Linux内核模块编程指南

linux

需积分: 9 141 浏览量更新于2024-07-09 收藏 652KB PDF 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

"《Linux内核模块编程指南》是一本由Peter Jay Salzman、Michael Burian、Ori Pomerantz、Bob Mottram和Jim Huang等人编写的关于Linux内核模块编程的专业指南，主要针对想要深入理解和开发Linux内核模块的读者。这本书详细介绍了如何编写、编译和使用内核模块，以及它们在操作系统中的角色和功能。 1. 内核模块的基本概念内核模块是可插入到Linux内核中的一小段代码，它们允许在需要时动态地添加或移除功能，而无需重新启动系统。这些模块通常用于扩展内核服务，如设备驱动程序、文件系统或其他特定功能。 1.5 如何查看已加载的内核模块你可以通过`lsmod`命令来查看当前系统中已加载的内核模块。如果你想知道自己的内核是否包含特定模块，可以检查`/lib/modules/$(uname -r)/modules.dep`文件，它列出了对应内核版本的所有模块。 1.6 编译自定义内核与模块在某些情况下，你可能需要下载并编译自定义内核，以包含特定的模块或配置选项。这通常涉及配置`.config`文件、编译源码以及安装新内核。然而，如果你只需要编写模块，可能不需要整个内核的源代码，只需使用内核头文件（headers）即可。 2. 头文件在编写内核模块时，你需要包含内核头文件，以便访问内核接口和数据结构。这些头文件通常位于`/usr/src/linux-headers-$(uname -r)`目录下。 3. 示例代码书中提供了许多示例代码，如“Hello World”模块，展示了最简单的模块如何加载和卸载，并逐步引入更复杂的功能，如使用`__init`和`__exit`宏进行模块初始化和清理，处理模块参数，以及跨多个文件组织代码。 4. 预备知识在深入模块编程之前，了解模块的生命周期、可用的内核函数、用户空间与内核空间的区别、命名空间、代码空间以及设备驱动程序的概念至关重要。这些基础知识将帮助你理解模块如何与系统交互。 5. 设备驱动设备驱动程序是内核模块的重要应用，它们使得操作系统能够与硬件设备通信。书中详细讲解了字符设备驱动，包括`file_operations`结构体、文件结构、设备注册与注销过程，以及编写字符设备驱动的基本步骤。 6. 字符设备驱动字符设备驱动示例`chardev.c`演示了如何创建一个基本的字符设备驱动，包括定义`file_operations`以处理读写操作，以及如何注册和注销设备。通过这个例子，你可以学习到如何在Linux内核中实现一个简单的设备驱动。《Linux内核模块编程指南》是一本深入浅出的教程，涵盖了从入门到进阶的全部内容，对于任何想在Linux环境中编写内核模块的开发者来说，都是宝贵的参考资料。"

资源详情

资源推荐

4. HELLO WORLD 15

3 */

5 #include <linux/kernel.h> /* We are doing kernel work */

6 #include <linux/module.h> /* Specifically, a module */

8 void cleanup_module(void)

9 {

10 pr_info("Short is the life of a kernel module\n");

11 }

13 MODULE_LICENSE("GPL");

And ﬁnally, the makeﬁle:

1 obj-m += hello-1.o

2 obj-m += hello-2.o

3 obj-m += hello-3.o

4 obj-m += hello-4.o

5 obj-m += hello-5.o

6 obj-m += startstop.o

7 startstop-objs := start.o stop.o

9 all:

10 make -C /lib/modules/$(shell uname -r)/b uild M=$(PWD) modules

12 clean:

13 make -C /lib/modules/$(shell uname -r)/b uild M=$(PWD) clean

This is the complete makeﬁle for all the examples we have seen so far. The

ﬁrst ﬁve lines are nothing special, but for the last example we will need two

lines. First we invent an object name for our combined module, second we tell

make what object ﬁles are part of that module.

4.7 Building modules for a precompiled kernel

Obviously, we strongly suggest you to recompile your kernel, so that you can

enable a number of useful debugging features, such as forced module unloading

(MODULE_FORCE_UNLOAD): when this option is enabled, you can force the kernel

to unload a module even when it believes it is unsafe, via a sudo rmmod -f module

command. This option can save you a lot of time and a number of reboots dur-

ing the development of a module. If you do not want to recompile your kernel

then you should consider running the examples within a test distribution on a

virtual machine. If you mess anything up then you can easily reboot or restore

the virtual machine (VM).

