android - 使用内核模块写入内存会导致 Android 内核出现内核 oops

Question

我目前正在尝试调试现有的 android 内核，但我遇到了一些需要帮助的问题。我有内核的源码，但不想重新编译内核刷入手机，只想对手机中已有的库存内核进行调试。 Kprobes 在标准内核中启用(我通过查看/proc/kallsyms 中存在的符号列表确认了这一点)。

首先，我尝试通过编译自己的内核模块来操作内核内存。我可以通过将物理地址映射到虚拟地址，然后将其分配给指针来读取内存，如下所示:

unsigned char *my_ptr;
my_ptr = (unsigned char *)phys_to_virt((unsigned long)0x001C1D50);
printk(KERN_INFO "%02X", *my_ptr);

但是当我尝试使用以下代码写入内存时:my_ptr[0] = 0;，内核进入 panic (oops)状态，然后重启手机。从/proc/last_kmsg，我得到以下日志:

<3>[  149.720085] RKP -> Inst bf3db69c out of cpu_v7_set_pte_ext range from c01159c4 to c0115a1c
<1>[  149.720233] Unable to handle kernel paging request at virtual address c01c1d50
<1>[  149.720355] pgd = eb760000
<1>[  149.720419] [c01c1d50] *pgd=0da00011
<0>[  149.720658] Internal error: Oops: 80f [#1] PREEMPT SMP ARM
<4>[  149.720749] Modules linked in: t_mod(O) wlan(PO) mhi(O)
<4>[  149.720889] CPU: 0 PID: 5561 Comm: tmp-mksh Tainted: P        W  O 3.10.0-2413392 #1
<4>[  149.721007] task: eba75400 ti: eb01a000 task.ti: eb01a000
<4>[  149.721118] PC is at my_write+0x230/0x300 [t_mod]
<4>[  149.721216] LR is at _kstrtoull+0x28/0x74
<4>[  149.721298] pc : [<bf3db69c>]    lr : [<c03cbf4c>]    psr: 60010013
<4>[  149.721298] sp : eb01be78  ip : 0000003f  fp : 00000000
<4>[  149.721464] r10: 00000000  r9 : eb01a000  r8 : bf3dd270
<4>[  149.721550] r7 : 00000005  r6 : 00000008  r5 : eb01be7c  r4 : eb01be86
<4>[  149.721650] r3 : c01c1d48  r2 : 00000002  r1 : 00000000  r0 : 00000000
<4>[  149.721754] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
<4>[  149.721863] Control: 10c5787d  Table: 2b76006a  DAC: 00000015
<4>[  149.721954] 
<4>[  149.721954] LR: 0xc03cbecc:
<4>[  149.722038] becc  e00b3001 e1921003 0a000007 e3a01000 e1a04007 e1e00008 e1e01001 ebffbc2c
<4>[  149.722235] beec  e153000b 0152000a 33a06001 e083279a e2855001 e0233b97 e092a008 e2a3b000
<4>[  149.722439] bf0c  e7d93005 e3530000 1affffd8 eaffffde e1a00005 e8bd8ffe e92d407f e28d3010
<4>[  149.722641] bf2c  e1a06002 e523100c e1a01003 ebffffa6 e59d1004 e28d2008 e1a04000 ebffffc2
<4>[  149.722842] bf4c  e3500000 ba00000b e3d00102 0a00000b e7d42000 e0843000 e352000a 02833001
<4>[  149.723043] bf6c  e5d30000 e3500000 1a000004 e1cd40d8 e1c640f0 ea000002 e3e00021 ea000000
<4>[  149.723244] bf8c  e3e00015 e28dd010 e8bd8070 e5d03000 e353002b 02800001 eaffffde e92d4070
<4>[  149.723444] bfac  e1a06003 e59f30bc e24dd048 e1a0e000 e3510042 31a04001 23a04042 e1a05002
<4>[  149.723650] 
<4>[  149.723650] SP: 0xeb01bdf8:
<4>[  149.723745] bdf8  00000000 ed77d74c eb01be86 eb01be38 eb01be38 eb01be86 eb01be7c eb01be50
<4>[  149.723947] be18  bf3db69c 60010013 ffffffff eb01be64 bf3dd270 c0abd1d8 00000000 00000000
<4>[  149.724147] be38  00000002 c01c1d48 eb01be86 eb01be7c 00000008 00000005 bf3dd270 eb01a000
<4>[  149.724344] be58  00000000 00000000 0000003f eb01be78 c03cbf4c bf3db69c 60010013 ffffffff
<4>[  149.724526] be78  00000000 eb01be89 00000002 3230ea28 20303000 31203030 e82b0041 eb01a000
<4>[  149.724707] be98  00000800 00000000 c1219210 c024cfa4 eb01bebc e82ba000 00000002 eb7b7270
<4>[  149.724888] beb8  6400742d 00000000 ea277e50 e8e7a7f8 ed77d74c c0192094 eba75400 eb01bf78
<4>[  149.725069] bed8  00000001 e82ba000 ffffff9c c0106344 c036f940 00000002 e958e180 b85b0ab4
<4>[  149.725255] 
<4>[  149.725255] R3: 0xc01c1cc8:
<4>[  149.725339] 1cc8  e1a03007 e58db010 eb23c055 e3a01001 e5960008 eb0cee18 ebfd4d09 e1a01005
<4>[  149.725523] 1ce8  e58d7000 e1a02007 e1a0300b e5960008 eb0cf40e e1a05000 e1a01004 e5960008
<4>[  149.725706] 1d08  eb0cee0d e3550000 0a00000c e1a01005 e59f015c eb23c042 e59f0158 eb23c040
<4>[  149.725887] 1d28  e2860008 eb0cf52e e3500000 05864008 0a00003a e59f0140 eb23c039 ea000037
<4>[  149.726068] 1d48  e5981144 e3510000 00000000 e59f012c eb23c033 ea000032 e59f5124 e59f0124
<4>[  149.726251] 1d68  eb23c02f e30810d0 e3a02010 e5950018 eb01e34a e2506000 1a000003 e59f1108
<4>[  149.726451] 1d88  e59f0108 eb23c026 ea000024 e3a01010 e59f20fc e3e03000 eb081633 e5950020
<4>[  149.726651] 1da8  e30810d0 e3a02c01 e58d6020 eb01e33b e2505000 1a000004 e59f00d0 e59f10c8
<4>[  149.726857] 
<4>[  149.726857] R4: 0xeb01be06:
<4>[  149.726950] be04  eb01be38 eb01be38 eb01be86 eb01be7c eb01be50 bf3db69c 60010013 ffffffff
