How To Use The KGDB
How To Use The KGDB
KGDB is a source level debugger for the kernel from host machine to the target board. It allows kernel
developers to use arch specific gdb to debug the kernel in a similar way to debugging application
programs. KGDB patch already included in the kernel tree.
KGDB debugging is quite similar to user-space debugging, but it is more complex when it comes to
SMP arch. Kernel bugs are pretty difficult to understand until and unless you understand the call trace
that is generated.
Internal debug information of the ARCH is need in order to debug kernel programming.
Physical connection
KDGB debug can be done using serial port (COM1), USB or Ethernet.
Well support for serial interface depends on the serial driver supporting CONFIG_CONSOLE_POLL
features.
Serial interface
The UART port of the 30-pin header on ODROID-XU4 is accessible via /dev/ttySAC0/
The UART port can be connected to your host PC via USB-UART Kit
We connected four wires on a 30-pin header socket and added the hot-melt-glue on that.
In order to configure KGDB you need to setup development machine to compile the kernel. First step
is to setup the toolchain.
Note: You need to use toolchain specific gdb to communicate with the target board. i.e arm-linux-
gnueabihf-gdb. It is better to use the same toolchain debugger to debug in order to interpret the
assembly code correctly.
Toolchain (4.9.2 Click one of the sites below to download toolchain to build Linux kernel).
Download #1
Download #2
host
In order to add the toolchain path to PATH, paste below lines to $HOME/.bashrc.
export ARCH=arm
export CROSS_COMPILE=arm-linux-gnueabihf-
export PATH=/opt/toolchains/gcc-linaro-arm-linux-
gnueabihf-4.9-2014.09_linux/bin/:$PATH
You can check if the toolchain installed above works properly while checking the version of toolchain.
If you can find gcc version 4.9.2 20140904 (prerelease) at the end of the line, the toolchain is
installed properly.
host
$ arm-linux-gnueabihf-gcc -v
Using built-in specs.
COLLECT_GCC=/opt/toolchains/gcc-linaro-arm-linux-
gnueabihf-4.9-2014.09_linux/bin/arm-linux-gnueabihf-gcc
COLLECT_LTO_WRAPPER=/opt/toolchains/gcc-linaro-arm-linux-
gnueabihf-4.9-2014.09_linux/bin/../libexec/gcc/arm-linux-
gnueabihf/4.9.2/lto-wrapper
Target: arm-linux-gnueabihf
Configured with: /cbuild/slaves/oorts/crosstool-ng/builds/arm-linux-
gnueabihf-linux/.build/src/gcc-linaro-4.9-2014.09/configure --
build=i686-build_pc-linux-gnu --host=i686-build_pc-linux-gnu --
target=arm-linux-gnueabihf --prefix=/cbuild/slaves/oorts/crosstool-
ng/builds/arm-linux-gnueabihf-linux/install --with-
sysroot=/cbuild/slaves/oorts/crosstool-ng/builds/arm-linux-gnueabihf-
linux/install/arm-linux-gnueabihf/libc --enable-languages=c,c++,fortran
--disable-multilib --enable-multiarch --with-arch=armv7-a --with-
tune=cortex-a9 --with-fpu=vfpv3-d16 --with-float=hard --with-
pkgversion='crosstool-NG linaro-1.13.1-4.9-2014.09 - Linaro GCC
4.9-2014.09' --with-bugurl=https://bugs.launchpad.net/gcc-linaro --
enable-__cxa_atexit --enable-libmudflap --enable-libgomp --enable-
libssp --with-gmp=/cbuild/slaves/oorts/crosstool-ng/builds/arm-linux-
gnueabihf-linux/.build/arm-linux-gnueabihf/build/static --with-
mpfr=/cbuild/slaves/oorts/crosstool-ng/builds/arm-linux-gnueabihf-
linux/.build/arm-linux-gnueabihf/build/static --with-
mpc=/cbuild/slaves/oorts/crosstool-ng/builds/arm-linux-gnueabihf-
linux/.build/arm-linux-gnueabihf/build/static --with-
isl=/cbuild/slaves/oorts/crosstool-ng/builds/arm-linux-gnueabihf-
linux/.build/arm-linux-gnueabihf/build/static --with-
cloog=/cbuild/slaves/oorts/crosstool-ng/builds/arm-linux-gnueabihf-
linux/.build/arm-linux-gnueabihf/build/static --with-
libelf=/cbuild/slaves/oorts/crosstool-ng/builds/arm-linux-gnueabihf-
linux/.build/arm-linux-gnueabihf/build/static --enable-threads=posix --
disable-libstdcxx-pch --enable-linker-build-id --enable-plugin --
enable-gold --with-local-prefix=/cbuild/slaves/oorts/crosstool-
ng/builds/arm-linux-gnueabihf-linux/install/arm-linux-gnueabihf/libc --
enable-c99 --enable-long-long --with-mode=thumb --disable-multilib --
with-float=hard
Thread model: posix
gcc version 4.9.2 20140904 (prerelease) (crosstool-NG
linaro-1.13.1-4.9-2014.09 - Linaro GCC 4.9-2014.09)
$ arm-linux-gnueabihf-gdb -v
GNU gdb (crosstool-NG linaro-1.13.1-4.9-2014.09 - Linaro GCC
4.9-2014.09) 7.6.1-2013.10
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show
copying"
and "show warranty" for details.
