应用调试(三)oops
应用调试(三)oops
引入
在驱动程序调试中，发生段错误后内核打印出oops信息，包括pc值，寄存器值和栈信息
Unable to handle kernel paging request at virtual address 56000050
.....
但是我们再应用程序故意引入一个错误（在地址0的地方写数据），只是提示段错误，没有信息打印，那么如何打开这个选项呢？
配置内核打开用户oops
搜索字符Unable to handle kernel，可以在arch\arm\mm\fault.c找到
__do_kernel_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
struct pt_regs *regs)
{
...
printk(KERN_ALERT
"Unable to handle kernel %s at virtual address %08lx\n",
(addr < PAGE_SIZE) ? "NULL pointer dereference" :
"paging request", addr);
die("Oops", regs, fsr);
...
}
也可以搜索下内核态的调用位置看到
void do_bad_area(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
{
struct task_struct *tsk = current;
struct mm_struct *mm = tsk->active_mm;
/*
* If we are in kernel mode at this point, we
* have no context to handle this fault with.
*/
if (user_mode(regs))
__do_user_fault(tsk, addr, fsr, SIGSEGV, SEGV_MAPERR, regs);
else
__do_kernel_fault(mm, addr, fsr, regs);
}
同时在下方就能看到打印用户态的oops
static void
__do_user_fault(struct task_struct *tsk, unsigned long addr,
unsigned int fsr, unsigned int sig, int code,
struct pt_regs *regs)
{
struct siginfo si;
#ifdef CONFIG_DEBUG_USER
if (user_debug & UDBG_SEGV) {
printk(KERN_DEBUG "%s: unhandled page fault (%d) at 0x%08lx, code 0x%03x\n",
tsk->comm, sig, addr, fsr);
show_pte(tsk->mm, addr);
show_regs(regs);
}
#endif
tsk->thread.address = addr;
tsk->thread.error_code = fsr;
tsk->thread.trap_no = 14;
si.si_signo = sig;
si.si_errno = 0;
si.si_code = code;
si.si_addr = (void __user *)addr;
force_sig_info(sig, &si, tsk);
}
从代码上就可以看到需要两个处理
CONFIG_DEBUG_USER配置需要打开user_debug变量的设置
CONFIG_DEBUG_USER
搜索内核这个配置项DEBUG_USER，已经打开了
│ Symbol: DEBUG_USER [=y] │
│ Prompt: Verbose user fault messages │
│ Defined at arch/arm/Kconfig.debug:18 │
│ Location: │
│ -> Kernel hacking
user_debug
搜索变量，可以看到如下,很明显可以通过设置启动参数arch\arm\kernel\traps.c
#ifdef CONFIG_DEBUG_USER
unsigned int user_debug;
static int __init user_debug_setup(char *str)
{
get_option(&str, &user_debug);
return 1;
}
__setup("user_debug=", user_debug_setup);
#endif
设置启动参数测试
set bootargs noinitrd root=/dev/mtdblock3 init=/linuxrc console=ttySAC0 user_debug=0xff
boot
mount -t nfs -o nolock,vers=2 192.168.95.222:/home/book/stu /mnt
运行错误的程序，可以看到打印寄存器和pc值
# ./test_debug
a = 0x12
pgd = c2cac000
[00000000] *pgd=32cca031, *pte=00000000, *ppte=00000000
Pid: 792, comm: test_debug
CPU: 0 Not tainted (2.6.22.6 #9)
PC is at 0x84ac
LR is at 0x84d0
pc : [<000084ac>] lr : [<000084d0>] psr: 60000010
sp : bed7ae40 ip : bed7ae54 fp : bed7ae50
r10: 4013365c r9 : 00000000 r8 : 00008514
r7 : 00000001 r6 : 000085cc r5 : 00008568 r4 : bed7aec4
r3 : 00000012 r2 : 00000000 r1 : 00001000 r0 : 00000000
