谈谈Android的浅杀
android.app.ActivityManager类提供了removeTask方法来清理任务。
在API21及之前，removeTask中提供一个参数来指定是否要连同任务所运行的进程一起杀掉。
这个方法的第二个参数就是用来指定是否要连同进程一起杀掉，可以为0或者REMOVE_TASK_KILL_PROCESS。
我们先看在4.4上的实现：
/**
* Completely remove the given task.
*
* @param taskId Identifier of the task to be removed.
* @param flags Additional operational flags. May be 0 or
* {@link #REMOVE_TASK_KILL_PROCESS}.
* @return Returns true if the given task was found and removed.
*
* @hide
*/
public boolean removeTask(int taskId, int flags)
throws SecurityException {
try {
return ActivityManagerNative.getDefault().removeTask(taskId, flags);
} catch (RemoteException e) {
// System dead, we will be dead too soon!
return false;
}
}
在ActivityManager中提供的只是一个接口，真正的实现要通过IPC去调用ActivityManagerService的removeTask. 主要的逻辑在cleanUpRemovedTaskLocked中实现。
@Override
public boolean removeTask(int taskId, int flags) {
...
try {
TaskRecord tr = recentTaskForIdLocked(taskId);
if (tr != null) {
ActivityRecord r = tr.removeTaskActivitiesLocked(-1, false);
if (r != null) {
cleanUpRemovedTaskLocked(tr, flags);
return true;
}
...
}
我们再往下看cleanUpRemovedTaskLocked的逻辑，如果flags&ActivityManager.REMOVE_TASK_KILL_PROCESS就杀进程。
private void cleanUpRemovedTaskLocked(TaskRecord tr, int flags) {
...
final boolean killProcesses = (flags&ActivityManager.REMOVE_TASK_KILL_PROCESS) != 0;
...
if (killProcesses) {
...
killUnneededProcessLocked(pr, "remove task");
} else {
pr.waitingToKill = "remove task";
}
}
}
}
杀进程的逻辑在killUnneededProcessLocked中，接着调用android.os.Process.killProcessQuiet方法来杀进程。然后调用bionic中的函数来做系统调用。
private void killUnneededProcessLocked(ProcessRecord pr, String reason) {
if (!pr.killedByAm) {
Slog.i(TAG, "Killing " + pr.toShortString() + " (adj " + pr.setAdj + "): " + reason);
EventLog.writeEvent(EventLogTags.AM_KILL, pr.userId, pr.pid,
pr.processName, pr.setAdj, reason);
pr.killedByAm = true;
Process.killProcessQuiet(pr.pid);
}
}
比如ARM的kill调用是这样的：
ENTRY(kill)
mov ip, r7
ldr r7, =__NR_kill
swi #0
mov r7, ip
cmn r0, #(MAX_ERRNO + 1)
bxls lr
neg r0, r0
b __set_errno_internal
END(kill)
在AArch64状态下，swi已经失效了，替换成svc指令。
ENTRY(kill)
mov x8, __NR_kill
svc #0
cmn x0, #(MAX_ERRNO + 1)
cneg x0, x0, hi
b.hi __set_errno_internal
ret
END(kill)
在Intel x86芯片上，系统调用要用int 0x80软中断。
ENTRY(kill)
pushl %ebx
pushl %ecx
mov 12(%esp), %ebx
mov 16(%esp), %ecx
movl $__NR_kill, %eax
int $0x80
cmpl $-MAX_ERRNO, %eax
jb 1f
negl %eax
pushl %eax
call __set_errno
addl $4, %esp
orl $-1, %eax
1:
popl %ecx
popl %ebx
ret
END(kill)
但是在x86_64指令集中，系统调用已经变成基本指令了，不再需要int 0x80了。
ENTRY(kill)
movl $__NR_kill, %eax
syscall
cmpq $-MAX_ERRNO, %rax
jb 1f
negl %eax
movl %eax, %edi
call __set_errno_internal
1:
ret
END(kill)
从API 22开始，情况出现了一些变化，带参数的API被取消了，默认就杀进程。
我们看5.1的代码：
/**
* Completely remove the given task.
*
* @param taskId Identifier of the task to be removed.
* @return Returns true if the given task was found and removed.
*
* @hide
*/
public boolean removeTask(int taskId) throws SecurityException {
try {
return ActivityManagerNative.getDefault().removeTask(taskId);
} catch (RemoteException e) {
// System dead, we will be dead too soon!
return false;
}
}
经过IPC，走到ActivityManagerService中，默认调用removeTaskByIdLocked时就杀进程。
@Override
public boolean removeTask(int taskId) {
synchronized (this) {
enforceCallingPermission(android.Manifest.permission.REMOVE_TASKS,
"removeTask()");
long ident = Binder.clearCallingIdentity();
try {
return removeTaskByIdLocked(taskId, true);
} finally {
Binder.restoreCallingIdentity(ident);
}
}
}
我们继续看removeTaskByIdLocked，还是会调用cleanUpRemovedTaskLocked，这两个方法都是可以控制是否要杀进程的。
/**
* Removes the task with the specified task id.
*
* @param taskId Identifier of the task to be removed.
* @param killProcess Kill any process associated with the task if possible.
* @return Returns true if the given task was found and removed.
*/
private boolean removeTaskByIdLocked(int taskId, boolean killProcess) {
TaskRecord tr = mStackSupervisor.anyTaskForIdLocked(taskId);
if (tr != null) {
tr.removeTaskActivitiesLocked();
cleanUpRemovedTaskLocked(tr, killProcess);
if (tr.isPersistable) {
notifyTaskPersisterLocked(null, true);
}
return true;
}
Slog.w(TAG, "Request to remove task ignored for non-existent task " + taskId);
return false;
}
private void cleanUpRemovedTaskLocked(TaskRecord tr, boolean killProcess) {
mRecentTasks.remove(tr);
tr.removedFromRecents();
......
if (!killProcess) {
return;
}
......
