Skip to content

Qiling gdbserver not handling stepi instruction #1538

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
antcpl opened this issue Mar 6, 2025 · 1 comment
Open

Qiling gdbserver not handling stepi instruction #1538

antcpl opened this issue Mar 6, 2025 · 1 comment

Comments

@antcpl
Copy link

antcpl commented Mar 6, 2025

*Describe the bug
When remote debugging a program running in Qiling, the Qiling gdbserver seems not to handle the single step instruction from gdb client. Every time I perform the si command in my gdb client, Qiling gdbserver send SIGTERM causing my debugged program to terminate.

Sample Code

 ql = Qiling(["./toto.elf"],
                archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f103, verbose=QL_VERBOSE.DISASM)

    ql.hw.create('scb')
    ql.hw.create('gpioa')
    ql.hw.create('usart1')
    ql.hw.create('rcc')
    ql.hw.create('afio')
    ql.hw.create('exti')
    ql.debugger = True
    ql.hw.show_info()

    ql.run(count=1000000)

    print(ql.hw.usart1.recv())

Expected behavior
Qiling gdbserver not sending SIGTERM each time performing the si command when remote debugging.

Dig in gdbserver Qiling implementation
I digged in the gdbserver implementation and debug with the command printing offered by Qiling gdbserver and this function seems weird to me, file : qiling/debugger/gdb/gdb.py

def handle_s(subcmd: str) -> Reply:
  """Perform a single step.
  """
  
  self.gdb.resume_emu(steps=1)
  
  # if emulation has been stopped, signal program termination
# ===== these two lines seems weird to me because the condition is always True ===
# This is what send the SIGTERM all the time 
 if self.ql.emu_state is QL_STATE.STOPPED: 
   return f'S{SIGTERM:02x}'
# ====================================================================
  # otherwise, this is just single stepping
  return f'S{SIGTRAP:02x}'

Wonder if it's normal or it's a bug or this condition is useful in a particular case that is not related to my implementation. I've tested to comment these two lines and everything works perfectly fine after that. I think it also causes other bugs with breakpoint but not so sure and didn't have the time to verify this point.

Additional context
I worked with the dev branch.
Just a really simple code, I work on cortex-m3 and this code works perfectly fine without debugging.
I use arm-none-eabi-gdb as gdb client (from the toolchain used to cross compile toto.elf) with my program and it has symbols debug.
I know that mcu's haven't been really tested with gdb and Qiling but I just crafted two xml files for cortex-m placed at : qiling/debugger/gdb/xml/cortex-m.

arm-m-profile.xml :

<?xml version="1.0"?>
<!-- Copyright (C) 2010-2020 Free Software Foundation, Inc.

     Copying and distribution of this file, with or without modification,
     are permitted in any medium without royalty provided the copyright
     notice and this notice are preserved.  -->

<!DOCTYPE feature SYSTEM "gdb-target.dtd">
<feature name="org.gnu.gdb.arm.m-profile">
  <reg name="r0" bitsize="32" regnum="0"/>
  <reg name="r1" bitsize="32"/>
  <reg name="r2" bitsize="32"/>
  <reg name="r3" bitsize="32"/>
  <reg name="r4" bitsize="32"/>
  <reg name="r5" bitsize="32"/>
  <reg name="r6" bitsize="32"/>
  <reg name="r7" bitsize="32"/>
  <reg name="r8" bitsize="32"/>
  <reg name="r9" bitsize="32"/>
  <reg name="r10" bitsize="32"/>
  <reg name="r11" bitsize="32"/>
  <reg name="r12" bitsize="32"/>
  <reg name="sp" bitsize="32" type="data_ptr"/>
  <reg name="lr" bitsize="32"/>
  <reg name="pc" bitsize="32" type="code_ptr"/>
  <reg name="xpsr" bitsize="32" regnum="25"/>
</feature>

target.xml :

<?xml version="1.0"?>
<!-- Copyright (C) 2009-2016 Free Software Foundation, Inc.

 *!Copying and distribution of this file, with or without modification,
 *!are permitted in any medium without royalty provided the copyright
 *!notice and this notice are preserved.  -->

<!DOCTYPE target SYSTEM "gdb-target.dtd">
<target xmlns:xi="http://www.w3.org/2001/XInclude">
    <architecture>arm</architecture>
    <xi:include href="arm-m-profile.xml"/>
</target>
@bet4it
Copy link
Contributor

bet4it commented Apr 27, 2025

You could have a try of udbserver.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants