Linux Kernel

gdb vmlinux

target remote :1234

# 直接输出
p (char*) &__log_buf[log_start]
# 定义gdb函数dmesg输出
define dmesg
    set $__log_buf = $arg0
    set $log_start = $arg1
    set $log_end = $arg2
    set $x = $log_start
    echo "
       while ($x < $log_end)
              set $c = (char)(($__log_buf)[$x++])
              printf "%c" , $c
       end
         echo "\n
end

document dmesg
dmesg __log_buf log_start log_end
Print the content of the kernel message buffer
end

lsmod

cat /sys/module/mydriver/sections/.text

#gdb implementation of the linux lsmod
define lsmod
    set $current = modules.next
    set $offset =  ((int)&((struct module *)0).list)
    printf "Module\tAddress\n"

    while($current.next != modules.next)
         printf "%s\t%p\n",  \
                ((struct module *) (((void *) ($current)) - $offset ) )->name ,\
                ((struct module *) (((void *) ($current)) - $offset ) )->module_core
         set $current = $current.next
    end
end
# Loading Symbols of a loaded module
add-symbol-file drivers/mydrivers/mydriver.o 0xbf098000

#define KERN_EMERG "<0>" /* 紧急事件，一般是系统崩溃之前提示的消息*/
#define KERN_ALERT "<1>" /* 必须立即采取行动*/
#define KERN_CRIT "<2>" /* 临界状态，通常涉及严重的硬件或软件操作失败*/
#define KERN_ERR "<3>" /* 用于报告错误状态，设备驱动程序会经常使用KERN_ERR来报告来自硬件的问题*/
#define KERN_WARNING "<4>" /* 对可能出现问题的情况进行警告，这类情况通常不会对系统造成严重的问题*/
#define KERN_NOTICE "<5>" /* 有必要进行提示的正常情形，许多与安全相关的状况用这个级别进行汇报*/
#define KERN_INFO "<6>" /* 内核提示性信息，很多驱动程序在启动的时候，用这个级别打印出它们找到的硬件信息*/
#define KERN_DEBUG "<7>" /* 用于调试信息*/

# arm-eabi-gdb ./vmlinux
(gdb) set remotebaud 115200
(gdb) target remote /dev/ttyS0

OUTPUT_ARCH(arm)
ENTRY(_start)
SECTIONS
{
  /DISCARD/ : {
    *(.ARM.exidx*)
    *(.ARM.extab*)
    /*
     * Discard any r/w data - this produces a link error if we have any,
     * which is required for PIC decompression.  Local data generates
     * GOTOFF relocations, which prevents it being relocated independently
     * of the text/got segments.
     */
    *(.data)
  }

  . = TEXT_START;
  _text = .;

  .text : {
    _start = .;
    *(.start)
    *(.text)
    *(.text.*)
    *(.fixup)
    *(.gnu.warning)
    *(.glue_7t)
    *(.glue_7)
  }

HEAD    = head.o
$(obj)/vmlinux: $(obj)/vmlinux.lds $(obj)/$(HEAD) $(obj)/piggy.o \
        $(addprefix $(obj)/, $(OBJS)) $(lib1funcs) $(ashldi3) \
        $(bswapsdi2) $(efi-obj-y) FORCE
    @$(check_for_multiple_zreladdr)
    $(call if_changed,ld)
    @$(check_for_bad_syms)

.section ".start", #alloc, #execinstr     //属性是可分配和可执行的
/**
 * sort out different calling conventions
 */
   .align
   /**
    * Always enter in ARM state for CPUs that support the ARM ISA.
    * As of today (2014) that's exactly the members of the A and R
    * classes.
    */
 AR_CLASS(.arm) //.align 伪指令和 .arm 伪指令告诉汇编器，这是一个使用 arm32 指令集并 要求对齐的 section
start:
        .type    start,#function
        .rept    7 @重复空操作7次
        __nop
        .endr
   ARM(mov  r0, r0)
   ARM(b    1f)  @跳转到1处
 THUMB(badr r12, 1f)
 THUMB(bx    r12)