<4>[  149.727153] be24  eb01be64 bf3dd270 c0abd1d8 00000000 00000000 00000002 c01c1d48 eb01be86
<4>[  149.727353] be44  eb01be7c 00000008 00000005 bf3dd270 eb01a000 00000000 00000000 0000003f
<4>[  149.727552] be64  eb01be78 c03cbf4c bf3db69c 60010013 ffffffff 00000000 eb01be89 00000002
<4>[  149.727751] be84  3230ea28 20303000 31203030 e82b0041 eb01a000 00000800 00000000 c1219210
<4>[  149.727951] bea4  c024cfa4 eb01bebc e82ba000 00000002 eb7b7270 6400742d 00000000 ea277e50
<4>[  149.728151] bec4  e8e7a7f8 ed77d74c c0192094 eba75400 eb01bf78 00000001 e82ba000 ffffff9c
<4>[  149.728351] bee4  c0106344 c036f940 00000002 e958e180 b85b0ab4 eb01bf80 c03681d0 00000000
<4>[  149.728534] bf04  ef00e400 00000001 b85b0ab4 00000001 c0241a04 00000020 a8279bb7 eb05dcbc
<4>[  149.728719] 
<4>[  149.728719] R5: 0xeb01bdfc:
<4>[  149.728803] bdfc  ed77d74c eb01be86 eb01be38 eb01be38 eb01be86 eb01be7c eb01be50 bf3db69c
<4>[  149.728986] be1c  60010013 ffffffff eb01be64 bf3dd270 c0abd1d8 00000000 00000000 00000002
<4>[  149.729166] be3c  c01c1d48 eb01be86 eb01be7c 00000008 00000005 bf3dd270 eb01a000 00000000
<4>[  149.729347] be5c  00000000 0000003f eb01be78 c03cbf4c bf3db69c 60010013 ffffffff 00000000
<4>[  149.729528] be7c  eb01be89 00000002 3230ea28 20303000 31203030 e82b0041 eb01a000 00000800
<4>[  149.729710] be9c  00000000 c1219210 c024cfa4 eb01bebc e82ba000 00000002 eb7b7270 6400742d
<4>[  149.729891] bebc  00000000 ea277e50 e8e7a7f8 ed77d74c c0192094 eba75400 eb01bf78 00000001
<4>[  149.730072] bedc  e82ba000 ffffff9c c0106344 c036f940 00000002 e958e180 b85b0ab4 eb01bf80
<4>[  149.730256] 
<4>[  149.730256] R9: 0xeb019f80:
<4>[  149.730347] 9f80  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
<4>[  149.730544] 9fa0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
<4>[  149.730742] 9fc0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
<4>[  149.730939] 9fe0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
<4>[  149.731136] a000  00000200 00000001 00000000 eba75400 c1240d78 00000000 00000015 eba75400
<4>[  149.731336] a020  c5151f00 eb01a000 c120df00 ed5fb500 00000000 ed2f1500 eb01be7c eb01bdf0
<4>[  149.731538] a040  c0abba1c 00000000 00000000 00000004 00000000 00000000 01010000 00000000
<4>[  149.731737] a060  b6f23f24 00000000 00000000 00000000 00000000 00000000 00000000 00000000
<0>[  149.731944] Process tmp-mksh (pid: 5561, stack limit = 0xeb01a238)
<0>[  149.732053] Stack: (0xeb01be78 to 0xeb01c000)
<0>[  149.732145] be60:                                                       00000000 eb01be89
<0>[  149.732295] be80: 00000002 3230ea28 20303000 31203030 e82b0041 eb01a000 00000800 00000000
<0>[  149.732425] bea0: c1219210 c024cfa4 eb01bebc e82ba000 00000002 eb7b7270 6400742d 00000000
<0>[  149.732554] bec0: ea277e50 e8e7a7f8 ed77d74c c0192094 eba75400 eb01bf78 00000001 e82ba000
<0>[  149.732684] bee0: ffffff9c c0106344 c036f940 00000002 e958e180 b85b0ab4 eb01bf80 c03681d0
<0>[  149.732812] bf00: 00000000 ef00e400 00000001 b85b0ab4 00000001 c0241a04 00000020 a8279bb7
<0>[  149.732942] bf20: eb05dcbc eb05dc80 00000000 eb05dcbc 00000001 c0287c78 eb01bf80 e958e180
<0>[  149.733071] bf40: 00000005 b85b0ab4 eb01bf80 b85b0ab4 00000005 c0240328 e958e180 b85b0ab4
<0>[  149.733199] bf60: 00000005 00000000 00000000 e958e180 00000000 b85b0ab4 00000005 c0240680
<0>[  149.733325] bf80: 00000000 00000000 00000005 00000003 00000005 00000001 00000004 c0106344
<0>[  149.733454] bfa0: 00000200 c0106328 00000003 00000005 00000001 b85b0ab4 00000005 ffffffff
<0>[  149.733580] bfc0: 00000003 00000005 00000001 00000004 b85b0ab4 00000000 00000000 00000000
<0>[  149.733715] bfe0: 00000000 bef89528 b6f34d75 b6ed34ac 20010010 00000001 00000000 00000000
<4>[  149.733918] [<bf3db69c>] (my_write+0x230/0x300 [t_mod]) from [<c0287c78>] (proc_reg_write+0x60/0x90)
<4>[  149.734116] [<c0287c78>] (proc_reg_write+0x60/0x90) from [<c0240328>] (vfs_write+0xcc/0x174)
<4>[  149.734288] [<c0240328>] (vfs_write+0xcc/0x174) from [<c0240680>] (SyS_write+0x38/0x64)
<4>[  149.734457] [<c0240680>] (SyS_write+0x38/0x64) from [<c0106328>] (__sys_trace_return+0x0/0x18)
<0>[  149.734617] Code: e3a01010 eb3fc49f e5983004 e59d2008 (e7c32006) 
<4>[  149.738191] ---[ end trace dec6997083161644 ]---
<0>[  149.738295] Kernel panic - not syncing: Fatal exception

