Android 12 init(4) 子进程回收与服务重启分析
龚奕
文章托管在gitee上 Android Notes , 同步csdn
本文基于Android12 分析
在init运行过程中，不可避免的会出现子进程或服务退出，需要做一些针对性处理：
- 对于已终止的子进程需要将其回收掉，防止产生僵尸进程
- 对于非oneshot服务，需要重新将其拉起，防止异常退出。
处理子进程退出
在init中通过监听信号 SIGCHLD，来获取子进程终止事件，然后做一些针对性动作。
InstallSignalFdHandler
初始化信号处理器，注册子进程终止的监听
/// @system/core/init/init.cpp
static void InstallSignalFdHandler(Epoll* epoll) {
// Applying SA_NOCLDSTOP to a defaulted SIGCHLD handler prevents the signalfd from receiving
// SIGCHLD when a child process stops or continues (b/77867680#comment9).
const struct sigaction act { .sa_handler = SIG_DFL, .sa_flags = SA_NOCLDSTOP };
sigaction(SIGCHLD, &act, nullptr);// 添加flag ，不接收进程 stop/continue 事件
sigset_t mask;
sigemptyset(&mask);
sigaddset(&mask, SIGCHLD);
if (!IsRebootCapable()) { // 没有CAP_SYS_BOOT capability，不具备重启能力
// If init does not have the CAP_SYS_BOOT capability, it is running in a container.
// In that case, receiving SIGTERM will cause the system to shut down.
sigaddset(&mask, SIGTERM); // 添加SIGTERM到信号集
}
if (sigprocmask(SIG_BLOCK, &mask, nullptr) == -1) { // block这些信号，与signalfd匹配使用
PLOG(FATAL) << "failed to block signals";
}
// Register a handler to unblock signals in the child processes.
// UnblockSignals在fork返回之前，在子进程上下文中被执行，使得子进程不block这些信号
const int result = pthread_atfork(nullptr, nullptr, &UnblockSignals);
if (result != 0) {
LOG(FATAL) << "Failed to register a fork handler: " << strerror(result);
}
signal_fd = signalfd(-1, &mask, SFD_CLOEXEC); // 创建fd，用于读取被block的信号
if (signal_fd == -1) {
PLOG(FATAL) << "failed to create signalfd";
}
// 通过 epoll 监听新的信号到来
if (auto result = epoll->RegisterHandler(signal_fd, HandleSignalFd); !result.ok()) {
LOG(FATAL) << result.error();
}
}
UnblockSignals
在子进程执行该函数，即子进程默认是不阻塞这些信号的。
/// @system/core/init/init.cpp
static void UnblockSignals() {
const struct sigaction act { .sa_handler = SIG_DFL };
sigaction(SIGCHLD, &act, nullptr);
sigset_t mask;
sigemptyset(&mask);
sigaddset(&mask, SIGCHLD);
sigaddset(&mask, SIGTERM);
if (sigprocmask(SIG_UNBLOCK, &mask, nullptr) == -1) {
PLOG(FATAL) << "failed to unblock signals for PID " << getpid();
}
}
当epoll监听到signal_fd有事件到来，即产生了相关信号，则会回调HandleSignalFd来处理
HandleSignalFd
/// system/core/init/init.cpp
static void HandleSignalFd() {
signalfd_siginfo siginfo;
// 从fd读取信号信息
ssize_t bytes_read = TEMP_FAILURE_RETRY(read(signal_fd, &siginfo, sizeof(siginfo)));
if (bytes_read != sizeof(siginfo)) {
PLOG(ERROR) << "Failed to read siginfo from signal_fd";
return;
}
switch (siginfo.ssi_signo) {
case SIGCHLD: // 子进程终止事件
ReapAnyOutstandingChildren();
break;
case SIGTERM: // 信号15，kill命令默认发送的信号
HandleSigtermSignal(siginfo);
break;
default:
PLOG(ERROR) << "signal_fd: received unexpected signal " << siginfo.ssi_signo;
break;
}
}
处理 SIGCHLD 会调用ReapAnyOutstandingChildren，它实现了所有终止子进程的回收
ReapAnyOutstandingChildren
/// @system/core/init/sigchld_handler.cpp
void ReapAnyOutstandingChildren() {
while (ReapOneProcess() != 0) { // 循环处理所有已终止的进程（调用exit或被信号杀死）
}
}
ReapOneProcess
这个函数的作用如下：
- 调用waitid回收已经终止的进程
- 打印进程死亡原因，被信号kill或者调用exit退出
- 针对 service 调用其 Reap 函数，清理状态、处理重启及 onrestart 命令
/// @system/core/init/sigchld_handler.cpp
static pid_t ReapOneProcess() {
siginfo_t siginfo = {};
// This returns a zombie pid or informs us that there are no zombies left to be reaped.
