概述
内核测试是确保代码质量和稳定性的关键环节。本专题介绍KUnit单元测试框架、kselftest自测试套件、syzkaller模糊测试工具等内核测试技术。
一、KUnit内核单元测试
1.1 KUnit基础
KUnit是Linux内核的轻量级单元测试框架，允许在内核空间直接运行测试。
# 配置KUnit
cd linux
make menuconfig
# 启用 Kernel hacking -> Kernel Testing and Coverage -> KUnit test framework
# 运行所有KUnit测试
./tools/testing/kunit/kunit.py run
# 运行特定测试
./tools/testing/kunit/kunit.py run --kunitconfig=drivers/base/test/
1.2 编写KUnit测试
// example_kunit_test.c - KUnit测试示例
#include<kunit/test.h>
#include<linux/slab.h>
// 测试套件数据结构
structexample_test_context {
int value;
char *buffer;
};
// 测试初始化
staticintexample_test_init(struct kunit *test)
{
structexample_test_context *ctx;
ctx = kunit_kzalloc(test, sizeof(*ctx), GFP_KERNEL);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
ctx->value = 42;
ctx->buffer = kunit_kzalloc(test, 256, GFP_KERNEL);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx->buffer);
test->priv = ctx;
return0;
}
// 测试清理
staticvoidexample_test_exit(struct kunit *test)
{
// KUnit自动清理分配的内存
}
// 测试用例1：基本断言
staticvoidexample_basic_test(struct kunit *test)
{
structexample_test_context *ctx = test->priv;
// 相等断言
KUNIT_EXPECT_EQ(test, ctx->value, 42);
KUNIT_EXPECT_NE(test, ctx->value, 0);
// 指针断言
KUNIT_EXPECT_NOT_NULL(test, ctx->buffer);
KUNIT_EXPECT_PTR_NE(test, ctx->buffer, NULL);
// 布尔断言
KUNIT_EXPECT_TRUE(test, ctx->value > 0);
KUNIT_EXPECT_FALSE(test, ctx->value < 0);
}
// 测试用例2：字符串操作
staticvoidexample_string_test(struct kunit *test)
{
structexample_test_context *ctx = test->priv;
strcpy(ctx->buffer, "Hello KUnit");
// 字符串断言
KUNIT_EXPECT_STREQ(test, ctx->buffer, "Hello KUnit");
KUNIT_EXPECT_STRNEQ(test, ctx->buffer, "Goodbye");
// 内存比较
KUNIT_EXPECT_MEMEQ(test, ctx->buffer, "Hello", 5);
}
// 测试用例3：边界条件
staticvoidexample_boundary_test(struct kunit *test)
{
int *arr;
int i;
// 测试内存分配边界
arr = kunit_kcalloc(test, 1000, sizeof(int), GFP_KERNEL);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, arr);
for (i = 0; i < 1000; i++) {
arr[i] = i;
KUNIT_EXPECT_EQ(test, arr[i], i);
}
// 测试整数溢出
KUNIT_EXPECT_GT(test, INT_MAX, INT_MAX - 1);
}
// 测试用例4：错误处理
staticvoidexample_error_test(struct kunit *test)
{
void *ptr;
// 测试错误返回值
ptr = kmalloc(SIZE_MAX, GFP_KERNEL);
KUNIT_EXPECT_NULL(test, ptr);
// 测试错误码
KUNIT_EXPECT_EQ(test, PTR_ERR(ERR_PTR(-EINVAL)), -EINVAL);
}
// 测试用例数组
staticstructkunit_caseexample_test_cases[] = {
KUNIT_CASE(example_basic_test),
KUNIT_CASE(example_string_test),
KUNIT_CASE(example_boundary_test),
KUNIT_CASE(example_error_test),
{}
};
// 定义测试套件
staticstructkunit_suiteexample_test_suite = {
.name = "example_kunit",
.init = example_test_init,
.exit = example_test_exit,
.test_cases = example_test_cases,
};
kunit_test_suite(example_test_suite);
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Example KUnit Test Suite");
1.3 参数化测试
// parameterized_test.c - 参数化KUnit测试
#include<kunit/test.h>
// 测试参数结构
structtest_params {
int input;
int expected;
constchar *name;
};
// 参数化测试数据
