Tutoriel : Déboguer un noyau Linux

if(!driver_allocate_struct()) {
    printk(KERN_ERR "%s: No memory left to initialize xxx\n", MODULE_NAME);
    return -ENOMEM;
}

time make -j$(($(nproc)+1)) # nproc + 1 pour optimiser la performance. Vous pouvez quand même aller prendre un café.
time make modules install -j$(($(nproc)+1)) 
sudo make install -j$(($(nproc)+1))
reboot

virsh edit ${vm_to_debug}

  <qemu:commandline>
    <qemu:arg value='-gdb'/>
    <qemu:arg value='tcp::1200'/>
  </qemu:commandline>

rsync ${user}@${ip_slave}:/lib/modules/${KERNEL_VERSION}/source/vmlinux ${DEBUG_DIR}/
rsync --copy-links ${user}@${ip_slave}:/lib/modules/${KERNEL_VERSION}/source/vmlinux-gdb.py ${DEBUG_DIR}/

rsync -ra --include '*/' --include='*.'{c,h,py,ko} --exclude='*' user@{ip_slave}:/lib/modules/${KERNEL_VERSION}/build/ remote/ # J’importe tous les fichiers .c et .h vers mon hôte.
rsync user@{ip_slave}~/path/to/my/module.{c,ko,o,mod.o,mod.c} remote/modules/ # Même choses avec les éventuels modules à déboguer

echo "add-auto-load-safe-path ${DEBUG_DIR}/vmlinux-gdb.py” >>~/ .gdbinit

export PYTHONPATH="${DEBUG_DIR}/:$PYTHONPATH" # pour avoir accès au vmlinux-gdb.py
export cdir="${DEBUG_DIR}/" # Fichier contenant le code source du noyau.

$ gdb -q vmlinux -ex 'target remote localhost:1200' # Remplacer 1200 par votre port débogueur
Reading symbols from vmlinux…
gdb-peda$

gdb-peda$ list printk
2031 * One effect of this deferred printing is that code which calls printk() and
2032 * then changes console_loglevel may break. This is because console_loglevel
2033 * is inspected when the actual printing occurs.
2034 *
2035 * See also:
2036 * printf(3)
2037 *
2038 * See the vsnprintf() documentation for format string extensions over C99.
2039 */
2040 asmlinkage __visible int printk(const char *fmt, ...)
2041 {
2042 va_list args;
2043 int r;
2044
2045 va_start(args, fmt);
2046 r = vprintk_func(fmt, args);
2047 va_end(args);
2048
2049 return r;
gdb-peda$ hb printk
Hardware assisted breakpoint 1 at 0xffffffff81151ebe: file kernel/printk/printk.c, line 2041.
gdb-peda$ c
/* Attente que printk soit exécuté */
Thread 1 hit Breakpoint 1, printk (fmt=0xffffffff820dadf8 "\001\066Message de test!\n") at kernel/printk/printk.c:2041
2041 {
gdb-peda$n
2045 va_start(args, fmt);
gdb-peda$ x/xg args
0xffffc90000987d80: 0x0000000000000000

/**
 * @file   ebbchar.c
 * @author Derek Molloy
 * @date   7 April 2015
 * @version 0.1
 * @brief   An introductory character driver to support the second article of my series on
 * Linux loadable kernel module (LKM) development. This module maps to /dev/ebbchar and
 * comes with a helper C program that can be run in Linux user space to communicate with
 * this the LKM.
 * @see http://www.derekmolloy.ie/ for a full description and follow-up descriptions.
 */

#include <linux/init.h>           // Macros used to mark up functions e.g. __init __exit
#include <linux/module.h>         // Core header for loading LKMs into the kernel
#include <linux/device.h>         // Header to support the kernel Driver Model
#include <linux/kernel.h>         // Contains types, macros, functions for the kernel
#include <linux/fs.h>             // Header for the Linux file system support
#include <linux/uaccess.h>          // Required for the copy to user function
#define  DEVICE_NAME "ebbchar"    ///< The device will appear at /dev/ebbchar using this value
#define  CLASS_NAME  "ebb"        ///< The device class -- this is a character device driver

