\input{configpres}

\subsection{Debugging}

\title{\lq Debugging\rq}
\maketitle

\section{Die GNU Compiler Collection}
\subsection{Hello world}
\begin{frame}[fragile]
\frametitle{Der GNU Compiler}
\begin{lstlisting}[language=c]
/* hello.c */
#include <stdio.h>

int main(void)
{
        printf("Hello world\n");
        return 0;
}
\end{lstlisting}
\begin{lstlisting}[language=bash]
# Uebersetzen des Testprogramms
gcc -o hello hello.c
\end{lstlisting}
\end{frame}

\subsubsection{Wichtige Optionen}
\begin{frame}[fragile]
\frametitle{Wichtige gcc Optionen}
\begin{lstlisting}[language=bash]
# Nur Objectfile erzeugen
gcc -c -o hello.o hello.c

# Uebersetzen mit Optimierungslevel 3
gcc -O3 -o hello hello.c

# Ohne Optimierung und mit
# Debugsymbolen uebersetzen
gcc -O0 -g hello hello.c
\end{lstlisting}
\end{frame}

\begin{frame}[fragile]
\frametitle{Wichtige gcc Optionen}
\begin{lstlisting}[language=bash]
# Gegen zusaetzliche Bibliothek linken (librt.so)
gcc -lrt -o hello hello.c

# Suchpfad fuer Bibliotheken hinzufuegen
gcc -L /mypath -lrt -o hello hello.c

# Suchpfad fuer Includes hinzufuegen
gcc -I /mypath -o hello hello.c
\end{lstlisting}
\end{frame}

\begin{frame}[fragile]
\frametitle{Wichtige gcc Optionen}
\begin{lstlisting}[language=bash]
# Alle Warnings ausgeben
gcc -Wall -o hello hello.c

# Warnings als Fehler behandeln
gcc -Wall -Werror -o hello hello.c
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{GCC: Nützliches}
\begin{lstlisting}[language=bash]
# Vordefinierte / Interne Makros ausgeben
$ gcc -E -dM - < /dev/null | cut -c 9- | sort
[...]
__SIZEOF_DOUBLE__ 8
__SIZEOF_FLOAT__ 4
__SIZEOF_INT__ 4
__SIZEOF_LONG__ 8
[...]
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{GCC: Nützliches}
\begin{lstlisting}[language=bash]
# Nur Pre-Prozessor ausfuehren
$ gcc -C -E hello.c -o hello_pre

# Woher kommt welches Symbol?
$ gcc -Wl,-y,printf hello.c
/lib/libc.so.6: definition of printf
\end{lstlisting}
Quelle und weitere nuetzliche Tipps: http://elinux.org/GCC\_Tips
\end{frame}

\subsection{Der Dynamic Loader}
\begin{frame}
\frametitle{Der Dynamic Loader: ld-linux.so}
\begin{alertblock}{Was ist der Dynamic Loader?}
Der Dynamic Loader: ld-linux.so lädt die dynamischen Bibliotheken, die von einem Programm
benötigt werden. Er ist Bestandteil der C Bibliothek.
\end{alertblock}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Der Dynamic Loader: ld-linux.so}
\begin{lstlisting}[language=bash]
# Entweder
./hello

# oder
/lib/ld-linux-x86-64.so.2 ./hello
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Der Dynamic Loader: Umgebungsvariablen}
\begin{tabular}{|l|p{5cm}|}
\hline
\textbf{Umgebungsvariable} & \textbf{Abkürzung}  \\
\hline
LD\_LIBRARY\_PATH & Suchpfad für Bibliotheken \\
\hline
LD\_PRELOAD & Liste von Bibliotheken, die vor allen anderen zu laden sind \\
\hline
LD\_DEBUG & Debug Ausgaben \\
\hline
\end{tabular}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Der Dynamic Loader: Umgebungsvariablen}
\begin{lstlisting}[basicstyle=\ttfamily\fontsize{9}{9}\selectfont]
$ LD_DEBUG=help ./hello
Valid options for the LD_DEBUG environment
variable are:

  libs        display library search paths
  reloc       display relocation processing
  files       display progress for input file
  symbols     display symbol table processing
  bindings    display information about symbol binding
  versions    display version dependencies
  all         all previous options combined
  statistics  display relocation statistics
  unused      determined unused DSOs
  help        display this help message and exit
\end{lstlisting}
\end{frame}

\begin{frame}
\frametitle{Der Dynamic Loader: Suchreihenfolge}
\begin{enumerate}
\item DT\_RPATH dynamic subsection (ELF)
\item LD\_LIBRARY\_PATH
\item DT\_RUNPATH dynamic subsection (ELF)
\item ld.so.cache
\item /lib bzw. /usr/lib
\end{enumerate}
\end{frame}

\subsection{Die Binutils}
\subsubsection{Übersicht}
\begin{frame}
\frametitle{Die Binutils}
Eine Sammlung von Programmen zum Erstellen / Bearbeiten von Binaries.
Die wichtigsten Tools sind:
\begin{itemize}
\item Der GNU Linker (ld)
\item Der GNU Assembler (as)
\end{itemize}
\end{frame}

\begin{frame}
\frametitle{Weitere Programme der Binutils}
\begin{itemize}
\item \textbf{addr2line}: Ordnet Adressen Zeilennummern zu
\item \textbf{gprof}: Profiler
\item \textbf{nm}: Listet Symbole in Objectfiles
\item \textbf{objcopy}: Kopiert und konvertiert Objectfiles
\item \textbf{objdump}: Listet Informationen zu Objectfiles
\end{itemize}
\end{frame}

\begin{frame}
\frametitle{Weitere Programme der Binutils}
\begin{itemize}
\item \textbf{ranlib}: Generiert den Index zu einem Archivinhalt
\item \textbf{readelf}: Zeigt Informationen zu ELF Files
\item \textbf{size}: Listet die Sektionsgrößen für Object- oder ELF Files
\item \textbf{strip}: Entfernt Symbole
\end{itemize}
\end{frame}

\subsubsection{objdump}
\begin{frame}[containsverbatim]
\frametitle{Untersuchen von Binaries mit Objdump}
\begin{lstlisting}[language=bash]
jan@hopfropf:~$ objdump -x /bin/ls
/bin/ls:     file format elf64-x86-64
/bin/ls
architecture: i386:x86-64, flags 0x00000112:
EXEC_P, HAS_SYMS, D_PAGED
start address 0x0000000000402490

Program Header:
    PHDR off    0x0000000000000040 vaddr [...]
         filesz 0x00000000000001f8 memsz [...]
[...]
Dynamic Section:
  NEEDED               librt.so.1
[...]
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Untersuchen von Binaries mit Objdump}
\begin{lstlisting}[language=bash]
Version References:
  required from librt.so.1:
    0x09691a75 0x00 07 GLIBC_2.2.5
[...]
Sections:
Idx Name          Size      VMA          [...] 
  0 .interp       0000001c  000000000040 [...]
                  CONTENTS, ALLOC, LOAD, [...] 
  1 .note.ABI-tag 00000020  000000000040 [...]
                  CONTENTS, ALLOC, LOAD, [...] 
[...]
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Bibliotheksabhängigkeiten mit objdump bestimmen}
\begin{lstlisting}[language=bash]
jan@hopfropf:~$ objdump -x /bin/ls | grep NEEDED
  NEEDED               librt.so.1
  NEEDED               libselinux.so.1
  NEEDED               libacl.so.1
  NEEDED               libc.so.6
\end{lstlisting}
\end{frame}

\subsubsection{addr2line}
\begin{frame}[containsverbatim]
\frametitle{Adressen zuordnen mit addr2line}
\begin{lstlisting}[language=bash]
objdump -D hello | less
\end{lstlisting}
\begin{verbatim}
[...]
000000000040050c <main>:
  40050c:       55           push   %rbp
  40050d:       48 89 e5     mov    %rsp,%rbp
[...]
\end{verbatim}
\begin{lstlisting}[language=bash]
$ addr2line -e hello 40050c
/home/jan/work/examples/hello.c:4
\end{lstlisting}
\end{frame}