staticconststructtest_paramstest_data[] = {
{ .input = 0, .expected = 0, .name = "zero" },
{ .input = 1, .expected = 1, .name = "one" },
{ .input = -1, .expected = 1, .name = "negative" },
{ .input = 100, .expected = 10000, .name = "large" },
};
// 生成参数描述
staticvoidparam_desc(conststruct test_params *params, char *desc)
{
snprintf(desc, KUNIT_PARAM_DESC_SIZE, "%s", params->name);
}
// 参数生成器
KUNIT_ARRAY_PARAM(test_param, test_data, param_desc);
// 参数化测试用例
staticvoidparam_test_square(struct kunit *test)
{
conststructtest_params *params = test->param_value;
int result;
if (params->input < 0)
result = -params->input;
else
result = params->input * params->input;
KUNIT_EXPECT_EQ(test, result, params->expected);
}
// 测试用例数组
staticstructkunit_caseparam_test_cases[] = {
KUNIT_CASE_PARAM(param_test_square, test_param_gen_params),
{}
};
// 测试套件
staticstructkunit_suiteparam_test_suite = {
.name = "param_test",
.test_cases = param_test_cases,
};
kunit_test_suite(param_test_suite);
二、kselftest自测试
2.1 kselftest框架
# 构建所有selftests
make -C tools/testing/selftests
# 运行所有测试
make -C tools/testing/selftests run_tests
# 运行特定子系统测试
make -C tools/testing/selftests TARGETS="mm net" run_tests
# 安装测试到系统
make -C tools/testing/selftests install INSTALL_PATH=/opt/selftests
2.2 编写kselftest测试
// test_example.c - kselftest示例
#include<stdio.h>
#include<stdlib.h>
#include<unistd.h>
#include<errno.h>
#include<sys/types.h>
#include<sys/wait.h>
#include"../kselftest.h"
#include"../kselftest_harness.h"
// 简单测试
TEST(basic_test)
{
int a = 1 + 1;
ASSERT_EQ(2, a);
ASSERT_NE(3, a);
ASSERT_GT(a, 1);
ASSERT_LT(a, 3);
}
// 带fixture的测试
structtest_fixture {
int fd;
char *buffer;
};
FIXTURE(file_test)
{
int fd;
char buffer[1024];
};
FIXTURE_SETUP(file_test)
{
self->fd = open("/tmp/test.txt", O_CREAT | O_RDWR, 0644);
ASSERT_GE(self->fd, 0);
memset(self->buffer, 0, sizeof(self->buffer));
}
FIXTURE_TEARDOWN(file_test)
{
if (self->fd >= 0) {
close(self->fd);
unlink("/tmp/test.txt");
}
}
TEST_F(file_test, write_read)
{
constchar *data = "Test data";
ssize_t ret;
ret = write(self->fd, data, strlen(data));
ASSERT_EQ(ret, strlen(data));
lseek(self->fd, 0, SEEK_SET);
ret = read(self->fd, self->buffer, sizeof(self->buffer));
ASSERT_EQ(ret, strlen(data));
ASSERT_STREQ(self->buffer, data);
}
TEST_F(file_test, seek_operations)
{
off_t pos;
pos = lseek(self->fd, 100, SEEK_SET);
ASSERT_EQ(pos, 100);
pos = lseek(self->fd, 50, SEEK_CUR);
ASSERT_EQ(pos, 150);
pos = lseek(self->fd, 0, SEEK_END);
ASSERT_EQ(pos, 0);
}
// 系统调用测试
TEST(syscall_test)
{
pid_t pid;
int status;
pid = fork();
ASSERT_GE(pid, 0);
if (pid == 0) {
// 子进程
exit(42);
} else {
// 父进程
waitpid(pid, &status, 0);
ASSERT_TRUE(WIFEXITED(status));
ASSERT_EQ(WEXITSTATUS(status), 42);
}
}
// 性能测试
TEST(performance_test)
{
structtimespecstart, end;
longlong elapsed_ns;
int i;
clock_gettime(CLOCK_MONOTONIC, &start);
// 测试操作
for (i = 0; i < 1000000; i++) {
getpid();
}
clock_gettime(CLOCK_MONOTONIC, &end);
