crash live system & -fipa-sra isra

目录

gdb kernel

1) vmlinux符号表的加载

a. 正常加载

b. 异常加载符号表

c. 指定具体的带有符号表的vmlinux文件

2）添加源码路径

3) 同步显示源码与汇编

4)  显示某个变量的值

a. 采用bpftrace  的watchpoint

b. bpftrace编译升级

c.  采用新版本bpftrace运行

crash live system

-fipa-sra isra

---

---

gdb kernel

1) vmlinux符号表的加载

a. 正常加载

gdb  vmlinux /proc/kcore

Reading symbols from vmlinux...done.  （这里提示符号表已经加载成功）
[New process 1]
Core was generated by `BOOT_IMAGE=/vmlinuz-5.14.0-rc5-next-20210811-amd64-desktop+ root=UUID=3ac51709-'.
#0  0x0000000000000000 in fixed_percpu_data ()
warning: File "/root/linux-note/scripts/gdb/vmlinux-gdb.py" auto-loading has been declined by your `auto-load safe-path' set to "$debugdir:$datadir/auto-load".
To enable execution of this file add
        add-auto-load-safe-path /root/linux-note/scripts/gdb/vmlinux-gdb.py
line to your configuration file "/root/.gdbinit".
To completely disable this security protection add
        set auto-load safe-path /
line to your configuration file "/root/.gdbinit".
For more information about this security protection see the
"Auto-loading safe path" section in the GDB manual.  E.g., run from the shell:
        info "(gdb)Auto-loading safe path"
运行命令测试可以看到符号表正常

(gdb) x/gx &sys_call_table
0xffffffff820002e0 <sys_call_table>:    0xffffffff81317fc0
(gdb) file
No executable file now.
Discard symbol table from `/root/linux-note/vmlinux'? (y or n) n （这里也提示了符号表的来源）
Not confirmed.
(gdb) x/5i 0xffffffff81317fc0
   0xffffffff81317fc0 <__x64_sys_read>: Cannot access memory at address 0xffffffff81317fc0
(gdb) 

b. 异常加载符号表

gdb  vmlinux /proc/kcore   此时从boot目录下读取，此目录的vmlinuxz是压缩后的，不带符号表信息，因而不能用于debug。针对这种情况，可以采用工具  https://github.com/elfmaster/kdress 添加符号信息。

For help, type "help".
--Type <RET> for more, q to quit, c to continue without paging--
Type "apropos word" to search for commands related to "word"...
Reading symbols from /boot/vmlinuz-5.14.0-rc5-next-20210811-amd64-desktop+...(no debugging symbols found)...done.

warning: core file may not match specified executable file.
[New process 1]
 

c. 指定具体的带有符号表的vmlinux文件

再次运行，主要保证 vmlinux要是非压缩版本的，所以这次直接到编译目录下寻找

 gdb /root/linux-note/vmlinux（当前系统运行的内核所对应的内核源码下的编译出的vmlinux）  /proc/kcore 
GNU gdb (Uos 8.2.1.1-1+security) 8.2.1
 

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from linux-note/vmlinux...done.
[New process 1]
Core was generated by `BOOT_IMAGE=/vmlinuz-5.14.0-rc5-next-20210811-amd64-desktop+ root=UUID=3ac51709-'.
#0  0x0000000000000000 in fixed_percpu_data ()
warning: File "/root/linux-note/scripts/gdb/vmlinux-gdb.py" auto-loading has been declined by your `auto-load safe-path' set to "$debugdir:$datadir/auto-load".
To enable execution of this file add
        add-auto-load-safe-path /root/linux-note/scripts/gdb/vmlinux-gdb.py
line to your configuration file "/root/.gdbinit".
To completely disable this security protection add
        set auto-load safe-path /
line to your configuration file "/root/.gdbinit".
For more information about this security protection see the
"Auto-loading safe path" section in the GDB manual.  E.g., run from the shell:
        info "(gdb)Auto-loading safe path"
 

(gdb) p  io_uring_fops
$6 = {owner = 0x0 <fixed_percpu_data>, llseek = 0x0 <fixed_percpu_data>, read = 0x0 <fixed_percpu_data>, write = 0x0 <fixed_percpu_data>, 
  read_iter = 0x0 <fixed_percpu_data>, write_iter = 0x0 <fixed_percpu_data>, iopoll = 0x0 <fixed_percpu_data>, iterate = 0x0 <fixed_percpu_data>, 
  iterate_shared = 0x0 <fixed_percpu_data>, poll = 0xffffffff81381080 <io_uring_poll>, unlocked_ioctl = 0x0 <fixed_percpu_data>, 
  compat_ioctl = 0x0 <fixed_percpu_data>, mmap = 0xffffffff81385020 <io_uring_mmap>, mmap_supported_flags = 0, open = 0x0 <fixed_percpu_data>, 
  flush = 0x0 <fixed_percpu_data>, release = 0xffffffff8138b380 <io_uring_release>, fsync = 0x0 <fixed_percpu_data>, 
  fasync = 0xffffffff813826e0 <io_uring_fasync>, lock = 0x0 <fixed_percpu_data>, sendpage = 0x0 <fixed_percpu_data>, 
  get_unmapped_area = 0x0 <fixed_percpu_data>, check_flags = 0x0 <fixed_percpu_data>, flock = 0x0 <fixed_percpu_data>, 
  splice_write = 0x0 <fixed_percpu_data>, splice_read = 0x0 <fixed_percpu_data>, setlease = 0x0 <fixed_percpu_data>, 
  fallocate = 0x0 <fixed_percpu_data>, show_fdinfo = 0xffffffff8138c110 <io_uring_show_fdinfo>, copy_file_range = 0x0 <fixed_percpu_data>, 
  remap_file_range = 0x0 <fixed_percpu_data>, fadvise = 0x0 <fixed_percpu_data>}
(gdb) p &io_uring_fops
$7 = (const struct file_operations *) 0xffffffff82043400 <io_uring_fops>
(gdb) 
(gdb) x/5i  io_uring_fasync
   0xffffffff813826e0 <io_uring_fasync>:        callq  0xffffffff81072700 <__fentry__>
   0xffffffff813826e5 <io_uring_fasync+5>:      push   %rbp
   0xffffffff813826e6 <io_uring_fasync+6>:      mov    0xc8(%rsi),%rax
   0xffffffff813826ed <io_uring_fasync+13>:     lea    0x448(%rax),%rcx
   0xffffffff813826f4 <io_uring_fasync+20>:     mov    %rsp,%rbp
 

2）添加源码路径

主要目的 在进行汇编查看寄存器时将汇编和源码对应

dir /root/linux-note/  运行此命令后

(gdb) show dir
Source directories searched: /root/linux-note:$cdir:$cwd
 

添加后运行l，可以看到远吗

(gdb) l io_uring_fasync
8679    }
8680
8681    static int io_uring_fasync(int fd, struct file *file, int on)
8682    {
8683            struct io_ring_ctx *ctx &#