MODULE_LICENSE("GPL");            ///< The license type -- this affects available functionality
MODULE_AUTHOR("Derek Molloy");    ///< The author -- visible when you use modinfo
MODULE_DESCRIPTION("A simple Linux char driver for the BBB");  ///< The description -- see modinfo
MODULE_VERSION("0.1");            ///< A version number to inform users

static int    majorNumber;                  ///< Stores the device number -- determined automatically
static char   message[256] = {0};           ///< Memory for the string that is passed from userspace
static short  size_of_message;              ///< Used to remember the size of the string stored
static int    numberOpens = 0;              ///< Counts the number of times the device is opened
static struct class*  ebbcharClass  = NULL; ///< The device-driver class struct pointer
static struct device* ebbcharDevice = NULL; ///< The device-driver device struct pointer

// The prototype functions for the character driver -- must come before the struct definition
static int     dev_open(struct inode *, struct file *);
static int     dev_release(struct inode *, struct file *);
static ssize_t dev_read(struct file *, char *, size_t, loff_t *);
static ssize_t dev_write(struct file *, const char *, size_t, loff_t *);

/** @brief Devices are represented as file structure in the kernel. The file_operations structure from
 *  /linux/fs.h lists the callback functions that you wish to associated with your file operations
 *  using a C99 syntax structure. char devices usually implement open, read, write and release calls
 */
static struct file_operations fops =
{
   .open = dev_open,
   .read = dev_read,
   .write = dev_write,
   .release = dev_release,
};

/** @brief The LKM initialization function
 *  The static keyword restricts the visibility of the function to within this C file. The __init
 *  macro means that for a built-in driver (not a LKM) the function is only used at initialization
 *  time and that it can be discarded and its memory freed up after that point.
 *  @return returns 0 if successful
 */
static int __init ebbchar_init(void){
   printk(KERN_INFO "EBBChar: Initializing the EBBChar LKM\n");

   // Try to dynamically allocate a major number for the device -- more difficult but worth it
   majorNumber = register_chrdev(0, DEVICE_NAME, &fops);
   if (majorNumber<0){
      printk(KERN_ALERT "EBBChar failed to register a major number\n");
      return majorNumber;
   }
   printk(KERN_INFO "EBBChar: registered correctly with major number %d\n", majorNumber);

   // Register the device class
   ebbcharClass = class_create(THIS_MODULE, CLASS_NAME);
   if (IS_ERR(ebbcharClass)){                // Check for error and clean up if there is
      unregister_chrdev(majorNumber, DEVICE_NAME);
      printk(KERN_ALERT "Failed to register device class\n");
      return PTR_ERR(ebbcharClass);          // Correct way to return an error on a pointer
   }
   printk(KERN_INFO "EBBChar: device class registered correctly\n");

   // Register the device driver
   ebbcharDevice = device_create(ebbcharClass, NULL, MKDEV(majorNumber, 0), NULL, DEVICE_NAME);
   if (IS_ERR(ebbcharDevice)){               // Clean up if there is an error
      class_destroy(ebbcharClass);           // Repeated code but the alternative is goto statements
      unregister_chrdev(majorNumber, DEVICE_NAME);
      printk(KERN_ALERT "Failed to create the device\n");
      return PTR_ERR(ebbcharDevice);
   }
   printk(KERN_INFO "EBBChar: device class created correctly\n"); // Made it! device was initialized
   return 0;
}

/** @brief The LKM cleanup function
 *  Similar to the initialization function, it is static. The __exit macro notifies that if this
 *  code is used for a built-in driver (not a LKM) that this function is not required.
 */
static void __exit ebbchar_exit(void){
   device_destroy(ebbcharClass, MKDEV(majorNumber, 0));     // remove the device
   class_unregister(ebbcharClass);                          // unregister the device class
   class_destroy(ebbcharClass);                             // remove the device class
   unregister_chrdev(majorNumber, DEVICE_NAME);             // unregister the major number
   printk(KERN_INFO "EBBChar: Goodbye from the LKM!\n");
}

/** @brief The device open function that is called each time the device is opened
 *  This will only increment the numberOpens counter in this case.
 *  @param inodep A pointer to an inode object (defined in linux/fs.h)
 *  @param filep A pointer to a file object (defined in linux/fs.h)
 */
static int dev_open(struct inode *inodep, struct file *filep){
   numberOpens++;
   printk(KERN_INFO "EBBChar: Device has been opened %d time(s)\n", numberOpens);
   return 0;
}