我认为这与我的内核模块有关，所以我继续使用内核中可用的 kprobes 函数(主要是 register_kprobe)，如下所示:

static struct kprobe kp = {
    .symbol_name    = "do_fork",
    .pre_handler = handler_pre,
    .post_handler = handler_post,
    .fault_handler = handler_fault,
};

static int __init kprobe_init(void)
{
    int ret;    
    ret = register_kprobe(&kp);
    if (ret < 0) {
        printk(KERN_INFO "register_kprobe failed, returned %d\n", ret);
        return ret;
    }
    printk(KERN_INFO "Planted kprobe at %p\n", kp.addr);
    return 0;
}

当我用上面的代码插入内核模块时，同样的事情发生了，内核产生了一个 panic (oops)，然后它重新启动了手机。记录的 last_kmsg 与我上面提供的大致相同。

如果熟悉该领域的人能帮助我解决上述问题，我将不胜感激。我想知道Android系统有没有实现内存保护。在我以前的手机中，当/dev/mem 仍然在内核中实现时，我可以根据需要通过驱动程序读取/写入内存。我试过 ioremap 但它只返回 NULL 指针。提前致谢!

编辑:对上面的混淆感到抱歉，我以 0x12345678 为例，我从/proc/kallsyms 获取地址，并将其转换为物理地址。例如，如果它是 0xc01c1d50，我需要从中减去 0xc0008000，并且由于内核本身的起始偏移量为 0x00008000，我会将其添加到结果中，因此它将是 0x001C1D50。

这是我尝试使用 register_kprobe() 注册 kprobe 时/proc/last_kmsg 的输出:

<3>[  184.769314] RKP -> Inst c0abe2a0 out of cpu_v7_set_pte_ext range from c01159c4 to c0115a1c
<1>[  184.769369] Unable to handle kernel paging request at virtual address c0170ce4
<1>[  184.769416] pgd = dc828000
<1>[  184.769439] [c0170ce4] *pgd=0da00011
<0>[  184.769535] Internal error: Oops: 80f [#1] PREEMPT SMP ARM
<4>[  184.769572] Modules linked in: kp_mod(O+) wlan(PO) mhi(O)
<4>[  184.769620] CPU: 0 PID: 5835 Comm: insmod Tainted: P        W  O 3.10.0-2413392 #1
<4>[  184.769665] task: ea0cf8c0 ti: de9a0000 task.ti: de9a0000
<4>[  184.769706] PC is at __patch_text+0x24/0x3c
<4>[  184.769734] LR is at __patch_text+0x1c/0x3c
<4>[  184.769764] pc : [<c0abe2a0>]    lr : [<c0abe298>]    psr: 800f0093
<4>[  184.769764] sp : de9a1df8  ip : 00000000  fp : 0000001c
<4>[  184.769830] r10: e9a0b0c0  r9 : 00000000  r8 : bf3dd008
<4>[  184.769862] r7 : 00000000  r6 : 00000000  r5 : e7f001f8  r4 : c0170ce4
<4>[  184.769901] r3 : 0da00411  r2 : dc82b004  r1 : c0170ce4  r0 : c0170ce4
<4>[  184.769942] Flags: Nzcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
<4>[  184.769984] Control: 10c5787d  Table: 1c82806a  DAC: 00000015
<4>[  184.770019] 
<4>[  184.770019] PC: 0xc0abe220:
<4>[  184.770049] e220  e12fff33 e8bd81f0 e592300c e3a00002 e5813004 e8bd81f0 e592300c e5813004
<4>[  184.770116] e240  e5913000 e5830000 e3a00001 e8bd81f0 e1a00005 e8bd81f0 e1a0000c e8bd81f0
<4>[  184.770186] e260  e3a00000 e8bd81f0 e1a0f00e c0b00714 dddddddd 22222222 00020103 e92d4037
<4>[  184.770257] e280  e1a04000 e28d0004 e1a05001 ebd95615 e1a00004 ebd9561f e1a01004 e1a00004
<4>[  184.770327] e2a0  e4815004 ebd95ba5 ebd95646 e28d0004 ebd95613 e8bd803e eaffffef e5902030
<4>[  184.770398] e2c0  e5903014 e3c204ff e3120401 e1a00100 12832004 e2833008 e200c402 15812038
<4>[  184.770468] e2e0  e26cc000 e18c0000 e0833000 e581303c e12fff1e e5903030 e5900014 e3c324ff
<4>[  184.770538] e300  e1a03ba3 e280c004 e1a02102 e2800008 e581c038 e2033002 e202c402 e26cc000
<4>[  184.770610] 
<4>[  184.770610] LR: 0xc0abe218:
<4>[  184.770643] e218  eaffffb5 e592300c e12fff33 e8bd81f0 e592300c e3a00002 e5813004 e8bd81f0
<4>[  184.770713] e238  e592300c e5813004 e5913000 e5830000 e3a00001 e8bd81f0 e1a00005 e8bd81f0
<4>[  184.770784] e258  e1a0000c e8bd81f0 e3a00000 e8bd81f0 e1a0f00e c0b00714 dddddddd 22222222
<4>[  184.770853] e278  00020103 e92d4037 e1a04000 e28d0004 e1a05001 ebd95615 e1a00004 ebd9561f
<4>[  184.770919] e298  e1a01004 e1a00004 e4815004 ebd95ba5 ebd95646 e28d0004 ebd95613 e8bd803e
<4>[  184.770982] e2b8  eaffffef e5902030 e5903014 e3c204ff e3120401 e1a00100 12832004 e2833008
<4>[  184.771046] e2d8  e200c402 15812038 e26cc000 e18c0000 e0833000 e581303c e12fff1e e5903030
<4>[  184.771110] e2f8  e5900014 e3c324ff e1a03ba3 e280c004 e1a02102 e2800008 e581c038 e2033002
<4>[  184.771174] 
