7

I have compiled my freebsd libc source with -g option, so that now I can step in into libc functions.

But I am having trouble stepping into system calls code. I have compiled the freebsd kernel source code with -g. On setting the breakpoint, gdb informs about breakpoint on .S files. On hitting the breakpoint, gdb is unable to step into the syscall source code.

Also, I have tried: gdb$catch syscall open

but this is also not working.

Can you please suggest something?

Thanks.

3
  • 1
    Debugging on Linux is implemented via the ptrace(2) system call; ptrace can only inspect and stop processes running in userspace. I would expect that FreeBSD's process debugging mechanism is similar, and only designed to work on userspace processes: because the OS kernel will acquire and release locks as well as respond to interrupts quickly, designing the kernel to allow full-featured debugging from userspace seems very unlikely.
    – sarnold
    May 14, 2011 at 1:27
  • 1
    Hi Sarnold, Thanks for your comment. If user-space debugging is not possible then can kdb/kgdb serve the purpose? May 14, 2011 at 1:30
  • it's been years since I've looked into kdb/kgdb, probably things have drastically changed. :) But perhaps this message about stack dumps will be a good starting point?
    – sarnold
    May 14, 2011 at 1:36

2 Answers 2

9

You appear to have fundamental lack of understanding of how UNIX systems work.

Think about it. Suppose you were able to step into the kernel function that implements a system call, say sys_open. So now you are looking at the kernel source for sys_open in the debugger. The question is: is the kernel running at that point, or is it stopped. Since you will want to do something like next in the debugger, let's assume the kernel is stopped.

So now you press the n key, and what happens?

Normally, the kernel will react to an interrupt raised by the keyboard, figure out which key was pressed, and send that key to the right process (the one that is blocked in read(2) from the terminal that has control of the keyboard).

But your kernel is stopped, so no key press for you.

Conclusion: debugging the kernel via debugger that is running on that same machine is impossible.

In fact, when people debug the kernel, they usually do it by running debugger on another machine (this is called remote debugging).

If you really want to step into kernel, the easiest way to do that is with UML.

After you've played with UML and understand how the userspace/kernel interface works and interacts, you can try kgdb, though the setup is usually a bit more complicated. You don't actually have to have a separate machine for this, you could use VMWare or VirtualPC, or VirtualBox.

2
  • 1
    Your "debugging the kernel via debugger that is running on that same machine is impossible" conclusion is AFAIK applying only to kgdb on Linux. UML is also a Linux specific solution. There is a port of kgdb to FreeBSD but FreeBSD kernel can be debugged locally with ddb, just like Solaris can be with kmdb.
    – jlliagre
    May 14, 2011 at 12:59
  • 2
    You explanation about the reason why a kernel debugger can't work is flawed. A kernel is not a single threaded program, and not even a multi-threaded one either. A kernel is code executed in a privileged context. Many kernel threads can run this code concurrently so a breakpoint affecting an instruction executed by one of them has no compelling reason to suddenly "stop the kernel", i.e. stop every other kernel thread.
    – jlliagre
    Oct 8, 2017 at 9:39
3

As Employed Russian already stated, gdb being in userland cannot inspect anything running in the kernel.

However, nothing prevents to implement a debugger in the kernel itself. In such case, it is possible to set breakpoints and run kernel code step by step from a local debugging session (console). With FreeBSD, such a debugger is available as ddb.

Some limitations would be the lack of connection between your gdb and ddb sessions and I'm unsure source level debugging (-g) is available for kernel code under FreeBSD/ddb.

An alternate and much less intrusive way to 'debug' the kernel from userland would be to use dtrace.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.