Linux kernel Debugging tools oops Ksymoops Objdump__linux

The article about Oops, in order to later see reproduced. Thank the original author.

1. OOPS
What is oops? If you write a Linux module or Linux driver, for oops is not unfamiliar, when the module program error, the terminal will print some of the annoying registers and data, such as:
Divide error:0000
cpu:0
Eip:0010:[] Tainted:p
eflags:00010286
eax:c10b0048 ebx:d0064000 ecx:00005ae5 edx:c10b0048
esi:00000000 edi:00000000 EBP:C770DEFC ESP:C770DEEC
ds:0018 es:0018 ss:0018
Process Insmod.old (pid:1160, stackpage=c770d000)
Stack:c0101d04 0f76a067 00067000 00000000 c770df1c d00640be d00640e4 00000212
00000060 d0064000 00000000 00000000 Ffffffea C01165e1 00000000 08085a05
0000010d 00000060 00000060 00000005 c2ea95a0 c4145000 cc5ca000 d0066000
Call Trace: [] [] [] [] []
Code:f6 7d FB fb 0f be e0 d0 E8 C1 0b
This data is the OOPS message we are going to talk about, which contains the register information of the error, along with the memory information, for example, EIP (0010:[]), which tells us that the relative value of the EIP is 0010 when the error occurs, and the Objdump tool is used to disassemble the source code, You can easily find the wrong point. Therefore, this data is very important for code error analysis. But for those data that only machines can understand, programmers may not like it.

2. Ksymoops
In order for programmers to understand what they mean, and with better use of these "valuable" data, the researcher designed the Ksymoops tool, which is to translate obscure oops messages into information that we can directly understand.
Here, for example, the above data, first of all, to store data into a document, as Ksmoops input data. Here I put the above data into the document Oops.info and then execute the KSMOOPS data to see what happens.
#ksmoops >EIP; d006408a >eax; c10b0048
>>ebx; d0064000
>>edx; c10b0048
>>ebp; C770defc
>>esp; C770deec
Trace; D00640be
Trace; D00640e4
Trace; C01165e1
Trace; d0064060
Trace; c0108983
Code; d006408a
00000000:
Code; d006408a
3:88 FB mov%al,0xfffffffb (%EBP)
Code; d0064090
6:0f be MOVSBL fb 0xfffffffb (%EBP),%eax
Code; d0064094
A:50 Push%eax
Code; d0064095
b:68 E0 D0 Push $0xd00640e0
Code; d006409a
2.1 Trace
Obviously, trace is the corresponding function address in the module execution process, because the Ksymoops runtime's default search module is under/lib/modules, because the module I run is not in that directory, so the result is pg0+ ... Type of data.
2.2 Code
The code line corresponds to the corresponding error occurred in the corresponding execution codes, through Ksymoops processing, becomes our familiar assembly code:
Code; d006408a
3:88 FB mov%al,0xfffffffb (%EBP)
Code; d0064090
6:0f be MOVSBL fb 0xfffffffb (%EBP),%eax
Code; d0064094
A:50 Push%eax
Code; d0064095
b:68 E0 D0 Push $0xd00640e0
Code; d006409a
The second line is where the error occurred, and the following is the code that will be executed.

3 Objdump
Ksymoops just gave the error point information, but for the large system module, we have to accurately locate the wrong delay, for this reason, we can also use another Disassembly tool objdump continue parsing errors. My module name is HELLO.O, and in order to understand his source code, we can use the tool.
#objdump –d hello.o
Hello.o:file format elf32-i386
Disassembly of section. Text:
00000000:
0:55 Push%EBP
1:89 e5 mov%esp,%ebp
3:83 EC-Sub $0x8,%esp
6:c7 FC Movl $0X0,0XFFFFFFFC (%EBP)
d:83 7d FC Cmpl $0X63,0XFFFFFFFC (%EBP)
11:7e Jle 15
13:eb JMP 49
15:83 EC-Sub $0x8,%esp
18:8B FC Mov 0XFFFFFFFC (%EBP),%eax
1b:03 add 0x8 (%EBP),%eax
1E:8A mov (%eax),%al
20:66 0f be D0 MOVSBW%AL,%DX
24:C6 FB Movb $0X0,0XFFFFFFFB (%EBP)
28:89 D0 mov%edx,%eax
2a:f6 7d fb IDIVB 0XFFFFFFFB (%EBP)
2D:88 FB mov%al,0xfffffffb (%EBP)
30:0f be MOVSBL fb 0xfffffffb (%EBP),%eax
34:50 Push%eax
35:68 Push $0x0
3a:e8 FC FF FF call 3b
3f:83 C4 Add $0x10,%esp
42:8D FC Lea 0XFFFFFFFC (%EBP),%eax
45:ff incl (%EAX)
47:eb C4 jmp D
49:c9 leave
4A:C3 ret
0000004B:
4B:55 Push%EBP
4c:89 e5 mov%esp,%ebp
4E:83 EC-Sub $0x8,%esp
51:83 EC 0c Sub $0xc,%esp
54:68 Push $0x4
59:e8 FC FF FF Call 5a
5e:83 C4 Add $0x10,%esp
61:B8 mov $0x0,%eax
66:c9 leave
67:C3 ret
00000068:
68:55 Push%EBP
69:89 e5 mov%esp,%ebp
6B:83 EC-Sub $0x8,%esp
6e:83 EC 0c Sub $0xc,%esp
71:68 Push $0x19
76:e8 FC FF FF Call 77
7b:83 C4 Add $0x10,%esp
7e:c9 leave
7F:C3 ret
This way, by Ksmoops results and objdump data, you can easily find the function where the error occurred, along with the exact location within the function:
2a:f6 7d fb IDIVB 0XFFFFFFFB (%EBP)

4 Summary
The oops information I gave was the result of a Linux kernel version of the 2.4.8 system, and in the 2.6.* version of the kernel, the name of the calling function was given in oops information. Kysmoops Some specific parameters here also does not describe how to use, want to specifically understand them, can refer to the documentation:/usr/src/linux/documentation/oops-tracing.txt or Ksymoops manual.
5 Accessories
HELLO.C Source:

01