使用kgdb调试Vagrant guest kernel

在上一篇介绍了如何用Vagrant启动自己编译的内核，现在我们要使用gdb来调试这个内核。首先需要在Guest Ubuntu中修改内核启动参数。在/etc/default/grub中找到GRUB_CMDLINE_LINUX, 改成下面这样：

GRUB_CMDLINE_LINUX="kgdboc=ttyS0,115200 nokaslr"

然后再运行命令update-grub命令，然后关机：

vagrant@ubuntu-xenial:~$ sudo update-grub
vagrant@ubuntu-xenial:~$ sudo poweroff

这样就enable串口调试，现在我们要通过Vagrant让VirtualBox虚拟一个串口，Ubuntu Host的Vagrant的配置文件做如下修改：

 config.vm.provider "virtualbox" do |vb|
    vb.customize ["modifyvm", :id, "--cpus", "4"]
    vb.customize ["modifyvm", :id, "--uart1", "0x3f8", "4"]
    vb.customize ["modifyvm", :id, "--uartmode1", "tcpserver", "1234"]
  end

这样Ubuntu Guest内核会检测到一个串口设备，VirtualBox会把串口重定向到Host的tcp端口1234. 现在启动Ubuntu Guest, 并且在Guest Ubuntu中执行echo g > /proc/sysrq-trigger, 使Guest Kernel进入被调试状态，

root@ubuntu:~/vagrant# vagrant up
root@ubuntu:~/vagrant# vagrant ssh

# Guest Ubuntu shell
vagrant@ubuntu-xenial:~$ sudo sh -c 'echo g > /proc/sysrq-trigger'

执行完这个命令后，Ubuntu Guest就失去响应了，因为Guest Kernel停下来等待调试器连接了。如果是首次运行，需要建立一个$HOME/.gdbinit文件，现在启动gdb:

root@ubuntu:~/vagrant/obj/x86_64# echo 'add-auto-load-safe-path /' > $HOME/.gdbinit
root@ubuntu:~/vagrant/obj/x86_64# gdb vmlinux
GNU gdb (Ubuntu 8.1-0ubuntu3) 8.1.0.20180409-git
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
.
Find the GDB manual and other documentation resources online at:
.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from vmlinux...done.

然后用target remote localhost:1234命令连接到Guest kernel

(gdb) target remote localhost:1234
Remote debugging using localhost:1234
kgdb_breakpoint () at /root/vagrant/linux/kernel/debug/debug_core.c:1073
1073            wmb(); /* Sync point after breakpoint */

现在可以用p命令查看内核全局变量了，如果能通过p saved_command_line打印内核启动参数，就说明一切顺利了。

(gdb) p saved_command_line
$1 = 0xffff88003ffdb800 "BOOT_IMAGE=/boot/vmlinuz-4.16.0+ root=UUID=76868d63-8c37-4f81-8dba-eb365f150e41 ro kgdboc=ttyS0,115200 nokaslr console=tty1 console=ttyS0"
(gdb)

此时，Guest Kernel使被调试器接管了，如果要接续运行，则输入gdb命令c,

(gdb) c
Continuing.

需要注意的是，每次用gdb的target remote命令连接之前，必须在Guest Ubuntu中执行echo g > /proc/sysrq-trigger，是Guest Kernel进入被调试状态，否则gdb会报错，连接失败。错误代码为vMustReplyEmpty.

(gdb) target remote :1234
Remote debugging using :1234
Remote replied unexpectedly to 'vMustReplyEmpty': vMustReplyEmpty
(gdb)

通过info register命令就可以查看常规寄存器的值了:

(gdb) info registers
rax            0xffffffff810fe9f4       -2129663500
rbx            0xffffffff8206e0e0       -2113478432
rcx            0x0      0
rdx            0x0      0
rsi            0xffff88003fd966d8       -131940324120872
rdi            0x67     103
rbp            0x4      0x4 
rsp            0xffffc90000707dc0       0xffffc90000707dc0
r8             0x0      0
r9             0xffffffff813cbc50       -2126726064
r10            0x0      0
r11            0xffffffff825cd0ad       -2107846483
r12            0x67     103
r13            0x0      0
r14            0xffffc90000707ef8       -60473132155144
r15            0x0      0
rip            0xffffffff810fe9d4       0xffffffff810fe9d4 
eflags         0x202    [ IF ]
cs             0x10     16
ss             0x18     24
ds             0x0      0
es             0x0      0
fs             0x0      0
gs             0xb      11

但是并没有特权寄存器，比如中断描述符寄存器IDTR, 下一篇将介绍使用Virtualbox自带的调试器+kgdb双剑合璧，来学习内核。

参考：
https://dri.freedesktop.org/docs/drm/dev-tools/kgdb.html