菜鸟求助：Fatal signal 11 (SIGSEGV), code 2, fault addr 0x7f7a809ce0 in tid 2169

[游不离2010]

在android5.1.1源码的内核部分编写了一个点亮LED灯的驱动，然后在HAL层、framework层添加各个接口，编译完将system.img烧到开发板，开发板上电后，在start APP过程中系统崩溃，反复重启。通过adb logcat保存log如下：
I/SystemServer( 2182): DiskStats Service
I/SystemServer( 2182): Swtled Service
I/SwtledService( 2182): call init_native()
I/SwtledService( 2182): Swtled JNI: initializing...
F/libc ( 2182): Fatal signal 11 (SIGSEGV), code 2, fault addr 0x7f7977cce0 in tid 2182 (system_server)

I/DEBUG ( 303): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***

I/DEBUG ( 303): Build fingerprint: 'Android/msm8916_64/msm8916_64:5.1.1/LMY47V/embedded01130902:userdebug/test-keys'

I/DEBUG ( 303): Revision: '0'

I/DEBUG ( 303): ABI: 'arm64'

I/DEBUG ( 303): pid: 2182, tid: 2182, name: system_server >>> system_server <<<

I/DEBUG ( 303): signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x7f7977cce0

I/DEBUG ( 303): x0 0000000000000000 x1 0000007f7976cb70 x2 0000000000000000 x3 0000000000000000

I/DEBUG ( 303): x4 8080000000000000 x5 0000000000000000 x6 0000000000008080 x7 feff63646b737672

I/DEBUG ( 303): x8 7f7f7f7f7f7f7f7f x9 0000007f8f364000 x10 0101010101010101 x11 0000000000000030

I/DEBUG ( 303): x12 0000000000000036 x13 00000000000001b0 x14 0000000000000011 x15 000000000000000d

I/DEBUG ( 303): x16 0000007f8f375fe0 x17 0000007f8f8f02d8 x18 0000000000000000 x19 0000000000000020

I/DEBUG ( 303): x20 0000007f7977ccb8 x21 0000007f8f375000 x22 0000007f7af36d28 x23 0000007f8f364cd8

I/DEBUG ( 303): x24 0000007f7976cb68 x25 0000007f7b244600 x26 0000007fe22043e8 x27 0000007fe22023a8

I/DEBUG ( 303): x28 0000007fe22013a8 x29 0000007fe2200340 x30 0000007f8f364ad8

I/DEBUG ( 303): sp 0000007fe2200340 pc 0000007f8f364adc pstate 0000000040000000

I/DEBUG ( 303):

I/DEBUG ( 303): backtrace:

I/DEBUG ( 303): #00 pc 0000000000000adc /system/lib64/libhardware.so (hw_get_module_by_class+264)

I/DEBUG ( 303): #01 pc 0000000000021d08 /system/lib64/libandroid_servers.so

I/DEBUG ( 303): #02 pc 0000000000125054 /data/dalvik-cache/arm64/system@[e-mail]@classes.dex

望各位大侠指导一下，谢谢了！

[游不离2010]

问题，已经找到，问题出在HAL层 。

[游不离2010]

接着2016-02-15 11:54:14的问题，打印出的log如下： I/DEBUG ( 310): I/DEBUG ( 310): backtrace: I/DEBUG ( 310): #00 pc 0000000000000c44 /system/lib64/libhardware.so (hw_get_module_by_class+560) I/DEBUG ( 310): #01 pc 0000000000021d08 /system/lib64/libandroid_servers.so I/DEBUG ( 310): #02 pc 0000000000125054 /data/dalvik-cache/arm64/system@[e-mail]@classes.dex 根据log中的backtrace，在android源码根目录下定位报错所在源文件及行号： aarch64-linux-android-addr2line -e out/target/product/msm8916_64/symbols/system/lib64/libandroid_servers.so 0000000000021d08 /home/embedded/android/410c_yk_1/APQ8016_410C_LA.BR.1.2.4018108x16.0_5.1.1_Lollipop_P2/frameworks/base/services/core/jni/com_android_server_SwtledService.cpp:66 aarch64-linux-android-addr2line -e out/target/product/msm8916_64/symbols/system/lib64/libhardware.so 0000000000000c44 home/embedded/android/410c_yk_1/APQ8016_410C_LA.BR.1.2.4-01810-8x16.0_5.1.1_Lollipop_P2/hardware/libhardware/hardware.c:104 贴出load()函数： static int load(const char *id, const char *path, const struct hw_module_t **pHmi) { int status; void *handle; struct hw_module_t *hmi; /* * load the symbols resolving undefined symbols before * dlopen returns. Since RTLD_GLOBAL is not or'd in with * RTLD_NOW the external symbols will not be global */ ALOGE("20160219 load: id=%s,path=%s\n", id, path); handle = dlopen(path, RTLD_NOW); if (handle == NULL) { char const *err_str = dlerror(); ALOGE("load: module=%s\n%s", path, err_str?err_str:"unknown"); status = -EINVAL; goto done; } ALOGE("load: handle=0x%X\n", handle); /* Get the address of the struct hal_module_info. */ const char *sym = HAL_MODULE_INFO_SYM_AS_STR; hmi = (struct hw_module_t *)dlsym(handle, sym); if (hmi == NULL) { ALOGE("load: couldn't find symbol %s", sym); status = -EINVAL; goto done; } ALOGE("load: id=%s,hmi=0x%X,hmi->id=%s\n",id,hmi,hmi->id); /* Check that the id matches */ if (strcmp(id, hmi->id) != 0) { ALOGE("load: id=%s != hmi->id=%s", id, hmi->id); status = -EINVAL; goto done; } hmi->dso = handle; ALOGE("load: hmi->dso=0x%X,handle=0x%X\n", hmi->dso,handle); /* success */ status = 0; done: if (status != 0) { hmi = NULL; if (handle != NULL) { dlclose(handle); handle = NULL; } } else { ALOGE("loaded HAL id=%s path=%s hmi=%p handle=%p", id, path, *pHmi, handle); } ALOGE("load: hmi=0x%X\n", hmi); *pHmi = hmi; ALOGE("load: *PHmi=0x%X,status=%d\n", *pHmi,status); return status; } 最终定位出在这句代码：hmi->dso = handle；不太理解这句有什么问题？