This GDB was configured as "--host=i686-build_pc-linux-gnu --
target=arm-linux-gnueabihf".
For bug reporting instructions, please see:
<https://bugs.launchpad.net/gcc-linaro>.
Once all the config flags are enabled, cross compile the kernel and put the image on the kernel.
Using UART connection from the target board to the host Linux machine (x86/x64) we need to setup
'minicom' or 'picocom'
Note : You need to identify the port connection from the dmesg.
host
Once you verify the connection is correct and you are able to see the boot messages. You can setup
KGDB connection with the target board.
On the target board, we need to initialize KGDB by setting up the kernel command line with
kgdbwait kgdboc=ttySAC2,115200
You need to update the kernel command line for the bootloader u-boot in the boot.ini
Note: It's not mandatory to set the KGDB option in the kernel command line.
kgdbwait makes kgdb wait for a debugger connection during booting of a kernel. You can only use
this option you compiled a kgdb I/O driver into the kernel and you specified the I/O driver
configuration as a kernel command line option. The kernel will stop and wait as early as the I/O driver
and architecture allows when you use this option.
kgdboc kgdboc driver was originally an abbreviation meant to stand for “kgdb over console”. Kgdboc
is designed to work with a single serial port. It was meant to cover the circumstance where you want
to use a serial console as your primary console as well as using it to perform kernel debugging.
kgdboc=<tty-device>,[baud]
Target is loaded with new kernel and KGDB is enabled in command prompt.
Note: Binding the kdb/kgdb feature to a serial port, by writing a value into the sys filesystem. This
step is run time.
Target Board
target
Host side
host
$arm-none-linux-gnueabi-gdb vmlinux
gdb > set remotebaud 115200
gdb > set debug remote 1
gdb > target remote /dev/ttyUSB0
Target Board Once you power on the target board, after initial boot of the CPU, it will break the
execution of booting.
is a S3C6400/10
[ 2.578493] [c7] console [ttySAC2] enabled
[ 2.583257] [c7] 12c30000.serial: ttySAC3 at MMIO 0x12c30000 (irq = 86)
is a S3C6400/10
[ 2.592651] [c7] kgdb: Registered I/O driver kgdboc.
[ 2.596170] [c7] kgdb: Waiting for connection from remote gdb...
You can give command for help or console for verification. If you want to break and boot the board
you need to specify the 'go'.
In order to connect to gdb via kgdboc, the kernel must first be stopped. There are several ways to
stop the kernel which include using kgdbwait as a boot argument, via a sysrq-g, or running the kernel
until it takes an exception where it waits for the debugger to attach.
target
[2]kdb>
[2]kdb> help
Command Usage Description
----------------------------------------------------------
md <vaddr> Display Memory Contents, also
mdWcN, e.g. md8c1
mdr <vaddr> <bytes> Display Raw Memory
mdp <paddr> <bytes> Display Physical Memory
mds <vaddr> Display Memory Symbolically
mm <vaddr> <contents> Modify Memory Contents
go [<vaddr>] Continue Execution
rd Display Registers
rm <reg> <contents> Modify Registers
ef <vaddr> Display exception frame
bt [<vaddr>] Stack traceback
btp <pid> Display stack for process <pid>
bta [D|R|S|T|C|Z|E|U|I|M|A]
Backtrace all processes matching
state flag
btc Backtrace current process on each
cpu
btt <vaddr> Backtrace process given its struct
task address
env Show environment variables
set Set environment variables
help Display Help Message
? Display Help Message
cpu <cpunum> Switch to new cpu
Host Machine
Kernel source code is present on the host machine and we can analyze the execution of the target
board using gdb. All the debug symbols are present into the binary vmlinux and kernel modules.