        .word    _magic_sig    @ Magic numbers to help the loader  
                               @ 魔数0x016f2818是在uboot中用于判断zImage的存在
                               @ 这个是内核和uboot约定好的。
        .word    _magic_start  @ absolute load/run zImage address 用于指定zImage的加载和运行的绝对地址
        .word    _magic_end    @ zImage end address
        .word    0x04030201    @ endianness flag 表示字节序标志

 THUMB(.thumb)
1:        __EFI_HEADER  //指向 EFI 头

 ARM_BE8(setend    be)         @ go BE8 if compiled for BE8
 AR_CLASS(mrs    r9, cpsr)
#ifdef CONFIG_ARM_VIRT_EXT
        bl __hyp_stub_install  @ get into SVC mode, reversibly
#endif
        @ r1和r2中分别存放着由uboot传递过来的
        @ architecture ID和指向标记列表的指针。
        mov r7, r1 @ save architecture ID
        mov r8, r2 @ save atags pointer

#ifndef CONFIG_CPU_V7M
        /**
         * Booting from Angel - need to enter SVC mode and disable
         * FIQs/IRQs (numeric definitions from angel arm.h source).
         * We only do this if we were in user mode on entry.
         */
        mrs    r2, cpsr   @get current mode
        tst    r2, #3     @not user?
        bne    not_angel
        mov    r0, #0x17  @angel_SWIreason_EnterSVC
 ARM(swi 0x123456) @ angel_SWI_ARM  angel_SWI_ARM 0x123456是arm指令集的半主机操作编号
 THUMB(svc 0xab)   @ angel_SWI_THUMB
not_angel:
        safe_svcmode_maskall r0  @进入svc模式
        msr  spsr_cxsf, r9       @ Save the CPU boot mode in
                                 @ SPSR
#endif

#ifdef CONFIG_AUTO_ZRELADDR
    /**
     * Find the start of physical memory.  As we are executing
     * without the MMU on, we are in the physical address space.
     * We just need to get rid of any offset by aligning the
     * address.
     *
     * This alignment is a balance between the requirements of
     * different platforms - we have chosen 128MB to allow
     * platforms which align the start of their physical memory
     * to 128MB to use this feature, while allowing the zImage
     * to be placed within the first 128MB of memory on other
     * platforms.  Increasing the alignment means we place
     * stricter alignment requirements on the start of physical
     * memory, but relaxing it means that we break people who
     * are already placing their zImage in (eg) the top 64MB
     * of this range.
     */
    mov    r4, pc
    and    r4, r4, #0xf8000000
    /* Determine final kernel image address. */
    add    r4, r4, #TEXT_OFFSET
#else
    ldr    r4, =zreladdr
#endif

# Text offset. This list is sorted numerically by address in order to
# provide a means to avoid/resolve conflicts in multi-arch kernels.
textofs-y    := 0x00008000
# We don't want the htc bootloader to corrupt kernel during resume
textofs-$(CONFIG_PM_H1940)      := 0x00108000
# SA1111 DMA bug: we don't want the kernel to live in precious DMA-able memory
ifeq ($(CONFIG_ARCH_SA1100),y)
        textofs-$(CONFIG_SA1111) := 0x00208000
endif
        textofs-$(CONFIG_ARCH_MSM8X60) := 0x00208000
        textofs-$(CONFIG_ARCH_MSM8960) := 0x00208000
        textofs-$(CONFIG_ARCH_AXXIA) := 0x00308000
# The byte offset of the kernel image in RAM from the start of RAM.TEXT_OFFSET := $(textofs-y)

/**
 * Set up a page table only if it won't overwrite ourself.
 * That means r4 < pc || r4 - 16k page directory > &_end.
 * Given that r4 > &_end is most unfrequent, we add a rough
 * additional 1MB of room for a possible appended DTB.
 */
 mov    r0, pc
 cmp    r0, r4 //此操作影响状态寄存器中的C状态位.
 ldrcc    r0, LC0+32
 addcc    r0, r0, pc
 cmpcc    r4, r0
 orrcc    r4, r4, #1        @ remember we skipped cache_on
 blcs    cache_on //如果pc>r4则直接执行这里

