1
2
3
4

# /sys/module/lowmemorykiller/parameters/minfree
18432,23040,27648,32256,55296,80640
# /sys/module/lowmemorykiller/parameters/adj
0,100,200,300,900,906

1
2

picasso:/ # cat /proc/7585/oom_score_adj                                 
0

1
2

picasso:/ # cat /proc/7585/oom_score_adj                                            
700

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

picasso:/proc/885 # ps -ef | grep lmkd
lmkd           885     1 0 14:56:33 ?     00:00:17 lmkd
root         10808  5253 4 20:16:59 pts/0 00:00:00 grep lmkd
picasso:/proc/885 # cd /proc/885
picasso:/proc/885 # cat status
Name:   lmkd
Umask:  0077
State:  S (sleeping)
Tgid:   885
Ngid:   0
Pid:    885
# 父进程ID init(1)
PPid:   1
TracerPid:      0
Uid:    1069    1069    1069    1069
Gid:    1069    1069    1069    1069
FDSize: 64

1
2
3
4
5
6
7

static final byte LMK_TARGET = 0;
static final byte LMK_PROCPRIO = 1;
static final byte LMK_PROCREMOVE = 2;
static final byte LMK_PROCPURGE = 3;
static final byte LMK_GETKILLCNT = 4;
static final byte LMK_SUBSCRIBE = 5;
static final byte LMK_PROCKILL = 6; // Note: this is an unsolicated command

1
2
3
4
5
6
7
8
9
10
11
12
13

/*
* Supported LMKD commands
*/
enum lmk_cmd {
    LMK_TARGET = 0, /* Associate minfree with oom_adj_score */
    LMK_PROCPRIO,   /* Register a process and set its oom_adj_score */
    LMK_PROCREMOVE, /* Unregister a process */
    LMK_PROCPURGE,  /* Purge all registered processes */
    LMK_GETKILLCNT, /* Get number of kills */
    LMK_SUBSCRIBE,  /* Subscribe for asynchronous events */
    LMK_PROCKILL,   /* Unsolicited msg to subscribed clients on proc kills */
    LMK_UPDATE_PROPS, /* Reinit properties */
};

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

public static void setOomAdj(int pid, int uid, int amt) {
    // This indicates that the process is not started yet and so no need to proceed further.
	if (pid <= 0) {
		return;
	}
	if (amt == UNKNOWN_ADJ)
		return;
  
	long start = SystemClock.elapsedRealtime();
    // 将进程一些信息放进ByteBuffer
	ByteBuffer buf = ByteBuffer.allocate(4 * 4);
	buf.putInt(LMK_PROCPRIO);
	buf.putInt(pid);
	buf.putInt(uid);
	buf.putInt(amt);
    // 写入socket缓冲区，准备发送
	writeLmkd(buf, null);
	long now = SystemClock.elapsedRealtime();
	if ((now-start) > 250) {
		Slog.w("ActivityManager", "SLOW OOM ADJ: " + (now-start) + "ms for pid " + pid
			+ " = " + amt);
	}
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

private static boolean writeLmkd(ByteBuffer buf, ByteBuffer repl) {
    // isConnected，此方法是主要，监测socket是否创建连接
	if (!sLmkdConnection.isConnected()) {
		// try to connect immediately and then keep retrying
		sKillHandler.sendMessage(
		sKillHandler.obtainMessage(KillHandler.LMKD_RECONNECT_MSG));
 
		// wait for connection retrying 3 times (up to 3 seconds)
		if (!sLmkdConnection.waitForConnection(3 * LMKD_RECONNECT_DELAY_MS)) {
			return false;
		}
	}
    // 发送消息
    return sLmkdConnection.exchange(buf, repl);
}