<4>[  184.771174] SP: 0xde9a1d78:
<4>[  184.771204] 1d78  000002d0 ffffffff 00000000 e9a0b0c0 0000001c c0230b4c 00000001 dc804980
<4>[  184.771268] 1d98  c0abe2a0 800f0093 ffffffff de9a1de4 bf3dd008 c0abd1d8 c0170ce4 c0170ce4
<4>[  184.771332] 1db8  dc82b004 0da00411 c0170ce4 e7f001f8 00000000 00000000 bf3dd008 00000000
<4>[  184.771395] 1dd8  e9a0b0c0 0000001c 00000000 de9a1df8 c0abe298 c0abe2a0 800f0093 ffffffff
<4>[  184.771459] 1df8  c0170ce4 200f0013 de9a1e08 bf3dd000 bf3dd000 c0abf000 00000000 c0ac03d8
<4>[  184.771522] 1e18  bf3dd04c bf3dd000 bf3dd058 00000001 bf3e0000 00000000 e9a0b0c0 bf3e0010
<4>[  184.771589] 1e38  de9a0000 bf3dd04c de9a1f58 c010065c bf3e1000 00000001 ffffffff 00000000
<4>[  184.771659] 1e58  bf3e2000 00000002 bf3e0000 bf3dd04c de9a1f58 bf3dd058 00000001 bf3dd094
<4>[  184.771730] 
<4>[  184.771730] R0: 0xc0170c64:
<4>[  184.771763] 0c64  eafffe41 e1a00004 e28dd01c e8bd8ff0 20000100 c1443500 003000d0 c12f4a00
<4>[  184.771834] 0c84  57ac6e9d c1242858 c0ebd7ae c01779ec c0ebd7c2 c1443524 c0ebd7d4 c12f83bc
<4>[  184.771905] 0ca4  c0ebd7eb c1242fe0 c1212040 c0ebb032 c1220cb8 c120a758 c12f8744 e1a0200d
<4>[  184.771975] 0cc4  e3a01000 e3c23d7f e3c3303f e593200c e58202e8 e593000c e1a02001 ea007583
<4>[  184.772045] 0ce4  e3100203 e92d45f0 e1a05000 e24dd01c e1a08003 0a000001 e3100906 1a0000ba
<4>[  184.772115] 0d04  e3150502 13a06000 1a000011 e3150901 13a06002 1a000004 e6ef6075 e3560011
<4>[  184.772185] 0d24  03a06001 13a06003 eaffffff e1a0c00d e2860003 e3cc3d7f e3a0c001 e3c3303f
<4>[  184.772255] 0d44  e593300c e5933010 e013301c 03a06000 eaffffff e59f32c4 e59f02c0 e0053003
<4>[  184.772323] 
<4>[  184.772323] R1: 0xc0170c64:
<4>[  184.772353] 0c64  eafffe41 e1a00004 e28dd01c e8bd8ff0 20000100 c1443500 003000d0 c12f4a00
<4>[  184.772417] 0c84  57ac6e9d c1242858 c0ebd7ae c01779ec c0ebd7c2 c1443524 c0ebd7d4 c12f83bc
<4>[  184.772481] 0ca4  c0ebd7eb c1242fe0 c1212040 c0ebb032 c1220cb8 c120a758 c12f8744 e1a0200d
<4>[  184.772544] 0cc4  e3a01000 e3c23d7f e3c3303f e593200c e58202e8 e593000c e1a02001 ea007583
<4>[  184.772608] 0ce4  e3100203 e92d45f0 e1a05000 e24dd01c e1a08003 0a000001 e3100906 1a0000ba
<4>[  184.772671] 0d04  e3150502 13a06000 1a000011 e3150901 13a06002 1a000004 e6ef6075 e3560011
<4>[  184.772735] 0d24  03a06001 13a06003 eaffffff e1a0c00d e2860003 e3cc3d7f e3a0c001 e3c3303f
<4>[  184.772799] 0d44  e593300c e5933010 e013301c 03a06000 eaffffff e59f32c4 e59f02c0 e0053003
<4>[  184.772863] 
<4>[  184.772863] R2: 0xdc82af84:
<4>[  184.772893] af84  00000000 00000000 00000000 00000000 00000000 00000000 00000000 2b57f835
<4>[  184.772956] afa4  2b57fc35 00000000 00000000 00000000 00000000 00000000 00000000 2c501811
<4>[  184.773025] afc4  2c501c11 2a5ad811 2a5adc11 2a61e811 2a61ec11 00000000 00000000 00000000
