SlideShare a Scribd company logo
1 of 26
Download to read offline
1
Chapter 6
Device Drivers
2
● File Type
● From App to Device
● Driver Registration
● Hotplug
● MMC Size & Partitions
● Request Queue & Elevator
3
File Type
*. 只有 type 為 b/c 的稱為 device file
*. type/major/minor 決定唯一 device
type major/minor
block device
mmc
可以存取任意位置
block
data 會被 cache 在 memory
b
沒特別意義
分區
character device
ir, uart
不行存取任意位置
byte
data 不被 cache 在 memory
c
類型 (e.g. memory)
子類型 (e.g. null/zero)
e.g.
data 存取
transfer unit
保留 data
type
白 major
白 minor
4
From App to Device
vfs
執行預設 operations 裡的 open
1. 從 type 對應 table 根據 major/minor
找 driver 註冊的 cdev
2. 執行 cdev 自帶的 open( )
app
lib
syscall
filesystem
準備 inode &
安裝預設 operations
open device file
glibc/bionic
sys_open
do_sys_open
user space
kernel space
open( )
cdev
5
From App to Device
user space
kernel space
.open
.llseek
.open
.llseek
.read
.write
.mmap
...
c device file
.open
.release
.llseek
.read
.write
.unlocked_ioctl
...
.open
.release
.ioctl
...
b device file
default
operations
driver
default
operations
driver
(partial)
8
Driver Registration
1. 準備 cdev & operations
2. 註冊 region(major/minor)
(3. 註冊 hotplug 機制 , for probe)
1. 註冊 hotplug 機制 , for probe
----- probe 之後 -----
2. 準備 gendisk & operations &
request queue & elevator
3. 註冊 region(major/minor) &
add partition
open( )
read( )
write( )
cdev
0
1
254
cdev_map
open( )
read( )
write( )
cdev
open( )
read( )
write( )
cdev
0
1
254
bdev_map
open( )
read( )
write( )
gendisk
open( )
read( )
write( )
gendisk
request
queue
request
queue
elevator
elevator
minor minor
major major
10
Hotplug
bus
usb
driver
mmc
driver
usb
device
sd
driver
match
fail
match
fail
match
pass
進行 probe
*. 這邊的 device, 是 kernel 內部自用的 struct
沒有 major/minor 概念
11
Hotplug
bus
usb
driver
mmc
driver
usb
device
sd
driver
mmc
device
match
pass
進行 probe
1. 註冊 hotplug 機制 , for probe
----- probe 之後 -----
2. 準備 gendisk & operations &
request queue & elevator
3. 註冊 region(major/minor) &
add partition
14
MMC Size & Partitions
partition
info
operations
gendisk
p0
noop
elevator
queue
request
queue
.request_fn
.make_request_fn
partition
table
1. 註冊 hotplug 機制 , for probe
----- probe 之後 -----
2. 準備 gendisk & operations &
request queue & elevator
3. 註冊 region(major/minor) &
add partition
15
MMC Size & Partitions
sector
0
3
2
1
13
name = “MBOOT”
start_block = 4096
block_count = 6144
name = “RTPM”
start_block = 907264
block_count = 512
14 magic not match
name = “MPOOL”
start_block = 10240
block_count = 4096
MPOOL
MBOOT
partition table
KL
RFS
customer
MSLIB
APP
customerbackup
CONFIG
certificate
tee
RTPM
oad
7G
443M
16
MMC Size & Partitions
noop
elevator
queue
request
queue
.request_fn
.make_request_fn
partition
table
partition
info
p1
partition
info
p2
partition
info
p13
.start_sect
.nr_sects
bdev
partition
info
operations
gendisk
p0
1. 註冊 hotplug 機制 , for probe
----- probe 之後 -----
2. 準備 gendisk & operations &
request queue & elevator
3. 註冊 region(major/minor) &
add partition
0
1
254
bdev_map
open( )
read( )
write( )
gendisk
open( )
read( )
write( )
gendisk
request
queue
request
queue
elevator
elevator
22
Request Queue & Elevator
bio request
task plug
plug
elevator queue request queue
cfq usb disk A
deadline usb disk B
noop emmc
23
Request Queue & Elevator
task plug
noop emmc
bio
plug
.make_request_fn: 把 bio 串入 plug/queue
.request_fn:
把 rq 從 request_queue 取出
交給 driver 處理 ( 先 drain)
.request_fn
.make_request_fn
24
Request Queue & Elevator
task plug
noop emmc
bio
1. if plug
嘗試合併到 task plug 的 request
plug
25
Request Queue & Elevator
task plug
noop emmc
bio
1. if plug
嘗試合併到 task plug 的 request
2. 嘗試合併到
elevator queue 的 requestplug
26
Request Queue & Elevator
request
3. 包裝成 request
noop emmc
task plug
plug
elevator queue request queue
27
Request Queue & Elevator
request
3. 包裝成 request
4. if plug, 串入 task plug
noop emmc
task plug
plug
elevator queue request queue
28
Request Queue & Elevator
request
3. 包裝成 request
4. if plug, 串入 task plug
5. 串入 elevator queue
( 或 request queue)
執行 driver 處理 request queue
noop emmc
task plug
plug
elevator queue request queue
29
Request Queue & Elevator
task plug
elevator queue request queue
cfq usb disk A
deadline usb disk B
noop emmc
30
Request Queue & Elevator
task plug
elevator queue request queue
cfq usb disk A
deadline usb disk B
noop emmc
執行 driver
處理 request
31
Request Queue & Elevator
task plug
elevator queue request queue
cfq usb disk A
deadline usb disk B
noop emmc
執行 driver
處理 request
32
Request Queue & Elevator
task plug
elevator queue request queue
cfq usb disk A
deadline usb disk B
noop emmc
執行 driver
處理 request
33
Request Queue & Elevator
request queue
page
frame
page
frame
34
Request Queue & Elevator
request queue
mmc driver 把 request(read/write/...) 轉成 cmd 組合
page
frame
page
frame
35
Request Queue & Elevator
request queue
mmc driver 把 request(read/write/...) 轉成 cmd 組合
敲 fcie register
透過 host 發送 protocol(cmd + data)
page
frame
page
frame
mstar fcie host
mstar fcie driver
36
Request Queue & Elevator
request queue
mmc driver
mmc device
把 request(read/write/...) 轉成 cmd 組合
敲 fcie register
透過 host 發送 protocol(cmd + data)
根據收到 protocol 執行 cmd
達成 request(read/write/...)
read: storage --> dram
write: dram --> storage
其它 , flush/discard/write_same/zeroout/...
page
frame
page
frame
rw
rw
mstar fcie host
mstar fcie driver
cmddata

