分享一下今日刚解决的一个tombstone

分享一下在wifi routerstop过程中出现tombstone原因及解决办法

下面是发生问题是的log

05-30 20:37:43.949 2128 2128 D STT:Device: Running [/system/xbin/su0 kill -15 2272] ...

05-30 20:37:43.959 2128 2128 D STT:Device: Process[pid=2326]

05-30 20:37:43.959 2128 2128 D STT:WifiRouter: enableAirplaneMode: skip!

05-30 20:37:43.979 2272 2272 D STT:pclink: service_send_command: [:close:]

05-30 20:37:43.989 1658 2292 D STT:iotty: read command [:close:].

05-30 20:37:43.989 1658 2311 D STT:iotty: thread_read: end of loop.

05-30 20:37:43.999 1658 2312 D STT:iotty: thread_write: end of thread.

05-30 20:37:43.999 1658 2311 D STT:iotty: thread_read: end of thread.

05-30 20:37:43.999 1658 2292 D STT:attr_table_switch: put ref = 0

05-30 20:37:43.999 1658 2292 D STT:attr_table_switch: attr:[/sys/module/msm_serial_debugger/parameters/uart_enabled][]

05-30 20:37:43.999 1658 2292 E STT:attr_table_switch: Nosuch file or directory

05-30 20:37:43.999 1658 2292 D STT:attr_table_switch: attr: [/sys/module/pm/parameters/sleep_mode][]

05-30 20:37:43.999 1658 2292 E STT:attr_table_switch: Nosuch file or directory

05-30 20:37:43.999 1658 2292 D STT:attr_table_switch: attr:[/sys/module/pm/parameters/idle_sleep_mode][]

05-30 20:37:43.999 1658 2292 E STT:attr_table_switch: Nosuch file or directory

05-30 20:37:43.999 1658 2292 D STT:attr_table_switch: attr:[/sys/module/diag/parameters/enabled][]

05-30 20:37:43.999 1658 2292 E STT:attr_table_switch: Nosuch file or directory

05-30 20:37:43.999 1658 2292 D STT:attr_table_switch: attr: [/sys/class/android_usb/f_diag/on][]

05-30 20:37:43.999 1658 2292 E STT:attr_table_switch: Nosuch file or directory

05-30 20:37:43.999 1658 2292 D STT:attr_table_switch: attr: [/sys/module/serial/parameters/serial_enabled][]

05-30 20:37:43.999 1658 2292 E STT:attr_table_switch: Nosuch file or directory

05-30 20:37:43.999 1658 2292 D STT:attr_table_switch: attr:[/sys/class/android_usb/f_serial/on][1]

05-30 20:37:43.999 1658 2292 D STT:attr_table_switch: attr:[/sys/devices/platform/omap-uart.0/sleep_timeout][]

05-30 20:37:43.999 1658 2292 E STT:attr_table_switch: Nosuch file or directory

05-30 20:37:43.999 1658 2292 D STT:attr_table_switch: attr: [/sys/devices/platform/omap-uart.1/sleep_timeout][]

05-30 20:37:43.999 1658 2292 E STT:attr_table_switch: Nosuch file or directory

05-30 20:37:43.999 1658 2292 D STT:attr_table_switch: attr:[/sys/devices/platform/omap-uart.2/sleep_timeout][]

05-30 20:37:43.999 1658 2292 E STT:attr_table_switch: Nosuch file or directory

05-30 20:37:43.999 1658 2292 D STT:attr_table_switch: attr:[/sys/devices/platform/omap-uart.3/sleep_timeout][]

05-30 20:37:43.999 1658 2292 E STT:attr_table_switch: Nosuch file or directory

05-30 20:37:43.999 1658 2292 D STT:attr_table_switch: attr:[/sys/devices/platform/serial8250.0/sleep_timeout][]

05-30 20:37:43.999 1658 2292 E STT:attr_table_switch: Nosuch file or directory

05-30 20:37:43.999 1658 2292 D STT:iotty: send response [0].

05-30 20:37:43.999 2272 2272 D STT:pclink: service_send_command: return [0]

05-30 20:37:43.999 2272 2272 F libc : Fatal signal 13(SIGPIPE) at 0x000008e0 (code=0), thread 2272 (ssd_emapid)

05-30 20:37:44.019 1658 2292 D STT:iotty: read command error (0)! close connection!