// It does NOT reap the pid; that is done below.
if (TEMP_FAILURE_RETRY(waitid(P_ALL, 0, &siginfo, WEXITED | WNOHANG | WNOWAIT)) != 0) {
PLOG(ERROR) << "waitid failed";
return 0;
}
auto pid = siginfo.si_pid;
if (pid == 0) return 0;
// At this point we know we have a zombie pid, so we use this scopeguard to reap the pid
// whenever the function returns from this point forward.
// We do NOT want to reap the zombie earlier as in Service::Reap(), we kill(-pid, ...) and we
// want the pid to remain valid throughout that (and potentially future) usages.
auto reaper = make_scope_guard([pid] { TEMP_FAILURE_RETRY(waitpid(pid, nullptr, WNOHANG)); });
std::string name;
std::string wait_string;
Service* service = nullptr;
if (SubcontextChildReap(pid)) { // 处理Subcontext进程退出，非正在关机中会重启该进程
name = "Subcontext";
} else {
// 判断该进程是否是某个服务，比如surfaceflinger
service = ServiceList::GetInstance().FindService(pid, &Service::pid);
if (service) { // 服务存在
name = StringPrintf("Service '%s' (pid %d)", service->name().c_str(), pid);
if (service->flags() & SVC_EXEC) { // 通过'exec' or 'exec_start' 启动的可执行程序进程
auto exec_duration = boot_clock::now() - service->time_started();
auto exec_duration_ms =
std::chrono::duration_cast<std::chrono::milliseconds>(exec_duration).count();
wait_string = StringPrintf(" waiting took %f seconds", exec_duration_ms / 1000.0f);
} else if (service->flags() & SVC_ONESHOT) { // 一次性的服务
auto exec_duration = boot_clock::now() - service->time_started();
auto exec_duration_ms =
std::chrono::duration_cast<std::chrono::milliseconds>(exec_duration)
.count();
wait_string = StringPrintf(" oneshot service took %f seconds in background",
exec_duration_ms / 1000.0f);
}
} else {
name = StringPrintf("Untracked pid %d", pid); // 非服务进程，未追踪的进程退出
}
}
if (siginfo.si_code == CLD_EXITED) { // 进程 exit
LOG(INFO) << name << " exited with status " << siginfo.si_status << wait_string;
} else { // 进程被 kill
LOG(INFO) << name << " received signal " << siginfo.si_status << wait_string;
}
if (!service) return pid;
service->Reap(siginfo); // 调用Reap，做清理工作，并重启非oneshot的服务
if (service->flags() & SVC_TEMPORARY) { // 通过'exec' 启动的服务
ServiceList::GetInstance().RemoveService(*service);
}
return pid;
}
Service::Reap
- kill进程组所有进程
- 清理所有socket资源相关文件
- 回调reap_callbacks_，比如之前设置的启动失败回调
- critical服务持续保持退出(4分钟大于4次)，则重启到BootLoader
- 标记服务SVC_RESTARTING，在HandleProcessActions中重启服务
- 执行onrestart命令
- 通知服务状态改变
/// @system/core/init/service.cpp
void Service::Reap(const siginfo_t& siginfo) {
if (!(flags_ & SVC_ONESHOT) || (flags_ & SVC_RESTART)) {// 不是一次性的或者需要重启的
KillProcessGroup(SIGKILL, false); // 服务死亡，杀死其进程组所有进程， 第二个参数表示是否report_oneshot
} else {
// Legacy behavior from ~2007 until Android R: this else branch did not exist and we did not
// kill the process group in this case.
if (SelinuxGetVendorAndroidVersion() >= __ANDROID_API_R__) { // 杀死oneshot服务的进程组
// The new behavior in Android R is to kill these process groups in all cases. The
// 'true' parameter instructions KillProcessGroup() to report a warning message where it
// detects a difference in behavior has occurred.
KillProcessGroup(SIGKILL, true);
}
}
// Remove any socket resources we may have created.
for (const auto& socket : sockets_) { // 清理该服务创建的socket 路径文件
auto path = ANDROID_SOCKET_DIR "/" + socket.name;
unlink(path.c_str());
}
for (const auto& f : reap_callbacks_) { // 执行通过 AddReapCallback 添加的reap操作的回调
f(siginfo);
}
if ((siginfo.si_code != CLD_EXITED || siginfo.si_status != 0) && on_failure_reboot_target_) {
LOG(ERROR) << "Service with 'reboot_on_failure' option failed, shutting down system.";
trigger_shutdown(*on_failure_reboot_target_);// 带有reboot_on_failure选项的服务，非正常退出则会触发关机
}
if (flags_ & SVC_EXEC) UnSetExec(); // 重置 is_exec_service_running_ flag
if (flags_ & SVC_TEMPORARY) return; // 临时oneshot服务，返回
pid_ = 0;
flags_ &= (~SVC_RUNNING);
start_order_ = 0;
// Oneshot processes go into the disabled state on exit,
// except when manually restarted.
