Android Service

Native Service and Android Service

• Native Service:In every main() method of NativeService, which is called by init process through parseing init.rc, the globale object of ProcessState will be created by calling ProcessState::self(),and then startThreadPool and created main thread by calling IPCThreadPool.self()->joinThreadPool().
• Android Service:All Android Service is created by SystemServer and running with the same parent process which is system server.

Init Process starts

      Reference: http://my.oschina.net/u/561492/blog/144730

• init.rc

• import init.usb.rc
  import init.xlog.rc
  
  on early-init
      # Set init and its forked children's oom_adj.
      write /proc/1/oom_adj -16
      start ueventd
      
  # create mountpoints
      mkdir /mnt 0775 root system
      mkdir /mnt/sdcard 0000 system system
      mkdir /mnt/sdcard2 0000 system system
  
  on early_property:ro.build.type=user
      write /proc/bootprof "INIT: user build setting"
  
  on early_property:ro.build.type=eng
      write /proc/bootprof "INIT: eng build setting"
  
  on init
  
  sysclktz 0
  
  loglevel 5
      write /proc/bootprof "INIT: on init start"
  
  # setup the global environment
      export PATH /sbin:/vendor/bin:/system/sbin:/system/bin:/system/xbin
      export LD_LIBRARY_PATH /vendor/lib:/system/lib
      export ANDROID_BOOTLOGO 1
      export ANDROID_ROOT /system
      export ANDROID_ASSETS /system/app
      export ANDROID_DATA /data
      export EXTERNAL_STORAGE /mnt/sdcard
      export ASEC_MOUNTPOINT /mnt/asec
      export LOOP_MOUNTPOINT /mnt/obb
      export BOOTCLASSPATH /system/framework/core.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/apache-xml.jar:/system/framework/filterfw.jar:/system/framework/mediatek-framework.jar:/system/framework/secondary_framework.jar
  
  # Backward compatibility
      symlink /system/etc /etc
      symlink /sys/kernel/debug /d
  
  # Right now vendor lives on the same filesystem as system,
  # but someday that may change.
      symlink /system/vendor /vendor
  
  # Create cgroup mount point for cpu accounting
      mkdir /acct
      mount cgroup none /acct cpuacct
      mkdir /acct/uid
  
  # Backwards Compat - XXX: Going away in G*
      symlink /mnt/sdcard /sdcard
  
      mkdir /system
      mkdir /data 0771 system system
      mkdir /cache 0770 system cache
      mkdir /config 0500 root root
  
      # Directory for putting things only root should see.
      mkdir /mnt/secure 0700 root root
  
      # Directory for staging bindmounts
      mkdir /mnt/secure/staging 0700 root root
  
      # Directory-target for where the secure container
      # imagefile directory will be bind-mounted
      mkdir /mnt/secure/asec  0700 root root
  
      # Secure container public mount points.
      mkdir /mnt/asec  0700 root system
      mount tmpfs tmpfs /mnt/asec mode=0755,gid=1000
  
      # Filesystem image public mount points.
      mkdir /mnt/obb 0700 root system
      mount tmpfs tmpfs /mnt/obb mode=0755,gid=1000
  
      write /proc/sys/kernel/panic_on_oops 1
      write /proc/sys/kernel/hung_task_timeout_secs 0
      write /proc/cpu/alignment 4
      write /proc/sys/kernel/sched_latency_ns 10000000
      write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
      write /proc/sys/kernel/sched_compat_yield 1
      write /proc/sys/kernel/sched_child_runs_first 0
      write /proc/sys/kernel/randomize_va_space 2
  
  # Create cgroup mount points for process groups
      mkdir /dev/cpuctl
      mount cgroup none /dev/cpuctl cpu
      chown system system /dev/cpuctl
      chown system system /dev/cpuctl/tasks
      chmod 0777 /dev/cpuctl/tasks
      write /dev/cpuctl/cpu.shares 1024
  
      mkdir /dev/cpuctl/fg_boost
      chown system system /dev/cpuctl/fg_boost/tasks
      chmod 0777 /dev/cpuctl/fg_boost/tasks
      write /dev/cpuctl/fg_boost/cpu.shares 1024
  
      mkdir /dev/cpuctl/bg_non_interactive
      chown system system /dev/cpuctl/bg_non_interactive/tasks
      chmod 0777 /dev/cpuctl/bg_non_interactive/tasks
      # 5.0 %
      write /dev/cpuctl/bg_non_interactive/cpu.shares 52
  
