\documentclass[aspectratio=169,obeyspaces,spaces,hyphens,dvipsnames]{beamer}
\usepackage[utf8]{inputenc}
\usepackage{lmodern}% http://ctan.org/pkg/lm
\usepackage{minted}
\usepackage{hyperref}
\usepackage{xcolor}
\usepackage{pgfplots}
\usepackage{tikz}
\usepackage[normalem]{ulem}

\mode<presentation>
\usetheme{Bootlin}

\def\signed #1{{\leavevmode\unskip\nobreak\hfil\penalty50\hskip2em
  \hbox{}\nobreak\hfil(#1)
  \parfillskip=0pt \finalhyphendemerits=0 \endgraf}}

\newsavebox\mybox
\newenvironment{aquote}[1]
  {\savebox\mybox{#1}\begin{quotation}}
  {\signed{\usebox\mybox}\end{quotation}}

\title{Debugging with GDB and remote GDB}
\authors{Luca Ceresoli}
\email{luca.ceresoli@bootlin.com}
\slidesurl{https://bootlin.com/pub/conferences/}
\institute{Bootlin}
\conference{Linux Day 2023, Bergamo}

\begin{document}

\addtocontents{toc}{\protect\setcounter{tocdepth}{-1}}
\section{Debugging with GDB and remote GDB}
\addtocontents{toc}{\protect\setcounter{tocdepth}{2}}

\begin{frame}{Luca Ceresoli}
  \begin{itemize}
  \item Embedded Linux engineer at {\bf Bootlin}
    \begin{itemize}
    \item Embedded Linux experts
    \item Engineering services: Linux BSP development, kernel porting
      and drivers, Yocto/Buildroot integration, real-time, boot-time,
      security, multimedia
    \item Training services: Embedded Linux, Linux kernel drivers, Yocto,
      Buildroot, graphics stack, boot-time, real-time, debugging, audio
    \end{itemize}
  \item Linux kernel and bootloader development, Buildroot and
    Yocto integration
  \item Open-source contributor
  \item Living in {\bf Bergamo}, Italy
  \item \code{luca.ceresoli@bootlin.com}
  \end{itemize}
  {\small \url{https://bootlin.com/company/staff/luca-ceresoli/}}
\end{frame}


\subsection{Introduction}

\begin{frame}{Debugging}

  {\em ``Everyone knows that debugging is twice as hard as writing a
    program in the first place. So if you're as clever as you can be when
    you write it, how will you ever debug it?''}

  -- Brian Kernighan
\end{frame}

\begin{frame}{Good practices}
  \begin{itemize}
    \item Keep your code clean and simple!
      \begin{itemize}
      \item Simple to implement, understand, debug\dots{} also helps
        writing less bugs!
      \end{itemize}
    \item Compiler are now smart enough to detect a wide range of errors at
          compile-time using warnings
    \begin{itemize}
      \item Using \code{-Werror -Wall -Wextra} is recommended if possible to catch
            errors as early as possible
    \end{itemize}
    \item Compilers now offer static analysis capabilities
    \begin{itemize}
      \item GCC allows to do so using the \href{https://gcc.gnu.org/onlinedocs/gcc-11.1.0/gcc/Static-Analyzer-Options.html}{-fanalyzer} flag
      \item LLVM provides \href{https://clang-analyzer.llvm.org/command-line.html}{dedicated tools} that can be used in build process
    \end{itemize}
  \end{itemize}
\end{frame}


\subsection{GDB}

\begin{frame}
  \frametitle{GDB: GNU Project Debugger}
  \fontsize{11}{11}\selectfont
  \begin{columns}[T]
    \column{0.8\textwidth}
    \begin{itemize}
    \item The debugger on GNU/Linux, available for most embedded
      architectures.
    \item Supported languages: C, C++, Pascal, Objective-C, Fortran,
      Ada...
    \item Command-line interface
    \item Integration in many graphical IDEs
    \item Can be used to
      \begin{itemize}
      \item control the execution of a running program, set
        breakpoints or change internal variables
      \item to see what a program was doing when it crashed: post
        mortem analysis
      \end{itemize}
    \item \url{https://www.gnu.org/software/gdb/}
    \item \url{https://en.wikipedia.org/wiki/Gdb}
    \item New alternative: {\em lldb} (\url{https://lldb.llvm.org/})\\
      from the LLVM project.
    \end{itemize}
    \column{0.2\textwidth}
    \includegraphics[width=0.9\textwidth]{gdb.png}
  \end{columns}
\end{frame}