05-30 20:37:44.019 1658 2292 D STT:iotty: waiting connection ...

05-30 20:37:44.129 120 120 I DEBUG : *** *** *** ****** *** *** *** *** *** *** *** *** *** *** ***

05-30 20:37:44.129 120 120 I DEBUG : Build fingerprint:'xxxx

05-30 20:37:44.129 120 120 I DEBUG : pid: 2272, tid: 2272, name:ssd_emapid >>>/system/bin/ssd_emapid <<<

05-30 20:37:44.129 120 120 I DEBUG :
signal 13 (SIGPIPE),code -6 (?), fault addr --------

05-30 20:37:44.159 120 120 I DEBUG : r0 ffffffe0 r1 bea7e04c r2 0000000d r3 00000000

05-30 20:37:44.159 120 120 I DEBUG : r4 00000000 r5 00000000 r6 00000003 r7 00000122

05-30 20:37:44.159 120 120 I DEBUG : r8 b6fb0e08 r9 b6fb0e04 sl bea7efd4 fp b6fb3144

05-30 20:37:44.159 120 120 I DEBUG : ip bea7e028 sp bea7e018 lr b6f23f7d pc b6f176c4 cpsr 60000010

05-30 20:37:44.159 120 120 I DEBUG : d0 646e616d6d6f635f d1 6e7275746572203a

05-30 20:37:44.159 120 120 I DEBUG : d2 7463656e6e6f6372 d3 61747365206e6f76

05-30 20:37:44.159 120 120 I DEBUG : d4 b8466570b8466560 d5 b8466590b8466580

05-30 20:37:44.159 120 120 I DEBUG : d6 b84669f0b84665a0 d7 b8466e50b8466e40

05-30 20:37:44.159 120 120 I DEBUG : d8 0000000000000000 d9 0000000000000000

05-30 20:37:44.159 120 120 I DEBUG : d10 0000000000000000 d11 0000000000000000

05-30 20:37:44.159 120 120 I DEBUG : d12 0000000000000000 d13 0000000000000000

05-30 20:37:44.159 120 120 I DEBUG : d14 0000000000000000 d15 0000000000000000

05-30 20:37:44.159 120 120 I DEBUG : d16 419fa903e57be76d d17 3f50624dd2f1a9fc

05-30 20:37:44.169 120 120 I DEBUG : d18 41c79ed30d800000 d19 0000000000000000

05-30 20:37:44.169 120 120 I DEBUG : d20 0000000000000000 d21 0000000000000000

05-30 20:37:44.169 120 120 I DEBUG : d22 0000000000000000 d23 0000000000000000

05-30 20:37:44.169 120 120 I DEBUG : d24 0000000000000000 d25 0000000000000000

05-30 20:37:44.169 120 120 I DEBUG : d26 0000000000000000 d27 0000000000000000

05-30 20:37:44.169 120 120 I DEBUG : d28 0000000000000000 d29 0000000000000000

05-30 20:37:44.169 120 120 I DEBUG : d30 0000000000000000 d31 0000000000000000

05-30 20:37:44.169 120 120 I DEBUG : scr 00000010

05-30 20:37:44.169 120 120 I DEBUG :

05-30 20:37:44.169 120 120 I DEBUG : backtrace:

05-30 20:37:44.169 120 120 I DEBUG :
#00 pc 0000d6c4 /system/lib/libc.so(sendto+20)

05-30 20:37:44.169 120 120 I DEBUG : #01 pc 00019f79 /system/lib/libc.so(send+8)

05-30 20:37:44.169 120 120 I DEBUG : #02 pc 000047e7 /system/bin/ssd_emapid

05-30 20:37:44.169 120 120 I DEBUG :

05-30 20:37:44.169 120 120 I DEBUG : stack:

05-30 20:37:44.169 120 120 I DEBUG : bea7dfd8 ffff0208 [vectors]

05-30 20:37:44.169 120 120 I DEBUG : bea7dfdc bea7e040 [stack]

05-30 20:37:44.169 120 120 I DEBUG : bea7dfe0 7fffffff

05-30 20:37:44.169 120 120 I DEBUG : bea7dfe4 00000000

05-30 20:37:44.169 120 120 I DEBUG : bea7dfe8 00000000

05-30 20:37:44.169 120 120 I DEBUG : bea7dfec b6f5c425 /system/lib/liblog.so (__android_log_write+248)

