Linux基础调试方法总结

一、编译链指令的使用方法

1.1、驱动panic

88260.548903][T29361] phyparamdev-D:zzlstk6a7x_init:273
[88260.583798][T29361] Unable to handle kernel paging request at virtual address 006b6b6b6b6b6b7b
[88260.592541][T29361] Mem abort info:
[88260.596158][T29361]   ESR = 0x96000004
[88260.599973][T29361]   EC = 0x25: DABT (current EL), IL = 32 bits
[88260.606057][T29361]   SET = 0, FnV = 0
[88260.609914][T29361]   EA = 0, S1PTW = 0
[88260.613803][T29361]   FSC = 0x04: level 0 translation fault
[88260.619441][T29361] Data abort info:
[88260.623207][T29361]   ISV = 0, ISS = 0x00000004
[88260.627782][T29361]   CM = 0, WnR = 0
[88260.631489][T29361] [006b6b6b6b6b6b7b] address between user and kernel address ranges
[88260.639375][T29361] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[88260.646406][T29361] Skip md ftrace buffer dump for: 0x1609e0
[88260.652080][T29361] Modules linked in: phyparam(OE+) swt6652_wifi(OE) skw_sdio_v20(OE) gadget(OE) fuelgauge(OE) charger(OE) keypad(OE) kcodec(OE) msgkit(OE) kbase(OE) m
88261.109559][T29361] Hardware name: Qualcomm Technologies, Inc. BENGAL IDP nopmi (DT)
[88261.117312][T29361] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[88261.124980][T29361] pc : stk6a7x_init+0x1d0/0x454 [phyparam]
[88261.130699][T29361] lr : stk6a7x_init+0x1b8/0x454 [phyparam]
[88261.136405][T29361] sp : ffffffc0212d39a0
[88261.140420][T29361] x29: ffffffc0212d3a00 x28: ffffffc026ffc778 x27: ffffffc026ff8898
[88261.148268][T29361] x26: 6b6b6b6b6b6b6b6b x25: ffffffdb2e32e780 x24: ffffffdb2e32df60
[88261.156115][T29361] x23: ffffffdb2e32e1b0 x22: ffffffdb2e32e000 x21: ffffffdb2e32e000
[88261.163960][T29361] x20: ffffff80270a3200 x19: ffffffdb2e32d438 x18: ffffffc00f62e068
[88261.171804][T29361] x17: 0000f4040044ffff x16: 0000000000098c3c x15: 0000000005f5e100
[88261.179650][T29361] x14: 0000000005f5e100 x13: 0000000000000000 x12: ff80005b2ad5b670
[88261.187495][T29361] x11: ffffffdb2ad5b670 x10: ffffffdb2ad5b670 x9 : 2c458a220a2c7e00
[88261.195341][T29
[88261.124980][T29361] pc : stk6a7x_init+0x1d0/0x454 [phyparam]
[88261.130699][T29361] lr : stk6a7x_init+0x1b8/0x454 [phyparam]
[88261.136405][T29361] sp : ffffffc0212d39a0
[88261.140420][T29361] x29: ffffffc0212d3a00 x28: ffffffc026ffc778 x27: ffffffc026ff8898
[88261.148268][T29361] x26: 6b6b6b6b6b6b6b6b x25: ffffffdb2e32e780 x24: ffffffdb2e32df60
[88261.156115][T29361] x23: ffffffdb2e32e1b0 x22: ffffffdb2e32e000 x21: ffffffdb2e32e000
[88261.163960][T29361] x20: ffffff80270a3200 x19: ffffffdb2e32d438 x18: ffffffc00f62e068
[88261.171804][T29361] x17: 0000f4040044ffff x16: 0000000000098c3c x15: 0000000005f5e100
[88261.179650][T29361] x14: 0000000005f5e100 x13: 0000000000000000 x12: ff80005b2ad5b670
[88261.187495][T29361] x11: ffffffdb2ad5b670 x10: ffffffdb2ad5b670 x9 : 2c458a220a2c7e00
[88261.195341][T29361] x8 : 2c458a220a2c7e00 x7 : 0000000000000001 x6 : fefefefefefeff32
[88261.203186][T29361] x5 : 8080808080808000 x4 : 0000000000000008 x3 : ffffff80341c8040
[88261.218870][T29361] Call trace:
[88261.222018][T29361]  stk6a7x_init+0x1d0/0x454 [phyparam]
[88261.227376][T29361]  phyparam_dev_create+0x144/0x710 [phyparam]
[88261.233341][T29361]  init_module+0x110/0xfc4 [phyparam]
[88261.238613][T29361]  do_one_initcall+0x7c/0x2d8
[88261.243164][T29361]  do_init_module+0x60/0x730
[88261.247614][T29361]  load_module+0xef0/0x11b4
[88261.251977][T29361]  __do_sys_init_module+0x334/0x3bc
[88261.257038][T29361]  __arm64_sys_init_module+0x20/0x30
[88261.262184][T29361]  invoke_syscall+0x60/0x150
[88261.266644][T29361]  el0_svc_common+0xc8/0x114
[88261.271102][T29361]  do_el0_svc+0x28/0x98
[88261.275118][T29361]  el0_svc+0x28/0x90
[88261.278882][T29361]  el0t_64_sync_handler+0x88/0xec
[88261.283773][T29361]  el0t_64_sync+0x1b8/0x1bc
[88261.288137][T29361] Code: f2b26c00 f0000082 f2dc51c0 91204042 (f9400b56) 
[88261.294935][T29361] ---[ end trace 721f7b1dea727321 ]---
[88261.300256][T29361] Kernel panic - not syncing: Oops: Fatal except

