| 内核调试配置选项 | 描述 |
|---|---|
| CONFIG_DEBUG_LIST | 开启对使用 list.h 头文件执行标准链表操作的检查。如果指针不匹配,系统会打印警告,随后触发 BUG_ON 崩溃。 |
| CONFIG_PAGE_POISONING | 在调用 free_pages() 后,用毒化模式 (PAGE_POISON 0xaa) 填充页面。 |
| CONFIG_DEBUG_PAGEALLOC | 在调用 alloc_pages() 之前验证这些模式。 |
| CONFIG_DEBUG_USER | 当系统由于分段错误(segfault)或无效指令而终止用户空间进程时打印消息,例如 arch/arm/Kconfig.debug 文件中的 user_debug=31。将该内核启动参数添加到 BoardConfig.mk 文件中。 |
| CONFIG_DEBUG_SPINLOCK | 识别缺失的自旋锁初始化和常见的自旋锁错误,例如: |
- 在自旋锁上等待超过一秒
- 释放已被释放的锁
- 重新初始化已被使用的锁
| CONFIG_DEBUG_MUTEXES | 检测 Mutex 语义违规。 |
|---|---|
| DEBUG_LOCK_ALLOC | 检测对活动锁的错误释放。 |
| CONFIG_SLUB CONFIG_SLUB_DEBUG | 通过为 use-after-free (0x6b) 和 buffer-overflow-padding (0xbb) 添加毒化标记,执行额外检查以检测内核内部内存分配结构的损坏。 |
| 用于额外调试的内核调试配置选项,可能产生冗长输出并使系统变慢。 | |
| CONFIG_DEBUG_ATOMIC_SLEEP | 使可能睡眠的例程在原子区段内被调用时发出告警。 |
| DEBUG_SPINLOCK_SLEEP | 使可能睡眠的例程在持有自旋锁时被调用时发出告警。 |
| CONFIG_DEBUG_VM, CONFIG_DEBUG_HIGHMEM | 为虚拟内存管理损坏问题提供额外的调试支持。 |
| CONFIG_DEBUG_OBJECTS | 跟踪各种对象的生命周期并验证对这些对象的操作。 |
链表损坏问题
要识别以下指示链表损坏问题的崩溃特征,请启用CONFIG_DEBUG_LIST 选项。
示例崩溃特征 1
\<4\> WARNING: at kernel/lib/list\_debug.c:60 \_\_list\_del\_entry\+0xa0/0xd0()
\<6\> list\_del corruption. prev-\>next should be c6fc374c, but was c18d804c
\<6\> Modules linked in: adsprpc
\<6\> \[\<c010cc94\>\] (unwind\_backtrace\+0x0/0x138) from \[\<c018ad54\>\] (warn\_slowpath\_common\+0x4c/0x64)
\<6\> \[\<c018ad54\>\] (warn\_slowpath\_common\+0x4c/0x64) from \[\<c018ae00\>\] (warn\_slowpath\_fmt\+0x30/0x40)
\<6\> \[\<c018ae00\>\] (warn\_slowpath\_fmt\+0x30/0x40) from \[\<c03b3128\>\] (\_\_list\_del\_entry\+0xa0/0xd0)
\<6\> \[\<c03b3128\>\] (\_\_list\_del\_entry\+0xa0/0xd0) from \[\<c01bc968\>\] (account\_entity\_dequeue\+0x84/0x94)
\<6\> \[\<c01bc968\>\] (account\_entity\_dequeue\+0x84/0x94) from \[\<c01bdaa4\>\] (dequeue\_task\_fair\+0x64/0x190)
\<4\>WARNING: at kernel/lib/list\_debug.c:52 \_\_list\_del\_entry\+0x8c/0xac()
\<4\> list\_del corruption, e240c500-\>prev is LIST\_POISON2 (00200200)
\<4\> Modules linked in: wlan(PO) cfg80211 adsp\_loader
\<4\> \[\<c001498c\>\] (unwind\_backtrace\+0x0/0x11c)
from \[\<c0068c90\>\] (warn\_slowpath\_common\+0x4c/0x64)