/** @brief This function is called whenever device is being read from user space i.e. data is
 *  being sent from the device to the user. In this case is uses the copy_to_user() function to
 *  send the buffer string to the user and captures any errors.
 *  @param filep A pointer to a file object (defined in linux/fs.h)
 *  @param buffer The pointer to the buffer to which this function writes the data
 *  @param len The length of the b
 *  @param offset The offset if required
 */
static ssize_t dev_read(struct file *filep, char *buffer, size_t len, loff_t *offset){
   int error_count = 0;
   // copy_to_user has the format ( * to, *from, size) and returns 0 on success
   error_count = copy_to_user(buffer, message, size_of_message);

   if (error_count==0){            // if true then have success
      printk(KERN_INFO "EBBChar: Sent %d characters to the user\n", size_of_message);
      return (size_of_message=0);  // clear the position to the start and return 0
   }
   else {
      printk(KERN_INFO "EBBChar: Failed to send %d characters to the user\n", error_count);
      return -EFAULT;              // Failed -- return a bad address message (i.e. -14)
   }
}

/** @brief This function is called whenever the device is being written to from user space i.e.
 *  data is sent to the device from the user. The data is copied to the message[] array in this
 *  LKM using the sprintf() function along with the length of the string.
 *  @param filep A pointer to a file object
 *  @param buffer The buffer to that contains the string to write to the device
 *  @param len The length of the array of data that is being passed in the const char buffer
 *  @param offset The offset if required
 */
static ssize_t dev_write(struct file *filep, const char *buffer, size_t len, loff_t *offset){
   sprintf(message, "%s(%zu letters)", buffer, len);   // appending received string with its length
   size_of_message = strlen(message);                 // store the length of the stored message
   printk(KERN_INFO "EBBChar: Received %zu characters from the user\n", len);
   return len;
}

/** @brief The device release function that is called whenever the device is closed/released by
 *  the userspace program
 *  @param inodep A pointer to an inode object (defined in linux/fs.h)
 *  @param filep A pointer to a file object (defined in linux/fs.h)
 */
static int dev_release(struct inode *inodep, struct file *filep){
   printk(KERN_INFO "EBBChar: Device successfully closed\n");
   return 0;
}

/** @brief A module must use the module_init() module_exit() macros from linux/init.h, which
 *  identify the initialization function at insertion time and the cleanup function (as
 *  listed above)
 */
module_init(ebbchar_init);
module_exit(ebbchar_exit);

   make && make install

[  166.509046] EBBChar: Initializing the EBBChar LKM
[  166.509048] EBBChar: registered correctly with major number 247
[  166.509056] EBBChar: device class registered correctly
[  166.509655] EBBChar: device class created correctly

sudo echo 'azer' >/dev/ebbchar

[  359.839419] BUG: unable to handle page fault for address: 0000555fc992e400
[  359.839421] #PF: supervisor read access in kernel mode
[  359.839422] #PF: error_code(0x0001) - permissions violation
[  359.839422] PGD 80000001afd25067 P4D 80000001afd25067 PUD 188157067 PMD 1998e8067 PTE 800000015967d867
[  359.839424] Oops: 0001 [#1] SMP PTI
[  359.839426] CPU: 1 PID: 5152 Comm: echo Tainted: G           OE     5.3.0-rc1mytesting-00056-g7b5cf701ea9c-dirty #5
[  359.839426] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019
[  359.839430] RIP: 0010:string_nocheck+0x13/0x70
[  359.839431] Code: 00 00 00 4c 89 e7 e8 2c 95 00 00 4c 01 eb e9 79 ff ff ff 0f 1f 40 00 48 89 c8 55 49 89 f1 48 c1 f8 30 66 85 c0 48 89 e5 74 44 <44> 0f b6 02 45 84 c0 74 3b 83 e8 01 4c 8d 54 07 01 b8 01 00 00 00
[  359.839432] RSP: 0018:ffffb5b7c2a6bd78 EFLAGS: 00010286
[  359.839432] RAX: ffffffffffffffff RBX: ffffffffffffffff RCX: ffff0a00ffffff04
[  359.839433] RDX: 0000555fc992e400 RSI: ffffffffffffffff RDI: ffffffffc09e94e0
[  359.839433] RBP: ffffb5b7c2a6bd78 R08: ffffffffc09e9000 R09: ffffffffffffffff
[  359.839434] R10: ffffb5b7c2a6be80 R11: 0000000000000000 R12: 0000555fc992e400
[  359.839435] R13: ffff0a00ffffff04 R14: ffffffffc09e82d4 R15: ffffffffc09e82d4
[  359.839435] FS:  00007fd67ce03540(0000) GS:ffff9d8e73440000(0000) knlGS:0000000000000000
[  359.839436] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  359.839436] CR2: 0000555fc992e400 CR3: 0000000142f4e004 CR4: 00000000003606e0
[  359.839460] Call Trace:
[  359.839463]  string+0x48/0x60
[  359.839466]  vsnprintf+0x444/0x510
[  359.839467]  sprintf+0x51/0x70
[  359.839469]  dev_write+0x26/0x80 [ebbchar]
[  359.839470]  __vfs_write+0x1b/0x40
[  359.839471]  vfs_write+0xb1/0x1a0
[  359.839472]  ksys_write+0xa7/0xe0
[  359.839474]  __x64_sys_write+0x1a/0x20
[  359.839476]  do_syscall_64+0x5a/0x130
[  359.839477]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