// 标记为 SVC_RESTART 的，是需要重启服务的。在StopOrReset函数先kill进程，然后标记为SVC_RESTART，到回收后则进行重启
if ((flags_ & SVC_ONESHOT) && !(flags_ & SVC_RESTART) && !(flags_ & SVC_RESET)) {
flags_ |= SVC_DISABLED; // oneshot服务置disabled状态
}
// Disabled and reset processes do not get restarted automatically.
if (flags_ & (SVC_DISABLED | SVC_RESET)) { // disabled 和 reset 状态服务不重启
NotifyStateChange("stopped");
return;
}
#if INIT_FULL_SOURCES
static bool is_apex_updatable = android::sysprop::ApexProperties::updatable().value_or(false);
#else
static bool is_apex_updatable = false;
#endif
const bool is_process_updatable = !use_bootstrap_ns_ && is_apex_updatable;
// If we crash > 4 times in 'fatal_crash_window_' minutes or before boot_completed,
// reboot into bootloader or set crashing property
boot_clock::time_point now = boot_clock::now();
// critica或可更新(如apex) 并且 服务未标记要重启
if (((flags_ & SVC_CRITICAL) || is_process_updatable) && !(flags_ & SVC_RESTART)) {
bool boot_completed = GetBoolProperty("sys.boot_completed", false);
if (now < time_crashed_ + fatal_crash_window_ || !boot_completed) { // 在窗口时间内 或 开机流程未完成
if (++crash_count_ > 4) {
auto exit_reason = boot_completed ?
"in " + std::to_string(fatal_crash_window_.count()) + " minutes" :
"before boot completed";
if (flags_ & SVC_CRITICAL) { // critical 服务在窗口时间(4分钟内)或开机完成前 crash超过4次，则会重启到 bootloader
if (!GetBoolProperty("init.svc_debug.no_fatal." + name_, false)) {
// Aborts into 'atal_reboot_target_'.
SetFatalRebootTarget(fatal_reboot_target_);
LOG(FATAL) << "critical process '" << name_ << "' exited 4 times "
<< exit_reason;
}
} else { // 非 critical 服务只有一个打印，然后记录到属性
LOG(ERROR) << "process with updatable components '" << name_
<< "' exited 4 times " << exit_reason;
// Notifies update_verifier and apexd
SetProperty("sys.init.updatable_crashing_process_name", name_);
SetProperty("sys.init.updatable_crashing", "1");
}
}
} else { // 重新记录时间和次数
time_crashed_ = now;
crash_count_ = 1;
}
}
flags_ &= (~SVC_RESTART);
flags_ |= SVC_RESTARTING; // 注意此处标记，是服务重启的关键
// Execute all onrestart commands for this service.
onrestart_.ExecuteAllCommands(); // 执行所有 onrestart 命令， 在rc里面配置的
NotifyStateChange("restarting");
return;
}
Service::KillProcessGroup
void Service::KillProcessGroup(int signal, bool report_oneshot) {
// If we've already seen a successful result from killProcessGroup*(), then we have removed
// the cgroup already and calling these functions a second time will simply result in an error.
// This is true regardless of which signal was sent.
// These functions handle their own logging, so no additional logging is needed.
if (!process_cgroup_empty_) {
LOG(INFO) << "Sending signal " << signal << " to service '" << name_ << "' (pid " << pid_
<< ") process group...";
int max_processes = 0;
int r;
if (signal == SIGTERM) {
r = killProcessGroupOnce(proc_attr_.uid, pid_, signal, &max_processes);
} else {
r = killProcessGroup(proc_attr_.uid, pid_, signal, &max_processes);
}
if (report_oneshot && max_processes > 0) {
LOG(WARNING)
<< "Killed " << max_processes
<< " additional processes from a oneshot process group for service '" << name_
<< "'. This is new behavior, previously child processes would not be killed in "
"this case.";
}
if (r == 0) process_cgroup_empty_ = true;
}
if (oom_score_adjust_ != DEFAULT_OOM_SCORE_ADJUST) {
LmkdUnregister(name_, pid_); // 从lmkd移除进程信息
}
}
上面两个killProcessGroup实现如下：
/// @system/core/libprocessgroup/processgroup.cpp
int killProcessGroup(uid_t uid, int initialPid, int signal, int* max_processes) {
// 内部调用DoKillProcessGroupOnce去kill进程组
return KillProcessGroup(uid, initialPid, signal, 40 /*retries*/, max_processes);
}
int killProcessGroupOnce(uid_t uid, int initialPid, int signal, int* max_processes) {
return KillProcessGroup(uid, initialPid, signal, 0 /*retries*/, max_processes);
}
关于cgroup配置可参见 cgroups.json
/// @system/core/libprocessgroup/profiles/cgroups.json
{
"Cgroups": [
{
"Controller": "blkio",
"Path": "/dev/blkio",
"Mode": "0755",
"UID": "system",
"GID": "system"
},
{
"Controller": "cpu",
