Msensor-Hal-crash

[Symptom]
Install version 4.5, and wait for the login interface (Earth Interface) to stop 3-5 seconds to restart the mobile phone

[Analysis]
D/sensors (223): sensorbase: setenable: menabled [0] = 1, menabled [1] = 0, menabled [2] = 0
D/sensors (223): Activate: handle = 2; DRV =-22, enable = 1
E/sensorservice (223): Error activating sensor 2 (unknown error:-1)
D/sensors (223): setdelay: handle = 0; DRV = 0
I/debug (143 ): **************************************** ********
I/debug (143): Build fingerprint: 'sprd/sprdroid_base/hsdroid: 2.3.5/mocordroid2.3.5/android2.3.5 _ hy_v01: User/test-keys'
I/debug (143): PID: 223, TID: 223 >>> system_server <
I/debug (143): Signal 11 (SIGSEGV), Code 1 (segv_maperr), fault ADDR 00000000
I/debug (143): R0 00000000 R1 00000002 R2 0bebc200 R3 8110464c
I/debug (143): R4 00000002 R5 ffffffea R6 001f1800 R7 0bebc200
I/debug (143): R8 00000000 R9 00000006 10 000003e8 FP 00000000
I/debug (143): IP afa03118 SP bed42118 LR 81104049 PC 81104054 CPSR 80800030
I/debug (143): D0 6168203a79616c3b D1 312d203a424f7220
I/debug (143): D2 0073006e00650064 D3 0076004500720072
I/debug (143): D4 0000001900000000 D5 0000000000000000
I/debug (143): D6 0000000000000001 D7 0000000000000019
I/debug (143): D8 000000000bebc200 D9 0000000000000000
I/debug (143): D10 0000000000000000 D11 0000000000000000
I/debug (143): D12 0000000000000000 D13 0000000000000000
I/debug (143): D14 0000000000000000 D15 0000000000000000
I/debug (143): D16 running bc2000000001 d17 running 3f800000
I/debug (143): d18 0000000100000000 d19 0068007a00000002
I/debug (143): d20 0000000200000000 D21 201710000004e0043
I/debug (143): D22 0000000000000000 d23 0000000300000000
I/debug (143): d24 3fc74721cad6b0ed D25 3fc39a09d078c69f
I/debug (143): d26 0000000000000000 d27 0000000000000000
I/debug (143): d28 0000000000000000 D29 0000000000000000
I/debug (143): d30 0000000000000000 d31 0000000000000000
I/debug (143): SCR 80000010
I/debug (143 ):
I/debug (143): #00 PC 00004054/system/lib/HW/sensors. sprdbp. So
I/debug (143): #01 PC restart 40f6/system/lib/HW/sensors. sprdbp. So
I/debug (143 ):
I/debug (143): code around PC:
I/debug (143): 81104034 0000061c 4ff7e92d 4606460c 46984617
I/debug (143): 81104044 ffecf7ff f1004621 4605091c 0029f856
I/debug (143): 81104054 6a5a6803 46834790 0029f856 69cb6801
I/debug (143): 81104064 47984621 46234a13 447a9500 49124689
I/debug (143): 81104074 20034682 f7fd4479 f1bbef5c dc040f01
I/debug (143 ):
I/debug (143): code around LR:
I/debug (143): 81104028 4b02d803 f853447b 47700021 0000061c
I/debug (143): 81104038 4ff7e92d 4606460c 46984617 ffecf7ff
I/debug (143): 81104048 f1004621 4605091c 0029f856 6a5a6803
I/debug (143): 81104058 46834790 0029f856 69cb6801 47984621
I/debug (143): 81104068 46234a13 447a9500 49124689 20034682
I/debug (143 ):
I/debug (143): Stack:
I/debug (143): bed420d8 81104839/system/lib/HW/sensors. sprdbp. So
I/debug (143): bed420dc 00000001
I/debug (143): bed420e0 00000000
I/debug (143): bed420e4 00000000
I/debug (143): bed420e8 00000031
I/debug (143): bed420ec 002055d4
I/debug (143): bed420f0 000003e8
I/debug (143): bed420f4 d082ea70
I/debug (143): bed420f8 001f1880
I/debug (143): bed420fc 00000000
I/debug (143): bed42100 00000000
I/debug (143): bed42104 001f1800
I/debug (143): bed42108 0bebc200
I/debug (143): bed4210c 8110407f/system/lib/HW/sensors. sprdbp. So
I/debug (143): bed42110 df002777
I/debug (143): bed42114 e3a070ad
I/debug (143): #00 bed42118 001f1800
I/debug (143): bed4211c 00000002
I/debug (143): bed42120 0bebc200
I/debug (143): bed42124 00000002
I/debug (143): bed42128 001f1800
I/debug (143): bed4212c 002055d0
I/debug (143): bed42130 001f17d0
I/debug (143): bed42134 001f17d0
I/debug (143): bed42138 002055d4
I/debug (143): bed4213c 000003e8
I/debug (143): bed42140 00000000
I/debug (143): bed42144 811040fb/system/lib/HW/sensors. sprdbp. So
I/debug (143): #01 bed42148 00000000
I/debug (143): bed4214c 00000000
I/debug (143): bed42150 00000001
I/debug (143): bed42154 81104101/system/lib/HW/sensors. sprdbp. So
I/debug (143): bed42158 002055d0
I/debug (143): bed4215c 81104107/system/lib/HW/sensors. sprdbp. So
I/debug (143): bed42160 00000001
I/debug (143): bed42164 8050d3d3/system/lib/libsensorservice. So
I/debug (143): bed42168 afd471ec
I/debug (143): bed4216c 00000000
I/debug (143): bed42170 00000000
I/debug (143): bed42174 00000002
I/debug (143): bed42178 00000000
I/debug (143): bed4217c 00000000
I/debug (143): bed42180 00000000
I/debug (143): bed42184 00000000
I/debug (143): bed42188 00249900
I/debug (143): bed4218c 0018fb68
D/keyguardupdatemonitor (223): received broadcast Android. Intent. Action. battery_changed
D/keyguardupdatemonitor (223): handlebatteryupdate
I/statusbarpolicy (298): receive intent = Android. Intent. Action. battery_changed
I/bootreceiver (223): copying/data/tombstones/tombstone_01 to Dropbox (system_tombstone)
I/debug (143): debugadh committing suicide to free the zombie!
I/debug (809): debugadh: Mar 17 2013 16:50:50
D/zygote (145): Process 223 terminated by signal (11)
I/zygote (145): Exit zygote because system server (223) has terminated
E/installd (148): EOF
E/installd (148): failed to read size
I/installd (148): Closing connection
E/inputqueue-JNI (298): Channel '40713b48 statusbar (client )'~ Publisher closed input channel or an error occurred. Events = 0x8
E/inputqueue-JNI (298): Channel '406c71d0 statusbarexpanded (client )'~ Publisher closed input channel or an error occurred. Events = 0x8
E/inputqueue-JNI (298): Channel '407170a8 trackingview (client )'~ Publisher closed input channel or an error occurred. Events = 0x8
D/androidruntime (554): Shutting Down VM
W/dalvikvm (554): threadid = 1: thread exiting with uncaught exception (group = 0x4001d578)
I/servicemanager (137): Service 'usagestats' died
I/servicemanager (137): Service 'telephony. registry1 'died
I/servicemanager (137): Service 'surfaceflinger 'died
I/servicemanager (137): Service 'batterinfo' died
I/servicemanager (137): Service 'telephony. registry0' died
I/servicemanager (137): Service 'sensorservice' died
I/servicemanager (137): Service 'permission' died
I/servicemanager (137): Service 'active' died
I/servicemanager (137): Service 'entropy' died
I/servicemanager (137): Service 'power' died
I/servicemanager (137): Service 'telephony. Registry 'died
I/servicemanager (137): Service 'account' died
I/servicemanager (137): Service 'appwidget 'died
I/servicemanager (137): Service 'audio' died
I/servicemanager (137): Service 'meminfo' died
I/servicemanager (137): Service 'package' died
I/servicemanager (137): Service 'uimode' died
I/servicemanager (137): Service 'cpuinfo' died
I/servicemanager (137): Service 'usb 'died
I/servicemanager (137): Service 'content' died
I/servicemanager (137): Service 'hardware' died
I/servicemanager (137): Service 'vibrator' died
I/servicemanager (137): Service 'battery' died
I/servicemanager (137): Service 'arm' died
I/servicemanager (137): Service 'window' died
I/servicemanager (137): Service 'bluetooth 'died
I/servicemanager (137): Service 'bluetooth _ a2dp 'died
I/servicemanager (137): Service 'device _ policy' died
I/servicemanager (137): Service 'statusbar' died
I/servicemanager (137): Service 'clipboard' died
I/servicemanager (137): Service 'diskstats' died
I/servicemanager (137): Service 'another _ watchdog 'died
I/servicemanager (137): Service 'backup 'died
I/servicemanager (137): Service 'network _ management' died
I/servicemanager (137): Service 'input _ method' died
I/servicemanager (137): Service 'netstat' died
I/servicemanager (137): Service 'mount' died
I/servicemanager (137): Service 'wifi 'died
I/servicemanager (137): Service 'connection' died
I/servicemanager (137): Service 'throttle' died
I/servicemanager (137): Service 'accesssibility 'died
I/servicemanager (137): Service 'notification' died
I/servicemanager (137): Service 'devicestoragemonitor 'died
I/servicemanager (137): Service 'dropbox' died
I/servicemanager (137): Service 'search' died
I/servicemanager (137): Service 'location' died
I/servicemanager (137): Service 'wallpaper' died
V/audioflinger (138): removenotificationclient () 0x32618, PID 223

1. Which process is crash?
>>> System_server <
2. Process PID
PID: 236
3. What is the value of PC?
PC 81104054
4. Cause of death
Signal 11 (SIGSEGV), Code 1 (segv_maperr), fault ADDR 00000000
Segment Error
5. Collect the following information to find the location of the Dead Code:
1) contact the customer to reach sensors. sprdbp. So.
$ Sourcebuild/envsetup. Sh
$ Lunch
$ Arm-Eabi-objdump-d-s sensors. sprdbp. So | tee sensor. Dump
2) Ask the customer to perform the following actions
# Cat/proc/<pid>/maps | grep sensors. sprdbp. So
81100000-81106000 R-XP 00000000 1f: 0b 566/system/lib/HW/sensors. sprdbp. So
81106000-81107000 RW-P 00006000 1f: 0b 566/system/lib/HW/sensors. sprdbp. So

PC value minus sensors. sprdbp. So Base Value: 81104054-81100000 = 4054

Search for the lock offset "4054" in sensor. Dump to locate the faulty function.
<_ Zn22sensors_poll_context_t12setdelay_subeix + 0x80>)
4054: 6803
LDR R3, [r0, #0]

In the setdelay_sub function of sensors. cpp, print the information to see where it is.

Int sensors_poll_context_t: setdelay_sub (INT handle, int64_t NS)
{
Int DRV = handletodriver (handle );

Logd ("Yue >>> setdelay: handle = % d; DRV = % d", handle, DRV );
Int en = msensors [DRV]-> getenable (handle

Logd ("Yue >>> crash abve line \ n ");

Int64_t cur = msensors [DRV]-> getdelay (handle );
Int err = 0;

If (EN <= 1)
{
/* No dependencies */
If (cur! = NS)
{
If (DRV> = 0)
Err = msensors [DRV]-> setdelay (handle, NS );
}
}
......
}

Then track handletodriver

Int sensors_poll_context_t: handletodriver (INT handle)
{
Switch (handle)
{
Case id_a:
Return ACC;
// Case id_m:
// Case id_o:
// Return mag;
Case id_l:
Return light;
Case id_p:
Return proximity;
}
Return-einval;
}
Handle = 2, that is, id_o. Therefore, return-einval is returned, while einval = 22.
Let's look at the ssensorlist. There is no msensor on the board, but it defines ensor_type_orientation.

/* The sensors module */
Static const struct sensor_t ssensorlist [] =
{
.....
# Ifdef sensorhal_acc_kxtj9 // This defines
{
"Kionix kxtj9 3-axis accelerometer ",
"Kionix ",
1, sensors_acceleration_handle,
Sensor_type_accelerometer, (gravity_earth * 4.0f ),
(Gravity_earth)/1024366f, 0.145f, 10000 ,{}
},
// Added by YUE 20130319 // added later
# If 0
{
"Ak8975 orientation sensor ",
"Asahi kasei Microdevices ",
1, sensors_orientation_handle,
Sensor_type_orientation, 360.0f,
Convert_o, 0.495f, 10000 ,{}
},
# Endif
# Endif
.....
}

[Summary]
The root cause of this is the typical case where removing msensor code from the sensor Hal does not completely cause crash.
Note:
When the system defines the several sensor, the following points must be consistent:"
1) ssensorlist Array
2) sensors_poll_context_t
Struct sensors_poll_context_t
{

PRIVATE:
Enum {
ACC
= 0,
// Mag
= 1,
Light = 1,
Proximity = 2,
Numsensordrivers, // poll is based on this value, so the enumerated values above must be consistent and increase sequentially
Numfds,
};

}