Android 启动过程的底层实现

int main(int argc, char **argv)
{
    int fd_count = 0;
    struct pollfd ufds[4];
    char *tmpdev;
    char* debuggable;
    char tmp[32];
    int property_set_fd_init = 0;
    int signal_fd_init = 0;
    int keychord_fd_init = 0;
    //假设传入的argv[0]參数是ueventd,运行ueventd_main函数
    if (!strcmp(basename(argv[0]), "ueventd"))
        return ueventd_main(argc, argv);

    /* clear the umask */
    //假设是文件。文件权限为666，文件夹权限是777  
    umask(0);

        /* Get the basic filesystem setup we need put
         * together in the initramdisk on / and then we'll
         * let the rc file figure out the rest.
         */
   //创建文件夹并挂载
    mkdir("/dev", 0755);
    mkdir("/proc", 0755);
    mkdir("/sys", 0755);

    mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755");
    mkdir("/dev/pts", 0755);
    mkdir("/dev/socket", 0755);
    mount("devpts", "/dev/pts", "devpts", 0, NULL);
    mount("proc", "/proc", "proc", 0, NULL);
    mount("sysfs", "/sys", "sysfs", 0, NULL);

        /* indicate that booting is in progress to background fw loaders, etc */
    close(open("/dev/.booting", O_WRONLY | O_CREAT, 0000));

        /* We must have some place other than / to create the
         * device nodes for kmsg and null, otherwise we won't
         * be able to remount / read-only later on.
         * Now that tmpfs is mounted on /dev, we can actually
         * talk to the outside world.
         */
    open_devnull_stdio();
    //初始化日志系统
    klog_init();
     
    //解析init.rc配置文件(这个是重点分析的)
    INFO("reading config file\n");
    init_parse_config_file("/init.rc");

    /* pull the kernel commandline and ramdisk properties file in */
    import_kernel_cmdline(0, import_kernel_nv);
    /* don't expose the raw commandline to nonpriv processes */
    chmod("/proc/cmdline", 0440);
    //读取/proc/cpuinfo得到机器hardware名称
    get_hardware_name(hardware, &revision);
    snprintf(tmp, sizeof(tmp), "/init.%s.rc", hardware);
    //解析tmp 文件，也就是/init.<hardware>.rc文件 
    init_parse_config_file(tmp);
    
    //解析完上面两个rc文件之后得到非常多Action。
    //这里运行名称为early-init的Action
    action_for_each_trigger("early-init", action_add_queue_tail);

    //触发内置的Action。第一个參数是函数指针，第二个參数是action的名称
    queue_builtin_action(wait_for_coldboot_done_action, "wait_for_coldboot_done");
    queue_builtin_action(property_init_action, "property_init");
    queue_builtin_action(keychord_init_action, "keychord_init");
    queue_builtin_action(console_init_action, "console_init");
    queue_builtin_action(set_init_properties_action, "set_init_properties");

    // 运行名称为init的action
    /* execute all the boot actions to get us started */
    action_for_each_trigger("init", action_add_queue_tail);

    /* skip mounting filesystems in charger mode */
    //假设正在充电则运行以下的action
    if (strcmp(bootmode, "charger") != 0) {
        action_for_each_trigger("early-fs", action_add_queue_tail);
        action_for_each_trigger("fs", action_add_queue_tail);
        action_for_each_trigger("post-fs", action_add_queue_tail);
        action_for_each_trigger("post-fs-data", action_add_queue_tail);
    }
    //触发内置Action
    queue_builtin_action(property_service_init_action, "property_service_init");
    queue_builtin_action(signal_init_action, "signal_init");
    queue_builtin_action(check_startup_action, "check_startup");

    if (!strcmp(bootmode, "charger")) {
        action_for_each_trigger("charger", action_add_queue_tail);
    } else {
        action_for_each_trigger("early-boot", action_add_queue_tail);
        action_for_each_trigger("boot", action_add_queue_tail);
    }

        /* run all property triggers based on current state of the properties */
    queue_builtin_action(queue_property_triggers_action, "queue_propety_triggers");


#if BOOTCHART
    queue_builtin_action(bootchart_init_action, "bootchart_init");
#endif