"Path": "/dev/cpuctl",
"Mode": "0755",
"UID": "system",
"GID": "system"
},
{
"Controller": "cpuset",
"Path": "/dev/cpuset",
"Mode": "0755",
"UID": "system",
"GID": "system"
},
{
"Controller": "memory",
"Path": "/dev/memcg",
"Mode": "0700",
"UID": "root",
"GID": "system",
"Optional": true
}
],
"Cgroups2": {
"Path": "/sys/fs/cgroup",
"Mode": "0755",
"UID": "system",
"GID": "system",
"Controllers": [
{
"Controller": "freezer",
"Path": ".",
"Mode": "0755",
"UID": "system",
"GID": "system"
}
]
}
}
KillProcessGroup
/// @system/core/libprocessgroup/processgroup.cpp
static int KillProcessGroup(uid_t uid, int initialPid, int signal, int retries,
int* max_processes) {
std::string hierarchy_root_path;
// 获取cgroup2对应的root path，也就是 /sys/fs/cgroup
CgroupGetControllerPath(CGROUPV2_CONTROLLER_NAME, &hierarchy_root_path);
const char* cgroup = hierarchy_root_path.c_str();
std::chrono::steady_clock::time_point start = std::chrono::steady_clock::now();
if (max_processes != nullptr) {
*max_processes = 0;
}
int retry = retries;
int processes;
while ((processes = DoKillProcessGroupOnce(cgroup, uid, initialPid, signal)) > 0) {// kill进程组
if (max_processes != nullptr && processes > *max_processes) {
*max_processes = processes;
}
LOG(VERBOSE) << "Killed " << processes << " processes for processgroup " << initialPid;
if (retry > 0) {
std::this_thread::sleep_for(5ms);
--retry;
} else {
break;
}
}
if (processes < 0) {
PLOG(ERROR) << "Error encountered killing process cgroup uid " << uid << " pid " << initialPid;
return -1;
}
std::chrono::steady_clock::time_point end = std::chrono::steady_clock::now();
auto ms = std::chrono::duration_cast<std::chrono::milliseconds>(end - start).count();
// We only calculate the number of 'processes' when killing the processes.
// In the retries == 0 case, we only kill the processes once and therefore
// will not have waited then recalculated how many processes are remaining
// after the first signals have been sent.
// Logging anything regarding the number of 'processes' here does not make sense.
if (processes == 0) { // 多次retry下若为0，则表示没有剩余待kill进程
if (retries > 0) {
LOG(INFO) << "Successfully killed process cgroup uid " << uid << " pid " << initialPid
<< " in " << static_cast<int>(ms) << "ms";
}
int err = RemoveProcessGroup(cgroup, uid, initialPid, retries); // 移除进程组目录
if (isMemoryCgroupSupported() && UsePerAppMemcg()) { // 移除memory cgroup相关目录
std::string memory_path;
CgroupGetControllerPath("memory", &memory_path);
memory_path += "/apps";
if (RemoveProcessGroup(memory_path.c_str(), uid, initialPid, retries)) return -1;
}
return err;
} else {
if (retries > 0) {
LOG(ERROR) << "Failed to kill process cgroup uid " << uid << " pid " << initialPid
<< " in " << static_cast<int>(ms) << "ms, " << processes
<< " processes remain";
}
return -1;
}
}
DoKillProcessGroupOnce
// Returns number of processes killed on success
// Returns 0 if there are no processes in the process cgroup left to kill
// Returns -1 on error
static int DoKillProcessGroupOnce(const char* cgroup, uid_t uid, int initialPid, int signal) {
// 路径即 /sys/fs/cgroup/uid_%d/pid_%d/cgroup.procs
auto path = ConvertUidPidToPath(cgroup, uid, initialPid) + PROCESSGROUP_CGROUP_PROCS_FILE;
std::unique_ptr<FILE, decltype(&fclose)> fd(fopen(path.c_str(), "re"), fclose);
if (!fd) {
if (errno == ENOENT) {
// This happens when process is already dead
return 0;
}
PLOG(WARNING) << "Failed to open process cgroup uid " << uid << " pid " << initialPid;
return -1;
}
// We separate all of the pids in the cgroup into those pids that are also the leaders of
// process groups (stored in the pgids set) and those that are not (stored in the pids set).
std::set<pid_t> pgids;
pgids.emplace(initialPid);
std::set<pid_t> pids;
pid_t pid;
int processes = 0;
while (fscanf(fd.get(), "%d\n", &pid) == 1 && pid >= 0) { // 读取路径下的所有pid
processes++;
if (pid == 0) {
// Should never happen... but if it does, trying to kill this
// will boomerang right back and kill us! Let's not let that happen.
