Android 手机开机不断重启故障分析

1、目前拿到编号为066E的故障机器,通过Android logcat日志分析初始报错现象是Android系统的zygote的AndroidRuntime在不断重启。
具体现象如下:

1.	07-26 07:48:43.625  2378  2378 D AndroidRuntime: >>>>>> START com.android.internal.os.ZygoteInit uid 0 <<<<<<  
2.	07-26 07:48:43.634  2378  2378 D AndroidRuntime: CheckJNI is OFF  
3.	07-26 07:48:43.635  2378  2378 I art     : option[0]=-Xzygote  
4.	07-26 07:48:43.636  2378  2378 I art     : option[1]=-Xstacktracefile:/data/anr/traces.txt  
5.	07-26 07:48:43.636  2378  2378 I art     : option[2]=exit  
6.	07-26 07:48:43.636  2378  2378 I art     : option[3]=vfprintf  
7.	07-26 07:48:43.636  2378  2378 I art     : option[4]=sensitiveThread  
8.	07-26 07:48:43.636  2378  2378 I art     : option[5]=-verbose:gc  
9.	07-26 07:48:43.636  2378  2378 I art     : option[6]=-Xms16m  
10.	...................  
11.	07-26 07:48:43.625  2378  2378 D AndroidRuntime: >>>>>> START com.android.internal.os.ZygoteInit uid 0 <<<<<<  
12.	07-26 07:48:43.634  2378  2378 D AndroidRuntime: CheckJNI is OFF  
13.	07-26 07:48:43.635  2378  2378 I art     : option[0]=-Xzygote  
14.	07-26 07:48:43.636  2378  2378 I art     : option[1]=-Xstacktracefile:/data/anr/traces.txt  
15.	07-26 07:48:43.636  2378  2378 I art     : option[2]=exit  
16.	07-26 07:48:43.636  2378  2378 I art     : option[3]=vfprintf  
17.	07-26 07:48:43.636  2378  2378 I art     : option[4]=sensitiveThread  
18.	07-26 07:48:43.636  2378  2378 I art     : option[5]=-verbose:gc  
19.	07-26 07:48:43.636  2378  2378 I art     : option[6]=-Xms16m  
20.	..........  
21.	07-26 07:48:43.625  2378  2378 D AndroidRuntime: >>>>>> START com.android.internal.os.ZygoteInit uid 0 <<<<<<  
22.	07-26 07:48:43.634  2378  2378 D AndroidRuntime: CheckJNI is OFF  
23.	07-26 07:48:43.635  2378  2378 I art     : option[0]=-Xzygote  
24.	07-26 07:48:43.636  2378  2378 I art     : option[1]=-Xstacktracefile:/data/anr/traces.txt  
25.	07-26 07:48:43.636  2378  2378 I art     : option[2]=exit  

2、AndroidRuntime无限重启原因是ServiceManager启动PMS失败 ,重要错误提示System : java.lang.RuntimeException: There must be exactly one installer; found []意思是没有发现PackageInstaller apk

