天启android5.1系统无法在非1650批次号的rk3288w芯片上启动

挂掉log，说明在rtc初始化后挂掉

[    1.420240] ======== PULL WL_REG_ON(-) HIGH! ========

[    1.420246] [WLAN_RFKILL]: rockchip_wifi_power:

[    1.420253] [WLAN_RFKILL]: rockchip_wifi_ref_voltage:

[    1.420258] [WLAN_RFKILL]: rockchip_wifi_ref_voltage: wifi io reference voltage control is disabled.

[    1.420759] android_usb gadget: Mass Storage Function, version: //

[    1.420768] android_usb gadget: Number of LUNs=

[    1.420776]  lun0: LUN: removable file: (no medium)

[    1.420782]  lun1: LUN: removable file: (no medium)

[    1.420924] android_usb gadget: android_usb ready

[    1.420991] sensor_init: Probe name sensors

[    1.421006] sensor-dev.c v1. add angle calculation support between two gsensors --

[    1.421532] rtc_hym8563 -: setting system clock to -- :: UTC ()

[    1.430593] u?

开发板正常log，说明在snd-usb-audio初始化前挂掉

[    2.456978] sensor_init: Probe name sensors

[    2.456995] sensor-dev.c v1. add angle calculation support between two gsensors --

[    2.457525] rtc_hym8563 -: setting system clock to -- :: UTC ()

[    2.463556] rockchip-spdif-card rockchip-spdif-card.:  rk-hdmi-spdif-hifi <-> ff880000.rockchip-spdif mapping ok

[    2.464517] ret

[    2.464896] usbcore: registered new interface driver snd-usb-audio

[    2.464903] ALSA device list:

[    2.464908]   #: RK_ES8323

[    2.464912]   #: RK-SPDIF-CARD

system.map
kernel 部分驱动启动顺序映射表

c0c11154 t __initcall_init7

c0c11158 t __initcall_sensor_init7

c0c1115c t __initcall_rtc_hctosys7

c0c11160 t __initcall_sync_debugfs_init7

c0c11164 t __initcall_clk_debug_init7

c0c11168 t __initcall_rockchip_headset_init7

c0c1116c t __initcall_rockchip_spdif_init7

c0c11170 t __initcall_tcp_congestion_default7

c0c11174 t __initcall_tcp_fastopen_init7

c0c11178 t __initcall_ip_auto_config7

c0c1117c t __initcall_drm_misc_init7s

c0c11180 t __initcall_clk_disable_unused7s

c0c11184 t __initcall_snd_usb_audio_init7s

c0c11188 t __initcall_alsa_sound_last_init7s

c0c1118c t __initcall_initialize_hashrnd7s

c0c11190 T __con_initcall_end

c0c11190 T __con_initcall_start

c0c11190 T __initcall_end

c0c11190 t __initcall_selinux_init

在rtc_hctosys与snd_usb_audio启动之间有以下驱动程序初始化

c0c11160 t __initcall_sync_debugfs_init7

c0c11164 t __initcall_clk_debug_init7

c0c11168 t __initcall_rockchip_headset_init7

c0c1116c t __initcall_rockchip_spdif_init7

c0c11170 t __initcall_tcp_congestion_default7

c0c11174 t __initcall_tcp_fastopen_init7

c0c11178 t __initcall_ip_auto_config7

c0c1117c t __initcall_drm_misc_init7s

c0c11180 t __initcall_clk_disable_unused7s

在这些驱动函数初始化中加入log调试
挂掉log：

[    3.037934] sensor_init: Probe name sensors

[    3.037949] sensor-dev.c v1. add angle calculation support between two gsensors --

[    3.038475] rtc_hym8563 -: setting system clock to -- :: UTC ()

[    3.044644] rockchip-spdif-card rockchip-spdif-card.:  rk-hdmi-spdif-hifi <-> ff880000.rockchip-spdif mapping ok

[    3.044959] carroll : tcp_fastopen_init

[    3.044987] carroll : ip_auto_config

u�

正常启动log为：

[    2.456978] sensor_init: Probe name sensors

[    2.456995] sensor-dev.c v1. add angle calculation support between two gsensors --

[    2.457525] rtc_hym8563 -: setting system clock to -- :: UTC ()

[    2.463556] rockchip-spdif-card rockchip-spdif-card.:  rk-hdmi-spdif-hifi <-> ff880000.rockchip-spdif mapping ok

[    2.463889] carroll : tcp_fastopen_init

[    2.463917] carroll : ip_auto_config

[    2.464517] ret

[    2.464588] carroll : clk_disable_unused

[    2.464896] usbcore: registered new interface driver snd-usb-audio

[    2.464903] ALSA device list:

[    2.464908]   #: RK_ES8323

[    2.464912]   #: RK-SPDIF-CARD

对比上述驱动初始化顺序表发现只剩下一个驱动初始化的嫌疑
c0c1117c t __initcall_drm_misc_init7s

查找drm_misc_init在整个SDK中 grep drm_misc_init -r firefly-rk3288_android5.1_git_20180126/*

firefly-rk3288_android5.1_git_20180126/android.iws:      <find>drm_misc_init</find>

Binary file firefly-rk3288_android5.1_git_20180126/kernel/.tmp_vmlinux2 matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/vmlinux matches

firefly-rk3288_android5.1_git_20180126/kernel/System.map:c0be3a14 t drm_misc_init

firefly-rk3288_android5.1_git_20180126/kernel/System.map:c0c1111c t __initcall_drm_misc_init7s

Binary file firefly-rk3288_android5.1_git_20180126/kernel/pie/pie_stage1.o matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/pie/pie_stage2.o matches

firefly-rk3288_android5.1_git_20180126/kernel/.tmp_System.map:c0be3a14 t drm_misc_init

firefly-rk3288_android5.1_git_20180126/kernel/.tmp_System.map:c0c1111c t __initcall_drm_misc_init7s

Binary file firefly-rk3288_android5.1_git_20180126/kernel/vmlinux.o matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/virtd matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/built-in.o matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/virtdrm.o matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/drivers/built-in.o matches

发现并没有drm_misc_init的函数，到此嫌疑只能推给这几个文件了

Binary file firefly-rk3288_android5.1_git_20180126/kernel/.tmp_vmlinux2 matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/vmlinux matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/pie/pie_stage1.o matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/pie/pie_stage2.o matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/vmlinux.o matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/virtd matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/built-in.o matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/virtdrm.o matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/drivers/built-in.o matches

根据名字可能再筛选出以下三个

Binary file firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/virtd matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/virtdrm.o matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/built-in.o matches

可能是这两个的原因

Binary file firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/virtd matches

Binary file firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/virtdrm.o matches

调试发现firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/目录下的Makefile发现
删除此驱动模块编译注册 obj-y                      += virtdrm.o
产生编译错误

  OBJCOPY pie/pie.bin

  OBJCOPY pie/pie.bin.o

  LD      pie/built-in.o

  GEN     .version

  CHK     include/generated/compile.h

  UPD     include/generated/compile.h

  CC      init/version.o

  LD      init/built-in.o

drivers/built-in.o: In function `mmc_blk_shutdown':

binder.c:(.text+0x338e90): undefined reference to `mmc_blk_emmc_remove'

drivers/built-in.o: In function `mmc_blk_probe':

binder.c:(.text+0x33ae28): undefined reference to `mmc_blk_emmc_add'

drivers/built-in.o: In function `mmc_blk_remove':

binder.c:(.text+0x33b270): undefined reference to `mmc_blk_emmc_remove'

make: *** [vmlinux] Error

/work/rk3288/firefly-rk3288_android5.1_git_20180126

TARGET_PRODUCT=rk3288_box

TARGET_HARDWARE=rk30board

IMG_TARGET=all , ota = withoutkernel

system filesysystem is ext4

然后分别屏蔽代码调用

编译成功并且跳过之前挂掉的地方，但是在内核启动完成后挂了 log

[    2.446169] sensor_init: Probe name sensors

[    2.446183] sensor-dev.c v1. add angle calculation support between two gsensors --

[    2.446709] rtc_hym8563 -: setting system clock to -- :: UTC ()