LOG(WARNING) << "Yikes, we've been told to kill pid 0! How about we don't do that?";
continue;
}
pid_t pgid = getpgid(pid);
if (pgid == -1) PLOG(ERROR) << "getpgid(" << pid << ") failed";
if (pgid == pid) { // 保存进程组id，后面直接kill进程组
pgids.emplace(pid);
} else {
pids.emplace(pid);
}
}
// Erase all pids that will be killed when we kill the process groups.
for (auto it = pids.begin(); it != pids.end();) {
pid_t pgid = getpgid(*it);
if (pgids.count(pgid) == 1) { // 如果进程在进程组里面，则从移除，因为kill进程组时会kill它，防止重复kill
it = pids.erase(it);
} else {
++it;
}
}
// Kill all process groups.
for (const auto pgid : pgids) { // kill 进程组的进程
LOG(VERBOSE) << "Killing process group " << -pgid << " in uid " << uid
<< " as part of process cgroup " << initialPid;
if (kill(-pgid, signal) == -1 && errno != ESRCH) {
PLOG(WARNING) << "kill(" << -pgid << ", " << signal << ") failed";
}
}
// Kill remaining pids.
for (const auto pid : pids) { // kill 剩余其他进程
LOG(VERBOSE) << "Killing pid " << pid << " in uid " << uid << " as part of process cgroup "
<< initialPid;
if (kill(pid, signal) == -1 && errno != ESRCH) {
PLOG(WARNING) << "kill(" << pid << ", " << signal << ") failed";
}
}
return feof(fd.get()) ? processes : -1;
}
Service::NotifyStateChange
void Service::NotifyStateChange(const std::string& new_state) const {
if ((flags_ & SVC_TEMPORARY) != 0) {
// Services created by 'exec' are temporary and don't have properties tracking their state.
return;
}
std::string prop_name = "init.svc." + name_;
SetProperty(prop_name, new_state); // 将服务状态设置到属性 如 [init.svc.zygote]: [running]
if (new_state == "running") { // 运行态设置启动时间
uint64_t start_ns = time_started_.time_since_epoch().count();
std::string boottime_property = "ro.boottime." + name_; // [ro.boottime.zygote]: [7240451464]
if (GetProperty(boottime_property, "").empty()) { // 为空时才设置
SetProperty(boottime_property, std::to_string(start_ns));
}
}
// init.svc_debug_pid.* properties are only for tests, and should not be used
// on device for security checks.
std::string pid_property = "init.svc_debug_pid." + name_;
if (new_state == "running") { // 运行时记录pid， [init.svc_debug_pid.zygote]: [364]
SetProperty(pid_property, std::to_string(pid_));
} else if (new_state == "stopped") { // 停止时移除pid记录
SetProperty(pid_property, "");
}
}
服务的onrestart命令执行流程
在服务退出后，会执行onrestart去重启某些相关服务，如下是zygote的rc文件，记录了其重启时将会重启 audioserver 等
service zygote /system/bin/app_process64 -Xzygote /system/bin --zygote --start-system-server
class main
priority -20
user root
group root readproc reserved_disk
socket zygote stream 660 root system
socket usap_pool_primary stream 660 root system
onrestart exec_background - system system -- /system/bin/vdc volume abort_fuse
onrestart write /sys/power/state on
onrestart restart audioserver # 注意这些 onrestart
onrestart restart cameraserver
onrestart restart media
onrestart restart media.tuner
onrestart restart netd
onrestart restart wificond
task_profiles ProcessCapacityHigh
critical window=${zygote.critical_window.minute:-off} target=zygote-fatal
下面分析onrestart restart 服务这个流程
onrestart_.ExecuteAllCommands
onrestart_ 是一个Action，解析onrestart时添加了相关命令。ExecuteAllCommands将遍历并执行每一条命令。
/// @system/core/init/action.cpp
void Action::ExecuteAllCommands() const {
for (const auto& c : commands_) {
ExecuteCommand(c); // 循环执行每一条命令
}
}
onrestart会执行相关命令，对于服务执行的动作是restart，它对应的函数是do_restart，在执行ExecuteCommand时会回调该函数,如
onrestart restart audioserver # 表明将会重启audioserver服务
do_restart
该函数的实现是用来重启一个服务
/// @system/core/init/builtins.cpp
static Result<void> do_restart(const BuiltinArguments& args) {
Service* svc = ServiceList::GetInstance().FindService(args[1]); // 首先寻找目标服务是否存在
if (!svc) return Error() << "service " << args[1] << " not found";
svc->Restart(); // 对应服务的 Restart 函数
return {};
}
Service::Restart
void Service::Restart() {
if (flags_ & SVC_RUNNING) { // 如果服务正在运行，则重启该服务
/* Stop, wait, then start the service. */
StopOrReset(SVC_RESTART);
} else if (!(flags_ & SVC_RESTARTING)) { // 如果不是在重启中
/* Just start the service since it's not running. */
if (auto result = Start(); !result.ok()) { // 调用 Start
LOG(ERROR) << "Could not restart '" << name_ << "': " << result.error();
}
} /* else: Service is restarting anyways. */
}
如果服务还在运行，则会调用StopOrReset去重启服务
Service::StopOrReset
此处传的how是 SVC_RESTART。此处传的how是 SVC_RESTART。在StopOrReset函数先将服务标记为SVC_RESTART，然后kill进程，当进程回收过程，执行Service::Reap函数进行服务重启
// The how field should be either SVC_DISABLED, SVC_RESET, or SVC_RESTART.
