book

Linux Kernel Debugging

Name: Linux Kernel Debugging
Author: Kaiwan N. Billimoria
ISBN: 9781801075039

by Kaiwan N. Billimoria

August 2022

Intermediate to advanced

638 pages

13h 58m

English

Packt Publishing

Read now

Unlock full access

Linux Kernel Debugging
ContributorsAbout the authorAbout the reviewer
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the example code filesDownload the color imagesConventions usedGet in touchShare Your Thoughts
Part 1: A General Introduction and Approaches to Kernel Debugging
Chapter 1: A General Introduction to Debugging Software
Technical requirementsCloning this book's code repositorySoftware debugging – what it is, origins, and mythsSoftware bugs – a few actual casesPatriot missile failureThe ESA's unmanned Ariane 5 rocketMars Pathfinder reset issueThe Boeing 737 MAX aircraft – the MCAS and lack of training of the flight crewOther casesSetting up the workspaceRunning Linux as a native or guest OSRunning Linux as a guest OSInstalling the Oracle VirtualBox guest additionsInstalling required software packagesA tale of two kernelsA production and a debug kernelSetting up our custom production kernelSetting up our custom debug kernelSeeing the difference – production and debug kernel configDebugging – a few quick tipsA programmer's checklist – seven rulesSummaryFurther reading
Chapter 2: Approaches to Kernel Debugging
Technical requirementsClassifying bug typesTypes of bugs – the classic viewTypes of bugs – the memory viewTypes of bugs – the CVE/CWE security-related viewTypes of bugs – the Linux kernelKernel debugging – why there are different approaches to itSummarizing the different approaches to kernel debuggingThe development phaseUnit testing and/or QA phasesCategorizing into different scenariosSummaryFurther reading
Part 2: Kernel and Driver Debugging Tools and Techniques
Chapter 3: Debug via Instrumentation – printk and Friends
Technical requirementsThe ubiquitous kernel printkUsing the printk API's logging levelsLeveraging the pr_<foo> convenience macrosUnderstanding where the printk output goesPractically using the printk format specifiers – a few quick tipsLeveraging the printk for debug purposesWriting debug messages to the kernel logDebug printing – quick and useful tipsDevice drivers – using the dev_dbg() macroTrying our kernel module on the custom production kernelRate limiting the printkUsing the kernel's powerful dynamic debug featureDynamic debugging via module parametersSpecifying what and how to print debug messagesExercising dynamic debugging on a kernel module on a production kernelRemaining printk miscellanyPrinting before console init – the early printkDesignating the printk to some known presets Printing exactly onceEmitting a printk from userspaceEasily dumping buffer contentRemaining points – bootloader log peeking, LED flashing, and moreSummaryFurther reading
Chapter 4: Debug via Instrumentation – Kprobes
Understanding kprobes basicsWhat we intend to doUsing static kprobes – traditional approaches to probingDemo 1 – static kprobe – trapping into the file open the traditional static kprobes way – simplest caseDemo 2 – static kprobe – specifying the function to probe via a module parameterUnderstanding the basics of the Application Binary Interface (ABI)Using static kprobes – demo 3 and demo 4Demo 3 – static kprobe – probing the file open syscall and retrieving the filename parameterDemo 4 – semi-automated static kprobe via our helper scriptGetting started with kretprobesKprobes miscellanyKprobes – limitations and downsidesInterface stabilityThe easier way – dynamic kprobes or kprobe-based event tracingKprobe-based event tracing – minimal internal detailsSetting up a dynamic kprobe (via kprobe events) on any functionUsing dynamic kprobe event tracing on a kernel moduleSetting up a return probe (kretprobe) with kprobe-perfTrapping into the execve() API – via perf and eBPF toolingSystem calls and where they land in the kernelObservability with eBPF tools – an introductionSummaryFurther reading
Chapter 5: Debugging Kernel Memory Issues – Part 1
Technical requirementsWhat's the problem with memory anyway?Tools to catch kernel memory issues – a quick summaryUsing KASAN and UBSAN to find memory bugsUnderstanding KASAN – the basicsRequirements to use KASANConfiguring the kernel for Generic KASAN modeBug hunting with KASANUsing the UBSAN kernel checker to find Undefined BehaviorBuilding your kernel and modules with ClangUsing Clang 13 on Ubuntu 21.10Catching memory defects in the kernel – comparisons and notes (Part 1)Miscellaneous notesSummaryFurther reading
Chapter 6: Debugging Kernel Memory Issues – Part 2
Technical requirementsDetecting slab memory corruption via SLUB debugConfiguring the kernel for SLUB debugLeveraging SLUB debug features via the slub_debug kernel parameterRunning and tabulating the SLUB debug test casesInterpreting the kernel's SLUB debug error reportLearning how to use the slabinfo and related utilitiesFinding memory leakage issues with kmemleakConfiguring the kernel for kmemleakUsing kmemleakA few tips for developers regarding dynamic kernel memory allocationCatching memory defects in the kernel – comparisons and notes (Part 2)Miscellaneous notesSummaryFurther reading

