1 2 gdbsx: gdbserver for xen 3 4 5Welcome to gdbsx. gdbsx is a gdbserver program to debug guest kernels and 6kernel modules. It runs on dom0 running on xen hypervisor and allows debug 7of 32 or 64bit PV or HVM elf guest binaries. It can also be run standalone, 8without remote gdb, to dump context of any/all VCPUs of any guest. 9 10It is divided in two parts, gx and xg. The former interacts with remote gdb, 11while latter interacts with xen and exports public APIs that can be used to 12create a plug in for any other debugger or binary type. 13 14 15USAGE: 16 USAGE 1: 17 - dom0> gdbsx -c 1 64 : displays VCPU contexts for 64bit guest with domid 1 18 19 USAGE 2: 20 - dom0> gdbsx -a 2 64 9999 21 connects to a 64bit guest with domid 2 and waits for gdb connection 22 - now, connect to the above gdbsx from a remote system or dom0 as: 23 bash> gdb ./vmlinux (exact matching vmlinux of guest kernel) 24 (gdb) target remote dom0:9999 25 26 - Additionally, to debug 32bit loadable kernel modules, please do following: 27 (gdb) p init_mm.pgd[3] 28 $1 = {pgd = 0x1b874f027} 29 (gdb) monitor pgd3 0x1b874f027 (Make sure value is in HEX) 30 pgd3val set to: 0x1b874f027 31 32 - use gdb as normal, breakpoints, single step, etc... 33 - when need to break into gdb, instead of ctrl-c, just do "xm pause <domid>" 34 on dom0 to pause the guest. this will break into gdb right away. 35 - detach/quit from gdb (leave gdbsx alone) to gracefully exit. 36 - if ctrl-c or core-dumped, make sure to do xm unpause if guest still paused. 37 38 - multiple vcpus: 39 o gdb>set scheduler-locking on : for single step of correct vcpu. 40 41 o since gdb is not kernel debugger, vcpus are emulated via threads 42 Thus, gdb>info threads : will show all vcpus. Then, switch thread 43 to get to another vcpu, etc... Remember, gdb has it's own [thread] 44 id, off by 1. 45 46 - See below for some useful gdb macros. Please email me if you've more. 47 48 49NOTES: 50 - For now, it is not possible to run gdbsx on a guest and gdb inside 51 the same guest at the same time. 52 - To report problems, please run gdbsx with -d and collect output. 53 - VCPU offlining is not supported. Thus [0-NUMVCPUs] are all assumed active. 54 55TIPS: 56 - make sure firewall is disabled on dom0 if running gdb on a different host. 57 - Must be at least gdb version 6.5-16.x to debug el5 kernels. 58 59 60Mukesh Rathor 61Oracle Corporation, 62Redwood Shores, CA USA 63mukesh[dot]rathor[at]oracle[dot]com 64 65 66------------------------------------------------------------------------------ 67 68USEFUL gdb macros: 69 70# Courtesy Zhigang W (http://10.182.120.78/tech/vt/ovm/debug/gdbinit.macros): 71 72define ps 73 dont-repeat 74 set $tasks = (struct list_head *)init_task->tasks 75 set $offset = (unsigned long)&init_task->tasks - (unsigned long)&init_task 76 set $task = $tasks 77 set $task_entry = (struct task_struct *)((unsigned long)$task - $offset) 78 printf "Pointer PID Command\n" 79 printf "%p %-9d%s\n", $task_entry, $task_entry->pid, $task_entry->comm 80 set $task = $task->next 81 while $task != $tasks 82 set $task_entry = (struct task_struct *)((unsigned long)$task - $offset) 83 if ($task_entry->pid) != 0 84 printf "%p %-9d%s\n", $task_entry, $task_entry->pid, $task_entry->comm 85 end 86 set $task = $task->next 87 end 88end 89 90document ps 91Report a snapshot of the current processes. 92end 93 94 95define lsmod 96 dont-repeat 97 # 4 for 32bit kernels. 8 for 64bit kernels. 98 set $sz = sizeof(long) 99 set $mod = (struct list_head *)modules 100 printf "modptr address name\n" 101 while 1 102 set $mod_entry = (struct module *)((unsigned long)$mod - $sz) 103 if ($sz == 4) 104 printf "%08lx %08lx %s\n", $mod_entry, \ 105 $mod_entry->module_core, $mod_entry->name 106 else 107 printf "%016lx %016lx %s\n", $mod_entry, \ 108 $mod_entry->module_core, $mod_entry->name 109 end 110 set $mod = $mod->next 111 if ($mod == &modules) 112 loop_break 113 end 114 end 115end 116 117document lsmod 118Show the list of modules loaded in the Linux kernel. 119end 120 121define log 122 dont-repeat 123 printf "%s", log_buf 124end 125 126document log 127Dump system message buffer. 128end 129 130------------------------------------------------------------------------------ 131