elapsed_ns = (end.tv_sec - start.tv_sec) * 1000000000LL +
(end.tv_nsec - start.tv_nsec);
printf("1M getpid() calls took %lld ns\n", elapsed_ns);
ASSERT_LT(elapsed_ns, 1000000000LL); // 应该小于1秒
}
TEST_HARNESS_MAIN
2.3 编写Makefile
# Makefile for kselftest
TEST_GEN_PROGS := test_example
TEST_GEN_FILES := test_data.txt
CFLAGS += -Wall -O2 -g
# 包含kselftest库
include ../lib.mk
# 自定义构建规则
$(OUTPUT)/test_example: test_example.c
$(CC)$(CFLAGS) -o $@$<$(LDFLAGS)
# 生成测试数据
$(OUTPUT)/test_data.txt:
echo "Test data" > $@
# 清理
clean:
rm -f $(TEST_GEN_PROGS)$(TEST_GEN_FILES)
三、syzkaller模糊测试
3.1 syzkaller安装配置
# 安装Go环境
wget https://golang.org/dl/go1.19.linux-amd64.tar.gz
tar -C /usr/local -xzf go1.19.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin
# 获取syzkaller
go get -u -d github.com/google/syzkaller/prog
cd$GOPATH/src/github.com/google/syzkaller
make
# 配置内核
cat >> .config << EOF
CONFIG_KCOV=y
CONFIG_DEBUG_INFO=y
CONFIG_KASAN=y
CONFIG_KASAN_INLINE=y
CONFIG_CONFIGFS_FS=y
CONFIG_SECURITYFS=y
EOF
make olddefconfig
make -j$(nproc)
3.2 syzkaller配置文件
{
"target":"linux/amd64",
"http":"127.0.0.1:56741",
"workdir":"/home/user/syzkaller-workdir",
"kernel_obj":"/home/user/linux",
"image":"/home/user/image/bullseye.img",
"sshkey":"/home/user/image/bullseye.id_rsa",
"syzkaller":"/home/user/gopath/src/github.com/google/syzkaller",
"procs":8,
"type":"qemu",
"vm":{
"count":4,
"kernel":"/home/user/linux/arch/x86/boot/bzImage",
"cpu":2,
"mem":2048
},
"enable_syscalls":[
"open",
"openat",
"read",
"write",
"ioctl$*"
],
"disable_syscalls":[
"keyctl",
"add_key",
"request_key"
],
"suppressions":[
"some known bug"
]
}
3.3 自定义系统调用描述
# custom_syscalls.txt - syzkaller系统调用描述
# 自定义ioctl
ioctl$MY_IOCTL_SET(fd fd, cmd const[MY_IOCTL_SET], arg ptr[in, my_ioctl_arg])
ioctl$MY_IOCTL_GET(fd fd, cmd const[MY_IOCTL_GET], arg ptr[out, my_ioctl_arg])
# 自定义结构体
my_ioctl_arg {
type int32
size int32
data array[int8, 0:256]
flags flags[my_flags, int32]
}
# 自定义标志
my_flags = MY_FLAG_READ, MY_FLAG_WRITE, MY_FLAG_EXEC
# 自定义文件描述符
resource fd_my[fd]
openat$my_device(fd const[AT_FDCWD], file ptr[in, string["/dev/my_device"]], flags flags[open_flags], mode const[0]) fd_my
# 自定义系统调用
my_custom_syscall(arg1 int32, arg2 ptr[in, array[int8]], arg3 len[arg2])
3.4 运行syzkaller
#!/bin/bash
# run_syzkaller.sh - 运行syzkaller
# 创建工作目录
mkdir -p syzkaller-workdir
# 启动syz-manager
./bin/syz-manager -config=my.cfg
# 查看崩溃
ls syzkaller-workdir/crashes/
# 重现崩溃
./bin/syz-repro -config=my.cfg syzkaller-workdir/crashes/crash-hash/log
# 最小化测试用例
./bin/syz-prog2c -prog syzkaller-workdir/crashes/crash-hash/prog
四、代码覆盖率测试
4.1 GCOV覆盖率
# 配置内核支持GCOV
cat >> .config << EOF
CONFIG_DEBUG_FS=y
CONFIG_GCOV_KERNEL=y
CONFIG_GCOV_PROFILE_ALL=y
EOF
make olddefconfig
make -j$(nproc)
# 挂载debugfs
mount -t debugfs none /sys/kernel/debug
# 重置覆盖率数据
echo 0 > /sys/kernel/debug/gcov/reset
# 运行测试
./run_tests.sh
# 收集覆盖率数据
gcov -o /sys/kernel/debug/gcov/ *.c
# 生成HTML报告
lcov -c -d /sys/kernel/debug/gcov -o coverage.info