.align    2
    .type    LC0, #object
LC0:
    .word  LC0            @r1
    .word  __bss_start    @r2
    .word  _end           @r3
    .word  _edata         @r6
    .word  input_data_end - 4    @ r10 (inflated size location)
    .word  _got_start     @r11
    .word  _got_end       @ip
    .word  .L_user_stack_end    @ sp
    //LC0+32位置，zImage 需要重定位的长度再加上 “16K + 1M” 的长度
    .word  _end - restart + 16384 + 1024*1024   
    .size  LC0, . - LC0

/**
 * Turn on the cache.  We need to setup some page tables so that we
 * can have both the I and D caches on.
 *
 * We place the page tables 16k down from the kernel execution address,
 * and we hope that nothing else is using it.  If we're using it, we
 * will go pop!
 *
 * On entry,
 *  r4 = kernel execution address
 *  r7 = architecture number
 *  r8 = atags pointer
 * On exit,
 *  r0, r1, r2, r3, r9, r10, r12 corrupted
 * This routine must preserve:
 *  r4, r7, r8
 */
    .align    5
cache_on:    mov    r3, #8 @ cache_on function
    b    call_cache_fn

call_cache_fn:    adr    r12, proc_types
#ifdef CONFIG_CPU_CP15
    mrc    p15, 0, r9, c0, c0    @ get processor ID
#elif defined(CONFIG_CPU_V7M)
    /*
    * On v7-M the processor id is located in the V7M_SCB_CPUID
    * register, but as cache handling is IMPLEMENTATION DEFINED on
    * v7-M (if existant at all) we just return early here.
    * If V7M_SCB_CPUID were used the cpu ID functions (i.e.
    * __armv7_mmu_cache_{on,off,flush}) would be selected which
    * use cp15 registers that are not implemented on v7-M.
    */
    bx    lr
#else
    ldr    r9, =CONFIG_PROCESSOR_ID
#endif
1:
    ldr    r1, [r12, #0]        @ get value
    ldr    r2, [r12, #4]        @ get mask
    eor    r1, r1, r9        @ (real ^ match)
    tst    r1, r2            @       & mask
 ARM(addeq pc, r12, r3) @ call cache function
 THUMB(addeq    r12, r3)
 THUMB(moveq    pc, r12) @ call cache function
    add    r12, r12, #PROC_ENTRY_SIZE
    b      1b

/**
 * Table for cache operations.  This is basically:
 *   - CPU ID match
 *   - CPU ID mask
 *   - 'cache on' method instruction
 *   - 'cache off' method instruction
 *   - 'cache flush' method instruction
 *
 * We match an entry using: ((real_id ^ match) & mask) == 0
 *
 * Writethrough caches generally only need 'on' and 'off'
 * methods.  Writeback caches _must_ have the flush method
 * defined.
 */
    .align    2
    .type    proc_types,#object
proc_types:
    .word    0x41000000  @ old ARM ID
    .word    0xff00f000
    mov    pc, lr
 THUMB(nop)
    mov    pc, lr
 THUMB(nop)
    mov    pc, lr
 THUMB(nop)
    .word 0x000f0000 @ new CPU Id               
    .word 0x000f0000
    W(b)  __armv7_mmu_cache_on
    W(b)  __armv7_mmu_cache_off
    W(b)  __armv7_mmu_cache_flush

__armv7_mmu_cache_on:
    mov r12, lr
#ifdef CONFIG_MMU
    mrc p15, 0, r11, c0, c1, 4    @ read ID_MMFR0
    tst r11, #0xf  @ VMSA
    movne r6, #CB_BITS | 0x02    @ !XN
    blne  __setup_mmu

__setup_mmu:
  sub     r3, r4, #16384  @ Page directory size
  bic     r3, r3, #0xff   @ Align the pointer
  bic     r3, r3, #0x3f00

/**
 * Initialise the page tables, turning on the cacheable and bufferable
 * bits for the RAM area only.
 */
mov     r0, r3
mov     r9, r0, lsr #18
mov     r9, r9, lsl #18         @ start of RAM
add     r10, r9, #0x10000000    @ a reasonable RAM size
mov     r1, #0x12               @ XN|U + section mapping
orr     r1, r1, #3 << 10        @ AP=11
add     r2, r3, #16384