从上述panic日志发现驱动加载挂在stk6a7x_init函数内部，但是不知道具体函数内部在哪里空指针
可以通过pc指针追溯

pc : stk6a7x_init+0x1d0/0x454 [phyparam]

从这句可以分析出
0x1d0 ✅ 是 pc（程序计数器）在函数内的偏移，也就是 crash 发生在 stk6a7x_init 函数开始后的第 0x1d0 字节。
0x454 ✅ 是 函数总大小（字节数），也就是 stk6a7x_init 从开始到结束占据的总机器码长度。
这里的偏移都是从函数起始地址（函数本身的第一个指令）算起的，也就是从0开始计数的

函数 stk6a7x_init 的机器码布局（简化）：
地址： 0x6c0   0x6c4   0x6c8   … … 0xA14 （长度 0x454）
偏移：   0       4       8        … … 0x454

0x0 → 函数起始指令
0x1d0 → 函数内部某条指令（crash 位置）
0x454 → 函数总长度

1.2、如何依据pc指针使用addr2line解析源码行号

aarch64-linux-android24-addr2line -e phyparam.ko 0x1d0
??:0

解析不出信息，因为用的偏移地址不对，0x1d0是函数内偏移，而addr2line需要的模块的虚拟地址或符号偏移，正确步骤如下所示：

aarch64-linux-android24-nm -n phyparam.ko | grep stk6a7x_init
00000000000006c0 t stk6a7x_init
000000000000aa78 t stk6a7x_init.cfi_jt

解析出stk6a7x_init函数首地址为0x6c0，偏移为0x1d0，实际为0x980

aarch64-linux-android24-addr2line -e phyparam.ko 0x890 -f -C
stk6a7x_xxx_pid
xxxx/stk6a7x.c:208

