android 6.0 vold shutdown流程

这篇博客我们主要分析下vold在关机时候的流程，先看如下代码：

一、接收shutdown命令

这是vold接收MountService的命令，我们主要看下shutdown命令

int CommandListener::VolumeCmd::runCommand(SocketClient *cli,
int argc, char **argv) {
dumpArgs(argc, argv, -1);

if (argc < 2) {
cli->sendMsg(ResponseCode::CommandSyntaxError, "Missing Argument", false);
return 0;
}

VolumeManager *vm = VolumeManager::Instance();
std::lock_guard<std::mutex> lock(vm->getLock());

// TODO: tease out methods not directly related to volumes

std::string cmd(argv[1]);
if (cmd == "reset") {
return sendGenericOkFail(cli, vm->reset());

} else if (cmd == "shutdown") {
return sendGenericOkFail(cli, vm->shutdown());

}

二、执行shutdown

接收到shutdown命令后我们调用了VolumeManager的shutdown函数。

int VolumeManager::shutdown() {
mInternalEmulated->destroy();
for (auto disk : mDisks) {
disk->destroy();
}
mDisks.clear();
return 0;
}

2.1 内部volume的卸载

VolumeManager的shutdown函数先调用了内部volume的destroy函数，最后会调用到

status_t EmulatedVolume::doUnmount() {
if (mFusePid > 0) {
kill(mFusePid, SIGTERM);
TEMP_FAILURE_RETRY(waitpid(mFusePid, nullptr, 0));
mFusePid = 0;
}

KillProcessesUsingPath(getPath());
ForceUnmount(mFuseDefault);
ForceUnmount(mFuseRead);
ForceUnmount(mFuseWrite);

rmdir(mFuseDefault.c_str());
rmdir(mFuseRead.c_str());
rmdir(mFuseWrite.c_str());

mFuseDefault.clear();
mFuseRead.clear();
mFuseWrite.clear();

return OK;
}

其中getPath函数返回的是storage/emulated/0目录，我们再来看看KillProcessesUsingPath函数：

status_t KillProcessesUsingPath(const std::string& path) {
const char* cpath = path.c_str();
if (Process::killProcessesWithOpenFiles(cpath, SIGINT) == 0) {
return OK;
}
sleep(5);

if (Process::killProcessesWithOpenFiles(cpath, SIGTERM) == 0) {
return OK;
}
sleep(5);

if (Process::killProcessesWithOpenFiles(cpath, SIGKILL) == 0) {
return OK;
}
sleep(5);

// Send SIGKILL a second time to determine if we've
// actually killed everyone with open files
if (Process::killProcessesWithOpenFiles(cpath, SIGKILL) == 0) {
return OK;
}
PLOG(ERROR) << "Failed to kill processes using " << path;
return -EBUSY;
}

主要还是调用了killProcessesWithOpenFiles函数，把占用这个文件的pid kill，直到没有pid占用这个文件。killProcessesWithOpenFiles我们后续分析。

继续回到VolumeManager的shutdown函数，下面就是各个Disk的destroy。

int VolumeManager::shutdown() {
mInternalEmulated->destroy();
for (auto disk : mDisks) {
disk->destroy();
}
mDisks.clear();
return 0;
}

2.2各个Disk的卸载

我们来看Disk的destroy函数：

status_t Disk::destroy() {
CHECK(mCreated);
destroyAllVolumes();
mCreated = false;
notifyEvent(ResponseCode::DiskDestroyed);
return OK;
}

主要看下destroyAllVolumes函数，如下，其实就是调用各个volume的destroy函数

void Disk::destroyAllVolumes() {
for (auto vol : mVolumes) {
vol->destroy();
}
mVolumes.clear();
}

volume的destroy函数又会调用到unmount函数。

status_t VolumeBase::destroy() {
CHECK(mCreated);

if (mState == State::kMounted) {
unmount();
setState(State::kBadRemoval);
} else {
setState(State::kRemoved);
}

notifyEvent(ResponseCode::VolumeDestroyed);
status_t res = doDestroy();
mCreated = false;
return res;
}

unmount函数又会调用到doUnmount函数，下面我们就来看下外部sd卡的PublicVolume的doUnmount函数：

status_t PublicVolume::doUnmount() {
if (mFusePid > 0) {
kill(mFusePid, SIGTERM);
TEMP_FAILURE_RETRY(waitpid(mFusePid, nullptr, 0));
mFusePid = 0;
}

ForceUnmount(kAsecPath);

ForceUnmount(mFuseDefault);//卸载fuse文件系统
ForceUnmount(mFuseRead);
ForceUnmount(mFuseWrite);
ForceUnmount(mRawPath);//卸载sd卡的挂载地址

rmdir(mFuseDefault.c_str());
rmdir(mFuseRead.c_str());
rmdir(mFuseWrite.c_str());
rmdir(mRawPath.c_str());

mFuseDefault.clear();
mFuseRead.clear();
mFuseWrite.clear();
mRawPath.clear();

return OK;
}

上面的函数就是卸载各种文件系统，我们主要看下ForceUnmount函数

status_t ForceUnmount(const std::string& path) {
const char* cpath = path.c_str();
if (!umount2(cpath, UMOUNT_NOFOLLOW) || errno == EINVAL || errno == ENOENT) {
return OK;
}
PLOG(WARNING) << "Failed to unmount 1 " << path;

// Apps might still be handling eject request, so wait before
// we start sending signals
sleep(5);

Process::killProcessesWithOpenFiles(cpath, SIGINT);
sleep(5);
if (!umount2(cpath, UMOUNT_NOFOLLOW) || errno == EINVAL || errno == ENOENT) {
return OK;
}
PLOG(WARNING) << "Failed to unmount 2 " << path;

Process::killProcessesWithOpenFiles(cpath, SIGTERM);
sleep(5);
if (!umount2(cpath, UMOUNT_NOFOLLOW) || errno == EINVAL || errno == ENOENT) {
return OK;
}
PLOG(WARNING) << "Failed to unmount 3 " << path;

Process::killProcessesWithOpenFiles(cpath, SIGKILL);
sleep(5);
if (!umount2(cpath, UMOUNT_NOFOLLOW) || errno == EINVAL || errno == ENOENT) {
return OK;
}
PLOG(ERROR) << "Failed to unmount " << path;

return -errno;
}

这个函数先执行unmount 操作，如果操作出错，就调用killProcessWithOpenFiles来杀占用该存储卡文件的pid。每次调用这个函数后继续umount操作，如果还不行，kill进程的信号会越来越高，最后到SIGKILL信号。

下面我们主要看下killProcessesWithOpenFiles函数。

三、杀占用sd卡文件的进程

下面我们主要分析killProcessesWithOpenFiles函数

int Process::killProcessesWithOpenFiles(const char *path, int signal) {
int count = 0;
DIR* dir;
struct dirent* de;

if (!(dir = opendir("/proc"))) {//打开proc目录
SLOGE("opendir failed (%s)", strerror(errno));
return count;
}

while ((de = readdir(dir))) {
int pid = getPid(de->d_name);//获取pid值
char name[PATH_MAX];

if (pid == -1)//不是pid的子目录continue，继续遍历目录
continue;
getProcessName(pid, name, sizeof(name));//从proc/pid/cmdline获取进程名

char openfile[PATH_MAX];

if (checkFileDescriptorSymLinks(pid, path, openfile, sizeof(openfile))) {
SLOGE("Process %s (%d) has open file %s", name, pid, openfile);
} else if (checkFileMaps(pid, path, openfile, sizeof(openfile))) {
SLOGE("Process %s (%d) has open filemap for %s", name, pid, openfile);
} else if (checkSymLink(pid, path, "cwd")) {
SLOGE("Process %s (%d) has cwd within %s", name, pid, path);
} else if (checkSymLink(pid, path, "root")) {
SLOGE("Process %s (%d) has chroot within %s", name, pid, path);
} else if (checkSymLink(pid, path, "exe")) {
SLOGE("Process %s (%d) has executable path within %s", name, pid, path);
} else {
continue;
}

if (signal != 0) {
SLOGW("Sending %s to process %d", strsignal(signal), pid);
kill(pid, signal);
count++;
}
}
closedir(dir);
return count;
}

下面我们先看下checkFileDescriptorSymLinks函数

int Process::checkFileDescriptorSymLinks(int pid, const char *mountPoint, char *openFilename, size_t max) {

// compute path to process's directory of open files
char    path[PATH_MAX];
sprintf(path, "/proc/%d/fd", pid);//指定proc/pid/fd这个目录
DIR *dir = opendir(path);
if (!dir)
return 0;

// remember length of the path
int parent_length = strlen(path);
// append a trailing '/'
path[parent_length++] = '/';

struct dirent* de;
while ((de = readdir(dir))) {
if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, "..")
|| strlen(de->d_name) + parent_length + 1 >= PATH_MAX)
continue;

// append the file name, after truncating to parent directory
path[parent_length] = 0;
strcat(path, de->d_name);//把目录变成proc/pid/fd/各个文件fd

char link[PATH_MAX];
//下面这个判断条件的意思是读取各个fd（符号链接）所指向的实际目录，然后第二个条件看看这个实际目录和挂载地址是否匹配
if (readSymLink(path, link, sizeof(link)) && pathMatchesMountPoint(link, mountPoint)) {
if (openFilename) {
memset(openFilename, 0, max);
strlcpy(openFilename, link, max);//把fd指向的实际地址传给openFilename
}
closedir(dir);
return 1;
}
}

closedir(dir);
return 0;
}

下面我们来看下readSymlink函数和pathMatchesMountPoint函数

int Process::readSymLink(const char *path, char *link, size_t max) {
struct stat s;
int length;

if (lstat(path, &s) < 0)
return 0;
if ((s.st_mode & S_IFMT) != S_IFLNK)//如果不是符号链接，返回
return 0;

// we have a symlink
length = readlink(path, link, max- 1);//读取符号链接所指向的实际地址
if (length <= 0)
return 0;
link[length] = 0;//字符串结束符
return 1;
}

pathMatchesMountPoint函数

int Process::pathMatchesMountPoint(const char* path, const char* mountPoint) {
int length = strlen(mountPoint);
if (length > 1 && strncmp(path, mountPoint, length) == 0) {//挂载地址和前面实际地址前面地址相同
// we need to do extra checking if mountPoint does not end in a '/'
if (mountPoint[length - 1] == '/')
return 1;
// if mountPoint does not have a trailing slash, we need to make sure
// there is one in the path to avoid partial matches.
return (path[length] == 0 || path[length] == '/');//如果实际地址在之前的路径是/或者结束了 返回1
}

return 0;
}

这样在killProcessesWithOpenFiles函数中，

1. checkFileDescriptorSymLinks

先看各个proc/pid/fd下面各个符号链接所指向的文件是否有在外置sd卡中的。如果有的话，通过cmdline把进程名和占用的sd卡文件打印出来

2.checkFileMaps

看各个pid的内存映射 proc/pid/maps是否有占用sd卡文件

3.查看proc/pid/cmd proc/pid/root proc/pid/exe下是否有占用sd卡文件

如果在这个pid中有的话，就把这个pid杀了，并且count + 1

我们再来看下proc/pid/fd下的文件，这是vold的pid下各个fd很多都指向socket pipe等

root@lte26007:/proc/173/fd # ls -l
lrwx------ root     root              1980-01-01 14:17 0 -> /dev/null
lrwx------ root     root              1980-01-01 14:17 1 -> /dev/null
lrwx------ root     root              1980-01-01 14:17 10 -> socket:[7465]
lrwx------ root     root              1980-01-01 14:17 11 -> socket:[7468]
lr-x------ root     root              1980-01-01 14:17 12 -> pipe:[3160]
lrwx------ root     root              1980-01-01 14:17 13 -> socket:[10392]
lrwx------ root     root              1980-01-01 14:17 14 -> socket:[10394]
l-wx------ root     root              1980-01-01 14:17 15 -> pipe:[3160]
lrwx------ root     root              1980-01-01 14:17 2 -> /dev/null
lrwx------ root     root              1980-01-01 13:32 3 -> socket:[3142]
lrwx------ root     root              1980-01-01 14:17 4 -> socket:[3148]
lr-x------ root     root              1980-01-01 14:17 5 -> pipe:[3149]
l-wx------ root     root              1980-01-01 14:17 6 -> pipe:[3149]
lr-x------ root     root              1980-01-01 14:17 7 -> pipe:[3159]
l-wx------ root     root              1980-01-01 14:17 8 -> pipe:[3159]
lr-x------ root     root              1980-01-01 14:17 9 -> /dev/__properties__

下面是setttings 进程下的fd，指向很多都是文件

root@lte26007:/proc/1667/fd # ls -l
lrwx------ system system 1980-01-01 14:19 0 -> /dev/null
lrwx------ system system 1980-01-01 14:19 1 -> /dev/null
l-wx------ system system 1980-01-01 14:19 10 -> /dev/cpuctl/tasks
lr-x------ system system 1980-01-01 14:19 11 -> /system/priv-app/Settings/Settings.apk
l-wx------ system system 1980-01-01 14:19 12 -> /dev/cpuctl/bg_non_interactive/tasks
lrwx------ system system 1980-01-01 14:19 13 -> socket:[34994]
lr-x------ system system 1980-01-01 14:19 14 -> pipe:[11126]
l-wx------ system system 1980-01-01 14:19 15 -> pipe:[11126]
lrwx------ system system 1980-01-01 14:19 16 -> anon_inode:[eventfd]
lrwx------ system system 1980-01-01 14:19 17 -> anon_inode:[eventpoll]
lrwx------ system system 1980-01-01 13:33 18 -> anon_inode:[eventfd]
lrwx------ system system 1980-01-01 14:19 19 -> anon_inode:[eventpoll]
lrwx------ system system 1980-01-01 14:19 2 -> /dev/null
lrwx------ system system 1980-01-01 14:19 20 -> /data/data/com.android.settings/databases/lock_screen_data_usage.db
lr-x------ system system 1980-01-01 14:19 21 -> pipe:[34995]
l-wx------ system system 1980-01-01 14:19 22 -> pipe:[34995]
lrwx------ system system 1980-01-01 14:19 3 -> socket:[3344]
l-wx------ system system 1980-01-01 14:19 4 -> /sys/kernel/debug/tracing/trace_marker
lr-x------ system system 1980-01-01 14:19 5 -> /system/framework/framework-res.apk
lr-x------ system system 1980-01-01 14:19 6 -> /system/framework/core-libart.jar
lr-x------ system system 1980-01-01 14:19 7 -> /dev/urandom
lrwx------ system system 1980-01-01 14:19 8 -> /dev/binder
lr-x------ system system 1980-01-01 14:19 9 -> /dev/__properties__

四、总结

这篇博客，主要分析了vold在手机关机的流程，先进行内存volume的卸载，然后再是各个disk的卸载。其中我们详细分析了在卸载sd卡的时候，会去kill各个占用外置sd卡的pid。