From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.5 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,MAILING_LIST_MULTI, MIME_HTML_MOSTLY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0CB3BC4338F for ; Mon, 26 Jul 2021 02:16:36 +0000 (UTC) Received: from shelob.surriel.com (shelob.surriel.com [96.67.55.147]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 0301F60C51 for ; Mon, 26 Jul 2021 02:16:34 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 0301F60C51 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=etri.re.kr Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kernelnewbies.org Received: from localhost ([::1] helo=shelob.surriel.com) by shelob.surriel.com with esmtp (Exim 4.94.2) (envelope-from ) id 1m7qA0-0003nE-US; Sun, 25 Jul 2021 22:16:04 -0400 Received: from mscreen.etri.re.kr ([129.254.9.16]) by shelob.surriel.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (Exim 4.94.2) (envelope-from ) id 1m7q9y-0003n0-8T for kernelnewbies@kernelnewbies.org; Sun, 25 Jul 2021 22:16:03 -0400 Received: from unknown (HELO send001-relay.gov-dooray.com) (211.180.235.152) by 129.254.9.16 with ESMTP; 26 Jul 2021 11:15:55 +0900 X-Original-SENDERIP: 211.180.235.152 X-Original-MAILFROM: ckim@etri.re.kr X-Original-RCPTTO: kernelnewbies@kernelnewbies.org Received: from [10.162.225.112] (HELO smtp002-imp.gov-dooray.com) ([10.162.225.112]) by send001-relay.gov-dooray.com with SMTP id 40aae5a660fe1adb; Mon, 26 Jul 2021 11:15:55 +0900 DKIM-Signature: a=rsa-sha256; b=FEHPOi2TA0gZ4XbPr3mFs9VB9QpuKZw/oa2ZnxwoKB7/vNqYPpWBU1soSSx/ScLCnZ5nakCp2D 69LQU18rLJh2jWsp//Dm3ByWuIrUAoSiT289/MyYZy4r3kc7JSZoy/ZB9j2SPkMCWb8IL3WCqRD8 GqcUErXcht/AdjmzzTpk1ls6AbMQQ8tsFZivgTI1qZBBgojek2q1JLJAmYpDhJBm36fsQaNUgYGp Th6QulYobJtoeJtiWLO0U36Pr+H7XZtD0RhkmDr4e2R6Y52FU18Wmp/tTkaP1FzHwMMgdPMfpTJw bALUoObUrF4V+0FIarpY3GBGXrlvXZOcMkOVJJgw==; c=relaxed/relaxed; s=selector; d=dooray.com; v=1; bh=4LMHfxpNC5Q6BUnjUckwwAsJJKzZYhGS18DeINcYsNI=; h=From:To:Subject:Message-ID; Received: from [129.254.132.39] (HELO CHANKIMPC) ([129.254.132.39]) by smtp002-imp.gov-dooray.com with SMTP id ab30fbc460fe1adb; Mon, 26 Jul 2021 11:15:55 +0900 From: To: Subject: How can I convert user virtual address to kernel virtual address and then to physical address? Date: Mon, 26 Jul 2021 11:15:53 +0900 Message-ID: <018c01d781c4$298b5810$7ca20830$@etri.re.kr> MIME-Version: 1.0 X-Mailer: Microsoft Outlook 16.0 thread-index: AdeBxB5+MJ3sdz/DTCqN+p4SbtV2Dw== Content-Language: ko X-BeenThere: kernelnewbies@kernelnewbies.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Learn about the Linux kernel List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============5230878098108349490==" Errors-To: kernelnewbies-bounces@kernelnewbies.org This is a multipart message in MIME format. --===============5230878098108349490== Content-Type: multipart/alternative; boundary="----=_NextPart_000_018D_01D7820F.99754A00" Content-Language: ko This is a multipart message in MIME format. ------=_NextPart_000_018D_01D7820F.99754A00 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi, all, I'm testing a simple character driver on qemu arm64 virtual machine. I have uint64_t args[32] array and I pass args to the ioctl data. By the way args[2] contains the address of test_val which is set to 77. I want to change this value to 78 in the driver using kernel virtual address. (ultimately I want to get the physical address of test_val and pass it to the qemu hardware model). I read I can change user virtual address to kernel land virtual address using get_user_pages function and then I can use virt_to_phys function to get the physical address from kernel land virtual address. (please correct me if I'm wrong) When I try to write 78 at the kernel virtual address for test_val, trap occurs. ## app.c ## uint64_t __attribute__(( aligned(64) )) args[32]; uint64_t test_val = 77; args[2] = (uint64_t) &test_val; // let's see it's changed to 78 printf("app : args[2] = %p, *args[2] = %lld\n", args[2], *(uint64_t *)args[2]); ioctl(fd, CallSetBareMetalMode, (uint64_t)args); ### driver.c ### static long my_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { switch(cmd) { case CallSetBareMetalMode: printk("driver:cmd = %x, arg = %lx\n", cmd, arg); copy_from_user(&args, (void __user *)arg, 8*3); printk("args[2] = %llx\n", args[2]); offs = args[2] % 4096; down_read(¤t->mm->mmap_sem); res = get_user_pages( (unsigned long)args[2], 1, 1, &pages, NULL); printk("get_user_pages done! args[2] = %px\n", args[2]); if (res) { printk(KERN_INFO "Got mmaped.\n"); kvpaddr = kmap(pages); printk("kmap done!\n"); printk(KERN_INFO "kvpaddr = %px, ofs = %x\n", kvpaddr, offs); printk("xx = %llx\n", ((unsigned long long int)(kvpaddr)+offs)); *(uint64_t *)((unsigned long long int)(kvpaddr)+offs) = 78; printk(KERN_INFO "changed value : %lld\n",\ *(uint64_t *)((unsigned int)(kvpaddr)+offs)); put_page(pages); //page_cache_release(page); printk("put_page done!\n"); } else { printk("get_user_pages failed!\n"); } up_read(¤t->mm->mmap_sem); ### run output ### args = 0x442f40 app : args[0] = 0x443040 app : args[2] = 0xffffd2e44d98, *args[2] = 77 [85194.544029] driver:cmd = 40086142, arg = 442f40 [85194.544822] args[2] = ffffd2e44d98 [85194.545613] get_user_pages done! args[2] = 0000ffffd2e44d98 [85194.546004] Got mmaped. [85194.546248] kmap done! [85194.546536] kvpaddr = ffff00001f7c0000, ofs = d98 [85194.546976] kvaddr = ffff00001f7c0d98 [85194.548645] Unable to handle kernel paging request at virtual address 000000001f7c0d98 [85194.549245] Mem abort info: [85194.549513] ESR = 0x96000006 [85194.549929] EC = 0x25: DABT (current EL), IL = 32 bits [85194.550364] SET = 0, FnV = 0 [85194.550719] EA = 0, S1PTW = 0 [85194.551008] Data abort info: [85194.551555] ISV = 0, ISS = 0x00000006 [85194.551938] CM = 0, WnR = 0 [85194.552609] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000568fb000 [85194.553441] [000000001f7c0d98] pgd=0000000056209003, pud=0000000047b97003, pmd=0000000000000000 [85194.555783] Internal error: Oops: 96000006 [#16] SMP [85194.556761] Modules linked in: chr_drv_ex1(OE) nls_iso8859_1 dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua qemu_fw_cfg sch_fq_codel ppdev lp parport drm ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor xor_neon raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_ce ghash_ce sm4_ce sm4_generic sm3_ce sm3_generic sha3_ce sha3_generic sha512_ce sha512_arm64 sha2_ce sha256_arm64 sha1_ce virtio_net net_failover virtio_blk failover aes_neon_bs aes_neon_blk aes_ce_blk crypto_simd cryptd aes_ce_cipher [last unloaded: chr_drv_ex1] [85194.563741] CPU: 2 PID: 4258 Comm: test_axpu_app Tainted: G D W OE 5.4.0-77-generic #86-Ubuntu [85194.564638] Hardware name: QEMU QEMU Ab21q Virtual Machine, BIOS 0.0.0 02/06/2015 [85194.565687] pstate: 60400005 (nZCv daif +PAN -UAO) [85194.568143] pc : my_ioctl+0x310/0x370 [chr_drv_ex1] [85194.568854] lr : my_ioctl+0x300/0x370 [chr_drv_ex1] [85194.569473] sp : ffff80001372bd30 [85194.569838] x29: ffff80001372bd30 x28: ffff000009f7bc00 [85194.570354] x27: 0000000000000000 x26: 0000000000000000 [85194.570796] x25: 0000000056000000 x24: ffff00000d3c35e0 [85194.571308] x23: ffff000016875600 x22: 0000000000000d98 [85194.571870] x21: 000000001f7c0d98 x20: 0000000000442f40 [85194.572273] x19: ffff00001f7c0000 x18: 0000000000000010 [85194.572669] x17: 0000000000000000 x16: 0000000000000000 [85194.573126] x15: ffff000009f7c128 x14: ffffffffffffffff [85194.573632] x13: ffff80009372ba77 x12: ffff80001372ba7f [85194.574127] x11: ffff800011b9e000 x10: 0000000000000000 [85194.574578] x9 : ffff800011db4000 x8 : 00000000000005f2 [85194.575193] x7 : 0000000000000017 x6 : ffff800011db39d4 [85194.575700] x5 : 0000000000000000 x4 : ffff00001feb5250 [85194.576139] x3 : ffff00001fec56c8 x2 : 0000000000000000 [85194.576550] x1 : 0000000000000000 x0 : ffff80000924b220 [85194.577379] Call trace: [85194.577805] my_ioctl+0x310/0x370 [chr_drv_ex1] [85194.579423] do_vfs_ioctl+0xc64/0xe60 [85194.579846] ksys_ioctl+0x88/0xb8 [85194.580116] __arm64_sys_ioctl+0x2c/0x228 [85194.580479] el0_svc_common.constprop.0+0xe4/0x1f0 [85194.580929] el0_svc_handler+0x38/0xa8 [85194.581293] el0_svc+0x10/0x2c8 [85194.582065] Code: d28009c0 f8336ac0 b0000000 91088000 (f94002a1) [85194.583646] ---[ end trace bd1ac75ca265aec2 ]--- [85194.590696] Device File closed.. Segmentation fault (core dumped) I thought I changed the user virtual address to kernel virtual address, but writing to the kernel virtual address causes trap. Can anyone help me with finding what is wrong here? Thank you for reading. Chan Kim ------=_NextPart_000_018D_01D7820F.99754A00 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi, all,

