【现象】
安装微信4.5版本，运行微信后在等待登陆界面（地球界面）停留3-5s手机重启
【分析】
D/Sensors ( 223): SensorBase:setEnable: mEnabled[0]=1, mEnabled[1]=0,mEnabled[2]=0
D/Sensors ( 223): activate:handle=2; drv=-22,enable=1
E/SensorService( 223): Error activating sensor 2 (Unknown error: -1)
D/Sensors ( 223): setDelay: handle=0; drv=0
I/DEBUG ( 143): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG ( 143): Build fingerprint: 'sprd/sprdroid_base/hsdroid:2.3.5/MocorDroid2.3.5/Android2.3.5_HY_V01:user/test-keys'
I/DEBUG ( 143): pid: 223, tid: 223 >>> system_server <<<
I/DEBUG ( 143): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 00000000
I/DEBUG ( 143): r0 00000000 r1 00000002 r2 0bebc200 r3 8110464c
I/DEBUG ( 143): r4 00000002 r5 ffffffea r6 001f1800 r7 0bebc200
I/DEBUG ( 143): r8 00000000 r9 00000006 10 000003e8 fp 00000000
I/DEBUG ( 143): ip afa03118 sp bed42118 lr 81104049 pc 81104054 cpsr 80800030
I/DEBUG ( 143): d0 6168203a79616c3b d1 312d203a726f7220
I/DEBUG ( 143): d2 0073006e00650064 d3 0076004500720072
I/DEBUG ( 143): d4 0000001900000000 d5 0000000000000000
I/DEBUG ( 143): d6 0000000000000001 d7 0000000000000019
I/DEBUG ( 143): d8 000000000bebc200 d9 0000000000000000
I/DEBUG ( 143): d10 0000000000000000 d11 0000000000000000
I/DEBUG ( 143): d12 0000000000000000 d13 0000000000000000
I/DEBUG ( 143): d14 0000000000000000 d15 0000000000000000
I/DEBUG ( 143): d16 0000bc2000000001 d17 000000003f800000
I/DEBUG ( 143): d18 0000000100000000 d19 0068007a00000002
I/DEBUG ( 143): d20 0000000200000000 d21 00000000004e0043
I/DEBUG ( 143): d22 0000000000000000 d23 0000000300000000
I/DEBUG ( 143): d24 3fc74721cad6b0ed d25 3fc39a09d078c69f
I/DEBUG ( 143): d26 0000000000000000 d27 0000000000000000
I/DEBUG ( 143): d28 0000000000000000 d29 0000000000000000
I/DEBUG ( 143): d30 0000000000000000 d31 0000000000000000
I/DEBUG ( 143): scr 80000010
I/DEBUG ( 143):
I/DEBUG ( 143): #00 pc 00004054 /system/lib/hw/sensors.sprdbp.so
I/DEBUG ( 143): #01 pc 000040f6 /system/lib/hw/sensors.sprdbp.so
I/DEBUG ( 143):
I/DEBUG ( 143): code around pc:
I/DEBUG ( 143): 81104034 0000061c 4ff7e92d 4606460c 46984617
I/DEBUG ( 143): 81104044 ffecf7ff f1004621 4605091c 0029f856
I/DEBUG ( 143): 81104054 6a5a6803 46834790 0029f856 69cb6801
I/DEBUG ( 143): 81104064 47984621 46234a13 447a9500 49124689
I/DEBUG ( 143): 81104074 20034682 f7fd4479 f1bbef5c dc040f01
I/DEBUG ( 143):
I/DEBUG ( 143): code around lr:
I/DEBUG ( 143): 81104028 4b02d803 f853447b 47700021 0000061c
I/DEBUG ( 143): 81104038 4ff7e92d 4606460c 46984617 ffecf7ff
I/DEBUG ( 143): 81104048 f1004621 4605091c 0029f856 6a5a6803
I/DEBUG ( 143): 81104058 46834790 0029f856 69cb6801 47984621
I/DEBUG ( 143): 81104068 46234a13 447a9500 49124689 20034682
I/DEBUG ( 143):
I/DEBUG ( 143): stack:
I/DEBUG ( 143): bed420d8 81104839 /system/lib/hw/sensors.sprdbp.so
I/DEBUG ( 143): bed420dc 00000001
I/DEBUG ( 143): bed420e0 00000000
I/DEBUG ( 143): bed420e4 00000000
I/DEBUG ( 143): bed420e8 00000031
I/DEBUG ( 143): bed420ec 002055d4
I/DEBUG ( 143): bed420f0 000003e8
I/DEBUG ( 143): bed420f4 d082ea70
I/DEBUG ( 143): bed420f8 001f1880
I/DEBUG ( 143): bed420fc 00000000
I/DEBUG ( 143): bed42100 00000000
I/DEBUG ( 143): bed42104 001f1800
I/DEBUG ( 143): bed42108 0bebc200
I/DEBUG ( 143): bed4210c 8110407f /system/lib/hw/sensors.sprdbp.so
I/DEBUG ( 143): bed42110 df002777
I/DEBUG ( 143): bed42114 e3a070ad
I/DEBUG ( 143): #00 bed42118 001f1800
I/DEBUG ( 143): bed4211c 00000002
I/DEBUG ( 143): bed42120 0bebc200
I/DEBUG ( 143): bed42124 00000002
I/DEBUG ( 143): bed42128 001f1800
I/DEBUG ( 143): bed4212c 002055d0
I/DEBUG ( 143): bed42130 001f17d0
I/DEBUG ( 143): bed42134 001f17d0
I/DEBUG ( 143): bed42138 002055d4
I/DEBUG ( 143): bed4213c 000003e8
I/DEBUG ( 143): bed42140 00000000
I/DEBUG ( 143): bed42144 811040fb /system/lib/hw/sensors.sprdbp.so
I/DEBUG ( 143): #01 bed42148 00000000
I/DEBUG ( 143): bed4214c 00000000
I/DEBUG ( 143): bed42150 00000001
I/DEBUG ( 143): bed42154 81104101 /system/lib/hw/sensors.sprdbp.so
I/DEBUG ( 143): bed42158 002055d0
I/DEBUG ( 143): bed4215c 81104107 /system/lib/hw/sensors.sprdbp.so
I/DEBUG ( 143): bed42160 00000001
I/DEBUG ( 143): bed42164 8050d3d3 /system/lib/libsensorservice.so
I/DEBUG ( 143): bed42168 afd471ec
I/DEBUG ( 143): bed4216c 00000000
I/DEBUG ( 143): bed42170 00000000
I/DEBUG ( 143): bed42174 00000002
I/DEBUG ( 143): bed42178 00000000
I/DEBUG ( 143): bed4217c 00000000
I/DEBUG ( 143): bed42180 00000000
I/DEBUG ( 143): bed42184 00000000
I/DEBUG ( 143): bed42188 00249900
I/DEBUG ( 143): bed4218c 0018fb68
D/KeyguardUpdateMonitor( 223): received broadcast android.intent.action.BATTERY_CHANGED
D/KeyguardUpdateMonitor( 223): handleBatteryUpdate
I/StatusBarPolicy( 298): Receive intent =android.intent.action.BATTERY_CHANGED
I/BootReceiver( 223): Copying /data/tombstones/tombstone_01 to DropBox (SYSTEM_TOMBSTONE)
I/DEBUG ( 143): debuggerd committing suicide to free the zombie!
I/DEBUG ( 809): debuggerd: Mar 17 2013 16:50:50
D/Zygote ( 145): Process 223 terminated by signal (11)
I/Zygote ( 145): Exit zygote because system server (223) has terminated
E/installd( 148): eof
E/installd( 148): failed to read size
I/installd( 148): closing connection
E/InputQueue-JNI( 298): channel '40713b48 StatusBar (client)' ~ Publisher closed input channel or an error occurred. events=0x8
E/InputQueue-JNI( 298): channel '406c71d0 StatusBarExpanded (client)' ~ Publisher closed input channel or an error occurred. events=0x8
E/InputQueue-JNI( 298): channel '407170a8 TrackingView (client)' ~ Publisher closed input channel or an error occurred. events=0x8
D/AndroidRuntime( 554): Shutting down VM
W/dalvikvm( 554): threadid=1: thread exiting with uncaught exception (group=0x4001d578)
I/ServiceManager( 137): service 'usagestats' died
I/ServiceManager( 137): service 'telephony.registry1' died
I/ServiceManager( 137): service 'SurfaceFlinger' died
I/ServiceManager( 137): service 'batteryinfo' died
I/ServiceManager( 137): service 'telephony.registry0' died
I/ServiceManager( 137): service 'sensorservice' died
I/ServiceManager( 137): service 'permission' died
I/ServiceManager( 137): service 'activity' died
I/ServiceManager( 137): service 'entropy' died
I/ServiceManager( 137): service 'power' died
I/ServiceManager( 137): service 'telephony.registry' died
I/ServiceManager( 137): service 'account' died
I/ServiceManager( 137): service 'appwidget' died
I/ServiceManager( 137): service 'audio' died
I/ServiceManager( 137): service 'meminfo' died
I/ServiceManager( 137): service 'package' died
I/ServiceManager( 137): service 'uimode' died
I/ServiceManager( 137): service 'cpuinfo' died
I/ServiceManager( 137): service 'usb' died
I/ServiceManager( 137): service 'content' died
I/ServiceManager( 137): service 'hardware' died
I/ServiceManager( 137): service 'vibrator' died
I/ServiceManager( 137): service 'battery' died
I/ServiceManager( 137): service 'alarm' died
I/ServiceManager( 137): service 'window' died
I/ServiceManager( 137): service 'bluetooth' died
I/ServiceManager( 137): service 'bluetooth_a2dp' died
I/ServiceManager( 137): service 'device_policy' died
I/ServiceManager( 137): service 'statusbar' died
I/ServiceManager( 137): service 'clipboard' died
I/ServiceManager( 137): service 'diskstats' died
I/ServiceManager( 137): service 'another_watchdog' died
I/ServiceManager( 137): service 'backup' died
I/ServiceManager( 137): service 'network_management' died
I/ServiceManager( 137): service 'input_method' died
I/ServiceManager( 137): service 'netstat' died
I/ServiceManager( 137): service 'mount' died
I/ServiceManager( 137): service 'wifi' died
I/ServiceManager( 137): service 'connectivity' died
I/ServiceManager( 137): service 'throttle' died
I/ServiceManager( 137): service 'accessibility' died
I/ServiceManager( 137): service 'notification' died
I/ServiceManager( 137): service 'devicestoragemonitor' died
I/ServiceManager( 137): service 'dropbox' died
I/ServiceManager( 137): service 'search' died
I/ServiceManager( 137): service 'location' died
I/ServiceManager( 137): service 'wallpaper' died
V/AudioFlinger( 138): removeNotificationClient() 0x32618, pid 223
1.哪个进程crash了
>>> system_server <<<
2.进程的pid
pid: 236
3.PC的值是什么
pc 81104054
4.死的原因
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 00000000
段错误
5.如何找到死时的代码位置,需要收集以下信息
1）跟客户要到sensors.sprdbp.so
$sourcebuild/envsetup.sh
$lunch
$arm-eabi-objdump -D -S sensors.sprdbp.so |tee sensor.dump
2）让客户执行下面的动作
# cat /proc/<pid>/maps|grep sensors.sprdbp.so
81100000-81106000 r-xp 00000000 1f:0b 566 /system/lib/hw/sensors.sprdbp.so
81106000-81107000 rw-p 00006000 1f:0b 566 /system/lib/hw/sensors.sprdbp.so
pc的值减去sensors.sprdbp.so的基地值： 81104054 - 81100000=4054
在sensor.dump搜锁偏移量“4054”，可以定位出错的函数
<_ZN22sensors_poll_context_t12setDelay_subEix+0x80>)
4054: 6803
ldr r3, [r0, #0]
在sensors.cpp的setDelay_sub函数中加打印信息看死在何处
int sensors_poll_context_t::setDelay_sub(int handle, int64_t ns)
{
int drv = handleToDriver(handle);
LOGD("yue >>>setDelay: handle=%d; drv=%d",handle, drv);
int en = mSensors[drv]->getEnable(handle); //打印发现这里drv=-22，原来是这里导致对0地址的非法访问
LOGD("yue >>>crash above line \n");
int64_t cur = mSensors[drv]->getDelay(handle);
int err = 0;
if (en <= 1)
{
/* no dependencies */
if (cur != ns)
{
if(drv>=0)
err = mSensors[drv]->setDelay(handle, ns);
}
}
。。。。。。
}
再跟踪handleToDriver
int sensors_poll_context_t::handleToDriver(int handle)
{
switch (handle)
{
case ID_A:
return acc;
// case ID_M:
// case ID_O:
// return mag;
case ID_L:
return light;
case ID_P:
return proximity;
}
return -EINVAL;
}
发现这里handle=2，即 ID_O，所以导致return -EINVAL，而EINVAL=22
再看sSensorList，板子上没有msensor但却定义了ENSOR_TYPE_ORIENTATION
/* The SENSORS Module */
static const struct sensor_t sSensorList[] =
{
.....
#ifdef SENSORHAL_ACC_KXTJ9 //这个定义了
{
"Kionix KXTJ9 3-axis Accelerometer",
"Kionix",
1, SENSORS_ACCELERATION_HANDLE,
SENSOR_TYPE_ACCELEROMETER, (GRAVITY_EARTH * 4.0f),
(GRAVITY_EARTH)/ 1024.0f, 0.145f, 10000, { }
},
//added by yue 20130319 //后来加上了
#if 0
{
"AK8975 Orientation sensor",
"Asahi Kasei Microdevices",
1, SENSORS_ORIENTATION_HANDLE,
SENSOR_TYPE_ORIENTATION, 360.0f,
CONVERT_O, 0.495f, 10000, { }
},
#endif
#endif
.....
}
【总结】
这个的根本原因是在sensor的hal中去除msensor代码不完全引起crash的典型案例。
需要注意
到底系统定义了那几个sensor，以下几个点必须一致“
1）sSensorList数组
2）sensors_poll_context_t
struct sensors_poll_context_t
{
private:
enum {
acc
= 0,
// mag
= 1,
light = 1,
proximity = 2,
numSensorDrivers, //poll是根据这个值，所以上面的枚举必须一致，依次递增
numFds,
};
}