1.	PackageManager: reconcileAppsData finished 112 packages  
2.	07-26 07:48:47.591  2471  2471 E PackageManager: There should probably be a verifier, but, none were found  
3.	07-26 07:48:47.592  2471  2471 E System  : ******************************************  
4.	07-26 07:48:47.593  2471  2471 E System  : ************ Failure starting system services  
5.	07-26 07:48:47.593  2471  2471 E System  : java.lang.RuntimeException: There must be exactly one installer; found []  
6.	07-26 07:48:47.593  2471  2471 E System  :  at com.android.server.pm.PackageManagerService.getRequiredInstallerLPr(PackageManagerService.java:2875)  
7.	07-26 07:48:47.593  2471  2471 E System  :  at com.android.server.pm.PackageManagerService.(PackageManagerService.java:2749)  
8.	07-26 07:48:47.593  2471  2471 E System  :  at com.android.server.pm.PackageManagerService.main(PackageManagerService.java:2005)  
9.	07-26 07:48:47.593  2471  2471 E System  :  at com.android.server.SystemServer.startBootstrapServices(SystemServer.java:486)  
10.	07-26 07:48:47.593  2471  2471 E System  :  at com.android.server.SystemServer.run(SystemServer.java:346)  
11.	07-26 07:48:47.593  2471  2471 E System  :  at com.android.server.SystemServer.main(SystemServer.java:230)  
12.	07-26 07:48:47.593  2471  2471 E System  :  at java.lang.reflect.Method.invoke(Native Method)  
13.	07-26 07:48:47.593  2471  2471 E System  :  at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:889)  
14.	07-26 07:48:47.593  2471  2471 E System  :  at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:779)  
15.	07-26 07:48:47.593  2471  2471 D AndroidRuntime: Shutting down VM  
16.	07-26 07:48:47.593  2471  2471 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: main  
17.	07-26 07:48:47.593  2471  2471 E AndroidRuntime: java.lang.RuntimeException: There must be exactly one installer; found []  
18.	07-26 07:48:47.593  2471  2471 E AndroidRuntime:    at com.android.server.pm.PackageManagerService.getRequiredInstallerLPr(PackageManagerService.java:2875)  
19.	07-26 07:48:47.593  2471  2471 E AndroidRuntime:    at com.android.server.pm.PackageManagerService.(PackageManagerService.java:2749)  
20.	07-26 07:48:47.593  2471  2471 E AndroidRuntime:    at com.android.server.pm.PackageManagerService.main(PackageManagerService.java:2005)  
21.	07-26 07:48:47.593  2471  2471 E AndroidRuntime:    at com.android.server.SystemServer.startBootstrapServices(SystemServer.java:486)  
22.	07-26 07:48:47.593  2471  2471 E AndroidRuntime:    at com.android.server.SystemServer.run(SystemServer.java:346)  
23.	07-26 07:48:47.593  2471  2471 E AndroidRuntime:    at com.android.server.SystemServer.main(SystemServer.java:230)  
24.	07-26 07:48:47.593  2471  2471 E AndroidRuntime:    at java.lang.reflect.Method.invoke(Native Method)  
25.	07-26 07:48:47.593  2471  2471 E AndroidRuntime:    at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:889)  
26.	07-26 07:48:47.593  2471  2471 E AndroidRuntime:    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:779)  
27.	07-26 07:48:47.594  2471  2471 E AndroidRuntime: Error reporting crash  
28.	07-26 07:48:47.594  2471  2471 E AndroidRuntime: java.lang.NullPointerException: Attempt to invoke virtual method 'void android.app.ActivityThread$Profiler.stopProfiling()' on a null object reference  
29.	07-26 07:48:47.594  2471  2471 E AndroidRuntime:    at android.app.ActivityThread.stopProfiling(ActivityThread.java:4868)  
30.	07-26 07:48:47.594  2471  2471 E AndroidRuntime:    at com.android.internal.os.RuntimeInit$UncaughtHandler.uncaughtException(RuntimeInit.java:93)  
31.	07-26 07:48:47.594  2471  2471 E AndroidRuntime:    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1068)  
32.	07-26 07:48:47.594  2471  2471 E AndroidRuntime:    at java.lang.ThreadGroup.uncaughtException(ThreadGroup.java:1063)  
33.	07-26 07:48:47.594  2471  2471 I Process : Sending signal. PID: 2471 SIG: 9  
34.	07-26 07:48:47.637   488   488 I ServiceManager: service 'batterystats' died  
35.	07-26 07:48:47.637   488   488 I ServiceManager: service 'appops' died  
36.	07-26 07:48:47.637   488   488 I ServiceManager: service 'power' died  
37.	07-26 07:48:47.637   488   488 I ServiceManager: service 'display' died  
38.	07-26 07:48:47.637   488   488 I ServiceManager: service 'regionalization' died  

Packageinstaller apk是用于apk安装、权限校验、权限赋权等,如果系统不存在Packageinstaller apk ,Android系统会不断重启查找这个apk。