1:
    cmp     r1, r9           @ if virt > start of RAM
    cmphs   r10, r1          @   && end of RAM > virt
    bic     r1, r1, #0x1c    @ clear XN|U + C + B
    orrlo   r1, r1, #0x10    @ Set XN|U for non-RAM
    orrhs   r1, r1, r6       @ set RAM section settings
    str     r1, [r0], #4     @ 1:1 mapping
    add     r1, r1, #1048576
    teq     r0, r2
    bne     1b

/**
 * If ever we are running from Flash, then we surely want the cache
 * to be enabled also for our execution instance...  We map 2MB of it
 * so there is no map overlap problem for up to 1 MB compressed kernel.
 * If the execution is in RAM then we would only be duplicating the above.
 */
    orr    r1, r6, #0x04  @ ensure B is set for this
    orr    r1, r1, #3 << 10
    mov    r2, pc
    mov    r2, r2, lsr #20
    orr    r1, r1, r2, lsl #20
    add    r0, r3, r2, lsl #2
    str    r1, [r0], #4
    add    r1, r1, #1048576
    str    r1, [r0]
    mov    pc, lr
ENDPROC(__setup_mmu)

__armv7_mmu_cache_on:
    mov     r12, lr
#ifdef CONFIG_MMU
    mrc     p15, 0, r11, c0, c1, 4  @ read ID_MMFR0
    tst     r11, #0xf               @ VMSA
    movne   r6, #CB_BITS | 0x2      @ !XN
    blne    __setup_mmu
    mov     r0, #0
    mcr     p15, 0, r0, c7, c10, 4  @ drain write buffer
    tst     r11, #0xf               @ VMSA
    mcrne   p15, 0, r0, c8, c7, 0   @ flush I,D TLBs
#endif

mrc    p15, 0, r0, c1, c0, 0 @ read control reg
bic    r0, r0, #1 << 28      @ clear SCTLR.TRE
orr    r0, r0, #0x5000       @ I-cache enable, RR cache replacement
orr    r0, r0, #0x003c       @ write buffer
bic    r0, r0, #2            @ A (no unaligned access fault)
orr    r0, r0, #1 << 22      @ U (v6 unaligned access model)
                    @ (needed for ARM1176)

#ifdef CONFIG_MMU
    mrcne   p15, 0, r6, c2, c0, 2   @ read ttb control reg
    orrne   r0, r0, #1              @ MMU enable
    movne   r1, #0xfffffffd         @ domain 0 = client
    bic     r6, r6, #1 << 31        @ 32-bit translation system
    bic     r6, r6, #(7 << 0) | (1 << 4)    @ use only ttbr0
    mcrne   p15, 0, r3, c2, c0, 0   @ load page table pointer
    mcrne   p15, 0, r1, c3, c0, 0   @ load domain access control
    mcrne   p15, 0, r6, c2, c0, 2   @ load ttb control
#endif

mcr     p15, 0, r0, c7, c5, 4   @ ISB
mcr     p15, 0, r0, c1, c0, 0   @ load control register
mrc     p15, 0, r0, c1, c0, 0   @ and read it back
mov     r0, #0
mcr     p15, 0, r0, c7, c5, 4   @ ISB
mov     pc, r12

restart:
    adr     r0, LC0
    ldmia   r0, {r1, r2, r3, r6, r10, r11, r12}
    ldr     sp, [r0, #28]

.align  2
    .type   LC0, #object
LC0:
    .word   LC0                     @ r1
    .word   __bss_start             @ r2
    .word   _end                    @ r3
    .word   _edata                  @ r6
    .word   input_data_end - 4      @ r10 (inflated size location)
    .word   _got_start              @ r11
    .word   _got_end                @ ip
    .word   .L_user_stack_end       @ sp
    .word   _end - restart + 16384 + 1024*1024
    .size   LC0, . - LC0

/**
 * We might be running at a different address. We need
 * to fix up various pointers.
 */
sub     r0, r0, r1    @ caclculate the delta offset
add     r6, r6, r0    @ _edata
add     r10, r10, r0  @ inflated kernel size location

$(obj)/piggy_data: $(obj)/../Image FORCE
        $(call if_changed,$(compress-y))

compress-$(CONFIG_KERNEL_GZIP) = gzip
compress-$(CONFIG_KERNEL_LZO)  = lzo
compress-$(CONFIG_KERNEL_LZMA) = lzma
compress-$(CONFIG_KERNEL_XZ)   = xzkern
compress-$(CONFIG_KERNEL_LZ4)  = lz4

