Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 45215ae6 authored by Woody Lin's avatar Woody Lin
Browse files

init/service_parser: Add arguments `window' and `target' for `critical' 

The critical services can now using the interface `critical
[window=<fatal crash window mins>] [target=<fatal reboot target>]` to
setup the timing window that when there are more than 4 crashes in it,
the init will regard it as a fatal system error and reboot the system.

Config `window=${zygote.critical_window.minute:-off}' and
`target=zygote-fatal' for all system-server services, so platform that
configures ro.boot.zygote_critical_window can escape the system-server
crash-loop via init fatal handler.

Bug: 146818493
Change-Id: Ib2dc253616be6935ab9ab52184a1b6394665e813
parent 45662c89

init/README.md

+5 −2
Original line number Diff line number Diff line
@@ -172,9 +172,12 @@ runs the service. 
  This option connects stdin, stdout, and stderr to the console. It is mutually exclusive with the

  stdio_to_kmsg option, which only connects stdout and stderr to kmsg.



`critical`

`critical [window=<fatal crash window mins>] [target=<fatal reboot target>]`

> This is a device-critical service. If it exits more than four times in

  four minutes or before boot completes, the device will reboot into bootloader.

  _fatal crash window mins_ minutes or before boot completes, the device

  will reboot into _fatal reboot target_.

  The default value of _fatal crash window mins_ is 4, and default value

  of _fatal reboot target_ is 'bootloader'.



`disabled`

> This service will not automatically start with its class.

init/host_init_stubs.h

+2 −1
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ 
#include <sys/socket.h>

#include <sys/types.h>



#include <optional>

#include <string>



#include <android-base/properties.h>
@@ -41,7 +42,7 @@ inline bool CanReadProperty(const std::string&, const std::string&) { 
}



// reboot_utils.h

inline void SetFatalRebootTarget() {}

inline void SetFatalRebootTarget(const std::optional<std::string>& = std::nullopt) {}

inline void __attribute__((noreturn)) InitFatalReboot(int signal_number) {

    abort();

}

init/reboot_utils.cpp

+7 −1
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ 
#include <sys/syscall.h>

#include <unistd.h>



#include <optional>

#include <string>



#include <android-base/file.h>
@@ -37,7 +38,7 @@ namespace init { 
static std::string init_fatal_reboot_target = "bootloader";

static bool init_fatal_panic = false;



void SetFatalRebootTarget() {

void SetFatalRebootTarget(const std::optional<std::string>& reboot_target) {

    std::string cmdline;

    android::base::ReadFileToString("/proc/cmdline", &cmdline);

    cmdline = android::base::Trim(cmdline);
@@ -45,6 +46,11 @@ void SetFatalRebootTarget() { 
    const char kInitFatalPanicString[] = "androidboot.init_fatal_panic=true";

    init_fatal_panic = cmdline.find(kInitFatalPanicString) != std::string::npos;



    if (reboot_target) {

        init_fatal_reboot_target = *reboot_target;

        return;

    }



    const char kRebootTargetString[] = "androidboot.init_fatal_reboot_target=";

    auto start_pos = cmdline.find(kRebootTargetString);

    if (start_pos == std::string::npos) {

init/reboot_utils.h

+2 −1
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ 


#pragma once



#include <optional>

#include <string>



#define PROC_SYSRQ "/proc/sysrq-trigger"
@@ -23,7 +24,7 @@ 
namespace android {

namespace init {



void SetFatalRebootTarget();

void SetFatalRebootTarget(const std::optional<std::string>& reboot_target = std::nullopt);

// Determines whether the system is capable of rebooting. This is conservative,

// so if any of the attempts to determine this fail, it will still return true.

bool IsRebootCapable();

init/service.cpp

+10 −5
Original line number Diff line number Diff line
@@ -45,6 +45,7 @@ 
#include <android/api-level.h>



#include "mount_namespace.h"

#include "reboot_utils.h"

#include "selinux.h"

#else

#include "host_init_stubs.h"
@@ -312,20 +313,24 @@ void Service::Reap(const siginfo_t& siginfo) { 
#endif

    const bool is_process_updatable = !pre_apexd_ && is_apex_updatable;



    // If we crash > 4 times in 4 minutes or before boot_completed,

    // If we crash > 4 times in 'fatal_crash_window_' minutes or before boot_completed,

    // reboot into bootloader or set crashing property

    boot_clock::time_point now = boot_clock::now();

    if (((flags_ & SVC_CRITICAL) || is_process_updatable) && !(flags_ & SVC_RESTART)) {

        bool boot_completed = android::base::GetBoolProperty("sys.boot_completed", false);

        if (now < time_crashed_ + 4min || !boot_completed) {

        if (now < time_crashed_ + fatal_crash_window_ || !boot_completed) {

            if (++crash_count_ > 4) {

                auto exit_reason = boot_completed ?

                    "in " + std::to_string(fatal_crash_window_.count()) + " minutes" :

                    "before boot completed";

                if (flags_ & SVC_CRITICAL) {

                    // Aborts into bootloader

                    // Aborts into `fatal_reboot_target_'.

                    SetFatalRebootTarget(fatal_reboot_target_);

                    LOG(FATAL) << "critical process '" << name_ << "' exited 4 times "

                               << (boot_completed ? "in 4 minutes" : "before boot completed");

                               << exit_reason;

                } else {

                    LOG(ERROR) << "updatable process '" << name_ << "' exited 4 times "

                               << (boot_completed ? "in 4 minutes" : "before boot completed");

                               << exit_reason;

                    // Notifies update_verifier and apexd

                    SetProperty("sys.init.updatable_crashing_process_name", name_);

                    SetProperty("sys.init.updatable_crashing", "1");