相关函数片段如下:
1.	new  PackageManagerService() //PMS启动  
2.	 ---> mRequiredInstallerPackage = getRequiredInstallerLPr(); //查找系统中的 Packageinstaller  
3.	     --->getRequiredInstallerLPr{  
4.	         final Intent intent = new Intent(Intent.ACTION_INSTALL_PACKAGE);  
5.	        intent.addCategory(Intent.CATEGORY_DEFAULT);  
6.	        intent.setDataAndType(Uri.fromFile(new File("foo.apk")), PACKAGE_MIME_TYPE);  
7.	        //以上三行设定查找apk的条件  
8.	          
9.	        final List matches = queryIntentActivitiesInternal(intent, PACKAGE_MIME_TYPE,  
10.	                MATCH_SYSTEM_ONLY | MATCH_DIRECT_BOOT_AWARE | MATCH_DIRECT_BOOT_UNAWARE,  
11.	                UserHandle.USER_SYSTEM); //查询符合设定条件的apk ,即 Packageinstaller  
12.	        if (matches.size() == 1) {  
13.	            ResolveInfo resolveInfo = matches.get(0);  
14.	            if (!resolveInfo.activityInfo.applicationInfo.isPrivilegedApp()) {  
15.	                throw new RuntimeException("The installer must be a privileged app");  
16.	            }  
17.	            return matches.get(0).getComponentInfo().packageName;  
18.	        } else {  
19.	            throw new RuntimeException("There must be exactly one installer; found " + matches);  
20.	            //若获取不到就会抛出异常,禁止系统正常开机 ,这里就是系统报错的出处
21.	        }  
22.	     }  
函数queryIntentActivitiesInternal用于查询系统匹配intent 的apk
1.	private @NonNull List queryIntentActivitiesInternal(Intent intent,    
2.	           String resolvedType, int flags, int userId) {    
3.	       if (!sUserManager.exists(userId)) return Collections.emptyList();    
4.	   
5.	    // 这里的userId == UserHandle.USER_SYSTEM == 0 就是机器第一次初始化的默认user,    
6.	 //如果不存在 USER_SYSTEM 直接返回。现在情况是不存在USER_SYSTEM  
7.	  …….    
8.	 ResolveInfo xpResolveInfo  = querySkipCurrentProfileIntents(matchingFilters, intent,  
9.	                        resolvedType, flags, userId);  
10.	…   
11.	//查询匹配条件的apk  
12.	}    

3、android从4.2开始便添加了多用户功能,其具体的管理者为UserManager. 默认机器第一次开机的用户为system user,Android启动过程会查询UserManager中相关system user的信息。故障机器system user配置文件信息丢失。UserManager无法配置system user。
UserManager 中也就不存在 system user。
UserManager 有关user 管理的文件都是保存在data分区下 user_de 、user 、system
和 system_de文件夹中
正常机器启动UserManager日志输出:

1.	01-09 07:28:27.863  1302  1302 V UserManagerService: Found /data/user_de/0 with serial number 0  
2.	01-09 07:28:27.863  1302  1302 V UserManagerService: Found /data/user/0 with serial number 0  
3.	01-09 07:28:27.864  1302  1302 V UserManagerService: Found /data/system_de/0 with serial number 0  
4.	01-09 07:28:27.864  1302  1302 V UserManagerService: Found /data/system_ce/0 with serial number 0  

问题机器UserManager日志输出:

1.	  07-26 07:49:13.210  3879  3879 E UserManagerService: Unable to read user 0  

日志对比明显看出问题机器无法找到 user 0 ,即 system user。
UserManagerService 有关启动配置 system user的函数:

new UserManagerService()  
2.	  ---> readUserListLP()  
3.	       ---> readUserLP() {  
4.	           --AtomicFile userFile =  
5.	                    new AtomicFile(new File(mUsersDir, Integer.toString(id)          + XML_SUFFIX));  
6.	                    //这里 userFile = /data/system/users/0.xml ,问题机器没有0.xml  
7.	            fis = userFile.openRead();  
8.	            XmlPullParser parser = Xml.newPullParser();  
9.	            parser.setInput(fis, StandardCharsets.UTF_8.name());  
10.	            int type;  
11.	            while ((type = parser.next()) != XmlPullParser.START_TAG  
12.	                    && type != XmlPullParser.END_DOCUMENT) {  
13.	                // Skip  
14.	            }  
15.	  
16.	            if (type != XmlPullParser.START_TAG) {  
17.	            //如果文件不存在 或者无法解析这个文件 就报 如下错误,  
18.	                Slog.e(LOG_TAG, "Unable to read user " + id);  
19.	                return null;  
20.	            }  
21.	       }  

4、以上分析都是基于Android 的log 分析,总结大致就是/data分区某些有关UserManagerService文件丢失,致使PMS查询PackageInstaller apk获取为空而异常,PMS异常会使zygote崩溃重启。
5、Kernel 日志中错误最重要的信息是

9.411816] EXT4-fs (mmcblk0p24): mounted filesystem with ordered data mode. Opts: barrier=1,discard  
2.	[    9.420235] fs_mgr: __mount(source=/dev/block/bootdevice/by-name/system,target=/system,type=ext4)=0  
3.	[    9.620377] EXT4-fs warning (device mmcblk0p50): ext4_clear_journal_err:4669: Filesystem error recorded from previous mount: IO failure  
4.	[    9.631529] EXT4-fs warning (device mmcblk0p50): ext4_clear_journal_err:4670: Marking fs in need of filesystem check.  
5.	[    9.643172] EXT4-fs (mmcblk0p50): warning: mounting fs with errors, running e2fsck is recommended  
6.	[    9.656426] EXT4-fs (mmcblk0p50): recovery complete  
7.	[    9.660770] EXT4-fs (mmcblk0p50): mounted filesystem with ordered data mode. Opts: barrier=1,noauto_da_alloc,discard  
8.	[    9.671052] fs_mgr: __mount(source=/dev/block/bootdevice/by-name/userdata,target=/data,type=ext4)=0  
9.	[    9.683910] EXT4-fs (mmcblk0p27): warning: maximal mount count reached, running e2fsck is recommended  
10.	[    9.693249] EXT4-fs (mmcblk0p27): mounted filesystem with ordered data mode. Opts: (null)  
11.	[    9.700502] fs_mgr: __mount(source=/dev/block/bootdevice/by-name/factory,target=/factory,type=ext4)=0  
12.	[    9.712334] EXT4-fs (mmcblk0p28): warning: maximal mount count reached, running e2fsck is recommended  
13.	[    9.721616] EXT4-fs (mmcblk0p28): mounted filesystem with ordered data mode. Opts: (null)  
14.	[    9.728915] fs_mgr: __mount(source=/dev/block/bootdevice/by-name/esim,target=/esim,type=ext4)=0  
15.	[    9.741321] EXT4-fs (mmcblk0p29): warning: maximal mount count reached, running e2fsck is recommended  
16.	[    9.751306] EXT4-fs (mmcblk0p29): mounted filesystem with ordered data mode. Opts: (null)  
17.	[    9.758620] fs_mgr: __mount(source=/dev/block/bootdevice/by-name/sdcard,target=/sdcard,type=ext4)=0  

上图相关日志提示除了 mmcblk0p24(system)可以正常挂载分区,mmcblk0p50(data)、mmcblk0p27(factory) 、mmcblk0p28(esim)、 mmcblk0p29(sdcard) 挂载都出现文件系统错误。
需要系统使用文件系统工具e2fsck 进行恢复,虽然使用e2fsck恢复,但是下次开机还是会出现当前的错误提示。
出现这种情况的原因有可能是刷机过程中Android文件系统遭到破坏,/data 分区的某些文件丢失。


总结:
	翻译机2.0开机故障分析结果:
1、	Android 文件系统在刷机过程中被破坏,/data分区某些文件丢失
2、	/data分区文件/data/system/users/0.xml等丢失,UserManagerService无法启动配置system user
3、	UserManagerService无system user,所以PMS 函数queryIntentActivitiesInternal查询system user失败
4、	UserManagerService不存在system user,所以PMS函数在调用queryIntentActivitiesInternal时候
5、	PMS获取PackageInstaller失败,AndroidRuntime无法正常启动而崩溃
6、	AndroidRuntime崩溃,导致zygote不断重启
7、	如果继续追寻文件系统被破坏的问题,需要ODM公司更专业的分析。

你可能感兴趣的:(android)