1.3、内核panic

[20250312-15:04:10] [15.828142]
[20250312-15:04:10][ Internal error: Oops: 805 [#1] PREEMPT SMP ARM.
[20250312-15:04:10][15.848559j cPU: 0 PID: 1648 Comm: ipc_server Tainted: G15.834276] Modules linked in: 1500_i2s(0) it662x(0) videoip(0) ssp(0) it6805(0) ast_vc(0) msgkit(0) kmedia(0) hwswitch(0) kbase(0) keypad(o)
o4.9.0 #1
[20250312-15:04:10][15.862181]15.856824] Hardware name: Generic Dr based system
[20250312-15:04:10][task: b4fa1e00 task.stack: b106a000
[20250312-15:04:10][15.867242] PC is at_unix_insert_socket+0x4c/0x70
[20250312-15:04:10] [15.872684]LR is at unix create1+0x150/0x1c4
[20250312-15:04:10][15.8775451]pc:[<804375ac>]lr:[<80438fb4>]psr: a0010013
[20250312-15:04:10][15.8775451sp:b106bef0ip:b106bf088fp:b106bf04
[20250312-15:04:10][15.890369]]r10:00000000r9 :00000000ｒ８ ：00000000
[20250312-15:04:10][15.896204]1 r7 : b1a9a9a9r6 :80605254r5:806050f8r4 :b1180000
[20250312-15:04:10] [15.903485]r3 : f8fcf7a99r2 :b1180034 r1 : 00000000 r0 : 806050f8
[20250312-15:04:10] [15.918729]Control: 10c5387dTable: b113006a1DAC: 00000055
[20250312-15:04:10] [15.925143]Process ipc_server (pid: 1648, stack limit = 0xb106a210)
[20250312-15:04:10] [15.932232] Stack:(0xb106bef0 to 0xb106c000)
[20250312-15:04:10] [15.937092]1 bee0:80604a54 b1180000 b106bf34 b106bf08
[20250312-15:04:10][15.946219] 1bf00: 80438fb4 8043756c 00000000 b106bf18 804a6ae4 80439028 b491d800 805a8ecc
[20250312-15:04:10] [15.950718]vhci_hcd 1e6a0000.usb-vhub: ASpeed Virtual Hub
[20250312-15:04:10] [15.950747]vhci_hcd 1e6a0000.usb-vhub: new UsB bus registered, assigned bus number 4
[20250312-15:04:10][15.970205] 1bf20: 805d8340 00000000 b106bf44 b106bf38 80439084 80438e70 b106bf6c b106bf48
[20250312-15:04:10][15.972306]gpio_ast1530 4f84c000.gpio: ast_gpio_set_debounce: Pin 6: debounce 1000choose 2-timer
[20250312-15:04:10][15.972384]insmod:vhub_hal_initialization(4701) : HUB plugged
[20250312-15:04:10][15.972712]usb usb4: New USB device found, idVendor=ld6b, idProduc

从上述日志发现出现内核panic，但是下面又出现了usb的日志，可以将usb驱动不进行加载，排除该问题。再从日志上发现报错在at_unix_insert_socket这个函数，但是这个函数不在某个驱动中，也不知道是哪个驱动发生了错误。因此，我们可以依据cp指针 借助内核编译生成的.vmlinux找到出问题的位置

xxx-addr2line -e ./vmlinux 0x804375ac

如果出现在某个.h 或者内核代码中，可以先排除是否是内核版本太旧导致的问题

二、局部变量的作用域问题

    struct i2c_manager i2c_mgr;

    LOG_DEBUG("zzl%s:%d\n", __func__, __LINE__);

    alps_data = (struct stk6a7x_data *)kmalloc(sizeof(struct stk6a7x_data), GFP_KERNEL);
    if (!alps_data)
    {
        LOG_ERR("failed to allocate struct stk6a7x_data");
        return -ENOMEM;
    }

    plat_data = (struct stk6a7x_platform_data *)kmalloc(sizeof(struct stk6a7x_platform_data), GFP_KERNEL);
    if (!plat_data)
    {
        LOG_ERR("failed to allocate struct stk6a7x_platform_data");
        goto release_alps_data;
    }

    si2c_new_device(&curr_type->i2c_t->i2c_client, curr_type->i2c_t->bus_num, *curr_type->i2c_t->i2c_boardinfo);

    alps_data->bops = &stk_i2c_bops;
    alps_data->tops = &stk_t_ops;

    memset(&i2c_mgr, 0, sizeof(struct i2c_manager));
    i2c_mgr.addr_type = ADDR_8BIT;
    i2c_mgr.client = curr_type->i2c_t->i2c_client;
    mutex_init(&i2c_mgr.lock);

    alps_data->bus_idx = alps_data->bops->init(&i2c_mgr);

init的实现

struct i2c_manager *pi2c_mgr[MAX_I2C_MANAGER_NUM] = {NULL};

int i2c_init(void* st)
{
    int i2c_idx = 0;

    if (!st)
    {
        return -1;
    }

    for (i2c_idx = 0; i2c_idx < MAX_I2C_MANAGER_NUM; i2c_idx ++)
    {
        if (pi2c_mgr[i2c_idx] == (struct i2c_manager*)st)
        {
            printk(KERN_ERR "%s: i2c is exist\n", __func__);
            return i2c_idx;
        }
        else if (pi2c_mgr[i2c_idx] == NULL)
        {
            pi2c_mgr[i2c_idx] = (struct i2c_manager*)st;
            return i2c_idx;
        }
    }

    return -1;
}

这时i2c_mgr局部结构体变量已经释放了内存，因此如果有使用到全局数组pi2c_mgr的存在概率性panic，如下函数即会出现概率性panic

int i2c_reg_read(int i2c_idx, unsigned int reg, unsigned char *val)
{
    int error = 0;
    struct i2c_manager *_pi2c;
    I2C_REG_ADDR_TYPE addr_type;
    