More Related Content

What's hot

Solaris Kernel Debugging V1.0
Solaris Kernel Debugging V1.0Solaris Kernel Debugging V1.0
Solaris Kernel Debugging V1.0
Jarod Wang
 

What's hot (20)

TDOH x 台科 pwn課程
TDOH x 台科 pwn課程TDOH x 台科 pwn課程
TDOH x 台科 pwn課程
 
from Binary to Binary: How Qemu Works
from Binary to Binary: How Qemu Worksfrom Binary to Binary: How Qemu Works
from Binary to Binary: How Qemu Works
 
Understanding eBPF in a Hurry!
Understanding eBPF in a Hurry!Understanding eBPF in a Hurry!
Understanding eBPF in a Hurry!
 
Linux Capabilities - eng - v2.1.5, compact
Linux Capabilities - eng - v2.1.5, compactLinux Capabilities - eng - v2.1.5, compact
Linux Capabilities - eng - v2.1.5, compact
 
Linux Device Tree
Linux Device TreeLinux Device Tree
Linux Device Tree
 
Unix v6 セミナー vol. 5
Unix v6 セミナー vol. 5Unix v6 セミナー vol. 5
Unix v6 セミナー vol. 5
 
Tracing MariaDB server with bpftrace - MariaDB Server Fest 2021
Tracing MariaDB server with bpftrace - MariaDB Server Fest 2021Tracing MariaDB server with bpftrace - MariaDB Server Fest 2021
Tracing MariaDB server with bpftrace - MariaDB Server Fest 2021
 
Page table manipulation attack
Page table manipulation attackPage table manipulation attack
Page table manipulation attack
 
Low Overhead System Tracing with eBPF
Low Overhead System Tracing with eBPFLow Overhead System Tracing with eBPF
Low Overhead System Tracing with eBPF
 
BPF / XDP 8월 세미나 KossLab
BPF / XDP 8월 세미나 KossLabBPF / XDP 8월 세미나 KossLab
BPF / XDP 8월 세미나 KossLab
 
System Hacking Tutorial #1 - Introduction to Vulnerability and Type of Vulner...
System Hacking Tutorial #1 - Introduction to Vulnerability and Type of Vulner...System Hacking Tutorial #1 - Introduction to Vulnerability and Type of Vulner...
System Hacking Tutorial #1 - Introduction to Vulnerability and Type of Vulner...
 
QEMU - Binary Translation
QEMU - Binary Translation QEMU - Binary Translation
QEMU - Binary Translation
 
eBPF maps 101
eBPF maps 101eBPF maps 101
eBPF maps 101
 
eBPF Basics
eBPF BasicseBPF Basics
eBPF Basics
 
Kernel Recipes 2019 - Faster IO through io_uring
Kernel Recipes 2019 - Faster IO through io_uringKernel Recipes 2019 - Faster IO through io_uring
Kernel Recipes 2019 - Faster IO through io_uring
 
Code GPU with CUDA - Identifying performance limiters
Code GPU with CUDA - Identifying performance limitersCode GPU with CUDA - Identifying performance limiters
Code GPU with CUDA - Identifying performance limiters
 
Solaris Kernel Debugging V1.0
Solaris Kernel Debugging V1.0Solaris Kernel Debugging V1.0
Solaris Kernel Debugging V1.0
 
Debugging Ruby
Debugging RubyDebugging Ruby
Debugging Ruby
 
Debugging Ruby Systems
Debugging Ruby SystemsDebugging Ruby Systems
Debugging Ruby Systems
 
App secforum2014 andrivet-cplusplus11-metaprogramming_applied_to_software_obf...
App secforum2014 andrivet-cplusplus11-metaprogramming_applied_to_software_obf...App secforum2014 andrivet-cplusplus11-metaprogramming_applied_to_software_obf...
App secforum2014 andrivet-cplusplus11-metaprogramming_applied_to_software_obf...
 

Viewers also liked

ch15-pv1-time-management
ch15-pv1-time-managementch15-pv1-time-management
ch15-pv1-time-management
yushiang fu
 
ch9-pv1-the-extended-filesystem-family
ch9-pv1-the-extended-filesystem-familych9-pv1-the-extended-filesystem-family
ch9-pv1-the-extended-filesystem-family
yushiang fu
 
07.flash memory technology
07.flash memory technology07.flash memory technology
07.flash memory technology
ruchiusha
 

Viewers also liked (10)

ch15-pv1-time-management
ch15-pv1-time-managementch15-pv1-time-management
ch15-pv1-time-management
 
ch9-pv1-the-extended-filesystem-family
ch9-pv1-the-extended-filesystem-familych9-pv1-the-extended-filesystem-family
ch9-pv1-the-extended-filesystem-family
 
Transport Layer (L4) of MIPI Unipro - An Introduction
Transport Layer (L4) of MIPI Unipro - An IntroductionTransport Layer (L4) of MIPI Unipro - An Introduction
Transport Layer (L4) of MIPI Unipro - An Introduction
 
UniPro Group Overview
UniPro Group OverviewUniPro Group Overview
UniPro Group Overview
 
ch7-pv1-modules
ch7-pv1-modulesch7-pv1-modules
ch7-pv1-modules
 
Arrow Devices MIPI MPHY Verification IP Solution
Arrow Devices MIPI MPHY Verification IP SolutionArrow Devices MIPI MPHY Verification IP Solution
Arrow Devices MIPI MPHY Verification IP Solution
 
Ufs movie
Ufs movieUfs movie
Ufs movie
 
Behavioral modeling of Clock/Data Recovery
Behavioral modeling of Clock/Data RecoveryBehavioral modeling of Clock/Data Recovery
Behavioral modeling of Clock/Data Recovery
 
Q4.11: Next Gen Mobile Storage – UFS
Q4.11: Next Gen Mobile Storage – UFSQ4.11: Next Gen Mobile Storage – UFS
Q4.11: Next Gen Mobile Storage – UFS
 
07.flash memory technology
07.flash memory technology07.flash memory technology
07.flash memory technology
 

Similar to ch6-pv2-device-drivers

BlackBerry 10 Core Native Camera API
BlackBerry 10 Core Native Camera APIBlackBerry 10 Core Native Camera API
BlackBerry 10 Core Native Camera API
Steven Beeckman
 
27.2.10 lab extract an executable from a pcap
27.2.10 lab   extract an executable from a pcap27.2.10 lab   extract an executable from a pcap
27.2.10 lab extract an executable from a pcap
Freddy Buenaño
 
Systemtap
SystemtapSystemtap
Systemtap
Feng Yu
 
MattsonTutorialSC14.pptx
MattsonTutorialSC14.pptxMattsonTutorialSC14.pptx
MattsonTutorialSC14.pptx
gopikahari7
 
Crash dump analysis - experience sharing
Crash dump analysis - experience sharingCrash dump analysis - experience sharing
Crash dump analysis - experience sharing
James Hsieh
 

Similar to ch6-pv2-device-drivers (20)

k8s practice 2023.pptx
k8s practice 2023.pptxk8s practice 2023.pptx
k8s practice 2023.pptx
 
UM2019 Extended BPF: A New Type of Software
UM2019 Extended BPF: A New Type of SoftwareUM2019 Extended BPF: A New Type of Software
UM2019 Extended BPF: A New Type of Software
 
Container Runtime Security with Falco
Container Runtime Security with FalcoContainer Runtime Security with Falco
Container Runtime Security with Falco
 
Linux Kernel Platform Development: Challenges and Insights
 Linux Kernel Platform Development: Challenges and Insights Linux Kernel Platform Development: Challenges and Insights
Linux Kernel Platform Development: Challenges and Insights
 
000-232 Exams
000-232 Exams000-232 Exams
000-232 Exams
 
BlackBerry 10 Core Native Camera API
BlackBerry 10 Core Native Camera APIBlackBerry 10 Core Native Camera API
BlackBerry 10 Core Native Camera API
 
Scaling docker with kubernetes
Scaling docker with kubernetesScaling docker with kubernetes
Scaling docker with kubernetes
 
OpenShift4 Installation by UPI on kvm
OpenShift4 Installation by UPI on kvmOpenShift4 Installation by UPI on kvm
OpenShift4 Installation by UPI on kvm
 
AWS Pentest.pdf
AWS Pentest.pdfAWS Pentest.pdf
AWS Pentest.pdf
 
Foomo / Zugspitze Presentation
Foomo / Zugspitze PresentationFoomo / Zugspitze Presentation
Foomo / Zugspitze Presentation
 
Let's trace Linux Lernel with KGDB @ COSCUP 2021
Let's trace Linux Lernel with KGDB @ COSCUP 2021Let's trace Linux Lernel with KGDB @ COSCUP 2021
Let's trace Linux Lernel with KGDB @ COSCUP 2021
 
27.2.10 lab extract an executable from a pcap
27.2.10 lab   extract an executable from a pcap27.2.10 lab   extract an executable from a pcap
27.2.10 lab extract an executable from a pcap
 
Clad sample exam15
Clad sample exam15Clad sample exam15
Clad sample exam15
 
BlueHat v17 || Out of the Truman Show: VM Escape in VMware Gracefully
BlueHat v17 || Out of the Truman Show: VM Escape in VMware Gracefully BlueHat v17 || Out of the Truman Show: VM Escape in VMware Gracefully
BlueHat v17 || Out of the Truman Show: VM Escape in VMware Gracefully
 
Systemtap
SystemtapSystemtap
Systemtap
 
App container rkt
App container rktApp container rkt
App container rkt
 
Android 5.0 Lollipop platform change investigation report
Android 5.0 Lollipop platform change investigation reportAndroid 5.0 Lollipop platform change investigation report
Android 5.0 Lollipop platform change investigation report
 
tools.ppt
tools.ppttools.ppt
tools.ppt
 
MattsonTutorialSC14.pptx
MattsonTutorialSC14.pptxMattsonTutorialSC14.pptx
MattsonTutorialSC14.pptx
 
Crash dump analysis - experience sharing
Crash dump analysis - experience sharingCrash dump analysis - experience sharing
Crash dump analysis - experience sharing
 

