Debugging The Linux Kernel Using Gdb

From eLinux.org
Revision as of 12:32, 26 November 2008 by Keesj (talk | contribs) (added ovewview image)
Jump to: navigation, search

Debugging the linux kernel using gdb

The majority of day to day kernel debugging is done by adding print statements to code by using the famous printk function this is well described in Kernel Debugging Tips . Using printk is a relatively simple, effective and cheap way to find problems. There are many other linux grown techniques that take the debugging and profiling approach to a higher level. On this page we will discuss using the gnu debugger to do kernel debugging. The GDB page describes some basic gdb command and also gives good links to documentation. Overall starting using gdb to do kernel debugging is relatively easy.

Most of the examples here will work in two (open source) situations. when using JTAG and when using qemu system emulation. As the second option does not require any hardware you could go on and try it right away!

The open source jtag debugging world is not that big. One project stands out in terms of debugging capabilities is OpenOCD and this is the tool used in this documentation. OpenOCD is pretty usable on the targets we tested arm11 and arm9

The basics

Kernel gdb debugging component overvierw small.png

To start debugging are kernel you will need to configure the kernel to have debug symbols. Once this is done you can do your normal kernel development. When needed you can "hook-up" your debugger Start debugging a running kernel.

- start openocd

vmlinuz v.s zImage

When you want to debug the kernel you need a little understanding of how the kernel is composed. Most important is the difference between your vmlinux and the zImage. What you need to understand at this point is that the zImage is a container. This container gets loaded by a bootloader and that execution is handed over to the zImage. This zImage unpacks the kernel to the same memory location and starts executing the kernel.(explain that vmlinux does not have to be the real kernel as it is possible to debug a "stripped" kernel using a non stripped vmlinux). overall if we look at a compiled kernel we will see that vmlinux is located at the root of the kernel tree whiles the zImage is located under arch/arm/boot

vmlinux
arch/arm/boot
`-- zImage

vmlinux is what we will be using during debugging of the linux kernel.

Loading a kernel in memory

Once you are used to using gdb to debug kernels you will want to use gdb to directly load kernels onto your target. The most practical way of doing this is to set a hardware breakpoint at the start of the kernel and reset your board using the jtag reset signal. Your bootloader will initialize your board and the execution will stop at the start of the kernel. after that you can load a kernel into memory and run it.

execute the following:

(gdb) file vmlinux
(gdb) target remote :3333
(gdb) break __init_begin
(gdb) cont
(gdb) mon reset #perhaps this needs to be done from the openocd telnet session..
Breakpoint 1, 0xc0008000 in stext ()
(gdb) load vmlinux
Loading section .text.head, size 0x240 lma 0xc0008000
Loading section .init, size 0xe4dc0 lma 0xc0008240
Loading section .text, size 0x219558 lma 0xc00ed000
Loading section .text.init, size 0x7c lma 0xc0306558
Loading section __ksymtab, size 0x4138 lma 0xc0307000
Loading section __ksymtab_gpl, size 0x1150 lma 0xc030b138
Loading section __kcrctab, size 0x209c lma 0xc030c288
Loading section __kcrctab_gpl, size 0x8a8 lma 0xc030e324
Loading section __ksymtab_strings, size 0xc040 lma 0xc030ebcc
Loading section __param, size 0x2e4 lma 0xc031ac0c
Loading section .data, size 0x1e76c lma 0xc031c000
Start address 0xc0008000, load size 3345456
Transfer rate: 64 KB/sec, 15632 bytes/write.
(gdb) cont

This will boot your kernel that was loaded into memory via jtag

Getting the kernel log buffer

Sometimes the kernel will panic before the serial is up and running. in such situations is it *VERY* handy to be able to dump the kernel log buffer. this can be done by looking at the content of the __log_buf in the kernel. in gdb this can be done by issuing

p (char*) &__log_buf[log_start]

There must be a simple way of printing the memory area between log_start and log_end.

The problem is that gdb stops after the first line. currently we use this routine that copied from wchar.gdb until something "normal" came out. we defined dmesg it like this:

define dmesg
        set $__log_buf = $arg0
        set $log_start = $arg1
        set $log_end = $arg2
        set $x = $log_start
        echo "
        while ($x < $log_end)
                set $c = (char)(($__log_buf)[$x++])
                printf "%c" , $c
        end
        echo "\n
end
document dmesg
dmesg __log_buf log_start log_end
Print the content of the kernel message buffer
end

and call it like this:

dmesg __log_buf log_start log_end

Debugging a kernel module (.o and .ko )

Debugging a kernel module is not much harder.

add-symbol-file drivers/mydrivers/mydriver.o 0xbf098000 note that we use the .o file and not the .ko one. the address at the end is currenly gotten from running

cat /sys/module/mydriver/sections/.text