QEMU 调试 内核模块(without kgdb)

1. 以 debug模式 启动 QEMU:

 sudo ./qemu-2.0.0/arm-softmmu/qemu-system-arm -S -s  -M vexpress-a9 -m 1024 -kernel ./linux-3.10.28/arch/arm/boot/zImage 
-sd rootfs.img  --append "root=/dev/mmcblk0 rw rootfs=ext3 rootdelay=3  physmap.enabled=0 console=ttyAMA0 console=tty0 
slub_debug=PZ"  -net nic,vlan=0 -net tap,vlan=0  -smp 4,sockets=1 -nographic

2. 启动 gdb, 

$ arm-linux-gdb vmlinux
GNU gdb (GDB) 7.7
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-linux".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from vmlinux...done.
(gdb) target remote localhost:1234
Remote debugging using localhost:1234
0x60000000 in ?? ()
(gdb) break start_kernel
Breakpoint 1 at 0xc04c1770: file init/main.c, line 473.
(gdb) b  kernel/module.c:3061
Breakpoint 2 at 0xc006ccc4: file kernel/module.c, line 3061.
(gdb) c
Continuing.

之后目标机进入系统,执行 insmod kthread.ko, 会停在断点处:

Breakpoint 2, do_init_module (mod=0xbf00f1e0) at kernel/module.c:3061
3061		if (mod->init != NULL)

查看 内核模块的地址信息:

(gdb) source  print-mod-sections 
Name:.text Address:0xbf00f000
Name:.rodata Address:0xbf00f164
Name:.ARM.exidx Address:0xbf00f1a4
Name:.gnu.linkonce.this_module Address:0xbf00f1e0
Name:.note.gnu.build-id Address:0xbf00f1bc
Name:.bss Address:0xbf00f330
Name:.symtab Address:0xbf011000
Name:.strtab Address:0xbf011340

(gdb) add-symbol-file /home/charles/code/modules/kthread.ko 0xbf00f000 -s .bss 0xbf00f330 -s .rodata 0xbf00f164 -s 0xbf011000
add symbol table from file "/home/charles/code/modules/kthread.ko" at
	.text_addr = 0xbf00f000
	.bss_addr = 0xbf00f330
	.rodata_addr = 0xbf00f164
(y or n) y
Reading symbols from /home/charles/code/modules/kthread.ko...done.
(gdb) b thread_fn
Breakpoint 3 at 0xbf00f00c: file /home/charles/code/modules/kthread.c, line 14.

继续执行:

(gdb) c
Continuing.
[New Thread 2]
[Switching to Thread 2]

Breakpoint 3, thread_fn (data=0x0 <__vectors_start>) at /home/charles/code/modules/kthread.c:14
14	int delay = 60*HZ;
(gdb) where
#0  thread_fn (data=0x0 <__vectors_start>) at /home/charles/code/modules/kthread.c:14
#1  0xc003e03c in kthread (_create=0xee9abe10) at kernel/kthread.c:200
#2  0xc000e158 in ret_from_fork () at arch/arm/kernel/entry-common.S:91
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb)