GLIBC中的库函数fflush究竟做了什么？

╰+攻爆jí腚メ 2023-06-13 06:05 12阅读 0赞

# **目录** #

目录 1

1. 库函数fflush原型 1

2. FILE结构体 1

3. fflush函数实现 2

4. fclose函数实现 4

附1：强弱函数名 5

附2：属性\_\_visibility\_\_ 6

1.   **库函数fflush原型**

先瞧瞧fflush的原型：

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> #include &lt;stdio.h&gt; int fflush(FILE *stream); </td> 
 </tr> 
 </tbody> 
</table>

可看到fflush操作的是FILE，这里的FILE又长什么样？如果参数传入NULL，则对所有已打开的有效。

1.   **FILE结构体**

直接查看源码，或者在GDB上执行ptype，即可看到FILE的庐山真面目如下：

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> // The value returned by fgetc and similar functions to indicate the end of the file. // #define EOF&nbsp;(-1) type = struct _IO_FILE&nbsp;{ &nbsp;&nbsp;&nbsp;&nbsp;int _flags; &nbsp;&nbsp;&nbsp;&nbsp;char *_IO_read_ptr; &nbsp;&nbsp;&nbsp;&nbsp;char *_IO_read_end; &nbsp;&nbsp;&nbsp;&nbsp;char *_IO_read_base; &nbsp;&nbsp;&nbsp;&nbsp;char *_IO_write_base; // &nbsp;写缓冲区起始地址 (Start of put area) &nbsp;&nbsp;&nbsp;&nbsp;char *_IO_write_ptr; // &nbsp;写的起始地址 (Current put pointer) &nbsp;&nbsp;&nbsp;&nbsp;char *_IO_write_end; // &nbsp;写缓冲区的末端 &nbsp;&nbsp;&nbsp;&nbsp;char *_IO_buf_base; &nbsp;&nbsp;&nbsp;&nbsp;char *_IO_buf_end; &nbsp;&nbsp;&nbsp;&nbsp;char *_IO_save_base; &nbsp;&nbsp;&nbsp;&nbsp;char *_IO_backup_base; &nbsp;&nbsp;&nbsp;&nbsp;char *_IO_save_end; &nbsp;&nbsp;&nbsp;&nbsp;_IO_marker *_markers; &nbsp;&nbsp;&nbsp;&nbsp;_IO_FILE *_chain; &nbsp;&nbsp;&nbsp;&nbsp;int _fileno;&nbsp;// 文件描述符 &nbsp;&nbsp;&nbsp;&nbsp;int _flags2; &nbsp;&nbsp;&nbsp;&nbsp;__off_t _old_offset; &nbsp;&nbsp;&nbsp;&nbsp;unsigned short _cur_column; &nbsp;&nbsp;&nbsp;&nbsp;signed char _vtable_offset; &nbsp;&nbsp;&nbsp;&nbsp;char _shortbuf[1]; &nbsp;&nbsp;&nbsp;&nbsp;_IO_lock_t *_lock; &nbsp;&nbsp;&nbsp;&nbsp;__off64_t _offset; &nbsp;&nbsp;&nbsp;&nbsp;void *__pad1; &nbsp;&nbsp;&nbsp;&nbsp;void *__pad2; &nbsp;&nbsp;&nbsp;&nbsp;void *__pad3; &nbsp;&nbsp;&nbsp;&nbsp;void *__pad4; &nbsp;&nbsp;&nbsp;&nbsp;size_t __pad5; &nbsp;&nbsp;&nbsp;&nbsp;int _mode; // 文件打开模式，参见系统调用open的mode参数取值 &nbsp;&nbsp;&nbsp;&nbsp;char _unused2[20]; } FILE; </td> 
 </tr> 
 </tbody> 
</table>

\_IO\_write\_ptr和\_IO\_write\_base之间为已写入缓冲区的数据，\_IO\_write\_end和\_IO\_write\_base为写缓冲区的大小，\_IO\_write\_end和\_IO\_write\_ptr之间为写缓冲区可用区域。

1.   **fflush函数实现**

LIBC库函数**fflush**主要做的是借助系统调用**write**将\_IO\_write\_ptr和\_IO\_write\_base间的数据写入内核。可借助下列小段代码看出真相：

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> $&nbsp;cat ggg.cpp #include &lt;stdio.h&gt; #include &lt;stdlib.h&gt; #include &lt;unistd.h&gt; int main() { &nbsp;&nbsp;FILE* fp = fopen("/tmp/ggg.txt", "w+"); &nbsp;&nbsp;if (fp == NULL) { &nbsp;&nbsp;&nbsp;&nbsp;perror("fopen"); &nbsp;&nbsp;&nbsp;&nbsp;exit(1); &nbsp;&nbsp;} &nbsp; &nbsp;&nbsp;fputs("hello", fp); // 这一步并不会调用write &nbsp;&nbsp;fflush(fp); // 间接调用write &nbsp;&nbsp;fclose(fp); &nbsp;&nbsp;return 0; } </td> 
 </tr> 
 </tbody> 
</table>

借助GDB即可看到fflush时的调用栈：

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> (gdb) bt #0 &nbsp;0x00007ffff72e0840 in write&nbsp;() from /lib64/libc.so.6 #1 &nbsp;0x00007ffff726cfb3 in _IO_new_file_write () from /lib64/libc.so.6 #2 &nbsp;0x00007ffff726e41c in __GI__IO_do_write () from /lib64/libc.so.6 #3 &nbsp;0x00007ffff726c810 in __GI__IO_file_sync&nbsp;() from /lib64/libc.so.6 #4 &nbsp;0x00007ffff72620a2 in fflush&nbsp;() from /lib64/libc.so.6 #5 &nbsp;0x00000000004007bd in main () at ggg.cpp:12 </td> 
 </tr> 
 </tbody> 
</table>

函数**\_\_GI\_****\_IO\_file\_sync**源码：

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> int _IO_new_file_sync&nbsp;(FILE *fp) { &nbsp;&nbsp;ssize_t delta; &nbsp;&nbsp;int retval = 0; &nbsp; &nbsp;&nbsp;/* char* ptr = cur_ptr(); */ &nbsp;&nbsp;if (fp-&gt;_IO_write_ptr&nbsp;&gt; fp-&gt;_IO_write_base) &nbsp;&nbsp;&nbsp;&nbsp;if (_IO_do_flush(fp)) return EOF; &nbsp;&nbsp;delta = fp-&gt;_IO_read_ptr - fp-&gt;_IO_read_end; &nbsp;&nbsp;if (delta != 0) &nbsp;&nbsp;{ &nbsp;&nbsp;&nbsp;&nbsp;off64_t new_pos = _IO_SYSSEEK (fp, delta, 1); &nbsp;&nbsp;&nbsp;&nbsp;if (new_pos != (off64_t) EOF) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fp-&gt;_IO_read_end = fp-&gt;_IO_read_ptr; &nbsp;&nbsp;&nbsp;&nbsp;else if (errno == ESPIPE) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;; /* Ignore error from unseekable devices. */ &nbsp;&nbsp;&nbsp;&nbsp;else &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;retval = EOF; &nbsp;&nbsp;} &nbsp;&nbsp;if (retval != EOF) &nbsp;&nbsp;&nbsp;&nbsp;fp-&gt;_offset = _IO_pos_BAD; &nbsp;&nbsp;/* FIXME: Cleanup - can this be shared? */ &nbsp;&nbsp;/* &nbsp;&nbsp;&nbsp;setg(base(), ptr, ptr); */ &nbsp;&nbsp;return retval; } libc_hidden_ver (_IO_new_file_sync, _IO_file_sync) &nbsp; // 下面的“_f”类型为FILE #define _IO_do_flush(_f) \ &nbsp;&nbsp;((_f)-&gt;_mode &lt;= 0 \ &nbsp;&nbsp;? _IO_do_write(_f, (_f)-&gt;_IO_write_base, (_f)-&gt;_IO_write_ptr-(_f)-&gt;_IO_write_base)&nbsp;\ &nbsp;&nbsp;: _IO_wdo_write(_f, (_f)-&gt;_wide_data-&gt;_IO_write_base, \ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;((_f)-&gt;_wide_data-&gt;_IO_write_ptr - (_f)-&gt;_wide_data-&gt;_IO_write_base))) &nbsp; extern int _IO_do_write&nbsp;(FILE *, const char *, size_t); libc_hidden_proto (_IO_do_write) extern int _IO_wdo_write&nbsp;(FILE *, const wchar_t *, size_t); libc_hidden_proto (_IO_wdo_write) </td> 
 </tr> 
 </tbody> 
</table>

