GDB Target Arch

使用 systemtap 可以方便的打印 backtrace, 例如这个脚本:

backtrace.sh:

#!/bin/bash
while getopts 'f:c:' opt; do
  case "$opt" in
    f)
      function="$OPTARG"
      ;;
    c)
      cmd="$OPTARG"
      ;;

    ?|h)
      echo "Usage: $(basename $0) [-f function] [-c cmd] "
      exit 1
      ;;
  esac
done

if [[ "${function}z" == "z" || "${cmd}z" == "z" ]]; then
      echo "Usage: $(basename $0) [-f function] [-c cmd] "
      exit 1
fi

sudo stap -e "probe process.function(\"$function\") {print_ubacktrace(); }" -c "$cmd"

ubuntu 自带的 systemtap 有问题, 可以从 https://sourceware.org/git/systemtap.git 下载后自己编译.

使用 systemtap 打印 backtrace 需要被调试的程序有符号信息. 另外 systemtap 的 process.function 可以使用 pattern, 例如 backtrace.sh -f "target_*" -c "xxx"

使用 remote target 执行 info reg 时的 backtrace

$> cat /tmp/test.cmd
target remote localhost:12345
info reg

$> backtrace.sh -f "fetch_registers"  -c "/usr/local/bin/gdb ./test.elf -x /tmp/test.cmd --batch"
 0x56025fbc8970 : _ZN13remote_target15fetch_registersEP8regcachei+0x0/0x210 [/usr/local/bin/gdb]
 0x56025fc3a381 : _Z22target_fetch_registersP8regcachei+0x31/0x70 [/usr/local/bin/gdb]
 0x56025fba836a : _ZN8regcache10raw_updateEi+0x3a/0x50 [/usr/local/bin/gdb]
 0x56025fba840e : _ZN17readable_regcache8raw_readEiPh+0x1e/0xb0 [/usr/local/bin/gdb]
 0x56025fba873d : _ZN17readable_regcache17cooked_read_valueEi+0x9d/0x150 [/usr/local/bin/gdb]
 0x56025fbd9b66 : _ZL28sentinel_frame_prev_registerP10frame_infoPPvi+0x16/0x40 [/usr/local/bin/gdb]
 0x56025fa858e7 : _Z27frame_unwind_register_valueP10frame_infoi+0x47/0x2d0 [/usr/local/bin/gdb]
 0x56025fc8d8e4 : _Z16value_fetch_lazyP5value+0x1c4/0x6d0 [/usr/local/bin/gdb]
 0x56025fa813c6 : _Z17value_of_registeriP10frame_info+0x66/0x80 [/usr/local/bin/gdb]
 0x56025fac6578 : _Z28default_print_registers_infoP7gdbarchP7ui_fileP10frame_infoii+0x78/0xe0 [/usr/local/bin/gdb]
 0x56025f9c81aa : _Z8cmd_funcP16cmd_list_elementPKci+0x3a/0x70 [/usr/local/bin/gdb]
 0x56025fc45828 : _Z15execute_commandPKci+0x7f8/0xa20 [/usr/local/bin/gdb]
 0x56025fa73175 : _Z15command_handlerPKc+0x85/0xd0 [/usr/local/bin/gdb]
 0x56025fc4684f : _Z17read_command_fileP8_IO_FILE+0x3f/0x60 [/usr/local/bin/gdb]
 0x56025f9d0c19 : _Z16script_from_fileP8_IO_FILEPKc+0x119/0x1d0 [/usr/local/bin/gdb]
 0x56025f9c3bbb : _ZL25source_script_with_searchPKcii+0xfb/0x1f0 [/usr/local/bin/gdb]
 0x56025fb16ee0 : _ZL20catch_command_errorsPFvPKciES0_i+0x20/0x50 [/usr/local/bin/gdb]
 0x56025fb185c9 : _ZL15captured_main_1P18captured_main_args+0xd59/0x1640 [/usr/local/bin/gdb]
 0x56025fb18ebf : _Z8gdb_mainP18captured_main_args+0xf/0x40 [/usr/local/bin/gdb]
 0x56025f933a30 : main+0x40/0x60 [/usr/local/bin/gdb]

c++filt 处理后为:

remote_target::fetch_registers(regcache*, int)
target_fetch_registers(regcache*, int)
regcache::raw_update(int)
readable_regcache::raw_read(int, unsigned char*)
readable_regcache::cooked_read_value(int)
sentinel_frame_prev_register(frame_info*, void**, int)
frame_unwind_register_value(frame_info*, int)
value_fetch_lazy(value*)
value_of_register(int, frame_info*)
default_print_registers_info(gdbarch*, ui_file*, frame_info*, int, int)
cmd_func(cmd_list_element*, char const*, int)
execute_command(char const*, int)
command_handler(char const*)
read_command_file(_IO_FILE*)
script_from_file(_IO_FILE*, char const*)
source_script_with_search(char const*, int, int)
catch_command_errors(void (*)(char const*, int), char const*, int)
captured_main_1(captured_main_args*)
gdb_main(captured_main_args*)

