Android的init进程启动过程

init是一个进程，它是linux系统中用户空间的第一个进程，其进程PID是1，父进程为linux是系统内核的0号进程。所以其被赋予很多极其重要的职责,linux内核初始化完成后就开始执行它。

一、在分析init的核心代码之前，可以初步了解init的主要工作：
  1. Android系统有很多属性，init提供了一个property_service（属性服务）来管理它们。
  2. 处理配置文件的命令（主要是init.rc文件），包括处理各种Action。
  3. 性能分析（使用bootchart工具）。
  4. 无限循环执行command。

二、代码路径：\system\core\init\init.c

  以下是main函数，包含对各部分的注解

int main(int argc, char **argv)
{
  int fd_count = 0;
  struct pollfd ufds[4];
  char *tmpdev;
  char* debuggable;
  char tmp[32];
  int property_set_fd_init = 0;
  int signal_fd_init = 0;
  int keychord_fd_init = 0;
  bool is_charger = false;

  if (!strcmp(basename(argv[0]), "ueventd"))
    return ueventd_main(argc, argv);

  if (!strcmp(basename(argv[0]), "watchdogd"))
    return watchdogd_main(argc, argv);

  /* clear the umask */
  umask(0);

  // 创建用户空间的目录，例如/dev,/proc,/sys等。
  mkdir("/dev", 0755);
  mkdir("/proc", 0755);
  mkdir("/sys", 0755);

  mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755");
  mkdir("/dev/pts", 0755);
  mkdir("/dev/socket", 0755);
  mount("devpts", "/dev/pts", "devpts", 0, NULL);
  mount("proc", "/proc", "proc", 0, NULL);
  mount("sysfs", "/sys", "sysfs", 0, NULL);

  // 检测/dev/.booting文件是否可读写和可创建。
  close(open("/dev/.booting", O_WRONLY | O_CREAT, 0000));

  // 将标准输入、输出、错误输出重定向到/dev/__null__。
  open_devnull_stdio();
  // 将init的日志输出设备设置为/dev/__kmsg__。
  klog_init();
  // 初始化和属性相关的资源
  property_init();

  get_hardware_name(hardware, &revision);
  
  // 处理内核命令行
  process_kernel_cmdline();

  union selinux_callback cb;
  cb.func_log = klog_write;
  selinux_set_callback(SELINUX_CB_LOG, cb);

  cb.func_audit = audit_callback;
  selinux_set_callback(SELINUX_CB_AUDIT, cb);

  selinux_initialize();
  /* These directories were necessarily created before initial policy load
   * and therefore need their security context restored to the proper value.
   * This must happen before /dev is populated by ueventd.
   */
  restorecon("/dev");
  restorecon("/dev/socket");
  restorecon("/dev/__properties__");
  restorecon_recursive("/sys");

  is_charger = !strcmp(bootmode, "charger");

  INFO("property init\n");
  if (!is_charger)
    property_load_boot_defaults();

  INFO("reading config file\n");
  // 分析/init.rc文件的内容
  init_parse_config_file("/init.rc");
  
  // 解析完init.rc配置文件后，会得到一系列的Action动作。
  // init将动作的执行时间划分为四个阶段：early-init,init,early-boot,boot
  action_for_each_trigger("early-init", action_add_queue_tail);

  queue_builtin_action(wait_for_coldboot_done_action, "wait_for_coldboot_done");
  queue_builtin_action(mix_hwrng_into_linux_rng_action, "mix_hwrng_into_linux_rng");
  queue_builtin_action(keychord_init_action, "keychord_init");
  queue_builtin_action(console_init_action, "console_init");

  /* execute all the boot actions to get us started */
  action_for_each_trigger("init", action_add_queue_tail);

  /* skip mounting filesystems in charger mode */
  if (!is_charger) {
    action_for_each_trigger("early-fs", action_add_queue_tail);
    action_for_each_trigger("fs", action_add_queue_tail);
    action_for_each_trigger("post-fs", action_add_queue_tail);
    action_for_each_trigger("post-fs-data", action_add_queue_tail);
  }

  /* Repeat mix_hwrng_into_linux_rng in case /dev/hw_random or /dev/random
   * wasn't ready immediately after wait_for_coldboot_done
   */
  queue_builtin_action(mix_hwrng_into_linux_rng_action, "mix_hwrng_into_linux_rng");

  queue_builtin_action(property_service_init_action, "property_service_init");
  queue_builtin_action(signal_init_action, "signal_init");
  queue_builtin_action(check_startup_action, "check_startup");

  if (is_charger) {
    action_for_each_trigger("charger", action_add_queue_tail);
  } else {
    action_for_each_trigger("early-boot", action_add_queue_tail);
    action_for_each_trigger("boot", action_add_queue_tail);
  }

    /* run all property triggers based on current state of the properties */
  queue_builtin_action(queue_property_triggers_action, "queue_property_triggers");


#if BOOTCHART
  queue_builtin_action(bootchart_init_action, "bootchart_init");
#endif
  // 进入无限循环，建立init的子进程(init是所有进程的父进程)
  for(;;) {
    int nr, i, timeout = -1;

    execute_one_command();
    restart_processes();

    if (!property_set_fd_init && get_property_set_fd() > 0) {
      ufds[fd_count].fd = get_property_set_fd();
      ufds[fd_count].events = POLLIN;
      ufds[fd_count].revents = 0;
      fd_count++;
      property_set_fd_init = 1;
    }
    if (!signal_fd_init && get_signal_fd() > 0) {
      ufds[fd_count].fd = get_signal_fd();
      ufds[fd_count].events = POLLIN;
      ufds[fd_count].revents = 0;
      fd_count++;
      signal_fd_init = 1;
    }
    if (!keychord_fd_init && get_keychord_fd() > 0) {
      ufds[fd_count].fd = get_keychord_fd();
      ufds[fd_count].events = POLLIN;
      ufds[fd_count].revents = 0;
      fd_count++;
      keychord_fd_init = 1;
    }

    if (process_needs_restart) {
      timeout = (process_needs_restart - gettime()) * 1000;
      if (timeout < 0)
        timeout = 0;
    }

    if (!action_queue_empty() || cur_action)
      timeout = 0;

#if BOOTCHART
    if (bootchart_count > 0) {
      if (timeout < 0 || timeout > BOOTCHART_POLLING_MS)
        timeout = BOOTCHART_POLLING_MS;
      if (bootchart_step() < 0 || --bootchart_count == 0) {
        bootchart_finish();
        bootchart_count = 0;
      }
    }
#endif

    nr = poll(ufds, fd_count, timeout);
    if (nr <= 0)
      continue;

    for (i = 0; i < fd_count; i++) {
      if (ufds[i].revents == POLLIN) {
        if (ufds[i].fd == get_property_set_fd())
          handle_property_set_fd();
        else if (ufds[i].fd == get_keychord_fd())
          handle_keychord();
        else if (ufds[i].fd == get_signal_fd())
          handle_signal();
      }
    }
  }

  return 0;
}

总结：
本文分析了Android里的init进程的启动过程，从中可以知道init做的主要工作包括对init.rc的解析，property机制的实现，service支撑的实现。