arm32段+页映射手撕mmu的行为之软件模拟

原创已于 2026-04-14 21:59:22 修改 · 261 阅读

4 ·

本内容遵循CC 4.0 BY-SA版权协议

GEO检测

标签

#linux #服务器 #网络

于 2026-04-14 21:55:22 首次发布

static int pt_walk_init( void )
{
   unsigned long virt;
   pgd_t *pgd_base;
   pgd_t *pgd;

   pmd_t *pmd;
   pte_t *pte;
   uint32_t pgd_valx, pmd_valx, pte_valx;

   unsigned long va;
   unsigned long pfn_base;
   unsigned long pa;
   phys_addr_t calc_pa, real_pa;
   unsigned long val1,val2,val3;
   unsigned int *pgd_one;
   unsigned int page_mode;unsigned long offset;

   // 分配内核线性映射地址
   virt = (unsigned long)__get_free_page(GFP_KERNEL);
   if (!virt) {
       pr_err("alloc page failed\n");
       return -ENOMEM;
   }

//pr_info("virt1 = %08lx\n", virt);

virt = vmalloc(PAGE_SIZE);

pr_info("virt2 = %08lx\n", virt);

   va = virt;
   //写入 VA
*(volatile unsigned long *)va = 0x12345678; //先访问一次,触发缺页,填充真实页表
*(volatile unsigned long *)(va+4) = 0x87654321;
   //pr_info("va = %08lx\n", va);

//然后用 MMU 算出的物理地址读
calc_pa = (unsigned long)virt_to_phys((void *)va);
   //pr_info("calc_pa = %08lx\n", calc_pa);
val1 = *(volatile unsigned long *)phys_to_virt(calc_pa);
   //pr_info("val1 = %08lx\n", val1);
   //pr_info("phys_to_virt(calc_pa) = %08lx\n", phys_to_virt(calc_pa) );

   //PAGE_OFFSET    = 0x80000000
   //PHYS_OFFSET    = 0x68000000

//步骤1：打印虚拟地址拆分 (硬件行为)
pr_info("[步骤1] 虚拟地址硬件拆分 (VA = 索引 + 偏移)\n");

   unsigned int idx = (va >> 20) & 0xFFF; // 高12位 → PGD索引
   unsigned int off = va & 0xFFFFF; // 低20位 → 偏移

pr_info("VA [31:20] 索引 = 0x%03x\n", idx);
pr_info("VA [19:0] 偏移 = 0x%05x\n\n", off);

   pr_info("[步骤2] 读取 PGD 原始值\n");
   pgd_base = init_mm.pgd;
   pgd = pgd_offset(&init_mm, va);
   pgd_valx = pgd_val(*pgd);

   pr_info( "PGD base addr = 0x%08x\n", (unsigned int)pgd_base );
   pr_info( "PGD calc addr = 0x%08x\n", (unsigned int)pgd );
   pr_info( "PGD value = 0x%08x\n", pgd_valx );

page_mode = pgd_valx & 0x00000003;
   pgd_one = pgd;

   if( page_mode ==0x02){
pr_info( "打印内核内存布局真相\n" );
   pr_info( "虚拟地址 VA = 0x%08lx\n", va );
   pr_info( "真实物理地址 PA = 0x%08lx\n", (unsigned long)virt_to_phys((void *)va) );
   pr_info( "VA - PAGE_OFFSET = 0x%08lx\n", va - PAGE_OFFSET );
   pr_info( "VA - virt_to_phys = 0x%08lx\n", va - (unsigned long)virt_to_phys((void *)va) );
   }
   if( page_mode == 0x02 ){
   if( (virt>>20) & 1 ){
pgd_one++;
       pgd_valx = pgd_one[0];
   pr_info("PGD 修正值       = 0x%08x\n", pgd_valx);
   }
   }

   //HEXDUMP PGD 内存
   pr_info("PGD 内存 hexdump:\n");
   print_hex_dump(KERN_INFO, "PGD: ", DUMP_PREFIX_ADDRESS, 16, 4,
       pgd_base+pgd_index(va), 0x40, false);
   pr_info("\n");

//步骤3：解析 PGD 位格式（ARM Section 格式）
pr_info("[步骤3] 解析 PGD 硬件格式 \n");

   if( page_mode == 2 ){
   pr_info("Bit[1:0] 类型 = %d (10=Section 1MB大页)\n", page_mode );
   }else{
pr_info("Bit[1:0] 类型 = %d (01=Section 4kB小页)\n", page_mode );
   }

   pr_info("Bit[4:2] AP = %d\n", (pgd_valx >> 2) & 7);
   pr_info("Bit[5] CB = %d\n", (pgd_valx >> 5) & 1);
   pr_info( "Bit[31:12] 基地址 = 0x%08x\n", (unsigned int)(pgd_valx & 0xFFF00000) );

if( page_mode == 2){
   //步骤4：硬件计算最终物理地址
   pr_info("\n[步骤4] 硬件计算最终物理地址\n");

pfn_base = (pgd_valx & 0xFFF00000);
pa = pfn_base | (va & 0x000FFFFF);

   pr_info("PA = PGD[31:12] + VA[19:0]\n");
   pr_info("PA = 0x%08lx + 0x%05x = 0x%08lx\n", pfn_base, off, pa);
}else if( page_mode == 0x1 ){
unsigned long pte_phys;
       pr_info("\n[步骤5] 解析 PTE 硬件格式 \n");
pr_info("=> 4KB 小页模式 (PGD → PTE)\n");