函数\_IO\_do\_write源代码：

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> int _IO_new_do_write&nbsp;(FILE *fp, const char *data, size_t to_do) { &nbsp;&nbsp;// new_do_write实际调用write &nbsp;&nbsp;return (to_do == 0 &nbsp;&nbsp;|| (size_t) new_do_write (fp, data, to_do) == to_do) ? 0 : EOF; } libc_hidden_ver (_IO_new_do_write, _IO_do_write) </td> 
 </tr> 
 </tbody> 
</table>

1.   **fclose函数实现**

如果省掉fflush，代码变成如下：

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> $ cat ggg.cpp #include &lt;stdio.h&gt; #include &lt;stdlib.h&gt; #include &lt;unistd.h&gt; int main() { &nbsp;&nbsp;FILE* fp = fopen("/tmp/ggg.txt", "w+"); &nbsp;&nbsp;if (fp == NULL) { &nbsp;&nbsp;&nbsp;&nbsp;perror("fopen"); &nbsp;&nbsp;&nbsp;&nbsp;exit(1); &nbsp;&nbsp;} &nbsp; &nbsp;&nbsp;fputs("hello", fp); &nbsp;&nbsp;//fflush(fp); &nbsp;&nbsp;fclose(fp); &nbsp;&nbsp;return 0; } </td> 
 </tr> 
 </tbody> 
</table>

可看到write发生在fclose时：

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> (gdb) bt #0 &nbsp;0x00007ffff72e0840 in write&nbsp;() from /lib64/libc.so.6 #1 &nbsp;0x00007ffff726cfb3 in _IO_new_file_write () from /lib64/libc.so.6 #2 &nbsp;0x00007ffff726e41c in __GI__IO_do_write () from /lib64/libc.so.6 #3 &nbsp;0x00007ffff726dd10 in __GI__IO_file_close_it () from /lib64/libc.so.6 #4 &nbsp;0x00007ffff7261c40 in fclose@@GLIBC_2.2.5 () from /lib64/libc.so.6 #5 &nbsp;0x000000000040076d in main () at ggg.cpp:13 </td> 
 </tr> 
 </tbody> 
</table>

但如果在flcose之前已调用了fflush，则fclose时不会再调用write。

# **附1：强弱函数名** #

调用一个函数时，如果存在强符号，则调用强函数；否则如果存在弱符号，则调用弱函数，可简单将“弱函数”看成为函数指针，如果弱函数对应的函数并不存在，仍然可以编译链接成功，这个时候类似于野指针或空指针，运行时会段错误。

1.  定义弱函数名weak\_alias

是一个宏，用来定义**弱****别名**，GLIBC中大量使用，如：

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> weak_alias&nbsp;(_IO_fflush, fflush) // fflush为别名 </td> 
 </tr> 
 </tbody> 
</table>

1.  定义强弱函数名strong\_alias

是一个宏，用来定义**强****别名**，GLIBC中大量使用，如：

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> strong_alias (_IO_fflush, __fflush_unlocked) </td> 
 </tr> 
 </tbody> 
</table>

1.  示例（f为弱函数名，\_f为强函数名）：

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> $ cat aaa.c #include &lt;stdio.h&gt; static void f() __attribute__((weakref, alias("_f"))); int main() { &nbsp;&nbsp;f(); &nbsp;&nbsp;return 0; } &nbsp; $ cat bbb.c #include &lt;stdio.h&gt; void _f() { printf("hello\n"); } </td> 
 </tr> 
 </tbody> 
</table>