void Service::StopOrReset(int how) {
// The service is still SVC_RUNNING until its process exits, but if it has
// already exited it shoudn't attempt a restart yet.
flags_ &= ~(SVC_RESTARTING | SVC_DISABLED_START); // 移除与restart相冲的flag
if ((how != SVC_DISABLED) && (how != SVC_RESET) && (how != SVC_RESTART)) { // how 只能是三者之一
// An illegal flag: default to SVC_DISABLED.
how = SVC_DISABLED; // 非法参数，默认disabled
}
// If the service has not yet started, prevent it from auto-starting with its class.
if (how == SVC_RESET) {
flags_ |= (flags_ & SVC_RC_DISABLED) ? SVC_DISABLED : SVC_RESET;
} else {
flags_ |= how; // 非reset，添加此flag
}
// Make sure it's in right status when a restart immediately follow a
// stop/reset or vice versa.
if (how == SVC_RESTART) {
flags_ &= (~(SVC_DISABLED | SVC_RESET));
} else {
flags_ &= (~SVC_RESTART);
}
if (pid_) { // 进程存在，则kill进程组
KillProcessGroup(SIGKILL);
NotifyStateChange("stopping"); // 更新进程状态
} else {
NotifyStateChange("stopped");
}
}
如果服务还没启动，则调用Start执行启动流程。
Service::Start
- 延时启动可更新服务若APEXes configs未完全加载
- 创建进程指定的socket以及打开指定文件
- fork创建子进程并通过execv执行服务可执行程序
- 创建进程组并做初始化
- 向lmkd注册此进程
- 通知进程状态改变
Result<void> Service::Start() {
auto reboot_on_failure = make_scope_guard([this] { // 在启动失败时回调
if (on_failure_reboot_target_) {
trigger_shutdown(*on_failure_reboot_target_);
}
});
if (is_updatable() && !ServiceList::GetInstance().IsServicesUpdated()) {
ServiceList::GetInstance().DelayService(*this); // 延时启动
return Error() << "Cannot start an updatable service '" << name_
<< "' before configs from APEXes are all loaded. "
<< "Queued for execution.";
}
bool disabled = (flags_ & (SVC_DISABLED | SVC_RESET));
// Starting a service removes it from the disabled or reset state and
// immediately takes it out of the restarting state if it was in there.
flags_ &= (~(SVC_DISABLED|SVC_RESTARTING|SVC_RESET|SVC_RESTART|SVC_DISABLED_START));
// Running processes require no additional work --- if they're in the
// process of exiting, we've ensured that they will immediately restart
// on exit, unless they are ONESHOT. For ONESHOT service, if it's in
// stopping status, we just set SVC_RESTART flag so it will get restarted
// in Reap().
if (flags_ & SVC_RUNNING) {
if ((flags_ & SVC_ONESHOT) && disabled) {
flags_ |= SVC_RESTART;
}
// It is not an error to try to start a service that is already running.
reboot_on_failure.Disable();
return {};
}
bool needs_console = (flags_ & SVC_CONSOLE);
if (needs_console) {
if (proc_attr_.console.empty()) {
proc_attr_.console = "/dev/" + GetProperty("ro.boot.console", "console");
}
// Make sure that open call succeeds to ensure a console driver is
// properly registered for the device node
int console_fd = open(proc_attr_.console.c_str(), O_RDWR | O_CLOEXEC);
if (console_fd < 0) {
flags_ |= SVC_DISABLED;
return ErrnoError() << "Couldn't open console '" << proc_attr_.console << "'";
}
close(console_fd);
}
struct stat sb;
if (stat(args_[0].c_str(), &sb) == -1) { // 判断可执行程序是否存在
flags_ |= SVC_DISABLED;
return ErrnoError() << "Cannot find '" << args_[0] << "'";
}
std::string scon;
if (!seclabel_.empty()) { // 执行seclabel
scon = seclabel_;
} else {
auto result = ComputeContextFromExecutable(args_[0]);
if (!result.ok()) {
return result.error();
}
scon = *result;
}
// APEXd is always started in the "current" namespace because it is the process to set up
// the current namespace.
const bool is_apexd = args_[0] == "/system/bin/apexd";
if (!IsDefaultMountNamespaceReady() && !is_apexd) {
// If this service is started before APEXes and corresponding linker configuration
// get available, mark it as pre-apexd one. Note that this marking is
// permanent. So for example, if the service is re-launched e.g., due
// to crash), it is still recognized as pre-apexd... for consistency.
use_bootstrap_ns_ = true;
}
// For pre-apexd services, override mount namespace as "bootstrap" one before starting.