//运行完上面初始化和触发action的过程之后进入一个死循环，运行Command
    for(;;) {
        int nr, i, timeout = -1;
       
        execute_one_command();
       //假设service异常退出，重新启动它   
        restart_processes();
       //监听来自property service事件，后面会介绍
        if (!property_set_fd_init && get_property_set_fd() > 0) {
            ufds[fd_count].fd = get_property_set_fd();
            ufds[fd_count].events = POLLIN;
            ufds[fd_count].revents = 0;
            fd_count++;
            property_set_fd_init = 1;
        }
        //监听来自signal事件 。signal是用来处理子进程退出时的操作，防止子进程编程僵尸进程

        if (!signal_fd_init && get_signal_fd() > 0) {
            ufds[fd_count].fd = get_signal_fd();
            ufds[fd_count].events = POLLIN;
            ufds[fd_count].revents = 0;
            fd_count++;
            signal_fd_init = 1;
        }
       //监听来自keychord设备事件  
        if (!keychord_fd_init && get_keychord_fd() > 0) {
            ufds[fd_count].fd = get_keychord_fd();
            ufds[fd_count].events = POLLIN;
            ufds[fd_count].revents = 0;
            fd_count++;
            keychord_fd_init = 1;
        }
         //假设异常终止的service重新启动，设置等待时间
        if (process_needs_restart) {
            timeout = (process_needs_restart - gettime()) * 1000;
            if (timeout < 0)
                timeout = 0;
        }

        if (!action_queue_empty() || cur_action)
            timeout = 0;

#if BOOTCHART
        if (bootchart_count > 0) {
            if (timeout < 0 || timeout > BOOTCHART_POLLING_MS)
                timeout = BOOTCHART_POLLING_MS;
            if (bootchart_step() < 0 || --bootchart_count == 0) {
                bootchart_finish();
                bootchart_count = 0;
            }
        }
#endif
        //多路监听设备
        nr = poll(ufds, fd_count, timeout);
        if (nr <= 0)
            continue;

        for (i = 0; i < fd_count; i++) {
            if (ufds[i].revents == POLLIN) {
                if (ufds[i].fd == get_property_set_fd())
                    handle_property_set_fd();//处理property service事件
                else if (ufds[i].fd == get_keychord_fd())
                    handle_keychord();//处理keychord事件 
                else if (ufds[i].fd == get_signal_fd())
                    handle_signal();//处理signal事件  
            }
        }
    }
    return 0;
}

#on用来声明这是一个Action。early-init是该Action的触发条件，也是它的名称
on early-init
    #运行命令 
    start ueventd
# create mountpoints
      #运行命令 
    mkdir /mnt 0775 root system

 //省略。
。。

#service声明是这是一个Service,servicemanager 是Service名称，/system/bin/servicemanager是程序地址
service servicemanager /system/bin/servicemanager
#class、user等都是option
    class core
    user system
    group system
    critical
    onrestart restart zygote
    onrestart restart media

service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
    class main
    socket zygote stream 666
    onrestart write /sys/android_power/request_state wake
    onrestart write /sys/power/state on
    onrestart restart media
    onrestart restart netd
 //....

on property:ro.debuggable=1
start console

    exec <path> [ <argument> ]*  执行路径为path的命令，參数是argument
    export <name> <value>    在全局环境变量中设在环境变量 <name>为<value>。
    ifup <interface>      启动网络接口<interface>
    import <filename>     解析一个init配置文件，扩展当前配置。
    hostname <name>      设置主机名。
    chmod <octal-mode> <path>     更改文件訪问权限。
    chown <owner> <group> <path>    更改文件的全部者和组。
    class_start <serviceclass>   启动全部指定服务类下的未执行服务。

    class_stop <serviceclass>   停止指定服务类下的全部已执行的服务。
    domainname <name>    设置域名。
    insmod <path>        载入<path>中的模块。

    mkdir <path> [mode] [owner] [group]    创建一个文件夹<path>，
    mount <type> <device> <dir> [ <mountoption> ]*   试图在文件夹<dir>挂载指定的设备
    setprop <name> <value>    设置系统属性 <name> 为 <value>值. 
    setrlimit <resource> <cur> <max>      设置<resource>的rlimit（资源限制）。
    start <service>   启动指定服务（假设此服务还未执行）。
    stop <service>    停止指定服务（假设此服务在执行中）。
    symlink <target> <path>      创建一个指向<path>的软连接<target>。
    sysclktz <mins_west_of_gmt>    设置系统时钟基准（0代表时钟滴答以格林威治平均时（GMT）为准）
    trigger <event>      触发一个事件。
    write <path> <string> [ <string> ]*      打开路径为<path>的一个文件，并写入一个或多个字符串。