Flags: nZCv IRQs on FIQs on Mode USER_32 Segment user
Control: c000717f Table: 32cac000 DAC: 00000015
[<c002cd1c>] (show_regs+0x0/0x4c) from [<c0031a98>] (__do_user_fault+0x5c/0xa4)
r4:c06c30a0
[<c0031a3c>] (__do_user_fault+0x0/0xa4) from [<c0031d38>] (do_page_fault+0x1dc/0x20c)
r7:c0026520 r6:c3333860 r5:c06c30a0 r4:ffffffec
[<c0031b5c>] (do_page_fault+0x0/0x20c) from [<c002b224>] (do_DataAbort+0x3c/0xa0)
[<c002b1e8>] (do_DataAbort+0x0/0xa0) from [<c002be48>] (ret_from_exception+0x0/0x10)
Exception stack(0xc2ca1fb0 to 0xc2ca1ff8)
1fa0: 00000000 00001000 00000000 00000012
1fc0: bed7aec4 00008568 000085cc 00000001 00008514 00000000 4013365c bed7ae50
1fe0: bed7ae54 bed7ae40 000084d0 000084ac 60000010 ffffffff
r8:00008514 r7:00000001 r6:000085cc r5:00008568 r4:c039bfc8
Segmentation fault
这里其实是有stack的，但这个栈实际上寄存器的值而非程序的栈,可以在notepad++上双击数字看到高亮的
Exception stack(0xc2ca1fb0 to 0xc2ca1ff8)
r0
1fa0: 00000000 00001000 00000000 00000012
1fc0: bed7aec4 00008568 000085cc 00000001 00008514 00000000 4013365c bed7ae50
psr
1fe0: bed7ae54 bed7ae40 000084d0 000084ac 60000010 ffffffff
r8:00008514 r7:00000001 r6:000085cc r5:00008568 r4:c039bfc8
打印用户堆栈
可以看到内核态打印栈
__do_kernel_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
struct pt_regs *regs)
>die("Oops", regs, fsr);
>show_stack_log_lvl(current, regs->sp, regs, KERN_EMERG)
>dump_mem("Stack: ", log_lvl, sp,THREAD_SIZE + (unsigned long)tinfo);
>show_trace_log_lvl(tsk, (unsigned long *)sp, regs, log_lvl);
试了下直接调用内核的打印栈的方式并不能成功，哈哈
添加代码为
{
printk("Stack by die: \n");
die("Oops", regs, fsr);
}
只会提示这个
Stack by die:
Internal error: Oops: 817 [#1]
我们这里就手动复制到用户态打印好了更改代码如下
static void
__do_user_fault(struct task_struct *tsk, unsigned long addr,
unsigned int fsr, unsigned int sig, int code,
struct pt_regs *regs)
{
struct siginfo si;
#ifdef CONFIG_DEBUG_USER
if (user_debug & UDBG_SEGV) {
printk(KERN_DEBUG "%s: unhandled page fault (%d) at 0x%08lx, code 0x%03x\n",
tsk->comm, sig, addr, fsr);
show_pte(tsk->mm, addr);
show_regs(regs);
}
#endif
/////////////////////////////////////////////////////////////////////////////
if(0)
{
printk("Stack by die: \n");
die("Oops", regs, fsr);
}
if (1)
{
unsigned long i=0,val=0;
printk("Stack: \n");
while(i<1024)
{
/* copy_from_user()只是用来检测该地址是否有效,如有效,便获取地址数据,否则break */
if(copy_from_user(&val, (const void __user *)(regs->ARM_sp+i*4), 4))
break;
printk("%08x ",val);
i++;
if(i%8==0) printk("\n");
}
printk("\n END of Stack\n");
}
/////////////////////////////////////////////////////////////////////////////
tsk->thread.address = addr;
tsk->thread.error_code = fsr;
tsk->thread.trap_no = 14;
