README
1
2 gdbsx: gdbserver for xen
3
4
5Welcome to gdbsx. gdbsx is a gdbserver program to debug guest kernels and
6kernel modules. It runs on dom0 running on xen hypervisor and allows debug
7of 32 or 64bit PV or HVM elf guest binaries. It can also be run standalone,
8without remote gdb, to dump context of any/all VCPUs of any guest.
9
10It is divided in two parts, gx and xg. The former interacts with remote gdb,
11while latter interacts with xen and exports public APIs that can be used to
12create a plug in for any other debugger or binary type.
13
14
15USAGE:
16 USAGE 1:
17 - dom0> gdbsx -c 1 64 : displays VCPU contexts for 64bit guest with domid 1
18
19 USAGE 2:
20 - dom0> gdbsx -a 2 64 9999
21 connects to a 64bit guest with domid 2 and waits for gdb connection
22 - now, connect to the above gdbsx from a remote system or dom0 as:
23 bash> gdb ./vmlinux (exact matching vmlinux of guest kernel)
24 (gdb) target remote dom0:9999
25
26 - Additionally, to debug 32bit loadable kernel modules, please do following:
27 (gdb) p init_mm.pgd[3]
28 $1 = {pgd = 0x1b874f027}
29 (gdb) monitor pgd3 0x1b874f027 (Make sure value is in HEX)
30 pgd3val set to: 0x1b874f027
31
32 - use gdb as normal, breakpoints, single step, etc...
33 - when need to break into gdb, instead of ctrl-c, just do "xm pause <domid>"
34 on dom0 to pause the guest. this will break into gdb right away.
35 - detach/quit from gdb (leave gdbsx alone) to gracefully exit.
36 - if ctrl-c or core-dumped, make sure to do xm unpause if guest still paused.
37
38 - multiple vcpus:
39 o gdb>set scheduler-locking on : for single step of correct vcpu.
40
41 o since gdb is not kernel debugger, vcpus are emulated via threads
42 Thus, gdb>info threads : will show all vcpus. Then, switch thread
43 to get to another vcpu, etc... Remember, gdb has it's own [thread]
44 id, off by 1.
45
46 - See below for some useful gdb macros. Please email me if you've more.
47
48
49NOTES:
50 - For now, it is not possible to run gdbsx on a guest and gdb inside
51 the same guest at the same time.
52 - To report problems, please run gdbsx with -d and collect output.
53 - VCPU offlining is not supported. Thus [0-NUMVCPUs] are all assumed active.
54
55TIPS:
56 - make sure firewall is disabled on dom0 if running gdb on a different host.
57 - Must be at least gdb version 6.5-16.x to debug el5 kernels.
58
59
60Mukesh Rathor
61Oracle Corporation,
62Redwood Shores, CA USA
63mukesh[dot]rathor[at]oracle[dot]com
64
65
66------------------------------------------------------------------------------
67
68USEFUL gdb macros:
69
70# Courtesy Zhigang W (http://10.182.120.78/tech/vt/ovm/debug/gdbinit.macros):
71
72define ps
73 dont-repeat
74 set $tasks = (struct list_head *)init_task->tasks
75 set $offset = (unsigned long)&init_task->tasks - (unsigned long)&init_task
76 set $task = $tasks
77 set $task_entry = (struct task_struct *)((unsigned long)$task - $offset)
78 printf "Pointer PID Command\n"
79 printf "%p %-9d%s\n", $task_entry, $task_entry->pid, $task_entry->comm
80 set $task = $task->next
81 while $task != $tasks
82 set $task_entry = (struct task_struct *)((unsigned long)$task - $offset)
83 if ($task_entry->pid) != 0
84 printf "%p %-9d%s\n", $task_entry, $task_entry->pid, $task_entry->comm
85 end
86 set $task = $task->next
87 end
88end
89
90document ps
91Report a snapshot of the current processes.
92end
93
94
95define lsmod
96 dont-repeat
97 # 4 for 32bit kernels. 8 for 64bit kernels.
98 set $sz = sizeof(long)
99 set $mod = (struct list_head *)modules
100 printf "modptr address name\n"
101 while 1
102 set $mod_entry = (struct module *)((unsigned long)$mod - $sz)
103 if ($sz == 4)
104 printf "%08lx %08lx %s\n", $mod_entry, \
105 $mod_entry->module_core, $mod_entry->name
106 else
107 printf "%016lx %016lx %s\n", $mod_entry, \
108 $mod_entry->module_core, $mod_entry->name
109 end
110 set $mod = $mod->next
111 if ($mod == &modules)
112 loop_break
113 end
114 end
115end
116
117document lsmod
118Show the list of modules loaded in the Linux kernel.
119end
120
121define log
122 dont-repeat
123 printf "%s", log_buf
124end
125
126document log
127Dump system message buffer.
128end
129
130------------------------------------------------------------------------------
131