There are a number of cases in which you may want to load your module

into a precompiled running kernel, such as the ones shipped with common Linux

distributions, or a kernel you have compiled in the past. In certain circumstances

you could require to compile and insert a module into a running kernel which

you are not allowed to recompile, or on a machine that you prefer not to reboot.

4. HELLO WORLD 16

If you can’t think of a case that will force you to use modules for a precompiled

kernel you might want to skip this and treat the rest of this chapter as a big

footnote.

Now, if you just install a kernel source tree, use it to compile your kernel

module and you try to insert your module into the kernel, in most cases you

would obtain an error as follows:

insmod: ERROR: could not insert module poet.ko: Invalid module format

Less cryptic information is logged to the systemd journal:

kernel: poet: disagrees about version of symbol module_layout

In other words, your kernel refuses to accept your module because version

strings (more precisely, version magic, see include/linux/vermagic.h) do not

match. Incidentally, version magic strings are stored in the module object in

the form of a static string, starting with vermagic:. Version data are inserted

in your module when it is linked against the kernel/module.o ﬁle. To inspect

version magics and other strings stored in a given module, issue the command

modinfo module.ko:

$ modinfo hello-4.ko

description: A sample driver

author: LKMPG

license: GPL

srcversion: B2AA7FBFCC2C39AED665382

depends:

retpoline: Y

name: hello_4

vermagic: 5.4.0-70-generic SMP mod_unload modversions

To overcome this problem we could resort to the --force-vermagic op-

tion, but this solution is potentially unsafe, and unquestionably unacceptable

in production modules. Consequently, we want to compile our module in an

environment which was identical to the one in which our precompiled kernel

was built. How to do this, is the subject of the remainder of this chapter.

First of all, make sure that a kernel source tree is available, having exactly

the same version as your current kernel. Then, ﬁnd the conﬁguration ﬁle which

was used to compile your precompiled kernel. Usually, this is available in your

current boot directory, under a name like config-5.14.x. You may just want

to copy it to your kernel source tree: cp /boot/config-`uname -r` .config.

Let’s focus again on the previous error message: a closer look at the version

magic strings suggests that, even with two conﬁguration ﬁles which are exactly

the same, a slight diﬀerence in the version magic could be possible, and it

is suﬃcient to prevent insertion of the module into the kernel. That slight

diﬀerence, namely the custom string which appears in the module’s version

magic and not in the kernel’s one, is due to a modiﬁcation with respect to the

5. PRELIMINARIES 18

work a bit diﬀerently. A module always begin with either the init_module or

the function you specify with module_init call. This is the entry function for

modules; it tells the kernel what functionality the module provides and sets up

the kernel to run the module’s functions when they are needed. Once it does

this, entry function returns and the module does nothing until the kernel wants

to do something with the code that the module provides.

All modules end by calling either cleanup_module or the function you spec-

ify with the module_exit call. This is the exit function for modules; it undoes

whatever entry function did. It unregisters the functionality that the entry

function registered.

Every module must have an entry function and an exit function. Since

there’s more than one way to specify entry and exit functions, I will try my best

to use the terms “entry function” and “exit function”, but if I slip and simply

refer to them as init_module and cleanup_module, I think you will know what

I mean.

5.2 Functions available to modules

Programmers use functions they do not deﬁne all the time. A prime example

of this is printf(). You use these library functions which are provided by the

standard C library, libc. The deﬁnitions for these functions do not actually enter

your program until the linking stage, which insures that the code (for printf()

for example) is available, and ﬁxes the call instruction to point to that code.

Kernel modules are diﬀerent here, too. In the hello world example, you

might have noticed that we used a function, pr_info() but did not include a

standard I/O library. That is because modules are object ﬁles whose symbols

get resolved upon insmod’ing. The deﬁnition for the symbols comes from the

kernel itself; the only external functions you can use are the ones provided by

the kernel. If you’re curious about what symbols have been exported by your

kernel, take a look at /proc/kallsyms.

One point to keep in mind is the diﬀerence between library functions and

system calls. Library functions are higher level, run completely in user space

and provide a more convenient interface for the programmer to the functions

that do the real work — system calls. System calls run in kernel mode on

the user’s behalf and are provided by the kernel itself. The library function

printf() may look like a very general printing function, but all it really does is

format the data into strings and write the string data using the low-level system

call write(), which then sends the data to standard output.

Would you like to see what system calls are made by printf()? It is easy!

Compile the following program:

1 #include <stdio.h>

3 int main(void)

4 {

5 printf("hello");

5. PRELIMINARIES 19

6 return 0;

7 }

with gcc -Wall -o hello hello.c. Run the executable with strace ./hello.

