.36 Removed in 2.5.44
fremovexattr(2) 2.6; 2.4.18
fsetxattr(2) 2.6; 2.4.18
fstat(2) 1.0
fstat64(2) 2.4
fstatat64(2) 2.6.16
...5. 既然系统调用表集中存放了所有系统调用服务例程的地址，那么系统调用在内核中的执行就可以转化为从该表获取对应的服务例程并执行的过程。这个过程中一个很重要的环节就是系统调用号。每个系统调用都拥有一个独一无二的系统调用号，用户应用通过它，而不是系统调用的名称，来指明要执行哪个系统调用。
系统调用号的定义在include/asm-i386/unistd.h文件。
008 #define __NR_restart_syscall 0
007 #define __NR_exit 1
009 #define __NR_fork 2
010 #define __NR_read 3
6. 系统调用最终由系统调用服务例程完成明确的操作。所有的系统调用服务例程集中声明在include/linux/syscalls.h文件，但分散定义在很多不同的文件。比如getpid系统调用用于获取当前进程的PID，它的服务例程sys_getpid在kernel/timer.c文件中定义为：
954 asmlinkage long sys_getpid(void)
955 {
956 return current->tgid;
957 }
除了都具有“sys_”前缀
7. 如图5.2所示，用户应用可以通过两种方式使用系统调用。第一种方式是通过C库函数，包括系统调用在C库中的封装函数和其他普通函数。
[插图]
图5.2 使用系统调用的两种方式
第二种方式是使用_syscall宏。2.6.18版本之前的内核，在include/asm-i386/unistd.h文件中定义有7个_syscall宏，分别是：
_syscall0(type,name)
_syscall1(type,name,type1,arg1)
_syscall2(type,name,type1,arg1,type2,arg2)
_syscall3(type,name,type1,arg1,type2,arg2,type3,arg3)
_syscall4(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4)
_syscall5(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,type5,arg5)
_syscall6(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,type5,arg5,type6,ar
g6)
其中，type表示所生成系统调用的返回值类型，name表示该系统调用的名称，typeN、argN分别表示第N个参数的类型和名称，它们的数目和_syscall后面的数字一样大。这些宏的作用是创建名为name的函数，_syscall后面跟的数字指明了该函数的参数的个数。
比如sysinfo系统调用用于获取系统总体统计信息，使用_syscall宏定义为：
_syscall1(int, sysinfo, struct sysinfo *, info);
展开后的形式为：
int sysinfo(struct sysinfo * info)
{
long __res;
__asm__ volatile("int $0x80" : "=a" (__res) : "0" (116),"b" ((long)(info)));
do {
if ((unsigned long)(__res) >= (unsigned long)(-(128 + 1))) {
errno = -(__res);
__res = -1;
}
return (int) (__res);
8. 但是自2.6.19版本开始，_syscall宏被废除，我们需要使用syscall函数，通过指定系统调用号和一组参数来调用系统调用。
syscall函数原型为：
int syscall(int number, ...);
其中number是系统调用号，number后面应顺序接上该系统调用的所有参数。下面是gettid系统调用的调用实例。
代码清单5.2 gettid系统调用使用实例
00 #include <unistd.h>
01 #include <sys/syscall.h>
02 #include <sys/types.h>
03
04 #define __NR_gettid 224
05
06 int main(int argc, char *argv[])
07 {
08 pid_t tid;
09
10 tid = syscall(__NR_gettid);
11 }
大部分系统调用都包括了一个SYS_符号常量来指定自己到系统调用号的映射，因此上面第10行可重写为：
tid = syscall(SYS_gettid);
9. 当我们在shell终端下输入“echo hello”命令时，将会要求shell进程执行一个可执行文件echo，参数为“hello”。当shell进程接收到命令之后，先在/bin目录下找到echo文件（我们可以使用which命令获得命令所在的位置），然后创建一个子进程去执行/bin/echo，并将参数传递给它，而这个子进程从shell进程继承了3个标准输入/输出文件，即stdin、stdout和stderr，文件号分别为0、1、2。它的工作很简单，就是将参数“hello”写到stdout文件中，通常都是我们的屏幕上。
但是如果我们将命令改成“echo hello > txt”，则在执行时输出将会被重定向到磁盘文件txt中。假定之前该shell进程只有上述3个标准文件打开，则该命令将按如下序列执行。
（1）打开或创建文件txt，如果txt中原来有内容，则清除原来的内容，其文件号为3。
（2）通过dup系统调用复制文件stdout的相关数据结构到文件号4。
（3）关闭stdout，但是由于4号文件也同时引用stdout，所以stdout文件并未真正关闭，只是腾出1号文件号位置。
（4）通过dup系统调用，复制3号文件（即文件txt），由于1号文件关闭，其位置空缺，故3号文件被复制到1号，即进程中原来指向stdout的指针指向了txt。
