❯ make

  SYNC    include/config/auto.conf.cmd

*

* Restart config...

*

*

* Compile-time checks and compiler options

*

Debug information

  1. Disable debug information (DEBUG_INFO_NONE)

> 2. Rely on the toolchain's implicit default DWARF version (DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT)

  3. Generate DWARF Version 4 debuginfo (DEBUG_INFO_DWARF4)

  4. Generate DWARF Version 5 debuginfo (DEBUG_INFO_DWARF5)

choice[1-4?]: 2

Reduce debugging information (DEBUG_INFO_REDUCED) [N/y/?] (NEW)

Compressed Debug information

> 1. Don't compress debug information (DEBUG_INFO_COMPRESSED_NONE) (NEW)

  2. Compress debugging information with zlib (DEBUG_INFO_COMPRESSED_ZLIB) (NEW)

  3. Compress debugging information with zstd (DEBUG_INFO_COMPRESSED_ZSTD) (NEW)

choice[1-3?]:

Produce split debuginfo in .dwo files (DEBUG_INFO_SPLIT) [N/y/?] (NEW)

Provide GDB scripts for kernel debugging (GDB_SCRIPTS) [N/y/?] (NEW) y # 其余都是默认，只有这个要手动开启

Warn for stack frames larger than (FRAME_WARN) [2048] 2048

Strip assembler-generated symbols during link (STRIP_ASM_SYMS) [N/y/?] n

Generate readable assembler code (READABLE_ASM) [N/y/?] n

Install uapi headers to usr/include (HEADERS_INSTALL) [N/y/?] n

Enable full Section mismatch analysis (DEBUG_SECTION_MISMATCH) [N/y/?] n

Make section mismatch errors non-fatal (SECTION_MISMATCH_WARN_ONLY) [Y/n/?] y

Force weak per-cpu definitions (DEBUG_FORCE_WEAK_PER_CPU) [N/y/?] n

sudo apt update

sudo apt install debootstrap

sudo debootstrap --arch=amd64 noble rootfs http://mirrors.ustc.edu.cn/ubuntu/

sudo chroot rootfs

apt update

apt install -y busybox init

#!/bin/sh

mount -t proc none /proc

mount -t sysfs none /sys

mount -t devtmpfs none /dev

exec /bin/sh

chmod +x /init

root@kernel-fuzz:/# passwd

New password:

Retype new password:

passwd: password updated successfully

# 打包 rootfs

sudo tar -czvf rootfs.tar.gz -C rootfs .

# 创建硬盘

dd if=/dev/zero of=rootfs.img bs=1M count=512

mkfs.ext4 rootfs.img

mkdir mnt

sudo mount rootfs.img mnt

# 复制

sudo tar -xzf rootfs.tar.gz -C mnt

sudo umount mnt

# 转换成 qcow2 镜像

qemu-img convert -f raw -O qcow2 rootfs.img rootfs.qcow2

sudo qemu-system-x86_64 -m 2G \

	 	        -smp 2 \

 		        -kernel /path/to/linux-6.8/arch/x86/boot/bzImage \

		        -drive file=/path/to/rootfs.qcow2,format=qcow2  \

		        -append "console=ttyS0 nokaslr root=/dev/sda rw"  \

 		        -nographic \

		        -enable-kvm \

		        -s -S

add-auto-load-safe-path /path/to/linux-src

gdb vmlinux

target remote :1234

(gdb) b start_kernel

Breakpoint 1 at 0xffffffff83220950: file init/main.c, line 875.

(gdb) c

Continuing.

Thread 1 hit Breakpoint 1, start_kernel () at init/main.c:875

875	{

(gdb)

(gdb) apropos lx

function lx_clk_core_lookup -- Find struct clk_core by name

function lx_current -- Return current task.

function lx_dentry_name -- Return string of the full path of a dentry.

function lx_device_find_by_bus_name -- Find struct device by bus and name (both strings)

function lx_device_find_by_class_name -- Find struct device by class and name (both strings)

function lx_i_dentry -- Return dentry pointer for inode.

function lx_module -- Find module by name and return the module variable.

function lx_per_cpu -- Return per-cpu variable.

function lx_radix_tree_lookup --  Lookup and return a node from a RadixTree.

function lx_rb_first -- Lookup and return a node from an RBTree

function lx_rb_last -- Lookup and return a node from an RBTree.

function lx_rb_next -- Lookup and return a node from an RBTree.

function lx_rb_prev -- Lookup and return a node from an RBTree.

function lx_task_by_pid -- Find Linux task by PID and return the task_struct variable.

function lx_thread_info -- Calculate Linux thread_info from task variable.

function lx_thread_info_by_pid -- Calculate Linux thread_info from task variable found by pid

lx-clk-summary -- Print clk tree summary

lx-cmdline -- Report the Linux Commandline used in the current kernel.

lx-configdump -- Output kernel config to the filename specified as the command

lx-cpus -- List CPU status arrays

lx-device-list-bus -- Print devices on a bus (or all buses if not specified)

lx-device-list-class -- Print devices in a class (or all classes if not specified)

lx-device-list-tree -- Print a device and its children recursively

lx-dmesg -- Print Linux kernel log buffer.

lx-dump-page-owner -- Dump page owner

lx-fdtdump -- Output Flattened Device Tree header and dump FDT blob to the filename

--Type <RET> for more, q to quit, c to continue without paging--

lx-genpd-summary -- Print genpd summary

lx-getmod-by-textaddr -- Look up loaded kernel module by text address.

lx-interruptlist -- Print /proc/interrupts

lx-iomem -- Identify the IO memory resource locations defined by the kernel

lx-ioports -- Identify the IO port resource locations defined by the kernel

lx-list-check -- Verify a list consistency

lx-lsmod -- List currently loaded modules.

lx-mounts -- Report the VFS mounts of the current process namespace.

lx-page_address -- struct page to linear mapping address

lx-page_to_pfn -- struct page to PFN

lx-page_to_phys -- struct page to physical address

lx-pfn_to_kaddr -- PFN to kernel address

lx-pfn_to_page -- PFN to struct page

lx-ps -- Dump Linux tasks.

lx-slabinfo -- Show slabinfo

lx-slabtrace -- Show specific cache slabtrace

lx-sym_to_pfn -- symbol address to PFN

lx-symbols -- (Re-)load symbols of Linux kernel and currently loaded modules.

lx-timerlist -- Print /proc/timer_list

lx-version -- Report the Linux Version of the current kernel.

lx-virt_to_page -- virtual address to struct page

lx-virt_to_phys -- virtual address to physical address

lx-vmallocinfo -- Show vmallocinfo

make CFLAGS="-g"

(gdb) b btrfs_init_sysfs

Function "btrfs_init_sysfs" not defined.

Make breakpoint pending on future shared library load? (y or [n]) y

Breakpoint 1 (btrfs_init_sysfs) pending.