  # Allow everybody to read the xt_qtaguid resource tracking misc dev.
  # This is needed by any process that uses socket tagging.
      chmod 0644 /dev/xt_qtaguid
  
  on fs
  # mount mtd partitions
      # Mount /system rw first to give the filesystem a chance to save a checkpoint
      write /proc/bootprof "INIT:NAND:Mount_START"
      mount yaffs2 mtd@system /system
      mount yaffs2 mtd@system /system ro remount
      mount yaffs2 mtd@userdata /data nosuid nodev
      mount yaffs2 mtd@cache /cache nosuid nodev
      write /proc/bootprof "INIT:NAND:Mount_END"
  # mount mtd partitions
      write /proc/bootprof "INIT:eMMC:Mount_START"
      exec /sbin/e2fsck -p /emmc@android
      # Mount /system rw first to give the filesystem a chance to save a checkpoint
      #mount ext4 emmc@android /system commit=1,data=journal,noauto_da_alloc
      mount ext4 /emmc@android /system commit=1,noauto_da_alloc
      mkdir /system/secro 0600 system system
      # RIL need to do this before the folder /system changed to read only
      chown radio system /system/etc/ril
      chmod 0770 /system/etc/ril
      chmod 0444 /system/etc/ril/oper.lis
      mount ext4 /emmc@android /system noatime ro remount 
      exec /sbin/e2fsck -pfD /emmc@usrdata
      exec /sbin/tune2fs -O has_journal /emmc@usrdata
      mount ext4 /emmc@usrdata /data noatime nosuid nodev noauto_da_alloc
      exec /sbin/e2fsck -p /emmc@cache
      exec /sbin/tune2fs -O has_journal /emmc@cache
      mount ext4 /emmc@cache /cache noatime nosuid nodev noauto_da_alloc
      write /proc/bootprof "INIT:eMMC:Mount_END"
  
  on post-fs
      # once everything is setup, no need to modify /
      mount rootfs rootfs / ro remount
  
  # Add by Mtk
      mount ext4 /emmc@sec_ro /system/secro ro remount
      
      # We chown/chmod /cache again so because mount is run as root + defaults
      chown system cache /cache
      chmod 0770 /cache
  
      # This may have been created by the recovery system with odd permissions
      chown system cache /cache/recovery
      chmod 0770 /cache/recovery
  
      #change permissions on vmallocinfo so we can grab it from bugreports
      chown root log /proc/vmallocinfo
      chmod 0440 /proc/vmallocinfo
  
      #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks
      chown root system /proc/kmsg
      chmod 0440 /proc/kmsg
      chown root system /proc/sysrq-trigger
      chmod 0220 /proc/sysrq-trigger
  
      # create the lost+found directories, so as to enforce our permissions
      mkdir /cache/lost+found 0770 root root
  
  # Add by Mtk
      mount yaffs2 mtd@secstatic /system/secro ro remount
  
  on post-fs-data
      # We chown/chmod /data again so because mount is run as root + defaults
      chown system system /data
      chmod 0771 /data
  
      # Create dump dir and collect dumps.
      # Do this before we mount cache so eventually we can use cache for
      # storing dumps on platforms which do not have a dedicated dump partition.
      mkdir /data/dontpanic 0750 root log
  
      # Collect apanic data, free resources and re-arm trigger
      copy /proc/apanic_console /data/dontpanic/apanic_console
      chown root log /data/dontpanic/apanic_console
      chmod 0640 /data/dontpanic/apanic_console
  
      copy /proc/apanic_threads /data/dontpanic/apanic_threads
      chown root log /data/dontpanic/apanic_threads
      chmod 0640 /data/dontpanic/apanic_threads
  
      write /proc/apanic_console 1
  
      # create basic filesystem structure
      mkdir /data/nvram 0770 root nvram
      mkdir /data/misc 01771 system misc
      mkdir /data/misc/bluetoothd 0770 bluetooth bluetooth
      mkdir /data/misc/bluetooth 0770 system system
      mkdir /data/misc/keystore 0700 keystore keystore
      mkdir /data/misc/keychain 0771 system system
      mkdir /data/misc/vpn 0770 system vpn
      mkdir /data/misc/systemkeys 0700 system system
      # give system access to wpa_supplicant.conf for backup and restore
      mkdir /data/misc/wifi 0770 wifi wifi
      chmod 0660 /data/misc/wifi/wpa_supplicant.conf
      chmod 0660 /data/misc/wifi/p2p_supplicant.conf
      mkdir /data/local 0751 root root
      mkdir /data/local/tmp 0771 shell shell
      mkdir /data/data 0771 system system
      mkdir /data/app-private 0771 system system
      mkdir /data/app 0771 system system
      mkdir /data/property 0700 root root
  
      #give system access to rfkill device node
      chmod 0660 /dev/rfkill
  
      # create dalvik-cache, so as to enforce our permissions
      mkdir /data/dalvik-cache 0771 system system
  
      # create resource-cache and double-check the perms
      mkdir /data/resource-cache 0771 system system
      chown system system /data/resource-cache
      chmod 0771 /data/resource-cache
  
