-
参考连接 https://blog.csdn.net/weixin_42992444/article/details/108571515
-
1.如何查看系统调用
- 系统调用的搜索方法
系统调用xxx都是从sys_xxx作为函数入口的
但是系统中是无法搜到sys_xxx函数的,因为是通过宏定义生成的sys_xxx
{
那想要查看实现:(1)搜SYSCALL_DEFINE (2)搜对应的参数
比如--int socket (int __domain, int __type, int __protocol)系统调用 ---对应3个参数-->
应该搜SYSCALL_DEFINE3(socket,
}
- 系统调用的搜索例子
比如socket(int __domain, int __type, int __protocol);函数---->
SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)----->
层层展开就是调用的sys_socket(int __domain, int __type, int __protocol);
- 系统调用sys_send--->应该去搜SYSCALL_DEFINEx(send, .....
-
2.通过gcc -E来编译展开宏定义
- 1.展开SYSCALL_DEFINE3
SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode) { 通过#define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__) } SYSCALL_DEFINEx(3, _open, const char __user *, filename, int, flags, umode_t, mode)
- 2.展开SYSCALL_DEFINEx
#define SYSCALL_DEFINEx(x, sname, ...) \ SYSCALL_METADATA(sname, x, __VA_ARGS__) \ __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) } SYSCALL_METADATA(_open, 3, const char __user *, filename, int, flags, umode_t, mode) __SYSCALL_DEFINEx(3, _open, const char __user *, filename, int, flags, umode_t, mode)
- 3.展开 SYSCALL_METADATA
static const char *types__open[] = { __MAP(3, __SC_STR_TDECL, const char __user *, filename, int, flags, umode_t, mode) }; static const char *args__open[] = { __MAP(3, __SC_STR_ADECL, const char __user *, filename, int, flags, umode_t, mode) }; SYSCALL_TRACE_ENTER_EVENT(_open); SYSCALL_TRACE_EXIT_EVENT(_open); static struct syscall_metadata __used __syscall_meta__open = { .name = "sys" "_open", .syscall_nr = -1,.nb_args = 3, .types = 3 ? types__open : NULL, .args = 3 ? args__open : NULL, .enter_event = &event_enter__open, .exit_event = &event_exit__open, .enter_fields = LIST_HEAD_INIT(__syscall_meta__open.enter_fields), }; static struct syscall_metadata __used __attribute__ ((section("__syscalls_metadata"))) * __p_syscall_meta__open = &__syscall_meta__open; asmlinkage long sys_open(__MAP (3, __SC_DECL, const char __user *, filename, int, flags, umode_t, mode)) __attribute__ ((alias(__stringify(SyS_open))));
- 4.展开__SYSCALL_DEFINEx
static inline long SYSC_open(__MAP (3, __SC_DECL, const char __user *, filename, int, flags, umode_t, mode)); asmlinkage long SyS_open(__MAP (3, __SC_LONG, const char __user *, filename, int, flags, umode_t, mode)); asmlinkage long SyS_open(__MAP (3, __SC_LONG, const char __user *, filename, int, flags, umode_t, mode)) { long ret = SYSC_open(__MAP (3, __SC_CAST, const char __user *, filename, int, flags, umode_t, mode)); __MAP(3, __SC_TEST, const char __user *, filename, int, flags, umode_t, mode); __PROTECT(3, ret, __MAP(3, __SC_ARGS, const char __user *, filename, int, flags, umode_t, mode)); return ret; } static inline long SYSC_open(__MAP (3, __SC_DECL, const char __user *, filename, int, flags, umode_t, mode)) { if (force_o_largefile()) flags |= O_LARGEFILE; return do_sys_open(AT_FDCWD, filename, flags, mode); } }
- 5.展开SYSCALL_TRACE_ENTER_EVENT
static struct syscall_metadata __syscall_meta__open; static struct ftrace_event_call __used event_enter__open = { .class = &event_class_syscall_enter, {.name = "sys_enter" "_open",}, .event.funcs = &enter_syscall_print_funcs, .data = (void *)&__syscall_meta__open, .flags = TRACE_EVENT_FL_CAP_ANY, }; static struct ftrace_event_call __used __attribute__ ((section("_ftrace_events"))) * __event_enter__open = &event_enter__open;;
- 6.展开 SYSCALL_TRACE_EXIT_EVENT
{ static struct syscall_metadata __syscall_meta__open; static struct ftrace_event_call __used event_exit__open = { .class = &event_class_syscall_exit, {.name = "sys_exit" "_open",}, .event.funcs = &exit_syscall_print_funcs, .data = (void *)&__syscall_meta__open, .flags = TRACE_EVENT_FL_CAP_ANY, }; static struct ftrace_event_call __used __attribute__ ((section("_ftrace_events"))) * __event_exit__open = &event_exit__open;; static struct syscall_metadata __used __syscall_meta__open = { .name = "sys" "_open", .syscall_nr = -1, .nb_args = 3, .types = 3 ? types__open : NULL, .args = 3 ? args__open : NULL, .enter_event = &event_enter__open, .exit_event = &event_exit__open, .enter_fields = LIST_HEAD_INIT(__syscall_meta__open.enter_fields), }; static struct syscall_metadata __used __attribute__ ((section("__syscalls_metadata"))) * __p_syscall_meta__open = &__syscall_meta__open; asmlinkage