通过/dev/mem只能访问high_memory高端内存以下的内核线性地址空间
来源：互联网 发布：安卓博德之门2修改数据 编辑：程序博客网 时间：2024/05/01 08:40
本文转载至：http://blog.chinaunix.net/uid-20564848-id-74706.html
通过/dev/mem只能访问高端内存以下的内核线性地址空间
《/proc/iomem和/proc /ioports对应的fops》
《浅析pc机上如何将vmlinuz- 2.6.31-14-generic解压出vmlinux》
fs_initcall(chr_dev_init);
chr_dev_init
==> register_chrdev(MEM_MAJOR,"mem",&memory_fops); // 建立/dev/mem字符节点
memory_open会根据inode的minor来定位具体的fops,
比如
1,1为mem_fops
1,2为kmem_fops
1,8为random_fops
等等(具体见下面的devlist[])
static const struct file_operations memory_fops = {
.open = memory_open, /* just a selector for the real open */
};
static const struct {
unsigned int minor;
char *name;
umode_t mode;
const struct file_operations *fops;
} devlist[] = { /* list of minor devices */
#ifdef CONFIG_DEVMEM
{1, "mem", S_IRUSR | S_IWUSR | S_IRGRP, &mem_fops},
{2, "kmem", S_IRUSR | S_IWUSR | S_IRGRP, &kmem_fops},
#endif
{3, "null", S_IRUGO | S_IWUGO, &null_fops},
#ifdef CONFIG_DEVPORT
{4, "port", S_IRUSR | S_IWUSR | S_IRGRP, &port_fops},
#endif
{5, "zero", S_IRUGO | S_IWUGO, &zero_fops},
{7, "full", S_IRUGO | S_IWUGO, &full_fops},
{8, "random", S_IRUGO | S_IWUSR, &random_fops},
{9, "urandom", S_IRUGO | S_IWUSR, &urandom_fops},
{11,"kmsg", S_IRUGO | S_IWUSR, &kmsg_fops},
#ifdef CONFIG_CRASH_DUMP
{12,"oldmem", S_IRUSR | S_IWUSR | S_IRGRP, &oldmem_fops},
#endif
};
static int memory_open(struct inode * inode, struct file * filp)
{
// 根据inode的minor子节点号定位具体功能驱动fops
switch (iminor(inode)) {
#ifdef CONFIG_DEVMEM
case 1:
filp->f_op = &mem_fops;
filp->f_mapping->backing_dev_info =
&directly_mappable_cdev_bdi;
break;
case 2:
filp->f_op = &kmem_fops;
filp->f_mapping->backing_dev_info =
&directly_mappable_cdev_bdi;
break;
#endif
case 3:
filp->f_op = &null_fops;
break;
#ifdef CONFIG_DEVPORT
case 4:
filp->f_op = &port_fops;
break;
#endif
case 5:
filp->f_mapping->backing_dev_info = &zero_bdi;
filp->f_op = &zero_fops;
break;
case 7:
filp->f_op = &full_fops;
break;
case 8:
filp->f_op = &random_fops;
break;
case 9:
filp->f_op = &urandom_fops;
break;
case 11:
filp->f_op = &kmsg_fops;
break;
#ifdef CONFIG_CRASH_DUMP
case 12:
filp->f_op = &oldmem_fops;
break;
#endif
default:
return -ENXIO;
}
if (filp->f_op && filp->f_op->open)
return filp->f_op->open(inode,filp);
return 0;
}
crw-rw-rw- 1 root root 1, 9 2010-05-16 09:18 urandom
crw-rw-rw- 1 root root 1, 3 2010-05-16 17:17 null
crw-rw-rw- 1 root root 1, 8 2010-05-16 17:17 random
crw-rw-rw- 1 root root 1, 5 2010-05-16 17:17 zero
brw-rw---- 1 root disk 1, 9 2010-05-16 17:17 ram9
brw-rw---- 1 root disk 1, 8 2010-05-16 17:17 ram8
brw-rw---- 1 root disk 1, 7 2010-05-16 17:18 ram7
crw-r----- 1 root kmem 1, 4 2010-05-16 17:18 port
crw-rw---- 1 root root 1, 12 2010-05-16 17:18 oldmem
crw-r----- 1 root kmem 1, 1 2010-05-16 17:18 mem
crw-rw---- 1 root root 1, 11 2010-05-16 17:18 kmsg
crw-rw-rw- 1 root root 1, 7 2010-05-16 17:18 full
我们来看看/dev/mem都能读取到些什么
static const struct file_operations mem_fops = {
.llseek = memory_lseek,
.read = read_mem,
.write = write_mem,
.mmap = mmap_mem,
.open = open_mem,
.get_unmapped_area = get_unmapped_area_mem,
};
/*
* This funcion reads the *physical* memory. The f_pos points directly to the
* memory location.
