1*324b2298SPaolo Bonzini.. _gdb_005fusage: 2*324b2298SPaolo Bonzini 3*324b2298SPaolo BonziniGDB usage 4*324b2298SPaolo Bonzini--------- 5*324b2298SPaolo Bonzini 6*324b2298SPaolo BonziniQEMU has a primitive support to work with gdb, so that you can do 7*324b2298SPaolo Bonzini'Ctrl-C' while the virtual machine is running and inspect its state. 8*324b2298SPaolo Bonzini 9*324b2298SPaolo BonziniIn order to use gdb, launch QEMU with the '-s' option. It will wait for 10*324b2298SPaolo Bonzinia gdb connection: 11*324b2298SPaolo Bonzini 12*324b2298SPaolo Bonzini.. parsed-literal:: 13*324b2298SPaolo Bonzini 14*324b2298SPaolo Bonzini |qemu_system| -s -kernel bzImage -hda rootdisk.img -append "root=/dev/hda" 15*324b2298SPaolo Bonzini Connected to host network interface: tun0 16*324b2298SPaolo Bonzini Waiting gdb connection on port 1234 17*324b2298SPaolo Bonzini 18*324b2298SPaolo BonziniThen launch gdb on the 'vmlinux' executable:: 19*324b2298SPaolo Bonzini 20*324b2298SPaolo Bonzini > gdb vmlinux 21*324b2298SPaolo Bonzini 22*324b2298SPaolo BonziniIn gdb, connect to QEMU:: 23*324b2298SPaolo Bonzini 24*324b2298SPaolo Bonzini (gdb) target remote localhost:1234 25*324b2298SPaolo Bonzini 26*324b2298SPaolo BonziniThen you can use gdb normally. For example, type 'c' to launch the 27*324b2298SPaolo Bonzinikernel:: 28*324b2298SPaolo Bonzini 29*324b2298SPaolo Bonzini (gdb) c 30*324b2298SPaolo Bonzini 31*324b2298SPaolo BonziniHere are some useful tips in order to use gdb on system code: 32*324b2298SPaolo Bonzini 33*324b2298SPaolo Bonzini1. Use ``info reg`` to display all the CPU registers. 34*324b2298SPaolo Bonzini 35*324b2298SPaolo Bonzini2. Use ``x/10i $eip`` to display the code at the PC position. 36*324b2298SPaolo Bonzini 37*324b2298SPaolo Bonzini3. Use ``set architecture i8086`` to dump 16 bit code. Then use 38*324b2298SPaolo Bonzini ``x/10i $cs*16+$eip`` to dump the code at the PC position. 39*324b2298SPaolo Bonzini 40*324b2298SPaolo BonziniAdvanced debugging options: 41*324b2298SPaolo Bonzini 42*324b2298SPaolo BonziniThe default single stepping behavior is step with the IRQs and timer 43*324b2298SPaolo Bonziniservice routines off. It is set this way because when gdb executes a 44*324b2298SPaolo Bonzinisingle step it expects to advance beyond the current instruction. With 45*324b2298SPaolo Bonzinithe IRQs and timer service routines on, a single step might jump into 46*324b2298SPaolo Bonzinithe one of the interrupt or exception vectors instead of executing the 47*324b2298SPaolo Bonzinicurrent instruction. This means you may hit the same breakpoint a number 48*324b2298SPaolo Bonziniof times before executing the instruction gdb wants to have executed. 49*324b2298SPaolo BonziniBecause there are rare circumstances where you want to single step into 50*324b2298SPaolo Bonzinian interrupt vector the behavior can be controlled from GDB. There are 51*324b2298SPaolo Bonzinithree commands you can query and set the single step behavior: 52*324b2298SPaolo Bonzini 53*324b2298SPaolo Bonzini``maintenance packet qqemu.sstepbits`` 54*324b2298SPaolo Bonzini This will display the MASK bits used to control the single stepping 55*324b2298SPaolo Bonzini IE: 56*324b2298SPaolo Bonzini 57*324b2298SPaolo Bonzini :: 58*324b2298SPaolo Bonzini 59*324b2298SPaolo Bonzini (gdb) maintenance packet qqemu.sstepbits 60*324b2298SPaolo Bonzini sending: "qqemu.sstepbits" 61*324b2298SPaolo Bonzini received: "ENABLE=1,NOIRQ=2,NOTIMER=4" 62*324b2298SPaolo Bonzini 63*324b2298SPaolo Bonzini``maintenance packet qqemu.sstep`` 64*324b2298SPaolo Bonzini This will display the current value of the mask used when single 65*324b2298SPaolo Bonzini stepping IE: 66*324b2298SPaolo Bonzini 67*324b2298SPaolo Bonzini :: 68*324b2298SPaolo Bonzini 69*324b2298SPaolo Bonzini (gdb) maintenance packet qqemu.sstep 70*324b2298SPaolo Bonzini sending: "qqemu.sstep" 71*324b2298SPaolo Bonzini received: "0x7" 72*324b2298SPaolo Bonzini 73*324b2298SPaolo Bonzini``maintenance packet Qqemu.sstep=HEX_VALUE`` 74*324b2298SPaolo Bonzini This will change the single step mask, so if wanted to enable IRQs on 75*324b2298SPaolo Bonzini the single step, but not timers, you would use: 76*324b2298SPaolo Bonzini 77*324b2298SPaolo Bonzini :: 78*324b2298SPaolo Bonzini 79*324b2298SPaolo Bonzini (gdb) maintenance packet Qqemu.sstep=0x5 80*324b2298SPaolo Bonzini sending: "qemu.sstep=0x5" 81*324b2298SPaolo Bonzini received: "OK" 82