\section{Einfache Debugging Werkzeuge}
\begin{frame}
\frametitle{STRACE}
\begin{alertblock}{Was ist STRACE?}
STRACE ist ein mächtiges Diagnosewerkzeug, mit dem sich System Calls und Signale
tracen lassen.
\end{alertblock}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Anwendungsbeispiel}
\begin{lstlisting}[language=bash,basicstyle=\ttfamily\fontsize{9}{9}\selectfont]
$ strace /bin/ls
execve("/bin/ls", ["/bin/ls"], [/* 38 vars */]) = 0
brk(0)                                  = 0x8061000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MA
0xb7f03000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=113431, ...}
[...]
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Wichtige STRACE Optionen}
\begin{itemize}
\item \textbf{-f}: Follow Forks
\item \textbf{-v}: Verbose mode
\item \textbf{-T}: Print out time which is spent in each syscall
\item \textbf{-p PID}: Attach to PID
\end{itemize}
\end{frame}

\section{Der GNU Debugger: GDB}
\begin{frame}[containsverbatim]
\frametitle{Hello world debuggen}
\begin{enumerate}
\item Übersetzen mit Debug Informationen
\item Starten im Debugger:
\begin{lstlisting}[language=bash]
gdb ./hello
\end{lstlisting}
\end{enumerate}
\end{frame}


\begin{frame}[containsverbatim]
\frametitle{Wichtige GDB Kommandos}
\begin{verbatim}
(gdb) run
Starting program: /home/jan/work/examples/hello 
Hello world

Program exited normally.
(gdb)
\end{verbatim}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Wichtige GDB Kommandos}
\begin{verbatim}
(gdb) list
1	#include <stdio.h>
2	
3	int main (void)
4	{
5		printf("Hello world\n");
6		return 0;
7	}
(gdb) break 5
Breakpoint 1 at 0x400528: file hello.c, line 5.
\end{verbatim}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Wichtige GDB Kommandos}
\begin{verbatim}
(gdb) run
Starting program: /home/jan/work/examples/hello 

Breakpoint 1, main () at hello.c:5
5		printf("Hello world\n");
(gdb) next
Hello world
6		return 0;
(gdb) continue 
Continuing.
\end{verbatim}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{GDB Kommandos: Übersicht}
\begin{tabular}{|c|c|p{5cm}|}
\hline
\textbf{Kommando} & \textbf{Abkürzung} & \textbf{Zweck} \\
\hline
run & r & Programm starten \\
\hline
continue & c & Programm fortsetzen \\
\hline
break X & b & Breakpoint in Zeile X setzen \\
\hline
step & s & step IN \\
\hline
next & n & step OVER \\
\hline
print var & -- & Inhalt von Variable var anzeigen \\
\hline
display var & -- & Inhalt von Variable var jedes mal anzeigen, wenn das Programm stoppt \\
\hline
\end{tabular}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{GDB Kommandos: Übersicht}
\begin{tabular}{|c|c|p{5cm}|}
\hline
\textbf{Kommando} & \textbf{Abkürzung} & \textbf{Zweck} \\
\hline
backtrace & bt & Backtrace anzeigen \\
\hline
frame X & f & Im aktuellen Stack zu Frame Nr. X wechseln \\
\hline
quit & q & GDB beenden \\
\hline
\end{tabular}
\end{frame}

\section{Post mortem Debugging}
\subsection{Core files}
\begin{frame}[containsverbatim]
\frametitle{Core Files}
\begin{lstlisting}[language=C]
/* arthur_dent.c */
#include <stdio.h>

int main (void)
{
char *arthur_dent = NULL;
printf("Hello segfault world %s\n", *arthur_dent);
return 0;
}
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Core Files}
\begin{lstlisting}[language=bash]
$ ulimit -c unlimited
$ ./hello_segfault 
Segmentation fault (core dumped)
$ ls -l core*
\end{lstlisting}
\end{frame}

