Ubuntu 下利用 LLDB 调试 AOSP 源码

连接 LLDB

1. 通过 adb 开启手机的 lldb 服务

aw@m:~/Downloads$ adb root
adbd is already running as root

aw@m:~/Downloads$ adb remount
remount succeeded

aw@m:~/Downloads$ adb shell

bonito:/ # cd data/local/tmp

bonito:/data/local/tmp # ./lldb-server p --server --listen unix-abstract:///data/local/tmp/debug.sock

2. 连接 lldb-server

aw@m:~/Downloads$ lldb
Traceback (most recent call last):
  File "<string>", line 1, in <module>
ModuleNotFoundError: No module named 'lldb.embedded_interpreter'

(lldb) platform select remote-android 
  Platform: remote-android
 Connected: no

(lldb) platform connect unix-abstract-connect:///data/local/tmp/debug.sock
  Platform: remote-android
    Triple: aarch64-unknown-linux-android
OS Version: 32 (4.9.292-gab4493f31457-ab8272301)
  Hostname: localhost
 Connected: yes
WorkingDir: /data/local/tmp
    Kernel: #0 SMP PREEMPT Tue Mar 8 09:05:39 UTC 2022

(lldb) 

LLDB 连接参考博客

---

创建 target 选择调试 thread

Notice: LLDB 下清屏执行 shell clear

1. AOSP 编译 userDebug 版本

Notice: 编译后在 out/target/product/bonito/symbols/ 目录下生成带有符号表的 so 或 bin 可执行文件。

2. 利用 ` target create ` 创建调试module

Notice: 执行 target create xxxmodule后，lldb 的默认目录即为文件目录。假设我们调试 audioserver 可执行文件, 我将 audioserver 以及 libaudiopolicymanagerdefault.so 拷贝到测试目录，这里我拷贝到 ~/Downloads 目录下 

(lldb) target create ~/Downloads/audioserver 
warning: (aarch64) /home/aw/Downloads/audioserver No LZMA support found for reading .gnu_debugdata section
warning: (aarch64) /home/aw/.lldb/module_cache/remote-android/.cache/CD0B9774-77EC-B203-BB27-74A7993205A3/libaaudioservice.so No LZMA support found for reading .gnu_debugdata section
...
Current executable set to '/home/aw/Downloads/audioserver' (aarch64).

(lldb) target list
Current targets:
* target #0: /home/aw/Downloads/audioserver ( arch=aarch64-*-linux-android, platform=remote-android )

(lldb) 

target create xx 一般是可执行程序，如果要debug像Android APP类似的应用程序，可以直接attach 到对应的进程上，一般lldb会自动加载依赖库，类似 [256] BF8E41B1-A728-E776-30C1-359AD12FBB20 0x0000007883820000 /home/mk/.lldb/module_cache/remote-android/.cache/BF8E41B1-A728-E776-30C1-359AD12FBB20/libcrypto.so 这种。只需要加载对应包含符号表的so即可。e.g. add-dsym /home/mk/Downloads/audio/libaaudio_internal.so

Executable module set to "/home/mk/.lldb/module_cache/remote-android/.cache/C1694CB8-8D61-4EEB-462C-75478ACBA9BD/app_process64".
Architecture set to: aarch64-unknown-linux-android.

(lldb) c
Process 2944 resuming

(lldb) add-dsym /home/mk/Downloads/audio/libaaudio_internal.so 
symbol file '/home/mk/Downloads/audio/libaaudio_internal.so' has been added to '/home/mk/.lldb/module_cache/remote-android/.cache/C056E9D5-E57E-F381-0E8F-89D8E98E7E42/libaaudio_internal.so'

(lldb) image list

 3. 打断点

(lldb) breakpoint set -n AudioPolicyManager::getInputForAttr
Breakpoint 1: where = libaudiopolicymanagerdefault.so`android::AudioPolicyManager::getInputForAttr(audio_attributes_t const*, int*, int, audio_session_t, android::content::AttributionSourceState const&, audio_config_base const*, audio_input_flags_t, int*, android::AudioPolicyInterface::input_type_t*, int*) + 76 at AudioPolicyManager.cpp:2160:5, address = 0x000000000006f84c

(lldb) image lookup -t "AudioPolicyManager::getInputForAttr"
(lldb)

4. 设置源码映射

(lldb) settings set target.source-map ./ /home/aw/backup/AOSP/Android12

(lldb) settings show target.source-map 
target.source-map (path-map) =
[0] "." -> "/home/aw/backup/AOSP/Android12"

(lldb)

Notice: settings set target.source-map path1 path2

path1: 是当前执行目录，在 target create 命令执行后，在最后一行会显示当前执行目录，比如我的是 Current executable set to '/home/aw/Downloads/audioserver' (aarch64).

path2: 是源码目录

5. run

执行 run 之后, 点击 Oboe Tester -> Test Input -> OPEN

   

(lldb) run
Process 4987 launched: '/home/aw/Downloads/audioserver' (aarch64)
(lldb) warning: (aarch64) /home/aw/.lldb/module_cache/remote-android/.cache/190D0C24-B5E1-5A84-F8C1-D24742DF3E62/libvibrator.so No LZMA support found for reading .gnu_debugdata section
warning: (aarch64) / home / aw /.lldb / module_cache / remote - android /.cache / F1F48C4D - 7A1D - 4F1D - AB22 - 092D5265646A / libeffectsconfig.so No LZMA support found for reading.gnu_debugdata section
...

Process 4987 stopped
* thread #1, name = 'audioserver', stop reason = breakpoint 1.1
    frame #0: 0x0000007fb391b84c libaudiopolicymanagerdefault.so`android::AudioPolicyManager::getInputForAttr(this=0x0000007e200d4a30, attr=0x0000007e200d4a30, input=0x0000007fffffe8dc, riid=-1, session=2317193, attributionSource=0x0000007fffffe9f0, config=0x0000007fffffe8d0, flags=AUDIO_INPUT_FLAG_MMAP_NOIRQ, selectedDeviceId=0x0000007fffffe8cc, inputType=0x0000007fffffe8ac, portId=0x0000007fffffe8c8) at AudioPolicyManager.cpp:2160:5
   2157	                                             input_type_t *inputType,
   2158	                                             audio_port_handle_t *portId)
   2159	{
-> 2160	    ALOGV("%s() source %d, sampling rate %d, format %#x, channel mask %#x, session %d, "
   2161	          "flags %#x attributes=%s", __func__, attr->source, config->sample_rate,
   2162	          config->format, config->channel_mask, session, flags, toString(*attr).c_str());
   2163	

(lldb) next
Process 4987 stopped
* thread #1, name = 'audioserver', stop reason = step over
    frame #0: 0x0000007fb391b8dc libaudiopolicymanagerdefault.so`android::AudioPolicyManager::getInputForAttr(this=0x0000007e200d4a30, attr=<unavailable>, input=0x0000007fffffe8dc, riid=-1, session=2317193, attributionSource=0x0000007fffffe9f0, config=0x0000007fffffe8d0, flags=AUDIO_INPUT_FLAG_MMAP_NOIRQ, selectedDeviceId=0x0000007fffffe8cc, inputType=0x0000007fffffe8ac, portId=0x0000007fffffe8c8) at AudioPolicyManager.cpp:2166:37
   2163	
   2164	    status_t status = NO_ERROR;
   2165	    audio_source_t halInputSource;
-> 2166	    audio_attributes_t attributes = *attr;
   2167	    sp<AudioPolicyMix> policyMix;
   2168	    sp<DeviceDescriptor> device;
   2169	    sp<AudioInputDescriptor> inputDesc;
(lldb) 

 Note: 如果没有源码, 则尝试执行查看

(lldb) thread list

(lldb) thread select 你想 test 的线程

(lldb) source list

(lldb) source info

 调试

调试文章有很多，比如 lldb 常用命令与调试技巧