\<4\> \[\<c0068c90\>\] (warn\_slowpath\_common\+0x4c/0x64)
from \[\<c0068d28\>\] (warn\_slowpath\_fmt\+0x2c/0x3c)
\<4\> \[\<c0068d28\>\] (warn\_slowpath\_fmt\+0x2c/0x3c)
from \[\<c023ef94\>\] (\_\_list\_del\_entry\+0x8c/0xac)
\<4\> \[\<c023ef94\>\] (\_\_list\_del\_entry\+0x8c/0xac)
from \[\<c023efc0\>\] (list\_del\+0xc/0x24)
\<4\> \[\<c023efc0\>\] (list\_del\+0xc/0x24)
from \[\<c043c78c\>\] (binder\_thread\_read\+0x488/0xb70)
\<4\> \[\<c043c78c\>\] (binder\_thread\_read\+0x488/0xb70)
from \[\<c043d094\>\] (binder\_ioctl\+0x220/0x5b8)
\<4\> WARNING: at kernel/lib/list\_debug.c:47 \_\_list\_del\_entry\+0x90/0xb0()
\<4\> list\_del corruption, d6ed3720-\>next is LIST\_POISON1 (00100100)
\<4\> Modules linked in:
\<4\> \[\] (unwind\_backtrace\+0x0/0x12c) from \[\] (warn\_slowpath\_common\+0x4c/0x64)
\<4\> \[\] (warn\_slowpath\_common\+0x4c/0x64) from \[\] (warn\_slowpath\_fmt\+0x2c/0x3c)
\<4\> \[\] (warn\_slowpath\_fmt\+0x2c/0x3c) from \[\] (\_\_list\_del\_entry\+0x90/0xb0)
\<4\> \[\] (\_\_list\_del\_entry\+0x90/0xb0) from \[\] (list\_del\+0xc/0x28)
\<4\> \[\] (list\_del\+0xc/0x28) from \[\] (bam\_mux\_write\_done\+0x34/0x11c)
识别自旋锁损坏问题
要识别指示自旋锁损坏问题的崩溃特征,请启用CONFIG_DEBUG_SPINLOCK 和 CONFIG_DEBUG_MUTEXES 内核配置选项。
示例崩溃特征 1
\<0\>BUG: spinlock lockup on CPU#1, ndroid.launcher/1071
\<0\> lock: 0xd5e8f480, .magic: dead4ead, .owner: \<none\>/-1, .owner\_cpu: -1
\<4\> \[\<c0734d84\>\] (spin\_dump\+0x74/0x84) from \[\<c028f8fc\>\]
(do\_raw\_spin\_lock\+0x144/0x188)
\<4\> \[\<c028f8fc\>\] (do\_raw\_spin\_lock\+0x144/0x188) from \[\<c0332594\>\] (kgsl\_mmu\_pt\_get\_flags\+0x18/0x44)
\<4\> \[\<c0332594\>\] (kgsl\_mmu\_pt\_get\_flags\+0x18/0x44) from \[\<c033c6c8\>\] (adreno\_ringbuffer\_submitcmd\+0x168/0x228)
\<4\> \[\<c033c6c8\>\] (adreno\_ringbuffer\_submitcmd\+0x168/0x228) from \[\<c033d9a4\>\] (sendcmd\+0x3c/0x254)
\<0\> BUG: spinlock lockup on CPU#2, kworker/2:0H/2910
\<0\> lock: kpss\_clock\_reg\_lock\+0x0/0x10, .magic: dead4ead, .owner:
kworker/3:0H/2904, .owner\_cpu: 3
\<6\> kworker/2:0H (2910): undefined instruction: pc=c0963098
kernel BUG at kernel/lib/spinlock\_debug.c:95!