[    2.452731] rockchip-spdif-card rockchip-spdif-card.:  rk-hdmi-spdif-hifi <-> ff880000.rockchip-spdif mapping ok

[    2.453062] carroll : tcp_fastopen_init

[    2.453091] carroll : ip_auto_config

[    2.453108] carroll : clk_disable_unused

[    2.453418] usbcore: registered new interface driver snd-usb-audio

[    2.453426] ALSA device list:

[    2.453430]   #: RK_ES8323

[    2.453435]   #: RK-SPDIF-CARD

分析原因屏蔽掉的源码为添加emmc设备，屏蔽后添加失败，文件系统初始化不成功

[    1.650105] ..dw_mci_set_ios:  no card. [mmc1]

[    1.662562] mmc0: BKOPS_EN bit is not set

[    1.664435] rk_sdmmc: BOOT Bus speed=0Hz,Bus width=8bits.[mmc0]

[    1.666717] mmc_host mmc0: Bus speed (slot ) = 100000000Hz (slot req 100000000Hz, actual 100000000HZ div = )

[    1.666742] rk_sdmmc: BOOT dw_mci_setup_bus: argue clk_mmc workaround out normal clock [mmc0]

[    1.666764] [mmc0] tuning regsbase addr 0x218.

[    1.667453] [mmc0] Data transmission error !!!!  MINTSTS: [0x00000088]

[    1.667464] [mmc0] host was already tuning, Don't need to retry tune again ignore 0.

[    1.667492] dwmmc_rockchip ff0f0000.rksdmmc: Tuning error: cmd.error:, data.error:-

[    1.667518] [mmc0] Data transmission error !!!!  MINTSTS: [0x00000088]

[    1.667527] [mmc0] host was already tuning, Don't need to retry tune again ignore 0.

[    1.667554] dwmmc_rockchip ff0f0000.rksdmmc: Tuning error: cmd.error:-, data.error:-

[    1.667580] [mmc0] Data transmission error !!!!  MINTSTS: [0x00000088]

[    1.667589] [mmc0] host was already tuning, Don't need to retry tune again ignore 0.

[    1.667615] dwmmc_rockchip ff0f0000.rksdmmc: Tuning error: cmd.error:-, data.error:-

[    1.667640] [mmc0] Data transmission error !!!!  MINTSTS: [0x00000088]

[    1.667649] [mmc0] host was already tuning, Don't need to retry tune again ignore 0.

[    1.667676] dwmmc_rockchip ff0f0000.rksdmmc: Tuning error: cmd.error:, data.error:-

[    1.667722] dwmmc_rockchip ff0f0000.rksdmmc: Good phase range - ( len)

[    1.667733] dwmmc_rockchip ff0f0000.rksdmmc: Good phase range - ( len)

[    1.667744] dwmmc_rockchip ff0f0000.rksdmmc: Best phase range - ( len)

[    1.667754] dwmmc_rockchip ff0f0000.rksdmmc: Successfully tuned phase to

[    1.667796] mmc0: new HS200 MMC card at address

[    1.668069] mmcblk0: mmc0: AJNB4R 14.5 GiB

[    1.668202] mmcblk0rpmb: mmc0: AJNB4R partition  4.00 MiB

[    1.668519]      uboot: 0x000400000 -- 0x000800000 ( MB)

[    1.668530]       misc: 0x000800000 -- 0x000c00000 ( MB)

[    1.668539]   resource: 0x000c00000 -- 0x001c00000 ( MB)

[    1.668548]     kernel: 0x001c00000 -- 0x002c00000 ( MB)

[    1.668557]       boot: 0x002c00000 -- 0x004c00000 ( MB)

[    1.668566]   recovery: 0x004c00000 -- 0x006c00000 ( MB)

[    1.668574]     backup: 0x006c00000 -- 0x00a000000 ( MB)

[    1.668583]      cache: 0x00a000000 -- 0x012000000 ( MB)

[    1.668591]     kpanic: 0x012000000 -- 0x012400000 ( MB)

[    1.668599]     system: 0x012400000 -- 0x072400000 ( MB)

[    1.668608]   metadata: 0x072400000 -- 0x073400000 ( MB)

[    1.668616] baseparamer: 0x073400000 -- 0x073800000 ( MB)

[    1.668625]   userdata: 0x077800000 -- 0x3a3a00000 ( MB)

[    1.668653]  mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 p11 p12 p13[    1.669832] dwmmc_rockchip ff0c0000.rksdmmc: DW MMC controller ao

[    1.669848] dwmmc_rockchip ff0c0000.rksdmmc:  slots initialized

[    1.670158] dw cru_regsbase addr 0x1d8.