service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
    class main
    socket zygote stream 666
    onrestart write /sys/android_power/request_state wake
    onrestart write /sys/power/state on
    onrestart restart media
    onrestart restart netd

     critical： 说明这是一个对于设备关键的服务。假设一定时间退出多次，系统将会重新启动并进入recovery（恢复）模式。

     disabled：说明这个服务禁用，不会自己主动启动此服务。可是能够手动启动。
     setenv <name> <value> :环境变量设置       在进程启动时将环境变量<name>设置为<value>。

     socket <name> <type> <perm> [ <user> [ <group> ] ]     创建一个Uinx域的名为/dev/socket/<name> 的套接字，并传递它的文件描写叙述符给已启动的进程。<type> 必须是 "dgram"或"stream"。User 和 group默觉得0。

     user <username>    在启动这个服务前改变切换到用户username，此时默觉得root。

     group <groupname> [ <groupname> ]*  在启动这个服务前改变切换到用户组username，此时默觉得root。 
     oneshot:仅仅启动一次。一旦关闭就不再重新启动
     class <name> 指定一个服务类别。全部同一类的服务能够同一时候启动和停止。默觉得"default"类服务。
     onrestart <Command>       当服务重新启动，运行一个命令

int init_parse_config_file(const char *fn)
{
    char *data;
     //读取配置文件
    data = read_file(fn, 0);
    if (!data) return -1;
     //重点是这个函数。解析配置文件
    parse_config(fn, data);
    DUMP();
    return 0;
}

static void parse_config(const char *fn, char *s)
{
    struct parse_state state;//保存解析状态
    char *args[INIT_PARSER_MAXARGS];//存储參数
    int nargs;//參数个数

    nargs = 0;
    state.filename = fn;//解析得文件路径
    state.line = 0;//当前解析的行号
    state.ptr = s;//当前解析的内容
    state.nexttoken = 0;//当前解析是那种类型的行。有文件结束T_EOF,新的一行T_NEWLINE,參数T_TEXT
    state.parse_line = parse_line_no_op;//parse_line_no_op是空操作
    for (;;) {
        switch (next_token(&state)) {
        case T_EOF://文件结束
            state.parse_line(&state, 0, 0);
            return;
        case T_NEWLINE://新的一行
            state.line++;
            if (nargs) {
                int kw = lookup_keyword(args[0]);//是哪一个keyword
                if (kw_is(kw, SECTION)) {//假设该keyword是section 
                    state.parse_line(&state, 0, 0);
                    parse_new_section(&state, kw, nargs, args);//在这里才真正開始開始解析Section
                } else {
                    state.parse_line(&state, nargs, args);
                }
                nargs = 0;
            }
            break;
        case T_TEXT:
            if (nargs < INIT_PARSER_MAXARGS) {
                args[nargs++] = state.text;
            }
            break;
        }
    }
}

void parse_new_section(struct parse_state *state, int kw,int nargs, char **args)
{
    printf("[ %s %s ]\n", args[0],nargs > 1 ? args[1] : "");
    switch(kw) {
    case K_service://假设是Service的Section，開始解析Service
        state->context = parse_service(state, nargs, args);//保存调用过parse_service的service 
        if (state->context) {
            state->parse_line = parse_line_service;//parse_line_service 才是真正的解析并填充Service函数
            return;
        }
        break;
    case K_on://假设是Action的Section。開始解析Action 
        state->context = parse_action(state, nargs, args);//保存调用过parse_action的action
        if (state->context) {
            state->parse_line = parse_line_action;//parse_line_action才是真正的解析并填充Action函数 
            return;
        }
        break;
    case K_import:
        if (nargs != 2) {
            ERROR("single argument needed for import\n");
        } else {
            int ret = init_parse_config_file(args[1]);
            if (ret)
                ERROR("could not import file %s\n", args[1]);
        }
    }
    state->parse_line = parse_line_no_op;
}

struct service {
        /* list of all services */
//用于将结构体连接成一个双向链表。init中有一个全局变量service_list,专门保存解析后的service
   struct listnode slist;//用于将结构体连接成一个双向链表，init中有一个全局变量

    const char *name;//名称
    const char *classname;//classname，默认是default
    unsigned flags;//属性标志
    pid_t pid;//进程号
    time_t time_started;    /* time of last start 上次启动时间   */
    time_t time_crashed;    /* first crash within inspection window 上次异常退出时间 */
    int nr_crashed;         /* number of times crashed within window  异常退出次数*/
    
    uid_t uid;//用户id
    gid_t gid;//用户组id
    gid_t supp_gids[NR_SVC_SUPP_GIDS];
    size_t nr_supp_gids;
    //service使用的socket
    struct socketinfo *sockets;
    //service环境变量
    struct svcenvinfo *envvars;
    //service中的onrestart是一个option，可是它后面是一系列的command，能够看做是一个action
    struct action onrestart;  /* Actions to execute on restart. */
    
