[FAQ13941]如何分析kernel panic？

FAQs 20 of 127

User版本开机异常/无法开机，如何抓取log 如何在User版本开启串口(Uart),抓取上层Log,开启输入控制台

内容 [DESCRIPTION] 当kernel发生异常时，会在重启后生成对应的db，用GAT的logviewer可以解开，如果是普通的KE或HWT，并且存在SYS_MINI_RDUMP或者SYS_COREDUMP，则可以借助gdb/crash进一步debug，否则只能查看log分析问题的可能性了。   [SOLUTION] 以下两个方法都需要对应的vmlinux，详情请查看FAQ06985。 1. 存在SYS_MINI_RDUMP并且其大小>32KB（太小则可能文件错误） 使用gdb分析 windows下，gdb可以使用NDK里的或者是GAT里的：gat-win32-3\prebuilt\android-sdk\bin\startGDB.bat（32bit kernel）或startGDB64.bat（64bit kernel） linux下，可以使用prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.8/bin/arm-linux-androideabi-gdb （32bit kernel）或prebuilts/gcc/linux-x86/aarch64/arch64-linux-android-4.9/bin/aarch64-linux-android-gdb（64bit kernel）。其中的4.8或4.9是版本，最好使用最新的版本。 直接启动gdb，进入gdb命令行，然后将vmlinux和SYS_MINI_RDUMP放到gdb所在的目录中，直接输入如下命令： file vmlinux core SYS_MINI_RDUMP bt 最后的bt是查看当前的调用栈，其他命令的话，直接到官方网站看手册即可。 如果是HWT（看门狗复位），可以通过info threads看到其他CPU的状态和调用栈，用thread 2/3/4...切换不同的CPU，thread 2 => 切换到CPU0，thread 3 => 切换到CPU1，以此类推。 使用trace32分析 将匹配的vmlinux放入db解开的目录中，将以下内容保存成debug.cmm： [XML] hide 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 local &off       if os.file.size("SYS_MINI_RDUMP")<=0x2000   (     dialog     (     header "File is incomplete"     pos 0. 0. 26. 1.     text "SYS_MINI_RDUMP is incomplete."     pos 1. 3. 22. 1.     defbutton "OK" "quit"     close "quit"     )     enddo   )   do ~~/t32.cmm   system.reset   d.load.binary SYS_MINI_RDUMP VM:0--0x2000   if d.word(VM:0x12)==0xb7   (     system.cpu CortexA53   )   if d.word(VM:0x12)==0x28   (     system.cpu CortexA7   )   system.up       d.load.elf symbols\vmlinux /nc   d.load.elf SYS_MINI_RDUMP /nc /nosymbol /logload       if d.word(VM:0x12)==0xb7   (     &off=d.quad(VM:0x48)     &off=&off+0xc+((d.long(VM:&off)+3)&~3)+((d.long(VM:(&off+4))+3)&~3)     &off=&off+0xc+((d.long(VM:&off)+3)&~3)+0x70     r.s CPSR d.quad(VM:(&off+0x108))     r.s X0 d.quad(VM:(&off+0x00))     r.s X1 d.quad(VM:(&off+0x08))     r.s X2 d.quad(VM:(&off+0x10))     r.s X3 d.quad(VM:(&off+0x18))     r.s X4 d.quad(VM:(&off+0x20))     r.s X5 d.quad(VM:(&off+0x28))     r.s X6 d.quad(VM:(&off+0x30))     r.s X7 d.quad(VM:(&off+0x38))     r.s X8 d.quad(VM:(&off+0x40))     r.s X9 d.quad(VM:(&off+0x48))     r.s X10 d.quad(VM:(&off+0x50))     r.s X11 d.quad(VM:(&off+0x58))     r.s X12 d.quad(VM:(&off+0x60))     r.s X13 d.quad(VM:(&off+0x68))     r.s X14 d.quad(VM:(&off+0x70))     r.s X15 d.quad(VM:(&off+0x78))     r.s X16 d.quad(VM:(&off+0x80))     r.s X17 d.quad(VM:(&off+0x88))     r.s X18 d.quad(VM:(&off+0x90))     r.s X19 d.quad(VM:(&off+0x98))     r.s X20 d.quad(VM:(&off+0xA0))     r.s X21 d.quad(VM:(&off+0xA8))     r.s X22 d.quad(VM:(&off+0xB0))     r.s X23 d.quad(VM:(&off+0xB8))     r.s X24 d.quad(VM:(&off+0xC0))     r.s X25 d.quad(VM:(&off+0xC8))     r.s X26 d.quad(VM:(&off+0xD0))     