05-30 20:37:44.169 120 120 I DEBUG : bea7dff0 00000000

05-30 20:37:44.169 120 120 I DEBUG : bea7dff4 00000003

05-30 20:37:44.169 120 120 I DEBUG : bea7dff8 bea7dff4 [stack]

05-30 20:37:44.169 120 120 I DEBUG : bea7dffc bea7dfbc [stack]

05-30 20:37:44.169 120 120 I DEBUG : bea7e000 b6ea49a8 /system/lib/libhtc_tools.so

05-30 20:37:44.169 120 120 I DEBUG : bea7e004 0000000b

05-30 20:37:44.169 120 120 I DEBUG : bea7e008 bea7e024 [stack]

05-30 20:37:44.169 120 120 I DEBUG : bea7e00c 00000022

05-30 20:37:44.169 120 120 I DEBUG : bea7e010 df0027ad

05-30 20:37:44.169 120 120 I DEBUG : bea7e014 00000000

05-30 20:37:44.169 120 120 I DEBUG : #00 bea7e018 00000000

05-30 20:37:44.179 120 120 I DEBUG : bea7e01c 000003f2

05-30 20:37:44.179 120 120 I DEBUG : bea7e020 b6f5aa4c

05-30 20:37:44.179 120 120 I DEBUG : bea7e024 b6fb0e0c /system/bin/ssd_emapid

05-30 20:37:44.179 120 120 I DEBUG : #01 bea7e028 00000000

05-30 20:37:44.179 120 120 I DEBUG : bea7e02c 00000000

05-30 20:37:44.179 120 120 I DEBUG : bea7e030 00000003

05-30 20:37:44.179 120 120 I DEBUG : bea7e034 b6faf7eb /system/bin/ssd_emapid

05-30 20:37:44.179 120 120 I DEBUG : #02 bea7e038 6572203a

05-30 20:37:44.179 120 120 I DEBUG : bea7e03c bea7e474 [stack]

05-30 20:37:44.179 120 120 I DEBUG : bea7e040 0000000a

05-30 20:37:44.179 120 120 I DEBUG : bea7e044 00000000

05-30 20:37:44.179 120 120 I DEBUG : bea7e048 00000000

05-30 20:37:44.179 120 120 I DEBUG : bea7e04c 6f6d6572

05-30 20:37:44.179 120 120 I DEBUG : bea7e050 6d206576

05-30 20:37:44.179 120 120 I DEBUG : bea7e054 6c75646f

05-30 20:37:44.179 120 120 I DEBUG : bea7e058 00000a65

05-30 20:37:44.179 120 120 I DEBUG : bea7e05c 00000000

05-30 20:37:44.179 120 120 I DEBUG : bea7e060 00000000

05-30 20:37:44.179 120 120 I DEBUG : bea7e064 00000000

05-30 20:37:44.179 120 120 I DEBUG : bea7e068 00000000

05-30 20:37:44.179 120 120 I DEBUG : bea7e06c 00000000

05-30 20:37:44.179 120 120 I DEBUG : bea7e070 00000000

05-30 20:37:44.179 120 120 I DEBUG : bea7e074 00000000

05-30 20:37:44.179 120 120 I DEBUG :

05-30 20:37:44.179 120 120 I DEBUG : memory near r1:

05-30 20:37:44.179 120 120 I DEBUG : bea7e02c 00000000 00000003 b6faf7eb6572203a ............: re

05-30 20:37:44.179 120 120 I DEBUG : bea7e03c bea7e474 0000000a 0000000000000000 t...............

05-30 20:37:44.179 120 120 I DEBUG : bea7e04c 6f6d6572 6d206576 6c75646f00000a65 remove module...

05-30 20:37:44.179 120 120 I DEBUG : bea7e05c 00000000 00000000 0000000000000000 ................

05-30 20:37:44.179 120 120 I DEBUG : bea7e06c 00000000 00000000 0000000000000000 ................

05-30 20:37:44.189 120 120 I DEBUG :

05-30 20:37:44.189 120 120 I DEBUG : memory near r8:

05-30 20:37:44.189 120 120 I DEBUG : b6fb0de8 79685069 726f665f 616365630000006c iPhy_forcecal...