如果如下方式编译，则运行时段错误：

而如下方式，则实际执行文件bbb.c中的函数“\_f”：

1.  GLIBC中weak\_alias的定义（定义在文件libc-symbols.h中）

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> /* Define ALIASNAME as a weak alias for NAME. &nbsp;&nbsp;&nbsp;If weak aliases are not available, this defines a strong alias. &nbsp;*/ # define weak_alias(name, aliasname) _weak_alias&nbsp;(name, aliasname) &nbsp; # define _weak_alias(name, aliasname) \ &nbsp;&nbsp;extern __typeof&nbsp;(name) aliasname __attribute__&nbsp;((weak, alias (#name))) \ &nbsp;&nbsp;&nbsp;&nbsp;__attribute_copy__ (name); </td> 
 </tr> 
 </tbody> 
</table>

也可用weak\_hidden\_alias定义隐藏别名：

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> /* Same as WEAK_ALIAS, but mark symbol as hidden. &nbsp;*/ # define weak_hidden_alias(name, aliasname) _weak_hidden_alias (name, aliasname) &nbsp; # define _weak_hidden_alias(name, aliasname) \ &nbsp;&nbsp;extern __typeof (name) aliasname \ &nbsp;&nbsp;&nbsp;&nbsp;__attribute__ ((weak, alias (#name), __visibility__&nbsp;("hidden"))) __attribute_copy__ (name); </td> 
 </tr> 
 </tbody> 
</table>

# **附2：属性\_\_visibility\_\_** #

先看一小段代码：

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> $ cat eee.cpp #include &lt;stdio.h&gt; __attribute ((visibility("default"))) void ff1() { &nbsp;&nbsp;printf("ff1\n"); } __attribute ((visibility("hidden"))) void ff2() { &nbsp;&nbsp;printf("ff2\n"); } </td> 
 </tr> 
 </tbody> 
</table>

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> $ g++ -g -o libeee.so -fPIC -shared eee.cpp $ nm libeee.so 0000000000201030 B __bss_start 0000000000201030 b completed.6337 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;w __cxa_finalize@@GLIBC_2.2.5 0000000000000600 t deregister_tm_clones 0000000000000670 t __do_global_dtors_aux 0000000000200dd0 t __do_global_dtors_aux_fini_array_entry 0000000000200de0 d __dso_handle 0000000000200de8 d _DYNAMIC 0000000000201030 D _edata 0000000000201038 B _end 000000000000070c T _fini 00000000000006b0 t frame_dummy 0000000000200dc8 t __frame_dummy_init_array_entry 00000000000007c8 r __FRAME_END__ 0000000000201000 d _GLOBAL_OFFSET_TABLE_ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;w __gmon_start__ 00000000000005a0 T _init &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;w _ITM_deregisterTMCloneTable &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;w _ITM_registerTMCloneTable 0000000000200dd8 d __JCR_END__ 0000000000200dd8 d __JCR_LIST__ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;w _Jv_RegisterClasses &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;U puts@@GLIBC_2.2.5 0000000000000630 t register_tm_clones 0000000000201030 d __TMC_END__ 00000000000006e8 T&nbsp;_Z3ff1v 00000000000006fa t&nbsp;_Z3ff2v </td> 
 </tr> 
 </tbody> 
</table>

上面中的“T”和“t”均表示该符号文本（代码）段在，但visibility为“default”的对应大写“T”，而visibility为“hidden”的对应小写“t”，为小写“t”的符号对外并不可见。

通过下段代码，可以看到引用大写“T”的符号，可得到预期的结果：

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> $ cat fff.cpp extern void ff1(); int main() { &nbsp;&nbsp;ff1(); &nbsp;&nbsp;return 0; } &nbsp; $ g++ -g -o fff fff.cpp libeee.so -Wl,-rpath=. $ ./fff ff1 </td> 
 </tr> 
 </tbody> 
</table>

而引用小写“t”的符号，在链接时报“符号未定义”错误：

<table style="width:426.1pt;"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:426.1pt;"> $ cat fff2.cpp extern void ff2(); int main() { &nbsp;&nbsp;ff2(); &nbsp;&nbsp;return 0; } &nbsp; $ g++ -g -o fff2 fff2.cpp libeee.so -Wl,-rpath=. /tmp/ccwoSyAu.o：在函数‘main’中： /tmp/fff.cpp:3：对‘ff2()’未定义的引用 collect2: 错误：ld 返回 1 </td> 
 </tr> 
 </tbody> 
</table>