# bugkiller
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/usage-of-bugkiller.html](https://docs.qualcomm.com/doc/80-58740-1/topic/usage-of-bugkiller.html)
1. Exception output information
Exceptions print the following information:
- exception_entry
- `mcause`: the cause of the exception
- `mepc`: where the exception occurred
- `mtval`: the type of the exception
2. Coredump log file format
QCC74x COREDUMP marks the
beginning of the coredump. The content of the coredump is composed of segments.
Each segment consists of a DATA BEGIN line and an
END line, which contains CRC check information,
segment start information, segment length information, and segment
name.
3. Process of parsing core dump (format check)
The
bugkiller\_dump\_linux\_amd64 command can parse coredump log
files and convert them into binary format. The command has two parameters,
bin specifies the output file, and `log`
specifies the input log
file.
./bugkiller_dump_linux_amd64 -bin test.bin -log printmemory.logCopy to clipboard
4. Launch bugkiller using coredump
binary
/bugkiller_linux_amd64 -d test.bin -e wifi_tcp_qcc743.elf Copy to clipboard
Input
the binary coredump and elf files into bugkiller. Start the gdb server and riscv
simulator. The default port of the gdb server is 6000.
5. Start gdb client and connect to
server
riscv64-unknown-elf-gdb -se wifi_tcp_qcc743.elfCopy to clipboard
Use info registers to observe the current context.
You must restore to the context where the exception occurred.
6. Debug
Run the following
command:
set $gp=&__global_pointer$
set $sp=0xe0000000+0xfffff
set $originPC = *pxCurrentTCB->pxTopOfStack
set *pxCurrentTCB->pxTopOfStack = 0
call (void (*)(void))processed_source()
set *pxCurrentTCB->pxTopOfStack = $originPC
set $pc=$originPC-4
btCopy to clipboard
7. Switch to another process context
In the previous step, we restored the context of
the abnormal task. Sometimes we may need to restore the context of other tasks.
Use the following method:
This method receives 1 parameter. The parameter
type is list. Print the name and TCB address of the task in the
list.
define task_list
set $item = $arg0.xListEnd.pxPrevious
while ($item != &$arg0.xListEnd)
p $item.pvOwner
p ((TCB_t *)$item.pvOwner)->pcTaskName
set $item = $item.pxPrevious
end
endCopy to clipboard
The
set command sets pxCurrentTCB (set pxCurrentTCB =
0x2302240f0), and then reperforms the context recovery operation (previous
step).
Using the bt command, it can be seen that the
context has been switched to the ez\_mcu\_ircut\_ta process.
8. Traverse all processes on the
OS
# READY status:
define ready_task_list
set $i = 0
while ($i < 32)
task_list pxReadyTasksLists[$i]
set $i = $i + 1
end
end
ready_task_list
# Delay status:
task_list xDelayedTaskList1
task_list xDelayedTaskList2
# PendingReady status:
task_list xPendingReadyList
# Suspend status:
task_list xSuspendedTaskListCopy to clipboard
9. gdb debugging command
The p command,
set command, bt command, and
define command are introduced above.
In addition to
these, the following commands are also supported:
The f
command (guaranteed f 0 before set $sp!!!)
switches the current stack frame. After the switch, local variables can be
accessed, such as p wait\_time. This local variable can only
be accessed after switching the stack frame.
`ptype`
command can print the type of variables.
With the
disassemble command, users can view the instructions of
the function.
**Parent Topic:** [Application development](https://docs.qualcomm.com/doc/80-58740-1/topic/application_development.html)
Last Published: Feb 11, 2026
[Previous Topic
Linker script](https://docs.qualcomm.com/bundle/publicresource/80-58740-1/topics/usage-of-linker-script.md)