sl8541e_1h10_32b:/ # getprop | grep dalvik.vm.heap
[dalvik.vm.heapgrowthlimit]: [80m] //单个应用程序最大内存限制，超过将被Kill
[dalvik.vm.heapsize]: [256m] //所有情况下（包括设置android:
 largeHeap="true"的情形）的最大堆内存值，超过直接oom
[dalvik.vm.heapstartsize]: [6m] //单个应用程序分配的初始内存

void testForOutMemory(){
    ActivityManager mActivityManager = (ActivityManager)
 getApplication().getSystemService(Context.ACTIVITY_SERVICE);
    int largeMemoryClass = mActivityManager.getLargeMemoryClass();
    int memoryClass = mActivityManager.getMemoryClass();
    int currentMemory = (int) Runtime.getRuntime().maxMemory() /1024 /1024;
    Log.d("LZQ","[show memory] largeMemoryClass = " +
  largeMemoryClass + " | memoryClass = " + memoryClass + 
 " | currentMemory = " + currentMemory);

    List list = new ArrayList();
    int count = 0;
    while (true) {
        Log.d("LZQ","[allocate memory] count = " + count);
        byte[] test = new byte[20 * 1024 * 1024];//20M数据
        list.add(test);
        count++;
    }
}

@art\runtime\gc\heap.cc
void Heap::ThrowOutOfMemoryError(Thread* self, size_t byte_count, AllocatorType allocator_type) {
  // If we're in a stack overflow, do not create a new exception. It would require running the
  // constructor, which will of course still be in a stack overflow.
  ...
  std::ostringstream oss;
  size_t total_bytes_free = GetFreeMemory();
  oss << "Failed to allocate a " << byte_count << " byte allocation with " << total_bytes_free
      << " free bytes and " << PrettySize(GetFreeMemoryUntilOOME()) << " until OOM,"
      << " target footprint " << target_footprint_.load(std::memory_order_relaxed)
      << ", growth limit "
      << growth_limit_;
  ...
  self->ThrowOutOfMemoryError(oss.str().c_str());
}

08-09 10:33:27.695   376   376 I lowmemorykiller: Kill
  'com.android.deskclock' (14849),
 uid 1000, oom_adj 700 to free 6728kB; reason: low 
 watermark is breached and swap is low (0kB < 108644kB), adjust critical adj.
08-09 10:33:27.695   376   376 D lowmemorykiller:
  handle notify_lmfs_process_killed done for 14849
08-09 10:33:27.720   383   383 D SurfaceFlinger: Setting
  power mode 0 on display 0
08-09 10:33:27.807   776  1101 D LmKillerTracker: doLmkForceStop pid=14849
08-09 10:33:27.827   328   328 I Zygote  : Process 
 14849 exited due to signal 9 (Killed)

@frameworks\base\services\core\java\com\android\server\am\ProcessList.java
    // 任何主要或次要adj字段的未初始化值
    static final int INVALID_ADJ = -10000;

    // 在某些我们还不知道的地方进行调整(通常这是将要被缓存的东西，但我们还
不知道要分配的缓存范围内的确切值)。
    static final int UNKNOWN_ADJ = 1001;

    // 这是一个只托管不可见活动的进程，因此可以在不中断任何情况下终止它。
    static final int CACHED_APP_MAX_ADJ = 999;
    static final int CACHED_APP_MIN_ADJ = 900;

    // 这是我们允许先死的oom_adj级别。这不能等于CACHED_APP_MAX_ADJ，除非
进程正在积极地被分配CACHED_APP_MAX_ADJ的oom_score_adj。
    static final int CACHED_APP_LMK_FIRST_ADJ = 950;

    // SERVICE_ADJ的B列表——这些是旧的和破旧的服务，不像A列表中的服务那么闪亮和有趣。
    static final int SERVICE_B_ADJ = 800;

    // 这是用户所在的前一个应用程序的进程。这个过程保持在其他事情之上，
因为切换回上一个应用程序是非常常见的。
这对于最近的任务切换(在两个最热门的最近应用程序之间切换)以及正常
的UI流(例如单击电子邮件应用程序中的URI以在浏览器中查看，然后按回返回电子邮件)都很重要。
    static final int PREVIOUS_APP_ADJ = 700;

    // 这是一个包含主应用程序的进程——我们希望尽量避免杀死它，即使它通常在后台，因为用户与它交互太多了。
    static final int HOME_APP_ADJ = 600;

    // 这是一个包含应用程序服务的进程——就用户而言，杀死它不会有太大的影响。
    static final int SERVICE_ADJ = 500;