\<4\> \[\<c0963098\>\] (spin\_dump\+0x7c/0x94) from \[\<c038e030\>\]
(do\_raw\_spin\_lock\+0xcc/0x164)
\<4\> \[\<c038e030\>\] (do\_raw\_spin\_lock\+0xcc/0x164) from \[\<c0972228\>\] (\_raw\_spin\_lock\_irqsave\+0x20/0x28)
\<4\> \[\<c0972228\>\] (\_raw\_spin\_lock\_irqsave\+0x20/0x28) from \[\<c011d4ac\>\] (\_\_kpss\_mux\_set\_sel\+0x14/0x80)
\<4\> \[\<c011d4ac\>\] (\_\_kpss\_mux\_set\_sel\+0x14/0x80) from \[\<c011d54c\>\] (kpss\_mux\_set\_sel\+0x18/0x20)
识别 slub 毒化问题
要识别指示 slub 毒化问题的崩溃特征,请启用CONFIG_SLUB 和 CONFIG_SLUB_DEBUG 内核配置选项。
<3\>\[ 3438.930472\] =====================================================================
<3\>\[ 3438.937628\] BUG kmalloc-64 (Tainted: G W O): Poison overwritten
<3\>\[ 3438.944223\] ---------------------------------------------------------------------
<3\>\[ 3438.944228\]
<3\>\[ 3438.953861\] INFO: 0xce308408-0xce30840b. First byte 0x0 instead of 0x6b
<3\>\[ 3438.960470\] INFO: Allocated in kgsl\_ioctl\_drawctxt\_create\+0x2c/0x2ac age=4426 cpu=0 pid=21702
<3\>\[ 3438.968970\] \_\_slab\_alloc.isra.37.constprop.43\+0x4d4/0x534
<3\>\[ 3438.974435\] kmem\_cache\_alloc\_trace\+0x240/0x258
<3\>\[ 3438.978947\] kgsl\_ioctl\_drawctxt\_create\+0x2c/0x2ac
<3\>\[ 3438.983721\] kgsl\_ioctl\+0xfc/0x324
<3\>\[ 3438.987108\] do\_vfs\_ioctl\+0x80/0x54c
<3\>\[ 3438.990669\] sys\_ioctl\+0x38/0x5c
<3\>\[ 3438.993880\] ret\_fast\_syscall\+0x0/0x30
<3\>\[ 3438.997615\] INFO: Freed in kgsl\_release\+0xb8/0xc0 age=10 cpu=3 pid=21842
<3\>\[ 3439.004298\] \_\_slab\_free\+0x30/0x308
<3\>\[ 3439.007770\] kgsl\_release\+0xb8/0xc0
<3\>\[ 3439.011242\] fput\+0xcc/0x23c
<3\>\[ 3439.014106\] filp\_close\+0x68/0x80
<3\>\[ 3439.017407\] put\_files\_struct\+0xd8/0x110
<3\>\[ 3439.021312\] do\_exit\+0x164/0x860
\<3\>\[ 3439.024524\] do\_group\_exit\+0x3c/0xb0
\<3\>\[ 3439.028084\] get\_signal\_to\_deliver\+0x2c4/0x59c
\<3\>\[ 3439.032510\] do\_signal\+0x90/0x480
<3\>\[ 3439.035809\] do\_notify\_resume\+0x50/0x5c
<3\>\[ 3439.039629\] work\_pending\+0x24/0x28
<3\>\[ 3439.043101\] INFO: Slab 0xc0fbcd20 objects=16 used=16 fp=0x (null) flags=0x0080
<3\>\[ 3439.050401\] INFO: Object 0xce308400 @offset=1024 fp=0xce308900
<3\>\[ 3439.050405\]
<3\>\[ 3439.057694\] Bytes b4 ce3083f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
<3\>\[ 3439.066457\] Object ce308400: 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk
<3\>\[ 3439.075051\] Object ce308410: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
<3\>\[ 3439.083639\] Object ce308420: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
<3\>\[ 3439.092234\] Object ce308430: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk.
<3\>\[ 3439.100828\] Redzone ce308440: bb bb bb bb ....