*/
static ssize_t read_mem(struct file * file, char __user * buf,
size_t count, loff_t *ppos)
{
unsigned long p = *ppos;
ssize_t read, sz;
char *ptr;
/*
// for arm
int valid_phys_addr_range(unsigned long addr, size_t size)
{
if (addr < PHYS_OFFSET) // 只能CONFIG_DRAM_BASE这个DDR物理内存首地址开始的空间~到高端内存之间内核线性地址
return 0;
if (addr + size > __pa(high_memory))
return 0;
return 1;
}
// for x86
static inline int valid_phys_addr_range(unsigned long addr, size_t count)
{
if (addr + count > __pa(high_memory)) // 只有高端内存以下的地址才能访问.
return 0;
return 1;
}
*/
if (!valid_phys_addr_range(p, count))
return -EFAULT;
read = 0;
#ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
/* we don't have page 0 mapped on sparc and m68k.. */
if (p < PAGE_SIZE) {
sz = PAGE_SIZE - p;
if (sz > count)
sz = count;
if (sz > 0) {
if (clear_user(buf, sz))
return -EFAULT;
buf += sz;
p += sz;
count -= sz;
read += sz;
}
}
#endif
while (count > 0) {
/*
* Handle first page in case it's not aligned
*/
if (-p & (PAGE_SIZE - 1))
sz = -p & (PAGE_SIZE - 1);
else
sz = PAGE_SIZE;
sz = min_t(unsigned long, sz, count);
/*
* On ia64 if a page has been mapped somewhere as
* uncached, then it must also be accessed uncached
* by the kernel or data corruption may occur
*/
ptr = xlate_dev_mem_ptr(p); // 将物理地址p转化为内核线性虚拟地址
// #define xlate_dev_mem_ptr(p) __va(p)
// #define __va(x) ((void *)((unsigned long)(x)+PAGE_OFFSET))
// #define PAGE_OFFSET ((unsigned long)__PAGE_OFFSET)
// #define __PAGE_OFFSET _AC(CONFIG_PAGE_OFFSET, UL)
// vim arch/x86/configs/i386_defconfig 我们获取的参数[luther.gliethttp]
// CONFIG_PAGE_OFFSET=0xC0000000
if (copy_to_user(buf, ptr, sz))
return -EFAULT;
buf += sz;
p += sz;
count -= sz;
read += sz;
}
*ppos += read;
return read;
}
让我们实际演练演练,我们读取释放到内存中的kernel代码
tatic struct resource code_resource = {
.name = "Kernel code",
.start = 0,
.end = 0,
.flags = IORESOURCE_BUSY | IORESOURCE_MEM
};
start_kernel
==> setup_arch
code_resource.start = virt_to_phys(_text); // _text内核代码相对DDR物理内存的偏移量,也就是内核线性地址偏移量[luther.gliethttp]
code_resource.end = virt_to_phys(_etext)-1;
data_resource.start = virt_to_phys(_etext);
data_resource.end = virt_to_phys(_edata)-1;
bss_resource.start = virt_to_phys(&__bss_start);
bss_resource.end = virt_to_phys(&__bss_stop)-1;
subsys_initcall(request_standard_resources);
request_standard_resources
==> init_iomem_resources(&code_resource, &data_resource, &bss_resource);// 这样/proc/iomem就可以看到这里设置的信息了
request_resource(res, code_resource);
request_resource(res, data_resource);
request_resource(res, bss_resource);
==> request_resource(&iomem_resource, &video_ram_resource);
luther@gliethttp:~$ cat /proc/iomem
00000000-00001fff : System RAM
00002000-00005fff : reserved
00006000-0009dbff : System RAM
0009dc00-0009ffff : reserved
000a0000-000bffff : Video RAM area
000c0000-000cefff : Video ROM
000cf000-000d07ff : Adapter ROM
000d2000-000fffff : reserved
000f0000-000fffff : System ROM
00100000-5bf0ffff : System RAM
00100000-00575553 : Kernel code
00575554-0078d307 : Kernel data
0081a000-008a809f : Kernel bss
以上的
00100000-00575553 : Kernel code
就是kernel代码存储区了
0x00100000等于1048576
0x00575553等于5723475
luther@gliethttp:~$ sudo dd bs=1 skip=1048576 count=208 if=/dev/mem 2>/dev/null | xxd -g 1
0000000: f6 86 11 02 00 00 40 75 14 0f 01 15 22 8e 74 00 ......@u....".t.
0000010: b8 18 00 00 00 8e d8 8e c0 8e e0 8e e8 fc 31 c0 ..............1.
0000020: bf 00 a0 81 00 b9 a0 80 8a 00 29 f9 c1 e9 02 f3 ..........).....
0000030: ab bf c0 56 7c 00 b9 00 04 00 00 fc f3 a5 8b 35 ...V|..........5
0000040: e8 58 7c 00 21 f6 74 0c bf e0 2a 7c 00 b9 00 02 .X|.!.t...*|....
0000050: 00 00 f3 a5 66 81 3d c6 58 7c 00 07 02 72 1c a1 ....f.=.X|...r..
0000060: fc 58 7c 00 3d 03 00 00 00 73 0e 8b 04 85 80 22 .X|.=....s....."
0000070: 7c 00 2d 00 00 00 c0 ff e0 0f 0b bf 00 90 8a 00 |.-.............
0000080: ba 00 a0 81 00 b8 03 00 00 00 8d 4f 67 89 0a 89 ...........Og...
0000090: 8a 00 0c 00 00 83 c2 04 b9 00 04 00 00 ab 05 00 ................
00000a0: 10 00 00 e2 f8 bd 03 90 a4 00 39 e8 72 dc 81 c7 ..........9.r...
00000b0: 00 00 00 c0 89 3d 80 a5 74 00 c1 e8 0c a3 84 f0 .....=..t.......
00000c0: 81 00 b8 67 b0 81 00 a3 fc af 81 00 e9 6d 6b 46 ...g.........mkF
《/proc/iomem和/proc /ioports对应的fops》
《浅析pc机上如何将vmlinuz- 2.6.31-14-generic解压出vmlinux》
fs_initcall(chr_dev_init);
chr_dev_init
==> register_chrdev(MEM_MAJOR,"mem",&memory_fops); // 建立/dev/mem字符节点
memory_open会根据inode的minor来定位具体的fops,
比如
1,1为mem_fops
1,2为kmem_fops
1,8为random_fops
等等(具体见下面的devlist[])
static const struct file_operations memory_fops = {
.open = memory_open, /* just a selector for the real open */
};
static const struct {
unsigned int minor;
char *name;
umode_t mode;
const struct file_operations *fops;
} devlist[] = { /* list of minor devices */
#ifdef CONFIG_DEVMEM
{1, "mem", S_IRUSR | S_IWUSR | S_IRGRP, &mem_fops},
{2, "kmem", S_IRUSR | S_IWUSR | S_IRGRP, &kmem_fops},
#endif
{3, "null", S_IRUGO | S_IWUGO, &null_fops},
#ifdef CONFIG_DEVPORT
{4, "port", S_IRUSR | S_IWUSR | S_IRGRP, &port_fops},
#endif
{5, "zero", S_IRUGO | S_IWUGO, &zero_fops},
{7, "full", S_IRUGO | S_IWUGO, &full_fops},
{8, "random", S_IRUGO | S_IWUSR, &random_fops},
{9, "urandom", S_IRUGO | S_IWUSR, &urandom_fops},
{11,"kmsg", S_IRUGO | S_IWUSR, &kmsg_fops},
#ifdef CONFIG_CRASH_DUMP
{12,"oldmem", S_IRUSR | S_IWUSR | S_IRGRP, &oldmem_fops},
#endif
};
static int memory_open(struct inode * inode, struct file * filp)
{
// 根据inode的minor子节点号定位具体功能驱动fops
switch (iminor(inode)) {
#ifdef CONFIG_DEVMEM
case 1:
filp->f_op = &mem_fops;
filp->f_mapping->backing_dev_info =
&directly_mappable_cdev_bdi;
break;
case 2:
filp->f_op = &kmem_fops;
filp->f_mapping->backing_dev_info =
&directly_mappable_cdev_bdi;
break;
#endif
case 3:
filp->f_op = &null_fops;
break;
#ifdef CONFIG_DEVPORT
case 4:
filp->f_op = &port_fops;
break;
#endif
case 5:
filp->f_mapping->backing_dev_info = &zero_bdi;
filp->f_op = &zero_fops;
break;
case 7:
filp->f_op = &full_fops;
break;
case 8:
filp->f_op = &random_fops;
break;
case 9:
filp->f_op = &urandom_fops;
break;
case 11:
filp->f_op = &kmsg_fops;
break;
#ifdef CONFIG_CRASH_DUMP
case 12:
filp->f_op = &oldmem_fops;
break;
#endif
default:
return -ENXIO;
}
if (filp->f_op && filp->f_op->open)
return filp->f_op->open(inode,filp);
