GDB (GNU Debugger) for AArch64 and ARM...AArch64 GDB can debug ARM program x86_64 GDB can debug x86...
Transcript of GDB (GNU Debugger) for AArch64 and ARM...AArch64 GDB can debug ARM program x86_64 GDB can debug x86...
Presented by
Date
Event
GDB (GNU Debugger) for AArch64 and ARM
Progress 2015 & 2016 PlansYao Qi
BKK16-304 March 9, 2016
Linaro Connect BKK16
Overview
Antoine Tremblay
Reverse debuggingProcess record and replay● Record the registers and memories
changes by instruction● Decode each instruction!
○ x86, aarch64, arm, moxie, and ppc
GDB core
Target Vector Interface
wait/resume
read/writereg/mem
insert/removebreakpoint
...
Processrecord
replay
corefile
remote
child/native
linux
win32
record list of every instruction
process
core dump
GDBserver
Non-stop debugging● Non-stop vs All-stop
○ All-stop: one thread stops, all threads stop
○ Non-stop: one threads stops, the rest are running,
● Pros and cons○ Safe to step over
breakpoint○ Intrusive
insn 1
insn 2
insn 3
insn 1BREAK
insn 3
insn 1
insn 2
insn 3
insn 1BREAK
insn 3
PC
PC PC
Insert breakpoint Resume
Single step insn 2to step over breakpoint
Non-stop debugging (cont)● Displaced stepping vs in-
place stepping○ Execute instruction elsewhere
(on scratch pad),○ New instructions are
equivalent to the original one,○ aarch64, arm, x86, POWER
S390
insn 1
insn 2
insn 3
insn 1BREAK
insn 3
insn 1BREAK
insn 3
insn 1BREAK
insn 3
PC
PC
Insert breakpoint Resume
insn 2a
_start:
scratch padPC
insn 2bMultiple threads share single scratch pad
Non-stop debugging (cont)0x400a3c <+20>: e0 ff ff 18 ldr w0, 0x400a38
0x400668: 00 00 40 b9 ldr w0, [x0]
0x400854 <+28>: c0 ff ff b4 cbz x0, 0x40084c
0x400668: 40 00 00 b4 cbz x0, 0x4006700x40066c:0x400670:
0x400ab8 <+0>: ff ff ff 97 bl 0x400ab4
0x400668: 13 01 00 14 b 0x400ab4
0x4008e8 <+32>: c0 ff 1f 36 tbz w0, #3, 0x4008e00x4009f0 <+8>: 01 00 00 90 adrp x1, 0x4000000x40080c <+32>: c1 ff ff 54 b.ne 0x400804
The offset can be out of therange of imm19
GDB sets x0 to 0x400a38
How to tell the condition result?
GDB knows the condition resultby PC, and adjust PCaccordingly
Don't emit BL
GDB updates LR instead.
Tracepoint● Tracepont
○ Non-intrusive for live system,○ Live analysis or saved in files for
post analysis (TFILE and CTF)○ Added in GDB 7.2 by codesourcery
(sponsored by Ericsson)○ Only x86 and x86_64 is supported
● Three types of tracepoint○ Tracepoint,
■ (gdb) trace foo○ Fast tracepoint,
■ (gdb) ftrace foo○ Static tracepoint,
■ User-space LTTng,
create tracepoint
start tracing
collecting data
stop tracing analyze trace daata
download tracepoints
upload traceframes
Tracepoint (cont)● Tracepont
○ Done by breakpoint,○ Slow
● Fast tracepoint○ In process agent,○ Done by jump pad,
■ Dynamically generated,■ Save registers on stack■ spin lock■ Call C function■ Jump back
○ Doesn’t work in shared library
main exe
JUMPinsn 1
insn 3
Relocatedinsn 2
Shared lib
JUMP
out of range
jump pad
Multi-Arch Debugging● AArch64 GDB can debug ARM
program○ x86_64 GDB can debug x86
program,● Cooperate with kernel● Handle the differences of
thread area, siginfo_t, regster sets and HW breakpoint/watchpoint
GDB
AArch64 processARM
process
Multi-Arch
Plan● Compile and inject code
in GDB○ libcc1.so in GCC 5.0 and
higher,○ X86, POWER and S390 is
supported,● Improve GDB
performance in remote debugging,
● More tests to process record/reply for ARM and AArch64
● Kernel-awareness
End
Thank you