User to kernel mode big picture?

Question

I've to implement a char device, a LKM.

I know some basics about OS, but I feel I don't have the big picture.

In a C programm, when I call a syscall what I think it happens is that the CPU is changed to ring0, then goes to the syscall vector and jumps to a kernel memmory space function that handle it. (I think that it does int 0x80 and in eax is the offset of the syscall vector, not sure).

Then, I'm in the syscall itself, but I guess that for the kernel is the same process that was before, only that it is in kernel mode, I mean the current PCB is the process that called the syscall.

So far... so good?, correct me if something is wrong.

Others questions... how can I write/read in process memory?. If in the syscall handler I refer to address, say, 0xbfffffff. What it means that address? physical one? Some virtual kernel one?

Answer 1

Big picture:

Everything happens in assembly. So in Intel assembly, there is a set of privilege instruction which can only be executed in Ring0 mode (http://en.wikipedia.org/wiki/Privilege_level). To make the transition into Ring0 mode, you can use the "Int" or "Sysenter" instruction:

what all happens in sysenter instruction is used in linux?

And then inside the Ring0 mode (which is your kernel mode), accessing the memory will require the privilege level to be matched via DPL/CPL/RPL attributes bits tagged in the segment register:

http://duartes.org/gustavo/blog/post/cpu-rings-privilege-and-protection/

You may asked, how the CPU initialize the memory and register in the first place: it is because when bootup, x86 CPU is running in realmode, unprotected (no Ring concept), and so everything is possible and lots of setup work is done.

As for virtual vs non-virtual memory address (or physical address): just remember that anything in the register used for memory addressing, is always via virtual address (if the MMU is setup, protected mode enabled). Look at the picture here (noticed that anything from the CPU is virtual address, only the memory bus will see physical address):

http://en.wikipedia.org/wiki/Memory_management_unit

As for memory separation between userspace and kernel, you can read here:

http://www.inf.fu-berlin.de/lehre/SS01/OS/Lectures/Lecture14.pdf

Answer 2

You can never get to ring0 from a regular process.

You'll have to write a kernel module to get to ring0.

And you never have to deal with any physical addresses, 0xbfffffff represents an address in a virtual address space of your process.

Answer 3

To read/write memory from the kernel, you need to use function calls such as get_user or __copy_to_user.

See the User Space Memory Access API of the Linux Kernel.