Before, if updatable processes crash 4 times in 4mins, a native
rollback will be attempted. This behavior does not detect
system_server early boot deadlocks because the system server requires
at least a min to detect a deadlock, and crash itself. The crashes
don't happen frequently enough for init to detect.
After, this cl, the old behavior exists and additionally, init detects
*any* 4 crashes of updatable processes before boot completed,
regardless of if they happen within 4mins or not.
Test: Manually tested by adding artificial sleep in system_server so
deadlock is triggered before boot. system_server crashes 4 times in
over 4mins and the ro.init.updatable_crashing prop is set to 1.
Bug: 129597207
Merged-In: Ie6fb5693ff4be105bcbe139c22850fb076e40260
Change-Id: Ie6fb5693ff4be105bcbe139c22850fb076e40260
Support `adb rescue wipe` command on the host side. This command runs
under the rescue mode and wipes data (and cache/metadata).
Bug: 131037235
Test: run adb rescue wipe
Change-Id: Ib3a3f2d564cc19d0446540d616cc21489ba558c2
(cherry picked from commit c2265c5343)
Create the anonymous namespace only from a non-empty library path.
This is a better heuristic than the current "first-come" one. It
allows creating classloaders that are not directly related to an
app's "main" classloader, that is, do not have any library path.
This is the case, for example, for shared libraries, including
preloaded ones.
Longer-term, the anonymous namespace creation should be made
explicit, so that the framework can have full control.
(cherry picked from commit b9df7d936c)
Bug: 130623656
Test: m
Test: manual
Merged-In: I8251363b372e365d10ae09d23df93d76388ac7f9
Change-Id: I8251363b372e365d10ae09d23df93d76388ac7f9
This is for Android Telemetry to be able to categorise the processes
that produce tombstones.
Bug: 129933535
Test: atest debugerd_test:TombstoneTest
Change-Id: Ie635347c9839eb58bfd27739050bd68cbdbf98da
Merged-In: Ie635347c9839eb58bfd27739050bd68cbdbf98da
(cherry picked from commit e5b7913d2c5da92c37233fef15ab3109e37d9c90)
procrank's usage in its output shows 20x increase from
last year. This is because it is keeping the process
maps around until termination. Fix that by getting rid
of ProcMemInfo objects when done parsing /proc/<pid>/maps,pagemap.
Note that the total allocations do not change and have not necessarily
regressed from Pie.
Bug: 130672819
Test: adb shell procrank | grep 'procrank\|cmdline'
Change-Id: Ib7bf960ed1d053347fcfc0c8aee9019607a1eb01
Merged-In: Ib7bf960ed1d053347fcfc0c8aee9019607a1eb01
Signed-off-by: Sandeep Patil <sspatil@google.com>
This CL adds client support to recognize the rescue mode (which will be
served by recovery image). It also allows waiting for a device to enter
rescue mode. The support for the actual rescue commands will be added in
follow-up CLs.
Bug: 128415917
Test: `adb devices` recognizes devices under rescue mode.
Test: `adb wait-for-rescue` waits for device to be in rescue mode.
Change-Id: I367d7339fe68006aba09a1e3db6370d472296676
Merged-In: I367d7339fe68006aba09a1e3db6370d472296676
(cherry picked from commit 55d407ec4a)
On devices that use FDE and APEX at the same time, we need to bring up a
minimal framework to be able to mount the /data partition. During this
period, a tmpfs /data filesystem is created, which doesn't contain any
of the updated APEXEs. As a consequence, all those processes will be
using the APEXes from the /system partition.
This is obviously not desired, as APEXes in /system may be old and/or
contain security issues. Additionally, it would create a difference
between FBE and FDE devices at runtime.
Ideally, we restart all processes that have started after we created the
tmpfs /data. We can't (re)start based on class names alone, because some
classes (eg 'hal') contain services that are required to start apexd
itself and that shouldn't be killed (eg the graphics HAL).
To address this, keep track of which processes are started after /data
is mounted, with a new 'mark_post_data' keyword. Additionally, create
'class_reset_post_data', which resets all services in the class that
were created after the initial /data mount, and 'class_start_post_data',
which starts all services in the class that were started after /data was
mounted.
On a device with FBE, these keywords wouldn't be used; on a device with
FDE, we'd use them to bring down the right processes after the user has
entered the correct secret, and restart them.
Bug: 118485723
Test: manually verified process list
Change-Id: I16adb776dacf1dd1feeaff9e60639b99899905eb
The first stage init skips mounting the mount points defined in
skip_mount.cfg, but these mount points still return from
ReadDefaultFstab(). The behavior causes some error logic which
try to access the partition which had been skipped.
After applying the patch. ReadDefaultFstab() will not contain the
skipped mount points.
Bug: 128961335
Test: `fastboot delete-logical-partition product_a`
Test: `fastboot flash system aosp_arm64-userdebug`
Test: `fastboot -w reboot` and boot to home screen
Change-Id: I3156260b5d37647dbecf98ca90601a089bea5c46
Merged-In: I3156260b5d37647dbecf98ca90601a089bea5c46
(cherry picked from commit 77c28476f1)
The debug ramdisk can only be used if the device is unlocked.
When it's used, init will load adb_debug.prop and the userdebug
sepolicy from the debug ramdisk, to allow adb root on a user build.
Bug: 126493225
Test: 'make' and checks the file is installed
Change-Id: Id6962414197fc8f47f7c07818e8fb16107dc17a3
Merged-In: Id6962414197fc8f47f7c07818e8fb16107dc17a3
(cherry picked from commit 05f07d89a6)
Limit libprocessgroup VNDK API to the minimum set required for task
profiles usage. This API allows vendors to use cgroups without accessing
cgroup files directly, therefore allowing Android to change cgroup
arrangement details without breaking vendor code.
Bug: 131098932
Test: build and boot
Change-Id: I92463dfb44a108a133bafd2fe52237b6b1d50a69
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
This reverts commit bee9f5718b
"libprocessgroup: Disable file descriptor caching temporarily" and adds
option to use SetTaskProfiles and SetProcessProfiles without file caching.
This option is used from JNI to avoid access denials because cached files
are not whitelisted for JNI usage.
Bug: 123868658
Bug: 123043091
Test: boot using svelte target
Change-Id: I76b9d6af8a1dd4464cb3cf3e6dc327980efdf361
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
In previous implementation, userdebug sepoilcy and property files are
loaded from the system.img. This CL changes this to:
- first-stage init copies userdebug files from ramdisk to /debug_ramisk/*
- second-stage init loads files from /debug_ramdisk/*.
Note: same as before, the above can only be triggered, if the device
is UNLOCKED
With this, we don't have to put userdebug related files into the USER
system.img.
Bug: 126493225
Test: boot device with a ramdisk with /force_debuggable, checks related
files are loaded
Change-Id: I63f5f846e82ba78427062bf7615c26173878d8f3
Merged-In: I63f5f846e82ba78427062bf7615c26173878d8f3
(cherry picked from commit 30afda71c0)
Modify the unwinder library to indicate that at least one of the stack
frames contains an elf file that is unreadable.
Modify debuggerd to display a note about the unreadable frame and a possible
way to fix it.
Bug: 129769339
Test: New unit tests pass.
Test: Ran an app that crashes and has an unreadable file and verified the
Test: message is displayed. Then setenforce 0 and verify the message is
Test: not displayed.
Change-Id: Ibc4fe1d117e9b5840290454e90914ddc698d3cc2
Merged-In: Ibc4fe1d117e9b5840290454e90914ddc698d3cc2
(cherry picked from commit 4ae266ccbd)
right now vendor_init is forked before we set oom_adj for init which
leaves a chance vendor_init could be killed in heavy memory pressure.
this CL set the oom_adj before forking everything to ensure all native
have correct oom_adj settings.
Fixes: 130824864
Test: procrank -o
(cherry picked from commit 45d8174fe7)
Change-Id: I68c18f9db24d55239f7f0608592fcc702f04542e
There appears to be a kernel bug that causes SIGHUP and SIGCONT to be
sent to the parent process group we spawn from if the process group
contains stopped jobs (e.g. the parent itself, because of wait_for_gdb).
Call setsid in all of our children to prevent this from happening.
Bug: http://b/31124563
Test: adb shell 'setprop debug.debuggerd.wait_for_gdb 1; killall -ABRT surfaceflinger'
Change-Id: I1a48d70886880a5bfbe2deb80d48deece55faf09
(cherry picked from commit 18cb681247)
Some USB controllers only support 16k writes, so drop down to that.
Bug: http://b/130622010
Test: treehugger
Change-Id: I836d5b2d0d6fcae05f290af11a6a19c6e8d7c1ba
(cherry picked from commit 770a6a4d46)
Some app may have different cgroup settings in cpuset and schedtune for its
threads, so let blkio follow cpuset only, which represents the app's current
state more accurately. Otherwise, if that thread is doing IO, then its
performance will be affected because its blkio group is in lower priority
group as schedtune.
ex: an app is now in top-app, but some thread of it set schedtune group to
background, and blkio follows schedtune because it is called later.
Main thread:
6:schedtune:/top-app
5:memory:/
4:cpuset:/top-app
3:cpuacct:/uid_1000/pid_8766
2:cpu:/
1:blkio:/
0::/
Some thread:
6:schedtune:/background
5:memory:/
4:cpuset:/top-app
3:cpuacct:/uid_1000/pid_8766
2:cpu:/
1:blkio:/background
0::/
Bug: 124727032
Test: blkio has same settings with cpuset
Change-Id: I9a140c7d9d93e1dd43c34c8cf066f4a62e2bf604
Merged-In: I9a140c7d9d93e1dd43c34c8cf066f4a62e2bf604
This refactors the step function slightly to split it up into
distinct pieces since the code needs to handle a signal handler
versus normal step slightly differently.
Add a new error for an invalid elf.
Modify libbacktrace code to handle new error code.
Bug: 130302288
Test: libbacktrace/libunwindstack unit tests.
Change-Id: I3fb9b00c02d2cf2cc5911541bba0346c6f39b8e6
Merged-In: I3fb9b00c02d2cf2cc5911541bba0346c6f39b8e6
(cherry picked from commit d11ed86d65)
umount_all is the cleanup step for mount_all.
In particular, the mount_all builtin creates a verity device,
'postinstall-verity', for the following line:
system /postinstall ... ... slotselect_other,logical,avb_keys=...
cppreopt umounts /postinstall but doesn't destroy the postinstall-verity
device, causing OTA to fail (because it cannot destroy the
system_[other] device). umount_all also destroy the verity device.
Note that mount_all does not map system_[other]; it is mapped by
first stage init. Hence, umount_all doesn't destroy it either. The OTA
client is reponsible for unmapping the device itself.
Bug: 129988285
Test: flash, boot, then check `dmctl list devices`, then OTA
Change-Id: Id3ab65b3860b6ea6cfec310ab13652009c81f415
This reverts commit 85b5fecec9.
Reason for revert: Breaks ART tests, reverting to investigate.
Exempt-From-Owner-Approval: Revert.
(cherry picked from commit b9cc4fbb26)
Bug: 130406806
Change-Id: I634e37060b97484d627fc544e3b406fd90aaa784
On some devices (e.g., emulator), init needs to read AVB footer from
a logical partition because:
1) Dynamic/logical partition is enabled
2) The partition is AVB chained, i.e., need to locate footer from the end
3) Logical partition is not understandable by bootloader,
but there is no bootloader in this case
Bug: 125540538
Bug: 128434470
Test: boot and force the fallback path, to check it can get logical path
Change-Id: Ie304bce234cbf0f938f386f7ce59235c851e0e2d
Merged-In: Ie304bce234cbf0f938f386f7ce59235c851e0e2d
(cherry picked from commit 84d4933686)
This change allows specifying additional avb keys to verify a fstab
entry. It can be used together with the original 'avb' flag. When both
'avb' and 'avb_keys' are present, it will try to use avb_keys to verify
this partition and extract the AVB descriptor from the end of it first.
When avb_key fails, it falls back to searching the AVB descriptor in the
built-in /vbmeta (and its chained partitions) with the matched partition
name.
An example of a fstab file:
system /system ext4 ro,barrier=1 wait,slotselect,avb=vbmeta,logical,first_stage_mount,avb_keys=/avb/gsi.avbpubkey
vendor /vendor ext4 ro,barrier=1 wait,slotselect,avb,logical,first_stage_mount
The overhead of adding an additional 'avb_keys' should not be significant,
as the typical size of a AVB Hashtree descriptor for /system is usually
less than 1000 bytes. e.g., on crosshatch, it's about 600 bytes, which
takes less than 1 millisecond for the following call to return failure.
auto avb_standalone_handle = AvbHandle::LoadAndVerifyVbmeta(*fstab_entry);
We also checked the time spent on init's first stage on crosshatch, with the
following CL to set ro.boottime.init.first_stage. The testing result
shows no significant difference between them as well.
https://android-review.googlesource.com/c/platform/system/core/+/934536
With an additional avb_keys entry for /system
[ro.boottime.init.first_stage]: [728]
[ro.boottime.init.first_stage]: [720]
[ro.boottime.init.first_stage]: [722]
Without an additional avb_keys entry for /system
[ro.boottime.init.first_stage]: [730]
[ro.boottime.init.first_stage]: [728]
[ro.boottime.init.first_stage]: [725]
Bug: 124491153
Test: boot a device with above fstab settings
Change-Id: I0c81f816efb0dd40c93da2df304f2e215df9d105
Merged-In: I0c81f816efb0dd40c93da2df304f2e215df9d105
(cherry picked from commit a0f8b05d91)