\subsection{GDB crash course}

\begin{frame}[fragile]
  \frametitle{GDB crash course (1/3)}
  \begin{itemize}
    \item GDB is used mainly to debug a process by starting it with {\em gdb}
    \begin{itemize}
      \item \code{$ gdb <program>}
    \end{itemize}
    \item GDB can also be attached to running processes using the program PID
    \begin{itemize}
      \item \code{$ gdb -p <pid>}
    \end{itemize}
    \item When using GDB to start a program, the program needs to be run with
    \begin{itemize}
      \item \code{(gdb) run}
    \end{itemize}
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{GDB crash course (2/3)}
  \small
  A few useful GDB commands
  \begin{itemize}
  \item \code{break foobar} (\code{b})\\
    Put a breakpoint at the entry of function \code{foobar()}
  \item \code{break foobar.c:42}\\
    Put a breakpoint in \code{foobar.c}, line 42
  \item \code{print var}, \code{print $reg} or \code{print task->files[0].fd} (\code{p})\\
    Print the variable \code{var}, the register \code{$reg} or a more
    complicated reference. GDB can also nicely display structures with all
    their members
  \item \code{info registers}\\
    Display architecture registers
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{GDB crash course (3/3)}
  \small
  \begin{itemize}
  \item \code{continue} (\code{c})\\
    Continue the execution after a breakpoint
  \item \code{next} (\code{n})\\
    Continue to the next line, stepping over function calls
  \item \code{step} (\code{s})\\
    Continue to the next line, entering into subfunctions
  \item \code{stepi} (\code{si})\\
    Continue to the next instruction
  \item \code{finish}\\
    Execute up to function return
  \item \code{backtrace} (\code{bt})\\
    Display the program stack
  \end{itemize}
\end{frame}


\subsection{GDB advanced commands}

\begin{frame}
  \frametitle{GDB advanced commands (1/3)}
  \small
  \begin{itemize}
    \item \code{info threads} (\code{i threads})\\
      Display the list of threads that are available
    \item \code{info breakpoints} (\code{i b})\\
      Display the list of breakpoints/watchpoints
    \item \code{delete <n>} (\code{d <n>})\\
      Delete breakpoint <n>
    \item \code{thread <n>} (\code{t <n>})\\
      Select thread number <n>
    \item \code{frame <n>} (\code{f <n>})\\
      Select a specific frame from the backtrace, the number being the one
      displayed when using \code{backtrace} at the beginning of each line
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{GDB advanced commands (2/3)}
  \small
  \begin{itemize}
    \item \code{watch <variable>} or \code{watch \*<address>}\\
      Add a watchpoint on a specific variable/address.
    \item \code{print variable = value} (\code{p variable = value})\\
      Modify the content of the specified variable with a new value
    \item \code{break if condition == value}\\
      Break only if the specified condition is true
    \item \code{watch if condition == value}\\
      Trigger the watchpoint only if the specified condition is true
    \item \code{x/<n><u> <address>}\\
      Display memory at the provided address. \code{n} is the amount of memory to
      display, \code{u} is the type of data to be displayed (\code{b/h/w/g}).
      Instructions can be displayed using the \code{i} type.
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{GDB advanced commands (3/3)}
  \small
  \begin{itemize}
    \item \code{list <expr>}\\
      Display the source code associated to the current program counter location.
    \item \code{disassemble <location,start_offset,end_offset>} (\code{disas})\\
      Display the assembly code that is currently executed.
    \item \code{p $newvar = value}\\
      Declare a new gdb variable that can be used locally or in command sequence
    \item \code{p function(arguments)}\\
      Execute a function using GDB. NOTE: be careful of any side effects that
      may happen when executing the function
    \item \code{define <command_name>}\\
      Define a new command sequence. GDB will prompt for the sequence of
      commands.
  \end{itemize}
\end{frame}


\subsection{Remote GDB debugging}

\begin{frame}
  \frametitle{Remote debugging}
  \begin{itemize}
  \item In a non-embedded environment, debugging takes place using \code{gdb}
    or one of its front-ends.
  \item \code{gdb} has direct access to the binary and libraries compiled
    with debugging symbols.
  \item However, in an embedded context, the target platform
    environment is often too limited to allow direct debugging with
    \code{gdb} (2.4 MB on x86).
  \item Remote debugging is preferred
    \begin{itemize}
    \item \code{ARCH-linux-gdb} is used on the development workstation, offering
      all its features.
    \item \code{gdbserver} is used on the target system (only 400 KB
      on arm).
    \end{itemize}
  \end{itemize}
  \begin{center}
    \includegraphics[width=0.5\textwidth]{gdb-vs-gdbserver.pdf}
  \end{center}
\end{frame}