1
2
3
4
5
6

// 此方法判断mLmkdSocket是否连接，主要通过一个标志mLmkdSocket
public boolean isConnected() {
	synchronized (mLmkdSocketLock) {
		return (mLmkdSocket != null);
	}
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

public boolean connect() {
	synchronized (mLmkdSocketLock) {
		if (mLmkdSocket != null) {
			return true;
		}
		// temporary sockets and I/O streams
        // 打开连接
		final LocalSocket socket = openSocket();
 
		if (socket == null) {
			Slog.w(TAG, "Failed to connect to lowmemorykiller, retry later");
			return false;
		}
		
        // 获得输入输出
		final OutputStream ostream;
		final InputStream istream;
		try {
			ostream = socket.getOutputStream();
			istream = socket.getInputStream();
		} catch (IOException ex) {
			IoUtils.closeQuietly(socket);
			return false;
		}
		// execute onConnect callback
		if (mListener != null && !mListener.onConnect(ostream)) {
			Slog.w(TAG, "Failed to communicate with lowmemorykiller, retry later");
			IoUtils.closeQuietly(socket);
			return false;
		}
		// connection established
		mLmkdSocket = socket;
		mLmkdOutputStream = ostream;
		mLmkdInputStream = istream;
        mMsgQueue.addOnFileDescriptorEventListener(mLmkdSocket.getFileDescriptor(),
			EVENT_INPUT | EVENT_ERROR,
			new MessageQueue.OnFileDescriptorEventListener() {
				public int onFileDescriptorEvents(FileDescriptor fd, int events) {
					return fileDescriptorEventHandler(fd, events);
				}
			}
		);
		mLmkdSocketLock.notifyAll();
	}
	return true;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

/* Second pass to handle all other events */
for (i = 0, evt = &events[0]; i < nevents; ++i, evt++) {
	if (evt->events & EPOLLERR) {
		ALOGD("EPOLLERR on event #%d", i);
	}
	if (evt->events & EPOLLHUP) {
		/* This case was handled in the first pass */
		continue;
	}
	if (evt->data.ptr) {
        // 接收到消息，调用回调方法
		handler_info = (struct event_handler_info*)evt->data.ptr;
		call_handler(handler_info, &poll_params, evt->events);
	}
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

static void ctrl_command_handler(int dsock_idx) {
	......
 
	switch(cmd) {
        // 第一个指令
		case LMK_TARGET:
			targets = nargs / 2;
			if (nargs & 0x1 || targets > (int)ARRAY_SIZE(lowmem_adj))
				goto wronglen;
            // 处理逻辑
			cmd_target(targets, packet);
			break;
		case LMK_PROCPRIO:
			/* process type field is optional for backward compatibility */
			if (nargs < 3 || nargs > 4)
				goto wronglen;
			cmd_procprio(packet, nargs, &cred);
			break;
		case LMK_PROCREMOVE:
			if (nargs != 1)
				goto wronglen;
			cmd_procremove(packet, &cred);
			break;
		case LMK_PROCPURGE:
			if (nargs != 0)
				goto wronglen;
			cmd_procpurge(&cred);
			break;
		case LMK_GETKILLCNT:
			if (nargs != 2)
				goto wronglen;
			kill_cnt = cmd_getkillcnt(packet);
			len = lmkd_pack_set_getkillcnt_repl(packet, kill_cnt);
			if (ctrl_data_write(dsock_idx, (char *)packet, len) != len)
				return;
			break;
		case LMK_SUBSCRIBE:
			if (nargs != 1)
				goto wronglen;
			cmd_subscribe(dsock_idx, packet);
			break;
		case LMK_PROCKILL:
			/* This command code is NOT expected at all */
			ALOGE("Received unexpected command code %d", cmd);
			break;
		case LMK_UPDATE_PROPS:
			if (nargs != 0)
				goto wronglen;
			update_props();
			if (!use_inkernel_interface) {
				/* Reinitialize monitors to apply new settings */
				destroy_monitors();
				result = init_monitors() ? 0 : -1;
			} else {
				result = 0;
			}
			len = lmkd_pack_set_update_props_repl(packet, result);
			if (ctrl_data_write(dsock_idx, (char *)packet, len) != len) {
				ALOGE("Failed to report operation results");
			}
			if (!result) {
				ALOGI("Properties reinitilized");
			} else {
				/* New settings can't be supported, crash to be restarted */
				ALOGE("New configuration is not supported. Exiting...");
				exit(1);
			}
			break;
		default:
			ALOGE("Received unknown command code %d", cmd);
			return;
	}
 
	return;
 
	wronglen:
		ALOGE("Wrong control socket read length cmd=%d len=%d", cmd, len);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

static void cmd_procprio(LMKD_CTRL_PACKET packet, int field_count, struct ucred *cred) {
	......
	