1. cmd 相关的代码在 infcmd.c, 它调用了 gdbarch_print_registers_info
2. i386 的 gdbarch 使用默认的 default_print_registers_info
3. default_print_registers_info 使用了 regcache, 然后调用到 remote_target::fetch_registers
4. remote_target 发送 g RSP packet
5. fetch_registers 会根据 gdbarch 里关于 register 的信息 (num_regs, register_size 等) 使用 RSP packet 的数据来填充 regcache

$> cat test.cmd
b main
r

$> backtrace.sh -f "xfer_partial"  -c "/usr/local/bin/gdb ./test.elf -x ./test.cmd --batch"
 0x55adc0ca7a20 : _ZN16linux_nat_target12xfer_partialE13target_objectPKcPhPKhmmPm+0x0/0x550 [/usr/local/bin/gdb]
 0x55adc0dd92c9 : _Z23raw_memory_xfer_partialP10target_opsPhPKhmlPm+0x79/0x120 [/usr/local/bin/gdb]
 0x55adc0dd99ba : _Z19target_xfer_partialP10target_ops13target_objectPKcPhPKhmmPm+0x3da/0x4c0 [/usr/local/bin/gdb]
 0x55adc0dda231 : _Z26target_write_with_progressP10target_ops13target_objectPKcPKhmlPFvmPvES6_+0xf1/0x140 [/usr/local/bin/gdb]
 0x55adc0dda32e : _Z23target_write_raw_memorymPKhl+0x3e/0x50 [/usr/local/bin/gdb]
 0x55adc0cd2aa0 : _Z32default_memory_insert_breakpointP7gdbarchP14bp_target_info+0xc0/0xf0 [/usr/local/bin/gdb]
 0x55adc0b337d2 : _ZL20bkpt_insert_locationP11bp_location+0x62/0xa0 [/usr/local/bin/gdb]
 0x55adc0b42656 : _ZL18insert_bp_locationP11bp_locationP7ui_filePiS3_S3_+0xc6/0x1480 [/usr/local/bin/gdb]
 0x55adc0b469e5 : _ZL27update_global_location_list16ugll_insert_mode+0x8c5/0x1070 [/usr/local/bin/gdb]
 0x55adc0b47889 : _ZL35update_global_location_list_nothrow16ugll_insert_mode+0x9/0x20 [/usr/local/bin/gdb]
 ...

linux_nat_target::xfer_partial
raw_memory_xfer_partial
target_xfer_partial
target_write_with_progress
target_write_raw_memory
default_memory_insert_breakpoint
bkpt_insert_location
insert_bp_location
update_global_location_list
update_global_location_list_nothrow
...

breakpoint 每次在执行时 (run, cont, step, …) 会重新插入一次, 因为每次执行完都会被删除 (参考 GDB Remote Serial Protocal::Example::break)

可以看到 native debug 时 breakpoint 是通过写内存实现 (xfer_partial) 的 (参考 breakpoint)

gdb 运行在 host arch, 被调试程序运行在 target arch, 大多数情况下 host arch 与 target arch 相同, 称为 native debug

有时 host arch 与 target arch 会不同, 例如 x86 上的 gdb 可以查看 riscv 的 elf 或 coredump 的内容, 或者 x86 上的 gdb 通过 gdbserver 可以调试 riscv 的进程

以 amd64_linux_nat_target 为例, 说明 target 与 gdbarch 的初始化过程.

porting 一个新的 arch 大约需要:

1. binutils

   gdb 的 disass 依赖 opcodes. core, exec 数据的读取依赖 bfd

2. os

   native debug 依赖 ptrace 这类系统调用

3. xxx-tdep

   需要定义 gdbarch, 实现其中定义的回调函数.

   例如 riscv-tdep.c, riscv-linux-tdep.c

4. xxx-nat

   需要实现 target_ops

   例如 riscv-linux-nat.c

5. 配置 configure

   修改 configure (configure.nat, configure.tgt), 以完成初始化