Question

Linux kernel3.8.0 检测 O_CREAT 过程有点不同。 Listing 17.8: linux kernel 3.8.0

#!bash
struct file *do_filp_open(int dfd, struct filename *pathname,

const struct open_flags *op)
{

... filp = path_openat(dfd, pathname, &nd, op, flags | LOOKUP_RCU); ... }

static struct file *path_openat(int dfd, struct filename *pathname,
    struct nameidata *nd, const struct open_flags *op, int flags)

{

... error = do_last(nd, &path, file, op, &opened, pathname); ... } static int do_last(struct nameidata nd, struct path path, struct file file, const struct open_flags op, int opened, struct filename name) { ... if (!(open_flag & O_CREAT)) { ... error = lookup_fast(nd, path, &inode); ... } else { ... error = complete_walk(nd); } ... }

在 IDA 中查看 ARM 模式内核： Listing 17.9: do_last() (vmlinux)

#!bash
...
.text:C0169EA8 MOV           R9, R3 ; R3 - (4th argument) open_flag
...
.text:C0169ED4 LDR           R6, [R9] ; R6 - open_flag
...
.text:C0169F68 TST           R6, #0x40 ; jumptable C0169F00 default case
.text:C0169F6C BNE           loc_C016A128
.text:C0169F70 LDR           R2, [R4,#0x10]
.text:C0169F74 ADD           R12, R4, #8
.text:C0169F78 LDR           R3, [R4,#0xC]
.text:C0169F7C MOV           R0, R4
.text:C0169F80 STR           R12, [R11,#var_50]
.text:C0169F84 LDRB          R3, [R2,R3]
.text:C0169F88 MOV           R2, R8
.text:C0169F8C CMP           R3, #0
.text:C0169F90 ORRNE         R1, R1, #3
.text:C0169F94 STRNE         R1, [R4,#0x24]
.text:C0169F98 ANDS          R3, R6, #0x200000
.text:C0169F9C MOV           R1, R12
.text:C0169FA0 LDRNE         R3, [R4,#0x24]
.text:C0169FA4 ANDNE         R3, R3, #1
.text:C0169FA8 EORNE         R3, R3, #1
.text:C0169FAC STR           R3, [R11,#var_54]
.text:C0169FB0 SUB           R3, R11, #-var_38
.text:C0169FB4 BL            lookup_fast
...
.text:C016A128 loc_C016A128          ; CODE XREF: do_last.isra.14+DC
.text:C016A128 MOV           R0, R4
.text:C016A12C BL            complete_walk
...

TST 指令类似于 x86 下的 TEST 指令。 这段代码来自 do_last() 函数源码，有两个分支 lookup_fast() 和 complete_walk()。这里 O_CREAT 宏也等于 0x40。