	// 将adj的值写入到/proc/%d/oom_score_adj文件下
	snprintf(path, sizeof(path), "/proc/%d/oom_score_adj", params.pid);
	snprintf(val, sizeof(val), "%d", params.oomadj);
	if (!writefilestring(path, val, false)) {
		ALOGW("Failed to open %s; errno=%d: process %d might have been killed",
			path, errno, params.pid);
		/* If this file does not exist the process is dead. */
		return;
	}
	

	if (use_inkernel_interface) {
		stats_store_taskname(params.pid, proc_get_name(params.pid, path, sizeof(path)));
		return;
	}
	......

	// 通过循环从数组的链表中找到进程的节点
	procp = pid_lookup(params.pid);
	if (!procp) { 	// 进程节点为null则创建一个节点
		int pidfd = -1;

		if (pidfd_supported) {
			pidfd = TEMP_FAILURE_RETRY(sys_pidfd_open(params.pid, 0));
			if (pidfd < 0) {
				ALOGE("pidfd_open for pid %d failed; errno=%d", params.pid, errno);
				return;
			}
		}

        procp = static_cast<struct proc*>(calloc(1, sizeof(struct proc)));
        if (!procp) {
            // Oh, the irony.  May need to rebuild our state.
            return;
        }
  
        procp->pid = params.pid;
        procp->pidfd = pidfd;
		procp->uid = params.uid;
		procp->reg_pid = cred->pid;
		procp->oomadj = params.oomadj;
		proc_insert(procp);
	} else {	// 进程节点不为null则更新节点adj的值
		if (!claim_record(procp, cred->pid)) {
			char buf[LINE_MAX];
			/* Only registrant of the record can remove it */
			ALOGE("%s (%d, %d) attempts to modify a process registered by another client",
			proc_get_name(cred->pid, buf, sizeof(buf)), cred->uid, cred->pid);
			return;
		}
		proc_unslot(procp);
        
        // 更新当前节点adj
		procp->oomadj = params.oomadj;
		proc_slot(procp);
	}
}

1
2
3
4
5
6
7
8
9
10

private final int[] mOomMinFreeLow = new int[] {
        12288, 18432, 24576,
        36864, 43008, 49152
};
// These are the high-end OOM level limits.  This is appropriate for a
// 1280x800 or larger screen with around 1GB RAM.  Values are in KB.
private final int[] mOomMinFreeHigh = new int[] {
        73728, 92160, 110592,
        129024, 147456, 184320
};

1
2
3
4
5
6

ProcessList() {
	MemInfoReader minfo = new MemInfoReader();
	minfo.readMemInfo();
	mTotalMemMb = minfo.getTotalSize()/(1024*1024);
	updateOomLevels(0, 0, false);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

private void updateOomLevels(int displayWidth, int displayHeight, boolean write) {
    // 根据屏幕分辨率计算minfree
    // Scale buckets from avail memory: at 300MB we use the lowest values to
    // 700MB or more for the top values.
    float scaleMem = ((float) (mTotalMemMb - 350)) / (700 - 350);
    831  
    // Scale buckets from screen size.
    int minSize = 480 * 800;  //  384000
    int maxSize = 1280 * 800; // 1024000  230400 870400  .264
    float scaleDisp = ((float)(displayWidth * displayHeight) - minSize) / (maxSize - minSize);
    if (false) {
        Slog.i("XXXXXX", "scaleMem=" + scaleMem);
        Slog.i("XXXXXX", "scaleDisp=" + scaleDisp + " dw=" + displayWidth
			+ " dh=" + displayHeight);
	}