si.si_signo = sig;
si.si_errno = 0;
si.si_code = code;
si.si_addr = (void __user *)addr;
force_sig_info(sig, &si, tsk);
}
可以看到打印了栈了
# /mnt/code/test_debug
a = 0x12
pgd = c2cc4000
[00000000] *pgd=32c82031, *pte=00000000, *ppte=00000000
Pid: 789, comm: test_debug
CPU: 0 Not tainted (2.6.22.6 #6)
PC is at 0x84ac
LR is at 0x84d0
pc : [<000084ac>] lr : [<000084d0>] psr: 60000010
sp : be87ee50 ip : be87ee64 fp : be87ee60
r10: 4013365c r9 : 00000000 r8 : 00008514
r7 : 00000001 r6 : 000085cc r5 : 00008568 r4 : be87eed4
r3 : 00000012 r2 : 00000000 r1 : 00001000 r0 : 00000000
Flags: nZCv IRQs on FIQs on Mode USER_32 Segment user
Control: c000717f Table: 32cc4000 DAC: 00000015
[<c002cd1c>] (show_regs+0x0/0x4c) from [<c0031a9c>] (__do_user_fault+0x60/0x148)
r4:c04a8800
[<c0031a3c>] (__do_user_fault+0x0/0x148) from [<c0031ddc>] (do_page_fault+0x1dc/0x20c)
[<c0031c00>] (do_page_fault+0x0/0x20c) from [<c002b224>] (do_DataAbort+0x3c/0xa0)
[<c002b1e8>] (do_DataAbort+0x0/0xa0) from [<c002be48>] (ret_from_exception+0x0/0x10)
Exception stack(0xc2cb1fb0 to 0xc2cb1ff8)
1fa0: 00000000 00001000 00000000 00000012
1fc0: be87eed4 00008568 000085cc 00000001 00008514 00000000 4013365c be87ee60
1fe0: be87ee64 be87ee50 000084d0 000084ac 60000010 ffffffff
r8:00008514 r7:00000001 r6:000085cc r5:00008568 r4:c039bfc8
Stack:
00000000 be87ee74 be87ee64 000084d0 000084a0 00000000 be87ee88 be87ee78
000084f0 000084c4 00000000 be87eea8 be87ee8c 00008554 000084e4 00000000
00000012 be87eed4 00000001 00000000 be87eeac 40034f14 00008524 00000000
00000000 0000839c 00000000 00000000 4001d594 000083c4 000085cc 4000c02c
be87eed4 be87ef7f 00000000 be87ef94 be87ef9e be87efa5 be87efb0 be87efd3
be87efe1 00000000 00000010 00000003 00000006 00001000 00000011 00000064
00000003 00008034 00000004 00000020 00000005 00000006 00000007 40000000
00000008 00000000 00000009 0000839c 0000000b 00000000 0000000c 00000000
0000000d 00000000 0000000e 00000000 00000017 00000000 0000000f be87ef7b
00000000 00000000 76000000 2f006c34 2f746e6d 65646f63 7365742f 65645f74
00677562 52455355 6f6f723d 4f480074 2f3d454d 52455400 74763d4d 00323031
48544150 62732f3d 2f3a6e69 2f727375 6e696273 69622f3a 752f3a6e 622f7273
53006e69 4c4c4548 69622f3d 68732f6e 44575000 2f002f3d 2f746e6d 65646f63
7365742f 65645f74 00677562 00000000
END of Stack
Segmentation fault
分析栈
同样可以先反汇编arm-linux-objdump -D test_debug > test_debug.dis
PC is at 0x84ac
LR is at 0x84d0
Stack:
00000000 be87ee74 be87ee64 000084d0 000084a0 00000000 be87ee88 be87ee78
C_sp ldr ↑ B_sp
000084f0 000084c4 00000000 be87eea8 be87ee8c 00008554 000084e4 00000000
ldr ↑ A_sp ldr ↑ main_sp
