Linux lab4
一、准备工作
1. gdb-multiarch安装
由于使用的是arm64内核,因此需要gdb-multiarch来调试
下载安装
sudo apt install gdb-multiarch
2. 安装编译工具链
为了编译arm64文件,需要安装交叉编译工具链
sudo apt install gcc-aarch64-linux-gnu
sudo apt install libncurses5-dev build-essential git bison flex libssl-dev
3. 制作根文件系统
3.1 编译busybox
cd ~/linux-5.4.34
wget https://busybox.net/downloads/busybox-1.33.1.tar.bz2
tar -xjf busybox-1.33.1.tar.bz2
cd busybox-1.33.1
make menuconfig
在configuration中打开静态库编译选项
Settings --->
[*] Build static binary (no shared libs)
指定编译工具并进行编译
export ARCH=arm64
export CROSS_COMPILE=aarch64-linux-gnu-
//编译
make
make install
等待完成,在busybox目录下生成_install目录
3.2 定制文件系统
在根目录下添加其他目录
cd _install
mkdir etc dev lib
在etc目录下创建其他文件
profile: 在linuxrc启动后读取属性。
fstab:提供文件系统挂载信息
inittab:读取sysinit并执行
rcS:查找设备并mknod
在etc文件夹下执行
cd etc
vim profile
//以下为profile内容
#!/bin/sh
export HOSTNAME=imingz
export USER=root
export HOME=/home
export PS1="[$USER@$HOSTNAME \W]\# "
PATH=/bin:/sbin:/usr/bin:/usr/sbin
LD_LIBRARY_PATH=/lib:/usr/lib:$LD_LIBRARY_PATH
export PATH LD_LIBRARY_PATH
//继续创建
vim inittab
::sysinit:/etc/init.d/rcS
::respawn:-/bin/sh
::askfirst:-/bin/sh
::ctrlaltdel:/bin/umount -a -r
//继续创建
vim fstab
#device mount-point type options dump fsck order
proc /proc proc defaults 0 0
tmpfs /tmp tmpfs defaults 0 0
sysfs /sys sysfs defaults 0 0
tmpfs /dev tmpfs defaults 0 0
debugfs /sys/kernel/debug debugfs defaults 0 0
kmod_mount /mnt 9p trans=virtio 0 0
//继续创建
mkdir -p init.d
cd init.d
vim rcS
mkdir -p /sys
mkdir -p /tmp
mkdir -p /proc
mkdir -p /mnt
/bin/mount -a
mkdir -p /dev/pts
mount -t devpts devpts /dev/pts
echo /sbin/mdev > /proc/sys/kernel/hotplug
mdev -s
切换至dev文件夹下
cd ../../dev
//将用户态输出打印到串口上
sudo mknod console c 5 1
切换至lib文件夹下
cd ../lib
//拷贝lib库
sudo cp /usr/aarch64-linux-gnu/lib/*.so* -a .