    float scale = scaleMem > scaleDisp ? scaleMem : scaleDisp;
    if (scale < 0) scale = 0;
    else if (scale > 1) scale = 1;
    int minfree_adj = Resources.getSystem().getInteger(
		com.android.internal.R.integer.config_lowMemoryKillerMinFreeKbytesAdjust);
	int minfree_abs = Resources.getSystem().getInteger(
		com.android.internal.R.integer.config_lowMemoryKillerMinFreeKbytesAbsolute);
	if (false) {
		Slog.i("XXXXXX", "minfree_adj=" + minfree_adj + " minfree_abs=" + minfree_abs);
	}
 
	final boolean is64bit = Build.SUPPORTED_64_BIT_ABIS.length > 0;
	
    // 以下逻辑主要是更新minfree
	for (int i = 0; i < mOomAdj.length; i++) {
		int low = mOomMinFreeLow[i];
		int high = mOomMinFreeHigh[i];
		if (is64bit) {
			// Increase the high min-free levels for cached processes for 64-bit
			if (i == 4) high = (high * 3) / 2;
			else if (i == 5) high = (high * 7) / 4;
		}
		mOomMinFree[i] = (int)(low + ((high - low) * scale));
	}
 
	if (minfree_abs >= 0) {
		for (int i = 0; i < mOomAdj.length; i++) {
			mOomMinFree[i] = (int)((float)minfree_abs * mOomMinFree[i]
				/ mOomMinFree[mOomAdj.length - 1]);
		}
	}

	if (minfree_adj != 0) {
		for (int i = 0; i < mOomAdj.length; i++) {
			mOomMinFree[i] += (int)((float) minfree_adj * mOomMinFree[i]
				/ mOomMinFree[mOomAdj.length - 1]);
            if (mOomMinFree[i] < 0) {
                mOomMinFree[i] = 0;
            }
		}
	}

    // The maximum size we will restore a process from cached to background, when under
    // memory duress, is 1/3 the size we have reserved for kernel caches and other overhead
    // before killing background processes.
    mCachedRestoreLevel = (getMemLevel(ProcessList.CACHED_APP_MAX_ADJ) / 1024) / 3;

    // Ask the kernel to try to keep enough memory free to allocate 3 full
    // screen 32bpp buffers without entering direct reclaim.
    int reserve = displayWidth * displayHeight * 4 * 3 / 1024;
    int reserve_adj = Resources.getSystem().getInteger(
        com.android.internal.R.integer.config_extraFreeKbytesAdjust);
    int reserve_abs = Resources.getSystem().getInteger(
        com.android.internal.R.integer.config_extraFreeKbytesAbsolute);

    if (reserve_abs >= 0) {
		reserve = reserve_abs;
	}
  
	if (reserve_adj != 0) {
		reserve += reserve_adj;
		if (reserve < 0) {
			reserve = 0;
		}
	}
	
    // 通过socket将信息发送到native层LMKD
	if (write) {
		ByteBuffer buf = ByteBuffer.allocate(4 * (2 * mOomAdj.length + 1));
        // 推送LMK_TARGET指令
		buf.putInt(LMK_TARGET);
		for (int i = 0; i < mOomAdj.length; i++) {
			buf.putInt((mOomMinFree[i] * 1024)/PAGE_SIZE);
			buf.putInt(mOomAdj[i]);
		}

		writeLmkd(buf, null);
		SystemProperties.set("sys.sysctl.extra_free_kbytes", Integer.toString(reserve));
		mOomLevelsSet = true;
	}
	// GB: 2048,3072,4096,6144,7168,8192
	// HC: 8192,10240,12288,14336,16384,20480
}

