sc32440 arm linux2.6.30.4 系统调用(一)

这篇是关于软中断之前部分,也就是app中请求系统调用到cpu发出swi指令这段.

先说结论

1.通过r7传递syscall idx(open的话为5)

2.swi 指令的Comment Field部分固定传0

当然还要传递系统调用对应的内核响应函数参数,这个等第二篇出来了,再更新.

用户程序c代码

int main(int argc, char* argv[]) {
    int fd = 0;
    int val = (1 << 16 | 1);
    int ledNo = 0;
    int onOff = 0;

    // if(argc != 3) {
        // printf("usage %s lenNo(1-4) onOff(1|0)\r\n", argv[0]);
        // return -1;
    // }
    system("insmod /home/sky/1drv.km");
    sleep(1);
    // ledNo = atoi(argv[1]);
    // onOff = atoi(argv[2]);
    ledNo  = 2;
    onOff = 1;
    
    val = ledNo << 16 | onOff;
    //printf("lenNo=%d, onOff=%d\r\n", ledNo, onOff);
    
    //printf("open /dev/xyz\r\n");
    fd = open("/dev/xyz", O_RDWR);
    if(fd < 0) {
        printf("open failed.\r\n");   
        return -1;
    }
    write(fd, &val, 4);
    //printf("main exit\r\n");
    return 0;
}

 调试过程

$ arm-linux-gdb ./1.test
GNU gdb 6.8
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-linux"...
(gdb) target remote s:2331
Remote debugging using s:2331
warning: Unable to find dynamic linker breakpoint function.
GDB will be unable to debug shared library initializers
and track explicitly loaded dynamic code.
0x00000000 in ?? ()
(gdb) b main
Breakpoint 1 at 0x850c: file test.c, line 7.
(gdb) c
Continuing.

Breakpoint 1, main (argc=1971528, argv=0x1bd78c) at test.c:7
7           int fd = 0;
(gdb) l
2       #include <sys/stat.h>
3       #include <fcntl.h>
4       #include <stdio.h>
5
6       int main(int argc, char* argv[]) {
7           int fd = 0;
8           int val = (1 << 16 | 1);
9           int ledNo = 0;
10          int onOff = 0;
11
(gdb) l
12          // if(argc != 3) {
13              // printf("usage %s lenNo(1-4) onOff(1|0)\r\n", argv[0]);
14              // return -1;
15          // }
16          system("insmod /home/sky/1drv.km");
17          sleep(1);
18          // ledNo = atoi(argv[1]);
19          // onOff = atoi(argv[2]);
20          ledNo  = 2;
21          onOff = 1;
(gdb) l
22
23          val = ledNo << 16 | onOff;
24          //printf("lenNo=%d, onOff=%d\r\n", ledNo, onOff);
25
26          //printf("open /dev/xyz\r\n");
27          fd = open("/dev/xyz", O_RDWR);
28          if(fd < 0) {
29              printf("open failed.\r\n");
30              return -1;
31          }
(gdb) b 20
Breakpoint 2 at 0x8540: file test.c, line 20.
(gdb) b 27
Breakpoint 3 at 0x8564: file test.c, line 27.
(gdb) c
Continuing.

