深入理解系统调用

make defcon?g # Default con?guration is based on ‘x86_64_defcon?g‘
make menucon?g  
# 打开debug相关选项
Kernel hacking  ---> 
    Compile-time checks and compiler options  ---> 
       [*] Compile the kernel with debug info 
       [*]   Provide GDB scripts for kernel debugging
 [*] Kernel debugging 
# 关闭KASLR，否则会导致打断点失败
Processor type and features ----> 
   [] Randomize the address of the kernel image (KASLR)

make -j$(nproc) # nproc gives the number of CPU cores/threads available 
qemu-system-x86_64 -kernel arch/x86/boot/bzImage # 测试?下内核能不能正常加载运?，因为没有?件系统最终会kernel panic 

axel -n 20 https://busybox.net/downloads/busybox-1.31.1.tar.bz2
tar -jxvf busybox-1.31.1.tar.bz2
cd busybox-1.31.1
 
make menucon?g
#记得要编译成静态链接，不?动态链接库。
Settings  --->
    [*] Build static binary (no shared libs)
#然后编译安装，默认会安装到源码?录下的 _install ?录中。
make -j$(nproc) && make install

mkdir rootfs
cd rootfs
cp ../busybox-1.31.1/_install/* ./ -rf
mkdir dev proc sys home
sudo cp -a /dev/{null,console,tty,tty1,tty2,tty3,tty4} dev/

#!/bin/sh
mount -t proc none /proc
mount -t sysfs none /sys
echo "Welcome My OS!"
echo "-------------------"
cd home
/bin/sh

chmod +x init

#打包成内存根?件系统镜像
?nd . -print0 | cpio --null -ov --format=newc | gzip -9 > ../rootfs.cpio.gz
#测试挂载根?件系统，看内核启动完成后是否执?init脚本
qemu-system-x86_64 -kernel linux-5.4.34/arch/x86/boot/bzImage -initrd rootfs.cpio.gz　

void *shmat(int shm_id, const void *shm_addr, int shmflg);

#include <sys/ipc.h>

#include <sys/shm.h>

#include <stdio.h>


int main(){
    int shmid;
    asm volatile(
            "movl %1, %%ebx\n\t"      //将第一个参数放入edi
            "movl %2, %%ecx\n\t"      //将第二个参数放入rsi
            "movl %3, %%edx\n\t"      //将第三个参数放入esi
            "movl $0x1E, %%eax\n\t"   //中断号30放入eax
            "syscall\n\t"            //触发系统调?
            "movl %%eax, %0\n\t"
            :"=m"(shmid)              //将结果放入shmid中
        );
    if(shmid<0){
        printf("error");
        return -1;
    }
    printf("%d\n",shmid);
    return 0;
}

gcc testSys.c -o testSys -static

?nd . -print0 | cpio --null -ov --format=newc | gzip -9 > ../rootfs.cpio.gz

qemu-system-x86_64 -kernel linux-5.4.34/arch/x86/boot/bzImage -initrd rootfs.cpio.gz -S -s

gdb vmlinux
target remote:1234
b __64x_sys_shmat
c

ENTRY(entry_SYSCALL_64)
    UNWIND_HINT_EMPTY
    /*
     * Interrupts are off on entry.
     * We do not frame this tiny irq-off block with TRACE_IRQS_OFF/ON,
     * it is too small to ever cause noticeable irq latency.
     */

    swapgs  /*swapgs指令切换gs寄存器从用户态到内核态*/
    /* tss.sp2 is scratch space. */
    movq    %rsp, PER_CPU_VAR(cpu_tss_rw + TSS_sp2) /*保存中断上下文中的rsp寄存器的值*/
    SWITCH_TO_KERNEL_CR3 scratch_reg=%rsp      /*切换到内核堆栈空间*/
    movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp  

    /* Construct struct pt_regs on stack */
    pushq    $__USER_DS                /* pt_regs->ss */
    pushq    PER_CPU_VAR(cpu_tss_rw + TSS_sp2)    /* pt_regs->sp */
    pushq    %r11                    /* pt_regs->flags */
    pushq    $__USER_CS                /* pt_regs->cs */
    pushq    %rcx                    /* pt_regs->ip */
GLOBAL(entry_SYSCALL_64_after_hwframe)
    pushq    %rax                    /* pt_regs->orig_ax */

    PUSH_AND_CLEAR_REGS rax=$-ENOSYS

    TRACE_IRQS_OFF          

    /* IRQs are off. */
    movq    %rax, %rdi      
    movq    %rsp, %rsi      
    call    do_syscall_64        /* returns with IRQs disabled */

#ifdef CONFIG_X86_64
__visible void do_syscall_64(unsigned long nr, struct pt_regs *regs)
{
    struct thread_info *ti;

    enter_from_user_mode();
    local_irq_enable();
    ti = current_thread_info();
    if (READ_ONCE(ti->flags) & _TIF_WORK_SYSCALL_ENTRY)
        nr = syscall_trace_enter(regs);

    if (likely(nr < NR_syscalls)) {
        nr = array_index_nospec(nr, NR_syscalls);
        regs->ax = sys_call_table[nr](regs);  /*获得系统调用号*/
#ifdef CONFIG_X86_X32_ABI
    } else if (likely((nr & __X32_SYSCALL_BIT) &&
              (nr & ~__X32_SYSCALL_BIT) < X32_NR_syscalls)) {
        nr = array_index_nospec(nr & ~__X32_SYSCALL_BIT,
                    X32_NR_syscalls);
        regs->ax = x32_sys_call_table[nr](regs);
#endif
    }

    syscall_return_slowpath(regs);
}