如何编写Linux内核模块？

一、问题来源

测试内核漏洞利用

二、解决步骤

1.编写内核模块 hello_world_mod.c

#include <linux/init.h>
#include <linux/module.h>

MODULE_LICENSE("Dual BSD/GPL");

static int hello_init(void)
{
    printk(KERN_ALERT "Hello, world\n");
    return 0; 
}

static void hello_exit(void)
{
    printk(KERN_ALERT "Goodbye, world\n");
}

module_init(hello_init);
module_exit(hello_exit);

2.编译
编写Makefile

obj-m += hello_world_mod.o

all:
    make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules

clean:
    make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

编译

invincible@ubuntu:~/Desktop/my_mods$ ls
hello_world_mod.c  Makefile

invincible@ubuntu:~/Desktop/my_mods$ make
make -C /lib/modules/4.4.0-112-generic/build M=/home/invincible/Desktop/my_mods modules
make[1]: Entering directory '/usr/src/linux-headers-4.4.0-112-generic'
  CC [M]  /home/invincible/Desktop/my_mods/hello_world_mod.o
  Building modules, stage 2.
  MODPOST 1 modules
  CC      /home/invincible/Desktop/my_mods/hello_world_mod.mod.o
  LD [M]  /home/invincible/Desktop/my_mods/hello_world_mod.ko
make[1]: Leaving directory '/usr/src/linux-headers-4.4.0-112-generic'

invincible@ubuntu:~/Desktop/my_mods$ ls
hello_world_mod.c   hello_world_mod.mod.c  hello_world_mod.o  modules.order
hello_world_mod.ko  hello_world_mod.mod.o  Makefile           Module.symvers

3.加载和卸载

invincible@ubuntu:~/Desktop/my_mods$ sudo insmod hello_world_mod.ko 
[sudo] password for invincible: 
invincible@ubuntu:~/Desktop/my_mods$ dmesg | tail -1
[23470.393026] Hello, world

invincible@ubuntu:~/Desktop/my_mods$ sudo rmmod hello_world_mod 
invincible@ubuntu:~/Desktop/my_mods$ dmesg |tail -1
[23500.854576] Goodbye, world

三、知识点

什么是内核模块？

Modules are an efficient way of adding device drivers, filesystems and other components dynamically into the Linux kernel without having to build a new kernel or reboot the system.

模块是一种有效的向Linux Kernel中动态添加device drivers, filesystems 等内核组件的方法，这种方式不需要重新编译内核也不需要重启内核。

Externally, modules are just normal relocatable object files, as a file call will quickly confirm:
wolfgang@meitner> file vfat.ko
vfat.ko: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
They are, of course, neither executable files nor program libraries as normally found in system program- ming; however, the basic structure of the binary module file is based on the same scheme also used for the above purposes.

模块也是一种ELF格式的文件。

内核模块代码含义？

hello_init和hello_exit

This module defines two functions, one to be invoked when the module is loaded into the kernel(hello_init) and one for when the module is removed(hello_exit).
自定义的两个函数，分别作为module_init和module_exit宏的参数，当模块被加载和卸载时调用。

module_init和module_exit宏

The module_init and module_exit lines use special kernel macros to indicate the role of these two functions.
用于声明模块加载和卸载的时候调用的函数。

MODULE_LICENSE

Another special macro(MODULE_LICENSE) is used to tell the kernel that this module bears a free license; without such a declaration, the kernel complains when the module is loaded.
用于声明License, 带着就行了

invincible$ grep "MODULE_LICENSE" -nr ./
.//kvm_main.c:72:MODULE_LICENSE("GPL");

kvm 用的GPL license

Makefile代码含义？

Linux/Documentation/kbuild/makefiles.txt

3.1 Goal definitions
Goal definitions are the main part (heart) of the kbuild Makefile.
...
The most simple kbuild makefile contains one line:

    Example:
        obj-y += foo.o

This tells kbuild that there is one object in that directory, named foo.o. foo.o will be built from foo.c or foo.S. 
If foo.o shall be built as a module, the variable obj-m is used.

Linux/Documentation/kbuild/modules.txt

=== 2. How to Build External Modules

--- 2.1 Command Syntax

    The command to build an external module is:

        $ make -C <path_to_kernel_src> M=$PWD

    The kbuild system knows that an external module is being built
    due to the "M=<dir>" option given in the command.

    To build against the running kernel use:

        $ make -C /lib/modules/`uname -r`/build M=$PWD

    ...

--- 2.2 Options

    ($KDIR refers to the path of the kernel source directory.)

    make -C $KDIR M=$PWD

    -C $KDIR
        The directory where the kernel source is located.
        "make" will actually change to the specified directory
        when executing and will change back when finished.

    M=$PWD
        Informs kbuild that an external module is being built.
        The value given to "M" is the absolute path of the
        directory where the external module (kbuild file) is
        located.

--- 2.3 Targets

    When building an external module, only a subset of the "make"
    targets are available.

    make -C $KDIR M=$PWD [target]

    The default will build the module(s) located in the current
    directory, so a target does not need to be specified. All
    output files will also be generated in this directory. No
    attempts are made to update the kernel source, and it is a
    precondition that a successful "make" has been executed for the
    kernel.

    modules
        The default target for external modules. It has the
        same functionality as if no target was specified. See
        description above.

    modules_install
        ...
    clean
        Remove all generated files in the module directory only.

    help
         ...

参考资料：

《Linux Kernel Architecture》Chapter 7
《Linux Device Driver 3》Chapter 2
《Linux Kernel Makefiles》
《Building External Modules》