【RK3399 Android系统】，启动时出现”Unable to handle kernel paging request at virtual address 490000004c“的解决思路

        从Firefly官网下载的安卓系统源码，编译后，修改了部分驱动，启动的时候偶尔会出现”Unable to handle kernel paging request at virtual address 490000004c“的报错，出现这种情况基本系统就无法启动了。

[    1.739143] ioctrl: ioctrl driver register success!
[    1.739187] register ioctrl driver platform! 
[    1.739201] register ioctrl driver chrdev! 
[    1.739221] register ioctrl driver create! 
[    1.744889] register ioctrl driver success! 
[    1.745023] Unable to handle kernel paging request at virtual address 490000004c
[    1.746071] pgd = ffffff80093ea000
[    1.746373] [490000004c] *pgd=0000000000000000, *pud=0000000000000000
[    1.746965] Internal error: Oops: 96000005 [#1] PREEMPT SMP
[    1.747465] Modules linked in:
[    1.747761] CPU: 4 PID: 37 Comm: kdevtmpfs Not tainted 4.4.103 #559
[    1.748318] Hardware name: AIO-3399JD4 Board mipi (Android) (DT)
[    1.748853] task: ffffffc0f1d00000 task.stack: ffffffc0f1d08000
[    1.749382] PC is at __kmalloc_track_caller+0xe8/0x238
[    1.749837] LR is at __kmalloc_track_caller+0x58/0x238
[    1.750291] pc : [<ffffff80081adee4>] lr : [<ffffff80081ade54>] pstate: 60400145
[    1.750943] sp : ffffffc0f1d0bc80
[    1.751242] x29: ffffffc0f1d0bc80 x28: ffffff80093d0520 
[    1.751736] x27: ffffff80093a4b90 x26: 000000000001119c 
[    1.752229] x25: ffffffc0f1d00000 x24: ffffffc0f1d00000 
[    1.752721] x23: ffffff8008535158 x22: 00000000024000c0 
[    1.753214] x21: 000000000000000a x20: ffffffc000201e00 
[    1.753707] x19: 000000490000004c x18: 0000000030d00800 
[    1.754199] x17: 0000000000000000 x16: 0000000000000000 
[    1.754691] x15: 0000000000000000 x14: 0fffffffffffffff 
[    1.755184] x13: 0000000000000030 x12: 0000000000000008 
[    1.755676] x11: 0101010101010101 x10: 7f7f7fff7f7f7f7f 
[    1.756168] x9 : fefeff93fefeff71 x8 : 7f7f7f7f7f7f7f7f 
[    1.756661] x7 : 646c68732e636d72 x6 : 0080808000808080 
[    1.757153] x5 : 0000000000000000 x4 : 0000000000000000 
[    1.757645] x3 : 0000009500000072 x2 : 000000000001119c 
[    1.758137] x1 : 00000040ede26000 x0 : 0000000000000000 
[    1.758630] 
[    1.758630] PC: 0xffffff80081ade64:
[    1.759071] de64  d2800013 b40007e0 d5384118 aa1803f9 b9401b00 11000400 b9001b00 f9400280
[    1.759856] de84  d538d081 91002000 f860683a b9401b00 51000400 b9001b00 35000080 f9400300
[    1.760636] dea4  36080040 94260e30 f9400280 d538d081 8b000022 f9400442 eb02035f 54fffda1
[    1.761417] dec4  f8606833 b50000d3 aa1403e0 2a1603e1 97fff86c aa0003f3 1400001c b9802280
[    1.762197] dee4  f8606a7b b9401b20 11000400 b9001b20 f9400281 91002342 d538d080 8b010000
[    1.762977] df04  f9800011 c87f7003 ca130063 ca1a039c aa1c007c b500007c c823081b 35ffff43
[    1.763757] df24  b9401b20 51000400 b9001b20 35000080 f9400320 36080040 94260e0b b5fff9bc
[    1.764536] df44  b9802280 f8a06b60 367800d6 b40000b3 b9801e82 aa1303e0 52800001 94074b68
[    1.765317] 
[    1.765317] LR: 0xffffff80081addd4:
[    1.765758] ddd4  aa1503e1 97fff44f f94006a0 b4fffee0 2a1403e0 a94153f3 a9425bf5[    1.766440] mmc0: MAN_BKOPS_EN bit is not set

        根据网上的搜索结果，查看地址为pgd = ffffff80093ea000，查看系统源码下的kernel下的System.map，查看该该地址对应的函数，为swapper_pg_dir，这个函数不是自己写的函数，因此再往下查有些困难。