$(obj)/piggy_data: $(obj)/../Image FORCE
        $(call if_changed,gzip)

quiet_cmd_gzip = GZIP    $@
      cmd_gzip = cat $(filter-out FORCE,$^) | gzip -n -f -9 > $@

$ ll arch/arm/boot/Image
    -rwxrwxr-x 1 buddy buddy 11931944 4月   1 07:06 Image*

$ bless arch/arm/boot/compressed/piggy_data
    EB 11 97 AB C6 BC B8 40 5D 87 38 5B 35 E6 05 45 6A EC 99 66 4F 5F
    49 A3 3F 96 EB A4 1D 2B E9 1A BB 1B D7 B7 78 F5 80 26 4E 4E FF 0F
    A1 10 18 DA 28 11 B6 00

/**
 * The kernel build system appends the size of the
 * decompressed kernel at the end of the compressed data
 * in little-endian form.
 */
ldrb    r9, [r10, #0]
ldrb    lr, [r10, #1]
orr     r9, r9, lr, lsl #8
ldrb    lr, [r10, #2]
ldrb    r10, [r10, #3]
orr     r9, r9, lr, lsl #16
orr     r9, r9, r10, lsl #24

#ifndef CONFIG_ZBOOT_ROM
    /* malloc space is above the relocated stack (64k max) */
    add     sp, sp, r0
    add     r10, sp, #0x10000
#endif
    mov     r5, #0                  @ init dtb size to 0

/**
 * Check to see if we will overwrite ourselves.
 *   r4  = final kernel address (possibly with LSB set)
 *   r9  = size of decompressed image
 *   r10 = end of this image, including  bss/stack/malloc space if non XIP
 * We basically want:
 *   r4 - 16k page directory >= r10 -> OK
 *   r4 + image length <= address of wont_overwrite -> OK
 * Note: the possible LSB in r4 is harmless here.
 */
    add     r10, r10, #16384
    cmp     r4, r10
    bhs     wont_overwrite
    add     r10, r4, r9
    adr     r9, wont_overwrite
    cmp     r10, r9
    bls     wont_overwrite

/**
 * Relocate ourselves past the end of the decompressed kernel.
 *   r6  = _edata
 *   r10 = end of the decompressed kernel
 * Because we always copy ahead, we need to do it from the end and go
 * backward in case the source and destination overlap.
 */
    /**
    * Bump to the next 256-byte boundary with the size of
    * the relocation code added. This avoids overwriting
    * ourself when the offset is small.
    */
    add     r10, r10, #((reloc_code_end - restart + 256) & ~255)
    bic     r10, r10, #255

    /* Get start of code we want to copy and align it down. */
    adr     r5, restart
    bic     r5, r5, #31

sub     r9, r6, r5   @ size to copy
add     r9, r9, #31  @ rounded up to a multiple
bic     r9, r9, #31  @ ... of 32 bytes
add     r6, r9, r5
add     r9, r9, r10

1:
    ldmdb   r6!, {r0 - r3, r10 - r12, lr}
    cmp     r6, r5
    stmdb   r9!, {r0 - r3, r10 - r12, lr}
    bhi     1b

    /* Preserve offset to relocated code. */
    sub     r6, r9, r6

#ifndef CONFIG_ZBOOT_ROM
    /* cache_clean_flush may use the satck, so relocated it */
    add     sp, sp, r6
#endif

/**
 * Clean and flush the cache to maintain consistency
 *
 * On exit,
 *  r1, r2, r3, r9, r10, r11, r12 corrupted
 * This routine must preserve:
 *  r4, r6, r7, r8
 */
    .align  5
cache_clean_flush:
    mov     r3, #16
    b       call_cache_fn