\begin{frame}
  \frametitle{Remote debugging: architecture}
  \begin{center}
    \includegraphics[width=\textwidth]{gdb-vs-gdbserver-architecture.pdf}
  \end{center}
\end{frame}

\begin{frame}
  \frametitle{Remote debugging: usage}
  \begin{itemize}
  \item On the target, run a program through \code{gdbserver}.\\
    Program execution will not start immediately.\\
    \code{gdbserver localhost:<port> <executable> <args>}
    \code{gdbserver /dev/ttyS0 <executable> <args>}
  \item Otherwise, attach \code{gdbserver} to an already running program:\\
    \code{gdbserver --attach localhost:<port> <pid>}
  \item Then, on the host, start \code{ARCH-linux-gdb <executable>},\\
    and use the following \code{gdb} commands:
    \begin{itemize}
    \item To tell \code{gdb} where shared libraries are:\\
      \code{gdb> set sysroot <library-path>} (typically path to build space without \code{lib/})
    \item To connect to the target:\\
      \code{gdb> target remote <ip-addr>:<port>} (networking)\\
      \code{gdb> target remote /dev/ttyUSB0} (serial link)
    \end{itemize}
  \end{itemize}
\end{frame}


\subsection{How a debugger works\\(within an Operating System)}

\begin{frame}
  \frametitle{System architecture}
  \begin{columns}
    \column{0.6\textwidth}
  \begin{itemize}
    \item Porcesses do not access the hardware resources directly
    \item The kernel isolates processes from teh hardware and from other
      processes
    \item Processes ask the kernel to provide its services via syscalls
      (usually wrapped by the C library)
  \end{itemize}
    \column[c]{0.4\textwidth}
    \includegraphics[width=\textwidth]{kernel-syscall-userspace.pdf}
  \end{columns}
\end{frame}

\begin{frame}
  \frametitle{Debugger and debuggee}
  \begin{columns}
    \column{0.5\textwidth}
  \begin{itemize}
    \item {\em debugger} and {\em debuggee} are different processes, which
      normally cannot acccess each other memory and control execution
    \item A debugger uses the \code{ptrace()} syscall to control a process
      execution and read/write its data
  \end{itemize}
    \column[c]{0.5\textwidth}
    \includegraphics[width=\textwidth]{debugger-debuggee.pdf}
  \end{columns}
\end{frame}

\begin{frame}[fragile]
  \frametitle{ptrace}
  \begin{itemize}
    \item The {\em ptrace} mechanism allows processes to trace other processes by
          accessing tracee memory and register contents
    \item A tracer can observe and control the execution state of another
          process
    \item Works by attaching to a tracee process using the \code{ptrace()}
          system call (see \code{man 2 ptrace})
    \item Can be executed directly using the \code{ptrace()} call but often used
          indirectly using other tools.
  \end{itemize}

  \begin{block}{}
    \begin{minted}[fontsize=\small]{C}
long ptrace(enum __ptrace_request request, pid_t pid, void *addr, void *data);
    \end{minted}
  \end{block}

  \begin{itemize}
    \item Used by {\em GDB}, {\em strace} and all debugging tools that need access to the
          tracee process state
  \end{itemize}
\end{frame}


\questionslide

\begin{frame}
\frametitle{Rights to copy}
   \scriptsize
   © Copyright 2004-\the\year, Bootlin \\
   {\bf License: Creative Commons Attribution - Share Alike 3.0} \\
   \url{https://creativecommons.org/licenses/by-sa/3.0/legalcode} \\

   You are free:
   \begin{itemize}
     \item to copy, distribute, display, and perform the work
     \item to make derivative works
     \item to make commercial use of the work
   \end{itemize}

   Under the following conditions:
   \begin{itemize}
     \item {\bf Attribution}. You must give the original author credit.
     \item {\bf Share Alike}. If you alter, transform, or build upon
           this work, you may distribute the resulting work only under
           a license identical to this one.
     \item For any reuse or distribution, you must make clear to others
           the license terms of this work.
     \item Any of these conditions can be waived if you get permission
           from the copyright holder.
    \end{itemize}

    Your fair use and other rights are in no way affected by the above.
    \vfill
    {\bf Document sources:} \\
    \url{https://bootlin.com/pub/conferences/} \\
    \url{https://github.com/bootlin/training-materials/} \\
\end{frame}

\end{document}
