1 <html devsite> 2 <head> 3 <title>Debugging Native Android Platform Code</title> 4 <meta name="project_path" value="/_project.yaml" /> 5 <meta name="book_path" value="/_book.yaml" /> 6 </head> 7 <body> 8 <!-- 9 Copyright 2017 The Android Open Source Project 10 11 Licensed under the Apache License, Version 2.0 (the "License"); 12 you may not use this file except in compliance with the License. 13 You may obtain a copy of the License at 14 15 http://www.apache.org/licenses/LICENSE-2.0 16 17 Unless required by applicable law or agreed to in writing, software 18 distributed under the License is distributed on an "AS IS" BASIS, 19 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 20 See the License for the specific language governing permissions and 21 limitations under the License. 22 --> 23 24 25 26 <p>This section summarizes useful tools and related commands for debugging, 27 tracing, and profiling native Android platform code when developing 28 platform-level features.</p> 29 30 <p>This page covers use of <code>debuggerd</code>, a daemon process for 31 collecting error information after applications crash. Other pages in this 32 section explore system services with 33 <a href="https://developer.android.com/studio/command-line/dumpsys.html">Dumpsys</a>, viewing 34 <a href="/devices/tech/debug/native-memory.html">native memory</a>, 35 <a href="https://developer.android.com/studio/command-line/dumpsys.html#network">network</a>, and 36 <a href="https://developer.android.com/studio/command-line/dumpsys.html#procstats">RAM</a> usage, using 37 <a href="/devices/tech/debug/asan.html">AddressSanitizer</a> to detect memory 38 bugs in native code, evaluating 39 <a href="/devices/tech/debug/eval_perf.html"> performance issues</a> (includes 40 <a href="/devices/tech/debug/systrace">systrace</a>), and using 41 <a href="/devices/tech/debug/gdb.html">GNU Project debugger (GDB)</a> and 42 other debugging tools.</p> 43 44 <h2 id=debuggerd>Using debuggerd</h2> 45 46 <p>The <code>debuggerd</code> process dumps registers and unwinds the stack. 47 When a dynamically linked executable starts, several signal handlers are 48 registered that connect to <code>debuggerd</code> (or <code>debuggerd64)</code> 49 in the event that signals (such as SIGSEGV or SIGABRT) are sent to the process.</p> 50 51 <p>It's possible for <code>debuggerd</code> to attach only if nothing else is 52 already attached, which means using tools such as <code>strace</code> or 53 <code>gdb</code> will prevent <code>debuggerd</code> from working. You can also 54 explicitly prevent <code>debuggerd</code> from attaching by calling 55 <code>prctl(PR_SET_DUMPABLE, 0)</code>, which can be useful when you need to 56 opt out of crash reporting.</p> 57 58 <p>Example <code>debuggerd</code> output (with timestamps and extraneous 59 information removed):</p> 60 61 <pre class="devsite-click-to-copy"> 62 *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** 63 Build fingerprint: 'Android/aosp_angler/angler:7.1.1/NYC/enh12211018:eng/test-keys' 64 Revision: '0' 65 ABI: 'arm' 66 pid: 17946, tid: 17949, name: crasher >>> crasher <<< 67 signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xc 68 r0 0000000c r1 00000000 r2 00000000 r3 00000000 69 r4 00000000 r5 0000000c r6 eccdd920 r7 00000078 70 r8 0000461a r9 ffc78c19 sl ab209441 fp fffff924 71 ip ed01b834 sp eccdd800 lr ecfa9a1f pc ecfd693e cpsr 600e0030 72 73 backtrace: 74 #00 pc 0004793e /system/lib/libc.so (pthread_mutex_lock+1) 75 #01 pc 0001aa1b /system/lib/libc.so (readdir+10) 76 #02 pc 00001b91 /system/xbin/crasher (readdir_null+20) 77 #03 pc 0000184b /system/xbin/crasher (do_action+978) 78 #04 pc 00001459 /system/xbin/crasher (thread_callback+24) 79 #05 pc 00047317 /system/lib/libc.so (_ZL15__pthread_startPv+22) 80 #06 pc 0001a7e5 /system/lib/libc.so (__start_thread+34) 81 Tombstone written to: /data/tombstones/tombstone_06 82 </pre> 83 84 <p>The last line of <code>debuggerd</code> output dumps a summary to the log and 85 writes a full <em>tombstone</em> to disk. The tombstone is simply a file with 86 extra data about the crashed process; it contains information that can be 87 helpful in debugging a crash, in particular the stack traces for all threads in 88 the crashing process (not just the thread that caught the signal) and a full 89 memory map.</p> 90 91 <p>Assuming the unstripped binaries can be found, you can get a more detailed 92 unwind with line number information by pasting the above example into 93 <code>development/scripts/stack</code>:</p> 94 95 <p class="key-point"><strong>Tip:</strong> For convenience, if you've lunched 96 <code>stack</code> will be on your $PATH already so you don't need to give the 97 full path.