3.2. GDB step debug kernel post-boot
Let’s observe the kernel write system call as it reacts to some userland actions.
Start QEMU with just:
./run
and after boot inside a shell run:
./count.sh
which counts to infinity to stdout. Source: rootfs_overlay/lkmc/count.sh.
Then in another shell, run:
./run-gdb
and then hit:
Ctrl-C break __x64_sys_write continue continue continue
And you now control the counting on the first shell from GDB!
Before v4.17, the symbol name was just sys_write, the change happened at d5a00528b58cdb2c71206e18bd021e34c4eab878. As of Linux v 4.19, the function is called sys_write in arm, and __arm64_sys_write in aarch64. One good way to find it if the name changes again is to try:
rbreak .*sys_write
or just have a quick look at the sources!
When you hit Ctrl-C, if we happen to be inside kernel code at that point, which is very likely if there are no heavy background tasks waiting, and we are just waiting on a sleep type system call of the command prompt, we can already see the source for the random place inside the kernel where we stopped.