genhtml coverage.info -o coverage_report/
4.2 KCOV覆盖率
// kcov_example.c - KCOV使用示例
#include<stdio.h>
#include<stdint.h>
#include<stdlib.h>
#include<sys/ioctl.h>
#include<sys/mman.h>
#include<fcntl.h>
#include<unistd.h>
#define KCOV_INIT_TRACE _IOR('c', 1, unsigned long)
#define KCOV_ENABLE _IO('c', 100)
#define KCOV_DISABLE _IO('c', 101)
#define COVER_SIZE (64 << 10)
intmain()
{
int fd;
unsignedlong *cover;
unsignedlong n, i;
// 打开KCOV设备
fd = open("/sys/kernel/debug/kcov", O_RDWR);
if (fd < 0) {
perror("open");
return1;
}
// 初始化跟踪
if (ioctl(fd, KCOV_INIT_TRACE, COVER_SIZE)) {
perror("ioctl(KCOV_INIT_TRACE)");
return1;
}
// 映射覆盖率缓冲区
cover = mmap(NULL, COVER_SIZE * sizeof(unsignedlong),
PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
if (cover == MAP_FAILED) {
perror("mmap");
return1;
}
// 启用覆盖率收集
if (ioctl(fd, KCOV_ENABLE, 0)) {
perror("ioctl(KCOV_ENABLE)");
return1;
}
// 重置计数器
__atomic_store_n(&cover[0], 0, __ATOMIC_RELAXED);
// 执行要测试的系统调用
read(fd, &n, sizeof(n));
// 读取覆盖率数据
n = __atomic_load_n(&cover[0], __ATOMIC_RELAXED);
printf("Coverage: %lu basic blocks\n", n);
for (i = 0; i < n; i++)
printf(" 0x%lx\n", cover[i + 1]);
// 禁用覆盖率收集
if (ioctl(fd, KCOV_DISABLE, 0))
perror("ioctl(KCOV_DISABLE)");
munmap(cover, COVER_SIZE * sizeof(unsignedlong));
close(fd);
return0;
}
五、错误注入测试
5.1 故障注入框架
// fault_injection.c - 故障注入测试
#include<linux/module.h>
#include<linux/fault-inject.h>
#include<linux/slab.h>
staticDECLARE_FAULT_ATTR(test_fault_attr);
// 带故障注入的内存分配
staticvoid *test_kmalloc(size_t size, gfp_t flags)
{
if (should_fail(&test_fault_attr, size))
returnNULL;
return kmalloc(size, flags);
}
staticint __init fault_test_init(void)
{
void *ptr;
int i;
// 配置故障注入
test_fault_attr.probability = 10; // 10%失败率
test_fault_attr.interval = 100; // 每100次注入一次
// 测试故障注入
for (i = 0; i < 20; i++) {
ptr = test_kmalloc(1024, GFP_KERNEL);
if (!ptr) {
printk(KERN_INFO "Allocation %d failed (injected)\n", i);
} else {
printk(KERN_INFO "Allocation %d succeeded\n", i);
kfree(ptr);
}
}
return0;
}
staticvoid __exit fault_test_exit(void)
{
}
module_init(fault_test_init);
module_exit(fault_test_exit);
MODULE_LICENSE("GPL");
5.2 使用debugfs控制故障注入
#!/bin/bash
# fault_inject.sh - 故障注入控制脚本
# 启用slab故障注入
echo 1 > /sys/kernel/debug/failslab/task-filter
# 设置失败概率（1-100）
echo 10 > /sys/kernel/debug/failslab/probability
# 设置间隔
echo 100 > /sys/kernel/debug/failslab/interval
# 设置详细输出
echo 2 > /sys/kernel/debug/failslab/verbose
# 针对特定进程
echo$PID > /sys/kernel/debug/failslab/task-filter
# 运行测试
./test_program
# 查看统计
cat /sys/kernel/debug/failslab/times
cat /sys/kernel/debug/failslab/space
六、压力测试
6.1 LTP（Linux Test Project）
# 安装LTP
git clone https://github.com/linux-test-project/ltp.git
cd ltp
make autotools
./configure
make
make install
# 运行测试
cd /opt/ltp
./runltp -f syscalls
./runltp -f mm
./runltp -f fs
# 运行压力测试
./runltp -f stress
6.2 自定义压力测试
// stress_test.c - 内核压力测试模块
#include<linux/module.h>