</p> 98 99 <pre class="devsite-terminal devsite-click-to-copy"> 100 development/tools/stack 101 </pre> 102 103 <p>Example output:</p> 104 <pre class="devsite-click-to-copy"> 105 Reading native crash info from stdin 106 03-02 23:53:49.477 17951 17951 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** 107 03-02 23:53:49.477 17951 17951 F DEBUG : Build fingerprint: 'Android/aosp_angler/angler:7.1.1/NYC/enh12211018:eng/test-keys' 108 03-02 23:53:49.477 17951 17951 F DEBUG : Revision: '0' 109 03-02 23:53:49.477 17951 17951 F DEBUG : ABI: 'arm' 110 03-02 23:53:49.478 17951 17951 F DEBUG : pid: 17946, tid: 17949, name: crasher >>> crasher <<< 111 03-02 23:53:49.478 17951 17951 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xc 112 03-02 23:53:49.478 17951 17951 F DEBUG : r0 0000000c r1 00000000 r2 00000000 r3 00000000 113 03-02 23:53:49.478 17951 17951 F DEBUG : r4 00000000 r5 0000000c r6 eccdd920 r7 00000078 114 03-02 23:53:49.478 17951 17951 F DEBUG : r8 0000461a r9 ffc78c19 sl ab209441 fp fffff924 115 03-02 23:53:49.478 17951 17951 F DEBUG : ip ed01b834 sp eccdd800 lr ecfa9a1f pc ecfd693e cpsr 600e0030 116 03-02 23:53:49.491 17951 17951 F DEBUG : 117 03-02 23:53:49.491 17951 17951 F DEBUG : backtrace: 118 03-02 23:53:49.492 17951 17951 F DEBUG : #00 pc 0004793e /system/lib/libc.so (pthread_mutex_lock+1) 119 03-02 23:53:49.492 17951 17951 F DEBUG : #01 pc 0001aa1b /system/lib/libc.so (readdir+10) 120 03-02 23:53:49.492 17951 17951 F DEBUG : #02 pc 00001b91 /system/xbin/crasher (readdir_null+20) 121 03-02 23:53:49.492 17951 17951 F DEBUG : #03 pc 0000184b /system/xbin/crasher (do_action+978) 122 03-02 23:53:49.492 17951 17951 F DEBUG : #04 pc 00001459 /system/xbin/crasher (thread_callback+24) 123 03-02 23:53:49.492 17951 17951 F DEBUG : #05 pc 00047317 /system/lib/libc.so (_ZL15__pthread_startPv+22) 124 03-02 23:53:49.492 17951 17951 F DEBUG : #06 pc 0001a7e5 /system/lib/libc.so (__start_thread+34) 125 03-02 23:53:49.492 17951 17951 F DEBUG : Tombstone written to: /data/tombstones/tombstone_06 126 Reading symbols from /huge-ssd/aosp-arm64/out/target/product/angler/symbols 127 Revision: '0' 128 pid: 17946, tid: 17949, name: crasher >>> crasher <<< 129 signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xc 130 r0 0000000c r1 00000000 r2 00000000 r3 00000000 131 r4 00000000 r5 0000000c r6 eccdd920 r7 00000078 132 r8 0000461a r9 ffc78c19 sl ab209441 fp fffff924 133 ip ed01b834 sp eccdd800 lr ecfa9a1f pc ecfd693e cpsr 600e0030 134 Using arm toolchain from: /huge-ssd/aosp-arm64/prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.9/bin/ 135 136 Stack Trace: 137 RELADDR FUNCTION FILE:LINE 138 0004793e pthread_mutex_lock+2 bionic/libc/bionic/pthread_mutex.cpp:515 139 v------> ScopedPthreadMutexLocker bionic/libc/private/ScopedPthreadMutexLocker.h:27 140 0001aa1b readdir+10 bionic/libc/bionic/dirent.cpp:120 141 00001b91 readdir_null+20 system/core/debuggerd/crasher.cpp:131 142 0000184b do_action+978 system/core/debuggerd/crasher.cpp:228 143 00001459 thread_callback+24 system/core/debuggerd/crasher.cpp:90 144 00047317 __pthread_start(void*)+22 bionic/libc/bionic/pthread_create.cpp:202 (discriminator 1) 145 0001a7e5 __start_thread+34 bionic/libc/bionic/clone.cpp:46 (discriminator 1) 146 </pre> 147 148 <p class="note"><strong>Note:</strong> Some system libraries are built with 149 <code>LOCAL_STRIP_MODULE := keep_symbols</code> to provide usable backtraces 150 directly from <code>debuggerd</code> without taking up anywhere near as much 151 space as an unstripped version.</p> 152 153 <p>You can also <code>stack</code> an entire tombstone. Example:</p> 154 <pre class="devsite-terminal devsite-click-to-copy"> 155 stack < FS/data/tombstones/tombstone_05</code> 156 </pre> 157 <p>This is useful if you've just unzipped a bugreport in the current directory. 158 For more information about diagnosing native crashes and tombstones, see 159 <a href="/devices/tech/debug/native-crash.html">Diagnosing Native Crashes</a>. 160 </p> 161 162 <h2 id="tombstone">Getting a stack trace/tombstone from a running process</h2> 163 164 <p>You can also use <code>debuggerd</code> on a running process. From the 165 command line, invoke <code>debuggerd</code> using a process ID (PID) to dump the 166 full tombstone to <code>stdout</code>. To get just the stack for every thread in 167 the process, include the <code>-b</code> or <code>--backtrace</code> flag.</p> 168 169 </body> 170 </html> 171