Taking the reference of the source code, we need to load the symbols of the module to watch.
Note: Kernel has lots of functionality any is call asynchronously. So putting an breakpoints is a bit
tedious to debug the bug.
host
$ arm-linux-gnueabihf-gdb ./vmlinux
GNU gdb (Linaro GDB 2014.11) 7.8-2014.09-1-git
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show
copying"
and "show warranty" for details.
This GDB was configured as "--host=x86_64-unknown-linux-gnu --
target=arm-linux-g
nueabihf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://bugs.launchpad.net/gcc-linaro>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./vmlinux...done.
(gdb) target remote /dev/ttyUSB0
Remote debugging using /dev/ttyUSB0
queue_stop_cpus_work (cpumask=0x0 <__vectors_start>, fn=0x1
<__vectors_start>,
arg=0xc0d6aba4 <futex_queues+8584>, done=0xc0d6aba0
<futex_queues+8580>)
at kernel/stop_machine.c:145
145 {
(gdb)
(gdb)
(gdb) list
https://wiki.odroid.com/ Printed on 2023/11/21 17:08
2023/11/21 17:08 9/19 How to use the KGDB
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/init.h>
module_init(my_oops_init);
module_exit(my_oops_exit);
Note: As this is static code once loaded in memory it break into kgbd session
target
LR: 0xc002ddf4:
ddf4 e58d200c e51b2418 e58d2008 e1a0200c e1a0100a e51b0410 e58d3014
e1cd80f0
de14 ebfff987 ebfffd7c e51b341c e3500000 e0855003 0a000050 e30e213c
e3570000
de34 e34c2064 e287301f e5922000 a1a03007 e1a032c3 e207701f e7923103
e1a07733
de54 e3170001 0a000095 e3e03000 e59f049c e5843104 eb185acc ebfffe85
eb017ef7
de74 e51b3414 e3130080 051b3414 e121f003 e1a00005 e24bd028 e89daff0
e5d6292c
de94 e30b3f50 e34c309a e3520001 1affffc1 e5d3392d e3530000 0affffbe
e3530030
deb4 3affffbc e3530037 9a0000ef e3530064 1affffb8 e59f943c e3e02001
e3530030
ded4 3a000004 e3530037 9a0000f0 e3530064 1a000000 e38cc004 e0855002
eaffffae
more>
SP: 0xdad31db0:
1db0 60080093 c0951110 60080013 c0294b88 ffffffff bf11501c 40080013
ffffffff
1dd0 dad31e1c dca463c0 dad31e3c dad31de8 c000e318 c00083ac 00000000
00000000
1df0 de242b00 60080013 c09aaec0 bf115000 bf113068 00000001 dca463c0
dca463f0
1e10 00000000 dad31e3c dad319b8 dad31e30 c002de74 bf11501c 40080013
ffffffff
1e30 dad31e84 dad31e40 c0008728 bf11500c c0058d64 c0057604 dad30000
c0132c3c
1e50 dad31f48 bf113074 bf113068 dad31f48 bf113074 bf113068 00000001
dca463c0
1e70 dca463f0 00000001 dad31f44 dad31e88 c009c1d0 c0008620 bf113074
00007fff
1e90 c0097b90 dad31f4c dad31ec4 dad31ea8 c0053270 dad31edc 00000000
bf113074
more>
IP: 0xdad31938:
1938 0000005a c0877214 c081f508 bf000000 dad319d4 dad31958 c000fc6c
c000f440
1958 00000000 c08023f4 c081f508 00000000 61542020 3a656c62 36633520
36303466
1978 44202061 203a4341 30303030 35313030 c0db1300 0000049a de242b00
c0940540
1998 dad319c4 dad319a8 c063e0f0 c00ae464 dad319fc dad31de8 c094c340
0000000f
