记录一次系统进程死锁crash的分析

系统唤醒屏幕的时候，概率导致系统死锁。

crash 日志

------略-------
"PowerManagerService" prio=5 tid=24 Blocked
  | group="main" sCount=1 dsCount=0 flags=1 obj=0x12d816f0 self=0x715f3a9400
  | sysTid=544 nice=-4 cgrp=default sched=0/0 handle=0x715273e4f0
  | state=S schedstat=( 846103284 1433579951 4865 ) utm=56 stm=27 core=0 HZ=100
  | stack=0x715263c000-0x715263e000 stackSize=1037KB
  | held mutexes=
  at com.android.server.power.PowerManagerService.startUidChangesInternal(PowerManagerService.java:2958)
  - waiting to lock <0x0987a5bc> (a java.lang.Object) held by thread 39
  at com.android.server.power.PowerManagerService$LocalService.startUidChanges(PowerManagerService.java:4850)
  at com.android.server.am.ActivityManagerService.updateOomAdjLocked(ActivityManagerService.java:23154)
  at com.android.server.am.ActivityManagerService.updateSleepIfNeededLocked(ActivityManagerService.java:12695)
  at com.android.server.am.ActivityStackSupervisor.removeSleepTokenLocked(ActivityStackSupervisor.java:4052)
  at com.android.server.am.ActivityStackSupervisor.-wrap7(ActivityStackSupervisor.java:-1)
  at com.android.server.am.ActivityStackSupervisor$SleepTokenImpl.release(ActivityStackSupervisor.java:4959)
  - locked <0x0bf5b58d> (a com.android.server.am.ActivityManagerService)
  at com.android.server.policy.PhoneWindowManager.updateScreenOffSleepToken(PhoneWindowManager.java:8294)
  at com.android.server.policy.PhoneWindowManager.screenTurningOn(PhoneWindowManager.java:7508)
  at com.android.server.display.DisplayPowerController.setScreenState(DisplayPowerController.java:975)
  at com.android.server.display.DisplayPowerController.setScreenState(DisplayPowerController.java:916)
  at com.android.server.display.DisplayPowerController.animateScreenStateChange(DisplayPowerController.java:1048)
  at com.android.server.display.DisplayPowerController.updatePowerState(DisplayPowerController.java:685)
  at com.android.server.display.DisplayPowerController.-wrap6(DisplayPowerController.java:-1)
  at com.android.server.display.DisplayPowerController$DisplayControllerHandler.handleMessage(DisplayPowerController.java:1431)
  at android.os.Handler.dispatchMessage(Handler.java:106)
  at android.os.Looper.loop(Looper.java:164)
  at android.os.HandlerThread.run(HandlerThread.java:65)
  at com.android.server.ServiceThread.run(ServiceThread.java:46)
---------略---------
"InputReader" prio=10 tid=39 Blocked
  | group="main" sCount=1 dsCount=0 flags=1 obj=0x12d82a48 self=0x7151d80800
  | sysTid=614 nice=-8 cgrp=default sched=0/0 handle=0x7150cf44f0
  | state=S schedstat=( 300585048 188837454 1263 ) utm=14 stm=16 core=0 HZ=100
  | stack=0x7150bfa000-0x7150bfc000 stackSize=1005KB
  | held mutexes=
  at com.android.server.am.ActivityManagerService.broadcastIntent(ActivityManagerService.java:20065)
  - waiting to lock <0x0bf5b58d> (a com.android.server.am.ActivityManagerService) held by thread 24
  at android.app.ContextImpl.sendBroadcast(ContextImpl.java:971)
  at com.android.server.power.PowerManagerService.goToSleepNoUpdateLocked(PowerManagerService.java:1547)
  at com.android.server.power.PowerManagerService.goToSleepInternal(PowerManagerService.java:1531)
  - locked <0x0987a5bc> (a java.lang.Object)
  at com.android.server.power.PowerManagerService.-wrap12(PowerManagerService.java:-1)
  at com.android.server.power.PowerManagerService$BinderService.goToSleep(PowerManagerService.java:4408)
  at android.os.PowerManager.goToSleep(PowerManager.java:757)
  at com.android.server.policy.PhoneWindowManager.goToSleep(PhoneWindowManager.java:1638)
  at com.android.server.policy.PhoneWindowManager.powerPress(PhoneWindowManager.java:1604)
  at com.android.server.policy.PhoneWindowManager.interceptPowerKeyUp(PhoneWindowManager.java:1543)
  at com.android.server.policy.PhoneWindowManager.interceptKeyBeforeQueueing(PhoneWindowManager.java:6878)
  at com.android.server.wm.InputMonitor.interceptKeyBeforeQueueing(InputMonitor.java:449)
  at com.android.server.input.InputManagerService.interceptKeyBeforeQueueing(InputManagerService.java:1971)
------略-------

先看PowerManagerService tid=24的Blocked

1.ActivityStackSupervisor.java:4959
synchronized (mService) { //activityManagerService 锁住
removeSleepTokenLocked(this);
}
2.PowerManagerService.java:2958
void startUidChangesInternal() {
synchronized (mLock) { //等待tid 39解锁
mUidsChanging = true;
}
}
ActivityManagerService在锁住后，进入PowerManagerService等待mLock解锁，而这个mLock被tid=39的进程锁住

我们再看 InputReader tid=39 的Block

1.PowerManagerService.java:1531
synchronized (mLock) { //mLock 锁住
if (goToSleepNoUpdateLocked(eventTime, reason, flags, uid)) {
updatePowerStateLocked();
}
}

2. ActivityManagerService.java:20065
   synchronized(this) { //等待tid24解锁
   intent = verifyBroadcastLocked(intent);
   InputReader在PowerManagerService锁住后，准备发广播，然后需要锁住ActivityManagerService，然后tid=24 锁住了

从上面可以看到两个进程由于互锁，导致系统崩溃。进而分析原因。

我们开发系统系统灭屏的时候锁住activityManagerService并且会等待mLock解锁，在这个同时由于进程间状态问题，底层TP认为我们系统这个时候已经休眠，我们点击屏幕唤醒，TP发送了一个PowerKey广播，其实上层还未休眠，认为是马上进入Sleep操作，并且准备发送广播通知系统，导致互锁。
修改方法：

1. PowerKey广播不适合用以唤醒换成WakeUpKey
2. 不要在PowerManagerService的mLock后发广播，容易出现死锁。