// Note: "ueventd" is supposed to be run in "default" mount namespace even if it's pre-apexd
// to support loading firmwares from APEXes.
std::optional<MountNamespace> override_mount_namespace;
if (name_ == "ueventd") {
override_mount_namespace = NS_DEFAULT;
} else if (use_bootstrap_ns_) {
override_mount_namespace = NS_BOOTSTRAP;
}
post_data_ = ServiceList::GetInstance().IsPostData();
LOG(INFO) << "starting service '" << name_ << "'...";
std::vector<Descriptor> descriptors;
for (const auto& socket : sockets_) { // 创建进程指定的socket
if (auto result = socket.Create(scon); result.ok()) {
descriptors.emplace_back(std::move(*result));
} else {
LOG(INFO) << "Could not create socket '" << socket.name << "': " << result.error();
}
}
for (const auto& file : files_) { // 打开通过file指定的文件，如 file /dev/kmsg w
if (auto result = file.Create(); result.ok()) {
descriptors.emplace_back(std::move(*result));
} else {
LOG(INFO) << "Could not open file '" << file.name << "': " << result.error();
}
}
// fork 服务进程
pid_t pid = -1;
if (namespaces_.flags) {
pid = clone(nullptr, nullptr, namespaces_.flags | SIGCHLD, nullptr);
} else {
pid = fork();
}
if (pid == 0) { // 新创建的子进程，做初始化并执行execv
umask(077);
if (auto result = EnterNamespaces(namespaces_, name_, override_mount_namespace);
!result.ok()) {
LOG(FATAL) << "Service '" << name_
<< "' failed to set up namespaces: " << result.error();
}
for (const auto& [key, value] : environment_vars_) {
setenv(key.c_str(), value.c_str(), 1);
}
for (const auto& descriptor : descriptors) {
descriptor.Publish(); // 在执行execv 去掉 FD_CLOEXEC，防止被关闭
}
// 处理writepid到文件，如 writepid /dev/cpuset/foreground/tasks
if (auto result = WritePidToFiles(&writepid_files_); !result.ok()) {
LOG(ERROR) << "failed to write pid to files: " << result.error();
}
if (task_profiles_.size() > 0 && !SetTaskProfiles(getpid(), task_profiles_)) {
LOG(ERROR) << "failed to set task profiles";
}
// As requested, set our gid, supplemental gids, uid, context, and
// priority. Aborts on failure.
SetProcessAttributesAndCaps();
if (!ExpandArgsAndExecv(args_, sigstop_)) { // 展开参数并执行 execv
PLOG(ERROR) << "cannot execv('" << args_[0]
<< "'). See the 'Debugging init' section of init's README.md for tips";
}
_exit(127);
}
if (pid < 0) { // 创建失败
pid_ = 0;
return ErrnoError() << "Failed to fork";
}
if (oom_score_adjust_ != DEFAULT_OOM_SCORE_ADJUST) { // 写入oom_score_adj
std::string oom_str = std::to_string(oom_score_adjust_);
std::string oom_file = StringPrintf("/proc/%d/oom_score_adj", pid);
if (!WriteStringToFile(oom_str, oom_file)) {
PLOG(ERROR) << "couldn't write oom_score_adj";
}
}
time_started_ = boot_clock::now();
pid_ = pid;
flags_ |= SVC_RUNNING;
start_order_ = next_start_order_++;
process_cgroup_empty_ = false;
bool use_memcg = swappiness_ != -1 || soft_limit_in_bytes_ != -1 || limit_in_bytes_ != -1 ||
limit_percent_ != -1 || !limit_property_.empty();
errno = -createProcessGroup(proc_attr_.uid, pid_, use_memcg); // 创建进程组
if (errno != 0) {
PLOG(ERROR) << "createProcessGroup(" << proc_attr_.uid << ", " << pid_
<< ") failed for service '" << name_ << "'";
} else if (use_memcg) {
if (swappiness_ != -1) {
// 设置 swappiness , rc中通过 memcg.swappiness 设置的
if (!setProcessGroupSwappiness(proc_attr_.uid, pid_, swappiness_)) {
PLOG(ERROR) << "setProcessGroupSwappiness failed";
}
}
if (soft_limit_in_bytes_ != -1) { // rc中通过 memcg.soft_limit_in_bytes 设置
if (!setProcessGroupSoftLimit(proc_attr_.uid, pid_, soft_limit_in_bytes_)) {
PLOG(ERROR) << "setProcessGroupSoftLimit failed";
}
}
size_t computed_limit_in_bytes = limit_in_bytes_; // memcg.limit_in_bytes
if (limit_percent_ != -1) { // memcg.limit_percent
long page_size = sysconf(_SC_PAGESIZE);
long num_pages = sysconf(_SC_PHYS_PAGES);
if (page_size > 0 && num_pages > 0) {
size_t max_mem = SIZE_MAX;
if (size_t(num_pages) < SIZE_MAX / size_t(page_size)) {
max_mem = size_t(num_pages) * size_t(page_size);
}
computed_limit_in_bytes =
std::min(computed_limit_in_bytes, max_mem / 100 * limit_percent_);
}
}
if (!limit_property_.empty()) {
// This ends up overwriting computed_limit_in_bytes but only if the
// property is defined.
