Linux内核分析之五——分析系统调用（system_call）的执行机制
作者：姚开健
原创作品转载请注明出处
《Linux内核分析》MOOC课程http://mooc.study.163.com/course/USTC-1000029000
当系统进行系统调用时，系统会通过int 0x80进行跳转到system_call这个地方，它是在系统初始化时，调用trap_init（）就开始初始化好的地址，如果在以后有发生系统调用，则会跳转至system_call这个地方去执行。system_call这个汇编执行块是在x86/kernel/entry_32.S这个文件里面（以x86为例），我们来看看它的部分代码：
ENTRY(system_call)
491 RING0_INT_FRAME # can't unwind into user space anyway
492 ASM_CLAC
493 pushl_cfi %eax # save orig_eax
494 SAVE_ALL
495 GET_THREAD_INFO(%ebp)
496 # system call tracing in operation / emulation
497 testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp)
498 jnz syscall_trace_entry
499 cmpl $(NR_syscalls), %eax
500 jae syscall_badsys
501syscall_call:
502 call *sys_call_table(,%eax,4)
503syscall_after_call:
504 movl %eax,PT_EAX(%esp) # store the return value
505syscall_exit:
506 LOCKDEP_SYS_EXIT
507 DISABLE_INTERRUPTS(CLBR_ANY) # make sure we don't miss an interrupt
508 # setting need_resched or sigpending
509 # between sampling and the iret
510 TRACE_IRQS_OFF
511 movl TI_flags(%ebp), %ecx
512 testl $_TIF_ALLWORK_MASK, %ecx # current->work
513 jne syscall_exit_work
514
515restore_all:
516 TRACE_IRQS_IRET
517restore_all_notrace:
518#ifdef CONFIG_X86_ESPFIX32
519 movl PT_EFLAGS(%esp), %eax # mix EFLAGS, SS and CS
520 # Warning: PT_OLDSS(%esp) contains the wrong/random values if we
521 # are returning to the kernel.
522 # See comments in process.c:copy_thread() for details.
523 movb PT_OLDSS(%esp), %ah
524 movb PT_CS(%esp), %al
525 andl $(X86_EFLAGS_VM | (SEGMENT_TI_MASK << 8) | SEGMENT_RPL_MASK), %eax
526 cmpl $((SEGMENT_LDT << 8) | USER_RPL), %eax
527 CFI_REMEMBER_STATE
528 je ldt_ss # returning to user-space with LDT SS
529#endif
530restore_nocheck:
531 RESTORE_REGS 4 # skip orig_eax/error_code
532irq_return:
533 INTERRUPT_RETURN
534.section .fixup,"ax"
535ENTRY(iret_exc)
536 pushl $0 # no error code
537 pushl $do_iret_error
538 jmp error_code
539.previous
540 _ASM_EXTABLE(irq_return,iret_exc)
541
542#ifdef CONFIG_X86_ESPFIX32
543 CFI_RESTORE_STATE
544ldt_ss:
545#ifdef CONFIG_PARAVIRT
546 /*
547 * The kernel can't run on a non-flat stack if paravirt mode
548 * is active. Rather than try to fixup the high bits of
549 * ESP, bypass this code entirely. This may break DOSemu
550 * and/or Wine support in a paravirt VM, although the option
551 * is still available to implement the setting of the high
552 * 16-bits in the INTERRUPT_RETURN paravirt-op.
553 */
554 cmpl $0, pv_info+PARAVIRT_enabled
555 jne restore_nocheck
556#endif
557
558/*
559 * Setup and switch to ESPFIX stack
560 *
561 * We're returning to userspace with a 16 bit stack. The CPU will not
562 * restore the high word of ESP for us on executing iret... This is an
563 * "official" bug of all the x86-compatible CPUs, which we can work
564 * around to make dosemu and wine happy. We do this by preloading the
565 * high word of ESP with the high word of the userspace ESP while
566 * compensating for the offset by changing to the ESPFIX segment with
567 * a base address that matches for the difference.
