ramdump crash工具

一.怎麼抓取kernel ramdump

 

1.手機準備

到代碼的根目錄 執行

python vendor/xiaomi/securebootsigner/Qualcomm/tools/debugpolicy.py
然後會自動重啓
第二步
重啓之後 需要有root
adb root
adb shell "echo 1 > /sys/module/msm_poweroff/parameters/download_mode"
如何確認是否打開 download mode
adb shell "cat /sys/module/msm_poweroff/parameters/download_mode"
返回值是1 就可以了
如果重啓手機了，需要重新執行第二步
復現之後 如果是底層重啓，手機會進入黑屏狀態，連上linux lsusb 查看 會有一個 900e 或者 9091的設備
此時用高通qpst configuration 抓dump 就行了。（裝好qpst 打開 qpst configuration， 手機連接電腦，如果是900e的話，會自動抓 dump的）
備註：因爲很多watchdog問題都是線程D狀態引起的，所以我們再分析類似問題的時候是需要ramdump的，我們再測試的時候最好setprop persist.sys.crashOnWatchdog true. 這樣的話，發生watchdog問題的時候會自動進入到抓ramdump的模式下，然後就能最大限度的保留現場，以便後續分析。

2.qpst環境搭建

安裝包下載路徑：
http://note.youdao.com/noteshare?id=4b317b88f46638ec8af54953864f7116
分別解壓安裝：
1.qpst.win.2.7_installer_00472.4.zip
2.qxdm.win.4.0_installer_00210.1.zip
3.QUD.WIN.1.1+Installer-10039.2.rar

 

二.怎麼分析kernel ramdump

1.crash工具安裝

首先需要安裝一改crash工具，安裝包下載鏈接：
http://note.youdao.com/noteshare?id=3253867a92a3315187eb8f1b22703924

解壓後，把工具的路徑配置到環境變量中：export PATH=$PATH:/home/pzc/tools/qcrash

 

2.怎麼加載ramdump

我們抓到的ramdump的文件大概如下：

pzc@pzc-K56CM:~/log/C8/c8-ramdump$ ls
CODERAM.BIN   DDRCS1_0.BIN  dump_info.txt  IPA_HRAM.BIN  IPA_SRAM.BIN  logcat.bin  PART_BIN.BIN  PMON_HIS.BIN  vmlinux-ee0535c
DATARAM.BIN   DDRCS1_1.BIN  IPA_DICT.BIN   IPA_IRAM.BIN  lastkmsg.txt  MSGRAM.BIN  PIMEM.BIN     RST_STAT.BIN
DDRCS0_0.BIN  DDR_DATA.BIN  IPA_DRAM.BIN   IPA_MBOX.BIN  load.cmm      OCIMEM.BIN  PMIC_PON.BIN  tz_log.txt

第一步：

 

pzc@pzc-K56CM:~/log/C8/c8-ramdump$ hexdump  -e '16/4 "%08x " "\n"' -s 0x03f6d4 -n 8 OCIMEM.BIN
94800000 0000000a 

 

取得--kaslr 的地址：94800000 0000000a

第二步：

確保--kaslr 後跟的地址正確：0xa94800000

 

pzc@pzc-K56CM:~/log/C8/c8-ramdump$ crash64 vmlinux-ee0535c DDRCS0_0.BIN@0x0000000080000000,DDRCS1_0.BIN@0x0000000100000000,DDRCS1_1.BIN@0x0000000180000000 --kaslr 0xa94800000
 
crash64 7.1.9
Copyright (C) 2002-2016  Red Hat, Inc.
Copyright (C) 2004, 2005, 2006, 2010  IBM Corporation
Copyright (C) 1999-2006  Hewlett-Packard Co
Copyright (C) 2005, 2006, 2011, 2012  Fujitsu Limited
Copyright (C) 2006, 2007  VA Linux Systems Japan K.K.
Copyright (C) 2005, 2011  NEC Corporation
Copyright (C) 1999, 2002, 2007  Silicon Graphics, Inc.
Copyright (C) 1999, 2000, 2001, 2002  Mission Critical Linux, Inc.
This program is free software, covered by the GNU General Public License,
and you are welcome to change it and/or distribute copies of it under
certain conditions.  Enter "help copying" to see the conditions.
This program has absolutely no warranty.  Enter "help warranty" for details.
 
GNU gdb (GDB) 7.6
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=x86_64-unknown-linux-gnu --target=aarch64-elf-linux"...
please wait... (patching 161877 gdb minimal_symbol values)

 

2.分析ramdump

等待大概兩分鐘就會進入調試模式：

WARNING: cannot determine starting stack frame for task ffffffce2f11cb00
      KERNEL: vmlinux-ee0535c           
   DUMPFILES: /var/tmp/ramdump_elf_uvwal1 [temporary ELF header]
              DDRCS0_0.BIN
              DDRCS1_0.BIN
              DDRCS1_1.BIN
        CPUS: 8
        DATE: Thu Jan  4 09:26:45 2018
      UPTIME: 00:02:09
LOAD AVERAGE: 6.68, 2.96, 1.12
       TASKS: 2833
    NODENAME: localhost
     RELEASE: 4.4.21-perf-g91f9a92-00622-gee0535c
     VERSION: #1 SMP PREEMPT Thu Dec 21 03:26:45 CST 2017
     MACHINE: aarch64  (unknown Mhz)
      MEMORY: 5.7 GB
       PANIC: "Unable to handle kernel NULL pointer dereference at virtual address 00000200"
         PID: 0
     COMMAND: "swapper/0"
        TASK: ffffff8a9ec15750  (1 of 8)  [THREAD_INFO: ffffff8a9ec00000]
         CPU: 0
       STATE: TASK_RUNNING 
     WARNING: panic task not found
 