05-30 20:37:44.189 120 120 I DEBUG : b6fb0df8 635f6c77 746e756f 0073726500006425 wl_counters.%d..

05-30 20:37:44.189 120 120 I DEBUG : b6fb0e08 00006325 30257830 00007838 6b636f73 %c..0x%08x..sock

05-30 20:37:44.189 120 120 I DEBUG : b6fb0e18 00007465 2e373231 2e302e3000000031 et..127.0.0.1...

05-30 20:37:44.189 120 120 I DEBUG : b6fb0e28 6e6e6f63 00746365 7373656d20656761 connect.message

05-30 20:37:44.189 120 120 I DEBUG :

05-30 20:37:44.189 120 120 I DEBUG : memory near r9:

05-30 20:37:44.189 120 120 I DEBUG : b6fb0de4 70616d65 79685069 726f665f61636563 emapiPhy_forceca

05-30 20:37:44.189 120 120 I DEBUG : b6fb0df4 0000006c 635f6c77 746e756f00737265 l...wl_counters.

05-30 20:37:44.189 120 120 I DEBUG : b6fb0e04 00006425 00006325 3025783000007838 %d..%c..0x%08x..

05-30 20:37:44.189 120 120 I DEBUG : b6fb0e14 6b636f73 00007465 2e3732312e302e30 socket..127.0.0.

05-30 20:37:44.189 120 120 I DEBUG : b6fb0e24 00000031 6e6e6f63 007463657373656d 1...connect.mess

05-30 20:37:44.189 120 120 I DEBUG :

05-30 20:37:44.189 120 120 I DEBUG : memory near sl:

05-30 20:37:44.189 120 120 I DEBUG : bea7efb4 6e616c77 00000030 0000000000000000 wlan0...........

05-30 20:37:44.189 120 120 I DEBUG : bea7efc4 bea7e818 00000000 0000000000000000 ................

05-30 20:37:44.189 120 120 I DEBUG : bea7efd4 00000000 00000000 0000000000000000 ................

05-30 20:37:44.189 120 120 I DEBUG : bea7efe4 00000000 00000000 0000000000000000 ................

05-30 20:37:44.189 120 120 I DEBUG : bea7eff4 00000000 00000000 0000000000000000 ................

05-30 20:37:44.189 120 120 I DEBUG :

05-30 20:37:44.189 120 120 I DEBUG : memory near fp:

05-30 20:37:44.189 120 120 I DEBUG : b6fb3124 00000000 ffffffff 0000000300000000 ................

05-30 20:37:44.189 120 120 I DEBUG : b6fb3134 00000000 00000000 0000000000000000 ................

05-30 20:37:44.189 120 120 I DEBUG : b6fb3144 00000001 00000000 0000000000000000 ................

05-30 20:37:44.189 120 120 I DEBUG : b6fb3154 00000000 00000000 0000000000000000 ................

05-30 20:37:44.189 120 120 I DEBUG : b6fb3164 00000000 00000000 0000000000000000 ................

05-30 20:37:44.189 120 120 I DEBUG :

05-30 20:37:44.189 120 120 I DEBUG : memory near ip:

05-30 20:37:44.189 120 120 I DEBUG : bea7e008 bea7e024 00000022 df0027ad00000000 $..."....'......

05-30 20:37:44.189 120 120 I DEBUG : bea7e018 00000000 000003f2 b6f5aa4c b6fb0e0c ........L.......

05-30 20:37:44.199 120 120 I DEBUG : bea7e028 00000000 00000000 00000003b6faf7eb ................

05-30 20:37:44.199 120 120 I DEBUG : bea7e038 6572203a bea7e474 0000000a00000000 : ret...........

05-30 20:37:44.199 120 120 I DEBUG : bea7e048 00000000 6f6d6572 6d2065766c75646f ....remove modul

05-30 20:37:44.199 120 120 I DEBUG :

05-30 20:37:44.199 120 120 I DEBUG : memory near sp:

05-30 20:37:44.199 120 120 I DEBUG : bea7dff8 bea7dff4 bea7dfbc b6ea49a80000000b .........I......

05-30 20:37:44.199 120 120 I DEBUG : bea7e008 bea7e024 00000022 df0027ad00000000 $..."....'......

05-30 20:37:44.199 120 120 I DEBUG : bea7e018 00000000 000003f2 b6f5aa4c b6fb0e0c ........L.......