      # create the lost+found directories, so as to enforce our permissions
      mkdir /data/lost+found 0770 root root
  
      # create directory for DRM plug-ins
      mkdir /data/drm 0774 drm drm
  
      # If there is no fs-post-data action in the init.<device>.rc file, you
      # must uncomment this line, otherwise encrypted filesystems
      # won't work.
      # Set indication (checked by vold) that we have finished this action
      #setprop vold.post_fs_data_done 1
  
  # -----------------------
  # Add by MTK 
  
      # hwe
      insmod /system/lib/modules/mtk_hwe.ko
  
      # alps core
      # insmod /system/lib/modules/alps_core.ko
  
      # dhcp server 
      mkdir /data/misc/dhcp 0770 dhcp dhcp
      chown dhcp dhcp /data/misc/dhcp
  
      # SGX
      insmod /system/lib/modules/pvrsrvkm.ko
      insmod /system/lib/modules/mtklfb.ko
  
      # Permissions for System Server and daemons.
      chown root   radio  /sys/class/leds/lcd-backlight/brightness
      chown root   radio  /sys/class/leds/lcd-backlight/duty
      chown root   radio  /sys/class/leds/lcd-backlight/div
  
      # Touch Panel 
      chmod 0664 /dev/touch
      chown root diag /sys/module/tpd_setting/parameters/tpd_calmat
      chown root diag /sys/module/tpd_setting/parameters/tpd_em_debounce_time
      chown root diag /sys/module/tpd_setting/parameters/tpd_mode
      chown root diag /sys/module/tpd_setting/parameters/tpd_em_debounce_time0
      chown root diag /sys/module/tpd_setting/parameters/tpd_em_debounce_time1
      chown root diag /sys/module/tpd_setting/parameters/tpd_em_spl_num
      chown root diag /sys/module/tpd_setting/parameters/tpd_em_pressure_threshold
      chown root diag /sys/module/tpd_setting/parameters/tpd_em_auto_time_interval
      chown root diag /sys/module/tpd_setting/parameters/tpd_em_sample_cnt
      chown root diag /sys/module/tpd_setting/parameters/tpd_em_asamp
      chown root diag /sys/module/tpd_debug/parameters/tpd_em_log
      chown root diag /sys/module/tpd_debug/parameters/tpd_em_log_to_fs
      
      chmod 0666 /dev/pmem_multimedia
      # load driver base driver
      insmod /system/lib/modules/mtk_drvb_77.ko
      mknod /dev/drvb c 176 0
      chmod 0666 /dev/drvb
  
      # watch dog kicker
      write /proc/wdk "0 20 30"
  
      
  
      # RTC
      mkdir /data/misc/rtc 0770 system system
  
      # Modem related device nodes
      mkdir /data/nvram/md 0700 root root
  
      insmod /system/lib/modules/ccci_plat.ko
      insmod /system/lib/modules/ccci.ko
      insmod /system/lib/modules/ccmni.ko
  
      mknod /dev/ccci c 184 0
      mknod /dev/ccci_fs c 178 0
      mknod /dev/ccci_sys_rx c 184 2
      mknod /dev/ccci_sys_tx c 184 3
      mknod /dev/ccci_pcm_rx c 184 4
      mknod /dev/ccci_pcm_tx c 184 5
      mknod /dev/ccci_uart1_rx c 184 6
      mknod /dev/ccci_uart1_rx_ack c 184 7
      
      mknod /dev/ccci_uem_rx c 184 18
      mknod /dev/ccci_uem_tx c 184 19
      chmod 0666 /dev/ccci_uem_rx
      chmod 0666 /dev/ccci_uem_tx
  
      mknod /dev/ccci_md_log_rx c 184 42
      mknod /dev/ccci_md_log_tx c 184 43
      chmod 0666 /dev/ccci_md_log_rx
      chmod 0666 /dev/ccci_md_log_tx
  
      chmod 0666 /dev/ccci
      chmod 0660 /dev/ccci_fs
      chmod 0666 /dev/ccci_pcm_rx
      chmod 0666 /dev/ccci_pcm_tx
      chmod 0600 /dev/ccci_sys_rx
      chmod 0600 /dev/ccci_sys_tx
      chmod 0600 /dev/ccci_uart1_rx
      chmod 0600 /dev/ccci_uart1_rx_ack
      chmod 0660 /dev/ttyC0
  
      # M4U
      insmod /system/lib/modules/m4u.ko
      mknod /dev/M4U_device c 188 0
      chmod 0666 /dev/M4U_device
      
      # Sensor
      chmod 0666 /dev/hwmsensor
      chmod 0666 /dev/msensor
      chmod 0666 /dev/gsensor
      chmod 0666 /dev/alsps
  
      #VideoCodec
      insmod /system/lib/modules/vcodec_kernel_driver.ko
      mknod /dev/Vcodec c 160 0
      chmod 0666 /dev/Vcodec
  