r.s X27 d.quad(VM:(&off+0xD8))     r.s X28 d.quad(VM:(&off+0xE0))     r.s X29 d.quad(VM:(&off+0xE8))     r.s X30 d.quad(VM:(&off+0xF0))     r.s SP d.quad(VM:(&off+0xF8))     r.s PC d.quad(VM:(&off+0x100))   )   if d.word(VM:0x12)==0x28   (     &off=d.long(VM:0x38)     &off=&off+0xc+((d.long(VM:&off)+3)&~3)+((d.long(VM:(&off+4))+3)&~3)     &off=&off+0xc+((d.long(VM:&off)+3)&~3)+0x48     r.s CPSR d.long(VM:(&off+0x40))     r.s R0 d.long(VM:(&off+0x00))     r.s R1 d.long(VM:(&off+0x04))     r.s R2 d.long(VM:(&off+0x08))     r.s R3 d.long(VM:(&off+0x0c))     r.s R4 d.long(VM:(&off+0x10))     r.s R5 d.long(VM:(&off+0x14))     r.s R6 d.long(VM:(&off+0x18))     r.s R7 d.long(VM:(&off+0x1c))     r.s R8 d.long(VM:(&off+0x20))     r.s R9 d.long(VM:(&off+0x24))     r.s R10 d.long(VM:(&off+0x28))     r.s R11 d.long(VM:(&off+0x2c))     r.s R12 d.long(VM:(&off+0x30))     r.s R13 d.long(VM:(&off+0x34))     r.s R14 d.long(VM:(&off+0x38))     r.s R15 d.long(VM:(&off+0x3c))   )       setup.v %hex.on %string.on   winclear   winpos 0% 0% 50% 100%   w.v.f /a /l   winpos 50% 0%   w.r   winpos 50% 30%   d.l 然后用Trace32加载debug.cmm，如果是32位的，需要用ARM32的trace32加载，如果是64位的则是ARM64的trace32加载。 2. 存在SYS_COREDUMP（该文件是否存在请看[FAQ13784]ramdump介绍） 使用gdb分析 linux下，使用crash，crash搭建请看FAQ13939。 将vmlinux和SYS_CORE_DUMP放到crash所在的目录中，直接输入：crash vmlinux SYS_COREDUMP即可进入crash命令行： bt bt是查看当前的调用栈，其他命令的话，直接到官方网站看手册即可。 使用trace32分析 将匹配的vmlinux放入db解开的目录中，将以下内容保存成debug.cmm： [XML] hide 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 local &off       if os.file.size("SYS_COREDUMP")<=0x2000   (     dialog     (     header "File is incomplete"     pos 0. 0. 26. 1.     text "SYS_COREDUMP is incomplete."     text "May be HW reboot db?"     pos 2. 3. 22. 1.     defbutton "OK" "quit"     close "quit"     )     enddo   )   do ~~/t32.cmm   system.reset   d.load.binary SYS_COREDUMP VM:0--0x2000   if d.word(VM:0x12)==0xb7   (     system.cpu CortexA53   )   if d.word(VM:0x12)==0x28   (     system.cpu CortexA7   )   system.option mmuspaces on   system.up       d.load.elf symbols\vmlinux /nc   d.load.elf SYS_COREDUMP /nc /nosymbol /physload       if d.word(VM:0x12)==0xb7   (     &off=d.quad(VM:0x48)     &off=&off+0xc+((d.long(VM:&off)+3)&~3)+((d.long(VM:(&off+4))+3)&~3)     &off=&off+0xc+((d.long(VM:&off)+3)&~3)+((d.long(VM:(&off+4))+3)&~3)     &off=&off+0xc+((d.long(VM:&off)+3)&~3)+0x70     r.s CPSR d.quad(VM:(&off+0x108))     r.s X0 d.quad(VM:(&off+0x00))     r.s X1 d.quad(VM:(&off+0x08))     r.s X2 d.quad(VM:(&off+0x10))     r.s X3 d.quad(VM:(&off+0x18))     r.s X4 d.quad(VM:(&off+0x20))     r.s X5 d.quad(VM:(&off+0x28))     r.s X6 d.quad(VM:(&off+0x30))     r.s X7 d.quad(VM:(&off+0x38))     r.s X8 d.quad(VM:(&off+0x40))     r.s X9 d.quad(VM:(&off+0x48))     r.s X10 d.quad(VM:(&off+0x50))     r.s X11 