568 */
569#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
570 mov %esp, %edx /* load kernel esp */
571 mov PT_OLDESP(%esp), %eax /* load userspace esp */
572 mov %dx, %ax /* eax: new kernel esp */
573 sub %eax, %edx /* offset (low word is 0) */
574 shr $16, %edx
575 mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
576 mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
577 pushl_cfi $__ESPFIX_SS
578 pushl_cfi %eax /* new kernel esp */
579 /* Disable interrupts, but do not irqtrace this section: we
580 * will soon execute iret and the tracer was already set to
581 * the irqstate after the iret */
582 DISABLE_INTERRUPTS(CLBR_EAX)
583 lss (%esp), %esp /* switch to espfix segment */
584 CFI_ADJUST_CFA_OFFSET -8
585 jmp restore_nocheck
586#endif
587 CFI_ENDPROC
588ENDPROC(system_call)
589
590 # perform work that needs to be done immediately before resumption
591 ALIGN
592 RING0_PTREGS_FRAME # can't unwind into user space anyway
593work_pending:
594 testb $_TIF_NEED_RESCHED, %cl
595 jz work_notifysig
596work_resched:
597 call schedule
598 LOCKDEP_SYS_EXIT
599 DISABLE_INTERRUPTS(CLBR_ANY) # make sure we don't miss an interrupt
600 # setting need_resched or sigpending
601 # between sampling and the iret
602 TRACE_IRQS_OFF
603 movl TI_flags(%ebp), %ecx
604 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
605 # than syscall tracing?
606 jz restore_all
607 testb $_TIF_NEED_RESCHED, %cl
608 jnz work_resched
609
610work_notifysig: # deal with pending signals and
611 # notify-resume requests
612#ifdef CONFIG_VM86
613 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
614 movl %esp, %eax
615 jne work_notifysig_v86 # returning to kernel-space or
616 # vm86-space
6171:
618#else
619 movl %esp, %eax
620#endif
621 TRACE_IRQS_ON
622 ENABLE_INTERRUPTS(CLBR_NONE)
623 movb PT_CS(%esp), %bl
624 andb $SEGMENT_RPL_MASK, %bl
625 cmpb $USER_RPL, %bl
626 jb resume_kernel
627 xorl %edx, %edx
628 call do_notify_resume
629 jmp resume_userspace
630
631#ifdef CONFIG_VM86
632 ALIGN
633work_notifysig_v86:
634 pushl_cfi %ecx # save ti_flags for do_notify_resume
635 call save_v86_state # %eax contains pt_regs pointer
636 popl_cfi %ecx
637 movl %eax, %esp
638 jmp 1b
639#endif
640END(work_pending)
641
642 # perform syscall exit tracing
643 ALIGN
644syscall_trace_entry:
645 movl $-ENOSYS,PT_EAX(%esp)
646 movl %esp, %eax
647 call syscall_trace_enter
648 /* What it returned is what we'll actually use. */
649 cmpl $(NR_syscalls), %eax
650 jnae syscall_call
651 jmp syscall_exit
652END(syscall_trace_entry)
653
654 # perform syscall exit tracing
655 ALIGN
656syscall_exit_work:
657 testl $_TIF_WORK_SYSCALL_EXIT, %ecx
658 jz work_pending
659 TRACE_IRQS_ON
660 ENABLE_INTERRUPTS(CLBR_ANY) # could let syscall_trace_leave() call
661 # schedule() instead
662 movl %esp, %eax
663 call syscall_trace_leave
664 jmp resume_userspace
665END(syscall_exit_work)
可以看到，系统进入系统调用时（system_call），会首先保存现场，执行save_all宏，然后进行调用中断服务程序syscall_call，接着执行syscall_exit，当执行到这里准备退出时，会进行判断需不需要响应其他中断或者信号，如果不需要则直接进行restore_all恢复现场并且irq_return，正式返回到系统调用的地方；
如果需要响应其他中断，则需要执行syscall_exit_work，看看有没有work_resched或者work_notifysig，一个是看看当前进程需不需要调度，如果需要就执行call_schedule，如果需要响应某个信号，则进行work_notifysig，接着再跳转至restore_all接着执行并退出。这个就是系统调用时汇编代码级别的大致执行过程。
当我们知道上述系统调用处理过程之后，我们则可以根据之前的进程调度切换上下文，中断处理切换上下文得出一个一般性的过程，就是当系统需要跳转去调度进程，或中断处理或系统调用时，通常我们需要的是保护现场，接着再跳转至要执行的进程或中断服务程序或系统调用服务程序，接着执行完该程序后再恢复现场，并且返回至之前发生调用的地方。如果在服务程序执行过程中还需要进程其他中断或调度或系统调用，则重复刚才的过程直至返回至最初发生调用的地方。这就是系统调用处理程序的原理。