    /* keycodes for triggering this service via /dev/keychord */
     //和keychord有关的
    int *keycodes;
    int nkeycodes;
    int keychord_id;
     //io优先级
    int ioprio_class;
    int ioprio_pri;
    //參数个数
    int nargs;
    /* "MUST BE AT THE END OF THE STRUCT" */
    //參数列表
    char *args[1];
}

struct listnode
{
     struct listnode * next;
     struct listnode * prev;
 };

void list_init(struct listnode *node)
{
    node->next = node;
    node->prev = node;
}

void list_add_tail(struct listnode *head, struct listnode *item)
{
    item->next = head;
    item->prev = head->prev;
    head->prev->next = item;
    head->prev = item;
}

static void *parse_service(struct parse_state *state, int nargs, char **args)
{
    struct service *svc;//定义的service结构体，用来保存解析出来的service
     //异常处理代码
    if (nargs < 3) {
        parse_error(state, "services must have a name and a program\n");
        return 0;
    }
    if (!valid_name(args[1])) {
        parse_error(state, "invalid service name '%s'\n", args[1]);
        return 0;
    }

    svc = service_find_by_name(args[1]);
    if (svc) {
        parse_error(state, "ignored duplicate definition of service '%s'\n", args[1]);
        return 0;
    }

    nargs -= 2;
    svc = calloc(1, sizeof(*svc) + sizeof(char*) * nargs);//为Service分配内存空间
    if (!svc) {
        parse_error(state, "out of memory\n");
        return 0;
    }
    为svc结构体填充数据赋值
    svc->name = args[1];
    svc->classname = "default";//默觉得default类比
    memcpy(svc->args, args + 2, sizeof(char*) * nargs);
    svc->args[nargs] = 0;
    svc->nargs = nargs;
    svc->onrestart.name = "onrestart";
    //Service中的onrestart 是Action类型的链表。初始化该链表
    list_init(&svc->onrestart.commands);
    //将service中的slist增加到service_list 中
    list_add_tail(&service_list, &svc->slist);
    return svc;
}

static void parse_line_service(struct parse_state *state, int nargs, char **args)
{
    struct service *svc = state->context;//取出刚才创建的service
    struct command *cmd;
    int i, kw, kw_nargs;

    if (nargs == 0) {
        return;
    }

    svc->ioprio_class = IoSchedClass_NONE;//设置IO优先级

    kw = lookup_keyword(args[0]);//配置service中的option关键字
    switch (kw) {
     //......  
    case K_onrestart://处理onrestart选项
        nargs--;
        args++;
        kw = lookup_keyword(args[0]);
        if (!kw_is(kw, COMMAND)) {//假设onrestart 选项后面不是command 提示错误
            parse_error(state, "invalid command '%s'\n", args[0]);
            break;
        }
        kw_nargs = kw_nargs(kw);
        if (nargs < kw_nargs) {
            parse_error(state, "%s requires %d %s\n", args[0], kw_nargs - 1,
                kw_nargs > 2 ? "arguments" : "argument");
            break;
        }
        //service中onrestart  option的command序列创建过程
        cmd = malloc(sizeof(*cmd) + sizeof(char*) * nargs);
        cmd->func = kw_func(kw);
        cmd->nargs = nargs;
        memcpy(cmd->args, args, sizeof(char*) * nargs);
        list_add_tail(&svc->onrestart.commands, &cmd->clist);
        break;
    case K_critical:
        svc->flags |= SVC_CRITICAL;
        break;
    case K_setenv: { /* name value */
        struct svcenvinfo *ei;
        if (nargs < 2) {
            parse_error(state, "setenv option requires name and value arguments\n");
            break;
        }
        ei = calloc(1, sizeof(*ei));
        if (!ei) {
            parse_error(state, "out of memory\n");
            break;
        }
        ei->name = args[1];
        ei->value = args[2];
        ei->next = svc->envvars;
        svc->envvars = ei;
        break;
    }