#include<linux/kthread.h>
#include<linux/slab.h>
#include<linux/random.h>
#include<linux/delay.h>
staticstructtask_struct *stress_threads[NR_CPUS];
staticint stop_flag = 0;
staticintstress_thread(void *data)
{
int cpu = *(int *)data;
void *ptrs[100];
int i, size;
// 绑定到指定CPU
set_cpus_allowed_ptr(current, cpumask_of(cpu));
while (!kthread_should_stop() && !stop_flag) {
// 随机内存分配/释放
for (i = 0; i < 100; i++) {
get_random_bytes(&size, sizeof(size));
size = (size % 4096) + 1;
ptrs[i] = kmalloc(size, GFP_KERNEL);
if (ptrs[i]) {
memset(ptrs[i], 0xAA, size);
get_random_bytes(ptrs[i], min(size, 16));
}
}
// 随机延迟
usleep_range(100, 1000);
// 释放内存
for (i = 0; i < 100; i++) {
kfree(ptrs[i]);
}
// CPU让出
schedule();
}
return0;
}
staticint __init stress_init(void)
{
int cpu;
staticint cpu_ids[NR_CPUS];
printk(KERN_INFO "Starting kernel stress test\n");
for_each_online_cpu(cpu) {
cpu_ids[cpu] = cpu;
stress_threads[cpu] = kthread_create(stress_thread,
&cpu_ids[cpu],
"stress_%d", cpu);
if (stress_threads[cpu])
wake_up_process(stress_threads[cpu]);
}
return0;
}
staticvoid __exit stress_exit(void)
{
int cpu;
stop_flag = 1;
for_each_online_cpu(cpu) {
if (stress_threads[cpu])
kthread_stop(stress_threads[cpu]);
}
printk(KERN_INFO "Kernel stress test stopped\n");
}
module_init(stress_init);
module_exit(stress_exit);
MODULE_LICENSE("GPL");
七、测试自动化
7.1 CI/CD集成
# .github/workflows/kernel-test.yml - GitHub Actions配置
name:KernelTests
on: [push, pull_request]
jobs:
build-and-test:
runs-on:ubuntu-latest
steps:
-uses:actions/checkout@v2
-name:Installdependencies
run:|
sudo apt-get update
sudo apt-get install -y build-essential libncurses-dev \
bison flex libssl-dev libelf-dev
-name:Configurekernel
run:|
make defconfig
./scripts/config --enable CONFIG_KUNIT
./scripts/config --enable CONFIG_KCOV
-name:Buildkernel
run:make-j$(nproc)
-name:RunKUnittests
run:./tools/testing/kunit/kunit.pyrun
-name:Runselftests
run:|
make -C tools/testing/selftests
make -C tools/testing/selftests run_tests
-name:Uploadcoverage
run:|
lcov -c -d . -o coverage.info
bash <(curl -s https://codecov.io/bash)
7.2 测试脚本
#!/bin/bash
# run_all_tests.sh - 运行所有测试
set -e
echo"=== Building kernel with test configs ==="
make clean
cp .config.test .config
make olddefconfig
make -j$(nproc)
echo"=== Running KUnit tests ==="
./tools/testing/kunit/kunit.py run --timeout=300
echo"=== Running kselftest ==="
make -C tools/testing/selftests run_tests
echo"=== Running custom tests ==="
insmod test_module.ko
sleep 5
rmmod test_module
dmesg | tail -100
echo"=== Checking coverage ==="
gcov *.c
lcov -c -d . -o coverage.info
genhtml coverage.info -o coverage_html/
echo"=== All tests completed ==="
测试最佳实践
测试原则
测试覆盖率目标
调试技巧
# 使用KGDB调试测试
echo g > /proc/sysrq-trigger
# 使用ftrace跟踪测试
echofunction > /sys/kernel/debug/tracing/current_tracer
echo 1 > /sys/kernel/debug/tracing/tracing_on
# 使用printk调试
echo 8 > /proc/sys/kernel/printk
实践检查清单
下一步
完成内核测试学习后，可以：
10个月宝宝每天需要喝多少奶粉？