long sys_open(__MAP (3, __SC_DECL, const char __user *, filename, int, flags, umode_t, mode)) __attribute__ ((alias(__stringify(SyS_open)))); static inline long SYSC_open(__MAP (3, __SC_DECL, const char __user *, filename, int, flags, umode_t, mode)); asmlinkage long SyS_open(__MAP (3, __SC_LONG, const char __user *, filename, int, flags, umode_t, mode)); asmlinkage long SyS_open(__MAP (3, __SC_LONG, const char __user *, filename, int, flags, umode_t, mode)) { long ret = SYSC_open(__MAP (3, __SC_CAST, const char __user *, filename, int, flags, umode_t, mode)); __MAP(3, __SC_TEST, const char __user *, filename, int, flags, umode_t, mode); __PROTECT(3, ret, __MAP(3, __SC_ARGS, const char __user *, filename, int, flags, umode_t, mode)); return ret; } static inline long SYSC_open(__MAP (3, __SC_DECL, const char __user *, filename, int, flags, umode_t, mode)) { if (force_o_largefile()) flags |= O_LARGEFILE; return do_sys_open(AT_FDCWD, filename, flags, mode); } }
-
3. 展开所有的东西
6.将上面的东西全部展开 { static const char *types__open[] = { "const char __user *", "int", "umode_t" }; static const char *args__open[] = { "filename", "flags", "mode" }; static struct syscall_metadata __syscall_meta__open; static struct ftrace_event_call __used event_enter__open = { .class = &event_class_syscall_enter, {.name = "sys_enter" "_open",}, .event.funcs = &enter_syscall_print_funcs, .data = (void *)&__syscall_meta__open, .flags = TRACE_EVENT_FL_CAP_ANY, }; static struct ftrace_event_call __used __attribute__ ((section("_ftrace_events"))) * __event_enter__open = &event_enter__open;; static struct syscall_metadata __syscall_meta__open; static struct ftrace_event_call __used event_exit__open = { .class = &event_class_syscall_exit, {.name = "sys_exit" "_open",}, .event.funcs = &exit_syscall_print_funcs, .data = (void *)&__syscall_meta__open, .flags = TRACE_EVENT_FL_CAP_ANY, }; static struct ftrace_event_call __used __attribute__ ((section("_ftrace_events"))) * __event_exit__open = &event_exit__open;; static struct syscall_metadata __used __syscall_meta__open = { .name = "sys" "_open", .syscall_nr = -1, .nb_args = 3, .types = 3 ? types__open : NULL, .args = 3 ? args__open : NULL, .enter_event = &event_enter__open, .exit_event = &event_exit__open, .enter_fields = LIST_HEAD_INIT(__syscall_meta__open.enter_fields), }; static struct syscall_metadata __used __attribute__ ((section("__syscalls_metadata"))) * __p_syscall_meta__open = &__syscall_meta__open; asmlinkage long sys_open(const char __user * filename, int flags, umode_t mode) __attribute__ ((alias(__stringify(SyS_open)))); static inline long SYSC_open(const char __user * filename, int flags, umode_t mode); asmlinkage long SyS_open( __typeof ( __builtin_choose_expr ( ( __same_type((const char __user *)0, 0LL) || __same_type((const char __user *)0, 0ULL) ), 0LL, 0L ) ) filename, __typeof ( __builtin_choose_expr ( ( __same_type((int)0, 0LL) || __same_type((int)0, 0ULL) ), 0LL, 0L ) ) flags, __typeof ( __builtin_choose_expr ( ( __same_type((umode_t) 0, 0LL) || __same_type((umode_t) 0, 0ULL) ), 0LL, 0L ) ) mode ); asmlinkage long SyS_open( __typeof ( __builtin_choose_expr ( ( __same_type((const char __user *)0, 0LL) || __same_type((const char __user *)0, 0ULL) ), 0LL, 0L ) ) filename, __typeof ( __builtin_choose_expr ( ( __same_type((int)0, 0LL) || __same_type((int)0, 0ULL)), 0LL, 0L ) ) flags, __typeof ( __builtin_choose_expr ( ( __same_type((umode_t) 0, 0LL) || __same_type((umode_t) 0, 0ULL) ), 0LL, 0L ) ) mode ) { long ret = SYSC_open((const char __user *)filename, (int)flags, (umode_t) mode); (void) BUILD_BUG_ON_ZERO( !( __same_type((const char __user *)0, 0LL) || __same_type((const char __user *)0, 0ULL) ) && sizeof(const char __user *) > sizeof(long) ), (void) BUILD_BUG_ON_ZERO( !( __same_type((int)0, 0LL) || __same_type((int)0, 0ULL) ) && sizeof(int) > sizeof(long) ), (void) BUILD_BUG_ON_ZERO( !( __same_type((umode_t) 0, 0LL) || __same_type((umode_t) 0, 0ULL) ) && sizeof(umode_t) > sizeof(long) ); asmlinkage_protect(3, ret, filename, flags, mode); return ret; } static inline long SYSC_open(const char __user * filename, int flags, umode_t mode) { if (force_o_largefile()) flags |= O_LARGEFILE; return do_sys_open(AT_FDCWD, filename, flags, mode); } }
综上系统调用:
sys_open() == SyS_open() —> SYSC_open() —> do_sys_open()