    //假设须要创建socket
    case K_socket: {/* name type perm [ uid gid ] */
        struct socketinfo *si;
        if (nargs < 4) {
            parse_error(state, "socket option requires name, type, perm arguments\n");
            break;
        }
        if (strcmp(args[2],"dgram") && strcmp(args[2],"stream")
                && strcmp(args[2],"seqpacket")) {
            parse_error(state, "socket type must be 'dgram', 'stream' or 'seqpacket'\n");
            break;
        }
        si = calloc(1, sizeof(*si));
        if (!si) {
            parse_error(state, "out of memory\n");
            break;
        }
        si->name = args[1];
        si->type = args[2];
        si->perm = strtoul(args[3], 0, 8);
        if (nargs > 4)
            si->uid = decode_uid(args[4]);
        if (nargs > 5)
            si->gid = decode_uid(args[5]);
        si->next = svc->sockets;
        svc->sockets = si;
        break;
    }
    ...
    default:
        parse_error(state, "invalid option '%s'\n", args[0]);
    }
}

struct action {
        /* node in list of all actions */
    struct listnode alist;//用来存储全部的Action指针
        /* node in the queue of pending actions */
    struct listnode qlist;//用来存储即将运行的Action指针
        /* node in list of actions for a trigger */
    struct listnode tlist;//用来存储等待触发的Action节点

    unsigned hash;
    const char *name;//Action的名称
   
    struct listnode commands;//Action中的command命令 
    struct command *current;
};

struct command
{
        /* list of commands in an action */
    struct listnode clist;//一个Action中的command队列
    int (*func)(int nargs, char **args);//command相应的函数指针
    int nargs;//函数參数个数
    char *args[1];//函数參数
};

static void *parse_action(struct parse_state *state, int nargs, char **args)
{
    struct action *act;
    if (nargs < 2) {
        parse_error(state, "actions must have a trigger\n");
        return 0;
    }
    if (nargs > 2) {
        parse_error(state, "actions may not have extra parameters\n");
        return 0;
    }
    act = calloc(1, sizeof(*act));//为action结构体分配内存
    act->name = args[1];//填充action的名称
    list_init(&act->commands);//初始化action中的command指针队列
    list_add_tail(&action_list, &act->alist);//将Action指针存放在action_list队列中
        /* XXX add to hash */
    return act;
}

static void parse_line_action(struct parse_state* state, int nargs, char **args)
{
    struct command *cmd;
    struct action *act = state->context;//action的引用
    int (*func)(int nargs, char **args);
    int kw, n;

    if (nargs == 0) {
        return;
    }

    kw = lookup_keyword(args[0]);
    if (!kw_is(kw, COMMAND)) {//匹配是否是Command，假设不是。提示错误
        parse_error(state, "invalid command '%s'\n", args[0]);
        return;
    }

    n = kw_nargs(kw);
    if (nargs < n) {
        parse_error(state, "%s requires %d %s\n", args[0], n - 1,
            n > 2 ? "arguments" : "argument");
        return;
    }
    cmd = malloc(sizeof(*cmd) + sizeof(char*) * nargs);//为Command分配内存
    cmd->func = kw_func(kw);//获取command相应的函数指针
    cmd->nargs = nargs;
    memcpy(cmd->args, args, sizeof(char*) * nargs);
    list_add_tail(&act->commands, &cmd->clist);//command增加到action的command列表
}

//这里触发名称为early-init的Action
    action_for_each_trigger("early-init", action_add_queue_tail);

    //触发内置的Action。第一个參数是函数指针。第二个參数是action的名称
    queue_builtin_action(wait_for_coldboot_done_action, "wait_for_coldboot_done");
    queue_builtin_action(property_init_action, "property_init");
    queue_builtin_action(keychord_init_action, "keychord_init");
    queue_builtin_action(console_init_action, "console_init");
    queue_builtin_action(set_init_properties_action, "set_init_properties");

void action_for_each_trigger(const char *trigger,void (*func)(struct action *act))
{
    struct listnode *node;
    struct action *act;
    list_for_each(node, &action_list) {//实际就是遍历action_list
        act = node_to_item(node, struct action, alist);
        if (!strcmp(act->name, trigger)) {
            func(act);
        }
    }
}

#define list_for_each(node, list)     for (node = (list)->next; node != (list); node = node->next)