    STK_ERR("zzl@%s:%d i2c_idx:%d\n", __FUNCTION__, __LINE__, i2c_idx);

    _pi2c = pi2c_mgr[i2c_idx];
    if(_pi2c == NULL)
    {
        STK_ERR("zzl@%s:%d error!\n", __FUNCTION__, __LINE__);
        return -EFAULT;
    }

    STK_ERR("zzl@%s:%d i2c_idx:%d _pi2c->addr_type:%p\n", __FUNCTION__, __LINE__, i2c_idx, &_pi2c->addr_type);

    addr_type = _pi2c->addr_type;

    STK_ERR("zzl@%s:%d reg:0x%x val:%p\n", __FUNCTION__, __LINE__, reg, val);
    mutex_lock(&_pi2c->lock);
    STK_ERR("zzl@%s:%d\n", __FUNCTION__, __LINE__);

    if (addr_type == ADDR_8BIT)
    {
        unsigned char reg_ = (unsigned char)(reg & 0xFF);
        STK_ERR("zzl@%s:%d\n", __FUNCTION__, __LINE__);
        error = i2c_smbus_read_byte_data(_pi2c->client, reg_);
        if (error < 0)
        {
            STK_ERR("%s: fai

[  379.834677][  T667] Unable to handle kernel paging request at virtual address ffffffc02279b9e8
[  379.843348][  T667] Mem abort info:
[  379.846878][  T667]   ESR = 0x96000007
[  379.850670][  T667]   EC = 0x25: DABT (current EL), IL = 32 bits
[  379.856725][  T667]   SET = 0, FnV = 0
[  379.860514][  T667]   EA = 0, S1PTW = 0
[  379.864397][  T667]   FSC = 0x07: level 3 translation fault
[  379.870014][  T667] Data abort info:
[  379.873642][  T667]   ISV = 0, ISS = 0x00000007
[  379.878221][  T667]   CM = 0, WnR = 0
[  379.881924][  T667] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000042939000
[  379.889353][  T667] [ffffffc02279b9e8] pgd=1000000043a43003, p4d=1000000043a43003, pud=1000000043a43003, pmd=100000008ade0003, pte=0000000000000000
[  379.902639][  T667] Internal error: Oops: 0000000096000007 [#1] PREEMPT SMP
[  379.909672][  T667] Skip md ftrace buffer dump for: 0x1609e0
[  379.915341][  T667] Modules linked in: phyparam(OE) swt6652_wifi(OE) skw_sdio_
[  380.369945][  T667] Hardware name: Qualcomm Technologies, Inc. BENGAL IDP nopmi (DT)
[  380.377694][  T667] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  380.385358][  T667] pc : i2c_reg_read+0xd4/0x1dc [phyparam]
[  380.390987][  T667] lr : i2c_reg_read+0xb4/0x1dc [phyparam]
[  380.396604][  T667] sp : ffffffc009e6bb50
[  380.400619][  T667] x29: ffffffc009e6bb50 x28: ffffff804c433e80 x27: 0000000000000000
[  380.408467][  T667] x26: ffffffef6770c0b0 x25: 0000000000000000 x24: 0000000000000007
[  380.416311][  T667] x23: ffffffc02279b990 x22: ffffffef65a46cfc x21: 0000000000000000
[  380.424150][  T667] x20: 0000000000000004 x19: ffffffc009e6bb94 x18: ffffffc009a7d068
[  380.431988][  T667] x17: ffffffffffffffff x16: 0000000000000004 x15: 0000000000000004
[  380.439841][  T667] x14: ffffffef68bface0 x13: 00000000000003b7 x12: 0000000000000001
[  380.447700][  T667] x11: 0000000000000000 x10: 0000000000000001 x9 : 07a759925ba5f300
[  380.455541][  T6
[  380.463386][  T667] x5 : 0000000000000004 x4 : 0000000000000052 x3 : ffffffef65a46cfc
[  380.471231][  T667] x2 : 0000000000000052 x1 : ffffffef65a46cfc x0 : ffffffef65a466cf
[  380.479077][  T667] Call trace:
[  380.482227][  T667]  i2c_reg_read+0xd4/0x1dc [phyparam]
[  380.487508][  T667]  i2c_reg_read_modify_write+0x110/0x200 [phyparam]