return 0;
}
crw-rw-rw- 1 root root 1, 9 2010-05-16 09:18 urandom
crw-rw-rw- 1 root root 1, 3 2010-05-16 17:17 null
crw-rw-rw- 1 root root 1, 8 2010-05-16 17:17 random
crw-rw-rw- 1 root root 1, 5 2010-05-16 17:17 zero
brw-rw---- 1 root disk 1, 9 2010-05-16 17:17 ram9
brw-rw---- 1 root disk 1, 8 2010-05-16 17:17 ram8
brw-rw---- 1 root disk 1, 7 2010-05-16 17:18 ram7
crw-r----- 1 root kmem 1, 4 2010-05-16 17:18 port
crw-rw---- 1 root root 1, 12 2010-05-16 17:18 oldmem
crw-r----- 1 root kmem 1, 1 2010-05-16 17:18 mem
crw-rw---- 1 root root 1, 11 2010-05-16 17:18 kmsg
crw-rw-rw- 1 root root 1, 7 2010-05-16 17:18 full
我们来看看/dev/mem都能读取到些什么
static const struct file_operations mem_fops = {
.llseek = memory_lseek,
.read = read_mem,
.write = write_mem,
.mmap = mmap_mem,
.open = open_mem,
.get_unmapped_area = get_unmapped_area_mem,
};
/*
* This funcion reads the *physical* memory. The f_pos points directly to the
* memory location.
*/
static ssize_t read_mem(struct file * file, char __user * buf,
size_t count, loff_t *ppos)
{
unsigned long p = *ppos;
ssize_t read, sz;
char *ptr;
/*
// for arm
int valid_phys_addr_range(unsigned long addr, size_t size)
{
if (addr < PHYS_OFFSET) // 只能CONFIG_DRAM_BASE这个DDR物理内存首地址开始的空间~到高端内存之间内核线性地址
return 0;
if (addr + size > __pa(high_memory))
return 0;
return 1;
}
// for x86
static inline int valid_phys_addr_range(unsigned long addr, size_t count)
{
if (addr + count > __pa(high_memory)) // 只有高端内存以下的地址才能访问.
return 0;
return 1;
}
*/
if (!valid_phys_addr_range(p, count))
return -EFAULT;
read = 0;
#ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
/* we don't have page 0 mapped on sparc and m68k.. */
if (p < PAGE_SIZE) {
sz = PAGE_SIZE - p;
if (sz > count)
sz = count;
if (sz > 0) {
if (clear_user(buf, sz))
return -EFAULT;
buf += sz;
p += sz;
count -= sz;
read += sz;
}
}
#endif
while (count > 0) {
/*
* Handle first page in case it's not aligned
*/
if (-p & (PAGE_SIZE - 1))
sz = -p & (PAGE_SIZE - 1);
else
sz = PAGE_SIZE;
sz = min_t(unsigned long, sz, count);
/*
* On ia64 if a page has been mapped somewhere as
* uncached, then it must also be accessed uncached
* by the kernel or data corruption may occur
*/
ptr = xlate_dev_mem_ptr(p); // 将物理地址p转化为内核线性虚拟地址
// #define xlate_dev_mem_ptr(p) __va(p)
// #define __va(x) ((void *)((unsigned long)(x)+PAGE_OFFSET))
// #define PAGE_OFFSET ((unsigned long)__PAGE_OFFSET)
// #define __PAGE_OFFSET _AC(CONFIG_PAGE_OFFSET, UL)
// vim arch/x86/configs/i386_defconfig 我们获取的参数[luther.gliethttp]
// CONFIG_PAGE_OFFSET=0xC0000000
if (copy_to_user(buf, ptr, sz))
return -EFAULT;
buf += sz;
p += sz;
count -= sz;
read += sz;
}
*ppos += read;
return read;
}
让我们实际演练演练,我们读取释放到内存中的kernel代码
tatic struct resource code_resource = {
.name = "Kernel code",
.start = 0,
.end = 0,
.flags = IORESOURCE_BUSY | IORESOURCE_MEM
};
start_kernel
==> setup_arch
code_resource.start = virt_to_phys(_text); // _text内核代码相对DDR物理内存的偏移量,也就是内核线性地址偏移量[luther.gliethttp]