ch6-pv2-device-drivers

  • 2. 2 ● File Type ● From App to Device ● Driver Registration ● Hotplug ● MMC Size & Partitions ● Request Queue & Elevator
  • 3. 3 File Type *. 只有 type 為 b/c 的稱為 device file *. type/major/minor 決定唯一 device type major/minor block device mmc 可以存取任意位置 block data 會被 cache 在 memory b 沒特別意義 分區 character device ir, uart 不行存取任意位置 byte data 不被 cache 在 memory c 類型 (e.g. memory) 子類型 (e.g. null/zero) e.g. data 存取 transfer unit 保留 data type 白 major 白 minor
  • 4. 4 From App to Device vfs 執行預設 operations 裡的 open 1. 從 type 對應 table 根據 major/minor 找 driver 註冊的 cdev 2. 執行 cdev 自帶的 open( ) app lib syscall filesystem 準備 inode & 安裝預設 operations open device file glibc/bionic sys_open do_sys_open user space kernel space open( ) cdev
  • 5. 5 From App to Device user space kernel space .open .llseek .open .llseek .read .write .mmap ... c device file .open .release .llseek .read .write .unlocked_ioctl ... .open .release .ioctl ... b device file default operations driver default operations driver (partial)
  • 6. 8 Driver Registration 1. 準備 cdev & operations 2. 註冊 region(major/minor) (3. 註冊 hotplug 機制 , for probe) 1. 註冊 hotplug 機制 , for probe ----- probe 之後 ----- 2. 準備 gendisk & operations & request queue & elevator 3. 註冊 region(major/minor) & add partition open( ) read( ) write( ) cdev 0 1 254 cdev_map open( ) read( ) write( ) cdev open( ) read( ) write( ) cdev 0 1 254 bdev_map open( ) read( ) write( ) gendisk open( ) read( ) write( ) gendisk request queue request queue elevator elevator minor minor major major
  • 8. 11 Hotplug bus usb driver mmc driver usb device sd driver mmc device match pass 進行 probe 1. 註冊 hotplug 機制 , for probe ----- probe 之後 ----- 2. 準備 gendisk & operations & request queue & elevator 3. 註冊 region(major/minor) & add partition
  • 9. 14 MMC Size & Partitions partition info operations gendisk p0 noop elevator queue request queue .request_fn .make_request_fn partition table 1. 註冊 hotplug 機制 , for probe ----- probe 之後 ----- 2. 準備 gendisk & operations & request queue & elevator 3. 註冊 region(major/minor) & add partition
  • 10. 15 MMC Size & Partitions sector 0 3 2 1 13 name = “MBOOT” start_block = 4096 block_count = 6144 name = “RTPM” start_block = 907264 block_count = 512 14 magic not match name = “MPOOL” start_block = 10240 block_count = 4096 MPOOL MBOOT partition table KL RFS customer MSLIB APP customerbackup CONFIG certificate tee RTPM oad 7G 443M
  • 11. 16 MMC Size & Partitions noop elevator queue request queue .request_fn .make_request_fn partition table partition info p1 partition info p2 partition info p13 .start_sect .nr_sects bdev partition info operations gendisk p0 1. 註冊 hotplug 機制 , for probe ----- probe 之後 ----- 2. 準備 gendisk & operations & request queue & elevator 3. 註冊 region(major/minor) & add partition 0 1 254 bdev_map open( ) read( ) write( ) gendisk open( ) read( ) write( ) gendisk request queue request queue elevator elevator
  • 12. 22 Request Queue & Elevator bio request task plug plug elevator queue request queue cfq usb disk A deadline usb disk B noop emmc
  • 13. 23 Request Queue & Elevator task plug noop emmc bio plug .make_request_fn: 把 bio 串入 plug/queue .request_fn: 把 rq 從 request_queue 取出 交給 driver 處理 ( 先 drain) .request_fn .make_request_fn
  • 14. 24 Request Queue & Elevator task plug noop emmc bio 1. if plug 嘗試合併到 task plug 的 request plug
  • 15. 25 Request Queue & Elevator task plug noop emmc bio 1. if plug 嘗試合併到 task plug 的 request 2. 嘗試合併到 elevator queue 的 requestplug
  • 16. 26 Request Queue & Elevator request 3. 包裝成 request noop emmc task plug plug elevator queue request queue
  • 17. 27 Request Queue & Elevator request 3. 包裝成 request 4. if plug, 串入 task plug noop emmc task plug plug elevator queue request queue
  • 18. 28 Request Queue & Elevator request 3. 包裝成 request 4. if plug, 串入 task plug 5. 串入 elevator queue ( 或 request queue) 執行 driver 處理 request queue noop emmc task plug plug elevator queue request queue
  • 19. 29 Request Queue & Elevator task plug elevator queue request queue cfq usb disk A deadline usb disk B noop emmc
  • 20. 30 Request Queue & Elevator task plug elevator queue request queue cfq usb disk A deadline usb disk B noop emmc 執行 driver 處理 request
  • 21. 31 Request Queue & Elevator task plug elevator queue request queue cfq usb disk A deadline usb disk B noop emmc 執行 driver 處理 request
  • 22. 32 Request Queue & Elevator task plug elevator queue request queue cfq usb disk A deadline usb disk B noop emmc 執行 driver 處理 request
  • 23. 33 Request Queue & Elevator request queue page frame page frame
  • 24. 34 Request Queue & Elevator request queue mmc driver 把 request(read/write/...) 轉成 cmd 組合 page frame page frame
  • 25. 35 Request Queue & Elevator request queue mmc driver 把 request(read/write/...) 轉成 cmd 組合 敲 fcie register 透過 host 發送 protocol(cmd + data) page frame page frame mstar fcie host mstar fcie driver
  • 26. 36 Request Queue & Elevator request queue mmc driver mmc device 把 request(read/write/...) 轉成 cmd 組合 敲 fcie register 透過 host 發送 protocol(cmd + data) 根據收到 protocol 執行 cmd 達成 request(read/write/...) read: storage --> dram write: dram --> storage 其它 , flush/discard/write_same/zeroout/... page frame page frame rw rw mstar fcie host mstar fcie driver cmddata