（5）通过系统调用fork和exec创建子进程并执行echo，子进程在执行cat前关闭3号和4号文件，只留下0、1、2三个文件，请注意，这时的1号文件已经不是stdout而是文件txt了。当cat想向stdout文件写入“hello”时自然就写入到了txt中。
（6）回到shell进程后，关闭指向txt的1号与3号文件文件，再用dup和close系统调用将2号恢复至stdout，这样shell就恢复了0、1、2三个标准输入/输出文件
10. sys_reboot
Linux下有关关机与重启的命令主要有shutdown、reboot、halt、poweroff、telinit和init。它们都可以达到关机或重启的目的，但是每个命令的工作流程并不一样。
这些命令并不都是互相独立的，比如，poweroff、reboot即是halt的符号链接，但是它们最终都是通过reboot系统调用来完成关机或重启操作。
reboot系统调用的服务例程为
11. 如何实现一个新的系统调用
为Linux添加新的系统调用是件相对容易的事情，主要包括有4个步骤：编写系统调用服务例程；添加系统调用号；修改系统调用表；重新编译内核并测试新添加的系统调用。
下面以一个并无实际用处的hello系统调用为例，来演示上述几个步骤。
（1）编写系统调用服务例程。
遵循前面所述的几个原则，hello系统调用的服务例程实现为：
01 asmlinkage long sys_hello(void)
02 {
03 printk(“Hello!\n”);
04 return 0;
05 }
通常，应该为新的系统调用服务例程创建一个新的文件进行存放，但也可以将其定义在其他文件之中并加上注释做必要说明。同时，还要在include/linux/syscalls.h文件中添加原型声明：
asmlinkage long sys_hello(void);
sys_hello函数非常简单，仅仅打印一条语句，并没有使用任何参数。如果我们希望hello系统调用不仅能打印“hello!”欢迎信息，还能够打印出我们传递过去的名称，或者其他的一些描述信息，则sys_hello函数可以实现为：
01 asmlinkage long sys_hello(const char __user *_name)
02 {
03 char *name;
04 long ret;
05
06 name = strndup_user(_name, PAGE_SIZE);
07 if (IS_ERR(name)) {
08 ret = PTR_ERR(name);
09 goto error;
10 }
11
12 printk(“Hello, %s!\n”, name);
13 return 0;
14 error:
15 return ret;
16 }
第二个sys_hello函数使用了一个参数，在这种有参数传递发生的情况下，编写系统调用服务例程时必须仔细检查所有的参数是否合法有效。因为系统调用在内核空间执行，如果不加限制任由用户应用传递输入进入内核，则系统的安全与稳定将受到影响。
参数检查中最重要的一项就是检查用户应用提供的用户空间指针是否有效。比如上述sys_hello函数参数为char类型指针，并且使用了__user标记进行修饰。__user标记表示所修饰的指针为用户空间指针，不能在内核空间直接引用，原因主要如下。
● 用户空间指针在内核空间可能是无效的。
● 用户空间的内存是分页的，可能引起页错误。
● 如果直接引用能够成功，就相当于用户空间可以直接访问内核空间，产生安全问题。
因此，为了能够完成必须的检查，以及在用户空间和内核空间之间安全地传送数据，就需要使用内核提供的函数。比如在sys_hello函数的第6行，就使用了内核提供的strndup_user函数（在mm/util.c文件中定义）从用户空间复制字符串name的内容。
（2）添加系统调用号。
每个系统调用都会拥有一个独一无二的系统调用号，所以接下来需要更新include/asm-i386/unistd.h文件，为hello系统调用添加一个系统调用号。
328 #define __NR_utimensat 320
329 #define __NR_signalfd 321
330 #define __NR_timerfd 322
331 #define __NR_eventfd 323
332 #define __NR_fallocate 324
333 #define __NR_hello 325 / *分配hello系统调用号为325*/
334
335 #ifdef __KERNEL__
336
337 #define NR_syscalls 326 / *将系统调用数目加1修改为326*/
（3）修改系统调用表。
为了让系统调用处理程序system_call函数能够找到hello系统调用，我们还需要修改系统调用表sys_call_table，放入服务例程sys_hello函数的地址。
322 .long sys_utimensat / * 320 */
323 .long sys_signalfd
324 .long sys_timerfd
325 .long sys_eventfd
326 .long sys_fallocate
327 .long sys_hello / *hello系统调用服务例程*/
新的系统调用hello的服务例程被添加到了sys_call_table的末尾。我们可以注意到，sys_call_table每隔5个表项就会有一个注释，表明该项的系统调用号，这个好习惯可以在查找系统调用对应的系统调用号时提供方便。
（4）重新编译内核并测试。
为了能够使用新添加的系统调用，需要重新编译内核，并使用新内核重新引导系统。然后，我们还需要编写测试程序对新的系统调用进行测试。针对hello系统调用的测试程序如下：
00 #include <unistd.h>
01 #include <sys/syscall.h>
02 #include <sys/types.h>
03
04 #define __NR_hello 325
05
06 int main(int argc, char *argv[])
07 {
08 syscall(__NR_hello);
09 return 0;
10 }
然后使用gcc编译并执行：
$gcc –o hello hello.c
$./hello
Hello!
由执行结果可见，系统调用添加成功
4818
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
