最近调试zygote进程的镜像恢复，发现重新设置系统语言或情景模式后，再开机不起作用。经调试发现是用get_property的到的值与实际文件中的值不符。
只能分析下property的过程。
在Android开机后的init.c的主要工作：
queue_builtin_action(property_init_action, "property_init");
queue_builtin_action(set_init_properties_action, "set_init_properties");
queue_builtin_action(property_service_init_action, "property_service_init");
queue_builtin_action(queue_property_triggers_action, "queue_propety_triggers");
上面是几个跟property相关的初始化动作加入队列中，
接着在init.c里for循环里有下面的代码
int property_set_fd_init = 0;
。。。
for(;;) {
execute_one_command();
。。。
if (!property_set_fd_init && get_property_set_fd() > 0) {
ufds[fd_count].fd = get_property_set_fd();
ufds[fd_count].events = POLLIN;
ufds[fd_count].revents = 0;
fd_count++;
property_set_fd_init = 1;
}
。。。
for (i = 0; i < fd_count; i++) {
if (ufds[i].revents == POLLIN) {
if (ufds[i].fd == get_property_set_fd())
handle_property_set_fd();
else 。。。。
}
}
}
在这个for循环里会用execute_one_command();去执行队列中的代码，可以看到会去执行上面已经提到的这几个。
queue_builtin_action(property_init_action, "property_init");
queue_builtin_action(set_init_properties_action, "set_init_properties");
queue_builtin_action(property_service_init_action, "property_service_init");
queue_builtin_action(queue_property_triggers_action, "queue_propety_triggers");
其实是依次执行
property_init_action
set_init_properties_action
property_service_init_action
queue_property_triggers_action
并且当get_property_set_fd条件满足(property_service_init_action被执行)后，会去处理handle_property_set_fd()，也就是init最后充当ufds[]里那几个句柄的server
现在来逐步分析
A. property_init_action
里面调的是property_service.c里的
property_init
init_property_area
load_properties_from_file(“/default.prop”);
其中init_property_area是初始化一块内存，
load _properties_from_file则读取一些默认的属性
init_property_area初始化一块内存进行共享，而load_properties_from_file则读取一些默认的属性。
init_property_area里
static int init_property_area(void)
{
prop_area *pa;
if(pa_info_array)
return -1;
if(init_workspace(&pa_workspace, PA_SIZE))//PA_SIZE = 32168
return -1;
fcntl(pa_workspace.fd, F_SETFD, FD_CLOEXEC);
pa_info_array = (void*) (((char*) pa_workspace.data) + PA_INFO_START);//PA_INFO_START = 1024
pa = pa_workspace.data;
memset(pa, 0, PA_SIZE);
pa->magic = PROP_AREA_MAGIC;
pa->version = PROP_AREA_VERSION;
/* plug into the lib property services */
__system_property_area__ = pa;
property_area_inited = 1;
return 0;
}
可以看到init_workspace()后，将__system_property_area__作为prop_area,以后属性就从内存中读取了。出错的关键肯定是init_workspace里做了文件映射到内存的动作，导致镜像恢复后内存和文件中的内容不符合
static int init_workspace(workspace *w, size_t size)
{
void *data;
int fd;
/* dev is a tmpfs that we can use to carve a shared workspace
* out of, so let's do that...
