c - 处理来自task_struct 的条目。为什么有些任务->下一个有0。如何转到下一个任务比？

Question

我了解内核模块宏 for_each_process

struct task_struct *iter; 
for_each_process(iter)
{ 
if (iter->state > 0)
{ 
  snprintf(buf, MAX_BUF_SIZE, " name: %s, pid: %d, parent id: %d, state: %ld", iter->group_leader->comm, iter->pid, iter->parent->pid, iter->state);
  print_string(buf); 
}

它应该遍历task_struct任务成员并获取下一个任务成员，即task_struct。

编写了这个用户态程序，应该做同样的事情:

列表任务.c

#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <stdbool.h>



long readtaskstruct(long address)
{

    int fd;
    void *retp = NULL;

    long addr = address; 
    long *addrp = NULL;

    long next,prev;
    long val;
    char nextstr;
    int page_size,offset;


    addrp = (long *) addr;
    page_size = getpagesize();
    val = addr & ~(page_size-1)- 0xc0000000;
    long *ptr = (long *) val;

    offset = addr & 0xfff;



    fd = open("/dev/mem", O_RDWR|O_SYNC);
    retp = mmap(NULL, 4096, PROT_READ, MAP_SHARED, fd,ptr);


    if (retp == MAP_FAILED)
    {
        printf("FAILED\n");
    }
    else
    {



        memcpy(&val,retp+(offset+784),4); //tasks next pointer
        val = val-620; //address to task_struct 
        munmap(retp,4096);

        close(fd);


    }

    return val;
}           


const char * readval(long address)
{                
    int fd;
    void *retp = NULL;


    long addr = address;
    long *addrp = NULL;

    long next,prev;
    long val;
    char *nextstr = calloc(sizeof(char),100);
    int page_size,offset;

    long *nextp = (long *) next;
    page_size = getpagesize();
    val = next & ~(page_size-1)- 0xc0000000;
    long *ptr = (long *) val; 

    offset = next & 0xfff;
    fd = open("/dev/mem", O_RDWR|O_SYNC);

    retp = mmap(NULL, 4096, PROT_READ, MAP_SHARED, fd, ptr);


    if (retp == MAP_FAILED)
    {
        printf("FAILED\n");
    }
    else
    {

        memcpy(nextstr,retp+(offset+996),100); //task->comm



        munmap(retp,4096);
    }
        return nextstr;
}
void main(void)
{


int ret = 0xc1a8cac0; //init_task

ret = readtaskstruct(ret);
printf("%s\n",readval(ret));




}

它有效。

$./list-tasks
swapper/0

但是，当我递归调用它时，即:

  int ret = 0xc1a8cac0; //init_task

  while(1)
  {  
    ret = readtaskstruct(ret);
    printf("%s\n",readval(ret));
  }

它经历了第一个任务->下一个，不知何故，任务->下一个似乎被设置为0，因为我得到的ret为0。

为什么有些任务->下一个有 0 ...我想我应该看到一个很好的进程列表，其中的进程在任务中从一个任务链接到另一个任务。为什么在第一次处理后它会以 0 中断。

有人在 list-tasks.c 中看到逻辑/编程错误吗？

更新1:

嗯..它似乎可以与 for_each_process 一起正常工作:更多信息 https://0bin.net/paste/HCkEu8+daKo9Y8Z3#+M0vkO9KmtSmBSXBnuvQi73NsU2hrq0gWzJ6U8IHU4s 。我的理解正确吗，结构体task_struct的tasks成员将有指向task_structs的next和prev成员？

嗯，我的 init_task 位于 0xc1a8cac0 ...为什么我在内核模块的 for_each_process 输出中看不到它？

好的，所以它没有在那里列出，并且它链接到下一个 0xf58c0318 ...这个链接在 0x0 旁边

刚刚与 GDB 核实

我的问题是为什么 init_task 没有在 for_each_process 宏中列出？

我想我从错误的过程开始，列表结束......