19b8 c0db13f8 0000049a de242b00 c0940540 dad319ec dad319d8 c000fd0c
c000f780
19d8 c0db11e8 c094c340 dad31a0c dad319f0 c00afdcc c000fcec 00000005
00000003
19f8 dad30000 c0db13f8 dad31a54 dad31a10 c00b33a0 c00afd98 dad31a2c
00000001
1a18 c001435c c02afc84 dad31a74 c00b60f8 00000060 c0db0ac4 dad31b14
00000000
more>
FP: 0xdad31dbc:
1dbc c0294b88 ffffffff bf11501c 40080013 ffffffff dad31e1c dca463c0
dad31e3c
1ddc dad31de8 c000e318 c00083ac 00000000 00000000 de242b00 60080013
c09aaec0
1dfc bf115000 bf113068 00000001 dca463c0 dca463f0 00000000 dad31e3c
dad319b8
1e1c dad31e30 c002de74 bf11501c 40080013 ffffffff dad31e84 dad31e40
c0008728
1e3c bf11500c c0058d64 c0057604 dad30000 c0132c3c dad31f48 bf113074
bf113068
1e5c dad31f48 bf113074 bf113068 00000001 dca463c0 dca463f0 00000001
dad31f44
1e7c dad31e88 c009c1d0 c0008620 bf113074 00007fff c0097b90 dad31f4c
dad31ec4
1e9c dad31ea8 c0053270 dad31edc 00000000 bf113074 bf1131b0 bf1131c4
dad30008
more>
R2: 0xde242a80:
2a80 00000000 dea21150 00000000 00000020 00000000 0000c350 0000c350
ffffffff
c0886c5c
6420 dca46420 dca46420 00000000 dac30400 0000002c 00000000 00000000
00000000
R9: 0xdca46370:
6370 00000000 00000000 00000000 00000000 00000000 bf113000 00002000
00000002
6390 dca46940 00000001 00000000 c009a838 00000000 00000000 00000000
00000000
63b0 00000000 00000000 00000000 00000000 dca46bc0 00000001 dca46980
00000124
63d0 c0dab510 00000000 00000000 00000024 bf113044 c0099200 00000000
00000000
63f0 00000000 00000000 00000000 00000000 00000100 dc5ef000 dca46da0
dca46d80
6410 c0e4758c 00000000 00000000 c0886c5c dca46420 dca46420 00000000
dac30400
6430 0000002c 00000000 00000000 00000000 dca46580 b0d6a915 dca46889
00000000
6450 00000000 00000000 0000171d 65640112 79732d62 6d657473 6e692d64
656b6f76
dCPU: 4 PID: 1178 Comm: insmod Tainted: P O 3.10.82-xu4hk #3
Backtrace:
[<c0012dec>] (dump_backtrace+0x0/0x114) from [<c001305c>]
(show_stack+0x20/0x24)
r7:c0db13f8 r6:0000000f r5:c094c340 r4:dad31de8
[<c001303c>] (show_stack+0x0/0x24) from [<c063ef68>]
(dump_stack+0x24/0x28)
[<c063ef44>] (dump_stack+0x0/0x28) from [<c000fd10>]
(show_regs+0x30/0x34)
[<c000fce0>] (show_regs+0x0/0x34) from [<c00afdcc>]
(kdb_dumpregs+0x40/0x60)
r5:c094c340 r4:c0db11e8
[<c00afd8c>] (kdb_dumpregs+0x0/0x60) from [<c00b33a0>]
(kdb_main_loop+0x3bc/0x7b
4)
r7:c0db13f8 r6:dad30000 r5:00000003 r4:00000005
[<c00b2fe4>] (kdb_main_loop+0x0/0x7b4) from [<c00b61d8>]
(kdb_stub+0x26c/0x4d0)
[<c00b5f6c>] (kdb_stub+0x0/0x4d0) from [<c00ac004>]
(kgdb_cpu_enter+0x434/0x728)
[<c00abbd0>] (kgdb_cpu_enter+0x0/0x728) from [<c00ac5fc>]
(kgdb_handle_exception
+0x1ac/0x20c)
[<c00ac450>] (kgdb_handle_exception+0x0/0x20c) from [<c0015590>]
(kgdb_notify+0x
34/0x4c)
r9:00000000 r8:00000000 r7:fffffffd r6:00000001 r5:dad31bec
r4:20080193
[<c001555c>] (kgdb_notify+0x0/0x4c) from [<c0058908>]
(notifier_call_chain+0x54/
0x94)
