Debugging Linux Kernel using KProbes - Counting number of processes created

-
Kernel provides a lot of techniques for debugging Linux Kernel. Most of the developers use printk for its ease and simplicity. There are some cons using printk.

  • Difficult when frequent changes are required
  • Time-consuming, as recompiling, installing and rebooting the kernel is required 
We have already seen kgdb in our previous posts, In this post, we will learn KProbes.

What are KProbes?

KProbes is a debugging technique for Linux Kernel using which you can
  • Monitor events
  • Filter out performance bottlenecks
  • Log Specific Events
  • Trace Problems etc
KProbes enables you to dynamically break into any kernel function and collect debugging and performance information.  

How KProbes work?

1. User needs to know the address or symbol which needs to be debugged
2. Create pre and post handlers which will be called before and after the instruction execution at the address or symbol
Prototype: 
int pre_handler(struct kprobe *p, struct pt_regs *regs);
void post_handler(struct kprobe *p, struct pt_regs *regs,
  unsigned long flags);
3. You can retrieve the address from /proc/kallsyms

Kernel Configuration for KProbes

CONFIG_KPROBES
CONFIG_MODULES
CONFIG_MODULE_UNLOAD
CONFIG_KALLSYMS
CONFIG_DEBUG_INFO

Sample driver code which will increment the counter when fork is called

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/kprobes.h>

MODULE_LICENSE("GPL");
static unsigned int counter = 0;
static struct kprobe kp;

int pre_handler(struct kprobe *p, struct pt_regs *regs)
{
    printk(KERN_INFO"%s:counter:%d\n",__func__, counter++);
    return 0;
}

void post_handler(struct kprobe *p, struct pt_regs *regs, unsigned long flags)
{
    printk(KERN_INFO"%s:counter:%d\n",__func__, counter++);
}
static int test_kprobe_init(void)
{
    printk(KERN_INFO"%s: In init\n", __func__);
    kp.pre_handler = pre_handler;
    kp.post_handler = post_handler;
    kp.symbol_name = "_do_fork";
    register_kprobe(&kp);
    return 0;
}

static void test_kprobe_exit(void)
{
    unregister_kprobe(&kp);
    printk(KERN_INFO"%s: In exit\n", __func__);
}
module_init(test_kprobe_init);
module_exit(test_kprobe_exit);

dmesg output:






Comments

Post a Comment

Popular posts from this blog

bb.utils.contains yocto

-
Image
bb.utils.contains  is most commonly used function in Yocto. grep in poky directory returned with 696 count. $ grep -nr 'bb.utils.contains' poky/ | wc -l 696 It's definition is present in 'poky/bitbake/lib/bb/utils.py' file This function returns third argument if the second argument is subset of the first argument else returns fourth argument Let's take an example to understand this. You can see from the above screenshot, when the second argument is a subset of first argument, "present" was returned, else "notpresent" was returned We can also use bb.utils.contains inside if loop. This we can use inside a recipe. if ${@bb.utils.contains('SOMEFLAG','NEWVALUE3','true','false',d)}; then     FOO = 'HELLO' fi
Read more

Difference between RDEPENDS and DEPENDS in Yocto

-
We normally observe these two (RDEPENDS and DEPENDS) whenever we open any recipe. What should we choose when we write our own recipe. DEPENDS -> Build Time Dependency RDEPENDS -> Run Time Dependency DEPENDS: When a recipe 'A' is DEPENDS on recipe 'B'. In this case, Bitbake first builds recipe 'B' and then recipe 'A' E.g. You need 'dbus' to be built before 'wpa_supplicant'. RDEPENDS: When a recipe 'A' is RDEPENDS on recipe 'B'. In this case, Bitbake deploys 'B' on the target system when it deploys 'A'.  E.g. 'perf' RDEPENDS on 'bash' In other words, DEPENDS are those set of packages that should be available while building package, whereas RDEPENDS are set of packages that should be available during execution of the program.
Read more

make config vs oldconfig vs defconfig vs menuconfig vs savedefconfig

-
Image
Building the Linux Kernel is a two-step process: Configuring the Kernel options Building the Kernel with those options. There are many methods available for configuring the kernel. make config: Text-based Configuration.  Options are prompted one after another. All options need to be answered Access to former options is not possible make menuconfig: Menu-driven user interface Allows to navigate forwards and backward directly between features Allows to load and save files with filenames different from ".config" Provides search feature It uses ncurses library for GUI. If the ncurses library is not installed, make menuconfig option fails. To install ncurses library on Ubuntu: sudo apt-get install libncurses5-dev make defconfig: Creates a ".config" file with default options from the ARCH supplied defconfig Configurations are generally stored in the directory: arch/$(ARCH)/configs $ ls arch/x86/configs/ i386_defconfi
Read more