1
2
3
4
5
6
7

snprintf(val, sizeof(val), "%d", use_inkernel_interface ? lowmem_minfree[i] : 0);
strlcat(minfreestr, val, sizeof(minfreestr));
snprintf(val, sizeof(val), "%d", use_inkernel_interface ? lowmem_adj[i] : 0);
strlcat(killpriostr, val, sizeof(killpriostr));

writefilestring(INKERNEL_MINFREE_PATH, minfreestr, true);
writefilestring(INKERNEL_ADJ_PATH, killpriostr, true);

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

if (!app.isPersistent() || app.isolated) {
	if (DEBUG_PROCESSES || DEBUG_CLEANUP) Slog.v(TAG_CLEANUP,
		"Removing non-persistent process during cleanup: " + app);
	if (!replacingPid) {
        // 此处为重要点，调用ProcessList中的移除方法
		mProcessList.removeProcessNameLocked(app.processName, app.uid, app);
	}
	mAtmInternal.clearHeavyWeightProcessIfEquals(app.getWindowProcessController());
} else if (!app.removed) {
    // This app is persistent, so we need to keep its record around.
    // If it is not already on the pending app list, add it there
    // and start a new process for it.
	if (mPersistentStartingProcesses.indexOf(app) < 0) {
		mPersistentStartingProcesses.add(app);
		restart = true;
	}
}

1
2
3
4
5
6
7
8
9
10
11
12
13

@GuardedBy("mService")
final ProcessRecord removeProcessNameLocked(final String name, final int uid,
	final ProcessRecord expecting) {
	
	......
	
    if ((expecting == null) || (old == expecting)) {
    	// 通信native层LMKD
    	mProcessNames.remove(name, uid);
    }
    
    ......
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

final MyProcessMap mProcessNames = new MyProcessMap();

final class MyProcessMap extends ProcessMap<ProcessRecord> {
@Override
public ProcessRecord put(String name, int uid, ProcessRecord value) {
	final ProcessRecord r = super.put(name, uid, value);
	mService.mAtmInternal.onProcessAdded(r.getWindowProcessController());
	return r;
}
 
@Override
public ProcessRecord remove(String name, int uid) {
	// 调用remove方法
    final ProcessRecord r = super.remove(name, uid);
    mService.mAtmInternal.onProcessRemoved(name, uid);
    return r;
}

1
2
3
4
5
6
7
8
9
10
11
12

public static final void remove(int pid) {
    // This indicates that the process is not started yet and so no need to proceed further.
    if (pid <= 0) {
    	return;
    }
    ByteBuffer buf = ByteBuffer.allocate(4 * 2);
    
    // 发送指令，进行通信
    buf.putInt(LMK_PROCREMOVE);
    buf.putInt(pid);
    writeLmkd(buf, null);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

static void cmd_procremove(LMKD_CTRL_PACKET packet, struct ucred *cred) {
    struct lmk_procremove params;
    struct proc *procp;

    lmkd_pack_get_procremove(packet, &params);

	// 当use_inkernel_interface为1的时候，就使用内核去杀进程，
	// 当use_inkernel_interface为0的时候，就用lmkd去杀进程
	if (use_inkernel_interface) {

		poll_kernel(kpoll_fd);

		stats_remove_taskname(params.pid);
		return;
	}
	
	// 循环找到当前节点
	procp = pid_lookup(params.pid);
	
	......
	
	// 移除节点
	pid_remove(params.pid);
}

1
2
3
4
5

picasso:/ # ps -ef | grep lmkd
lmkd           885     1 0 14:56:32 ?     00:00:19 lmkd
root         17365  5253 0 21:25:09 pts/0 00:00:00 grep lmkd
picasso:/ # cat /proc/885/oom_score_adj
-1000

1
2
3
4
5
6
7
8
9
10

picasso:/ # ps -ef | grep com.miui.home
u0_a90        3224   667 0 14:56:46 ?     00:02:05 com.miui.home
root         18033  5253 0 21:32:18 pts/0 00:00:00 grep com.miui.home

# 桌面在前台时（前台进程）
picasso:/ # cat /proc/3224/oom_score_adj
0
# 桌面在后台时（即我们打开某个app）
picasso:/ # cat /proc/3224/oom_score_adj
100