r5:dad31bec r4:c094e774
[<c00588b4>] (notifier_call_chain+0x0/0x94) from [<c0058c18>]
(__atomic_notifier
_call_chain+0x74/0xa0)
r9:00000000 r8:dad31bec r7:00000001 r6:c094e9cc r5:00000001
r4:c094e774
[<c0058ba4>] (__atomic_notifier_call_chain+0x0/0xa0) from [<c0059304>]
(notify_d
ie+0x4c/0x54)
more>
Only 'q' or 'Q' are processed at more prompt, input ignored
[<c00592b8>] (notify_die+0x0/0x54) from [<c001316c>] (die+0x10c/0x2ec)
r4:c09460b8
[<c0013060>] (die+0x0/0x2ec) from [<c063dd1c>]
(__do_kernel_fault.part.10+0x74/0
x84)
[<c063dca8>] (__do_kernel_fault.part.10+0x0/0x84) from [<c001d040>]
(do_page_fau
lt+0x3f4/0x400)
r7:de242b00 r4:dad30030
[<c001cc4c>] (do_page_fault+0x0/0x400) from [<c001d1c4>]
(do_translation_fault+0
xbc/0xc0)
[<c001d108>] (do_translation_fault+0x0/0xc0) from [<c00083e8>]
(do_DataAbort+0x4
8/0xac)
r7:00000000 r6:c001d108 r5:00000805 r4:c0946d3c
[<c00083a0>] (do_DataAbort+0x0/0xac) from [<c000e318>]
(__dabt_svc+0x38/0x60)
Exception stack(0xdad31de8 to 0xdad31e30)
1de0: 00000000 00000000 de242b00 60080013 c09aaec0
bf115000
1e00: bf113068 00000001 dca463c0 dca463f0 00000000 dad31e3c dad319b8
dad31e30
1e20: c002de74 bf11501c 40080013 ffffffff
r8:dca463c0 r7:dad31e1c r6:ffffffff r5:40080013 r4:bf11501c
[<bf115000>] (my_oops_init+0x0/0x24 [code]) from [<c0008728>]
(do_one_initcall+0
x114/0x174)
[<c0008614>] (do_one_initcall+0x0/0x174) from [<c009c1d0>]
(load_module+0x190c/0
x209c)
more>
Only 'q' or 'Q' are processed at more prompt, input ignored
[<c009a8c4>] (load_module+0x0/0x209c) from [<c009cad4>]
(SyS_finit_module+0x78/0
x88)
[<c009ca5c>] (SyS_finit_module+0x0/0x88) from [<c000e7c0>]
(ret_fast_syscall+0x0
/0x38)
r6:b6f76f10 r5:b6f8aad4 r4:4479ed00
[4]kdb>
[4]kdb>
[4]kdb>
[4]kdb>
Host side :
Initiate the ARM kgdb connection from the target machine to communicate with code.
host
# arm-linux-gnueabihf-gdb debug/code.ko
GNU gdb (Linaro GDB 2014.11) 7.8-2014.09-1-git
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show
copying"
and "show warranty" for details.
This GDB was configured as "--host=x86_64-unknown-linux-gnu --
target=arm-linux-g
nueabihf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://bugs.launchpad.net/gcc-linaro>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from debug/code.ko...done.
(gdb)
(gdb) set debug remote 1
(gdb) target remote /dev/ttyUSB1
Remote debugging using /dev/ttyUSB1
Sending packet: $qSupported:multiprocess+;qRelocInsn+#2a...Ack
Saw new packet start in middle of old one
Packet received:
Packet qSupported (supported-packets) is NOT supported
Sending packet: $Hg0#df...Ack
Packet received: OK
Sending packet: $qTStatus#49...Ack
Packet received:
Packet qTStatus (trace-status) is NOT supported
From:
https://wiki.odroid.com/ - ODROID Wiki
Permanent link:
https://wiki.odroid.com/odroid-xu4/application_note/software/linux_kernel_debugging