#define node_to_item(node, container, member)     (container *) (((char*) (node)) - offsetof(container, member))

void action_add_queue_tail(struct action *act)
{   //将action中的qlist增加到action_queue中，当中qlist是中即将运行的action 。
    list_add_tail(&action_queue, &act->qlist);
}

void queue_builtin_action(int (*func)(int nargs, char **args), char *name)
{
    struct action *act;
    struct command *cmd;

    act = calloc(1, sizeof(*act));//action分配内存
    act->name = name;//设置action名称
    list_init(&act->commands);//初始化action的command链表

    cmd = calloc(1, sizeof(*cmd));//为链表分配内存
    cmd->func = func;//填充函数运行
    cmd->args[0] = name;//填充函数名称
    list_add_tail(&act->commands, &cmd->clist);//将command的clist增加到action的command链表中

    list_add_tail(&action_list, &act->alist);//将action的alist增加到action_list 链表中
    action_add_queue_tail(act);也是调用action_add_queue_tail。将创建的action增加到action_queue 链表中
}

  for(;;) {
        ....      
        execute_one_command();//就是这里启动了解析的action
       //假设service异常退出。重新启动它   
        restart_processes();
     ...
}

void execute_one_command(void)
{
    int ret;
     //取出action中的command，运行action就是运行command
    if (!cur_action || !cur_command || is_last_command(cur_action, cur_command)) {
        cur_action = action_remove_queue_head();
        cur_command = NULL;
        if (!cur_action)
            return;
        INFO("processing action %p (%s)\n", cur_action, cur_action->name);
        cur_command = get_first_command(cur_action);
    } else {
        cur_command = get_next_command(cur_action, cur_command);
    }

    if (!cur_command)
        return;
     //调用command中的func函数
    ret = cur_command->func(cur_command->nargs, cur_command->args);
    INFO("command '%s' r=%d\n", cur_command->args[0], ret);
}

on early-init 
     write /proc/1/oom_adj -16
     start ueventd

int do_write(int nargs, char **args)
{
    const char *path = args[1];
    const char *value = args[2];
   ...
    //调用库函数write_file，想 /proc/1/oom_adj 文件里写入16
    return write_file(path, value);
}

int do_start(int nargs, char **args)
{
    struct service *svc;
    //找到servicename是ueventd  的service
    svc = service_find_by_name(args[1]);
    if (svc) {
       //调用service_start 函数
        service_start(svc, NULL);
    }
    return 0;
}

void service_start(struct service *svc, const char *dynamic_args)
{
    struct stat s;
    pid_t pid;
    int needs_console;
    int n;

        /* starting a service removes it from the disabled or reset
         * state and immediately takes it out of the restarting
         * state if it was in there
         */
    svc->flags &= (~(SVC_DISABLED|SVC_RESTARTING|SVC_RESET));
    svc->time_started = 0;

        /* running processes require no additional work -- if
         * they're in the process of exiting, we've ensured
         * that they will immediately restart on exit, unless
         * they are ONESHOT
         */
    if (svc->flags & SVC_RUNNING) {
        return;
    }

    needs_console = (svc->flags & SVC_CONSOLE) ? 1 : 0;
   .... 
    //创建子进程
    pid = fork();

    if (pid == 0) {
        struct socketinfo *si;
        struct svcenvinfo *ei;
        char tmp[32];
        int fd, sz;
       
        //将属性信息增加到环境变量
        if (properties_inited()) {
            get_property_workspace(&fd, &sz);
            sprintf(tmp, "%d,%d", dup(fd), sz);
            add_environment("ANDROID_PROPERTY_WORKSPACE", tmp);
        }

        for (ei = svc->envvars; ei; ei = ei->next)
            add_environment(ei->name, ei->value);

        for (si = svc->sockets; si; si = si->next) {
            int socket_type = (
                    !strcmp(si->type, "stream") ?
 SOCK_STREAM :
                        (!strcmp(si->type, "dgram") ? SOCK_DGRAM : SOCK_SEQPACKET));
           //创建socket
            int s = create_socket(si->name, socket_type,
                                  si->perm, si->uid, si->gid);
            if (s >= 0) {
                publish_socket(si->name, s);
            }
        }

        if (svc->ioprio_class != IoSchedClass_NONE) {
            if (android_set_ioprio(getpid(), svc->ioprio_class, svc->ioprio_pri)) {
                ERROR("Failed to set pid %d ioprio = %d,%d: %s\n",
                      getpid(), svc->ioprio_class, svc->ioprio_pri, strerror(errno));
            }
        }
    //pid<0说明创建子进程失败，没有启动服务
    if (pid < 0) {
        ERROR("failed to start '%s'\n", svc->name);
        svc->pid = 0;
        return;
    }
    