       //1.从 PGD 取出 PTE 物理地址
       pte_phys = pgd_valx & 0xFFFFFC00;
       pr_info("PTE 物理地址 = 0x%08lx\n", pte_phys);

       //2.转虚拟地址找到对应 PTE 项
       pte = (pte_t *)phys_to_virt(pte_phys);
pr_info("pte1 = 0x%08lx\n", pte);
       pr_info("pte_index(va) = 0x%08lx\n", pte_index(va));
       //(((addr) >> 12) & (0x1ff)) Bit[31:21] Bit[20:12] Bit[11:0]
       //获取 pte的索引数 Bit[20:12]
       pte = pte + pte_index(va);
       //pte基地址 + 索引偏移得到pte条目的入口
       pr_info("pte2 = 0x%08lx\n", pte);

       print_hex_dump(KERN_INFO, "PTE: ", DUMP_PREFIX_ADDRESS, 16, 4,
                   pte, 0x20, false);
       pte_valx = pte_val(*pte);
       //取pte条目的值
       pr_info("PTE 项地址 = 0x%08x, PTE 值 = 0x%08x\n", (unsigned int)pte, pte_valx );

       // 3.计算最终物理地址 (4KB)
       pfn_base = pte_valx & 0xFFFFF000;
       offset = va & 0x00000FFF;
       pa = pfn_base | offset;
       print_hex_dump(KERN_INFO, "PTE: ", DUMP_PREFIX_ADDRESS, 16, 4,
                   phys_to_virt(pa), 0x40, false);
       pr_info("PA = 0x%08lx\n", pa);
   }else {
       pr_err("不支持的页表类型: %d\n", page_mode);
   }

   // =========================================================================
   // 总结
   // =========================================================================
   pr_info("\n=======================================================\n");
   pr_info( "[硬件流程完成]\n" );
   pr_info("VA = 0x%08lx --> PA = 0x%08lx\n", va, pa);

//free_page(virt);
return 0;
}

run log:

/ # cat /dev/test_char_dev
[ 21.843404] virt2 = 992ed000
[ 21.843714] [步骤1] 虚拟地址硬件拆分 (VA = 索引 + 偏移)
[ 21.844116] VA [31:20] 索引 = 0x992
[ 21.844347] VA [19:0] 偏移 = 0xed000
[ 21.844347]
[ 21.844764] [步骤2] 读取 PGD 原始值
[ 21.844990] PGD base addr = 0x80004000
[ 21.845208] PGD calc addr = 0x80006648
[ 21.845428] PGD value = 0x7edfa811
[ 21.845695] PGD 内存 hexdump:
[ 21.845957] PGD: 80006648: 7edfa811 7edfac11 7ede7811 7ede7c11
[ 21.846231] PGD: 80006658: 7ede6811 7ede6c11 7ede5811 7ede5c11
[ 21.846504] PGD: 80006668: 7ede4811 7ede4c11 7ede3811 7ede3c11
[ 21.846819] PGD: 80006678: 7ede2811 7ede2c11 7ede1811 7ede1c11
[ 21.847083]
[ 21.847167] [步骤3] 解析 PGD 硬件格式
[ 21.847375] Bit[1:0] 类型 = 1 (01=Section 4kB小页)
[ 21.847625] Bit[4:2] AP = 4
[ 21.847802] Bit[5] CB = 0
[ 21.847962] Bit[31:12] 基地址 = 0x7ed00000
[ 21.848163]
[ 21.848163] [步骤5] 解析 PTE 硬件格式
[ 21.848444] => 4KB 小页模式 (PGD → PTE)
[ 21.848677] PTE 物理地址 = 0x7edfa800
[ 21.849121] pte1 = 0x96dfa800
[ 21.849309] pte_index(va) = 0x000000ed
[ 21.849484] pte2 = 0x96dfabb4
[ 21.849705] PTE: 96dfabb4: 7ef2101f 00000000 00000000 00000000
[ 21.849986] PTE: 96dfabc4: 00000000 00000000 00000000 00000000
[ 21.850266] PTE 项地址 = 0x96dfabb4, PTE 值 = 0x7ef2101f
[ 21.850612] PTE: 96f21000: 12345678 87654321 00000000 00000000
[ 21.850987] PTE: 96f21010: 00000000 00000000 00000000 00000000
[ 21.851288] PTE: 96f21020: 00000000 00000000 00000000 00000000
[ 21.851609] PTE: 96f21030: 00000000 00000000 00000000 00000000
[ 21.852043] PA = 0x7ef21000
[ 21.852220]
[ 21.852220] =======================================================
[ 21.852561] [硬件流程完成]
[ 21.852754] VA = 0x992ed000 --> PA = 0x7ef21000
A