    // 这是一个重量级应用程序的过程。它在背景中，但我们要尽量避免杀死它。
在system/rootdir/init中设置的值。Rc启动。
    static final int HEAVY_WEIGHT_APP_ADJ = 400;

    // 这是当前托管备份操作的进程。杀死它并不完全致命，但通常是个坏主意。
    static final int BACKUP_APP_ADJ = 300;

    // 这是一个受系统(或其他应用)约束的过程，它比服务更重要，但如果被杀死，它不会立即影响用户。
    static final int PERCEPTIBLE_LOW_APP_ADJ = 250;

    // 这是一个只承载用户可感知组件的进程，我们确实希望避免杀死它们，但它们
不是立即可见的。背景音乐播放就是一个例子。
    static final int PERCEPTIBLE_APP_ADJ = 200;

    // 这是一个只承载用户可见的活动的进程，所以我们希望它们不要消失。
    static final int VISIBLE_APP_ADJ = 100;
    static final int VISIBLE_APP_LAYER_MAX = PERCEPTIBLE_APP_ADJ - VISIBLE_APP_ADJ - 1;

    // 这是一个最近被列为TOP的过程，并转移到了FGS。在一段时间内，继续把它当作前台应用来对待。
    static final int PERCEPTIBLE_RECENT_FOREGROUND_APP_ADJ = 50;

    // 这是运行当前前台应用程序的进程。我们真的不想杀死它!
    static final int FOREGROUND_APP_ADJ = 0;

    // 这是系统或持久进程绑定的进程，并表示它很重要。
    static final int PERSISTENT_SERVICE_ADJ = -700;

    // 这是一个系统持久进程，例如电话。我当然不想杀死它，但这样做也不是完全致命的。
    static final int PERSISTENT_PROC_ADJ = -800;

    // 系统进程以默认调整运行。
    static final int SYSTEM_ADJ = -900;

    // 不受系统管理的本机进程的特殊代码(因此没有系统分配的空间)。
    static final int NATIVE_ADJ = -1000;

@frameworks\base\services\core\java\com\android\server\am\ProcessList.java
    public static void setOomAdj(int pid, int uid, int amt) {
        ...
        long start = SystemClock.elapsedRealtime();
        ByteBuffer buf = ByteBuffer.allocate(4 * 4);
        buf.putInt(LMK_PROCPRIO);
        buf.putInt(pid);
        buf.putInt(uid);
        buf.putInt(amt);
        writeLmkd(buf, null);
        ...
    }

    private static boolean openLmkdSocketLS() {
        try {
            sLmkdSocket = new LocalSocket(LocalSocket.SOCKET_SEQPACKET);
            sLmkdSocket.connect(
                new LocalSocketAddress("lmkd",
                        LocalSocketAddress.Namespace.RESERVED));
            sLmkdOutputStream = sLmkdSocket.getOutputStream();
            sLmkdInputStream = sLmkdSocket.getInputStream();
        } 
        ...
        return true;
    }

   private static boolean writeLmkdCommandLS(ByteBuffer buf) {
        try {
            sLmkdOutputStream.write(buf.array(), 0, buf.position());
        } catch (IOException ex) {
            Slog.w(TAG, "Error writing to lowmemorykiller socket");
            IoUtils.closeQuietly(sLmkdSocket);
            sLmkdSocket = null;
            return false;
        }
        return true;
    }

    private static boolean readLmkdReplyLS(ByteBuffer buf) {
        int len;
        try {
            len = sLmkdInputStream.read(buf.array(), 0, buf.array().length);
            if (len == buf.array().length) {
                return true;
            }
        } 
        ...
    }

@system/core/lmkd/lmkd.rc
service lmkd /system/bin/lmkd
    class core
    user lmkd
    group lmkd system readproc
    capabilities DAC_OVERRIDE KILL IPC_LOCK SYS_NICE SYS_RESOURCE NET_ADMIN
    critical
    socket lmkd seqpacket 0660 system system
    socket lmfs stream 0660 root system
    socket vmpressure stream 0666 root system
    writepid /dev/cpuset/system-background/tasks