<4>[  184.773094] afe4  00000000 00000000 00000000 00000000 00000000 304f2811 304f2c11 0da00011
<4>[  184.773163] b004  0da00411 0021940e 0031940e 0041940e 0051940e 0061940e 0071940e 0081940e
<4>[  184.773233] b024  0091940e 00a1940e 0da00811 0da00c11 0da01011 0da01411 0da01811 0da01c11
<4>[  184.773303] b044  0da02011 0da02411 0da02811 0da02c11 0da03011 0da03411 0da03811 0da03c11
<4>[  184.773373] b064  0da04011 0da04411 0da04811 0da04c11 0da05011 0da05411 0da05811 0da05c11
<4>[  184.773445] 
<4>[  184.773445] R4: 0xc0170c64:
<4>[  184.773478] 0c64  eafffe41 e1a00004 e28dd01c e8bd8ff0 20000100 c1443500 003000d0 c12f4a00
<4>[  184.773549] 0c84  57ac6e9d c1242858 c0ebd7ae c01779ec c0ebd7c2 c1443524 c0ebd7d4 c12f83bc
<4>[  184.773619] 0ca4  c0ebd7eb c1242fe0 c1212040 c0ebb032 c1220cb8 c120a758 c12f8744 e1a0200d
<4>[  184.773690] 0cc4  e3a01000 e3c23d7f e3c3303f e593200c e58202e8 e593000c e1a02001 ea007583
<4>[  184.773754] 0ce4  e3100203 e92d45f0 e1a05000 e24dd01c e1a08003 0a000001 e3100906 1a0000ba
<4>[  184.773817] 0d04  e3150502 13a06000 1a000011 e3150901 13a06002 1a000004 e6ef6075 e3560011
<4>[  184.773881] 0d24  03a06001 13a06003 eaffffff e1a0c00d e2860003 e3cc3d7f e3a0c001 e3c3303f
<4>[  184.773944] 0d44  e593300c e5933010 e013301c 03a06000 eaffffff e59f32c4 e59f02c0 e0053003
<4>[  184.774009] 
<4>[  184.774009] R5: 0xe7f00178:
<4>[  184.774039] 0178  000406ab 0000d2ab 06ae06ac 0000cd09 06ae06ad 0000cd09 1cbd06ae 0000957c
<4>[  184.774104] 0198  058006ae 00009595 048106ae 00009596 04fb06ae 00009597 04fb06ae 00009598
<4>[  184.774168] 01b8  04fb06ae 00009599 080106ae 000096e5 07c306ae 000097c9 00ec06ae 00009813
<4>[  184.774231] 01d8  050206ae 00009852 067606ae 00009859 1dd806ae 000098ec 04fb06ae 00009b4e
<4>[  184.774294] 01f8  18a606ae 00009c0f 058006ae 00009c10 0bdc06ae 00009c62 1c2706ae 00009ca0
<4>[  184.774358] 0218  1e5a06ae 0000a03a 1dd806ae 0000a210 058006ae 0000a288 058006ae 0000a289
<4>[  184.774427] 0238  0d4806af 00009850 056306af 00009b3f 04f206af 00009cc3 000406af 0000a023
<4>[  184.774497] 0258  1e5a06af 0000a03a 073406b0 0000957b 005306b2 000095b4 080206b2 000096c6
<4>[  184.774568] 
<4>[  184.774568] R10: 0xe9a0b040:
<4>[  184.774602] b040  e9a0b680 e9a0b044 e9a0b044 bf3dd094 00000000 c12611f4 dc804840 00000001
<4>[  184.774673] b060  00000003 00000000 00000000 00000000 00000000 00000000 00000000 00000000
<4>[  184.774742] b080  000136ad eba6ec05 eaee9984 ea766f84 c329f811 deb3c7d0 ea9b0b10 00000000
<4>[  184.774812] b0a0  debf6ba0 e9fd2a00 debf6b80 000001c9 00000001 00000001 00000000 00000000
<4>[  184.774882] b0c0  e9a0b040 00000001 eb9600c0 00000124 00000024 bf3dc0c4 c01c1f6c 00000000
<4>[  184.774952] b0e0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
<4>[  184.775021] b100  00000001 00000000 eb960fc0 eb9600c0 eb960b50 00000000 00000000 00000000
