The last one will avoid errors=panic in ext4.
Bug: 63981945
Bug: 65481582
Change-Id: I9c86afcce441767e24fc43668ab1ff6230155a9f
Merged-In: I9c86afcce441767e24fc43668ab1ff6230155a9f
Signed-off-by: Jaegeuk Kim <jaegeuk@google.com>
(cherry picked from commit 0f04f72c2d)
Builtin commands may set the sys.powerctl property, which causes
reboot to be immediately processed. Unfortunately, part of the reboot
processing involves clearing the action queue, so when this scenario
happens, ActionManager::ExecuteOneCommand() can abort due to its state
being unexpectedly changed.
Longer term, the real fix here is to split init and property service.
In this case, the property sets will be sent to property service and
the reboot will only be processed once property service responds back
to init that the property has been set. Since that will not happen
within the action queue, there will be no risk of failure.
Short term, this change sets a flag in init to shutdown the device
before the next action is run, which defers the shutdown enough to fix
the crash, but continues to prevent any further commands from running.
Bug: 65374456
Test: force bullhead into the repro case and observe that it no longer
repros
Merged-In: I89c73dad8d7912a845d694b095cab061b8dcc05e
Change-Id: I89c73dad8d7912a845d694b095cab061b8dcc05e
(cherry picked from commit 3633a4014a)
ExpandArgs() was factored out of Service::Start() to clean up init,
however this introduced a bug: the scope of expanded_args ends when
ExpandArgs() returns, yet pointers to the c strings contained within
those std::strings are returned from the function. These pointers are
invalid and have been seen to cause failures on real devices.
This change moves the execv() into ExpandArgs() and renames it
ExpandArgsAndExecv() to keep the clean separation of Service::Start()
but fix the variable scope issue.
Bug: 65303004
Test: boot fugu
Change-Id: I612128631f5b58d040bffcbc2220593ad16cd450
(cherry picked from commit 5e405cacb1)
Child processes inherit the signal handlers from their parent process.
In the case of init, fork()'ed processes, will attempt to reboot the
system if they receive a fatal signal). This is not the correct behavior;
these processes should terminate due to the provided signal like other
processes on the system.
This is particularly important as there are multiple LOG(FATAL) calls
in service.cpp for failures after fork() but before execv() when a
service is started.
Note, that pthread_atfork() is not a viable solution since clone() is
used in some cases instead of fork() and atfork handlers are not
called with clone().
Bug: 65637054
Test: LOG(FATAL) from a child process of init and see that it
terminates due to a signal correctly
Test: LOG(FATAL) from init proper and see that it reboots to the
bootloader
Change-Id: I875ebd7a5f6b3f5e3e2c028af3306917c4409db3
Bug: 64848081
Test: built and successfully booted again
Merged-In: I93c899249bf2cc5ab8d880c0eaff471518e73121
Change-Id: I08e6f71a7c5151544b9434eb0d362a236202cd31
On platforms that use ACPI instead of Device Tree (DT), such as
Ranchu x86/x86_64, /proc/device-tree/firmware/android/ does not
exist. As a result, Android O is unable to mount /system, etc.
at the first stage of init:
init: First stage mount skipped (missing/incompatible fstab in
device tree)
Those platforms may create another directory that mimics the layout
of the standard DT directory in procfs, and store early mount
configuration there. E.g., Ranchu x86/x86_64 creates one in sysfs
using information encoded in the ACPI tables:
https://android-review.googlesource.com/442472https://android-review.googlesource.com/443432https://android-review.googlesource.com/442393https://android-review.googlesource.com/442395
Therefore, instead of hardcoding the Android DT path, load it from
the kernel command line using a new Android-specific property key
("androidboot.android_dt_dir"). If no such property exists, fall
back to the standard procfs path (so no change is needed for DT-
aware platforms).
Note that init/ and fs_mgr/ each have their own copy of the Android
DT path, because they do not share any global state. A future CL
should remove the duplication by refactoring.
With this CL as well as the above ones, the said warning is gone,
but early mount fails. That is a separate bug, though, and will be
addressed by another CL.
Test: Boot patched sdk_phone_x86-userdebug system image with patched
Goldfish 3.18 x86 kernel in patched Android Emulator, verify
the "init: First stage mount skipped" warning no longer shows
in dmesg.
Signed-off-by: Yu Ning <yu.ning@intel.com>
(cherry picked from commit c08d2cb0fb7ce470e128c7571553aa12ae9b57a4)
Change-Id: Ia8d5f68e044fde0ecf5c7b14e40f040ff42bc35d
prctl(PR_SET_SECUREBITS, ...) expects an unsigned long as its 2nd argument.
