我正在Linux内核中编写一个系统调用,它给出了一个虚拟地址和一个无符号长指针,找到相应的页表条目,然后将其内容复制到无符号长指针中。这是系统调用:
SYSCALL_DEFINE2(readMMU, unsigned long, vaddr, unsigned long*, pte) {
unsigned long* kernel_pte;
unsigned char* page_table;
struct task_struct *pid_task;
pgd_t *pgd;
pud_t *pud;
pmd_t *pmd;
pte_t *page_te;
unsigned long n;
kernel_pte = kmalloc(sizeof(unsigned long), GFP_KERNEL);
if (copy_from_user(kernel_pte, pte, sizeof(unsigned long)) > 0) {
printk("Error: copy from user returned more than 0\n");
return -1;
}
//System call implementation in between here
printk("Getting Task\n");
pid_task = get_pid_task(find_get_pid(current->pid), PIDTYPE_PID);
printk("Getting pgd\n");
pgd = pgd_offset(pid_task->mm, vaddr);
printk("Getting pud\n");
pud = pud_offset(pgd, vaddr);
printk("Getting pmd\n");
pmd = pmd_offset(pud, vaddr);
printk("Getting pte\n");
page_te = pte_offset_kernel(pmd, vaddr);
*kernel_pte = pte_val(*page_te);
printk("Can we access pte?: %d\n", access_ok(VERIFY_WRITE, pte, sizeof(unsigned long)));
printk("Can we acces kernel_pte?: %d\n", access_ok(VERIFY_READ, kernel_pte, sizeof(unsigned long)));
if ((n = copy_to_user(pte, kernel_pte, sizeof pte)) > 0) {
printk("Error: copy to user returned more than 0\n");
printk("copy to user failed to copy this many bits: %ld\n", n);
return -1;
}
kfree(kernel_pte);
return 0;
}
这是调用系统调用的测试程序:
int
main (int argc, char ** argv) {
unsigned long vaddr;
unsigned long *pte;
vaddr = (size_t) malloc(sizeof(unsigned long));
/* Print a friendly message */
printf ("Hello from User Space!\n");
/* Call our new system call */
syscall (181, vaddr, pte);
/* Exit the program */
return 0;
}
目前对 copy_to_user 的调用失败,返回值为 8,这意味着它没有将 kernel_pte 复制到 pte。我用 access_ok 检查了 pte 的 VERIFY_WRITE,它返回 1。但是,用 VERIFY_READ 在 kernel_pte 上调用的 acces_ok 返回 0。我不确定这是否是导致 copy_to_user 失败的原因,但查看 copy_to_user 的源代码看起来它只再次检查用户指针。所以我有点茫然为什么通话失败了。