@\system\core\lmkd\lmkd.c
int main(int argc __unused, char **argv __unused) {
    ...
    level_oomadj[VMPRESS_LEVEL_LOW] =
        property_get_int32("ro.lmk.low", OOM_SCORE_ADJ_MAX + 1);//初始化属性配置
    ...
    if (!init()) {//初始化消息事件处理
        if (!use_inkernel_interface) {//不使用驱动LMK杀进程方案
            ...
            if (mlockall(MCL_CURRENT | MCL_FUTURE | MCL_ONFAULT) && (errno != EINVAL)) {//虚拟空间上锁，防止内存交换
                ALOGW("mlockall failed %s", strerror(errno));
            }
            ...
        }
        ...
        mainloop();//轮询监听消息事件
    }
    ...
    return 0;
}

    epollfd = epoll_create(MAX_EPOLL_EVENTS);
    if (epollfd == -1) {
        ALOGE("epoll_create failed (errno=%d)", errno);
        return -1;
    }

    ctrl_sock.sock = android_get_control_socket("lmkd");//设置监听的socket名称
    if (ctrl_sock.sock < 0) {
        ALOGE("get lmkd control socket failed");
        return -1;
    }

    ret = listen(ctrl_sock.sock, MAX_DATA_CONN);//监听socket消息
    if (ret < 0) {
        ALOGE("lmkd control socket listen failed (errno=%d)", errno);
        return -1;
    }

    epev.events = EPOLLIN;//只有当对端有数据写入时才会触发，
 所以触发一次后需要不断读取所有数据直到读完EAGAIN为止
    ctrl_sock.handler_info.handler = ctrl_connect_handler;
 //socket连接成功的响应处理事件
    epev.data.ptr = (void *)&(ctrl_sock.handler_info);
    if (epoll_ctl(epollfd, EPOLL_CTL_ADD, ctrl_sock.sock, &
 epev) == -1) {//将socket句柄添加到epoll的池子，并设置epev的监听事件类型
        ALOGE("epoll_ctl for lmkd control socket failed (errno=%d)", errno);
        return -1;
    }

#define INKERNEL_MINFREE_PATH "/sys/module/lowmemorykiller/parameters/minfree"

has_inkernel_module = !access(INKERNEL_MINFREE_PATH, W_OK);
use_inkernel_interface = has_inkernel_module;

/* Try to use psi monitor first if kernel has it */
    use_psi_monitors = property_get_bool("ro.lmk.use_psi", true) &&
        init_psi_monitors();//使用psi策略

    if (use_psi_vmpressure && use_psi_monitors) {
        if (!init_mp_common(VMPRESS_LEVEL_MEDIUM_EXT)) {//使用vmpressure策略
            ALOGE("Kernel does no support memory pressure events.use psi only.");
        }
    }

static bool init_psi_monitors() {
    ...
    bool use_new_strategy =
        property_get_bool("ro.lmk.use_new_strategy", 
low_ram_device || !use_minfree_levels);//确认是使用PSI 策略还是vmpressure

    /* In default PSI mode override stall amounts using system properties */
    if (use_new_strategy) {
        /* Do not use low pressure level */
        psi_thresholds[VMPRESS_LEVEL_LOW].threshold_ms = 0;
        psi_thresholds[VMPRESS_LEVEL_MEDIUM].threshold_ms = psi_partial_stall_ms;//70ms，
部分 PSI 失速阈值（以毫秒为单位），用于触发内存不足通知。如果设备收到内存压力通
知的时间太晚，可以降低此值以在较早的时间触发通知。
        psi_thresholds[VMPRESS_LEVEL_CRITICAL].threshold_ms = psi_complete_stall_ms
;//700ms，完全 PSI 失速阈值（以毫秒为单位），用于触发关键内存通知。如果设备收到关
键内存压力通知的时间太晚，可以降低该值以在较早的时间触发通知。
    }
    //初始化PSI相关行为
    if (!init_mp_psi(VMPRESS_LEVEL_LOW, use_new_strategy)) {
        return false;
    }
    ...
    return true;
}

#define PSI_MON_FILE_MEMORY "/proc/pressure/memory"
static bool init_mp_psi(enum vmpressure_level level, bool use_new_strategy) {
    ...
    fd = init_psi_monitor(psi_thresholds[level].stall_type,
        psi_thresholds[level].threshold_ms * US_PER_MS,
        PSI_WINDOW_SIZE_MS * US_PER_MS);//获取/proc/pressure/memory节点
    ...
    vmpressure_hinfo[level].handler = use_new_strategy ? 
 mp_event_psi_psi : mp_event_common;//内存压力消息响应处理事件
    vmpressure_hinfo[level].data = level;
    if (register_psi_monitor(epollfd, fd, &vmpressure
 _hinfo[level]) < 0) {//注册监听器，监听psi内存压力
        destroy_psi_monitor(fd);
        return false;
    }
    ...
    return true;
}

static void mainloop(void) {
    ...
    while (1) {
        ...
        if (poll_params.poll_handler) {
            ...
            /* Wait for events until the next polling timeout */
            nevents = epoll_wait(epollfd, events, maxevents, delay);//阻塞等待epoll响应
            ...
        }
        ...
        /* Second pass to handle all other events */
        for (i = 0, evt = &events[0]; i < nevents; ++i, evt++) {
            ...
            if (evt->data.ptr) {
                handler_info = (struct event_handler_info*)evt->data.ptr;
                /* Set input params for the call */
                handler_info->handler(handler_info->data, evt->events, &poll_params);//执行handler
                ...
            }
        }
    }
}