[    1.670168] dw cru_reset_offset val .

[    1.670179] dwmmc_rockchip ff0d0000.rksdmmc: Version ID is 270a

[    1.670218] dwmmc_rockchip ff0d0000.rksdmmc: failed to get hpclk_mmc

[    1.670473] dwmmc_rockchip ff0d0000.rksdmmc: Using internal DMA controller.

[    1.670605] dw_mci_init_slot: fmin=, fmax= [mmc2]

[    1.670851] ..dw_mci_set_ios:  no card. [mmc2]

------------------------------------------------------------------------------------------

[    1.670945] carroll : mmc_blk_probe mmc_blk_emmc_add

------------------------------------------------------------------------------------------

[    1.670992] ..dw_mci_set_ios:  no card. [mmc1]

[    1.689476] ..dw_mci_set_ios:  no card. [mmc2]

[    1.709161] ..dw_mci_set_ios:  no card. [mmc2]

[    1.709185] dwmmc_rockchip ff0d0000.rksdmmc: DW MMC controller at irq ,  bit host data width,  deep fifo

[    1.709198] dwmmc_rockchip ff0d0000.rksdmmc:  slots initialized

说明这里不能删除只能做修改兼容其他批次cpu

再次把问题锁定文件，下边几个文件好像是天启android5.1特供的，就是这个东西让内核挂掉的，天启android4.4以及荣品都能正常开机，并且源码中也无下属文件
firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/virtdrm.o文件
firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/virtd
firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/virtdrm.mod.c
firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/.virtdrm.o.cmd

天启2017年07-21添加kernel->driver:fix queue file，才添加的这几个文件
https://bitbucket.org/T-Firefly/firenow-lollipop/commits/bd3833f7c215b3f907464866510412ae505d2e73

最终将问题锁定在编译产生的二进制文件firefly-rk3288_android5.1_git_20180126/kernel/drivers/char/virtd

下节尝试逆向分析

天启android5.1系统无法在非1650批次号的rk3288w芯片上启动的更多相关文章

  1. Linux系统下给非root用户添加sudo权限

    Linux系统下给非root用户添加sudo权限 有时,在linux系统中非root用户运行sudo命令,会提示类似信息:  xxx is not in the sudoers file. This ...

  2. Android5.1系统WebView内存泄漏场景

    问题现象 (该文章,引自零号路的私人博客,本人在浏览框架的开发过程中,用该方式,规避了内存泄露的问题.) 在Android5.1系统中,会发现App存在 WebView 泄漏情况,还比较严重.并且只是 ...

  3. 迅为iTOP-4418开发板-Android5.1系统编译补充

    基于iTOP-4418开发板-Android5.1系统编译补充 5.6 编译-20181225 日期之后的源码 本文档补充介绍 4418 编译网盘目录 “J:\局域网共享_阮\iTOP4418 开发板 ...

  4. 容器计划任务大坑：在alpine容器里，想用非root帐号执行crontab任务

    我只能说抱歉,我前前后后测试了七天, 将自己预想的配置错误,一个一个去验证. 非root帐号在alpine容器里执行crontab任务,还是失败, 输出依旧是一片空白~ stackoverflow里, ...

  5. SQLSERVER聚集索引与非聚集索引的再次研究（上）

    SQLSERVER聚集索引与非聚集索引的再次研究(上) 上篇主要说聚集索引 下篇的地址:SQLSERVER聚集索引与非聚集索引的再次研究(下) 由于本人还是SQLSERVER菜鸟一枚,加上一些实验的逻 ...

