• 嵌入式调试
    • Identifying large memory consumers
      • Heap allocations
        • Install Instructions
          • Ubuntu:
        • Start heap profiling
          • Fedora:
          • Ubuntu:
    • Debugging Hard Faults in NuttX

    嵌入式调试

    官网英文原文地址：http://dev.px4.io/advanced-gdb-debugging.html

    The autopilots running PX4 support debugging via GDB or LLDB.

    Identifying large memory consumers

    The command below will list the largest static allocations:

    1. arm-none-eabi-nm --size-sort --print-size --radix=dec build_px4fmu-v2_default/src/firmware/nuttx/firmware_nuttx | grep " [bBdD] "

    This NSH command provides the remaining free memory:

    1. free

    And the top command shows the stack usage per application:

    1. top

    Stack usage is calculated with stack coloring and thus is not the current usage, but the maximum since the start of the task.

    Heap allocations

    Dynamic heap allocations can be traced on POSIX in SITL with gperftools.

    Install Instructions

    Ubuntu:
    1. sudo apt-get install google-perftools libgoogle-perftools-dev

    Start heap profiling

    First of all, build the firmware as follows:

    1. make posix_sitl_default

    Start jmavsim: ./Tools/jmavsim_run.sh

    In another terminal, type:

    1. cd build_posix_sitl_default/tmp
    2. export HEAPPROFILE=/tmp/heapprofile.hprof
    3. export HEAP_PROFILE_TIME_INTERVAL=30

    Enter this depending on your system:

    Fedora:
    1. env LD_PRELOAD=/lib64/libtcmalloc.so ../src/firmware/posix/px4 ../../posix-configs/SITL/init/lpe/iris
    2. pprof --pdf ../src/firmware/posix/px4 /tmp/heapprofile.hprof.0001.heap > heap.pdf
    Ubuntu:
    1. env LD_PRELOAD=/usr/lib/libtcmalloc.so ../src/firmware/posix/px4 ../../posix-configs/SITL/init/lpe/iris
    2. google-pprof --pdf ../src/firmware/posix/px4 /tmp/heapprofile.hprof.0001.heap > heap.pdf

    It will generate a pdf with a graph of the heap allocations.
    The numbers in the graph will all be zero, because they are in MB. Just look at the percentages instead. They show the live memory (of the node and the subtree), meaning the memory that was still in use at the end.

    See the gperftools docs for more information.

    Debugging Hard Faults in NuttX

    A hard fault is a state when the operating system detects that it has no valid instructions to execute. This is typically the case when key areas in RAM have been corrupted. A typical scenario is when incorrect memory access smashed the stack and the processor sees that the address in memory is not a valid address for the microprocessors’s RAM.