//根据指令id进行事件下发
static void ctrl_command_handler(int dsock_idx) {
    ...
    switch(cmd) {
    case LMK_TARGET://更新OomLevels水位时，触发
        ...
        cmd_target(targets, packet);
        break;
    case LMK_PROCPRIO://oom_adj_score更新时，触发
        ...
        cmd_procprio(packet);
        break;
    case LMK_PROCREMOVE://进程退出时，移除相关信息，触发
        ...
        cmd_procremove(packet);
        break;
    case LMK_PROCPURGE://socket连接成功后，触发
        ...
        cmd_procpurge();
        break;
    ...
    }
    ...
}

//更新OomLevels水位
static void cmd_target(int ntargets, LMKD_CTRL_PACKET packet) {
    ...
    for (i = 0; i < ntargets; i++) {
        lmkd_pack_get_target(packet, i, &target);
        lowmem_minfree[i] = target.minfree;//内存阈值数组
        lowmem_adj[i] = target.oom_adj_score;//adj等级数组
        pstr += snprintf(pstr, pend - pstr, "%d:%d,", target.minfree,
            target.oom_adj_score);
        ...
    }
    pstr[-1] = '\0';
    property_set("sys.lmk.minfree_levels", minfree_str);//重新写入水位属性
    ...
}

//更新oom_adj_score
static void cmd_procprio(LMKD_CTRL_PACKET packet) {
    ...
    snprintf(path, sizeof(path), "/proc/%d/oom_score_adj", params.pid);
    snprintf(val, sizeof(val), "%d", params.oomadj);
    if (!writefilestring(path, val, false)) {
        ALOGW("Failed to open %s; errno=%d: process %d might have been killed",
              path, errno, params.pid);
        /* If this file does not exist the process is dead. */
        return;
    }
    ...
}

    if (vmstat_parse(&vs) < 0) {
        ALOGE("Failed to parse vmstat!");
        return;
    }

    if (meminfo_parse(&mi) < 0) {
        ALOGE("Failed to parse meminfo!");
        return;
    }

    if (!in_reclaim) {
        /* Record file-backed pagecache size when entering reclaim cycle */
        base_file_lru = vs.field.nr_inactive_file + vs.field.nr_active_file;
        init_ws_refault = vs.field.workingset_refault;
        thrashing_limit = thrashing_limit_pct;
    } else {
        /* Calculate what % of the file-backed pagecache refaulted so far */
        thrashing = (vs.field.workingset_refault - init_ws_refault) * 100 / base_file_lru;
    }
    in_reclaim = true;

    if (watermarks.high_wmark == 0 || get_time_diff_ms(&wmark_update_tm, &curr_tm) > 60000) {
        struct zoneinfo zi;

        if (zoneinfo_parse(&zi) < 0) {
            ALOGE("Failed to parse zoneinfo!");
            return;
        }

        calc_zone_watermarks(&zi, &watermarks);
        wmark_update_tm = curr_tm;
     }

enum zone_watermark {
    WMARK_MIN = 0,
    WMARK_LOW,
    WMARK_HIGH,
    WMARK_NONE
};

/* Find out which watermark is breached if any */
wmark = get_lowest_watermark(&mi, &watermarks);