*/
fd = open("/dev/__properties__", O_RDWR | O_CREAT, 0600);
if (fd < 0)
return -1;
if (ftruncate(fd, size) < 0)
goto out;
data = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
if(data == MAP_FAILED)
goto out;
close(fd);
fd = open("/dev/__properties__", O_RDONLY);
if (fd < 0)
return -1;
unlink("/dev/__properties__");
w->data = data;
w->size = size;
w->fd = fd;
return 0;
out:
close(fd);
return -1;
}
果然init_workspace里有mmap的动作，但是这个是init进程的，怎么传递给zygote进程的呢？带会儿再注意下。
unlink("/dev/__properties__")会删除文件。如果该文件名为最后连接点，但有其他进程打开了此文件，则在所有关于此文件的描述符皆关闭后才会删除。如果参数/dev/__properties__为一符号连接，则此连接会被删除,在本函数中返回0的时候不会被删除
init_property_area()完成之后，就会调用load_properties_from_file(PROP_PATH_RAMDISK_DEFAULT);//"/default.prop"装载默认的属性值
static void load_properties_from_file(const char *fn)
{
char *data;
unsigned sz;
data = read_file(fn, &sz);
if(data != 0) {
load_properties(data);
free(data);
}
}看看default.prop中的内容： cat /dafult.prope
persist.msms.phone_count=1
ro.secure=0
ro.allow.mock.location=1
ro.debuggable=1
persist.service.adb.enable=1
先用read_file读出来，然后用load_properties加载属性，恢复zygote进程镜像后是否可以用load_properties重新加载一次呢,
难点是不确定哪些文件改动了要重新记载。
static void load_properties(char *data)
{
char *key, *value, *eol, *sol, *tmp;
sol = data;
while((eol = strchr(sol, '\n'))) {
key = sol;
*eol++ = 0;
sol = eol;
value = strchr(key, '=');
if(value == 0) continue;
*value++ = 0;
while(isspace(*key)) key++;
if(*key == '#') continue;
tmp = value - 2;
while((tmp > key) && isspace(*tmp)) *tmp-- = 0;
while(isspace(*value)) value++;
tmp = eol - 2;
while((tmp > value) && isspace(*tmp)) *tmp-- = 0;
property_set(key, value);
}
}上面的property_set调的是本文件property_service.c中的property_set，而不是libcutils中Properties.c中的property_setint property_set(const char *name, const char *value)
{
prop_area *pa;
prop_info *pi;
int namelen = strlen(name);
int valuelen = strlen(value);
if(namelen >= PROP_NAME_MAX) return -1;
if(valuelen >= PROP_VALUE_MAX) return -1;
if(namelen < 1) return -1;
pi = (prop_info*) __system_property_find(name);
if(pi != 0) {
/* ro.* properties may NEVER be modified once set */
if(!strncmp(name, "ro.", 3) &&
!(!strncmp(name+3, "hisense", 7) || !strncmp(name+3, "mbbms", 5) || !strncmp(name+3, "bootmode", 8))) return -1;
pa = __system_property_area__;
update_prop_info(pi, value, valuelen);
pa->serial++;
__futex_wake(&pa->serial, INT32_MAX);
} else {
pa = __system_property_area__;
if(pa->count == PA_COUNT_MAX) return -1;
pi = pa_info_array + pa->count;
pi->serial = (valuelen << 24);
memcpy(pi->name, name, namelen + 1);
memcpy(pi->value, value, valuelen + 1);
pa->toc[pa->count] =
(namelen << 24) | (((unsigned) pi) - ((unsigned) pa));
pa->count++;
pa->serial++;
__futex_wake(&pa->serial, INT32_MAX);
}
/* If name starts with "net." treat as a DNS property. */
if (strncmp("net.", name, strlen("net.")) == 0) {
if (strcmp("net.change", name) == 0) {
return 0;
}
/*
* The 'net.change' property is a special property used track when any
* 'net.*' property name is updated. It is _ONLY_ updated here. Its value
* contains the last updated 'net.*' property.
*/
property_set("net.change", name);
} else if (persistent_properties_loaded &&
strncmp("persist.", name, strlen("persist.")) == 0) {
/*
* Don't write properties to disk until after we have read all default properties
* to prevent them from being overwritten by default values.
*/
write_persistent_property(name, value);
}
property_changed(name, value);
return 0;
}
对于是persist.的，则调write_persistent_property()写入文件中，所以问题就出在这里，文件被更改，如果zygote从镜像恢复，zygote内存中的属性没有体现实际文件中的内容。
但是这里的疑问是zygote进程是着怎么把__system_property_area__作了镜像的，因为目前看到的都是init进程做property的操作，和zygote进程是怎么联系上的呢？
这里想到一个做法：当有write_persistent_property的时候，把保存的zygote进程镜像删除，重新做镜像。
将其以独立文件的形式保存到data/property目录中，接着调用property_changed通知属性已经改变，是否有相应的action操作
查找以”property:“打头的action，如果相应action需要的条件成立，则调用action_add_queue_tail触发相应的action我们可以看一下init.rc中与property有关的action