\subsection{Core Files analysieren mit GDB}
\begin{frame}[containsverbatim]
\frametitle{Post Mortem Debugging mit GDB}
\begin{lstlisting}[language=bash,basicstyle=\ttfamily\fontsize{9}{9}\selectfont]
$ gdb hello_segfault core
[...]
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Core was generated by `./hello_segfault'.
Program terminated with signal 11, Segmentation fault.
#0  0x0000000000400538 in main () at hello_crash.c:6
6		printf("Hello segfaulting world %s\n",
				*arthur_dent);
(gdb) bt
#0  0x0000000000400538 in main () at hello_crash.c:6
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Wichtig Kommandos für Post Mortem Debugging}
\begin{tabular}{|p{3.5cm}|p{5cm}|}
\hline
\textbf{Kommando} & \textbf{Zweck} \\
\hline
ulimit & Coredumps aktivieren und größe festlegen \\
\hline
cat /proc/sys/kernel/core\_pattern & Aktuelles Namenspattern für core-Files anzeigen \\
\hline
echo core-\%p \textgreater /proc/sys/kernel/core\_pattern & Namenspattern für
core-Files setzen \\
\hline
gdb ./exe corefile & Coredump mit GDB anzeigen \\
\hline
\end{tabular}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Symboltabellen}
Was tun, wenn Releases keine Debuginformation enthalten sollen?
\begin{lstlisting}[language=bash,basicstyle=\ttfamily\fontsize{9}{9}\selectfont]
$ gcc -g -Wall -Wextra -o arthur_dent arthur_dent.c
$ objcopy --only-keep-debug arthur_dent arthur_dent.dbg
$ strip --strip-all arthur_dent
$ gdb arthur_dent core
[...]
Program terminated with signal 11, Segmentation fault.
#0  0x0000000000400538 in ?? ()
$ symbol-file arthur_dent.dbg
[..]
$ bt
#0  0x0000000000400538 in main () at arthur_dent.c:6
\end{lstlisting}
\end{frame}

\section{Cross Entwicklung}
\subsection{Cross Übersetzen}
\begin{frame}[containsverbatim]
\frametitle{Cross ''Hello world''}
\begin{lstlisting}[language=c]
/* cross_hello.c */
#include <stdio.h>

int main(void)
{
    printf("Hello cross compiling world\n");
    return 0;
}
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Übersetzen für das Zielsystem}
\begin{lstlisting}[language=bash]
# Uebersetzen
$ arm-none-linux-gnueabi-gcc -static \
-o cross_hello cross_hello.c
\end{lstlisting}
\begin{lstlisting}[language=bash]
# Executable ueberpruefen
$ file cross_hello
cross_hello: ELF 32-bit LSB executable, ARM,
version 1 (SYSV), dynamically
linked (uses shared libs),
for GNU/Linux 2.6.14, not stripped
\end{lstlisting}
\end{frame}

\subsection{Qemu als Testwerkzeug}
\begin{frame}
\frametitle{Qemu als Werkzeug zur Cross Entwicklung}
\begin{alertblock}{Was ist Qemu?}
Qemu ist eine sehr performante Emulations- und Virtualisierungsumgebung für alle
gängigen CPU Architekturen.
\end{alertblock}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Testen eines Executables mit der Qemu user emulation}
\begin{lstlisting}[language=bash]
$ ./cross_hello
 : ./cross_hello: cannot execute binary file
$ qemu-arm ./cross_hello
Hello cross compiling world
\end{lstlisting}
\end{frame}

\subsection{Rootfilesystem}
\begin{frame}
\frametitle{Komponenten des Zielsystems}
\begin{overprint}
\onslide <1>
\begin{figure}[h]
\centering
\includegraphics[width=6cm]{images/target.png}
\end{figure}
\onslide <2>
\begin{figure}[h]
\centering
\includegraphics[width=6cm]{images/target_highlight_rfs.png}
\end{figure}
\end{overprint}
\end{frame}

\begin{frame}
\frametitle{Testsystem}
\begin{figure}[h]
\centering
\includegraphics[width=9cm]{images/zielsystem.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Randdaten zum verwendeten RFS}
\begin{itemize}
\item Einfaches Busybox basiertes System
\item FTP Server
\item SSH Server (dropbear)
\end{itemize}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Exportieren per NFS}
\begin{lstlisting}
# Auf Debian basierten Systemen (als root)
sudo apt-get install nfs-kernel-server
\end{lstlisting}
\end{frame}
\begin{frame}[containsverbatim]
\frametitle{Exportieren per NFS}
2) Directory exportieren
\begin{lstlisting}[language=bash]
sudo vim /etc/exports
\end{lstlisting}
\begin{verbatim}
/tftpboot/nfsroot \
192.168.2.0/255.255.255.0\
(rw,no_root_squash,no_subtree_check,insecure)
\end{verbatim}
\begin{lstlisting}[language=bash]
/etc/init.d/nfs-kernel-server restart
\end{lstlisting}
\end{frame}

\section{Remote Debugging}
\begin{frame}\frametitle{Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/remote_debug.png}
\end{figure}
\end{frame}

\begin{frame}[fragile]
\frametitle{Anforderungen an das Zielsystem}
\begin{itemize}
\item libthread\_db.so.1
\item libdl.so.2
\item gdbserver
\end{itemize}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{Remote Debugging session}
Auf dem Target:
\begin{lstlisting}[language=bash]
$ gdbserver :2345 ./cross_hello 
Process ./cross_hello created; pid = 310
Listening on port 54321
Remote debugging from host 192.168.2.1
Hello world
\end{lstlisting}
Auf dem Host:
\begin{lstlisting}[language=bash]
$ arm-none-linux-gnu-gdb cross_hello
(gdb) set solib-absolute-prefix /XXX/libc/
(gdb) target remote 192.168.2.2:2345
Remote debugging using 192.168.2.2:2345
0x30016180 in _start() from /XXX/libc/lib/ld.so.1
(gdb) c
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{gdbinit}
GDB Kommandos automatisch ausführen:
\begin{lstlisting}[language=bash]
vim gdbinit.txt
\end{lstlisting}
\begin{verbatim}
set solib-absolute-prefix /XXX/libc/
target remote 192.168.2.2:2345
\end{verbatim}
\begin{lstlisting}[language=bash]
arm-none-linux-gnu-gdb -x gdbinit.txt cross_hello 
\end{lstlisting}
\end{frame}

\section{Memory debugging}
\begin{frame}
\frametitle{Memory debugging}
Gängige Probleme:
\begin{itemize}
\item Schreiben / Lesen über die Grenze von Speicherbereichen
\item Memory leaks
\item ''Use after free()''
\end{itemize}
\end{frame}
\begin{frame}[containsverbatim]
\frametitle{GLIBC eigene Mechanismen: MTrace}
\begin{lstlisting}[language=C]
/* mem_test.c */
[...]
#include <mcheck.h>
[...]
int main(void)
{
   mtrace();
   [...]
}
\end{lstlisting}
\begin{lstlisting}[language=bash]
$ gcc -o mem_test mem_test.c
$ MALLOC_TRACE=mytrace.log ./mem_test
$ mtrace mem_test mytrace.log
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{GLIBC eigene Mechanismen: MTrace}
\begin{lstlisting}[language=C,basicstyle=\ttfamily\fontsize{9}{9}\selectfont]
/* mem_leak.c */
#include <mcheck.h>
#include <malloc.h>
#include <stdio.h>

int main(void)
{
        int i = 0;
        char *blurb = NULL;

        mtrace();

        for(i = 0; i < 50; i++)
                blurb = malloc(sizeof(char));

        free(blurb);
}
\end{lstlisting}
\end{frame}
\begin{frame}[containsverbatim]
\frametitle{GLIBC eigene Mechanismen: MTrace}
\begin{lstlisting}[language=bash,basicstyle=\ttfamily\fontsize{9}{9}\selectfont]
$ gcc -g -o mem_leak mem_leak.c
$ MALLOC_TRACE=mytrace.log ./mem_leak
$ mtrace ./mem_leak mytrace.log

Memory not freed:
-----------------
Address   Size   Caller
0x1536460 0x1 at /home/jan/work/examples/mem_leak.c:13
0x1536480 0x1 at /home/jan/work/examples/mem_leak.c:13
0x15364a0 0x1 at /home/jan/work/examples/mem_leak.c:13
[...]
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{libDUMA / electric fence}
\begin{lstlisting}[language=C,basicstyle=\ttfamily\fontsize{9}{9}\selectfont]
/* mem_leak.c */
#include <duma.h>
#include <malloc.h>
#include <stdio.h>

int main(void)
{
        int i = 0;
        char *blurb = NULL;

        for(i = 0; i < 50; i++)
                blurb = malloc(sizeof(char));

        free(blurb);
}
\end{lstlisting}
\begin{lstlisting}[language=bash,basicstyle=\ttfamily\fontsize{9}{9}\selectfont]
$ gcc -g -o mem_leak mem_leak.c /usr/lib/libduma.a \
   -lpthread
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{libDUMA / electric fence}
\begin{lstlisting}[language=bash,basicstyle=\ttfamily\fontsize{9}{9}\selectfont]
$ ./mem_leak
DUMA 2.5.15 (static library)
Copyright (C) 2006 Michael Eddington
<meddington@gmail.com>
Copyright (C) 2002-2008 Hayati Ayguen
<h_ayguen@web.de>, Procitec GmbH
Copyright (C) 1987-1999 Bruce Perens
<bruce@perens.com>
DUMA: ptr=0x7f7280bdbfff size=1 type='malloc()'
      alloced from mem_leak.c(11) not freed
DUMA: ptr=0x7f7280bddfff size=1 type='malloc()'
      alloced from mem_leak.c(11) not freed
[...]
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{libDUMA / electric fence: Überschriebener Speicher}
\begin{lstlisting}[language=C,basicstyle=\ttfamily\fontsize{8}{8}\selectfont]
/* array_access.c */
#include <stdio.h>
#include <malloc.h>
#include <string.h>

int main(void)
{
        int *my_array = (int*) malloc(10 * sizeof(int));
        int i = 0;
	memset(my_array, 0, 10 * sizeof(int));

        for(i = 0; i < 11; i++)
                printf("%d ", my_array[i]);

	printf("\n");
        return 0;
}
\end{lstlisting}
\begin{lstlisting}[language=bash,basicstyle=\ttfamily\fontsize{9}{9}\selectfont]
$ gcc -g -o array_access array_access.c
./array_access 0 0 0 0 0 0 0 0 0 0 135121
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{libDUMA / electric fence: Überschriebener Speicher}
\begin{lstlisting}[language=bash,basicstyle=\ttfamily\fontsize{9}{9}\selectfont]
$ gcc -g -o array_access array_access.c -lduma
$ ulimit -c unlimited
$ ./array_access
Segmentation fault (core dumped)
$ gdb array_access core
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Core was generated by `./array_access'.
Program terminated with signal 11, Segmentation fault.
#0  0x00000000004006b7 in main () at array_access.c:10
10                      printf("%d\n", my_array[i]);
(gdb) print i
$1 = 10
\end{lstlisting}
\end{frame}

\begin{frame}[containsverbatim]
\frametitle{libDUMA / electric fence: Überschriebener Speicher}
\begin{lstlisting}[language=bash,basicstyle=\ttfamily\fontsize{9}{9}\selectfont]
$ gcc -g -o array_access array_access.c
$ LD_PRELOAD=/usr/lib/libduma.so ./array_access
Segmentation fault (core dumped)
[...]
\end{lstlisting}
\end{frame}

\section{Eclipse}
\begin{frame}
\frametitle{Eclipse: Download}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_download.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Plug-Ins installieren}
\begin{figure}[h]
\centering
\includegraphics[width=10cm]{images/eclipse_install_new.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Plug-Ins installieren}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_install_rse.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Plug-Ins installieren}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_install_cdt.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Plug-Ins installieren}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_install_details.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Plug-Ins installieren}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_install_license.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: C Cross-Projekt}
\begin{figure}[h]
\centering
\includegraphics[width=10cm]{images/eclipse_new_c.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Download}
\frametitle{Eclipse: C Cross-Projekt}
\begin{figure}[h]
\centering
\includegraphics[width=6cm]{images/eclipse_new_select.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: C Cross-Projekt}
\begin{figure}[h]
\centering
\includegraphics[width=6cm]{images/eclipse_new_advanced.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: C Cross-Projekt}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_new_comp.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: C Cross-Projekt}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_new_link.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: C Cross-Projekt}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_new_asm.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: C Cross-Projekt}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_new_disc-debug.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: C Cross-Projekt}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_new_disc-release.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: C Cross-Projekt}
\begin{figure}[h]
\centering
\includegraphics[width=10cm]{images/eclipse_build_all.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: C Cross-Projekt}
\begin{figure}[h]
\centering
\includegraphics[width=10cm]{images/eclipse_overview.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=10cm]{images/eclipse_debug_config.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_debug_remote_base.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_debug_base_settings.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=6cm]{images/eclipse_remote_linux.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=6cm]{images/eclipse_remote_hostname.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=6cm]{images/eclipse_remote_ftp.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=6cm]{images/eclipse_remote_process.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=6cm]{images/eclipse_remote_shell.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=6cm]{images/eclipse_remote_terminal.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_remote_select.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_remote_debugger.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_remote_gdbserver.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=5cm]{images/eclipse_remote_pass.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=8cm]{images/eclipse_remote_remember.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote Debugging}
\begin{figure}[h]
\centering
\includegraphics[width=10cm]{images/eclipse_remote_debug_per.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote System Explorer}
\begin{figure}[h]
\centering
\includegraphics[width=10cm]{images/eclipse_open_perspective.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote System Explorer}
\begin{figure}[h]
\centering
\includegraphics[width=5cm]{images/eclipse_open_rse.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote System Explorer}
\begin{figure}[h]
\centering
\includegraphics[width=10cm]{images/eclipse_rse_files.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote System Explorer}
\begin{figure}[h]
\centering
\includegraphics[width=10cm]{images/eclipse_rse_terminal0.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Eclipse: Remote System Explorer}
\begin{figure}[h]
\centering
\includegraphics[width=10cm]{images/eclipse_rse_terminal1.png}
\end{figure}
\end{frame}

\section{Hardware Debugging / JTAG}
\begin{frame}
\frametitle{OpenOCD}
\begin{alertblock}{Freie Software für:}
\begin{itemize}
\item On-Chip Debugging
\item In-System Programming
\item Boundary-Scan Testing
\end{itemize}
\end{alertblock}
\end{frame}

\begin{frame}
\frametitle{Testaufbau}
\begin{figure}[h]
\centering
\includegraphics[width=5cm]{images/jtag.png}
\end{figure}
\end{frame}

\begin{frame}[fragile]
\frametitle{OpenOCD}
\begin{verbatim}
openocd -f interface/jtagkey2.cfg \
       -f board/olimex_sam9_l9260.cfg
\end{verbatim}
\begin{verbatim}
telnet localhost 4444
\end{verbatim}
\end{frame}

\begin{frame}[fragile]
\frametitle{interface/jtagkey2.cfg}
\begin{verbatim}
interface ft2232
ft2232_device_desc "Amontec JTAGkey-2"
ft2232_layout jtagkey
ft2232_vid_pid 0x0403 0xCFF8
jtag_rclk 3000
\end{verbatim}
\end{frame}