  6. Wireshark分析非标准端口号流量

    Wireshark分析非标准端口号流量 2.2.2  分析非标准端口号流量Wireshark分析非标准端口号流量 应用程序运行使用非标准端口号总是网络分析专家最关注的.关注该应用程序是否有意涉及使用非 ...

  7. Java Web项目在Mac系统上启动时提示nodename nor servname provided的解决办法

    今天在Mac系统上启动Java Web项目的时候,提示了Java.net.UnknownHostException: yangxiaomindeMacBook-Pro.local nodename n ...

  8. 【win10主机】连接virtualbox上【32位winXP系统虚拟机】上启动的mysql

    问题Q: 在virtualbox上启动winXP系统虚拟机后,启动含oa项目的tomcat,数据库服务也运行起来了,虚拟机上连接无误: 在上一篇<主机访问 虚拟机启动的项目>基础上,尝试连 ...

  9. 初探RT-Thread系统在GD32E103x芯片上的使用，点亮LED灯

    初探RT-Thread系统在GD32E103x芯片上的使用,点亮LED灯 前言 ​ 随着中美贸易战的加剧,很多公司越来越重视使用国产技术的重要性.使用国产技术,一方面可规避国外对技术的封锁造成产品核心 ...

随机推荐

  1. 通过反射获取方法的参数名称（JDK8以上支持）

    方法的参数名,在很多时候我们是需要反射得到的.但是在java8之前,代码编译为class文件后,方法参数的类型是固定的,但参数名称却丢失了,这和动态语言严重依赖参数名称形成了鲜明对比.(java是静态 ...

  2. mysql 通过navicat 添加函数或者过程

    1. 添加函数时, 函数参数的  varchar(255) 一定要加上 255,返回也要加.不加一直保存不了,狂试: 2. 添加过程时, 进入课程体 编辑时  也要加上 varchar 的位数限制.不 ...

  3. flask之注册功能

    一:注册功能 1:前端准备表单 # 前端代码 <!DOCTYPE html> <html lang="en"> <head> <meta ...

  4. Centos7硬盘空间扩容（vmware虚拟机）

    1. 查看系统挂载点 df -h 2. 系统关机 init 0 硬盘1空间修改为100G,保存并启动 3.查看磁盘 fdisk -l /dev/sda空间加上去了 3. 硬盘分区 fdisk /dev ...

  5. POJ 3259 Wormholes ( SPFA判断负环 && 思维 )

    题意 : 给出 N 个点,以及 M 条双向路,每一条路的权值代表你在这条路上到达终点需要那么时间,接下来给出 W 个虫洞,虫洞给出的形式为 A B C 代表能将你从 A 送到 B 点,并且回到 C 个 ...

  6. FFT IP核调用与仿真之SCALE压缩因子设置

    关于FFT IP核的配置,网上有很多相关的资料可以参考,但是唯独涉及到scaled压缩因子设置这个参数,资料却非常匮乏,这是个什么参数,应该整么设置,设置后对结果输出会有什么影响,整样才能知道它设置的 ...

  7. python 文件读写操作打开模式

    ‘r’:只读.该文件必须已存在. ‘r+’:可读可写.该文件必须已存在,写为追加在文件内容末尾. ‘rb’:表示以二进制方式读取文件.该文件必须已存在. ‘w’:只写.打开即默认创建一个新文件,如果文 ...

  8. rem布局及响应式布局

    流式布局(100%布局)(可能:做的页面不是很美观)效果与弹性布局一样 不设置宽高:表示宽 auto 最外层:保证100% 等比例缩放的算法:  320/10  已知的一个比例  =  已知的宽/x  ...

  9. Malformed UTF-8 characters, possibly incorrectly encoded 或中文乱码 （Uncaught InvalidArgumentException: Malformed UTF-8 characters, possibly incorrectly encoded in）

    问题: Uncaught InvalidArgumentException: Malformed UTF-8 characters, possibly incorrectly encoded in 是 ...

  10. p5342 [TJOI2019]甲苯先生的线段树

    分析  代码 #include<bits/stdc++.h> using namespace std; #define int long long ],yy[],cnt1,cnt2; ][ ...