static void write_persistent_property(const char *name, const char *value)
{
const char *tempPath = PERSISTENT_PROPERTY_DIR "/.temp";
char path[PATH_MAX];
int fd, length;
snprintf(path, sizeof(path), "%s/%s", PERSISTENT_PROPERTY_DIR, name);
fd = open(tempPath, O_WRONLY|O_CREAT|O_TRUNC, 0600);
if (fd < 0) {
ERROR("Unable to write persistent property to temp file %s errno: %d\n", tempPath, errno);
return;
}
write(fd, value, strlen(value));
close(fd);
if (rename(tempPath, path)) {
unlink(tempPath);
ERROR("Unable to rename persistent property file %s to %s\n", tempPath, path);
}
}
B. set_init_properties_action
设置一些属性
static int set_init_properties_action(int nargs, char **args)
{
char tmp[PROP_VALUE_MAX];
if (qemu[0])
import_kernel_cmdline(1);
if (calibration[0]) {
PRINT("###: set ro.calibration 1.\n");
property_set("ro.calibration", "1");
}
else {
PRINT("###: set ro.calibration 0.\n");
property_set("ro.calibration", "0");
}
/* In fastsleep mode. */
if (!strcmp(bootmode,"fastsleep")) {
PRINT("###: fastsleep mode.\n");
PRINT("###: fastsleep mode.\n");
PRINT("###: fastsleep mode.\n");
property_set("ro.fastsleep", "1");
fastsleep_enable = 1;
}
if (!strcmp(bootmode,"factory"))
property_set("ro.factorytest", "1");
else if (!strcmp(bootmode,"factory2"))
property_set("ro.factorytest", "2");
else
property_set("ro.factorytest", "0");
property_set("ro.serialno", serialno[0] ? serialno : "");
property_set("ro.bootmode", bootmode[0] ? bootmode : "unknown");
property_set("ro.baseband", baseband[0] ? baseband : "unknown");
property_set("ro.carrier", carrier[0] ? carrier : "unknown");
property_set("ro.bootloader", bootloader[0] ? bootloader : "unknown");
property_set("ro.hardware", hardware);
snprintf(tmp, PROP_VALUE_MAX, "%d", revision);
property_set("ro.revision", tmp);
return 0;
}
C. property_service_init_action
static int property_service_init_action(int nargs, char **args)
{
/* read any property files on system or data and
* fire up the property service. This must happen
* after the ro.foo properties are set above so
* that /data/local.prop cannot interfere with them.
*/
start_property_service();
return 0;
}
void start_property_service(void)
{
int fd;
load_properties_from_file(PROP_PATH_SYSTEM_BUILD);
load_properties_from_file(PROP_PATH_SYSTEM_DEFAULT);
load_properties_from_file(PROP_PATH_LOCAL_OVERRIDE);
/* Read persistent properties after all default values have been loaded. */
load_persistent_properties();
fd = create_socket(PROP_SERVICE_NAME, SOCK_STREAM, 0666, 0, 0);
if(fd < 0) return;
fcntl(fd, F_SETFD, FD_CLOEXEC);
fcntl(fd, F_SETFL, O_NONBLOCK);
listen(fd, 8);
property_set_fd = fd;
}
load_properties_from_file从几个文件装载系统和本地属性，load_persistent_properties装载永久属性，调用create_socket创建一个server端的socket用于和其它需要设置属性的进程通信，最后这个property_set_fd给init进程用，init进程充当property service功能
static void load_persistent_properties()
{
DIR* dir = opendir(PERSISTENT_PROPERTY_DIR);
struct dirent* entry;
char path[PATH_MAX];
char value[PROP_VALUE_MAX];
int fd, length;
if (dir) {
while ((entry = readdir(dir)) != NULL) {
if (strncmp("persist.", entry->d_name, strlen("persist.")))
continue;
#if HAVE_DIRENT_D_TYPE
if (entry->d_type != DT_REG)
continue;
#endif
/* open the file and read the property value */
snprintf(path, sizeof(path), "%s/%s", PERSISTENT_PROPERTY_DIR, entry->d_name);
fd = open(path, O_RDONLY);
if (fd >= 0) {
length = read(fd, value, sizeof(value) - 1);
if (length >= 0) {
value[length] = 0;
property_set(entry->d_name, value);
} else {
ERROR("Unable to read persistent property file %s errno: %d\n", path, errno);
}
close(fd);
} else {
ERROR("Unable to open persistent property file %s errno: %d\n", path, errno);
}
}
closedir(dir);
} else {
ERROR("Unable to open persistent property directory %s errno: %d\n", PERSISTENT_PROPERTY_DIR, errno);
}
persistent_properties_loaded = 1;
}
这里想到了是否zygote进程镜像恢复后，做load_persistent_properties里的动作。在init.c的for循环里有调restart_processes启动服务