更新2:

实时调试

https://0bin.net/paste/h6YqUUQnKpIIPSMO#1mxZ5RR9zPIrbNOykeWHju58WZ-lOKhYhjaNnn/YEiq

将 list-task.c 修改为:

#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <stdbool.h>



long readtaskstruct(long address)
{

    int fd;
    void *retp = NULL;

    long addr = address; 
    long *addrp = NULL;

    long next,prev;
    long val;
    char nextstr;
    int page_size,offset;


    addrp = (long *) addr;
    page_size = getpagesize();
    val = addr & ~(page_size-1)- 0xc0000000;
    long *ptr = (long *) val;

    offset = addr & 0xfff;



    fd = open("/dev/mem", O_RDWR|O_SYNC);
    retp = mmap(NULL, 4096, PROT_READ, MAP_SHARED, fd,ptr);


    if (retp == MAP_FAILED)
    {
        printf("FAILED\n");
    }
    else
    {



        memcpy(&val,retp+(offset+620),4); //tasks next pointer
        //val = val-620; //address to task_struct 
        munmap(retp,4096);

        close(fd);


    }

    return val;
}           


const char * readval(long address)
{                
    int fd;
    void *retp = NULL;


    long addr = address;
    long *addrp = NULL;

    long next,prev;
    long val;
    char *nextstr = calloc(sizeof(char),100);
    int page_size,offset;

    long *nextp = (long *) next;
    page_size = getpagesize();
    val = addr & ~(page_size-1)- 0xc0000000;
    long *ptr = (long *) val; 

    offset = next & 0xfff;
    fd = open("/dev/mem", O_RDWR|O_SYNC);

    retp = mmap(NULL, 4096, PROT_READ, MAP_SHARED, fd, ptr);


    if (retp == MAP_FAILED)
    {
        printf("FAILED\n");
    }
    else
    {

        memcpy(nextstr,retp+(offset+996),100); //task->comm



        munmap(retp,4096);
    }
    return nextstr;
}
void main(void)
{


    int ret = 0xc1a8cac0; //init_task

    for(int i=0;i<10;i++)
    {
        printf("0x%x\n",ret);
        ret = readtaskstruct(ret);
        printf("%s\n",readval(ret));
    }


}

更新3:

甜蜜的作品。

./list-task  |more
Address:0xc1a8cac0
Process:systemd
Address:0xf58b8000
Process:kthreadd
Address:0xf58b89c0
Process:ksoftirqd/0
Address:0xf58b9380
Process:kworker/0:0H
Address:0xf58ba700
Process:rcu_sched
Address:0xf58bba80
Process:rcu_bh
Address:0xf58bc440
Process:migration/0
Address:0xf58bce00
Process:migration/1
Address:0xf58bf500
Process:ksoftirqd/1
Address:0xf58f0000
Process:kworker/1:0H
Address:0xf58f1380
Process:migration/2
Address:0xf58f1d40
Process:ksoftirqd/2
Address:0xf58f2700
Process:kworker/2:0H
Address:0xf58f3a80
Process:migration/3
Address:0xf58f4440
Process:ksoftirqd/3
Address:0xf58f4e00
Process:kworker/3:0H
Address:0xf58f6180
Process:kdevtmpfs
Address:0xf5948000
Process:netns
Address:0xf59b0000
Process:kworker/u8:1
.
.
.
Process:VBoxClient
Address:0xf594d7c0
Process:VBoxClient
Address:0xf0f0e180
Process:VBoxClient
Address:0xf513b0c0
FAILED
FAILED
Process:
Address:0x3513b000
FAILED
FAILED
Process:
Address:0x3513b000

列表任务.c

#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <stdbool.h>



long readtaskstruct(long address)
{

    int fd;
    void *retp = NULL;

    long addr = address; 
    long *addrp = NULL;

    long next,prev;
    long val;
    char nextstr;
    int page_size,offset;


    addrp = (long *) addr;
    page_size = getpagesize();
    val = addr & ~(page_size-1)- 0xc0000000;
    long *ptr = (long *) val;

    offset = addr & 0xfff;



    fd = open("/dev/mem", O_RDWR|O_SYNC);
    retp = mmap(NULL, 4096*4, PROT_READ, MAP_SHARED, fd,ptr);


    if (retp == MAP_FAILED)
    {
        printf("FAILED\n");
    }
    else
    {



        memcpy(&val,retp+(offset+620),4); //tasks next pointer
        if(val==0)
          return 0;
        val = val-620; //address to task_struct 
        munmap(retp,4096*4);

        close(fd);