Passing in a int64_t happens to work with a 64-bit kernel, but does not
work with a 32-bit kernel.
Bug: 63680332
Test: boot 32-bit kernel; verify services with capabilities can successfully
set those capabilties
Change-Id: I60250d107a77b54b2e9fe3419b4480b921c7e2f8
Signed-off-by: Ben Fennema <fennema@google.com>
(cherry picked from commit a72436067d)
We've blown up twice in init due to the unsigned integer overflow
sanitizer despite the overflows in question being both defined and
intentional.
Bug: 63680332
Test: boot
Change-Id: I08effe3202ac1367d858982ff5478b3a088bab37
(cherry picked from commit 2ffd65e1d1)
Latest device has rootfs instead of "/system" mount point
(cherry picked from commit a01c27eef8)
Bug: 37737296
Test: adb remount, reboot, and check log
Change-Id: I315ecf71e85255fc55c3a80619920b456bad0956
Recent change in init has bring normal shutdown sequence in
thermal-shutdown condition. This CL will make sure init fire shutdown
trigger where holds custom shutdown actions for vendor SoC/platform.
(cherry picked from commit 1be2212319)
Bug: 63686426
Test: adb shell setprop sys.powerctl thermal-shutdown
Change-Id: Ieb8579fdf9c30c1a81d60466a7375c9784f3ca98
- Skipping SIGTERM / SIGKILL / umount brings race between block
device driver and fs layer. Do umount before shutting down.
- Reduce timeout to 1 sec for thermal shutdown and skip other time
taking part like fsck.
- Refactor waiting part to check time in ms so that 1 sec can
have enough resolution.
bug: 63686426
Test: adb shell setprop sys.powerctl thermal-shutdown, adb shell setprop sys.powerctl reboot and check dmesg
Merged-In: I048bac767b328c8d656a97fe65dde5f2b5bf4ae5
Change-Id: I048bac767b328c8d656a97fe65dde5f2b5bf4ae5
- Skipping SIGTERM / SIGKILL / umount brings race between block
device driver and fs layer. Do umount before shutting down.
- Reduce timeout to 1 sec for thermal shutdown and skip other time
taking part like fsck.
- Refactor waiting part to check time in ms so that 1 sec can
have enough resolution.
bug: 63686426
Test: adb shell setprop sys.powerctl thermal-shutdown, adb shell setprop sys.powerctl reboot and check dmesg
Change-Id: I048bac767b328c8d656a97fe65dde5f2b5bf4ae5
- If problematic process is from user, kill all kills
it and dump does not show problematic process.
bug: 37737296
Test: reboot and check log
Merged-In: Iaa4f7d12f5a40fa7528c6672567c36e30b140372
Change-Id: Iaa4f7d12f5a40fa7528c6672567c36e30b140372
Use ASSERT_EQ() instead of EXPECT_EQ() to prevent segfaults after
failed API calls.
Do not run setfscreatecon_IsPerThread unless we're in permissive mode
as it will not pass otherwise.
Test: init unit tests
Change-Id: I70525d438e89f1ec036255890169a50b5007b4c4
- If problematic process is from user, kill all kills
it and dump does not show problematic process.
bug: 37737296
Test: reboot and check log
Change-Id: Iaa4f7d12f5a40fa7528c6672567c36e30b140372
Allow configuring memory.swappiness, memory.soft_limit_in_bytes
and memory.limit_in_bytes by init; by doing so there is better
control of memory consumption per native app.
Test: tested on gobo branch.
bug: 63765067
Change-Id: I8906f3ff5ef77f75a0f4cdfbf9d424a579ed52bb
Modified Android.mk to define cflag "USER_MODE_LINUX" if
TARGET_USER_MODE_LINUX := true in BoardCofig.mk.
Modified set_mmap_rnd_bits_action to return 0 if "USER_MODE_LINUX" is
defined. This is needed since uml does not support the mmap_rnd_bits
sysctl, and init would otherwise crash without this check.
Test: manual
Bug: 32523022
Change-Id: I409ef64a1fa253bfb3f9fb59d0267be159819bb8
Signed-off-by: Quang Luong <qal@google.com>
- /vendor, /system, /oem can be remounted to R/W for development
purpose.
- In such case, umounting these partitions can lead into some processes
not running properly during shutdown or blocking umount of fs.
- So skip them. As it is dev feature, it is up to each developer to
understand the risk. But for normal adb sync - reboot should be ok
as shutdown involves sync operations.
bug: 37737296
Test: adb remount,reboot, and check last kmsg
(cherry picked from commit 6e12b3887e)
Change-Id: Ia92a20aa672e68f695818e451ba2ae53af8f5ab9