<4>[  184.775091] b120  00000000 5499790f e9824578 00000000 00000000 81240002 00001c0d 00000000
<0>[  184.775159] Process insmod (pid: 5835, stack limit = 0xde9a0238)
<0>[  184.775195] Stack: (0xde9a1df8 to 0xde9a2000)
<0>[  184.775225] 1de0:                                                       c0170ce4 200f0013
<0>[  184.775275] 1e00: de9a1e08 bf3dd000 bf3dd000 c0abf000 00000000 c0ac03d8 bf3dd04c bf3dd000
<0>[  184.775324] 1e20: bf3dd058 00000001 bf3e0000 00000000 e9a0b0c0 bf3e0010 de9a0000 bf3dd04c
<0>[  184.775373] 1e40: de9a1f58 c010065c bf3e1000 00000001 ffffffff 00000000 bf3e2000 00000002
<0>[  184.775422] 1e60: bf3e0000 bf3dd04c de9a1f58 bf3dd058 00000001 bf3dd094 00000001 e9a0b0c0
<0>[  184.775472] 1e80: 0000001c c01c524c bf3dd058 00007fff c03d6a48 c023007c de9a0000 00000028
<0>[  184.775521] 1ea0: 00000000 c01c1ff4 00000000 c1218444 bf3dd1a0 00000041 c0b093fc f09ddd90
<0>[  184.775570] 1ec0: de9a1edc be8c93c4 de9a1f0c c1055198 00000000 00000000 00000000 00000000
<0>[  184.775619] 1ee0: 00000000 00000000 6e72656b 00006c65 00000000 00000000 00000000 00000000
<0>[  184.775669] 1f00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
<0>[  184.775724] 1f20: 00000000 a8279bb7 000000d2 b6d3f008 00015a68 be8c93c4 00000080 c0106344
<0>[  184.775780] 1f40: de9a0000 00000200 00015a68 c01c5670 00000080 00000080 f09cd000 00015a68
<0>[  184.775836] 1f60: f09dd700 f09dd54a f09e2940 00003000 00003130 00000000 00000000 00000000
<0>[  184.775892] 1f80: 0000002a 0000002b 00000015 00000012 00000010 00000000 00015a68 b6d3f008
<0>[  184.775948] 1fa0: b6f7fc74 c0106328 00015a68 b6d3f008 b6d3f008 00015a68 be8c93c4 00000000
<0>[  184.776004] 1fc0: 00015a68 b6d3f008 b6f7fc74 00000080 be8c9844 00000038 00000002 00015a68
<0>[  184.776059] 1fe0: 00000004 be8c9348 b6f66785 b6efc7f0 600b0010 b6d3f008 00000000 00000000
<4>[  184.776127] [<c0abe2a0>] (__patch_text+0x24/0x3c) from [<c0abf000>] (arm_kprobe+0x24/0x34)
<4>[  184.776188] [<c0abf000>] (arm_kprobe+0x24/0x34) from [<c0ac03d8>] (register_kprobe+0x4f0/0x58c)
<4>[  184.776256] [<c0ac03d8>] (register_kprobe+0x4f0/0x58c) from [<bf3e0010>] (kprobe_init+0x10/0x1000 [kp_mod])
<4>[  184.776325] [<bf3e0010>] (kprobe_init+0x10/0x1000 [kp_mod]) from [<c010065c>] (do_one_initcall+0xcc/0x180)
<4>[  184.776391] [<c010065c>] (do_one_initcall+0xcc/0x180) from [<c01c524c>] (load_module+0x1c98/0x1fc0)
<4>[  184.776450] [<c01c524c>] (load_module+0x1c98/0x1fc0) from [<c01c5670>] (SyS_init_module+0xfc/0x11c)
<4>[  184.776508] [<c01c5670>] (SyS_init_module+0xfc/0x11c) from [<c0106328>] (__sys_trace_return+0x0/0x18)
<0>[  184.776563] Code: e1a00004 ebd9561f e1a01004 e1a00004 (e4815004) 
<4>[  184.776608] ---[ end trace dec6997083161644 ]---
<0>[  184.776642] Kernel panic - not syncing: Fatal exception