00000012 be87eed4 00000001 00000000 be87eeac 40034f14 00008524 00000000
ldr ↑
00000000 0000839c 00000000 00000000 4001d594 000083c4 000085cc 4000c02c
be87eed4 be87ef7f 00000000 be87ef94 be87ef9e be87efa5 be87efb0 be87efd3
这里的mani函数最后会返回40034f14这个动态库，动态库不太好分析，我们重新编译为静态链接分析下main被谁调用
main的调用
在动态库中,可以查看 /proc/pidxxx/maps,看到程序动态库的地址，但是这个函数我们直接段错误退出了所以无法查看，可以看下别的pid（shell）的
# cat /proc/772/maps
00008000-000bf000 r-xp 00000000 1f:03 646 /bin/busybox
000c7000-000c8000 rw-p 000b7000 1f:03 646 /bin/busybox
000c8000-000ec000 rwxp 000c8000 00:00 0 [heap]
40000000-40015000 r-xp 00000000 1f:03 733 /lib/ld-2.3.6.so
40015000-40017000 rw-p 40015000 00:00 0
4001d000-4001e000 rw-p 00015000 1f:03 733 /lib/ld-2.3.6.so
4001e000-40023000 r-xp 00000000 1f:03 691 /lib/libcrypt-2.3.6.so
40023000-4002a000 ---p 00005000 1f:03 691 /lib/libcrypt-2.3.6.so
4002a000-4002b000 rw-p 00004000 1f:03 691 /lib/libcrypt-2.3.6.so
4002b000-40052000 rw-p 4002b000 00:00 0
40052000-400f9000 r-xp 00000000 1f:03 708 /lib/libm-2.3.6.so
400f9000-40101000 ---p 000a7000 1f:03 708 /lib/libm-2.3.6.so
40101000-40102000 rw-p 000a7000 1f:03 708 /lib/libm-2.3.6.so
40102000-4020d000 r-xp 00000000 1f:03 734 /lib/libc-2.3.6.so
4020d000-40215000 ---p 0010b000 1f:03 734 /lib/libc-2.3.6.so
40215000-40219000 rw-p 0010b000 1f:03 734 /lib/libc-2.3.6.so
40219000-4021b000 rw-p 40219000 00:00 0
bed05000-bed1a000 rwxp bed05000 00:00 0 [stack]
那么我们可以静态编译这个文件，看看被谁调用
arm-linux-gcc -static -o test_debug_static test_debug.c
arm-linux-objdump -D test_debug_static > test_debug_static.dis
运行后打印了错误信息
# /mnt/code/test_debug_static
<Physical Layer error>
<Physical Layer error>
a = 0x12
pgd = c2cd4000
[00000000] *pgd=32c94031, *pte=00000000, *ppte=00000000
Pid: 789, comm: test_debug_stat
CPU: 0 Not tainted (2.6.22.6 #6)
PC is at 0x81e0
LR is at 0x8204
pc : [<000081e0>] lr : [<00008204>] psr: 60000010
.....
Stack:
00000000 beeeac94 beeeac84 00008204 000081d4 00000000 beeeaca8 beeeac98
C_Sp ldr B_Sp
00008224 000081f8 00000000 beeeacc8 beeeacac 00008288 00008218 00000000
ldr A_Sp ldr main_Sp
00000012 beeeaec4 00000001 00000000 beeeaccc 000084ac 00008258 756e694c
ldr ↑
00000078 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 6f6e2800
0029656e 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 2e320000
32322e36 0000362e 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 23000000
61532036 614a2074 3931206e 3a333120 303a3630 53432032 30322054 00003931
.......
END of Stack
Segmentation fault
跳过一些栈，直接看到
00008248 <main>:
可以看到main的返回 000084ac
0000829c <__libc_start_main>:
84a4: e1a0e00f mov lr, pc ;这个就是main
84ac: eb0000fc bl 88a4 <exit>
也就是最终的关系是
__libc_start_main
> main
> exit