# insmod ebbchar.ko # J’insère mon module noyau
$ ./start.sh
gdb-peda$ lx-symbols # J’actualise les symboles
loading vmlinux
scanning for modules in /home/max/prog/kgdb/remote
loading @0xffffffffc015d000: /home/my/path/modules/ebbchar.ko
loading @0xffffffffc027d000: /home/my/path/drivers/input/evdev.ko
# …
gdb-peda$ b dev_write # Je mets un point d’arrêt dans la fonction qui m’intéresse
Breakpoint 1 at 0xffffffffc013d000: file /home/user/testMmap/ebbchar.c, line 144.
gdb-peda$ c # Je continue l’exécution

sudo echo 'azer' >/dev/ebbchar

Thread 2 hit Breakpoint 1, dev_write () at /home/user/testMmap/ebbchar.c:144
144     static ssize_t dev_write(struct file *filep, const char *buffer, size_t len, loff_t *offset){
gdb-peda$ x/s message # Je peux lire mes variables normalement
0xffffffffc013f4e0 <message>:   "aa\003(4 letters)"
gdb-peda$ x/s buffer # Par contre je ne peux pas lire ma variable buffer
0x7ffc7fa6e4dc: Cannot access memory at address 0x7ffc7fa6e4dc

static ssize_t dev_write(struct file *filep, const char *buffer, size_t len, loff_t *offset) {
    char* kbuffer = kmalloc(len, GFP_KERNEL);
    copy_from_user(kbuffer, buffer, len);
    sprintf(message, “%s(%zu letters)”, kbuffer, len); // appending received string with its length
    size_of_message = strlen(message); // store the length of the stored message
    printk(KERN_INFO “EBBChar: Received %zu characters from the user\n”, len);
    kfree(kbuffer);
    return len;
}

# echo 'frjiogrfrkogpregkep'>/dev/ebbchar
# dmesg
/* … */
[ 1535.923624] EBBChar: Device has been opened 1 time(s)
[ 1535.951148] EBBChar: Received 20 characters from the user
[ 1535.951161] EBBChar: Device successfully closed

$ sudo ./kprobe 'p:myopen do_sys_open filename=+0(%si):string'

   DECLARE_EVENT_CLASS(sched_wakeup_template,
        TP_PROTO(struct rq *rq, struct task_struct *p, int success),
        TP_ARGS(rq, p, success),
        TP_STRUCT__entry(
                __array(       char,   comm,   TASK_COMM_LEN   )
                __field(        pid_t,  pid                     )
                __field(        int,    prio                    )
                __field(        int,    success                 )
                __field(        int,    target_cpu              )
        ),
        TP_fast_assign(
                memcpy(__entry->comm, p->comm, TASK_COMM_LEN);
                __entry->pid            = p->pid;
                __entry->prio           = p->prio;
                __entry->success        = success;
                __entry->target_cpu     = task_cpu(p);
        ),
        TP_printk("comm=%s pid=%d prio=%d success=%d target_cpu=%03d",
                  __entry->comm, __entry->pid, __entry->prio,
                  __entry->success, __entry->target_cpu)
   );