  
      
      mkdir /data/amit/
      mkdir /data/misc/sensors 0777 system system
      mkdir /data/misc/akmd 0777 compass compass
      chown system /sys/class/input/input4/enable
      chown system /sys/class/input/input4/delay
      chown system /sys/class/input/input4/wake
      chown system /sys/class/input/input2/enable
      chown system /sys/class/input/input2/wake
      chown compass /sys/class/input/input3/offsets    
  
      # GPIO
      chmod 0666 /dev/mtgpio
      
          #EM eint
      chown root diag /sys/bus/platform/drivers/eint/current_eint
  
      # change MTKFB permission for Settings App JNI functions to set TVOut related status
      chmod 0666 /dev/graphics/fb0
      
      # EM baseband file
      chown root diag /system/bin/baseband_regdump
      chmod 4750 /system/bin/baseband_regdump
  
      #pmu
      chown root radio /sys/devices/platform/mt-pmic/pmic_access_bank0
      chown root radio /sys/devices/platform/mt-pmic/pmic_access_bank1
      chmod 0664 /sys/devices/platform/mt-pmic/pmic_access_bank0
      chmod 0664 /sys/devices/platform/mt-pmic/pmic_access_bank1
  
      
      #EM eint
      chown root diag /sys/bus/platform/drivers/eint/current_eint
  
      # for ppp options file
      mkdir /data/misc/ppp
      chmod 0777 /data/misc/ppp
  
      # Android SEC related device nodes
      insmod /system/lib/modules/sec.ko
      mknod /dev/sec c 182 0
      chmod 0660 /dev/sec
  
      # device apc settings
      insmod /system/lib/modules/devapc.ko
  
      # device info /proc interface
      insmod /system/lib/modules/devinfo.ko
      
      # bluetooth
      mkdir /data/@btmtk 0770 bluetooth net_bt
      chown bluetooth bluetooth /dev/hid-keyboard
      chmod 0660 /dev/hid-keyboard
      chown bluetooth bluetooth /dev/btn
      chmod 0660 /dev/btn
      #Use uinput's default permission
      chown system net_bt_admin /dev/uinput
  
      #TV-out
      chmod 0666 /dev/TV-out
  
      #HDMI
      chmod 0666 /dev/hdmitx
  
      # JPEG
      chmod 0666 /dev/mtk_jpeg
      
      #SYSRAM
      chmod 0666 /dev/camera-sysram
  
      #ISP
      chmod 0666 /dev/camera-isp
  
      #ResMar
      chmod 0666 /dev/camera-resmgr
  
      # otg_test
      chmod 0777 /dev/mt_otg_test
      
      # MDP
      chmod 0666 /dev/mt6575-MDP
  
  # End of adding by MTK drivers   
  # -----------------------
  
  on boot
  
      # xlog
      chmod 0666 /dev/xLog
      start xlogboot
      
  # basic network init
      ifup lo
      hostname localhost
      domainname localdomain
  
  # set RLIMIT_NICE to allow priorities from 19 to -20
      setrlimit 13 40 40
  
  # Memory management.  Basic kernel parameters, and allow the high
  # level system server to be able to adjust the kernel OOM driver
  # paramters to match how it is managing things.
      write /proc/sys/vm/overcommit_memory 1
      write /proc/sys/vm/min_free_order_shift 4
      chown root system /sys/module/lowmemorykiller/parameters/adj
      chmod 0664 /sys/module/lowmemorykiller/parameters/adj
      chown root system /sys/module/lowmemorykiller/parameters/minfree
      chmod 0664 /sys/module/lowmemorykiller/parameters/minfree
  
      # Tweak background writeout
      write /proc/sys/vm/dirty_expire_centisecs 100
      write /proc/sys/vm/dirty_writeback_centisecs 300
      write /proc/sys/vm/dirty_background_ratio  5
  
      # Permissions for System Server and daemons.
      chown radio system /sys/android_power/state
      chown radio system /sys/android_power/request_state
      chown radio system /sys/android_power/acquire_full_wake_lock
      chown radio system /sys/android_power/acquire_partial_wake_lock
      chown radio system /sys/android_power/release_wake_lock
      chown radio system /sys/power/state
      chown radio system /sys/power/wake_lock
      chown radio system /sys/power/wake_unlock
      chmod 0660 /sys/power/state
      chmod 0660 /sys/power/wake_lock
      chmod 0660 /sys/power/wake_unlock
      chmod 0664 /sys/class/leds/lcd-backlight/brightness
      chown system system /sys/class/timed_output/vibrator/enable
      chown system system /sys/class/leds/keyboard-backlight/brightness
      chown system radio  /sys/class/leds/lcd-backlight/brightness
      chown system system /sys/class/leds/button-backlight/brightness
      chown system system /sys/class/leds/jogball-backlight/brightness
      chown system system /sys/class/leds/red/brightness
      chown system system /sys/class/leds/green/brightness
      chown system system /sys/class/leds/blue/brightness
      chown system system /sys/class/leds/red/device/grpfreq
      chown system system /sys/class/leds/red/device/grppwm
      chown system system /sys/class/leds/red/device/blink
      chown system system /sys/class/leds/red/brightness
      chown system system /sys/class/leds/green/brightness
      chown system system /sys/class/leds/blue/brightness
      chown system system /sys/class/leds/red/device/grpfreq
      chown system system /sys/class/leds/red/device/grppwm
      chown system system /sys/class/leds/red/device/blink
      chown system system /sys/class/timed_output/vibrator/enable
      chown system system /sys/module/sco/parameters/disable_esco
      chown system system /sys/kernel/ipv4/tcp_wmem_min
      chown system system /sys/kernel/ipv4/tcp_wmem_def
      chown system system /sys/kernel/ipv4/tcp_wmem_max
      chown system system /sys/kernel/ipv4/tcp_rmem_min
      chown system system /sys/kernel/ipv4/tcp_rmem_def
      chown system system /sys/kernel/ipv4/tcp_rmem_max
      chown root radio /proc/cmdline
  
