Android: Kernel Debugging with KGDB

I'm trying to do kernel debugging for my Nexus One, and have been following instructions from http://bootloader.wikidot.com/android:kgdb. I was wondering if someone has actually got this to work? And has anyone done a more up to date solution for using KGDB to debug the kernel?

回答1:

I know that you've already asked a question at the Android Kernel Dev list and got no answers, but did you search through the archives for posts about kgdb and debugging?: http://groups.google.com/group/android-kernel/search?group=android-kernel&q=kgdb&qt_g=Search+this+group

In particular, you might want to look at this post: http://groups.google.com/group/android-kernel/browse_thread/thread/5233e03391867c98/320beef11e737a62

Here's a few other random links that might be helpful:

http://www.cs.gmu.edu/~astavrou/courses/ISA_673/Android_Debugging/Android_GDB.pdf
http://www.cs.columbia.edu/~nieh/teaching/w4118/ubb/Forum6/HTML/000122.html
http://wiki.ncl.cs.columbia.edu/wiki/AndroidVirt:Guides:Kernel_Debugging
http://source.android.com/porting/debugging_gdb.html

Anyhow, this is an interesting question, and I'm really having a hard time finding anything on it. You might want want to try hopping on IRC sometime (#android-dev or #android-root on freenode) and asking some people there for pointers (please post up what you find here), or maybe asking on the xda-developers Android forums.

回答2:

I found this post when I was looking for information of KGDB on Android so, despite it being a few years old, I thought it worth posting a link to some work I did to get this up and running on the Nexus 6.

http://www.contextis.com/resources/blog/kgdb-android-debugging-kernel-boss/

I hope this helps anyone else looking for similar answers.

Edited following feedback (thanks all):

To get this working I had to make a UART debug cable based on this Accuvant blog. This is quite a simple circuit which consists of a FTDI 3.3v basic breakout (available from SparkFun at the time of writing), as well as 4 resistors (2 x 1K Ohm, 1 x 1.2K Ohm and 1 x 100Ohm), and a 4-element Tip-Ring-Ring-Sleeve (TRRS) headphone jack. The resistors are essentially providing a voltage divider to reduce the 3.3v down to something a little safer for your phone. By inserting the audio jack with the other end connected to your circuit board, the audio subsystem recognises that a voltage (~2.8V) on the one of the pins and it knows to provide a UART interface via that cable. The FTDI breakout plugs into your PC via USB and from here you can access console messages via a terminal emulator like minicom. However, you now have a serial interface through the same mechanism and that's what we can use for a KGDB connection.

So at this point some relatively minor changes are required to the Nexus 6's serial driver (msm_serial_hs_lite.c) to support KGDB (specifically, the ability to perform atomic character I/O operations). I just ported these changes from the Linux Kernel mainline code as a chap called Stephen Boyd had done the hard work to the full MSM (Qualcomm) serial driver msm_serial.c. His changes can be found here or just search for "msm_serial: add support for poll_" on Google. The port wasn't difficult and my code can be found on github.

Aside from that you need to be able to build a custom kernel for your N6 which google provides lots of information on. You then need to create a boot image which contains the KGDB modifications in the github repo. I took the stock kernel from https://developers.google.com/android/nexus/images, extracted it (using abootimg -x) and then used the following command to repack it with my custom kernel (zImage-dtb) and additional command line params to ensure KGDB would be loaded and point to my serial port like so:

abootimg -u boot.img -k zImage-dtb -c 'cmdline=console=ttyHSL0,115200,n8 kgdboc=ttyHSL0,115200 kgdbretry=4'

With my boot.img created I could boot into it using the command fastboot boot boot.img, open an adb shell and then trigger a breakpoint in the Android kernel using the command:

echo -n g > /proc/sysrq-trigger

It is worth mentioning for completeness that you need superuser privileges to access /proc/sysrq-trigger so you need to have root.

With the phone halted, and your debug cable connected, launch a version of GDB for ARM on your host PC with your uncompressed kernel as an argument (e.g. arm-eabi-gdb ./vmlinux). Note: I'm running Ubuntu 14.04 and using arm-eabi-gdb from the 'prebuilts' directory in my AOSP source repository. Finally, enter the following commands:

set remoteflow off
set remotebaud 115200
target remote /dev/ttyUSB0

All being well this should immediately break into the kgdb breakpoint (that your write to /proc/sysrq-trigger produced) and you can start debugging.