Chapter 7: Oops! Interpreting the Kernel Bug Diagnostic
Technical requirementsGenerating a simple kernel bug and OopsThe procmap utilityWhat's this NULL trap page anyway?A simple Oops v1 – dereferencing the NULL pointerDoing a bit more of an Oops – our buggy module v2A kernel Oops and what it signifiesThe devil is in the details – decoding the OopsLine-by-line interpretation of an OopsTools and techniques to help determine the location of the OopsUsing objdump to help pinpoint the Oops code locationUsing GDB to help debug the OopsUsing addr2line to help pinpoint the Oops code locationTaking advantage of kernel scripts to help debug kernel issuesLeveraging the console device to get the kernel log after Oopsing in IRQ contextAn Oops on an ARM Linux system and using netconsoleFiguring out the actual buggy code location (on ARM)A few actual OopsesSummaryFurther reading
Chapter 8: Lock Debugging
Technical requirementsLocking and lock debuggingLocking – a quick summarization of key pointsUnderstanding data races – delving deeperCatching concurrency bugs with KCSANWhat KCSAN does, in a nutshellConfiguring the kernel for KCSANUsing KCSANKnee-jerk reactions to KCSAN reports – please don't!A few actual use cases of kernel bugs due to locking defectsDefects identified by KCSANIdentifying locking rules and bugs from the LDV projectIdentifying locking bugs from the Linux kernel BugzillaIdentifying some locking defects from various blog articles and the likeSummaryFurther reading
Part 3: Additional Kernel Debugging Tools and Techniques
Chapter 9: Tracing the Kernel Flow
Technical requirementsKernel tracing technology – an overviewUsing the ftrace kernel tracerAccessing ftrace via the filesystemConfiguring the kernel for ftraceUsing ftrace to trace the flow of the kernelUseful ftrace filtering optionsCase 1 – tracing a single ping with raw ftraceCase 2 – tracing a single ping with raw ftrace via the set_event interfaceUsing trace_printk() for debuggingFtrace – miscellaneous remaining points via FAQsFtrace use casesUsing the trace-cmd, KernelShark, and perf-tools ftrace frontendsAn introduction to using trace-cmdUsing the KernelShark GUIAn introduction to using perf-toolsAn introduction to kernel tracing with LTTng and Trace CompassA quick introduction to recording a kernel tracing session with LTTngUsing the Trace Compass GUI to visualize the single ping LTTng traceSummaryFurther reading
Chapter 10: Kernel Panic, Lockups, and Hangs
Technical requirementsPanic! – what happens when a kernel panicsLet's panicTo the rescue with netconsoleInterpreting the panic outputKernel parameters, tunables, and configs that affect kernel panicWriting a custom kernel panic handler routineLinux kernel panic notifier chains – the basicsSetting up our custom panic handler within a moduleDetecting lockups and CPU stalls in the kernelA short note on watchdogsEmploying the kernel's hard and soft lockup detectorEmploying the kernel's hung task and workqueue stall detectorsLeveraging the kernel hung task detectorDetecting workqueue stallsSummaryFurther reading
Chapter 11: Using Kernel GDB (KGDB)
Technical requirementsConceptually understanding how KGDB worksSetting up an ARM target system and kernel for KGDBBuilding a minimal custom ARM Linux target system with SEALSConfiguring the kernel for KGDBTesting the target systemDebugging the kernel with KGDBRunning our target (emulated) ARM32 systemRunning and working with the remote GDB client on the host systemDebugging kernel modules with KGDBInforming the GDB client about the target module's locations in memoryStep by step – debugging a buggy module with KGDB[K]GDB – a few tips and tricksSetting up and using GDB scripts with CONFIG_GDB_SCRIPTSKGDB target remote :1234 command doesn't work on physical systemsSetting the system root with sysrootUsing GDB's TUI modeWhat to do when the <value optimized out> GDB response occursGDB convenience routinesGDB custom macros in its startup fileFancy breakpoints and hardware watchpointsMiscellaneous GDB tipsSummaryFurther reading
Chapter 12: A Few More Kernel Debugging Approaches
An introduction to the kdump/crash frameworkWhy use kdump/crash?Understanding the kdump/crash basic frameworkA mention on performing static analysis on kernel codeExamples using cppcheck and checkpatch.pl for static analysisAn introduction to kernel code coverage tools and testing frameworksWhy is code coverage important?A brief note on kernel testingMiscellaneous – using journalctl, assertions, and warningsLooking up system logs with journalctlAssertions, warnings, and BUG() macrosSummaryFurther reading
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youShare Your Thoughts

Content preview from Linux Kernel Debugging

Chapter 8: Lock Debugging

Imagine this: two threads, T1 and T2, running on different CPU cores, concurrently work upon a shared (global) writable data item. If one (or both) of these memory accesses is a write (a store), then congratulations, you've just witnessed a wily difficult-to-spot-and-catch bug or defect: a data race. This can happen in both user as well as kernel space. In the latter, the possibility of racing with both process (thread) and interrupt contexts arises as well.

A data race is a bug of course. What's worse, it's often a clue, or symptom, to the fact that there's often a higher-level issue or defect (like the proverbial tip of the iceberg). Untangling buggy code, finding the data race, fixing it (and finding any higher-level ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781801075039

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Linux Kernel Debugging

by Kaiwan N. Billimoria

Chapter 8: Lock Debugging

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.