      chown root   radio  /sys/class/leds/lcd-backlight/duty
      chown root   radio  /sys/class/leds/lcd-backlight/div
      chown system system /sys/class/leds/lcd-backlight/trigger
      chown system system /sys/class/leds/button-backlight/trigger
      chown system system /sys/class/leds/keyboard-backlight/trigger
      chown system system /sys/class/leds/jogball-backlight/trigger
      chown system system /sys/class/leds/red/trigger
      chown system system /sys/class/leds/green/trigger
      chown system system /sys/class/leds/blue/trigger
  # AGPS
  chmod 0777 /system/bin/mtk_agpsd
  
  ## Thermal
    #change permissions on thermal devices
    chown root system /proc/mtktscpu/mtktscpu
    chmod 0660 /proc/mtktscpu/mtktscpu
    chown root system /proc/mtktsabb/mtktsabb
    chmod 0660 /proc/mtktsabb/mtktsabb
    chown root system /proc/mtktsbattery/mtktsbattery
    chmod 0660 /proc/mtktsbattery/mtktsbattery
    chown root system /proc/mtktspa/mtktspa
    chmod 0660 /proc/mtktspa/mtktspa
    chown root system /proc/mtktspmic/mtktspmic
    chmod 0660 /proc/mtktspmic/mtktspmic
    chown root system /proc/wmt_tm/wmt_tm
    chmod 0660 /proc/wmt_tm/wmt_tm
    chown root system /proc/driver/mtk_thermal_monitor
    chmod 0660 /proc/driver/mtk_thermal_monitor
  
  # Define TCP buffer sizes for various networks
  #   ReadMin, ReadInitial, ReadMax, WriteMin, WriteInitial, WriteMax,
      setprop net.tcp.buffersize.default 4096,87380,110208,4096,16384,110208
      setprop net.tcp.buffersize.wifi    524288,1048576,2097152,262144,524288,1048576
      setprop net.tcp.buffersize.lte     524288,1048576,2097152,262144,524288,1048576
      setprop net.tcp.buffersize.umts    4094,87380,110208,4096,16384,110208
      setprop net.tcp.buffersize.hspa    4094,87380,262144,4096,16384,262144
      setprop net.tcp.buffersize.edge    4093,26280,35040,4096,16384,35040
      setprop net.tcp.buffersize.gprs    4092,8760,11680,4096,8760,11680
  
  # Set this property so surfaceflinger is not started by system_init
      setprop system_init.startsurfaceflinger 0
  
      class_start core
      class_start main
      class_start default
  
  on nonencrypted
      class_start late_start
  
  on charger
      class_start charger
  
  on property:vold.decrypt=trigger_reset_main
      class_reset main
  
  on property:vold.decrypt=trigger_load_persist_props
      load_persist_props
  
  on property:vold.decrypt=trigger_post_fs_data
      trigger post-fs-data
  
  on property:vold.decrypt=trigger_restart_min_framework
      class_start main
  
  on property:vold.decrypt=trigger_restart_framework
      class_start main
      class_start late_start
  
  on property:vold.decrypt=trigger_shutdown_framework
      class_reset late_start
      class_reset main
  
  on property:vold.decrypt=trigger_stop_modem_and_default
      stop gsm0710muxd
      stop rild
      stop ccci_fsd
      stop ccci_mdinit
      class_reset default
  
  ## Daemon processes to be run by init.
  ##
  
  # Update the second boot logo
  service bootlogoupdater /system/bin/boot_logo_updater
      oneshot
  
  service ueventd /sbin/ueventd
      class core
      critical
  
  service console /system/bin/sh
      class core
      console
      disabled
      user root
      group log
  
  on property:ro.debuggable=1
      start console
  
  # adbd is controlled via property triggers in init.<platform>.usb.rc
  service adbd /sbin/adbd
      class core
      disabled
  