4. 编译内核
4.1 配置内核
cd ~/linux-5.4.34
make defconfig ARCH=arm64
//加入配置
vim .config
以下为加入的配置内容
CONFIG_DEBUG_INFO=y
CONFIG_INITRAMFS_SOURCE="./root"
CONFIG_INITRAMFS_ROOT_UID=0
CONFIG_INITRAMFS_ROOT_GID=0
CONFIG_DEBUG_INFO 是为了方便调试
CONFIG_INITRAMFS_SOURCE 是指定 kernel ramdisk 的位置,这样指定之后 ramdisk 会直接被编译到 kernel 镜像中
将制作好的根文件系统复制到root目录下
cp -r ../busybox-1.33.1/_install root
sudo mknod root/dev/console c 5 1
4.2 执行编译
make ARCH=arm64 Image -j8 CROSS_COMPILE=aarch64-linux-gnu-
5. 启动qemu
5.1 下载qemu
sudo apt install build-essential zlib1g-dev pkg-config libglib2.0-dev binutils-dev libboost-all-dev autoconf libtool libssl-dev libpixman-1-dev libpython-dev python-pip python-capstone virtualenv
wget https://download.qemu.org/qemu-4.2.1.tar.xz
extract qemu-4.2.1.tar.xz
cd qemu-4.2.1
./configure --target-list=x86_64-softmmu,x86_64-linux-user,arm-softmmu,arm-linux-user,aarch64-softmmu,aarch64-linux-user --enable-kvm
make
sudo make install
5.2 启动qemu
注意路径
/usr/local/bin/qemu-system-aarch64 -m 512M -smp 4 -cpu cortex-a57 -machine virt -kernel ~/linux-5.4.34/arch/arm64/boot/Image -append "rdinit=/linuxrc nokaslr console=ttyAMA0 loglevel=8" -nographic -s
在以上安装软件过程中,可能会出现:
E: Could not get lock /var/lib/dpkg/lock-frontend - open (11: Resource temporarly unavailable)
解决方法
sudo rm /var/lib/dpkg/lock-frontend
sudo rm /var/lib/dpkg/lock
二、系统调用
1. 构造代码
使用PPT上提供的代码,
在rootfs目录下创建test.c文件
#include <stdio.h>
#include <time.h>
#include <sys/time.h>
int main()
{
time_t tt;
struct timeval tv;
struct tm *t;
#if 0
gettimeofday(&tv,NULL);
#else
asm volatile(
"add x0, x29, 16\n\t" //X0寄存器用于传递参数&tv
"mov x1, #0x0\n\t" //X1寄存器用于传递参数NULL
"mov x8, #0xa9\n\t" //使用X8传递系统调用号169
"svc #0x0\n\t" //触发系统调用
);
#endif
tt = tv.tv_sec; //tv是保存获取时间结果的结构体
t = localtime(&tt); //将世纪秒转换成对应的年月日时分秒
printf("time: %d/%d/%d %d:%d:%d\n",
t->tm_year + 1900,
t->tm_mon,
t->tm_mday,
t->tm_hour,
t->tm_min,
t->tm_sec);
return 0;
}
对该文件进行交叉编译
aarch64-linux-gnu-gcc -o test test.c -static
make ARCH=arm64 Image -j8 CROSS_COMPILE=aarch64-linux-gnu-
2. 启动调试
设置vscode配置文件:
c_cpp_properties.json:
{
"configurations": [
{
"name": "Linux",
"includePath": [
"${workspaceFolder}/arch/x86/include/**",
"${workspaceFolder}/include/**",
"${workspaceFolder}/include/linux/**",
"${workspaceFolder}/arch/x86/**",
"${workspaceFolder}/**"
],
"cStandard": "c11",
"intelliSenseMode": "gcc-x64",
"compileCommands": "${workspaceFolder}/compile_commands.json"
}
],
"version": 4
}
launch.json:
{
// launch.json
// Use IntelliSense to learn about possible attributes.
// Hover to view descriptions of existing attributes.
