CODEWITHSUNDEEP
linux-device-driver
André MESSEY
André MESSEY

Reputation: 31

Disassembly code of linux kernel module

i learn how to debug linux device drivers but i have a problem. i don't understand the assembly code of this module (crashit.ko writing in C language)

#include <linux/module.h>
#include <linux/init.h>

static int __init my_init(void){
    int *i;
        i = NULL;
    printk(KERN_INFO "Hello: init_module loaded at address 0x%p\n",init_module);
    printk(KERN_INFO "i = %d\n", *i);
    return 0;
}

static void __exit my_exit(void){
    printk(KERN_INFO "Hello: cleanup_module moaded at address 0x%p\n",cleanup_module);
}

module_init(my_init);
module_exit(my_exit);

MODULE_LICENSE("GPL v2");

here is the disassembly of the module above crashit.ko: file format elf32-i386

Disassembly of section .exit.text:

00000000 <cleanup_module>:
   0:   68 00 00 00 00          push   $0x0
   5:   68 00 00 00 00          push   $0x0
   a:   e8 fc ff ff ff          call   b <cleanup_module+0xb>
   f:   58                      pop    %eax
  10:   5a                      pop    %edx
  11:   c3                      ret
Disassembly of section .init.text:

00000000 <init_module>:
   0:   68 00 00 00 00          push   $0x0
   5:   68 31 00 00 00          push   $0x31
   a:   e8 fc ff ff ff          call   b <init_module+0xb>
   f:   ff 35 00 00 00 00       pushl  0x0
  15:   68 5f 00 00 00          push   $0x5f
  1a:   e8 fc ff ff ff          call   1b <init_module+0x1b>
  1f:   31 c0                   xor    %eax,%eax
  21:   83 c4 10                add    $0x10,%esp
  24:   c3                      ret

i noticed that in the disassembly code, there are three instructions call: call b , call b and call 1b that i don't know what they do and i don't know where they are implemented. moreover "call b" call b instruction but i don't see this. please give me some explanations.

Upvotes: 3

Views: 3465

Answers (1)

Kristof Provost
Kristof Provost

Reputation: 26332

The three call b <> instructions are the two calls to printk.

When the kernel module is built the address of printk is not know. It's not part of the module after all.

Kernel modules are similar to shared libraries. When they are loaded into the kernel the kernel dynamic linker resolves missing symbols and replaces them with calls to the real function.

Upvotes: 1

Related Questions