    //再设置service的启动信息
    svc->time_started = gettime();//service的启动时间
    svc->pid = pid;//service的进程id
    svc->flags |= SVC_RUNNING;//service的状态

    if (properties_inited())
         //更新状态
        notify_service_state(svc->name, "running");
}

static void service_start_if_not_disabled(struct service *svc)
{
    if (!(svc->flags & SVC_DISABLED)) {
        service_start(svc, NULL);//调用了service_start函数
    }
}

int do_class_start(int nargs, char **args)
{
        /* Starting a class does not start services
         * which are explicitly disabled.  They must
         * be started individually.
         */
     
    service_for_each_class(args[1], service_start_if_not_disabled);
    return 0;
}

on boot
# basic network init
  
# set RLIMIT_NICE to allow priorities from 19 to -20
   ...

# Memory management.  Basic kernel parameters, and allow the high
# level system server to be able to adjust the kernel OOM driver
# paramters to match how it is managing things.
  ...
# Define TCP buffer sizes for various networks
#   ReadMin, ReadInitial, ReadMax, WriteMin, WriteInitial, WriteMax,
  ...

# Set this property so surfaceflinger is not started by system_init
   ...
    class_start core
    class_start main

service servicemanager /system/bin/servicemanager
    class core
   ...
service vold /system/bin/vold
    class core
    ...
service netd /system/bin/netd
    class main
   ...
service debuggerd /system/bin/debuggerd
    class main

service ril-daemon /system/bin/rild
    class main
   ...
service surfaceflinger /system/bin/surfaceflinger
    class main
     ...
service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
    class main
   ...
service drm /system/bin/drmserver
    class main
   ...
service media /system/bin/mediaserver
    class main
  ...
service bootanim /system/bin/bootanimation
    class main
    ...
service dbus /system/bin/dbus-daemon --system --nofork
    class main
   ...
service installd /system/bin/installd
    class main
  ...
service flash_recovery /system/etc/install-recovery.sh
    class main
     ...
service keystore /system/bin/keystore /data/misc/keystore
    class main
     ...

 if (!strcmp(bootmode, "charger")) {
        action_for_each_trigger("charger", action_add_queue_tail);
    } else {
        action_for_each_trigger("early-boot", action_add_queue_tail);
        action_for_each_trigger("boot", action_add_queue_tail);
    }

queue_builtin_action(property_init_action, "property_init");
queue_builtin_action(property_service_init_action, "property_service_init");

static int property_init_action(int nargs, char **args)
{
    bool load_defaults = true;

    INFO("property init\n");
    if (!strcmp(bootmode, "charger"))
        load_defaults = false;
    property_init(load_defaults);
    return 0;
}

void property_init(bool load_defaults)
{
    init_property_area();//初始化存储区域
    if (load_defaults)
        load_properties_from_file(PROP_PATH_RAMDISK_DEFAULT);//载入配置文件
}

static int property_service_init_action(int nargs, char **args)
{
    /* read any property files on system or data and
     * fire up the property service.  This must happen
     * after the ro.foo properties are set above so
     * that /data/local.prop cannot interfere with them.
     */
    start_property_service();
    return 0;
}

void start_property_service(void)
{
    int fd;
    //载入其它配置文件
    load_properties_from_file(PROP_PATH_SYSTEM_BUILD);
    load_properties_from_file(PROP_PATH_SYSTEM_DEFAULT);
    load_properties_from_file(PROP_PATH_LOCAL_OVERRIDE);
    /* Read persistent properties after all default values have been loaded. */
    load_persistent_properties();
    //创建一个socket等待client请求
    fd = create_socket(PROP_SERVICE_NAME, SOCK_STREAM, 0666, 0, 0);
    if(fd < 0) return;
    fcntl(fd, F_SETFD, FD_CLOEXEC);
    fcntl(fd, F_SETFL, O_NONBLOCK);
    //监听fd的连接请求。最大请求个数是8
    listen(fd, 8);
    property_set_fd = fd;
}

int property_set(const char *key, const char *value){
    return __system_property_set(key, value);
}