// For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
"version": "0.2.0",
"configurations": [
{
"name": "(gdb) linux",
"type": "cppdbg",
"request": "launch",
"preLaunchTask": "vm",
"program": "${workspaceRoot}/vmlinux",
"miDebuggerPath":"/usr/bin/gdb-multiarch",
"miDebuggerServerAddress": "localhost:1234",
"args": [],
"stopAtEntry": true,
"cwd": "${workspaceFolder}",
"environment": [],
"externalConsole": false,
"MIMode": "gdb",
"miDebuggerArgs": "-n",
"targetArchitecture": "x64",
"setupCommands": [
{
"text": "dir .",
"ignoreFailures": false
},
{
"text": "add-auto-load-safe-path ./",
"ignoreFailures": false
},
{
"text": "-enable-pretty-printing",
"ignoreFailures": true
}
]
}
]
}
settings.json:
{
"search.exclude": {
"**/.git": true,
"**/.svn": true,
"**/.DS_Store": true,
"**/drivers": true,
"**/sound": true,
"**/tools": true,
"**/arch/alpha": true,
"**/arch/arc": true,
"**/arch/c6x": true,
"**/arch/h8300": true,
"**/arch/hexagon": true,
"**/arch/ia64": true,
"**/arch/m32r": true,
"**/arch/m68k": true,
"**/arch/microblaze": true,
"**/arch/mn10300": true,
"**/arch/nds32": true,
"**/arch/nios2": true,
"**/arch/parisc": true,
"**/arch/powerpc": true,
"**/arch/s390": true,
"**/arch/sparc": true,
"**/arch/score": true,
"**/arch/sh": true,
"**/arch/um": true,
"**/arch/unicore32": true,
"**/arch/xtensa": true
},
"files.exclude": {
"**/.*.*.cmd": true,
"**/.*.d": true,
"**/.*.o": true,
"**/.*.S": true,
"**/.git": true,
"**/.svn": true,
"**/.DS_Store": true,
"**/drivers": true,
"**/sound": true,
"**/tools": true,
"**/arch/alpha": true,
"**/arch/arc": true,
"**/arch/c6x": true,
"**/arch/h8300": true,
"**/arch/hexagon": true,
"**/arch/ia64": true,
"**/arch/m32r": true,
"**/arch/m68k": true,
"**/arch/microblaze": true,
"**/arch/mn10300": true,
"**/arch/nds32": true,
"**/arch/nios2": true,
"**/arch/parisc": true,
"**/arch/powerpc": true,
"**/arch/s390": true,
"**/arch/sparc": true,
"**/arch/score": true,
"**/arch/sh": true,
"**/arch/um": true,
"**/arch/unicore32": true,
"**/arch/xtensa": true
},
"[c]": {
"editor.detectIndentation": false,
"editor.tabSize": 8,
"editor.insertSpaces": false
},
"C_Cpp.errorSquiggles": "disabled"
}
tasks.json:
注意文件路径
{
// tasks.json
// See https://go.microsoft.com/fwlink/?LinkId=733558
// for the documentation about the tasks.json format
"version": "2.0.0",
"tasks": [
{
"label": "vm",
"type": "shell",
"command": "qemu-system-aarch64 -m 128M -smp 1 -cpu cortex-a57 -machine virt -kernel ~/linux-5.4.34/arch/arm64/boot/Image -initrd ../rootfs.cpio.gz -append "rdinit=/init console=ttyAMA0 loglevel=8" -nographic -s ",
"presentation": {
"echo": true,
"clear": true,
"group": "vm"
},
"isBackground": true,
"problemMatcher": [
{
"pattern": [
{
"regexp": ".",
"file": 1,
"location": 2,
"message": 3
}
],
"background": {
"activeOnStart": true,
"beginsPattern": ".",
"endsPattern": ".",
}
}
]
},
{
"label": "build linux",
"type": "shell",
"command": "make",
"group": {
"kind": "build",
"isDefault": true
},
"presentation": {
"echo": false,
"group": "build"
}
}
]
}
启动调试。
打断点
在对应内核函数处停下
3. 过程分析
通过查看调用堆栈,当用户态调用gettimeofday()触发系统调用。
以el0_sync为例,在触发异常时首先做的就是保存执行现场,即寄存器信息等,然后根据异常原因跳转到el0_svc,el0_svc调用el0_svc_handler、el0_svc_common函数,将系统调用号传递给invoke_syscall函数。
接着执行 invoke_syscall 函数,将通用寄存器中的内容传入 syscall_fn(),接着调用 __arm64_sys_gettimeofday
之后将返回值存入到X0寄存器中。
系统调用返回前,恢复程序现场,包括恢复ELR_EL1和SPSR_EL1的值。
最后,内核调用异常返回指令eret,CPU把ELR_EL1写会PC,把SPSR_EL1写会PSTATE,返回用户态。
学号254