 

I’m testing a simple = character driver on qemu arm64 virtual machine.

I have uint64_t args[32] array and = I pass args to the ioctl data.

By the way args[2] contains the = address of test_val which is set to 77. I want to change this value to = 78 in the driver using kernel virtual address.

(ultimately I want to get the = physical address of test_val and pass it to the qemu hardware = model).

I = read I can change user virtual address to kernel land virtual address = using get_user_pages function and then I can use virt_to_phys function = to get the physical address from kernel land virtual = address.

(please correct me if I’m = wrong)

When = I try to write 78 at the kernel virtual address for test_val, trap = occurs.

 

## app.c ## 

    uint64_t = __attribute__(( aligned(64) )) args[32];

    uint64_t = test_val =3D 77;

    args[2] =3D (uint64_t) &test_val; // = let's see it's changed to 78

    printf("app : args[2] =3D %p, *args[2] =3D %lld\n", = args[2], *(uint64_t *)args[2]);

    ioctl(fd, CallSetBareMetalMode, = (uint64_t)args);

 

### driver.c ###

 

    static long = my_ioctl(struct file *file, unsigned int cmd, unsigned long = arg)

    {

        switch(cmd) = {

        case = CallSetBareMetalMode:

          =   printk("driver:cmd =3D %x, arg =3D %lx\n", cmd, = arg);

          =   copy_from_user(&args, (void __user *)arg, = 8*3);

          =   printk("args[2] =3D %llx\n", = args[2]);

          =   offs =3D args[2] % 4096;

 

          =   = down_read(&current->mm->mmap_sem);

          =   res =3D get_user_pages( (unsigned long)args[2], 1, 1, &pages, = NULL);

          =   printk("get_user_pages done! args[2] =3D %px\n", = args[2]);

 

          =   if (res) {

          =       printk(KERN_INFO "Got = mmaped.\n");

          =       kvpaddr =3D = kmap(pages);

          =       printk("kmap = done!\n");

          =       printk(KERN_INFO "kvpaddr =3D %px, = ofs =3D %x\n", kvpaddr, offs);

          =       printk("xx =3D %llx\n", = ((unsigned long long int)(kvpaddr)+offs));

          =       *(uint64_t *)((unsigned long long = int)(kvpaddr)+offs) =3D 78;

          =       printk(KERN_INFO "changed value : = %lld\n",\

          =        *(uint64_t *)((unsigned = int)(kvpaddr)+offs));

          =       put_page(pages); = //page_cache_release(page);

          =       printk("put_page = done!\n");

          =   }

          =   else {

          =       printk("get_user_pages = failed!\n");

          =   }

          =   = up_read(&current->mm->mmap_sem);

 

### run output ###   =

 

    args =3D = 0x442f40

    app : args[0] =3D = 0x443040

    app : args[2] =3D = 0xffffd2e44d98, *args[2] =3D 77

    [85194.544029] = driver:cmd =3D 40086142, arg =3D 442f40

    [85194.544822] args[2] =3D = ffffd2e44d98

    [85194.545613] get_user_pages done! = args[2] =3D 0000ffffd2e44d98

    [85194.546004] = Got mmaped.

    [85194.546248] kmap = done!