05-30 20:37:44.199 120 120 I DEBUG : bea7e028 00000000 00000000 00000003b6faf7eb ................

05-30 20:37:44.199 120 120 I DEBUG : bea7e038 6572203a bea7e474 0000000a00000000 : ret...........

05-30 20:37:44.199 120 120 I DEBUG :

05-30 20:37:44.199 120 120 I DEBUG : code around pc:

05-30 20:37:44.199 120 120 I DEBUG : b6f176a4 512fff1e ea00b1ea 0000011fe1a0c00d ../Q............

05-30 20:37:44.199 120 120 I DEBUG : b6f176b4 e92d00f0 e89c0070 e59f7010ef000000 ..-.p....p......

05-30 20:37:44.199 120 120 I DEBUG : b6f176c4 e8bd00f0 e1b00000 512fff1eea00b1e0 ........../Q....

05-30 20:37:44.199 120 120 I DEBUG : b6f176d4 00000122 e1a0c00d e92d00f0e89c0070 ".........-.p...

05-30 20:37:44.199 120 120 I DEBUG : b6f176e4 e3a07f49 ef000000 e8bd00f0e1b00000 I...............

05-30 20:37:44.199 120 120 I DEBUG :

05-30 20:37:44.199 120 120 I DEBUG : code around lr:

05-30 20:37:44.199 120 120 I DEBUG : b6f23f5c 230cfc0b f04f6003 bd7030ffbf00bd70 ...#.`O..0p.p...

05-30 20:37:44.199 120 120 I DEBUG : b6f23f6c 0002a57e 2400b513 94019400eb9af7f3 ~......$........

05-30 20:37:44.199 120 120 I DEBUG : b6f23f7c 4601bd1c 30fff04f f01f4602b510bfb7 ...FO..0.F......

05-30 20:37:44.199 120 120 I DEBUG : b6f23f8c f00c4604 4620fc17 4010e8bdbfb6f01f .F.... F...@....

05-30 20:37:44.199 120 120 I DEBUG : b6f23f9c 4604b510 fc0ef00c 30fff04f46024621 ...F....O..0!F.F

05-30 20:37:44.229 335 365 I BootReceiver: Copying /data/tombstones/tombstone_09 to DropBox(SYSTEM_TOMBSTONE)

05-30 20:37:44.269 335 351 I ActivityManager: broadcast intentact=android.intent.action.DROPBOX_ENTRY_ADDED from pid=335, uid=1000

问题解决

1. 通过gdb，找到libc中crash的point（#00 pc
0000d6c4 /system/lib/libc.so(sendto+20)）

(gdb) b *0x0000d6c4

Breakpoint 1 at 0xd6c4: filebionic/libc/arch-arm/syscalls/sendto.S, line 12.

(gdb)

打开文件，发现crash在汇编函数 ldmfd sp!, {r4, r5, r6, r7}，从这里我们知道，只有一个可能，也就是stack被破坏掉了，回过头来看sp的值bea7e018，对应z4的memory
map，这个应该是一个非法值。也就是说问题应该在sp。到底是什么把sp破坏掉了呢？接着往下看。

2. 看看ssd_emapid的信息，这时候做在什么

(gdb) b*0x000047e7

Breakpoint 1at 0x47e7: file vendor/htc/SsdTestTool/commands/emapi_brcm/emapi_brcm.c, line118. –》send(msg_socket, buf, strlen(buf)-1, 0);

3. 回过头来看device log，05-30 20:37:43.949 2128 2128 D STT:Device:
Running [/system/xbin/su0 kill -15 2272] ...，看到这个以为是系统在ssd_emapid发送信息过程中把把ssd_emapid给kill掉了，看看这个相关的程序这个kill的程序其实是在同一个线程中，所以不会出现这个现象，所以到底是什么导致这个问题的呢？

4. 再来看看log里面的信息signal 13 (SIGPIPE)，这个是tcp在server关闭后，client端如果如果还是想他发送数据的话，系统就会触发一个SIGPIPE信息，而把当前线程关掉。看来问题估计在这个。

5. 加个log确认一下吧，


Solution：可以加一个SIGPIPE的处理函数，系统捕捉到这个信息后，今行相应的处理，而不是把thread退出。

if(signal(SIGPIPE,sigpipe_handle) == SIG_ERR){

LOGE("cattch signal fail!");

goto end;

}