三、linux内存申请

kmalloc 申请内存，但是不会对内存清零，因为其是从slab里拿一块旧内存，不清零，原来是谁用过、写过什么，不清楚
kzalloc 申请内存，会对内存进行清零操作

四、编译指令添加-v参数

arm-linux-gnueabihf-gcc main.c -o main -pthread -v
Using built-in specs.
COLLECT_GCC=arm-linux-gnueabihf-gcc
COLLECT_LTO_WRAPPER=/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../libexec/gcc/arm-linux-gnueabihf/4.9.4/lto-wrapper
Target: arm-linux-gnueabihf
Configured with: /home/tcwg-buildslave/workspace/tcwg-make-release/label/docker-trusty-amd64-tcwg-build/target/arm-linux-gnueabihf/snapshots/gcc-linaro-4.9-2017.01/configure SHELL=/bin/bash --with-mpc=/home/tcwg-buildslave/workspace/tcwg-make-release/label/docker-trusty-amd64-tcwg-build/target/arm-linux-gnueabihf/_build/builds/destdir/x86_64-unknown-linux-gnu --with-mpfr=/home/tcwg-buildslave/workspace/tcwg-make-release/label/docker-trusty-amd64-tcwg-build/target/arm-linux-gnueabihf/_build/builds/destdir/x86_64-unknown-linux-gnu --with-gmp=/home/tcwg-buildslave/workspace/tcwg-make-release/label/docker-trusty-amd64-tcwg-build/target/arm-linux-gnueabihf/_build/builds/destdir/x86_64-unknown-linux-gnu --with-gnu-as --with-gnu-ld --disable-libmudflap --enable-lto --enable-objc-gc --enable-shared --without-included-gettext --enable-nls --disable-sjlj-exceptions --enable-gnu-unique-object --enable-linker-build-id --disable-libstdcxx-pch --enable-c99 --enable-clocale=gnu --enable-libstdcxx-debug --enable-long-long --with-cloog=no --with-ppl=no --with-isl=no --disable-multilib --with-float=hard --with-mode=thumb --with-tune=cortex-a9 --with-arch=armv7-a --with-fpu=vfpv3-d16 --enable-threads=posix --enable-multiarch --enable-libstdcxx-time=yes --with-build-sysroot=/home/tcwg-buildslave/workspace/tcwg-make-release/label/docker-trusty-amd64-tcwg-build/target/arm-linux-gnueabihf/_build/sysroots/arm-linux-gnueabihf --with-sysroot=/home/tcwg-buildslave/workspace/tcwg-make-release/label/docker-trusty-amd64-tcwg-build/target/arm-linux-gnueabihf/_build/builds/destdir/x86_64-unknown-linux-gnu/arm-linux-gnueabihf/libc --enable-checking=release --disable-bootstrap --enable-languages=c,c++,fortran,lto --build=x86_64-unknown-linux-gnu --host=x86_64-unknown-linux-gnu --target=arm-linux-gnueabihf --prefix=/home/tcwg-buildslave/workspace/tcwg-make-release/label/docker-trusty-amd64-tcwg-build/target/arm-linux-gnueabihf/_build/builds/destdir/x86_64-unknown-linux-gnu
Thread model: posix
gcc version 4.9.4 (Linaro GCC 4.9-2017.01) 
COLLECT_GCC_OPTIONS='-o' 'main' '-pthread' '-v' '-march=armv7-a' '-mtune=cortex-a9' '-mfloat-abi=hard' '-mfpu=vfpv3-d16' '-mthumb' '-mtls-dialect=gnu'
 /usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../libexec/gcc/arm-linux-gnueabihf/4.9.4/cc1 -quiet -v -imultilib . -imultiarch arm-linux-gnueabihf -iprefix /usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/arm-linux-gnueabihf/4.9.4/ -isysroot /usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../arm-linux-gnueabihf/libc -D_REENTRANT main.c -quiet -dumpbase main.c -march=armv7-a -mtune=cortex-a9 -mfloat-abi=hard -mfpu=vfpv3-d16 -mthumb -mtls-dialect=gnu -auxbase main -version -o /tmp/ccwupN6d.s
GNU C (Linaro GCC 4.9-2017.01) version 4.9.4 (arm-linux-gnueabihf)
        compiled by GNU C version 4.8.4, GMP version 6.0.0, MPFR version 3.1.3, MPC version 1.0.3
GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
ignoring duplicate directory "/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/../../lib/gcc/arm-linux-gnueabihf/4.9.4/include"
ignoring nonexistent directory "/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../arm-linux-gnueabihf/libc/usr/local/include/arm-linux-gnueabihf"
ignoring nonexistent directory "/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../arm-linux-gnueabihf/libc/usr/local/include"
ignoring duplicate directory "/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/../../lib/gcc/arm-linux-gnueabihf/4.9.4/include-fixed"
ignoring duplicate directory "/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/../../lib/gcc/arm-linux-gnueabihf/4.9.4/../../../../arm-linux-gnueabihf/include"
ignoring nonexistent directory "/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../arm-linux-gnueabihf/libc/usr/include/arm-linux-gnueabihf"
#include "..." search starts here:
#include <...> search starts here:
 /usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/arm-linux-gnueabihf/4.9.4/include
 /usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/arm-linux-gnueabihf/4.9.4/include-fixed
 /usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/arm-linux-gnueabihf/4.9.4/../../../../arm-linux-gnueabihf/include
 /usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../arm-linux-gnueabihf/libc/usr/include
End of search list.
GNU C (Linaro GCC 4.9-2017.01) version 4.9.4 (arm-linux-gnueabihf)
        compiled by GNU C version 4.8.4, GMP version 6.0.0, MPFR version 3.1.3, MPC version 1.0.3
GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
Compiler executable checksum: 2f906073d57f32bb591416a2139d1491
COLLECT_GCC_OPTIONS='-o' 'main' '-pthread' '-v' '-march=armv7-a' '-mtune=cortex-a9' '-mfloat-abi=hard' '-mfpu=vfpv3-d16' '-mthumb' '-mtls-dialect=gnu'
 /usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/arm-linux-gnueabihf/4.9.4/../../../../arm-linux-gnueabihf/bin/as -v -march=armv7-a -mfloat-abi=hard -mfpu=vfpv3-d16 -meabi=5 -o /tmp/ccVCLy6b.o /tmp/ccwupN6d.s
GNU assembler version 2.24.0 (arm-linux-gnueabihf) using BFD version (Linaro_Binutils-2017.01) 2.24.0.20141017 Linaro 2014_11-3-git
COMPILER_PATH=/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../libexec/gcc/arm-linux-gnueabihf/4.9.4/:/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../libexec/gcc/arm-linux-gnueabihf/:/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../libexec/gcc/:/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/arm-linux-gnueabihf/4.9.4/../../../../arm-linux-gnueabihf/bin/
LIBRARY_PATH=/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/arm-linux-gnueabihf/4.9.4/:/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/arm-linux-gnueabihf/:/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/:/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/arm-linux-gnueabihf/4.9.4/../../../../arm-linux-gnueabihf/lib/:/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../arm-linux-gnueabihf/libc/lib/:/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../arm-linux-gnueabihf/libc/usr/lib/
COLLECT_GCC_OPTIONS='-o' 'main' '-pthread' '-v' '-march=armv7-a' '-mtune=cortex-a9' '-mfloat-abi=hard' '-mfpu=vfpv3-d16' '-mthumb' '-mtls-dialect=gnu'
 /usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../libexec/gcc/arm-linux-gnueabihf/4.9.4/collect2 -plugin /usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../libexec/gcc/arm-linux-gnueabihf/4.9.4/liblto_plugin.so -plugin-opt=/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../libexec/gcc/arm-linux-gnueabihf/4.9.4/lto-wrapper -plugin-opt=-fresolution=/tmp/ccWZi7gd.res -plugin-opt=-pass-through=-lgcc -plugin-opt=-pass-through=-lgcc_s -plugin-opt=-pass-through=-lpthread -plugin-opt=-pass-through=-lc -plugin-opt=-pass-through=-lgcc -plugin-opt=-pass-through=-lgcc_s --sysroot=/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../arm-linux-gnueabihf/libc --build-id --eh-frame-hdr -dynamic-linker /lib/ld-linux-armhf.so.3 -X -m armelf_linux_eabi -o main /usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../arm-linux-gnueabihf/libc/usr/lib/crt1.o /usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../arm-linux-gnueabihf/libc/usr/lib/crti.o /usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/arm-linux-gnueabihf/4.9.4/crtbegin.o -L/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/arm-linux-gnueabihf/4.9.4 -L/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/arm-linux-gnueabihf -L/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc -L/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/arm-linux-gnueabihf/4.9.4/../../../../arm-linux-gnueabihf/lib -L/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../arm-linux-gnueabihf/libc/lib -L/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../arm-linux-gnueabihf/libc/usr/lib /tmp/ccVCLy6b.o -lgcc --as-needed -lgcc_s --no-as-needed -lpthread -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../lib/gcc/arm-linux-gnueabihf/4.9.4/crtend.o /usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/bin/../arm-linux-gnueabihf/libc/usr/lib/crtn.o

从上述的编译打印出来的详细信息可得到：
1、工具链的安装目录

/usr/local/arm/gcc-linaro-4.9.4-2017.01-x86_64_arm-linux-gnueabihf/

后续该目录统一使用$PREFIX
2、各阶段可执行程序位置

阶段	实际调用路径
编译器驱动	$PREFIX/bin/arm-linux-gnueabihf-gcc
c编译器(cc1)	$PREFIX/libexec/gcc/arm-linux-gnueabihf/4.9.4/cc1
汇编器(as)	$PREFIX/bin/arm-linux-gnueabihf-gcc/as
连接器(collect2)	$PREFIX/libexec/gcc/arm-linux-gnueabihf/4.9.4/collect2
LTO插件	$PREFIX/libexec/gcc/arm-linux-gnueabihf/4.9.4/liblto_plugin.so

3、目标系统根目录

$PREFIX/arm-linux-gnueabihf/libc

所有目标头文件、库、启动文件都以此为**/** 根
4、头文件搜索顺序（编译阶段）

#include "..." 搜索起点: 当前目录
#include <...> 搜索目录列表:
  1. $PREFIX/lib/gcc/arm-linux-gnueabihf/4.9.4/include
  2. $PREFIX/lib/gcc/arm-linux-gnueabihf/4.9.4/include-fixed
  3. $PREFIX/arm-linux-gnueabihf/include
  4. $PREFIX/arm-linux-gnueabihf/libc/usr/include

5、库文件搜索路径（LIBRARY_PATH,链接阶段）

1. $PREFIX/lib/gcc/arm-linux-gnueabihf/4.9.4/
2. $PREFIX/lib/gcc/arm-linux-gnueabihf/
3. $PREFIX/lib/gcc/
4. $PREFIX/arm-linux-gnueabihf/lib/
5. $PREFIX/arm-linux-gnueabihf/libc/lib/
6. $PREFIX/arm-linux-gnueabihf/libc/usr/lib/

6、启动文件与动态链接器
启动文件（按顺序）：

$PREFIX/arm-linux-gnueabihf/libc/usr/lib/crt1.o
$PREFIX/arm-linux-gnueabihf/libc/usr/lib/crti.o
$PREFIX/lib/gcc/arm-linux-gnueabihf/4.9.4/crtbegin.o
$PREFIX/lib/gcc/arm-linux-gnueabihf/4.9.4/crtend.o
$PREFIX/arm-linux-gnueabihf/libc/usr/lib/crtn.o

动态链接器（程序运行时使用）：

/lib/ld-linux-armhf.so.3（在目标系统内）

五、ldd指令

ldd指令是Linux、Android下一个非常经典的动态库分析工具，
作用是查看程序运行时依赖哪些.so 库文件

:/ # ldd /phone/boot/bin/bootctl                                                                            
        linux-vdso.so.1 => [vdso] (0x731201c000)
        libhidlbase.so => /system/lib64/libhidlbase.so (0x730d85d000)
        libhidltransport.so => /system/lib64/libhidltransport.so (0x730d7e6000)
        libhwbinder.so => /system/lib64/libhwbinder.so (0x7310cca000)
        libutils.so => /system/lib64/libutils.so (0x730d71b000)
        android.hardware.boot@1.0.so => /system/lib64/android.hardware.boot@1.0.so (0x7310d5e000)
        libc++.so => /system/lib64/libc++.so (0x730d916000)
        libc.so => /apex/com.android.runtime/lib64/bionic/libc.so (0x730b489000)
        libm.so => /apex/com.android.runtime/lib64/bionic/libm.so (0x730d806000)
        libdl.so => /apex/com.android.runtime/lib64/bionic/libdl.so (0x7310cb2000)
        libbase.so => /system/lib64/libbase.so (0x7310d01000)
        liblog.so => /system/lib64/liblog.so (0x730d6cb000)
        libcutils.so => /system/lib64/libcutils.so (0x730d79d000)
        libvndksupport.so => /system/lib64/libvndksupport.so (0x7310c62000)
        libdl_android.so => /apex/com.android.runtime/lib64/bionic/libdl_android.so (0x730d747000)

ldd库可以展示出其依赖的多级库文件，因为可能存在部分.so依赖与其他.so

六、readelf指令

先了解elf是什么？Linux/Android可执行文件，内部大概为

ELF Header
Program Header
Section Header
.text
.data
.dynamic
.got
.plt
...