    • NuttX maintains two stacks: The IRQ stack for interrupt processing and the user stack
    • The stack grows downward. So the highest address in the example below is 0x20021060, the size is 0x11f4 (4596 bytes) and consequently the lowest address is 0x2001fe6c.
    1. Assertion failed at file:armv7-m/up_hardfault.c line: 184 task: ekf_att_pos_estimator
    2. sp:     20003f90
    3. IRQ stack:
    4.   base: 20003fdc
    5.   size: 000002e8
    6. 20003f80: 080d27c6 20003f90 20021060 0809b8d5 080d288c 000000b8 08097155 00000010
    7. 20003fa0: 20003ce0 00000003 00000000 0809bb61 0809bb4d 080a6857 e000ed24 080a3879
    8. 20003fc0: 00000000 2001f578 080ca038 000182b8 20017cc0 0809bad1 20020c14 00000000
    9. sp:     20020ce8
    10. User stack:
    11.   base: 20021060
    12.   size: 000011f4
    13. 20020ce0: 60000010 2001f578 2001f578 080ca038 000182b8 0808439f 2001fb88 20020d4c
    14. 20020d00: 20020d44 080a1073 666b655b 65686320 205d6b63 6f6c6576 79746963 76696420
    15. 20020d20: 65747265 63202c64 6b636568 63636120 63206c65 69666e6f 08020067 0805c4eb
    16. 20020d40: 080ca9d4 0805c21b 080ca1cc 080ca9d4 385833fb 38217db9 00000000 080ca964
    17. 20020d60: 080ca980 080ca9a0 080ca9bc 080ca9d4 080ca9fc 080caa14 20022824 00000002
    18. 20020d80: 2002218c 0806a30f 08069ab2 81000000 3f7fffec 00000000 3b4ae00c 3b12eaa6
    19. 20020da0: 00000000 00000000 080ca010 4281fb70 20020f78 20017cc0 20020f98 20017cdc
    20. 20020dc0: 2001ee0c 0808d7ff 080ca010 00000000 3f800000 00000000 080ca020 3aa35c4e
    21. 20020de0: 3834d331 00000000 01010101 00000000 01010001 000d4f89 000d4f89 000f9fda
    22. 20020e00: 3f7d8df4 3bac67ea 3ca594e6 be0b9299 40b643aa 41ebe4ed bcc04e1b 43e89c96
    23. 20020e20: 448f3bc9 c3c50317 b4c8d827 362d3366 b49d74cf ba966159 00000000 00000000
    24. 20020e40: 3eb4da7b 3b96b9b7 3eead66a 00000000 00000000 00000000 00000000 00000000
    25. 20020e60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    26. 20020e80: 00000016 00000000 00000000 00010000 00000000 3c23d70a 00000000 00000000
    27. 20020ea0: 00000000 20020f78 00000000 2001ed20 20020fa4 2001f498 2001f1a8 2001f500
    28. 20020ec0: 2001f520 00000003 2001f170 ffffffe9 3b831ad2 3c23d70a 00000000 00000000
    29. 20020ee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    30. 20020f00: 00000000 00000000 00000000 00000000 2001f4f0 2001f4a0 3d093964 00000001
    31. 20020f20: 00000000 0808ae91 20012d10 2001da40 0000260b 2001f577 2001da40 0000260b
    32. 20020f40: 2001f1a8 08087fd7 08087f9d 080cf448 0000260b 080afab1 080afa9d 00000003
    33. 20020f60: 2001f577 0809c577 2001ed20 2001f4d8 2001f498 0805e077 2001f568 20024540
    34. 20020f80: 00000000 00000000 00000000 0000260b 3d093a57 00000000 2001f540 2001f4f0
    35. 20020fa0: 0000260b 3ea5b000 3ddbf5fa 00000000 3c23d70a 00000000 00000000 000f423f
    36. 20020fc0: 00000000 000182b8 20017cc0 2001ed20 2001f4e8 00000000 2001f120 0805ea0d
    37. 20020fe0: 2001f090 2001f120 2001eda8 ffffffff 000182b8 00000000 00000000 00000000
    38. 20021000: 00000000 00000000 00000009 00000000 08090001 2001f93c 0000000c 00000000
    39. 20021020: 00000101 2001f96c 00000000 00000000 00000000 00000000 00000000 00000000
    40. 20021040: 00000000 00000000 00000000 00000000 00000000 0809866d 00000000 00000000
    41. R0: 20000f48 0a91ae0c 20020d00 20020d00 2001f578 080ca038 000182b8 20017cc0
    42. R8: 2001ed20 2001f4e8 2001ed20 00000005 20020d20 20020ce8 0808439f 08087c4e
    43. xPSR: 61000000 BASEPRI: 00000000 CONTROL: 00000000
    44. EXC_RETURN: ffffffe9

    To decode the hardfault, load the exact binary into the debugger:

    1. arm-none-eabi-gdb build_px4fmu-v2_default/src/firmware/nuttx/firmware_nuttx

    Then in the GDB prompt, start with the last instructions in R8, with the first address in flash (recognizable because it starts with 0x080, the first is 0x0808439f). The execution is left to right. So one of the last steps before the hard fault was when mavlink_log.c tried to publish something,

    1. (gdb) info line *0x0808439f
    2. Line 77 of "../src/modules/systemlib/mavlink_log.c" starts at address 0x8084398 <mavlink_vasprintf+36>
    3.    and ends at 0x80843a0 <mavlink_vasprintf+44>.
    1. (gdb) info line *0x08087c4e
    2. Line 311 of "../src/modules/uORB/uORBDevices_nuttx.cpp"
    3.    starts at address 0x8087c4e <uORB::DeviceNode::publish(orb_metadata const*, void*, void const*)+2>
    4.    and ends at 0x8087c52 <uORB::DeviceNode::publish(orb_metadata const*, void*, void const*)+6>.