code_resource.end = virt_to_phys(_etext)-1;
data_resource.start = virt_to_phys(_etext);
data_resource.end = virt_to_phys(_edata)-1;
bss_resource.start = virt_to_phys(&__bss_start);
bss_resource.end = virt_to_phys(&__bss_stop)-1;
subsys_initcall(request_standard_resources);
request_standard_resources
==> init_iomem_resources(&code_resource, &data_resource, &bss_resource);// 这样/proc/iomem就可以看到这里设置的信息了
request_resource(res, code_resource);
request_resource(res, data_resource);
request_resource(res, bss_resource);
==> request_resource(&iomem_resource, &video_ram_resource);
luther@gliethttp:~$ cat /proc/iomem
00000000-00001fff : System RAM
00002000-00005fff : reserved
00006000-0009dbff : System RAM
0009dc00-0009ffff : reserved
000a0000-000bffff : Video RAM area
000c0000-000cefff : Video ROM
000cf000-000d07ff : Adapter ROM
000d2000-000fffff : reserved
000f0000-000fffff : System ROM
00100000-5bf0ffff : System RAM
00100000-00575553 : Kernel code
00575554-0078d307 : Kernel data
0081a000-008a809f : Kernel bss
以上的
00100000-00575553 : Kernel code
就是kernel代码存储区了
0x00100000等于1048576
0x00575553等于5723475
luther@gliethttp:~$ sudo dd bs=1 skip=1048576 count=208 if=/dev/mem 2>/dev/null | xxd -g 1
0000000: f6 86 11 02 00 00 40 75 14 0f 01 15 22 8e 74 00 ......@u....".t.
0000010: b8 18 00 00 00 8e d8 8e c0 8e e0 8e e8 fc 31 c0 ..............1.
0000020: bf 00 a0 81 00 b9 a0 80 8a 00 29 f9 c1 e9 02 f3 ..........).....
0000030: ab bf c0 56 7c 00 b9 00 04 00 00 fc f3 a5 8b 35 ...V|..........5
0000040: e8 58 7c 00 21 f6 74 0c bf e0 2a 7c 00 b9 00 02 .X|.!.t...*|....
0000050: 00 00 f3 a5 66 81 3d c6 58 7c 00 07 02 72 1c a1 ....f.=.X|...r..
0000060: fc 58 7c 00 3d 03 00 00 00 73 0e 8b 04 85 80 22 .X|.=....s....."
0000070: 7c 00 2d 00 00 00 c0 ff e0 0f 0b bf 00 90 8a 00 |.-.............
0000080: ba 00 a0 81 00 b8 03 00 00 00 8d 4f 67 89 0a 89 ...........Og...
0000090: 8a 00 0c 00 00 83 c2 04 b9 00 04 00 00 ab 05 00 ................
00000a0: 10 00 00 e2 f8 bd 03 90 a4 00 39 e8 72 dc 81 c7 ..........9.r...
00000b0: 00 00 00 c0 89 3d 80 a5 74 00 c1 e8 0c a3 84 f0 .....=..t.......
00000c0: 81 00 b8 67 b0 81 00 a3 fc af 81 00 e9 6d 6b 46 ...g.........mkF
0 0
- 通过/dev/mem只能访问high_memory高端内存以下的内核线性地址空间
- 通过/dev/mem访问物理内存问题！
- linux内核地址空间和高端内存
- Linux 内核空间地址映射 高端内存 总结
- 内核中与驱动相关的内存操作之十三(/dev/mem)
- mmap内存映射/dev/mem到用户空间
- mmap内存映射/dev/mem到用户空间 + kernel config
- 通过/dev/mem实现用户层访问GPIO寄存器
- 使用 mmap64 和 /dev/mem 访问物理内存
- 在用户空间（和内核空间）访问内存的绝对地址
- 在用户空间（和内核空间）访问内存的绝对地址
- linux 内核空间 及 高端内存详解
- webpack-dev-server 只能通过 localhost 访问？
- Linux内核地址映射模型-高端内存
- dev/mem的使用
- Linux用户空间与内核空间（理解高端内存）
- Linux 用户空间与内核空间之高端内存详解
- linux 用户空间与内核空间 (高端内存详解)
- android自适应屏幕？
- lsblk查看块设备
- uva562(DP)
- 机器学习学习，笔记及感想1
- 【C#网络编程系列】专题三：自定义web服务器
- 通过/dev/mem只能访问high_memory高端内存以下的内核线性地址空间
- STL 型别技术
- Swift入门教程系列6-闭包
- springmvc为什么要和spring整合
- C语言二维数组
- 黑马程序员：OC学习日记之self
- HDU 4565So Easy! 共轭构造+矩阵快速幂
- Codeforces Round #274 (Div. 2) c Exams
- 【数学：卡特兰数】总结