computed_limit_in_bytes = android::base::GetUintProperty(
limit_property_, computed_limit_in_bytes, SIZE_MAX);
}
if (computed_limit_in_bytes != size_t(-1)) {
if (!setProcessGroupLimit(proc_attr_.uid, pid_, computed_limit_in_bytes)) { // 设置 MemLimit
PLOG(ERROR) << "setProcessGroupLimit failed";
}
}
}
if (oom_score_adjust_ != DEFAULT_OOM_SCORE_ADJUST) {
LmkdRegister(name_, proc_attr_.uid, pid_, oom_score_adjust_); // 添加到lmkd监听
}
NotifyStateChange("running"); // 通知服务运行起来了。
reboot_on_failure.Disable();
return {};
}
到这里，子进程回收流程就已经处理完了。
服务自身重启
在上面通过waitpid对服务进程回收，并调用Reap函数对服务状态以及onrestart命令等做了处理，但是并没有完成重启服务的工作。这个工作实际上是在SecondStageMain中处理的。
SecondStageMain 循环处理事件
如下是 init 主循环，负责处理相关事件。
/// @system/core/init/main.cpp
int SecondStageMain(int argc, char** argv) {
...
// Restore prio before main loop
setpriority(PRIO_PROCESS, 0, 0);
while (true) {
// By default, sleep until something happens. 计算epool超时
auto epoll_timeout = std::optional<std::chrono::milliseconds>{};
...
if (!IsShuttingDown()) { // 不是正在关机， 如有需要重启的服务，需要据此重新计算超时时间
auto next_process_action_time = HandleProcessActions(); // 处理进程相关action
// If there's a process that needs restarting, wake up in time for that.
if (next_process_action_time) { // 计数下次唤醒时间
epoll_timeout = std::chrono::ceil<std::chrono::milliseconds>(
*next_process_action_time - boot_clock::now());
if (*epoll_timeout < 0ms) epoll_timeout = 0ms;
}
}
...
}
return 0;
}
HandleProcessActions
- 处理服务超时
- 处理服务重启
static std::optional<boot_clock::time_point> HandleProcessActions() {
std::optional<boot_clock::time_point> next_process_action_time; // 计算下次action处理时间
for (const auto& s : ServiceList::GetInstance()) {
if ((s->flags() & SVC_RUNNING) && s->timeout_period()) { // 计算服务是否超时，通知 timeout_period <seconds> 指定
auto timeout_time = s->time_started() + *s->timeout_period();
if (boot_clock::now() > timeout_time) { // 超过设置的超时时间
s->Timeout(); // 调用服务的Timeout函数，将会kill服务进程
} else {
if (!next_process_action_time || timeout_time < *next_process_action_time) {// 超时时间早于下次action处理时间
next_process_action_time = timeout_time; // 设置超时时间下次action处理时间
}
}
}
if (!(s->flags() & SVC_RESTARTING)) continue;
// 指定 SVC_RESTARTING 则会重新启动服务，在Service::Reap中指定
auto restart_time = s->time_started() + s->restart_period(); // 计数启动时间限制，上次启动时间 + restart_period
if (boot_clock::now() > restart_time) { // 距上次启动时间大于 restart_period 5s，防止启动过频繁
if (auto result = s->Start(); !result.ok()) { // 执行Start函数启动服务
LOG(ERROR) << "Could not restart process '" << s->name() << "': " << result.error();
}
} else {
if (!next_process_action_time || restart_time < *next_process_action_time) {// 重启服务时间早于下次action处理时间
next_process_action_time = restart_time; // 设置重启时间为下次action处理时间
}
}
}
return next_process_action_time;
}
在上面的实现中，也是通过Service::Start来启动服务，如之前分析。
类似资料：