我们在分析watchdog问题时经常会遇到D状态的线程，然后它的调用栈如下：
"ActivityManager" prio=5 tid=11 Native
| group="main" sCount=1 dsCount=0 obj=0x12c567e0 self=0x7f77a35a00
| sysTid=2180 nice=-2 cgrp=default sched=0/0 handle=0x7f7ced0450
| state=D schedstat=( 19976991567 5871715712 18344 ) utm=1038 stm=959 core=3 HZ=100
| stack=0x7f7cdce000-0x7f7cdd0000 stackSize=1037KB
| held mutexes=
kernel: __switch_to+0x70/0x7c
kernel: binder_ioctl+0x1a8/0x5e8
kernel: do_vfs_ioctl+0x484/0x558
kernel: SyS_ioctl+0x5c/0x88
kernel: cpu_switch_to+0x48/0x4c
native: (backtrace::Unwind failed for thread 2180: Thread has not repsonded to signal in time)
at android.os.BinderProxy.transactNative(Native method)
at android.os.BinderProxy.transact(Binder.java:620)
at android.app.ApplicationThreadProxy.scheduleRegisteredReceiver(ApplicationThreadNative.java:1224)
at com.android.server.am.BroadcastQueue.performReceiveLocked(BroadcastQueue.java:492)
at com.android.server.am.BroadcastQueue.deliverToRegisteredReceiverLocked(BroadcastQueue.java:707)
at com.android.server.am.BroadcastQueue.processNextBroadcast(BroadcastQueue.java:836)
- locked <0x0b8e329d> (a com.android.server.am.ActivityManagerService)
at com.android.server.am.BroadcastQueue.processNextBroadcast(BroadcastQueue.java:804)
at com.android.server.am.BroadcastQueue$BroadcastHandler.handleMessage(BroadcastQueue.java:178)
at android.os.Handler.dispatchMessage(Handler.java:102)
at android.os.Looper.loop(Looper.java:163)
at android.os.HandlerThread.run(HandlerThread.java:61)
at com.android.server.ServiceThread.run(ServiceThread.java:46) |
|---|
这里我们能看得出来这里是卡在了binder_ioctl方法中，但是具体卡在这个方法的什么地方我们是看不出来的，那么我们怎么找到对应的行号呢？
第一步：
下载对应代码的symbols，并解压．我这里用的是libra_symbols_7.12.8_7.0_99cc23c6f1_g35e222b.tgz，symbols的下载地址在：http://eng.pt.miui.com/?r=eng&dir=/symbols
第二步：
在源码目录下运行gdb可执行文件：~/AndroidCode/C1-O/prebuilts/gdb/linux-x86/bin$ ./gdb
第三步：
加载vmlinux，vmlinux在symbols中，具体路径在out/target/product/libra/obj/KERNEL_OBJ/下
file /home/mi/xiaomiwork/LOG/surfaceflinger/C8/培训/out/target/product/libra/obj/KERNEL_OBJ/vmlinux-35e222b
第四步：
list *binder_ioctl+0x1a8
0xffffffc000a373f4 is in binder_ioctl (/home/work/libra-n-dev-build/kernel/drivers/android/binder.c:437)
第四步结束后我们就能够得到对应的代码行号了，我们可以看下对应的代码它卡在了哪里：
