编译并vscode可视化调试Linux 4.18内核

1. 安装必要软件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
# 安装编译依赖组件。
sudo apt install -y libncurses5-dev libssl-dev bison flex libelf-dev gcc make openssl libc6-dev
sudo apt install -y flex bison make gcc libssl-dev bc libelf-dev
wget https://mirrors.tuna.tsinghua.edu.cn/kernel/v4.x/linux-4.18.tar.gz
tar -zxf linux-4.18.tar.gz
cd linux-4.18.tar.gz

# 设置调试的编译菜单
export ARCH=x86
make x86_64_defconfig
make menuconfig

# 下面选项如果没有选上的,选上(点击空格键),然后 save 保存设置,退出 exit。
##################################################################
General setup --->
[*] Initial RAM filesystem and RAM disk (initramfs/initrd) support

Device Drivers --->
[*] Block devices --->
<*> RAM block device support
(65536) Default RAM disk size (kbytes)

Processor type and features --->
[*] Randomize the address of the kernel image (KASLR)

Kernel hacking --->
Compile-time checks and compiler options --->
[*] Compile the kernel with debug info
[*] Provide GDB scripts for kernel debugging

Device Drivers -->
Network device support -->
<*> Universal TUN/TAP device driver support

[*] Networking support -->
Networking options -->
<*> 802.1d Ethernet Bridging

# 编译内核。
make -j8

2. 编译内核

编译内核会遇见很多问题

2.1 网络库的问题

1
2
3
4
5
6
7
8
9
In file included from scripts/selinux/genheaders/genheaders.c:19:
# scripts/selinux/mdp/mdp.c 也会出现这种现象
./security/selinux/include/classmap.h:249:2: error: #error New address family defined, please update secclass_map.
249 | #error New address family defined, please update secclass_map.
| ^~~~~
make[3]: *** [scripts/Makefile.host:90: scripts/selinux/genheaders/genheaders] Error 1
make[2]: *** [scripts/Makefile.build:558: scripts/selinux/genheaders] Error 2
make[1]: *** [scripts/Makefile.build:558: scripts/selinux] Error 2
make: *** [Makefile:1045: scripts] Error 2

解决方法

1.找到错误中提示的.c文件,genheader.c文件和mdp.c文件编辑,去掉两个文件的头部引用中的

1
#include <sys/socket.h>

2.找到错误提示中的classmap.h文件
a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
编辑classmap.h,在头文件中添加

1
#include <linux/socket.h>

2.2 连接的问题

1
2
3
4
arch/x86/entry/entry_64.S: Assembler messages:
arch/x86/entry/entry_64.S:1667: Warning: no instruction mnemonic suffix given and no register operands; using default for `sysret'
AS arch/x86/entry/thunk_64.o
arch/x86/entry/thunk_64.o: warning: objtool: missing symbol table

使用这个patch

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Reported-by: Nathan Chancellor <natechancellor@xxxxxxxxx>
Signed-off-by: Josh Poimboeuf <jpoimboe@xxxxxxxxxx>
---
tools/objtool/elf.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
index be89c741ba9a..2b0f4f52f7b5 100644
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -380,8 +380,11 @@ static int read_symbols(struct elf *elf)

symtab = find_section_by_name(elf, ".symtab");
if (!symtab) {
- WARN("missing symbol table");
- return -1;
+ /*
+ * A missing symbol table is actually possible if it's an empty
+ * .o file. This can happen for thunk_64.o.
+ */
+ return 0;
}

symtab_shndx = find_section_by_name(elf, ".symtab_shndx");
--
2.29.2

3. 安装修改版的gdb

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
# 删除 gdb
gdb -v | grep gdb
apt remove gdb -y

# 安装其它组件。
sudo add-apt-repository ppa:ubuntu-toolchain-r/test
sudo apt install software-properties-common
sudo apt-get update

# 安装高版本 gcc。
gcc --version
sudo apt install gcc-9 g++-9 -y
sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-9 90 --slave /usr/bin/g++ g++ /usr/bin/g++-9
gcc --version