d.quad(VM:(&off+0x58))     r.s X12 d.quad(VM:(&off+0x60))     r.s X13 d.quad(VM:(&off+0x68))     r.s X14 d.quad(VM:(&off+0x70))     r.s X15 d.quad(VM:(&off+0x78))     r.s X16 d.quad(VM:(&off+0x80))     r.s X17 d.quad(VM:(&off+0x88))     r.s X18 d.quad(VM:(&off+0x90))     r.s X19 d.quad(VM:(&off+0x98))     r.s X20 d.quad(VM:(&off+0xA0))     r.s X21 d.quad(VM:(&off+0xA8))     r.s X22 d.quad(VM:(&off+0xB0))     r.s X23 d.quad(VM:(&off+0xB8))     r.s X24 d.quad(VM:(&off+0xC0))     r.s X25 d.quad(VM:(&off+0xC8))     r.s X26 d.quad(VM:(&off+0xD0))     r.s X27 d.quad(VM:(&off+0xD8))     r.s X28 d.quad(VM:(&off+0xE0))     r.s X29 d.quad(VM:(&off+0xE8))     r.s X30 d.quad(VM:(&off+0xF0))     r.s SP d.quad(VM:(&off+0xF8))     r.s PC d.quad(VM:(&off+0x100))     per.s spr:0x30201 %quad d.quad(VM:0x90)+0x7d000     per.s spr:0x30202 %quad 0x00000032B5193519     per.s spr:0x30100 %quad 0x0000000004C5D93D     trans.common 0xFFFFFF8000000000--0xFFFFFFFFFFFFFFFF     task.config "~~/demo/arm64/kernel/linux/linux-3.x/linux3"     menu.rp "~~/demo/arm64/kernel/linux/linux-3.x/linux"     task.setdir "~~/demo/arm64/kernel/linux/linux-3.x/"     y.autoload.checklinux "do ~~/demo/arm64/kernel/linux/linux-3.x/autoload "   )   if d.word(VM:0x12)==0x28   (     &off=d.long(VM:0x38)     &off=&off+0xc+((d.long(VM:&off)+3)&~3)+((d.long(VM:(&off+4))+3)&~3)     &off=&off+0xc+((d.long(VM:&off)+3)&~3)+((d.long(VM:(&off+4))+3)&~3)     &off=&off+0xc+((d.long(VM:&off)+3)&~3)+0x48     r.s CPSR d.long(VM:(&off+0x40))     r.s R0 d.long(VM:(&off+0x00))     r.s R1 d.long(VM:(&off+0x04))     r.s R2 d.long(VM:(&off+0x08))     r.s R3 d.long(VM:(&off+0x0c))     r.s R4 d.long(VM:(&off+0x10))     r.s R5 d.long(VM:(&off+0x14))     r.s R6 d.long(VM:(&off+0x18))     r.s R7 d.long(VM:(&off+0x1c))     r.s R8 d.long(VM:(&off+0x20))     r.s R9 d.long(VM:(&off+0x24))     r.s R10 d.long(VM:(&off+0x28))     r.s R11 d.long(VM:(&off+0x2c))     r.s R12 d.long(VM:(&off+0x30))     r.s R13 d.long(VM:(&off+0x34))     r.s R14 d.long(VM:(&off+0x38))     r.s R15 d.long(VM:(&off+0x3c))     per.s c15:0x2 %long d.long(VM:0x60)+0x4000     per.s c15:0x1 %long 1     trans.common 0xBF000000--0xFFFFFFFF     task.config "~~/demo/arm/kernel/linux/linux.t32"     menu.rp "~~/demo/arm/kernel/linux/linux.men"     task.setdir "~~/demo/arm/kernel/linux/"     y.autoload.checklinux "do ~~/demo/arm/kernel/linux/autoload "   )   trans.tablewalk on   trans.on   mmu.scan   help.filter.add rtoslinux   task.y.o mmuscan off   task.y.o rootpath "./"   task.y.o al m   task.y.o al cl   task.y.o al vm   task.o nm arg0comm   y.autoload.check   task.check       setup.v %hex.on %string.on   winclear   winpos 0% 0% 50% 100%   w.v.f /a /l   winpos 50% 0%   w.r   winpos 50% 30%   d.l 然后用Trace32加载debug.cmm，如果是32位的，需要用ARM32的trace32加载，如果是64位的则是ARM64的trace32加载。