c - 使用 __kernel_vsyscall 调用 write 系统调用不起作用

Question

我写了一个示例程序__kernel_vsyscall用于系统调用

#include <stdio.h>
#include <sys/auxv.h>

int main()
{
    unsigned long sysinfo = getauxval(AT_SYSINFO);
    unsigned long syscall_num = 1;  // 1 is system call number for exit
    long exit_status = 42;

    asm ("movl %0, %%eax\n"
            "movl %1, %%ebx\n"
            "call *%2"
            :
            :"m" (syscall_num), "m" (exit_status), "m" (sysinfo)
            :"eax", "ebx");

    printf("sysinfo:%lx\n", sysinfo);
    return 0;
}

这个调用的代码exit(42)工作正常。

$gcc userprog.c -o userprog -m32
$ ./userprog 
$ echo $?
42

但是当我试图打电话时write(1, "hello world", 12)，它失败了

#include <stdio.h>
#include <sys/auxv.h>

int main()
{
    unsigned long sysinfo = getauxval(AT_SYSINFO);
    unsigned long syscall_num = 4;  // 4 is system call number for write
    char buffer[] = "hello world";
        int buffer_length = sizeof(buffer); 

    asm ("movl %0, %%eax\n"
            "movl %1, %%ebx\n"
            "movl %2, %%ecx\n"
            "movl %3, %%edx\n"
            "call *%2"
            :
            :"m" (syscall_num), "i"(1), "m" (buffer), "m"(buffer_length)
            :"eax", "ebx", "ecx");

    printf("sysinfo:%lx\n", sysinfo);
    return 0;
}

它因分段错误而失败。

dmesg：

[43453.401815] userprog[13528]: segfault at 6c6c6568 ip 000000006c6c6568 sp 00000000ffc647ac error 14 in libc-2.27.so[f7cf3000+1d2000]
[43453.401821] Code: Bad RIP value.

Answer 1

在"call *%2"您的内联汇编中似乎是错误的。gdb你可以很容易地检查出来：

(gdb) layout asm
(gdb) break main
    Breakpoint 1 at 0x5eb: file test.c, line 31.
(gdb) run

从内联汇编生成的代码对我来说如下所示：

0x5655562b <main+94>    mov    -0x34(%ebp),%eax
0x5655562e <main+97>    mov    $0x1,%ebx
0x56555633 <main+102>   mov    -0x28(%ebp),%ecx
0x56555636 <main+105>   mov    -0x30(%ebp),%edx
0x56555639 <main+108>   call   *-0x28(%ebp)

在调用地址处休息：

(gdb) break *0x56555639
(gdb) c
(gdb) si
Cannot access memory at address 0x6c6c6568)

我认为你的程序集应该是这样的：

asm ("movl %0, %%eax\n"
     "movl %1, %%ebx\n"
     "movl %2, %%ecx\n"
     "movl %3, %%edx\n"
     "call *%4"
     :
     :"m" (syscall_num), "i"(1), "m" (buffer), "m"(buffer_length), "m"(sysinfo)
     :"eax", "ebx", "ecx", "edx");

edx请注意，您的 clobber 列表中也缺少您。