int __system_property_set(const char *key, const char *value)
{
    int err;
    int tries = 0;
    int update_seen = 0;
    prop_msg msg;
     ..
    通过send_prop_msg 函数来他发送消息
    err = send_prop_msg(&msg);
    if(err < 0) {
        return err;
    }
    return 0;
}

static int send_prop_msg(prop_msg *msg)
{
    struct pollfd pollfds[1];
    struct sockaddr_un addr;
    socklen_t alen;
    size_t namelen;
    int s;
    int r;
    int result = -1;
     //创建socket
    s = socket(AF_LOCAL, SOCK_STREAM, 0);
    if(s < 0) {
        return result;
    }
   //为socket设置数据
    memset(&addr, 0, sizeof(addr));
    namelen = strlen(property_service_socket);
    strlcpy(addr.sun_path, property_service_socket, sizeof addr.sun_path);
    addr.sun_family = AF_LOCAL;
    alen = namelen + offsetof(struct sockaddr_un, sun_path) + 1;
    //连接socket
    if(TEMP_FAILURE_RETRY(connect(s, (struct sockaddr *) &addr, alen) < 0)) {
        close(s);
        return result;
    }
   //发送消息
    r = TEMP_FAILURE_RETRY(send(s, msg, sizeof(prop_msg), 0));

    if(r == sizeof(prop_msg)) {
        // We successfully wrote to the property server but now we
        // wait for the property server to finish its work.  It
        // acknowledges its completion by closing the socket so we
        // poll here (on nothing), waiting for the socket to close.
        // If you 'adb shell setprop foo bar' you'll see the POLLHUP
        // once the socket closes.  Out of paranoia we cap our poll
        // at 250 ms.
        pollfds[0].fd = s;
        pollfds[0].events = 0;
        r = TEMP_FAILURE_RETRY(poll(pollfds, 1, 250 /* ms */));
        if (r == 1 && (pollfds[0].revents & POLLHUP) != 0) {
            result = 0;
        } else {
            // Ignore the timeout and treat it like a success anyway.
            // The init process is single-threaded and its property
            // service is sometimes slow to respond (perhaps it's off
            // starting a child process or something) and thus this
            // times out and the caller thinks it failed, even though
            // it's still getting around to it.  So we fake it here,
            // mostly for ctl.* properties, but we do try and wait 250
            // ms so callers who do read-after-write can reliably see
            // what they've written.  Most of the time.
            // TODO: fix the system properties design.
            result = 0;
        }
    }

    close(s);
    return result;
}

for(;;) {
        int nr, i, timeout = -1;

        execute_one_command();
        restart_processes();

       //指定了三类事件的监听get_property_set_fd、get_signal_fd、get_keychord_fd
       // 这就是监听来自client请求属性服务的信号  
        if (!property_set_fd_init && get_property_set_fd() > 0) {
            ufds[fd_count].fd = get_property_set_fd();
            ufds[fd_count].events = POLLIN;
            ufds[fd_count].revents = 0;
            fd_count++;
            property_set_fd_init = 1;
        }
       //子进程退出时的信号,能够回收子进程资源或者重新启动子进程 
        if (!signal_fd_init && get_signal_fd() > 0) {
            ufds[fd_count].fd = get_signal_fd();
            ufds[fd_count].events = POLLIN;
            ufds[fd_count].revents = 0;
            fd_count++;
            signal_fd_init = 1;
        }
       //keychord 信号
        if (!keychord_fd_init && get_keychord_fd() > 0) {
            ufds[fd_count].fd = get_keychord_fd();
            ufds[fd_count].events = POLLIN;
            ufds[fd_count].revents = 0;
            fd_count++;
            keychord_fd_init = 1;
        }

        if (process_needs_restart) {
            timeout = (process_needs_restart - gettime()) * 1000;
            if (timeout < 0)
                timeout = 0;
        }

        if (!action_queue_empty() || cur_action)
            timeout = 0;
      ...
        //使用poll系统调用监听上述三类事件的信号
        nr = poll(ufds, fd_count, timeout);
        if (nr <= 0)
            continue;

        for (i = 0; i < fd_count; i++) {
            if (ufds[i].revents == POLLIN) {
                if (ufds[i].fd == get_property_set_fd())
                    //属性服务信号处理函数
                    handle_property_set_fd();
                else if (ufds[i].fd == get_keychord_fd())
                    //keychord信号处理函数 
                    handle_keychord();
                else if (ufds[i].fd == get_signal_fd())
                     //子进程退出信号处理函数  
                    handle_signal();
            }
        }
    }