  # adbd on at boot in emulator
  on property:ro.kernel.qemu=1
      start adbd
  
  service debuggerd /system/bin/debuggerd
      class main
  
  service mobile_log_d /system/bin/mobile_log_d
      class main
  
  # SGX init
  service pvrsrvinit /system/vendor/bin/pvrsrvinit
      class main
      user root
      group root
      oneshot
  
  service servicemanager /system/bin/servicemanager
      class core
      user system
      group system
      critical
      onrestart restart zygote
      onrestart restart media
      onrestart restart surfaceflinger
      onrestart restart drm
  
  service vold /system/bin/vold
      class core
      socket vold stream 0660 root mount
      ioprio be 2
  
  service netd /system/bin/netd
      class main
      socket netd stream 0660 root system
      socket dnsproxyd stream 0660 root inet
      
  service netdiag /system/bin/netdiag
      class main
      socket netdiag stream 0666 root system 
      
  
  service nvram_daemon /system/bin/nvram_daemon
      class main
      user root
      group nvram
      oneshot
  service gsm0710muxd /system/bin/gsm0710muxd -s /dev/ttyC0 -f 512 -n 8 -m basic
      class core
      user root
      group radio cache inet misc
      disabled
  
  service muxreport-daemon /system/bin/muxreport
      class core
      user root
      group radio cache inet misc
          disabled
          oneshot
  
  service ril-daemon /system/bin/rild
      class core
      socket rild stream 660 root radio
      socket rild2 stream 660 root radio
      socket rild-debug stream 666 radio system
      socket rild-mtk-ut stream 660 radio net_bt
      socket rild-mtk-ut-2 stream 660 radio net_bt
      socket rild-mtk-modem stream 660 radio system
      socket rild-atci stream 660 root radio
      user root
      group radio cache inet misc audio sdcard_rw log
      disabled
  
  service atci_service /system/bin/atci_service 
      socket atci-service stream 660 radio system 
      socket atci-service-framework stream 660 radio system 
      user root 
      group radio system                         
  
  
  service atcid-daemon /system/bin/atcid 
      user root 
      group radio system
      
  service audio-daemon /system/bin/audiocmdservice_atci
      class main
      socket atci-audio stream 660 root system
      user root
      disabled
      oneshot
  
  service md_minilog_util /system/bin/md_minilog_util
      user root
      disabled
      oneshot
  
  service surfaceflinger /system/bin/surfaceflinger
      class main
  #    user system
      group graphics
      onrestart restart zygote
  
  service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
      class main
      socket zygote stream 660 root system
      onrestart write /sys/android_power/request_state wake
      onrestart write /sys/power/state on
      onrestart restart media
      onrestart restart netd
  
  #
  # MT6620 related services (Begin)
  #
  
  service hald /system/bin/hald
      class main
      socket hald stream 0660 root system
      
  service wpa_supplicant /system/bin/logwrapper /system/bin/wpa_supplicant
      group wifi
      disabled
      oneshot    
  
  service p2p_supplicant /system/bin/logwrapper /system/bin/p2p_supplicant
      group wifi
      disabled
      oneshot
    
  #
  # MT6620 related services (End)
  #
  
  service dhcpcd_wlan0 /system/bin/logwrapper /system/bin/dhcpcd -A -BK -dd
      class main
      disabled
      oneshot
  
  service dhcpcd_p2p /system/bin/logwrapper /system/bin/dhcpcd -A -BK -dd
      class main
      disabled
      oneshot
  
  service iprenew_wlan0 /system/bin/logwrapper /system/bin/dhcpcd -n
      class main
      disabled
      oneshot
  
  service DMAgent /system/bin/dm_agent_binder
      user root
  
  service drm /system/bin/drmserver
      class main
      user drm
      group system audio sdcard_rw net_raw inet drmrpc
  
  service media /system/bin/mediaserver
      class main
      user root
      group audio camera graphics inet net_bt net_bt_admin net_bw_acct drmrpc
      ioprio rt 4
  
  service mtkGD /system/bin/mtkGD
      class main
      user system
      group system
  
  service bootanim /system/bin/bootanimation
      class main
      user graphics
      group graphics
      disabled
      oneshot
  
  service dbus /system/bin/dbus-daemon --system --nofork
      class main
      socket dbus stream 660 bluetooth bluetooth
      user bluetooth
      group bluetooth net_bt_admin
  
  service bluetoothd /system/bin/bluetoothd -n
      class main
      socket bluetooth stream 660 bluetooth bluetooth
      socket dbus_bluetooth stream 660 bluetooth bluetooth
      # init.rc does not yet support applying capabilities, so run as root and
      # let bluetoothd drop uid to bluetooth with the right linux capabilities
      group bluetooth net_bt_admin misc
      disabled
  
  service mtkbt /system/bin/mtkbt
      socket bt.int.adp dgram 660 bluetooth net_bt
      socket bt.a2dp.stream dgram 660 bluetooth net_bt
      user bluetooth
      group net_bt bluetooth net_bt_admin sdcard_rw inet net_admin nvram net_raw
      oneshot
  
  
  service mdpd /system/bin/mdpd
      user system
      group system
  
  
  #
  #  Modem related services (Begin)
  #
  
  service ccci_fsd /system/bin/ccci_fsd
      user root
      class core
      oneshot
  
  service ccci_mdinit /system/bin/ccci_mdinit
      user root
      class core
      oneshot
  
  
  service pppd_gprs /system/etc/init.gprs-pppd file /etc/ppp/ppp_options
      user root
      group radio cache inet misc
          disabled
          oneshot
  