Are you impressed? Every line you see corresponds to a system call. strace is

a handy program that gives you details about what system calls a program

is making, including which call is made, what its arguments are and what it

returns. It is an invaluable tool for ﬁguring out things like what ﬁles a pro-

gram is trying to access. Towards the end, you will see a line which looks

like write(1, "hello", 5hello). There it is. The face behind the printf()

mask. You may not be familiar with write, since most people use library func-

tions for ﬁle I/O (like fopen, fputs, fclose). If that is the case, try looking

at man 2 write. The 2nd man section is devoted to system calls (like kill()

and read()). The 3rd man section is devoted to library calls, which you would

probably be more familiar with (like cosh() and random()).

You can even write modules to replace the kernel’s system calls, which we

will do shortly. Crackers often make use of this sort of thing for backdoors or

trojans, but you can write your own modules to do more benign things, like

have the kernel write Tee hee, that tickles! every time someone tries to delete a

ﬁle on your system.

5.3 User Space vs Kernel Space

A kernel is all about access to resources, whether the resource in question hap-

pens to be a video card, a hard drive or even memory. Programs often compete

for the same resource. As I just saved this document, updatedb started updat-

ing the locate database. My vim session and updatedb are both using the hard

drive concurrently. The kernel needs to keep things orderly, and not give users

access to resources whenever they feel like it. To this end, a CPU can run in

diﬀerent modes. Each mode gives a diﬀerent level of freedom to do what you

want on the system. The Intel 80386 architecture had 4 of these modes, which

were called rings. Unix uses only two rings; the highest ring (ring 0, also known

as “supervisor mode” where everything is allowed to happen) and the lowest

ring, which is called “user mode”.

Recall the discussion about library functions vs system calls. Typically, you

use a library function in user mode. The library function calls one or more

system calls, and these system calls execute on the library function’s behalf,

but do so in supervisor mode since they are part of the kernel itself. Once the

system call completes its task, it returns and execution gets transfered back to

user mode.

5.4 Name Space

When you write a small C program, you use variables which are convenient and

make sense to the reader. If, on the other hand, you are writing routines which

will be part of a bigger problem, any global variables you have are part of a

剩余97页未读，继续阅读

qoo12

粉丝: 1
资源: 86

Linux内核模块编程指南

The linux kernel module programming guide.pdf

com.itextpdf.kernel.pdf.PdfReader 获取pdf 总页数

从https://mirrors.edge.kernel.org/pub/linux/kernel/6.x/网站下载linux-6.6.4.tar.gz 的语句

 Please investigate the definition of task_struct in sched.h and check out how to output the state and name of each process.

ERROR: Unable to load the kernel module 'nvidia.ko'. This happens most frequently when this kernel mod

Your kernel headers for kernel 5.10.16.3-microsoft-standard-WSL2 cannot be found.

如何在linux用指令镜像下载Kernel版本：4.14.238

Linux kernel memory usage

对于Linux文件和目录访问，假设用户给出如下路径名：/home/bjut/linux/kernel/sched.c，写出找到文件sched.c的过程。

linux/kernel/fork.c是什么

Linux中的module.h文件下载

sysctl kernel.sem kernel.sem = 32000 1024000000 500 32000 如何只输出kernel.sem = 32000

在Ubuntu20.04中安装NVIDIA显卡驱动过程中产生了如下报错：ERROR:Unable to load the kernel module 'nvidia.ko'，请问该如何解决'

linux.kernel.development.3rd.edition.zip

bazel build android kernel module BUILD.bazel

linux下解包kernel编译的boot.img

/home/zsm/test1/test2/kernel32.dll.so: cannot open shared object file: No such file or directory

linux buildroot eval kernel-module用法

严重性 代码 说明 项目 文件 行 禁止显示状态 错误 CS1503 参数 1: 无法从“iText.Kernel.Pdf.PdfReader”转换为“iText.Kernel.Pdf.PdfDocument” IText7Library E:\Study\Pragram\C#\PDF\PDFStudio\IText7Library\PDFHelp\TableAnalyzer.cs 23 活动

最新资源

严重性代码说明项目文件行禁止显示状态错误 CS1503 参数 1: 无法从“iText.Kernel.Pdf.PdfReader”转换为“iText.Kernel.Pdf.PdfDocument” IText7Library E:\Study\Pragram\C#\PDF\PDFStudio\IText7Library\PDFHelp\TableAnalyzer.cs 23 活动