<3\>\[ 3439.108463\] Padding ce3084e8: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
<3\>\[ 3439.117145\] Padding ce3084f8: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
<4\>\[ 3439.125144\] \[\<c0014f78\>\] (unwind\_backtrace\+0x0/0x138) from \[\<c0150250\>\] (check\_bytes\_and\_report\+0xc0/0xe4)
<4\>\[ 3439.134771\] \[\<c0150250\>\] (check\_bytes\_and\_report\+0xc0/0xe4) from \[\<c015042c\>\] (check\_object\+0x1b8/0x214)
<4\>\[ 3439.144237\] \[\<c015042c\>\] (check\_object\+0x1b8/0x214) from \[\<c071b0bc\>\] (alloc\_debug\_processing\+0x7c/0x150)
<4\>\[ 3439.153782\] \[\<c071b0bc\>\] (alloc\_debug\_processing\+0x7c/0x150) from \[\<c071bcc0\>\] (\_\_slab\_alloc.isra.37.constprop.43\+0x4d4/0x534)
<4\>\[ 3439.165153\] \[\<c071bcc0\>\] (\_\_slab\_alloc.isra.37.constprop.43\+0x4d4/0x534) from \[\<c015221c\>\] (kmem\_cache\_alloc\_trace\+0x240/0x258)
<4\>\[ 3439.176611\] \[\<c015221c\>\] (kmem\_cache\_alloc\_trace\+0x240/0x258) from \[\<c014668c\>\] (\_\_get\_vm\_area\_node.isra.26\+0x84/0x174)
<4\>\[ 3439.187376\] \[\<c014668c\>\] (\_\_get\_vm\_area\_node.isra.26\+0x84/0x174) from \[\<c0147038\>\] (get\_vm\_area\_caller\+0x44/0x4c)
<4\>\[ 3439.197615\] \[\<c0147038\>\] (get\_vm\_area\_caller\+0x44/0x4c) from \[\<c014739c\>\] (vmap\+0x50/0x90)
<4\>\[ 3439.205866\] \[\<c014739c\>\] (vmap\+0x50/0x90) from \[\<c032a694\>\] (\_kgsl\_sharedmem\_page\_alloc\+0x238/0x3d4)
<4\>\[ 3439.214979\] \[\<c032a694\>\] (\_kgsl\_sharedmem\_page\_alloc\+0x238/0x3d4) from \[\<c0323e44\>\] (\_gpumem\_alloc\+0xb0/0xfc)
<4\>\[ 3439.224874\] \[\<c0323e44\>\] (\_gpumem\_alloc\+0xb0/0xfc) from \[\<c0323ed0\>\] (kgsl\_ioctl\_gpumem\_alloc\_id\+0x40/0x1a8)
<4\>\[ 3439.234684\] \[\<c0323ed0\>\] (kgsl\_ioctl\_gpumem\_alloc\_id\+0x40/0x1a8) from \[\<c0321874\>\] (kgsl\_ioctl\+0xfc/0x324)
<4\>\[ 3439.244319\] \[\<c0321874\>\] (kgsl\_ioctl\+0xfc/0x324) from \[\<c0167fe8\>\] (do\_vfs\_ioctl\+0x80/0x54c)
<4\>\[ 3439.252738\] \[\<c0167fe8\>\] (do\_vfs\_ioctl\+0x80/0x54c) from \[\<c01684ec\>\] (sys\_ioctl\+0x38/0x5c)
<4\>\[ 3439.260986\] \[\<c01684ec\>\] (sys\_ioctl\+0x38/0x5c) from \[\<c000eb00\>\] (ret\_fast\_syscall\+0x0/0x30)
<3\>\[ 3439.269400\] FIX kmalloc-64: Restoring 0xce308408-0xce30840b=0x6b
识别页面毒化问题
要识别指示页面毒化问题的崩溃特征,请启用CONFIG_DEBUG_PAGEALLOC 和 CONFIG_PAGE_POISONING 内核配置选项。
\<1\> Unable to handle kernel paging request at virtual address aaaaaaae
\<1\> pgd = e98b4000
\<1\> \[aaaaaaae\] [\*](https://docs.qualcomm.com/doc/80-80021-12/topic/configure_the_kernel_for_debugging.html?product=895724676033554725&facet=Debug%20Subsystem&version=2.0-rc2#id2)pgd=00000000
\<0\> Internal error: Oops: 5 \[#1\] PREEMPT SMP ARM
\<4\> Modules linked in: adsp\_loader exfat\_fs(P) exfat\_core(P)
\<4\> CPU: 1 Tainted: P W (3.4.0-628250-eng #1)
\<4\> PC is at pid\_nr\_ns\+0xc/0x3c
\<4\> LR is at do\_task\_stat\+0x248/0x83c
\<4\> pc : \[\<c00abda8\>\] lr : \[\<c018c15c\>\] psr: a0000093