  #Add by T.Zh for ppp daemon
  service pppd /system/bin/pppd file /data/misc/ppp/ppp_options
      user root
      disabled 
      oneshot
  
  #
  #
  #  Modem related services (End)
  #
  
  
  service installd /system/bin/installd
      class main
      socket installd stream 600 system system
  
  service flash_recovery /system/etc/install-recovery.sh
      class main
      oneshot
  
  service sbchk /system/bin/sbchk
      oneshot
  
  service racoon /system/bin/racoon
      class main
      socket racoon stream 600 system system
      # IKE uses UDP port 500. Racoon will setuid to vpn after binding the port.
      group vpn net_admin inet
      disabled
      oneshot
  
  service mtpd /system/bin/mtpd
      class main
      socket mtpd stream 600 system system
      user vpn
      group vpn net_admin inet net_raw
      disabled
      oneshot
  
  service keystore /system/bin/keystore /data/misc/keystore
      class main
      user keystore
      group keystore
      socket keystore stream 666
  
  service dumpstate /system/bin/dumpstate -s
      class main
      socket dumpstate stream 0660 shell log
      disabled
      oneshot
  
  service agpsd /system/bin/mtk_agpsd
      class main
      socket agpsd stream 666 system system
  
  service mnld /system/xbin/mnld
      socket mnld stream 666 system system
      disabled
  
  service ipod /system/bin/logwrapper /system/bin/ipod
      user root
      group root
      disabled
  
  service GoogleOtaAgent /system/bin/GoogleOtaBinder
      user root
      
  service SDCardUpdateA /system/bin/SDCardUpdateBinder
      user root
          
  service mdlogger /system/bin/mdlogger
      class main
      disabled
      oneshot
  
  #
  #sensor service (begin)
  #
  
  service msensord /system/bin/msensord
      oneshot
      
  service ami304d /system/bin/logwrapper /system/bin/ami304d
      disabled
      oneshot
  
  service memsicd /system/bin/memsicd
       disabled
       oneshot
  
  service akmd8975 /system/bin/akmd8975
      disabled
      user compass
      group compass
  
  service orientationd /system/bin/orientationd
      disabled
      user compass
      group input
  
  service geomagneticd /system/bin/geomagneticd
      disabled
      user compass
      group system input
  #
  #sensor service (end)
  #
  
  #
  #emsvr service (start)
  #
  service emsvr /system/bin/em_svr
          user root
          
  service afmsvr /system/bin/afm_server
          user root
  
  #
  #emsvr service (end)
  #
  
  service shutdown /system/bin/logwrapper /system/bin/shutdown
      user root
      group root
      disabled
  
  service NvRAMAgent /system/bin/nvram_agent_binder
          user root
  
  service thermal_manager /system/bin/thermal_manager
      user root
      oneshot
  
  #service init.thermal /system/etc/init.thermal.sh
  #    user root
  #    oneshot
  
  #
  # MMProfile service
  #
  service mmp /system/bin/mmp read_config
      user root
      oneshot
  
  service sysctl /system/xbin/sysctld
      user root
      socket sysctl stream 0666 root root
      disabled

• Many  Services  are  started in init.rc

• 607 # SGX init
  608 service pvrsrvinit /system/vendor/bin/pvrsrvinit
  609     class main
  610     user root
  611     group root
  612     oneshot
  613 
  614 service servicemanager /system/bin/servicemanager
  615     class core
  616     user system
  617     group system
  618     critical
  619     onrestart restart zygote
  620     onrestart restart media
  621     onrestart restart surfaceflinger
  622     onrestart restart drm
  623 
  624 service vold /system/bin/vold
  625     class core
  626     socket vold stream 0660 root mount
  627     ioprio be 2
  628 
  629 service netd /system/bin/netd
  630     class main
  631     socket netd stream 0660 root system
  632     socket dnsproxyd stream 0660 root inet
  633     
  634 service netdiag /system/bin/netdiag
  635     class main
  636     socket netdiag stream 0666 root system 
  637     
  638 
  639 service nvram_daemon /system/bin/nvram_daemon
  640     class main
  641     user root
  642     group nvram
  643     oneshot
  

   

