谈谈Android的浅杀

2017-01-14 10:22:54来源:http://www.jianshu.com/p/01f957a7e019作者:Jtag特工人点击

第七城市
谈谈Android的浅杀

android.app.ActivityManager类提供了removeTask方法来清理任务。
在API21及之前,removeTask中提供一个参数来指定是否要连同任务所运行的进程一起杀掉。
这个方法的第二个参数就是用来指定是否要连同进程一起杀掉,可以为0或者REMOVE_TASK_KILL_PROCESS。
我们先看在4.4上的实现:


    /**
* Completely remove the given task.
*
* @param taskId Identifier of the task to be removed.
* @param flags Additional operational flags. May be 0 or
* {@link #REMOVE_TASK_KILL_PROCESS}.
* @return Returns true if the given task was found and removed.
*
* @hide
*/
public boolean removeTask(int taskId, int flags)
throws SecurityException {
try {
return ActivityManagerNative.getDefault().removeTask(taskId, flags);
} catch (RemoteException e) {
// System dead, we will be dead too soon!
return false;
}
}

在ActivityManager中提供的只是一个接口,真正的实现要通过IPC去调用ActivityManagerService的removeTask. 主要的逻辑在cleanUpRemovedTaskLocked中实现。


    @Override
public boolean removeTask(int taskId, int flags) {
...
try {
TaskRecord tr = recentTaskForIdLocked(taskId);
if (tr != null) {
ActivityRecord r = tr.removeTaskActivitiesLocked(-1, false);
if (r != null) {
cleanUpRemovedTaskLocked(tr, flags);
return true;
}
...
}

我们再往下看cleanUpRemovedTaskLocked的逻辑,如果flags&ActivityManager.REMOVE_TASK_KILL_PROCESS就杀进程。


    private void cleanUpRemovedTaskLocked(TaskRecord tr, int flags) {
...
final boolean killProcesses = (flags&ActivityManager.REMOVE_TASK_KILL_PROCESS) != 0;
...
if (killProcesses) {
...
killUnneededProcessLocked(pr, "remove task");
} else {
pr.waitingToKill = "remove task";
}
}
}
}

杀进程的逻辑在killUnneededProcessLocked中,接着调用android.os.Process.killProcessQuiet方法来杀进程。然后调用bionic中的函数来做系统调用。


    private void killUnneededProcessLocked(ProcessRecord pr, String reason) {
if (!pr.killedByAm) {
Slog.i(TAG, "Killing " + pr.toShortString() + " (adj " + pr.setAdj + "): " + reason);
EventLog.writeEvent(EventLogTags.AM_KILL, pr.userId, pr.pid,
pr.processName, pr.setAdj, reason);
pr.killedByAm = true;
Process.killProcessQuiet(pr.pid);
}
}

比如ARM的kill调用是这样的:


ENTRY(kill)
mov ip, r7
ldr r7, =__NR_kill
swi #0
mov r7, ip
cmn r0, #(MAX_ERRNO + 1)
bxls lr
neg r0, r0
b __set_errno_internal
END(kill)

在AArch64状态下,swi已经失效了,替换成svc指令。


ENTRY(kill)
mov x8, __NR_kill
svc #0
cmn x0, #(MAX_ERRNO + 1)
cneg x0, x0, hi
b.hi __set_errno_internal
ret
END(kill)

在Intel x86芯片上,系统调用要用int 0x80软中断。


ENTRY(kill)
pushl %ebx
pushl %ecx
mov 12(%esp), %ebx
mov 16(%esp), %ecx
movl $__NR_kill, %eax
int $0x80
cmpl $-MAX_ERRNO, %eax
jb 1f
negl %eax
pushl %eax
call __set_errno
addl $4, %esp
orl $-1, %eax
1:
popl %ecx
popl %ebx
ret
END(kill)

但是在x86_64指令集中,系统调用已经变成基本指令了,不再需要int 0x80了。


ENTRY(kill)
movl $__NR_kill, %eax
syscall
cmpq $-MAX_ERRNO, %rax
jb 1f
negl %eax
movl %eax, %edi
call __set_errno_internal
1:
ret
END(kill)

从API 22开始,情况出现了一些变化,带参数的API被取消了,默认就杀进程。
我们看5.1的代码:


    /**
* Completely remove the given task.
*
* @param taskId Identifier of the task to be removed.
* @return Returns true if the given task was found and removed.
*
* @hide
*/
public boolean removeTask(int taskId) throws SecurityException {
try {
return ActivityManagerNative.getDefault().removeTask(taskId);
} catch (RemoteException e) {
// System dead, we will be dead too soon!
return false;
}
}

经过IPC,走到ActivityManagerService中,默认调用removeTaskByIdLocked时就杀进程。


    @Override
public boolean removeTask(int taskId) {
synchronized (this) {
enforceCallingPermission(android.Manifest.permission.REMOVE_TASKS,
"removeTask()");
long ident = Binder.clearCallingIdentity();
try {
return removeTaskByIdLocked(taskId, true);
} finally {
Binder.restoreCallingIdentity(ident);
}
}
}

我们继续看removeTaskByIdLocked,还是会调用cleanUpRemovedTaskLocked,这两个方法都是可以控制是否要杀进程的。


    /**
* Removes the task with the specified task id.
*
* @param taskId Identifier of the task to be removed.
* @param killProcess Kill any process associated with the task if possible.
* @return Returns true if the given task was found and removed.
*/
private boolean removeTaskByIdLocked(int taskId, boolean killProcess) {
TaskRecord tr = mStackSupervisor.anyTaskForIdLocked(taskId);
if (tr != null) {
tr.removeTaskActivitiesLocked();
cleanUpRemovedTaskLocked(tr, killProcess);
if (tr.isPersistable) {
notifyTaskPersisterLocked(null, true);
}
return true;
}
Slog.w(TAG, "Request to remove task ignored for non-existent task " + taskId);
return false;
}

    private void cleanUpRemovedTaskLocked(TaskRecord tr, boolean killProcess) {
mRecentTasks.remove(tr);
tr.removedFromRecents();
......
if (!killProcess) {
return;
}
......



第七城市

最新文章

123

最新摄影

微信扫一扫

第七城市微信公众平台