linux oops分析

[杨六]

平台是ARM，出现如下的OOPS，请大牛给点思路可能的原因是什么
> root@HSAN:/tmp#Internal error: Oops - undefined instruction: 0 [#1]
last sysfs file: /sys/devices/virtual/misc/CAPTURE/dev
Modules linked in: sdt alg(P) wal hmac(P) dmac(P) hal(P) frw(P) oam oal(P) capture(P) demo_ioctl demo_adapter multicast gponmac hi_klowpower(P) hi_kploam(P) hi_kadapt(P) hi_kmisc(P) hi_kbasic(P) hi_linux_optical hi_linux_port_mgr hi_linux_mdio_mgr sysinit hi_ioctl_interface(P) hi_ioctl_dp(P) hi_dp(P) hi_uart(P) hi_hw(P) hi_dma(P) hi_spi(P) hi_timer(P) hi_i2c(P) hi_gpio_int(P) hi_gpio(P) hi_tunnel_process delivery hi_pie hi_mdio(P) flash(P) hi_ioctl_sysctl(P) hi_sysctl(P)
CPU: 0 Tainted: P (2.6.34.10_sd5115h_v100f #46)
PC is at sdt_drv_add_head+0x20/0xbc [sdt]
LR is at sdt_drv_add_pkt_head+0x8c/0x1ac [sdt]
pc : [<bf3f1064>] lr : [<bf3f187c>] psr: 20000113
sp : c03c7dd0 ip : c4c539c0 fp : 00000004
r10: c4d6be28 r9 : c510d038 r8 : c4c53e40
r7 : 00000002 r6 : 00000004 r5 : 61715c48 r4 : c4c539c0
r3 : 00000017 r2 : 00000004 r1 : 00000000 r0 : c4d6b600
Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
Control: 10c53c7d Table: 87390059 DAC: 00000017
Process swapper (pid: 0, stack limit = 0xc03c6268)
Stack: (0xc03c7dd0 to 0xc03c8000)
7dc0: 0000000e bf24a7ec bf24a7ec c510d02a
7de0: 0000000e bf24a7ec c510d02a c4c53e40 0000fff8 bf247a44 00000002 00000006
7e00: bf3af3c4 00000002 bf37fa24 00000003 c4ff4a80 00000008 bf31f5b0 bf31f5a4
7e20: 00000008 bf397624 00000002 00000003 bf3af3c4 00000000 00000000 00000000
7e40: c03c7e9c 00000000 bf3af6f4 00000000 00000000 00000000 bf375060 00000000
7e60: 00000003 00000002 bf31f5c4 bf31f5bc bf31f5b0 bf31f5a4 00000008 bf248c1c
7e80: 00000002 00000003 bf3af6f4 c4ff4a80 00000000 00000000 bf37fa24 00000008
7ea0: bf31f5b0 bf31f5a4 00000008 bf398498 00000002 00000003 bf3af6f4 bf31ef04
7ec0: bf1fe04c bf31ef04 bf31ef04 bf31f5c4 bf31f5bc bf31a50c 20018e04 414fc091
7ee0: bf33997c bf33b778 00000005 00000003 bf33997c c03cb260 c03ef240 00000000
7f00: 00000000 c03cb098 00000100 c03ef240 00000000 c003dd78 00000018 00000001
7f20: c03ef240 c03c6000 c03cb098 c003e3f8 00000000 bf1f6010 00000006 0000000a
7f40: 00000000 c03da7b0 0000005b 00000000 c03c9fa0 80e204a4 414fc091 0000001f
7f60: 00000000 c0025040 ffffffff f1180100 0000005b c0025ab8 c70f9d80 00000000
7f80: c03c7fc0 00000000 c03c6000 c03ea624 c03c9fa8 c03c9fa0 80e204a4 414fc091
7fa0: 0000001f 00000000 00000000 c03c7fc0 c0026f08 c0026f0c 60000013 ffffffff
7fc0: c03c6000 c00273f4 c03f3c18 c0022010 c002200c c0008948 c00084b4 00000000
7fe0: 00000000 c0022010 00000000 10c53c7d c03ea6e0 80e08034 00000000 00000000
Unable to handle kernel paging request at virtual address 5171a3a3
pgd = c0004000
[5171a3a3] *pgd=00000000
Internal error: Oops: 5 [#2]
last sysfs file: /sys/devices/virtual/misc/CAPTURE/dev
Modules linked in: sdt alg(P) wal hmac(P) dmac(P) hal(P) frw(P) oam oal(P) capture(P) demo_ioctl demo_adapter multicast gponmac hi_klowpower(P) hi_kploam(P) hi_kadapt(P) hi_kmisc(P) hi_kbasic(P) hi_linux_optical hi_linux_port_mgr hi_linux_mdio_mgr sysinit hi_ioctl_interface(P) hi_ioctl_dp(P) hi_dp(P) hi_uart(P) hi_hw(P) hi_dma(P) hi_spi(P) hi_timer(P) hi_i2c(P) hi_gpio_int(P) hi_gpio(P) hi_tunnel_process delivery hi_pie hi_mdio(P) flash(P) hi_ioctl_sysctl(P) hi_sysctl(P)
CPU: 0 Tainted: P (2.6.34.10_sd5115h_v100f #46)
PC is at unwind_frame+0x90/0x418
LR is at unwind_frame+0x4c/0x418
pc : [<c002ba30>] lr : [<c002b9ec>] psr: 20000193
sp : c03c7c38 ip : 000015f0 fp : c03c7cc4
r10: c03c6000 r9 : c0025b44 r8 : bf3f1064
r7 : 60000193 r6 : c03ca000 r5 : c03c7dd0 r4 : c03c7ca8
r3 : 5171a3a3 r2 : 5171a3a3 r1 : 8e8ea303 r0 : c03ca258
Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
Control: 10c53c7d Table: 87390059 DAC: 00000017
Process swapper (pid: 0, stack limit = 0xc03c6268)