    [85194.546536] kvpaddr =3D = ffff00001f7c0000, ofs =3D d98

    [85194.546976] = kvaddr =3D ffff00001f7c0d98

    [85194.548645] = Unable to handle kernel paging request at virtual address = 000000001f7c0d98

[85194.549245] Mem abort info:

    = [85194.549513]   ESR =3D 0x96000006

    = [85194.549929]   EC =3D 0x25: DABT (current EL), IL =3D 32 = bits

    [85194.550364]   SET =3D 0, = FnV =3D 0

    [85194.550719]   EA =3D 0, = S1PTW =3D 0

    [85194.551008] Data abort = info:

    [85194.551555]   ISV =3D 0, = ISS =3D 0x00000006

    [85194.551938]   CM =3D 0, WnR = =3D 0

    [85194.552609] user pgtable: 4k pages, = 48-bit VAs, pgdp=3D00000000568fb000

    [85194.553441] = [000000001f7c0d98] pgd=3D0000000056209003, pud=3D0000000047b97003, = pmd=3D0000000000000000

    [85194.555783] Internal error: Oops: = 96000006 [#16] SMP

    [85194.556761] Modules linked in: = chr_drv_ex1(OE) nls_iso8859_1 dm_multipath scsi_dh_rdac scsi_dh_emc = scsi_dh_alua qemu_fw_cfg sch_fq_codel ppdev lp parport drm ip_tables = x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov = async_memcpy async_pq async_xor async_tx xor xor_neon raid6_pq libcrc32c = raid1 raid0 multipath linear crct10dif_ce ghash_ce sm4_ce sm4_generic = sm3_ce sm3_generic sha3_ce sha3_generic sha512_ce sha512_arm64 sha2_ce = sha256_arm64 sha1_ce virtio_net net_failover virtio_blk failover = aes_neon_bs aes_neon_blk aes_ce_blk crypto_simd cryptd aes_ce_cipher = [last unloaded: chr_drv_ex1]

    [85194.563741] = CPU: 2 PID: 4258 Comm: test_axpu_app Tainted: = G      D W  OE     = 5.4.0-77-generic #86-Ubuntu

    [85194.564638] = Hardware name: QEMU QEMU Ab21q Virtual Machine, BIOS 0.0.0 = 02/06/2015

    [85194.565687] pstate: 60400005 (nZCv = daif +PAN -UAO)

    [85194.568143] pc : my_ioctl+0x310/0x370 = [chr_drv_ex1]

    [85194.568854] lr : my_ioctl+0x300/0x370 = [chr_drv_ex1]

    [85194.569473] sp : = ffff80001372bd30

    [85194.569838] x29: ffff80001372bd30 = x28: ffff000009f7bc00

    [85194.570354] x27: 0000000000000000 x26: 0000000000000000 =

    [85194.570796] x25: 0000000056000000 = x24: ffff00000d3c35e0

    [85194.571308] x23: ffff000016875600 = x22: 0000000000000d98

    [85194.571870] x21: 000000001f7c0d98 x20: 0000000000442f40 =

    [85194.572273] x19: = ffff00001f7c0000 x18: 0000000000000010

    [85194.572669] x17: = 0000000000000000 x16: 0000000000000000

    [85194.573126] x15: = ffff000009f7c128 x14: ffffffffffffffff

    [85194.573632] x13: = ffff80009372ba77 x12: ffff80001372ba7f

    [85194.574127] x11: ffff800011b9e000 x10: 0000000000000000 =

    [85194.574578] x9 : ffff800011db4000 = x8 : 00000000000005f2

    [85194.575193] x7 : 0000000000000017 x6 : ffff800011db39d4 =

    [85194.575700] x5 : = 0000000000000000 x4 : ffff00001feb5250

    [85194.576139] x3 : = ffff00001fec56c8 x2 : 0000000000000000

    [85194.576550] x1 : = 0000000000000000 x0 : ffff80000924b220

    [85194.577379] Call = trace:

    [85194.577805]  = my_ioctl+0x310/0x370 [chr_drv_ex1]

    = [85194.579423]  do_vfs_ioctl+0xc64/0xe60

    = [85194.579846]  ksys_ioctl+0x88/0xb8

    = [85194.580116]  = __arm64_sys_ioctl+0x2c/0x228

    = [85194.580479]  = el0_svc_common.constprop.0+0xe4/0x1f0

    [85194.580929]  = el0_svc_handler+0x38/0xa8

    = [85194.581293]  el0_svc+0x10/0x2c8

    [85194.582065] Code: d28009c0 f8336ac0 b0000000 91088000 = (f94002a1)

    [85194.583646] ---[ end trace = bd1ac75ca265aec2 ]---

    [85194.590696] Device File = closed..

    Segmentation fault (core = dumped)

 

I thought I changed the user virtual address to kernel = virtual address, but writing to the kernel virtual address causes trap. =

Can anyone = help me with finding what is wrong here?

Thank you for = reading.

 

Chan Kim

 

------=_NextPart_000_018D_01D7820F.99754A00-- --===============5230878098108349490== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies --===============5230878098108349490==--