Linux kernel crash processing __linux

PC: [<BF0000B8]

1. Locating code crashes in the kernel or Xxx.ko

Cat/proc/kallsyms >1.txt

c0034818 T __kmalloc

...

C00082A8 T quiet_kernel/* The first is the virtual address * *

...

bf000000 T $a [CDD]

..

This can see code crashes in Xxx.ko

2. Locate the function of the crash in Xxx.ko

arm-linux-objdump-d Cdd.ko >2.txt

00000000 <cdd_llseek> 0:e1a0c00d mov ip,sp//compile address, compiled instruction, assembly language

Compile Address +0xbf000000 = store Address

0000009c <cdd_open>

9C:E1A0C00D mov ip,sp

A0:E92DD8F0 Push {R4,R5,R6,R7,FP,IP,LR,PC}

...

b8:e5c43000 STRB R3,[R4]------There is a problem here

Thus knowing the crash in the Cdd_open function

3. Disassembly kernel code to understand Cdd_open called process

arm-linux-objdump-d Vmlinux >3.txt

Cdd_open pressure Stack, push {r4,r5,r6,r7,fp,ip,lr,pc}

These 8 data is the data you want to press, the LR register is the value of the function call to return the address

According to LR, view the last function that called Cdd_open

And so on, you get the calling process