# 下载解压 gdb
cd /root
wget http://ftp.gnu.org/gnu/gdb/gdb-8.3.tar.gz
tar zxf gdb-8.3.tar.gz

# 修改 gdb/remote.c 代码。
cd gdb-8.3
vim gdb/remote.c

然后

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
#在gdb/remote.c文件下作如下修改
/* Further sanity checks, with knowledge of the architecture. */
// if (buf_len > 2 * rsa->sizeof_g_packet)
// error (_("Remote 'g' packet reply is too long (expected %ld bytes, got %d "
// "bytes): %s"),
// rsa->sizeof_g_packet, buf_len / 2,
// rs->buf.data ());
if (buf_len > 2 * rsa->sizeof_g_packet) {
rsa->sizeof_g_packet = buf_len;
for (i = 0; i < gdbarch_num_regs (gdbarch); i++){
if (rsa->regs[i].pnum == -1)
continue;
if (rsa->regs[i].offset >= rsa->sizeof_g_packet)
rsa->regs[i].in_g_packet = 0;
else
rsa->regs[i].in_g_packet = 1;
}
}

#编译GDB
./configure
./make -j8
# 有可能会有这个报错
# error: "Please include config.h first."
# vim ./gdb/build-gnulib/import/unistd.h
# 加入 #include "../config.h"
# 总之缺啥就在哪儿加上 #include "../config.h"
# 打开GDB,看是否为新版本

sudo apt install texinfo
sudo ./make install
# makeinfo: command not found

gdb -v

4. 安装qemu并配置qemu

1
sudo apt install -y qemu qemu-system-x86

制作helloworld的rootfs用于测试

1
touch main.c

键入以下代码

1
2
3
4
5
6
7
8
9
10
11
#include <stdio>
int main()
{
printf("hello world!");
printf("hello world!");
printf("hello world!");
printf("hello world!");
fflush(stdout);
while(1);
return 0;
}

编译

1
2
gcc --static -o helloworld main.c
echo helloworld | cpio -o --format=newc > rootfs

Qemu直接运行测试(非必须)

1
2
3
4
5
qemu-system-x86_64 \
-kernel ./arch/x86/boot/bzImage \
-initrd ./rootfs \
-append "root=/dev/ram rdinit=/helloworld console=ttyS0" \
-nographic -serial mon:stdio

但是实践证明还是有问题,最好是来一个图形化界面

Qemu 开启GDB调试

1
2
3
4
5
6
7
qemu-system-x86_64  \
-kernel ./arch/x86/boot/bzImage \
-initrd ./rootfs \
-append "root=/dev/ram rdinit=/helloworld" \
-smp 2 \
-s -S \
-append nokaslr

-s= -gdb tcp:1234, 这个可以改

-S 表示进入调试模式,在这个模式下已开始CPU是冻结的,在gdb中按下c来继续

这里的root=/dev/ram 因此需要在内核里面重新编译,开启对ext2的支持

进行以上会打开Qemu并进入等待调试状态,此时可以直接gdb调试,如下(非必须)

1
2
3
4
5
gdb ./vmLinux
#以下进行调试
target remote:1234
b start_kernel
c

可以发现内核被断点在start_kernel函数上

5. 使用vscode远程阅读linux内核源码

首先直接打开的话会发现有很多地方没法跳转,需要安装C/C++ GNU Global

在VScode远程窗口中安装C/C++ GNU Global 这个扩展

在远程机器中

1
sudo apt install global

在vscode设置中,写入

1
2
3
4
5
{
"gnuGlobal.globalExecutable": "/usr/bin/global",
"gnuGlobal.gtagsExecutable": "/usr/bin/gtags",
"gnuGlobal.objDirPrefix": "/home/damaoooo/.global"
}

shift + command(ctrl) + P,然后 rebuild Gtags Data

之后就可以进行Linux源代码阅读了

如果需要debug,需要安装 GDB debug 插件,随后配置launch.json

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
{
// Use IntelliSense to learn about possible attributes.
// Hover to view descriptions of existing attributes.
// For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
"version": "0.2.0",
"configurations": [
{
"name": "kernel-debug",
"type": "cppdbg",
"request": "launch",
"miDebuggerServerAddress": "192.168.1.114:1234",
"program": "${workspaceFolder}/vmlinux",
"args": [],
"stopAtEntry": true,
"cwd": "${workspaceFolder}",
"environment": [],
"externalConsole": false,
"logging": {
"engineLogging": false
},
"MIMode": "gdb",
}
]
}

启动qemu,就可以对内核进行调试了

但是有问题,如图所示,很多的变量会被optimized out,是因为默认编译的时候开了O2,而开O0选项,直接编译不过,需要做一些修改,我懒得改了直接单步调试看内存了。

image-20220703171844616