[杨六]

其中PC is at sdt_drv_add_head+0x20/0xbc [sdt] LR is at sdt_drv_add_pkt_head+0x8c/0x1ac [sdt]为自研代码 sdt_drv_add_head实现

oal_int32  sdt_drv_add_head(oal_uint8 *pst_buf,
                                 oal_uint8  uc_ftype,
                                 oal_uint8  uc_dtype,
                                 oal_uint16 us_lenth)
{
    oal_int8        *pc_ptr;
    oal_uint16       us_len;

    if (OAL_PTR_NULL == pst_buf)
    {
        SDT_DRV_ERR_LOG(0, "pst_buf is null!");
        return -OAL_EFAIL;
    }

    gst_kernelglobal.sn_num++;

    pc_ptr  = (oal_int8 *)pst_buf;
    *pc_ptr = PACKET_START_SIGNAL;
    pc_ptr++;

    *pc_ptr = (oal_int8)uc_ftype;
    pc_ptr++;

    *pc_ptr = (oal_int8)uc_dtype;
    pc_ptr++;
    *pc_ptr = RESERVE;

    us_len  = us_lenth;
    pc_ptr++;

    *pc_ptr = (oal_int8)LEN_LOW_BYTE(us_len);
    pc_ptr++;
    *pc_ptr = (oal_int8)LEN_HIGH_BYTE(us_len);

    us_len  = gst_kernelglobal.sn_num;
    pc_ptr++;
    *pc_ptr = (oal_int8)LEN_LOW_BYTE(us_len);
    pc_ptr++;
    *pc_ptr = (oal_int8)LEN_HIGH_BYTE(us_len);

    pc_ptr = (oal_int8 *)pst_buf;
    pc_ptr = pc_ptr + us_lenth;
    pc_ptr = pc_ptr - OAL_SIZEOF(OAM_END_STUR);
    *pc_ptr = PACKET_END_SIGNAL;

    return OAL_SUCC;
}

[杨六]