Breakpoint 3, main (argc=1971528, argv=0x1bd78c) at test.c:27
27          fd = open("/dev/xyz", O_RDWR);
(gdb) si
0x00008568      27          fd = open("/dev/xyz", O_RDWR);
(gdb) x/5i $pc
0x8568 <main+112>:      pop     {r5}            ; (ldr r5, [sp], #4)
0x856c <main+116>:      bx      lr
0x8570 <main+120>:      tst     r1, #1  ; 0x1
0x8574 <main+124>:      beq     0x8588 <main+144>
0x8578 <main+128>:      ldrb    r2, [r1], #1
(gdb) si
0x0000856c      27          fd = open("/dev/xyz", O_RDWR);
(gdb) i r lr
lr             0x76c58  486488
(gdb) x/10i 0x76c58-20
0x76c44:        mov     r4, r0
0x76c48:        add     r0, r5, r0
0x76c4c:        add     r6, r0, #1      ; 0x1
0x76c50:        ldr     r1, [pc, #1556] ; 0x7726c
0x76c54:        bl      0x84d0 <frame_dummy+12>
0x76c58:        mov     r2, #64 ; 0x40
0x76c5c:        mov     r0, r5
0x76c60:        mov     r1, r6
0x76c64:        bl      0x1b2e4
0x76c68:        ldr     r2, [sp, #12]
(gdb) si
0x00076c58 in ?? ()
(gdb) i r r2
r2             0xff010003       4278255619
(gdb) si
0x00076c5c in ?? ()
(gdb) i r r2
r2             0x40     64
(gdb) si
0x00076c60 in ?? ()
(gdb) i r r0
r0             0x1e4fa8 1986472
(gdb) x/10c 0x1e4fa8
0x1e4fa8:       47 '/'  115 's' 121 'y' 115 's' 47 '/'  99 'c'  108 'l' 97 'a'
0x1e4fb0:       115 's' 115 's'
(gdb) x/1s 0x1e4fa8
0x1e4fa8:        "/sys/class/tty/tty0/dev"
(gdb) x/10i $pc
0x76c60:        mov     r1, r6
0x76c64:        bl      0x1b2e4
0x76c68:        ldr     r2, [sp, #12]
0x76c6c:        cmp     r0, #0  ; 0x0
0x76c70:        strb    r2, [r5, r4]
0x76c74:        ble     0x76c94
0x76c78:        mov     r0, r6
0x76c7c:        ldr     r1, [pc, #1516] ; 0x77270
0x76c80:        add     r2, sp, #188    ; 0xbc
0x76c84:        add     r3, sp, #184    ; 0xb8
(gdb) si
0x00076c64 in ?? ()
(gdb) i r r1
r1             0x1e4fbc 1986492
(gdb) x/10i 0x1b2e4-20
0x1b2d0:        mov     r0, r4
0x1b2d4:        bl      0x8d00
0x1b2d8:        mov     r0, r5
0x1b2dc:        pop     {r4, r5, r6, lr}
0x1b2e0:        bx      lr
0x1b2e4:        push    {r4, r5, r6, lr}
0x1b2e8:        mov     r5, r1
0x1b2ec:        mov     r1, #0  ; 0x0
0x1b2f0:        mov     r4, r2
0x1b2f4:        bl      0x12d5b0
(gdb) si
0x0001b2e4 in ?? ()
(gdb) si
0x0001b2e8 in ?? ()
(gdb) si
0x0001b2ec in ?? ()
(gdb) si
0x0001b2f0 in ?? ()
(gdb) si
0x0001b2f4 in ?? ()
(gdb) x/10i 0x12d5b0-20
0x12d59c:       rsb     r2, r2, #0      ; 0x0
0x12d5a0:       str     r2, [r0, r3]
0x12d5a4:       mvn     r0, #0  ; 0x0
0x12d5a8:       b       0x12d588
0x12d5ac:       andeq   r1, r11, r0, lsr r4
0x12d5b0:       push    {r1, r2, r3}
0x12d5b4:       push    {r4, r5, r6, r7, r8, lr}
0x12d5b8:       sub     sp, sp, #12     ; 0xc
0x12d5bc:       ldr     r5, [sp, #36]
0x12d5c0:       ands    r2, r5, #64     ; 0x40
(gdb) si
0x0012d5b0 in ?? ()
(gdb) si
0x0012d5b4 in ?? ()
(gdb) i r r7
r7             0xffffffff       4294967295
(gdb) si
0x0012d5b8 in ?? ()
(gdb) si
0x0012d5bc in ?? ()
(gdb) i r r5
r5             0x1e4fbc 1986492
(gdb) x/10i $pc
0x12d5bc:       ldr     r5, [sp, #36]
0x12d5c0:       ands    r2, r5, #64     ; 0x40
0x12d5c4:       addne   r3, sp, #44     ; 0x2c
0x12d5c8:       strne   r3, [sp, #4]
0x12d5cc:       ldr     r3, [pc, #184]  ; 0x12d68c
0x12d5d0:       moveq   r4, r2
0x12d5d4:       ldr     r2, [r3]
0x12d5d8:       ldrne   r4, [sp, #40]
0x12d5dc:       cmp     r2, #0  ; 0x0
0x12d5e0:       mov     r6, r0
(gdb) si
0x0012d5c0 in ?? ()
(gdb) i r r5
r5             0x0      0
(gdb) si
0x0012d5c4 in ?? ()
(gdb) i r cpsr
cpsr           0x40000010       1073741840
(gdb) i r r3 sp
r3             0x766564 7759204
sp             0xbedea890       0xbedea890
(gdb) si
0x0012d5c8 in ?? ()
(gdb) i r r3 sp
r3             0x766564 7759204
sp             0xbedea890       0xbedea890
(gdb) si
0x0012d5cc in ?? ()
(gdb) si
0x0012d5d0 in ?? ()
(gdb) i r r3
r3             0x1e390c 1980684
(gdb) i r cpsr
cpsr           0x40000010       1073741840
(gdb) i r r4 r2
r4             0x40     64
r2             0x0      0
(gdb) si
0x0012d5d4 in ?? ()
(gdb) i r r4 r2
r4             0x0      0
r2             0x0      0
(gdb) x/10i $pc
0x12d5d4:       ldr     r2, [r3]
0x12d5d8:       ldrne   r4, [sp, #40]
0x12d5dc:       cmp     r2, #0  ; 0x0
0x12d5e0:       mov     r6, r0
0x12d5e4:       bne     0x12d61c
0x12d5e8:       orr     r1, r5, #131072 ; 0x20000
0x12d5ec:       mov     r2, r4
0x12d5f0:       mov     r7, #5  ; 0x5
0x12d5f4:       svc     0x00000000
0x12d5f8:       cmn     r0, #4096       ; 0x1000
(gdb) si
0x0012d5d8 in ?? ()
(gdb) i r r2
r2             0x0      0
(gdb) si
0x0012d5dc in ?? ()
(gdb) si
0x0012d5e0 in ?? ()
(gdb) si
0x0012d5e4 in ?? ()
(gdb) i r cpsr
cpsr           0x60000010       1610612752
(gdb) si
0x0012d5e8 in ?? ()
(gdb) si
0x0012d5ec in ?? ()
(gdb) si
0x0012d5f0 in ?? ()
(gdb) si
0x0012d5f4 in ?? ()
(gdb) x/1i $pc
0x12d5f4:       svc     0x00000000
(gdb) i r r7
r7             0x5      5
(gdb) x/1x 0x12d5f4
0x12d5f4:       0xef000000
(gdb)

 

 

目前还没看c库中c代码的open函数的实现,从下面可以看出这是一个动态链接的符号.

$ arm-linux-readelf -s 1.test
Symbol table '.dynsym' contains 12 entries:
   Num:    Value  Size Type    Bind   Vis      Ndx Name
     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND
     1: 000083e4     0 FUNC    GLOBAL DEFAULT  UND open@GLIBC_2.4 (2)

当然还有很多细节没深究.比如明明打开的是地/dev/xyz,哪个/sys/class/tty/tty0/dev是个什么鬼.