嵌入式Linux驱动学习【16】—— 驱动调试oops

1 问题

  在led驱动中，制造错误，打印log。在open中加入

unsigned long * gpfcon = (unsigned long *)0x56000050;
*gpfcon = 1;

  装载模块，并用测试程序打开时，出错，记录log。其中可以看到PC值、栈回溯等信息。

Unable to handle kernel paging request at virtual address 56000050
pgd = c3ae0000
[56000050] *pgd=00000000
Internal error: Oops: 805 [#1]
last sysfs file: /sys/devices/virtual/vc/vcs4/dev
Modules linked in: s3c24xx_leds
CPU: 0    Not tainted  (2.6.32.2-FriendlyARM #10)
PC is at s3c24xx_leds_open+0x18/0x54 [s3c24xx_leds]
LR is at chrdev_open+0xd0/0x16c
pc : [<bf000018>]    lr : [<c00a031c>]    psr: a0000013
sp : c3a39e20  ip : c3a39e38  fp : c3a39e34
r10: c3965980  r9 : 00000000  r8 : c34fd200
r7 : c3a76a80  r6 : c349ecc0  r5 : c39d2dc0  r4 : fffffff1
r3 : 56000000  r2 : 00000001  r1 : c3a76a80  r0 : c349ecc0
Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: c000717f  Table: 33ae0000  DAC: 00000015
Process led_test (pid: 745, stack limit = 0xc3a38270)
Stack: (0xc3a39e20 to 0xc3a3a000)
9e20: 00000000 c39d2dc0 c3a39e5c c3a39e38 c00a031c bf000010 c349ecc0 00000000
9e40: 00000000 c3a76a80 c349ecc0 c00a024c c3a39e84 c3a39e60 c009b950 c00a025c
9e60: c3a76a80 c3a7d300 00000001 ffffff9c 00000024 c3a39ed0 c3a39ea4 c3a39e88
9e80: c009bbe8 c009b88c 00000000 c3a7d300 00000000 00000000 c3a39f64 c3a39ea8
9ea0: c00a90c0 c009bb94 00000000 00000000 c3a39ef4 c0474818 00000000 beb65e94
9ec0: c0474868 00000000 00000000 000090fc c3965980 c34fd200 ffffffff c3a39f34
9ee0: c3a41000 00000000 c3407200 00000101 00000001 00000000 c0030ac0 c003025c
9f00: c3a41000 00065d4c 00000fff 00000000 00065d4c 00001000 00000003 00000001
9f20: 00000000 c3a76a80 00000000 c3a38000 c3a39f64 c3a39f40 c00b2584 00000003
9f40: c3a41000 00000000 beb65e94 ffffff9c c3a38000 00000000 c3a39f94 c3a39f68
9f60: c009b7a0 c00a8b08 00000000 c014f44c c3a39fa4 00008a74 00000000 00008a2c
9f80: 00000005 c00310c8 c3a39fa4 c3a39f98 c009b858 c009b740 00000000 c3a39fa8
9fa0: c0030f20 c009b844 00008a74 00000000 00065d4c 00000000 beb65e94 00000003
9fc0: 00008a74 00000000 00008a2c 00000005 00000000 00000000 00000000 beb65d34
9fe0: 00000000 beb65d18 000082a0 0001305c 60000010 00065d4c 00000000 00000000
Backtrace: 
[<bf000000>] (s3c24xx_leds_open+0x0/0x54 [s3c24xx_leds]) from [<c00a031c>] (chrdev_open+0xd0/0x16c)
 r5:c39d2dc0 r4:00000000
[<c00a024c>] (chrdev_open+0x0/0x16c) from [<c009b950>] (__dentry_open+0xd4/0x274)
 r7:c00a024c r6:c349ecc0 r5:c3a76a80 r4:00000000
[<c009b87c>] (__dentry_open+0x0/0x274) from [<c009bbe8>] (nameidata_to_filp+0x64/0x6c)
[<c009bb84>] (nameidata_to_filp+0x0/0x6c) from [<c00a90c0>] (do_filp_open+0x5c8/0x860)
 r5:00000000 r4:00000000
[<c00a8af8>] (do_filp_open+0x0/0x860) from [<c009b7a0>] (do_sys_open+0x70/0xf0)
[<c009b730>] (do_sys_open+0x0/0xf0) from [<c009b858>] (sys_open+0x24/0x28)
 r8:c00310c8 r7:00000005 r6:00008a2c r5:00000000 r4:00008a74
[<c009b834>] (sys_open+0x0/0x28) from [<c0030f20>] (ret_fast_syscall+0x0/0x28)
Code: e24cb004 e3a02001 e3a03456 e3e0400e (e5832050) 
---[ end trace 5b2d9447b9e43301 ]---
Segmentation fault

  若没有栈回溯，可在.config中，打开配置项CONFIG_FRAME_POINTER

2 查找原因

（1）根据PC值找到具体哪个函数出问题
  上面的log以给出出错模块，有时log中可能只有PC值，可通过以下方法确认。
  1）PC值位于内核还是装载的驱动模块
  在内核源码的根目录下通过的“vi System.map”来查看内核地址范围。
  2）若是加载的驱动程序引入的错误，确定是哪一个驱动程序

cat /proc/kallsyms

（2）若是加载的模块出错
  找到问题模块，反汇编

arm-linux-objdump -D 26th_segmentfault.ko >26th_segmentfault.dis //反汇编

（3）若发生错误的驱动位于内核的地址值时
  在内核源码目录下反汇编，根据PC查找地址。

arm-none-linux-gnueabi-objdump -D vmlinux > vmlinux.dis

（4）只有栈信息
  当出错时没有回溯信息，只有栈信息时，将栈信息对照vmlinux.dis，查看回溯调用关系。