restart_service_if_needed --> service_start
pid = fork();
if (pid == 0) {
struct socketinfo *si;
struct svcenvinfo *ei;
char tmp[32];
int fd, sz;
if (properties_inited()) {
get_property_workspace(&fd, &sz);
sprintf(tmp, "%d,%d", dup(fd), sz);
add_environment("ANDROID_PROPERTY_WORKSPACE", tmp);
}
可见，当属性初始化了(properties_inited), 然后add_environment("ANDROID_PROPERTY_WORKSPACE", tmp);添加到init进程的系统环境变量中
D. queue_property_triggers_action
把init.rc里perty:"等加到队列中
void queue_all_property_triggers()
{
struct listnode *node;
struct action *act;
list_for_each(node, &action_list) {
act = node_to_item(node, struct action, alist);
if (!strncmp(act->name, "property:", strlen("property:"))) {
/* parse property name and value
syntax is property:<name>=<value> */
const char* name = act->name + strlen("property:");
const char* equals = strchr(name, '=');
if (equals) {
char prop_name[PROP_NAME_MAX + 1];
const char* value;
int length = equals - name;
if (length > PROP_NAME_MAX) {
ERROR("property name too long in trigger %s", act->name);
} else {
memcpy(prop_name, name, length);
prop_name[length] = 0;
/* does the property exist, and match the trigger value? */
value = property_get(prop_name);
if (value && !strcmp(equals + 1, value)) {
action_add_queue_tail(act);
}
}
}
}
}
}
E. handle_property_set_fd
void handle_property_set_fd()
{
prop_msg msg;
int s;
int r;
int res;
struct ucred cr;
struct sockaddr_un addr;
socklen_t addr_size = sizeof(addr);
socklen_t cr_size = sizeof(cr);
if ((s = accept(property_set_fd, (struct sockaddr *) &addr, &addr_size)) < 0) {
return;
}
/* Check socket options here */
if (getsockopt(s, SOL_SOCKET, SO_PEERCRED, &cr, &cr_size) < 0) {
close(s);
ERROR("Unable to recieve socket options\n");
return;
}
r = recv(s, &msg, sizeof(msg), 0);
close(s);
if(r != sizeof(prop_msg)) {
ERROR("sys_prop: mis-match msg size recieved: %d expected: %d\n",
r, sizeof(prop_msg));
return;
}
switch(msg.cmd) {
case PROP_MSG_SETPROP:
msg.name[PROP_NAME_MAX-1] = 0;
msg.value[PROP_VALUE_MAX-1] = 0;
if(memcmp(msg.name,"ctl.",4) == 0) {
if (check_control_perms(msg.value, cr.uid, cr.gid)) {
handle_control_message((char*) msg.name + 4, (char*) msg.value);
} else {
ERROR("sys_prop: Unable to %s service ctl [%s] uid: %d pid:%d\n",
msg.name + 4, msg.value, cr.uid, cr.pid);
}
} else {
if (check_perms(msg.name, cr.uid, cr.gid)) {
property_set((char*) msg.name, (char*) msg.value);
} else {
ERROR("sys_prop: permission denied uid:%d gid:%d name:%s\n",
cr.uid, cr.gid, msg.name);
}
}
break;
default:
break;
}
}
最后分析下zygote的内存镜像为何会保存property的内存区域
前面提到的__system_property_area__是在bionic里定义的，在libcutils.so里，所以在不同的进程中这个__system_property_area__是互相独立的。在加载libcutils.so的时候，会调用__libc_init_common，__libc_init_common会调用system_properties.c里的__system_properties_init
int __system_properties_init(void)
{
prop_area *pa;
int s, fd;
unsigned sz;
char *env;
if(__system_property_area__ != ((void*) &dummy_props)) {
return 0;
}
env = getenv("ANDROID_PROPERTY_WORKSPACE");
if (!env) {
return -1;
}
fd = atoi(env);
env = strchr(env, ',');
if (!env) {
return -1;
}
sz = atoi(env + 1);
pa = mmap(0, sz, PROT_READ, MAP_SHARED, fd, 0);
if(pa == MAP_FAILED) {
return -1;
}
if((pa->magic != PROP_AREA_MAGIC) || (pa->version != PROP_AREA_VERSION)) {
munmap(pa, sz);
return -1;
}
__system_property_area__ = pa;
return 0;
}
这里获取环境变量，重新设置property区域，可以看到，当zygote进程镜像恢复后，里面的值仍然是以前的内存区域的值，
在java_lang_ProcessManager.cpp里ProcessManager_staticInitialize的native函数给JAVA调了，在java里调ProcessManager.staticInitialize可以重新初始化静态变量
static void ProcessManager_staticInitialize(JNIEnv* env,
jclass clazz) {
#ifdef ANDROID
char* fdString = getenv("ANDROID_PROPERTY_WORKSPACE");
if (fdString) {
androidSystemPropertiesFd = atoi(fdString);
}
#endif
onExitMethod = env->GetMethodID(clazz, "onExit", "(II)V");
if (onExitMethod == NULL) {
return;
}
}
3931
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