 
crash64> 

我們可以看當前存在的D狀態的進程：

crash64> ps | grep "UN"
     59      2   1  ffffffce34ddbe80  UN   0.0       0      0  [kworker/u16:1]
    163      2   0  ffffffcd35344b00  UN   0.0       0      0  [mdss_dsi_event]
    326      2   3  ffffffce33031900  UN   0.0       0      0  [irq/265-synapti]
    431      2   0  ffffffcd349bf080  UN   0.0       0      0  [mmc-cmdqd/0]
    501      2   2  ffffffcd3451e400  UN   0.0       0      0  [msm-core:sampli]
    692      1   0  ffffffce2f11d780  UN   0.5  184732  41064  surfaceflinger

切換到326進程：

crash64> set 326
    PID: 326
COMMAND: "irq/265-synapti"
   TASK: ffffffce33031900  [THREAD_INFO: ffffffcd34fec000]
    CPU: 3
  STATE: TASK_UNINTERRUPTIBLE 
crash64> 

查看當前進程的調用棧：

crash64> bt
PID: 326    TASK: ffffffce33031900  CPU: 3   COMMAND: "irq/265-synapti"
 #0 [ffffffcd34fef360] __switch_to at ffffff8a9c885560
 #1 [ffffffcd34fef390] __schedule at ffffff8a9d6ecd18
 #2 [ffffffcd34fef3f0] schedule at ffffff8a9d6ed07c
 #3 [ffffffcd34fef410] do_exit at ffffff8a9c8a3d7c
 #4 [ffffffcd34fef480] die at ffffff8a9c88864c
 #5 [ffffffcd34fef4d0] __do_kernel_fault at ffffff8a9c8991a0
 #6 [ffffffcd34fef500] do_translation_fault at ffffff8a9c8975dc
 #7 [ffffffcd34fef540] do_mem_abort at ffffff8a9c880ad8
 #8 [ffffffcd34fef720] el1_da at ffffff8a9c883cf8
     PC: ffffff8a9c8bc178  [kthread_data+4]
     LR: ffffff8a9c8f74a8  [irq_thread_dtor+68]
     SP: ffffffcd34fef720  PSTATE: 60000145
    X29: ffffffcd34fef720  X28: ffffffcd34fec000  X27: 0000000000000005
    X26: 0000000000000001  X25: ffffff8a9ec05000  X24: ffffffcd34fef7d0
    X23: ffffff8a9ec17000  X22: 0000000000000000  X21: ffffff8a9ef8f000
    X20: ffffffce33031900  X19: ffffffce33031900  X18: 0000000000000010
    X17: 000000000000000e  X16: 0000000000000007  X15: ffffff8a9d8c0000
    X14: 2d6d64742d696164  X13: 00000000001c1f9e  X12: 0000000000989680
    X11: 0000000041acdf40  X10: ffffffce3d4ffc78   X9: ffffffce3d4ffc88
     X8: ffffffcd34f4f320   X7: 0000000000000000   X6: 0000000000000004
     X5: 00000000036399ed   X4: ffffffce33032018   X3: 0000000000000000
     X2: 0000000000000000   X1: ffffff8a9c8f7464   X0: 0000000000000000
 #9 [ffffffcd34fef740] task_work_run at ffffff8a9c8ba24c
#10 [ffffffcd34fef770] do_exit at ffffff8a9c8a4074
#11 [ffffffcd34fef7e0] die at ffffff8a9c88864c
#12 [ffffffcd34fef830] __do_kernel_fault at ffffff8a9c8991a0
#13 [ffffffcd34fef860] do_page_fault at ffffff8a9c8974d0
#14 [ffffffcd34fef8d0] do_translation_fault at ffffff8a9c897574
#15 [ffffffcd34fef910] do_mem_abort at ffffff8a9c880ad8
#16 [ffffffcd34fefaf0] el1_da at ffffff8a9c883cf8
     PC: ffffff8a9cfca228  [synaptics_rmi4_add_and_update_tp_data+36]
     LR: ffffff8a9cfa9ff0  [input_event+524]
     SP: ffffffcd34fefaf0  PSTATE: 80000005
    X29: ffffffcd34fefaf0  X28: 0000000000000000  X27: 0000000000000005
    X26: 0000000000000001  X25: ffffffcd34849000  X24: 0000000000000003
    X23: ffffff8a9ec06000  X22: 0000000000000036  X21: ffffffcd34fefbf8
    X20: ffffff8a9ec06000  X19: ffffffcd34848800  X18: 0000000000000060
    X17: 000000000000000e  X16: 0000000000000007  X15: ffffff8a9d8c0000
    X14: 0000000000000000  X13: 00000000001b1c92  X12: 0000000000989680
    X11: 0000000040ffdb77  X10: 00000000000008c0   X9: ffffffcd34fec000

好了，環境搭建和初步的調試就是這樣了，具體問題再具體分析吧。後邊會說一個分析的實例

https://blog.csdn.net/aa787282301/article/details/79431214

https://blog.csdn.net/aa787282301/article/details/81413242