如何在Linux内核中设置断点
function q1
{
set -x
modprobe vfio
modprobe vfio-pci
echo 15b3 101a >/sys/bus/pci/drivers/vfio-pci/new_id
ls /dev/vfio
qemu-system-x86_64 --enable-kvm \
-S \
-cpu qemu64 \
-name vm1 \
-m 4096 \
-hda /var/lib/libvirt/images/vm1-1.qcow2 \
-smp 4,sockets=4,cores=1,threads=1 \
-netdev user,id=nat1,hostfwd=tcp:127.0.0.1:8000-10.0.2.15:22 \
-device e1000,netdev=nat1,mac=52:54:00:13:01:01 \
-device vfio-pci,host=04:00.4,id=hostdev0,bus=pci.0,addr=0x9 \
-vga std \
-vnc :1 \
-daemonize
set +x
}alias sq1="ssh -p 8000 127.0.0.1"用如上命令q1启动虚拟机，注意加了-S选项。
# vncviewer :1进入vnc界面后按ctrl + alt + 2，进入了所谓的QEMU monitor console，
输入
# gdbserver tcp::1234在物理机上输入：
$ gdb vmlinux
GNU gdb (GDB) 8.0.50.20171229-git
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
下面就可以设置断点调试了：
(gdb) b mlx5e_xmit
Breakpoint 2 at 0xffffffffa0215f50: file drivers/net/ethernet/mellanox/mlx5/core/en_tx.c, line 371.
(gdb) c
Continuing.
Thread 7 hit Breakpoint 2, mlx5e_xmit (skb=0xffff8801277e0200, dev=0xffff8801225c0000) at drivers/net/ethernet/mellanox/mlx5/core/en_tx.c:371
371 {
(gdb) bt
#0 mlx5e_xmit (skb=0xffff8801277e0200, dev=0xffff8801225c0000) at drivers/net/ethernet/mellanox/mlx5/core/en_tx.c:371
#1 0xffffffff81625652 in trace_net_dev_start_xmit (dev=, skb=) at ./include/trace/events/net.h:13
#2 xmit_one (more=, txq=, dev=, skb=) at net/core/dev.c:2982
#3 dev_hard_start_xmit (first=0xffff8801277e0200, dev=0xffff8801225c0000, txq=0xffff8801225c0000, ret=0xffffc900001b7a2c) at net/core/dev.c:2999
#4 0xffffffff816525a8 in qdisc_qlen (q=) at ./include/net/sch_generic.h:281
#5 sch_direct_xmit (skb=0xffff8801277e0200, q=0xffff880126f34800, dev=0xffff8801225c0000, txq=0xffff8801233f8000, root_lock=0xffff880126f3489c, validate=) at net/sched/sch_generic.c:187
#6 0xffffffff81625d9a in sch_handle_egress (dev=, ret=, skb=) at net/core/dev.c:3280
#7 __dev_queue_xmit (skb=0xffff8801277e0200, accel_priv=0xffff880126f34800) at net/core/dev.c:3429
#8 0xffffffff81625f70 in netif_receive_skb_internal (skb=0xffff8801277e0200) at net/core/dev.c:4465
#9 0xffffffff81672c17 in ip_finish_output2 (net=0xffff8801277e0200, sk=0xffff8801225c0000, skb=0xffffffff81625f70 ) at net/ipv4/ip_output.c:194
#10 0xffffffff81672ef7 in ip_finish_output_gso (mtu=, skb=, sk=, net=) at net/ipv4/ip_output.c:275
#11 ip_finish_output (net=0xffffffff81cd6e40 , sk=0xffff8801265c0000, skb=) at net/ipv4/ip_output.c:312
#12 0xffffffff816739e2 in nf_hook_state_init (okfn=, net=, sk=, outdev=, indev=, pf=, hook=, p=)
at ./include/linux/netfilter.h:121
#13 nf_hook (indev=, okfn=, outdev=, skb=, sk=, net=, hook=, pf=) at ./include/linux/netfilter.h:200
#14 NF_HOOK_COND (pf=, hook=, in=, okfn=, cond=, out=, skb=, sk=, net=)
at ./include/linux/netfilter.h:235
#15 ip_output (net=0xffffffff81cd6e40 , sk=0xffff8801265c0000, skb=0xffff8801277e0200) at net/ipv4/ip_output.c:405
#16 0xffffffff816730e5 in ip_build_and_send_pkt (skb=0xffffffff81cd6e40 , sk=0x0 , saddr=2686628480, daddr=1800748, opt=0xffff880126f3489c) at net/ipv4/ip_output.c:152
#17 0xffffffff81674389 in ip_push_pending_frames (sk=0xffffc900001b7c28, fl4=) at net/ipv4/ip_output.c:1512
#18 0xffffffff816743e3 in ip_make_skb (sk=0xffff8801277e0200, fl4=0xffff8801225c0000, getfrag=0xffffffffa022b280 , from=0xffffc900001b7a2c, length=653478044, transhdrlen=1, ipc=0xffff8801118a0000,
rtp=0x0 , flags=1801776) at net/ipv4/ip_output.c:1546
#19 0xffffffff8169cda5 in sock_tx_timestamp (tx_flags=, tsflags=, sk=) at ./include/net/sock.h:2269
#20 raw_sendmsg (sk=0xffffffff81674389 , msg=, len=18446612137252749312) at net/ipv4/raw.c:647
#21 0xffffffff816acf5e in rps_record_sock_flow (hash=, table=) at ./include/linux/netdevice.h:665
#22 sock_rps_record_flow_hash (hash=) at ./include/net/sock.h:927
#23 sock_rps_record_flow (sk=) at ./include/net/sock.h:947
#24 inet_sendmsg (sock=, msg=0xffff8801225c0000, size=18446744072101212800) at net/ipv4/af_inet.c:755
#25 0xffffffff81605038 in sock_sendmsg_nosec (msg=, sock=) at net/socket.c:633
#26 sock_sendmsg (sock=0xffff88011622c000, msg=0xffffc900001b7e30) at net/socket.c:643
#27 0xffffffff8160559f in SYSC_sendto (fd=, buff=, len=, flags=0, addr=0x5ee3998500, addr_len=16) at net/socket.c:1736
#28 0xffffffff8160607e in SyS_sendto (fd=, buff=, len=, flags=, addr=, addr_len=) at net/socket.c:1704
#29 0xffffffff8175e6b7 in entry_SYSCALL_64 () at arch/x86/entry/entry_64.S:236
#30 0x0000000000000401 in irq_stack_union ()
#31 0x00007ffcb6d011a4 in ?? ()
#32 0x00007ffcb6d00100 in ?? ()
#33 0x00007ffcb6d00c80 in ?? ()
#34 0x0000000000000401 in irq_stack_union ()
#35 0x0000000000000000 in ?? ()
(gdb) print *(struct net_device*) 0xffff8801225c0000
$1 = {
name = "ens9", '\000' ,
name_hlist = {
next = 0x0 ,
pprev = 0xffff88012950cfc0
}, 如果要用KVM，而不是QEMU的话，加上如下内容：
# virsh edit vm1
参考链接：
https://lwn.net/Articles/631167/
https://www.kernel.org/doc/html/v4.11/dev-tools/gdb-kernel-debugging.html
https://wiki.libvirt.org/page/QEMUSwitchToLibvirt#-S
http://blog.csdn.net/heli007/article/details/7187586
需要说明的是，虚拟机需要重新编译内核，加上如下选项：
CONFIG_GDB_SCRIPTS=y