ubt@ubt-ThinkPad-E470:~/proj/firefly-rk3399/kernel$ vim System.map

     1 0000000000000000 A __rela_size
     2 0000000000000000 A _kernel_flags_le_hi32
     3 0000000000000000 A _kernel_offset_le_hi32
     4 0000000000000000 A _kernel_size_le_hi32
     5 000000000000000a A _kernel_flags_le_lo32
     6 0000000000000200 A PECOFF_FILE_ALIGNMENT
     7 0000000000080000 A _kernel_offset_le_lo32
     8 000000000113fdb0 A __rela_offset
     9 000000000136d000 A _kernel_size_le_lo32
    10 ffffff8008080000 t _head
    11 ffffff8008080000 T _text
    12 ffffff8008080800 T __exception_text_start
    13 ffffff8008080800 T _stext
    14 ffffff8008080800 T do_undefinstr
    15 ffffff8008080b0c T do_mem_abort
    16 ffffff8008080bd0 T do_sp_pc_abort
    17 ffffff8008080ccc T do_debug_exception
    18 ffffff8008080d98 t gic_handle_irq
    19 ffffff8008080e3c t gic_handle_irq
    20 ffffff8008080f90 T __entry_text_start
    21 ffffff8008080f90 T __exception_text_end
    22 ffffff8008081000 T vectors
    23 ffffff8008081784 t el0_sync_invalid
    24 ffffff8008081834 t el0_irq_invalid
    25 ffffff80080818e4 t el0_fiq_invalid
    26 ffffff8008081994 t el0_error_invalid
    27 ffffff8008081a44 t el0_fiq_invalid_compat
    28 ffffff8008081af8 t el0_error_invalid_compat
    29 ffffff8008081bac t el1_sync_invalid
    30 ffffff8008081c4c t el1_irq_invalid
    31 ffffff8008081cec t el1_fiq_invalid
    32 ffffff8008081d8c t el1_error_invalid
    33 ffffff8008081e40 t el1_sync
    34 ffffff8008081f14 t el1_da
    35 ffffff8008081f14 t el1_ia
    36 ffffff8008081fb4 t el1_sp_pc
    37 ffffff8008081fc4 t el1_undef
    38 ffffff8008081fd0 t el1_dbg
    39 ffffff8008082060 t el1_inv
    40 ffffff8008082080 t el1_irq
    41 ffffff80080821f0 t el1_preempt
……
……
……
109720 ffffff80093e6048 B cfg80211_regdomain
109721 ffffff80093e6050 b reg_crda_timeouts
109722 ffffff80093e6058 b reg_pdev
109723 ffffff80093e6060 b reg_requests_lock
109724 ffffff80093e6068 b user_alpha2
109725 ffffff80093e6070 b reg_pending_beacons_lock
109726 ffffff80093e6078 b reg_indoor_lock
109727 ffffff80093e607c b reg_is_indoor
109728 ffffff80093e6080 b reg_is_indoor_portid
109729 ffffff80093e6088 b csa_attrs.67572
109730 ffffff80093e6798 b __key.66742
109731 ffffff80093e6798 b nullstats.40117
109732 ffffff80093e67b8 b __key.61255
109733 ffffff80093e67b8 b __key.61515
109734 ffffff80093e67b8 b __key.69218
109735 ffffff80093e67b8 b __key.69219
109736 ffffff80093e67b8 b __key.69220
109737 ffffff80093e67b8 b __key.69224
109738 ffffff80093e67b8 b rfkill_no.23457
109739 ffffff80093e67c0 b rfkill_global_states
109740 ffffff80093e67d8 b __key.23501
109741 ffffff80093e67d8 b __key.23502
109742 ffffff80093e67d8 b __key.23603
109743 ffffff80093e67d8 b g_rfkill
109744 ffffff80093e67e0 b power_set_time
109745 ffffff80093e67e4 b wifi_power_state
109746 ffffff80093e67e8 b country_cloc
109747 ffffff80093e67f8 b wifi_chip_type_string
109748 ffffff80093e6838 B wifi_custom_mac_addr
109749 ffffff80093e6840 b g_rfkill
109750 ffffff80093e6848 b bt_power_state
109751 ffffff80093e6850 b bluetooth_dir
109752 ffffff80093e6858 b sleep_dir
109753 ffffff80093e6860 b empty.48655
109754 ffffff80093e68a0 b net_header
109755 ffffff80093e68a8 b klist_remove_lock
109756 ffffff80093e68b0 A __bss_stop
109757 ffffff80093e7000 A idmap_pg_dir
109758 ffffff80093ea000 A swapper_pg_dir
109759 ffffff80093ec000 A reserved_ttbr0
109760 ffffff80093ed000 A _end

        这步走不通，只能用笨方法。还原逐步添加。

        首先屏蔽掉自己添加的所有驱动，图中可以看到，一共添加了4个驱动，分别是adc，tlc，ioctrl，ioint。首先全部屏蔽，编译，大量测试，结果测试约100次左右没有出现任何启动失败的情况，说明问题肯定出现在这几个驱动中。然后依次添加驱动，当添加到ioctrl时，大量测试，出现了启动失败的情况，那么问题逐步缩小到了ioctrl中。

        在ioctrl的文件中，有以下几个函数，全部屏蔽，依次添加测试，当添加到firefly_ioctrl_probe（）函数的时候，大量测试又出现了同样的问题，说明在这个函数中存在问题。继续在这个函数中依次屏蔽测试。

         此函数中初始化了几个IO引脚，依次添加测试，当添加到红绿黄灯的IO引脚控制时，问题复现。

 

        分析该问题，初始化红绿黄引脚后，复现问题，该引脚为指示灯引脚，且该引脚在初始化之前，adc的电量检测中调用过，因此可以断定，出现该问题为引脚未初始化，被调用引起异常，解决方式即为调整驱动启动顺序或者在adc中延后调用该接口，修改后进行测试。

        经过多次测试，出现该问题原因为在系统的其他函数中，调用该引脚资源，但是使用时未作判断，导致使用越界，系统崩溃。具体哪里调用仍未查出，只能使用是避免使用这三个IO口。