\begin{frame}[fragile]
\frametitle{board/olimex\_sam9\_l9260.cfg}
\begin{verbatim}
source [find target/at91sam9260.cfg]
$_TARGETNAME configure -event reset-start {
        jtag_rclk 5
        halt
        mww phys 0xfffffd08 0xa5000501
}
$_TARGETNAME configure -event reset-init {
  mww 0xfffffd44 0x00008000
  
  puts "Setting up clock"
  mww 0xfffffc20 0x00004001
  sleep 20                 
[...]
\end{verbatim}
\end{frame}

\begin{frame}[fragile]
\frametitle{OpenOCD: NAND konfigurieren}
board/olimex\_sam9\_l9260.cfg
\tiny
\begin{verbatim}
nand device at91sam9260.flash at91sam9 at91sam9260.cpu 0x40000000 0xffffe800
at91sam9 cle 0 22
at91sam9 ale 0 21
at91sam9 rdy_busy 0 0xfffff800 13
at91sam9 ce 0 0xfffff800 14
[...]
nand probe 0
\end{verbatim}
\end{frame}

\begin{frame}[fragile]
\frametitle{OpenOCD: NAND Zugriffe}
\tiny
\begin{verbatim}
Configuring SDRAM
Configuring NAND flash
NAND flash device 'NAND 512MiB 3.3V 8-bit (Samsung)' found
Setting up dataflash
NOTE! Severe performance degradation without fast memory access enabled. Type
'help fast'.
> nand raw_access 0 enable
raw access is enabled
> nand dump 0 /home/devel/work/dump.bin 0 131072
\end{verbatim}
\end{frame}

\begin{frame}[fragile]
\frametitle{OpenOCD: NAND löschen}
\begin{verbatim}
[...]
> nand erase 0 0 0x60000
\end{verbatim}
\end{frame}

\begin{frame}[fragile]
\frametitle{OpenOCD: NAND schreiben}
\begin{verbatim}
[...]
> nand write 0 /home/devel/work/bootloader.bin 0
\end{verbatim}
\end{frame}

\begin{frame}[fragile]
\frametitle{OpenOCD: Breakpoints / Single-Step}
\tiny
\begin{verbatim}
[...]
> reset halt
> bp 0x0020011c 0x04 hw
> resume
target state: halted
target halted in ARM state due to breakpoint, current mode: Supervisor
cpsr: 0x60000093 pc: 0x0020011c
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> step
target state: halted
target halted in ARM state due to breakpoint, current mode: Supervisor
cpsr: 0x60000093 pc: 0x00200280
MMU: disabled, D-Cache: disabled, I-Cache: disabled
\end{verbatim}
\end{frame}

\begin{frame}[fragile]
\frametitle{OpenOCD: GDB Schnittstelle}
\tiny
\begin{verbatim}
$ arm-none-linux-gnueabi-gdb sam9_l9260-nandflashboot-2.4.elf
[...]
(gdb) directory at91bootstrap-2.4-olimex
(gdb) target remote localhost:3333
Remote debugging using localhost:3333
[...]
(gdb) monitor reset halt
RCLK - adaptive
[...]
(gdb) hbreak main
Hardware assisted breakpoint 1 at 0x20011c: file main.c, line 68.
(gdb) c
Continuing.
Breakpoint 1, main () at main.c:68
68		hw_init();
\end{verbatim}
\end{frame}

\begin{frame}[fragile]
\frametitle{OpenOCD: GDB Schnittstelle}
\tiny
\begin{verbatim}
(gdb) c
Continuing.
Breakpoint 1, main () at main.c:68
68		hw_init();
(gdb) next
83		load_nandflash(IMG_ADDRESS, IMG_SIZE, JUMP_ADDR);
(gdb) next
84		dbg_print(">NANDflash ready\r\n");
(gdb) step
dbg_print (ptr=0x200e2c ">NANDflash ready\r\n") at driver/debug.c:90
90	}
\end{verbatim}
\end{frame}

\include{tailpres}
