Android内核源码级调试环境搭建

本文描述了搭建Android内核调试的过程，最终达到源码级调试的目的。由于真机调试内核的步骤比较复杂，这里先用模拟器为例。

1 环境&工具

硬件环境	软件环境	工具
模拟器	Android 4.4.2，内核：goldfish3.4	AOSP Prebuilt

2 步骤

可调试的内核需要增加特殊的内核配置选项，所以关键是编译可调试内核，下载编译内核的步骤可以参考《构建内核》，这里只描述编译过程中的一些关键步骤。

2.1 配置内核

使用/arch/arm/configs/goldfish_armv7_defconfig作为内核配置文件进行配置，

root@Tangxx:~/android_source/android_442/kernel/goldfish# export CROSS_COMPILE=arm-eabi-
root@Tangxx:~/android_source/android_442/kernel/goldfish# export SUBARCH=arm
root@Tangxx:~/android_source/android_442/kernel/goldfish# export ARCH=arm
root@Tangxx:~/android_source/android_442/kernel/goldfish# make goldfish_armv7_defconfig
  HOSTCC  scripts/basic/fixdep
  HOSTCC  scripts/kconfig/conf.o
  SHIPPED scripts/kconfig/zconf.tab.c
  SHIPPED scripts/kconfig/zconf.lex.c
  SHIPPED scripts/kconfig/zconf.hash.c
  HOSTCC  scripts/kconfig/zconf.tab.o
  HOSTLD  scripts/kconfig/conf
#
# configuration written to .config
#

2.2 修改内核配置选项

修改goldfish/.config配置文件，确保一下几项配置选项开启，

CONFIG_HIGHMEM=y #允许设置模拟器内存
CONFIG_DEBUG_INFO=y #显示vmlinux符号
CONFIG_DEBUG_KERNEL=y #开启内核调试
CONFIG_KGDB=y #开启kgdb

2.3 编译

root@Tangxx:~/android_source/android_442/kernel/goldfish#make
…
Kernel: arch/arm/boot/zImage is ready

2.4 启动模拟器

root@Tangxx:~/android_source/android_442/kernel/goldfish# emulator -verbose -show-kernel -kernel ./arch/arm/boot/zImage -qemu -s –S

启动时间有点长，耐心等待，启动完成后打开手机设置验证一下，

2.5 调试

打开另外一个终端启动调试器，加载内核符号，

root@Tangxx:~/android_source/android_442# cd kernel/goldfish
root@Tangxx:~/android_source/android_442/kernel/goldfish# arm-eabi-gdb ./vmlinuxGNU gdb (GDB) 7.3.1-gg2
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=x86_64-linux-gnu --target=arm-linux-android".
For bug reporting instructions, please see:
<http://source.android.com/source/report-bugs.html>...
Reading symbols from /root/android_source/android_442/kernel/goldfish/vmlinux...done.

链接默认的1234端口就可以进行调试内核了，

(gdb) target remote :1234
Remote debugging using :1234
?? () at arch/arm/kernel/entry-armv.S:1181
1181        W(b)    vector_rst
(gdb) list
1176        .globl  vector_fiq_offset
1177        .equ    vector_fiq_offset, vector_fiq
1178    
1179        .section .vectors, "ax", %progbits
1180    __vectors_start:
1181        W(b)    vector_rst
1182        W(b)    vector_und
1183        W(ldr)  pc, __vectors_start + 0x1000
1184        W(b)    vector_pabt
1185        W(b)    vector_dabt
(gdb) c
Continuing.
^C
Program received signal SIGINT, Interrupt.
cpu_v7_do_idle () at arch/arm/mm/proc-v7.S:74
74      mov pc, lr
(gdb) list
69   *  IRQs are already disabled.
70   */
71  ENTRY(cpu_v7_do_idle)
72      dsb                 @ WFI may enter a low-power mode
73      wfi
74      mov pc, lr
75  ENDPROC(cpu_v7_do_idle)
76  
77  ENTRY(cpu_v7_dcache_clean_area)
78  #ifndef TLB_CAN_READ_FROM_L1_CACHE
(gdb) disas
Dump of assembler code for function cpu_v7_do_idle:
   0xc00158e0 <+0>: dsb sy
   0xc00158e4 <+4>: wfi
=> 0xc00158e8 <+8>: mov pc, lr
End of assembler dump.