This page describes kernel debugging with UML running in tt mode (go here for the details on skas and tt mode). Kernel debugging in skas mode is described here .
Since the UML runs as a normal Linux process, it is possible to debug it with gdb almost like any other process. It is slightly different because the kernel's threads are already being ptraced for system call interception, so gdb can't ptrace them. However, a mechanism has been added to work around that problem.
In order to debug the kernel, you need build it from source. See Compiling the kernel and modules for information on doing that. Make sure that you enable CONFIG_DEBUGSYM and CONFIG_PT_PROXY during the config. These will compile the kernel with -g, and enable the ptrace proxy so that gdb works with UML, respectively.
You can have the kernel running under the control of gdb from the beginning by putting 'debug' on the command line. You will get an xterm with gdb running inside it. The kernel will send some commands to gdb which will leave it stopped at the beginning of start_kernel. At this point, you can get things going with 'next', 'step', or 'cont'.
There is a transcript of a debugging session here , with breakpoints being set in the scheduler and in an interrupt handler.
Not every bug is evident in the currently running process. Sometimes, processes hang in the kernel when they shouldn't because they've deadlocked on a semaphore or something similar. In this case, when you ^C gdb and get a backtrace, you will see the idle thread, which isn't very relevant.
What you want is the stack of whatever process is sleeping when it shouldn't be. You need to figure out which process that is, which is generally fairly easy. Then you need to get its host process id, which you can do either by looking at ps on the host or at task.thread.extern_pid in gdb.
Now what you do is this:
(UML gdb)  det
(UML gdb)  att <host pid>
(UML gdb)  bt
(UML gdb)  
att 1
(UML gdb)  
c
ddd works on UML, but requires a special kludge. The process goes like this:
host% ddd linux
0xa013dc51 in __kill ()
(gdb) 
gdb has support for debugging code which is dynamically loaded into the process. This support is what is needed to debug kernel modules under UML.
Using that support is somewhat complicated. You have to tell gdb what object file you just loaded into UML and where in memory it is. Then, it can read the symbol table, and figure out where all the symbols are from the load address that you provided. It gets more interesting when you load the module again (i.e. after an rmmod). You have to tell gdb to forget about all its symbols, including the main UML ones for some reason, then load then all back in again.
There's an easy way and a hard way to do this. The easy way is to use the umlgdb expect script written by Chandan Kudige. It basically automates the process for you.
First, you must tell it where your modules are. There is a list in the script that looks like this:
set MODULE_PATHS {
"fat" "/usr/src/uml/linux-2.4.18/fs/fat/fat.o"
"isofs" "/usr/src/uml/linux-2.4.18/fs/isofs/isofs.o"
"minix" "/usr/src/uml/linux-2.4.18/fs/minix/minix.o"
}
            ******** GDB pid is 21903 ********
Start UML as: ./linux <kernel switches> debug gdb-pid=21903
GNU gdb 5.0rh-5 Red Hat Linux 7.1
Copyright 2001 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux"...
(gdb) b sys_init_module
Breakpoint 1 at 0xa0011923: file module.c, line 349.
(gdb) att 1
Attaching to program: /home/jdike/linux/2.4/um/./linux, process 1
0xa00f4221 in __kill ()
(UML gdb)  c
Continuing.
 *** Module hostfs loaded *** 
Breakpoint 1, sys_init_module (name_user=0x805abb0 "hostfs", 
    mod_user=0x8070e00) at module.c:349
349             char *name, *n_name, *name_tmp = NULL;
(UML gdb)  finish
Run till exit from #0  sys_init_module (name_user=0x805abb0 "hostfs", 
    mod_user=0x8070e00) at module.c:349
0xa00e2e23 in execute_syscall (r=0xa8140284) at syscall_kern.c:411
411             else res = EXECUTE_SYSCALL(syscall, regs);
Value returned is $1 = 0
(UML gdb)  
p/x (int)module_list + module_list->size_of_struct
$2 = 0xa9021054
(UML gdb)  symbol-file ./linux
Load new symbol table from "./linux"? (y or n) y
Reading symbols from ./linux...
done.
(UML gdb)  
add-symbol-file /home/jdike/linux/2.4/um/arch/um/fs/hostfs/hostfs.o 0xa9021054
add symbol table from file "/home/jdike/linux/2.4/um/arch/um/fs/hostfs/hostfs.o" at
        .text_addr = 0xa9021054
 (y or n) y
Reading symbols from /home/jdike/linux/2.4/um/arch/um/fs/hostfs/hostfs.o...
done.
(UML gdb)  p *module_list
$1 = {size_of_struct = 84, next = 0xa0178720, name = 0xa9022de0 "hostfs", 
  size = 9016, uc = {usecount = {counter = 0}, pad = 0}, flags = 1, 
  nsyms = 57, ndeps = 0, syms = 0xa9023170, deps = 0x0, refs = 0x0, 
  init = 0xa90221f0 <init_hostfs>, cleanup = 0xa902222c <exit_hostfs>, 
  ex_table_start = 0x0, ex_table_end = 0x0, persist_start = 0x0, 
  persist_end = 0x0, can_unload = 0, runsize = 0, kallsyms_start = 0x0, 
  kallsyms_end = 0x0, 
  archdata_start = 0x1b855 <Address 0x1b855 out of bounds>, 
  archdata_end = 0xe5890000 <Address 0xe5890000 out of bounds>, 
  kernel_data = 0xf689c35d <Address 0xf689c35d out of bounds>}
>> Finished loading symbols for hostfs ...
Boot the kernel under the debugger and load the module with insmod or modprobe. With gdb, do:
(UML gdb)  p module_list
(UML gdb)  
printf "%#x\n", (int)module_list module_list->size_of_struct
(UML gdb)  
add-symbol-file /path/to/module/on/host that_address
If there's any doubt that you got the offset right, like breakpoints appear not to work, or they're appearing in the wrong place, you can check it by looking at the module structure. The init and cleanup fields should look like:
init = 0x588066b0 <init_hostfs>, cleanup = 0x588066c0 <exit_hostfs>
When you want to load in a new version of the module, you need to get gdb to forget about the old one. The only way I've found to do that is to tell gdb to forget about all symbols that it knows about:
(UML gdb)  symbol-file
(UML gdb)  symbol-file /path/to/kernel
If you don't have the kernel running under gdb, you can attach gdb to it later by sending the tracing thread a SIGUSR1. The first line of the console output identifies its pid:
tracing thread pid = 20093
host% kill -USR1 20093
If you have the mconsole compiled into UML, then the mconsole client can be used to start gdb:
(mconsole)  (mconsole) config gdb=xterm
UML has support for attaching to an already running debugger rather than starting gdb itself. This is present in CVS as of 17 Apr 2001. I sent it to Alan for inclusion in the ac tree, and it will be in my 2.4.4 release.
This is useful when gdb is a subprocess of some UI, such as emacs or ddd. It can also be used to run debuggers other than gdb on UML. Below is an example of using strace as an alternate debugger.
To do this, you need to get the pid of the debugger and pass it in with the 'gdb-pid=<pid>' switch along with the 'debug' switch.
If you are using gdb under some UI, then tell it to 'att 1', and you'll find yourself attached to UML.
If you are using something other than gdb as your debugger, then you'll need to get it to do the equivalent of 'att 1' if it doesn't do it automatically.
An example of an alternate debugger is strace. You can strace the actual kernel as follows:
host% 
sh -c 'echo pid=$$; echo -n hit return; read x; exec strace -p 1 -o strace.out'
host% strace ./linux