kprobe调试工具_config_have

本文链接：https://blog.csdn.net/lzhf1122/article/details/128451424

kprobe调试工具

前言
1 Kprobe结构体与API介绍
2 用例kprobe_example.c分析与演示
3 Kprobe的原理

前言

debug内核函数变量的时候最常用的是添加log，用printk看下相关的信息，但是这种方式往往需要重新编译内核，然后再启动设备。

而Kprobe可以在运行的内核中动态插入探测点，执行你预定义的操作。可以跟踪内核几乎所有的代码地址，并且当断点被击中后会响应处理函数。

使用kprobe最常用的就是查询函数调用的参数和返回值。

目前，使用kprobe可以通过自行编写内核模块，向内核注册探测点，探测函数可根据需要自行定制，使用灵活方便；

1 Kprobe结构体与API介绍

 60 struct kprobe {     
 61     struct hlist_node hlist;
 62  
 63     /* list of kprobes for multi-handler support */
 64     struct list_head list;
 65 
 66     /*count the number of times this probe was temporarily disarmed */
 67     unsigned long nmissed;
 68 
 69     /* location of the probe point */
 70     kprobe_opcode_t *addr;
 71 
 72     /* Allow user to indicate symbol name of the probe point */
 73     const char *symbol_name;
 74 
 75     /* Offset into the symbol */
 76     unsigned int offset;
 77 
 78     /* Called before addr is executed. */
 79     kprobe_pre_handler_t pre_handler;
 80 
 81     /* Called after addr is executed, unless... */
 82     kprobe_post_handler_t post_handler;
 83 
 84     /* Saved opcode (which has been replaced with breakpoint) */
 85     kprobe_opcode_t opcode;
 86 
 87     /* copy of the original instruction */
 88     struct arch_specific_insn ainsn;
 89 
 90     /*
 91      * Indicates various status flags.
 92      * Protected by kprobe_mutex after this kprobe is registered.
 93      */
 94     u32 flags;
 95 };

int register_kprobe(struct kprobe *kp)      //向内核注册kprobe探测点
void unregister_kprobe(struct kprobe *kp)   //卸载kprobe探测点
int register_kprobes(struct kprobe **kps, int num)     //注册探测函数向量，包含多个探测点
void unregister_kprobes(struct kprobe **kps, int num)  //卸载探测函数向量，包含多个探测点
int disable_kprobe(struct kprobe *kp)       //临时暂停指定探测点的探测
int enable_kprobe(struct kprobe *kp)        //恢复指定探测点的探测

2 用例kprobe_example.c分析与演示

2.1 开启kprobe的config

CONFIG_KPROBES=y
CONFIG_HAVE_KPROBES=y

2.2 linux内核源码中提供了kprobe的用例

samples/kprobes/kprobe_example.c

程序中定义了一个struct kprobe结构实例kp并初始化其中的symbol_name字段为“kernel_clone”，表明它将要探测kernel_clone函数。在模块的初始化函数中，注册了 pre_handler、post_handler这2个回调函数分别为handler_pre、handler_post，最后调用register_kprobe注册。在模块的卸载函数中调用unregister_kprobe函数卸载kp探测点。

另外如果想获取传入函数的参数和调用进程等信息，因为pre_handler和post_handler回调函数的输入参数里面包含了struct pt_regs *regs ，所以可以类似这样：

struct file *file = (struct file *)regs->regs[0];  //具体参数对应哪个寄存器需看反汇编代码
pr_info("<%s>,pid = %ld\n",current->comm, current->pid);
dump_stack();

2.3 编写Makefile

  1 export ARCH=arm64
  2 export CROSS_COMPILE=aarch64-linux-gnu-
  3 
  4 KERNEL_DIR ?=~/linux_rt/linux-rt-5.15/
  5 obj-m := kprobe_example.o
  6 
  7 modules:
  8     $(MAKE) -C $(KERNEL_DIR) M=$(PWD) modules
  9 
 10 clean:
 11     $(MAKE) -C $(KERNEL_DIR) M=$(PWD) clean
 12 
 13 install:
 14     cp *.ko $(KERNEL_DIR)/kmodules

2.4 测试效果

[root@liebao kprobe]# insmod kprobe_example.ko
[root@liebao kprobe]# [ 1552.862075] kprobe_init: Planted kprobe at (____ptrval____)
[ 1552.864013] handler_pre: <kernel_clone> p->addr = 0x(____ptrval____), pc = 0xffff8000080830f0, pstate = 0x60000005
[ 1552.864299] handler_post: <kernel_clone> p->addr = 0x(____ptrval____), pstate = 0x60000005
[ 1552.866225] handler_pre: <kernel_clone> p->addr = 0x(____ptrval____), pc = 0xffff8000080830f0, pstate = 0x80000005
[ 1552.866284] handler_post: <kernel_clone> p->addr = 0x(____ptrval____), pstate = 0x80000005

[root@liebao kprobe]# ls
[ 1556.661789] handler_pre: <kernel_clone> p->addr = 0x(____ptrval____), pc = 0xffff8000080830f0, pstate = 0x80000005
[ 1556.661913] handler_post: <kernel_clone> p->addr = 0x(____ptrval____), pstate = 0x80000005
Makefile              kprobe_example.ko     kprobe_example.mod.o
Module.symvers        kprobe_example.mod    kprobe_example.o
kprobe_example.c      kprobe_example.mod.c  modules.order