有个小的疑问，查看objdump文件发现这个文件的逻辑被改了；在中途就偏移到最后，后续再偏移时应该会越界；但这个问题并不是必现，不知道这个是什么原理了 pc_ptr = (oal_int8 *)pst_buf; pc_ptr = pc_ptr + us_lenth; 64: e08ca003 add sl, ip, r3 oal_int32 sdt_drv_add_head(oal_uint8 *pst_buf, oal_uint8 uc_ftype, oal_uint8 uc_dtype, oal_uint16 us_lenth) { 48: e92d4ff0 push {r4, r5, r6, r7, r8, r9, sl, fp, lr} 4c: e1a0b001 mov fp, r1 50: e24dd014 sub sp, sp, #20 oal_int8 *pc_ptr; oal_uint16 us_len; if (OAL_PTR_NULL == pst_buf) 54: 0a00001a beq c4 <sdt_drv_add_head+0x80> { SDT_DRV_ERR_LOG(0, "pst_buf is null!"); return -OAL_EFAIL; } gst_kernelglobal.sn_num++; 58: e59f4094 ldr r4, [pc, #148] ; f4 <sdt_drv_add_head+0xb0> pc_ptr = (oal_int8 *)pst_buf; *pc_ptr = PACKET_START_SIGNAL; 5c: e1a0100c mov r1, ip 60: e3a0507e mov r5, #126 ; 0x7e *pc_ptr = (oal_int8)LEN_LOW_BYTE(us_len); pc_ptr++; *pc_ptr = (oal_int8)LEN_HIGH_BYTE(us_len); pc_ptr = (oal_int8 *)pst_buf; pc_ptr = pc_ptr + us_lenth; 64: e08ca003 add sl, ip, r3 *pc_ptr = (oal_int8)uc_ftype; pc_ptr++; *pc_ptr = (oal_int8)uc_dtype; pc_ptr++; *pc_ptr = RESERVE; 68: e3a08000 mov r8, #0 us_len = us_lenth; pc_ptr++; *pc_ptr = (oal_int8)LEN_LOW_BYTE(us_len); pc_ptr++; *pc_ptr = (oal_int8)LEN_HIGH_BYTE(us_len); 6c: e1a09423 lsr r9, r3, #8 { SDT_DRV_ERR_LOG(0, "pst_buf is null!"); return -OAL_EFAIL; } gst_kernelglobal.sn_num++; 70: e1d462bc ldrh r6, [r4, #44] ; 0x2c *pc_ptr = (oal_int8)LEN_HIGH_BYTE(us_len); pc_ptr = (oal_int8 *)pst_buf; pc_ptr = pc_ptr + us_lenth; pc_ptr = pc_ptr - OAL_SIZEOF(OAM_END_STUR); *pc_ptr = PACKET_END_SIGNAL; 74: e1a00008 mov r0, r8 { SDT_DRV_ERR_LOG(0, "pst_buf is null!"); return -OAL_EFAIL; } gst_kernelglobal.sn_num++; 78: e2866001 add r6, r6, #1 7c: e1c462bc strh r6, [r4, #44] ; 0x2c pc_ptr = (oal_int8 *)pst_buf; *pc_ptr = PACKET_START_SIGNAL; 80: e4c15001 strb r5, [r1], #1 pc_ptr++; *pc_ptr = (oal_int8)uc_ftype; pc_ptr++; 84: e2817001 add r7, r1, #1 *pc_ptr = (oal_int8)uc_dtype; pc_ptr++; 88: e2876001 add r6, r7, #1 pc_ptr = (oal_int8 *)pst_buf; *pc_ptr = PACKET_START_SIGNAL; pc_ptr++; *pc_ptr = (oal_int8)uc_ftype; 8c: e5ccb001 strb fp, [ip, #1] *pc_ptr = (oal_int8)uc_dtype; pc_ptr++; *pc_ptr = RESERVE; us_len = us_lenth; pc_ptr++; 90: e286c001 add ip, r6, #1 pc_ptr++; *pc_ptr = (oal_int8)uc_ftype; pc_ptr++; *pc_ptr = (oal_int8)uc_dtype; 94: e5c12001 strb r2, [r1, #1] pc_ptr++; *pc_ptr = RESERVE; 98: e5c78001 strb r8, [r7, #1] us_len = us_lenth; pc_ptr++; *pc_ptr = (oal_int8)LEN_LOW_BYTE(us_len); pc_ptr++; 9c: e28c2001 add r2, ip, #1 *pc_ptr = RESERVE; us_len = us_lenth; pc_ptr++; *pc_ptr = (oal_int8)LEN_LOW_BYTE(us_len); a0: e5c63001 strb r3, [r6, #1] pc_ptr++; *pc_ptr = (oal_int8)LEN_HIGH_BYTE(us_len); a4: e5cc9001 strb r9, [ip, #1] us_len = gst_kernelglobal.sn_num; a8: e1d432bc ldrh r3, [r4, #44] ; 0x2c pc_ptr++; *pc_ptr = (oal_int8)LEN_LOW_BYTE(us_len); ac: e5c23001 strb r3, [r2, #1] pc_ptr++; *pc_ptr = (oal_int8)LEN_HIGH_BYTE(us_len); b0: e1a03423 lsr r3, r3, #8 b4: e5c23002 strb r3, [r2, #2] pc_ptr = (oal_int8 *)pst_buf; pc_ptr = pc_ptr + us_lenth; pc_ptr = pc_ptr - OAL_SIZEOF(OAM_END_STUR); *pc_ptr = PACKET_END_SIGNAL; b8: e54a5001 strb r5, [sl, #-1] return OAL_SUCC; }

[Wenxy1]

内核配置菜单里把地址解析成符号加上。 然后根据调用栈来初步定位。