__armv7_mmu_cache_flush:
    tst     r4, #1
    bne     iflush
    mrc     p15, 0, r10, c0, c1, 5  @ read ID_MMFR1
    tst     r10, #0xf << 16         @ hierarchical cache (ARMv7)
    mov     r10, #0
    beq     hierarchical
    mcr     p15, 0, r10, c7, c14, 0 @ clean+invalidate D
    b       iflush

hierarchical:
    mcr     p15, 0, r10, c7, c10, 5 @ DMB
    stmfd   sp!, {r0-r7, r9-r11}
    mrc     p15, 1, r0, c0, c0, 1   @ read clidr
    ands    r3, r0, #0x7000000      @ extract loc from clidr
    mov     r3, r3, lsr #23         @ left align loc bit field
    beq     finished                @ if loc is 0, then no need to c
    mov     r10, #0                 @ start clean at cache level 0

loop1:
    add     r2, r10, r10, lsr #1    @ work out 3x current cache leve
    mov     r1, r0, lsr r2          @ extract cache type bits from c
    and     r1, r1, #7              @ mask of the bits for current c
    cmp     r1, #2                  @ see what cache we have at this
    blt     skip                    @ skip if no cache, or just i-ca
    mcr     p15, 2, r10, c0, c0, 0  @ select current cache level in
    mcr     p15, 0, r10, c7, c5, 4  @ isb to sych the new cssr&csidr
    mcr     p15, 1, r1, c0, c0, 0   @ read the new csidr

(gdb) b BS_debug
    Breakpoint 1 at 0x600102a4: file arch/arm/boot/compressed/head.S, line 341.
(gdb) c
    Continuing.
    Breakpoint 1, BS_debug () at arch/arm/boot/compressed/head.S:341
    341   add    r2, r10, r10, lsr #1    @ work out 3x current cache level
(gdb) n
    342   mov    r1, r0, lsr r2  @ extract cache type bits from clidr
(gdb) info reg r10
    r10   0x0    0
(gdb) info reg r2
    r2    0x0    0
(gdb) n
    343   and    r1, r1, #7  @ mask of the bits for current cache only
(gdb) info reg r1
    r1    0x9000003  150994947
(gdb) n
    344   cmp    r1, #2      @ see what cache we have at this level
(gdb) info reg r1
    r1    0x3     3
(gdb) n
    345   blt    skip  @ skip if no cache, or just i-cache
(gdb) n
    346   mcr    p15, 2, r10, c0, c0, 0    @ select current cache level in cssr
(gdb) n
    347   mcr    p15, 0, r10, c7, c5, 4    @ isb to sych the new cssr&csidr
(gdb) info reg r10
    r10   0x0    0
(gdb) n
    348   mrc    p15, 1, r1, c0, c0, 0    @ read the new csidr
(gdb) n
    349   and    r2, r1, #7        @ extract the length of the cache lines
(gdb) info reg r1
    r1    0xe00fe019          -535830503

and     r2, r1, #7              @ extract the length of the cache lines
add     r2, r2, #4              @ add 4 (line length offset)
ldr     r4, =0x3ff
ands    r4, r4, r1, lsr #3      @ find maximum number on the way size
clz     r5, r4                  @ find bit position of way size increment
ldr     r7, =0x7fff
ands    r7, r7, r1, lsr #13     @ extract max number of the index size

loop2:
    mov     r9, r4    @ create working copy of max way size
loop3:
 ARM(orr  r11, r10, r9, lsl r5) @ factor way and cache number into r11
 ARM(orr  r11, r11, r7, lsl r2) @ factor index number into r11
    mcr  p15, 0, r11, c7, c14, 2 @ clean & invalidate by set/way
    subs r9, r9, #1   @ decrement the way
    bge  loop3
    subs r7, r7, #1   @ decrement the index
    bge  loop2
skip:
    add  r10, r10, #2 @ increment cache number
    cmp  r3, r10
    bgt  loop1

finished:
    ldmfd   sp!, {r0-r7, r9-r11}
    mov     r10, #0                 @ switch back to cache level 0
    mcr     p15, 2, r10, c0, c0, 0  @ select current cache level in cssr
iflush:
    mcr     p15, 0, r10, c7, c10, 4 @ DSB
    mcr     p15, 0, r10, c7, c5, 0  @ invalidate I+BTB
    mcr     p15, 0, r10, c7, c10, 4 @ DSB
    mcr     p15, 0, r10, c7, c5, 4  @ ISB
    mov     pc, lr

badr    r0, restart
add     r0, r0, r6
mov     pc, r0