编辑 2:我尝试使用以下代码进行页面遍历并将 pte 设置为可写，但写入该地址会导致内核死机并再次重启。

unsigned long my_addr = 0x1C1D50;
pgd = pgd_offset(mm, my_addr);
if (pgd_none(*pgd) || pgd_bad(*pgd))
    goto out;
prints("Valid pgd: [%08lx] *pgd=%08llx\n", my_addr, (long long)pgd_val(*pgd));

pud = pud_offset(pgd, my_addr);
if (pud_none(*pud) || pud_bad(*pud))
    goto out;
prints("Valid pud\n");

pmd = pmd_offset(pud, my_addr);
if (pmd_none(*pmd) || pmd_bad(*pmd))
    goto out;
prints("Valid pmd\n");

ptep = pte_offset_map(pmd, my_addr);
if (!ptep)
    goto out;
pte = *ptep;

page = pte_page(pte);
if (page)
    prints("page frame struct is @ %p\n", page);

if (pte_write(pte))
    prints("Pte is writable!\n");
else {
    prints("Pte is read-only!\n");
    pte = pte_mkwrite(pte);
    if (pte_write(pte)) {
        prints("Pte is now writable!\n");
        p[0] = 0x02;
        p[3] = 0x1A;
        pte = pte_wrprotect(pte);
    }
    else
        prints("Pte is still read-only!\n");
}

对这个问题有什么见解吗？

Answer 1

虚拟到物理的映射是由硬件控制的。需要对硬件，特别是内存管理单元 (MMU) 进行编程，以了解虚拟到物理的映射是什么。此外，phys_to_virt 不会使用 MMU 设置任何虚拟到物理的映射。事实上，根据架构，它只是在做一个简单的计算:

#define __phys_to_virt(x)       ((unsigned long)((x) - PHYS_OFFSET + PAGE_OFFSET))

static inline void *phys_to_virt(phys_addr_t x)
{
    return (void *)(__phys_to_virt(x));
}

这取自 ARM64 Linux kernel .我假设是 ARM64，因为我们正在谈论 Android，但总体思路适用于 x86 和 ARM 32 位。

这个简单的偏移量计算之所以有效，是因为 phys_to_virt 仅在传递内核映射中的物理地址时有效。取自this Linux doc :

The returned virtual address is a current CPU mapping for the memory address given. It is only valid to use this function on addresses that have a kernel mapping

This function does not handle bus mappings for DMA transfers. In almost all conceivable cases a device driver should not be using this function

总而言之，您不能为物理地址传入任何随机值并期望 phys_to_virt 正常工作。

根据问题更新和评论更新:

如果您能够从内存位置读取但不能写入它，那么很可能它已被 MMU 数据结构标记为只读。一些互联网搜索表明，有一些补丁和建议可以使 ARM Linux 内核的文本和只读部分变为只读。