    }

    return val;
}           


const char * readval(long address)
{                
    int fd;
    void *retp = NULL;


    long addr = address;
    long *addrp = NULL;

    long next,prev;
    long val;
    char *nextstr = calloc(sizeof(char),100);
    int page_size,offset;

    long *nextp = (long *) next;
    page_size = getpagesize();
    val = addr & ~(page_size-1)- 0xc0000000;
    long *ptr = (long *) val; 

    offset = addr & 0xfff;
    fd = open("/dev/mem", O_RDWR|O_SYNC);
    retp = mmap(NULL, 4096*4, PROT_READ, MAP_SHARED, fd, ptr);


    if (retp == MAP_FAILED)
    {
        printf("FAILED\n");
    }
    else
    {

        memcpy(nextstr,retp+(offset+996),100); //task->comm



        munmap(retp,4096*4);
    }
    return nextstr;
}
void main(void)
{


    int ret = 0xc1a8cac0; //init_task

    while(1)
    {
        if(ret!=0)
        {
          printf("Address:0x%x\n",ret);
          ret = readtaskstruct(ret);
          printf("Process:%s\n",readval(ret));
        }else{
          break;
        }
    }


}

但是我怎么知道列表已经在最后了？现在 mmap 失败了，这就是我知道它是如何完成的。有没有更好、更优雅的方式来讲述它？

谢谢

更新4:

最终版本:

列表任务.c

#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <stdbool.h>



long readtaskstruct(long address)
{

    int fd;
    void *retp = NULL;

    long addr = address; 
    long *addrp = NULL;

    long next,prev;
    long val;
    char nextstr;
    int page_size,offset;


    addrp = (long *) addr;
    page_size = getpagesize();
    val = addr & ~(page_size-1)- 0xc0000000;
    long *ptr = (long *) val;

    offset = addr & 0xfff;



    fd = open("/dev/mem", O_RDWR|O_SYNC);
    retp = mmap(NULL, 4096*4, PROT_READ, MAP_SHARED, fd,ptr);


    if (retp == MAP_FAILED)
    {
        printf("FAILED\n");
    }
    else
    {



        memcpy(&val,retp+(offset+620),4); //tasks next pointer
        if(val==0)
          return 0;
        val = val-620; //address to task_struct 
        munmap(retp,4096*4);

        close(fd);


    }

    return val;
}           


const char * readval(long address)
{                
    int fd;
    void *retp = NULL;


    long addr = address;
    long *addrp = NULL;

    long next,prev;
    long val;
    char *nextstr = calloc(sizeof(char),100);
    int page_size,offset;

    long *nextp = (long *) next;
    page_size = getpagesize();
    val = addr & ~(page_size-1)- 0xc0000000;
    long *ptr = (long *) val; 

    offset = addr & 0xfff;
    fd = open("/dev/mem", O_RDWR|O_SYNC);
    retp = mmap(NULL, 4096*4, PROT_READ, MAP_SHARED, fd, ptr);


    if (retp == MAP_FAILED)
    {
        printf("FAILED\n");
    }
    else
    {

        memcpy(nextstr,retp+(offset+996),100); //task->comm



        munmap(retp,4096*4);
    }
    return nextstr;
}
void main(void)
{


    int ret = 0xc1a8cac0; //init_task

    do
    {
          //printf("Address:0x%x\n",ret);
          ret = readtaskstruct(ret);
          printf("Process:%s\n",readval(ret));
    }while(ret!=0 && ret!= 0xc1a8cac0);


}

Answer 1

/dev/mem使您可以访问系统的物理内存。米em(4) man page详细解释了 /dev/mem是。在您的代码中，您假设物理内存的第一页是内核内存的第一页，并且使用固定偏移量您将到达 init_task 。根据平台的不同，内核镜像可能会加载到物理 RAM 的某个偏移位置，而不是 RAM 的起始位置。

您可以使用/dev/kmem访问内核虚拟内存，但您再次需要知道正确的页面和偏移量，您可以在其中找到 init_task结构，可能会有所不同。

my init_task is at 0xc1a8cac0 ... why I dont see it in for_each_process output from kernel module?

你应该猜到你的地址是init_task与推测为什么 init_task 不在 task_list 中相比，评估者是错误的。

我建议您编写一个简单的内核模块并访问init_task直接变量，无需任何指针运算。

如果你看一下宏for_each_process ，您会注意到它实际上以 init_task 开头并将循环任务列表循环回 init_task

#define for_each_process(p) \
        for (p = &init_task ; (p = next_task(p)) != &init_task ; )

希望这有帮助。