其中.dynamic就是动态链接信息区, 可使用readelf读出可执行文件该区域的内容：

:/ # readelf -d /phone/boot/bin/bootctl                                                                     

Dynamic section at offset 0xfc80 contains 40 entries:
  Tag                Type                 Name/Value
 0x0000000000000003 (PLTGOT)             0x1ff20
 0x0000000000000002 (PLTRELSZ)           600 (bytes)
 0x0000000000000017 (JMPREL)             0xd38
 0x0000000000000014 (PLTREL)             RELA
 0x0000000000000007 (RELA)               0x9a8
 0x0000000000000008 (RELASZ)             912 (bytes)
 0x0000000000000009 (RELAENT)            24 (bytes)
 0x000000006ffffff9 (RELACOUNT)          36
 0x0000000000000015 (DEBUG)              0x0
 0x0000000000000006 (SYMTAB)             0x288
 0x000000000000000b (SYMENT)             24 (bytes)
 0x0000000000000005 (STRTAB)             0x588
 0x000000000000000a (STRSZ)              909 (bytes)
 0x000000006ffffef5 (GNU_HASH)           0x918
 0x0000000000000001 (NEEDED)             Shared library: [libhidlbase.so]
 0x0000000000000001 (NEEDED)             Shared library: [libhidltransport.so]
 0x0000000000000001 (NEEDED)             Shared library: [libhwbinder.so]
 0x0000000000000001 (NEEDED)             Shared library: [libutils.so]
 0x0000000000000001 (NEEDED)             Shared library: [android.hardware.boot@1.0.so]
 0x0000000000000001 (NEEDED)             Shared library: [libc++.so]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so]
 0x0000000000000001 (NEEDED)             Shared library: [libm.so]
 0x0000000000000001 (NEEDED)             Shared library: [libdl.so]
 0x0000000000000020 (PREINIT_ARRAY)      0x1fae8
 0x0000000000000021 (PREINIT_ARRAYSZ)    0x10
 0x0000000000000019 (INIT_ARRAY)         0x1faf8
 0x000000000000001b (INIT_ARRAYSZ)       16 (bytes)
 0x000000000000001a (FINI_ARRAY)         0x1fb08
 0x000000000000001c (FINI_ARRAYSZ)       16 (bytes)
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW
 0x000000006ffffff0 (VERSYM)             0x948
 0x000000006ffffffe (VERNEED)            0x988
 0x000000006fffffff (VERNEEDNUM)         1
 0x0000000000000000 (NULL)               0x0
 0x0000000000000000 (NULL)               0x0
 0x0000000000000000 (NULL)               0x0
 0x0000000000000000 (NULL)               0x0
 0x0000000000000000 (NULL)               0x0
 0x0000000000000000 (NULL)               0x0
 或者使用
 readelf -d /phone/boot/bin/bootctl  | grep NEEDED
 :/ # readelf -d /phone/boot/bin/bootctl  | grep NEEDED                                                      
 0x0000000000000001 (NEEDED)             Shared library: [libhidlbase.so]
 0x0000000000000001 (NEEDED)             Shared library: [libhidltransport.so]
 0x0000000000000001 (NEEDED)             Shared library: [libhwbinder.so]
 0x0000000000000001 (NEEDED)             Shared library: [libutils.so]
 0x0000000000000001 (NEEDED)             Shared library: [android.hardware.boot@1.0.so]
 0x0000000000000001 (NEEDED)             Shared library: [libc++.so]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so]
 0x0000000000000001 (NEEDED)             Shared library: [libm.so]
 0x0000000000000001 (NEEDED)             Shared library: [libdl.so]

注意：使用ldd会更深入，readelf只是把可执行文件内部申明的依赖列出，ldd会把程序所需要运行所有库文件列出，包括二级依赖