I was trying to study the debugging of kernel using QEMU. I tried initially and failed due to the fact that there was no virtual file system. The answers to this post suggests that there should be a virtual file system. But it doesn't talk about how to create virtual FS for kernel debugging and how to pass it over to the qemu. Can you help me out?

  • This blog post describes the use of QEMU to debug the OpenBSD kernel but could still be helpful, just replace the OpenBSD-specific parts with the Linux ones. (The author uses a complete system image to debug the kernel; he doesn't just use a kernel only.) What exactly is the step you're stuck with?
    – sr_
    Jan 13, 2013 at 9:49
  • @sr_ Kernel Panic happens. And the warning says:- Unable to mount root fs on unknown-block(0,0). Jan 13, 2013 at 10:05
  • Try using a minimal filesystem (i.e. try debugging the kernel in its normal environment). What bug is it you're trying to get rid of? (A panic caused by no root file system doesn't quite qualify as a bug (unless what you're trying to do revolves around initrd))
    – sr_
    Jan 13, 2013 at 10:09
  • I know that does not relate to bug. I am experimenting and not trying to get rid of any bugs as of now :) Jan 13, 2013 at 10:23
  • Here is a way mentioned to debug the Linux kernel using qemu.
    – user31986
    Jan 8, 2016 at 10:20

2 Answers 2


Depending on the distribution you'd like to use, there are various ways to create a file system image, e.g. this article walks you through the laborious way to a "Linux from Scratch" system.

In general, you'd either create a QEMU image using qemu-img, fetch some distribution's installation media and use QEMU with the installation medium to prepare the image (this page explains the process for Debian GNU/Linux) or use an image prepared by someone else.

This section of the QEMU Wikibook contains all the information you need.

Edit: As Gilles' answer to the linked question suggests, you don't need a full-blown root file system for testing, you could just use an initrd image (say, Arch Linux's initrd like here)

  • I have made a debian image. Now how will I choose initrd image for that? In other words, which file will I choose as initrd? Jan 14, 2013 at 17:26
  • @sr_ I am using ubuntu 12.04.1 how could I get qemu-img?
    – Coder404
    Jan 20, 2013 at 21:31
  • @sr_ is qemu-utils the modern day version of qemu-img?
    – Coder404
    Feb 2, 2013 at 0:05
  • qemu-img is one of the tools in qemu-utils
    – sr_
    Feb 2, 2013 at 9:31

QEMU + GDB step-by-step procedure tested on Ubuntu 16.10 host

To get started from scratch quickly I've made a minimal fully automated QEMU + Buildroot example at: https://github.com/cirosantilli/linux-kernel-module-cheat Major steps are covered below.

First get a root filesystem rootfs.cpio.gz. If you need one, consider:

Then on the Linux kernel:

git checkout v4.9
make mrproper
make x86_64_defconfig
cat <<EOF >.config-fragment
./scripts/kconfig/merge_config.sh .config .config-fragment
make -j"$(nproc)"
qemu-system-x86_64 -kernel arch/x86/boot/bzImage \
                   -initrd rootfs.cpio.gz -S -s

On another terminal, supposing you want to start debugging from start_kernel:

gdb \
    -ex "add-auto-load-safe-path $(pwd)" \
    -ex "file vmlinux" \
    -ex 'set arch i386:x86-64:intel' \
    -ex 'target remote localhost:1234' \
    -ex 'break start_kernel' \
    -ex 'continue' \
    -ex 'disconnect' \
    -ex 'set arch i386:x86-64' \
    -ex 'target remote localhost:1234'

and we are done!!

For kernel modules see: How to debug Linux kernel modules with QEMU? | Stack Overflow

For Ubuntu 14.04, GDB 7.7.1, hbreak was needed, break software breakpoints were ignored. Not the case anymore in 16.10. See also: https://bugs.launchpad.net/ubuntu/+source/qemu-kvm/+bug/901944

The messy disconnect and what come after it are to work around the error:

Remote 'g' packet reply is too long: 000000000000000017d11000008ef4810120008000000000fdfb8b07000000000d352828000000004040010000000000903fe081ffffffff883fe081ffffffff00000000000e0000ffffffffffe0ffffffffffff07ffffffffffffffff9fffff17d11000008ef4810000000000800000fffffffff8ffffffffff0000ffffffff2ddbf481ffffffff4600000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007f0300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000801f0000

Related threads:

See also:

Known limitations:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.