   if (cycle_after_kill && wmark < WMARK_LOW) {//cycle_after_kill 为true 表明此时还处于killing 状态，并且水位已经低于low 水位
        kill_reason = PRESSURE_AFTER_KILL;
        strncpy(kill_desc, "min watermark is breached even after kill", sizeof(kill_desc));
    } else if (level == VMPRESS_LEVEL_CRITICAL && events != 0) {//内存压力过大
        kill_reason = NOT_RESPONDING;
        do_multi_kill = low_ram_device ? true : false;
        strncpy(kill_desc, "device is not responding", sizeof(kill_desc));
    } else if (fast_kill_enabled) {
        kill_reason = DO_FAST_KILL;
        strncpy(kill_desc, "do fast kill", sizeof(kill_desc));
        min_score_adj = low_ram_device ? CACHED_APP_MIN_ADJ : PERCEPTIBLE_LOW_APP_ADJ;
        min_score_adj = swap_is_low ? PERCEPTIBLE_LOW_APP_ADJ : min_score_adj;
    } else if (swap_is_low && thrashing > thrashing_limit_pct) {//swap 空间已经超过底线，且内存抖动占比也超过限制
        /* Page cache is thrashing while swap is low */
        kill_reason = LOW_SWAP_AND_THRASHING;
        snprintf(kill_desc, sizeof(kill_desc), "device is low on swap (%" PRId64
            "kB < %" PRId64 "kB) and thrashing (%" PRId64 "%%)",
            mi.field.free_swap * page_k, swap_low_threshold * page_k, thrashing);
    } else if (swap_is_low && wmark < WMARK_HIGH) {//swap 空间已经超过底线，且处于低水位
        /* Both free memory and swap are low */
        kill_reason = LOW_MEM_AND_SWAP;
        snprintf(kill_desc, sizeof(kill_desc), "%s watermark is breached and swap is low (%"
            PRId64 "kB < %" PRId64 "kB)", wmark > WMARK_LOW ? "min" : "low",
            mi.field.free_swap * page_k, swap_low_threshold * page_k);
    } else if (wmark < WMARK_HIGH && thrashing > thrashing_limit) {//标记此时处于低水位并抖动状态异常
        /* Page cache is thrashing while memory is low */
        kill_reason = LOW_MEM_AND_THRASHING;
        snprintf(kill_desc, sizeof(kill_desc), "%s watermark is breached and thrashing (%"
            PRId64 "%%)", wmark > WMARK_LOW ? "min" : "low", thrashing);
        cut_thrashing_limit = true;
        /* Do not kill perceptible apps because of thrashing */
        min_score_adj = PERCEPTIBLE_APP_ADJ;
    } else if (reclaim == DIRECT_RECLAIM && thrashing > thrashing_limit) {//kswap 进入reclaim状态，并且抖动状态异常
        /* Page cache is thrashing while in direct reclaim (mostly happens on lowram devices) */
        kill_reason = DIRECT_RECL_AND_THRASHING;
        snprintf(kill_desc, sizeof(kill_desc), "device is in direct reclaim and thrashing (%"
            PRId64 "%%)", thrashing);
        cut_thrashing_limit = true;
        /* Do not kill perceptible apps because of thrashing */
        min_score_adj = PERCEPTIBLE_APP_ADJ;
    }

 if (other_free <= minfree && other_file <= minfree) {
            min_score_adj_adjust = lowmem_adj[0];
            strcat(kill_desc, ", adjust adj0.");
        } else if (other_free <= lowmem_minfree[1] && other_file <= lowmem_minfree[1]) {
            min_score_adj_adjust = lowmem_adj[1];
            strcat(kill_desc, ", adjust adj1.");
        }

        if (min_score_adj_adjust == -1 && !min_score_adj) {
            min_score_adj = VISIBLE_APP_ADJ;
            strcat(kill_desc, ", adjust critical adj.");
        } else if (min_score_adj_adjust != -1) {
            min_score_adj = min_score_adj_adjust;
        }

        if (do_multi_kill) {
            do_multi_kill = false;
            if (NOT_RESPONDING == kill_reason) {
                min_score_adj = swap_is_low ? 0 : min_score_adj;
                strcat(kill_desc, " <kill all processes above>");
                pages_freed = find_and_kill_multi_processes(min_score_adj, kill_desc, true);
            } else if (swap_is_low) {
                strcat(kill_desc, " <kill all processes above>");
                pages_freed = find_and_kill_multi_processes(min_score_adj, kill_desc, true);
            } else {
                strcat(kill_desc, " <kill group processes>");
                pages_freed = find_and_kill_multi_processes(min_score_adj, kill_desc, false);
            }
        } else if (fast_kill_enabled) {
            fast_kill_enabled = false;
            pages_freed = find_and_kill_multi_processes(min_score_adj, kill_desc, true);
        } else
            pages_freed = find_and_kill_process(min_score_adj, kill_desc);

@system\core\lmkd\lmkconfig.c
/* For CONFIG_LMKD_SKIP_PROCESS_LIST */
#define LMKD_PARAMETER_NAME             "/vendor/etc/lmkd_param.conf"

bool lmkd_config_skip_kill(char *task_name)
{
    PARAM_INFO param_info;
    int count = 0;
    int number = 0;

    memset(&param_info, 0, sizeof(param_info));
    if (get_param_info(&param_info, CONFIG_LMKD_SKIP_PROCESS_LIST) == true) {
        count = param_info.proc_count;
        while(count) {
            number = count - 1;
            if (!memcmp(param_info.proc_info[number].task_info, 
 task_name, strlen(param_info.proc_info[number].task_info) -1))
                return true;
                count --;
        }
    }
    return false;
}