[游不离2010]

重新贴一下log信息： E/HAL ( 2166): hw_get_module: id=swtled E/HAL ( 2166): hw_get_module__by_class: class_id=swtled E/HAL ( 2166): hw_module_exists: path2=/vendor/lib64/hw/swtled.qcom.so E/HAL ( 2166): hw_module_exists: path1=/system/lib64/hw/swtled.qcom.so E/HAL ( 2166): hw_module_exists: path2=/vendor/lib64/hw/swtled.msm8916.so E/HAL ( 2166): hw_module_exists: path1=/system/lib64/hw/swtled.msm8916.so I/HAL ( 2166): hw_get_module_by_class:variant_keys I/HAL ( 2166): found: path=/system/lib64/hw/swtled.msm8916.so E/HAL ( 2166): 20160219 load: id=swtled,path=/system/lib64/hw/swtled.msm8916.so E/HAL ( 2166): load: handle=0x6D1D0D28 E/HAL ( 2166): load: id=swtled,hmi=0x6B696CB8,hmi->id=swtled F/libc ( 2166): Fatal signal 11 (SIGSEGV), code 2, fault addr 0x7f6b696ce0 in tid 2166 (system_server) I/DEBUG ( 310): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** I/DEBUG ( 310): Build fingerprint: 'Android/msm8916_64/msm8916_64:5.1.1/LMY47V/embedded01130902:userdebug/test-keys' I/DEBUG ( 310): Revision: '0' I/DEBUG ( 310): ABI: 'arm64' I/DEBUG ( 310): pid: 2166, tid: 2166, name: system_server >>> system_server <<< I/DEBUG ( 310): signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x7f6b696ce0 I/DEBUG ( 310): x0 0000000000000000 x1 0000007f815fee48 x2 0000007f815ff038 x3 0000007f6d1d0d28 I/DEBUG ( 310): x4 0000007f6d1d0d28 x5 0000007f815ff000 x6 0000000000008080 x7 feff63646b737672 I/DEBUG ( 310): x8 7f7f7f7f7f7f7f7f x9 0000000000000002 x10 0101010101010101 x11 0000000000000030 I/DEBUG ( 310): x12 0000000000000034 x13 0000007fd6097fcc x14 0000007fd6098008 x15 0000007fd6097f20 I/DEBUG ( 310): x16 0000007f8160ffe0 x17 0000007f81b8a2d8 x18 0000007fd60980c8 x19 0000007f6b696cb8 I/DEBUG ( 310): x20 0000000000000000 x21 0000007f6d1d0d28 x22 0000007f815fe000 x23 0000007f6d4dd608 I/DEBUG ( 310): x24 0000007f815fee48 x25 0000007f8160f000 x26 0000007fd60995f8 x27 0000007f6b686b68 I/DEBUG ( 310): x28 0000007fd609c638 x29 0000007fd6098580 x30 0000007f815fec28 I/DEBUG ( 310): sp 0000007fd6098580 pc 0000007f815fec44 pstate 0000000040000000 I/DEBUG ( 310): I/DEBUG ( 310): backtrace: I/DEBUG ( 310): #00 pc 0000000000000c44 /system/lib64/libhardware.so (hw_get_module_by_class+560) I/DEBUG ( 310): #01 pc 0000000000021d08 /system/lib64/libandroid_servers.so I/DEBUG ( 310): #02 pc 0000000000125054 /data/dalvik-cache/arm64/system@[e-mail]@classes.dex

[isHooky]

亲，我也遇到了相同的问题，能问下你当时找到的BUG原因吗

[vimtao]

同问，我也遇到这种问题，已经确认问题出在HAL层，但是找不到具体原因

[ctyjqcq]

引用 4 楼 isHooky 的回复:

亲，我也遇到了相同的问题，能问下你当时找到的BUG原因吗

楼主的意思就是HAL层出问题了，你可以在你要加载的库里面加一些日志，看看那里出错了。
这个问题我也遇到了，原来以为是加载找不到这个库，后来看楼主提示，在要加载的库里面看了下，发现里面打开文件的地方文件名写错了。