• install usb driver

• import init.usb.rc
  import init.xlog.rc

• setup the global environment

• export PATH /sbin:/vendor/bin:/system/sbin:/system/bin:/system/xbin
      export LD_LIBRARY_PATH /vendor/lib:/system/lib
      export ANDROID_BOOTLOGO 1
      export ANDROID_ROOT /system
      export ANDROID_ASSETS /system/app
      export ANDROID_DATA /data
      export EXTERNAL_STORAGE /mnt/sdcard
      export ASEC_MOUNTPOINT /mnt/asec
      export LOOP_MOUNTPOINT /mnt/obb
      export BOOTCLASSPATH /system/framework/core.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/apache-xml.jar:/system/framework/filterfw.jar:/system/framework/mediatek-framework.jar:/system/framework/secondary_framework.jar

• make directory and write device

•     # Directory-target for where the secure container
      # imagefile directory will be bind-mounted
      mkdir /mnt/secure/asec  0700 root root
  
      # Secure container public mount points.
      mkdir /mnt/asec  0700 root system
      mount tmpfs tmpfs /mnt/asec mode=0755,gid=1000
  
      # Filesystem image public mount points.
      mkdir /mnt/obb 0700 root system
      mount tmpfs tmpfs /mnt/obb mode=0755,gid=1000
  
      write /proc/sys/kernel/panic_on_oops 1
      write /proc/sys/kernel/hung_task_timeout_secs 0
      write /proc/cpu/alignment 4

  # Set this property so surfaceflinger is not started by system_init
      setprop system_init.startsurfaceflinger 0
      class_start core
      class_start main
      class_start default
  
  on nonencrypted
      class_start late_start
  
  on charger
      class_start charger
  
  on property:vold.decrypt=trigger_reset_main
      class_reset main

  # Update the second boot logo
  service bootlogoupdater /system/bin/boot_logo_updater
      oneshot
  
  service ueventd /sbin/ueventd
      class core
      critical
  
  service console /system/bin/sh
      class core
      console
      disabled
      user root
      group log
  
  on property:ro.debuggable=1
      start console
  
  # adbd is controlled via property triggers in init.<platform>.usb.rc
  service adbd /sbin/adbd
      class core
      disabled

ServiceManager(NativeService)

• service_manager.c

• /** Copyright 2008 The Android Open Source Project
   */
  
  #include <stdio.h>
  #include <stdlib.h>
  #include <errno.h>
  #include <fcntl.h>
  
  #include <private/android_filesystem_config.h>
  
  #include "binder.h"
  
  #if 0
  #define LOGI(x...) fprintf(stderr, "svcmgr: " x)
  #define LOGE(x...) fprintf(stderr, "svcmgr: " x)
  #else
  #define LOG_TAG "ServiceManager"
  #include <cutils/log.h>
  #endif
  
  /** TODO:
   * These should come from a config file or perhaps be
   * based on some namespace rules of some sort (media
   * uid can register media.*, etc)
   */
  static struct {
      unsigned uid;
      const char *name;
  } allowed[] = {
  #ifdef LVMX
      { AID_MEDIA, "com.lifevibes.mx.ipc" },
  #endif
      { AID_MEDIA, "media.audio_flinger" },
      { AID_MEDIA, "media.player" },
      { AID_MEDIA, "media.camera" },
      { AID_MEDIA, "media.audio_policy" },
      { AID_DRM,   "drm.drmManager" },
      { AID_NFC,   "nfc" },
      { AID_RADIO, "radio.phone" },
      { AID_RADIO, "radio.sms" },
      { AID_RADIO, "radio.phonesubinfo" },
      { AID_RADIO, "radio.simphonebook" },
  /** TODO: remove after phone services are updated: */
      { AID_RADIO, "phone" },
      { AID_RADIO, "sip" },
      { AID_RADIO, "isms" },
      { AID_RADIO, "iphonesubinfo" },
      { AID_RADIO, "simphonebook" },
  };
  
  void *svcmgr_handle;
  
  const char *str8(uint16_t *x)
  {
      static char buf[128];
      unsigned max = 127;
      char *p = buf;
  
      if (x) {
          while (*x && max--) {
              *p++ = *x++;
          }
      }
      *p++ = 0;
      return buf;
  }
  
  int str16eq(uint16_t *a, const char *b)
  {
      while (*a && *b)
          if (*a++ != *b++) return 0;
      if (*a || *b)
          return 0;
      return 1;
  }
  
  int svc_can_register(unsigned uid, uint16_t *name)
  {
      unsigned n;
      
      if ((uid == 0) || (uid == AID_SYSTEM))
          return 1;
  
      for (n = 0; n < sizeof(allowed) / sizeof(allowed[0]); n++)
          if ((uid == allowed[n].uid) && str16eq(name, allowed[n].name))
              return 1;
  
      return 0;
  }
  
  struct svcinfo 
  {
      struct svcinfo *next;
      void *ptr;
      struct binder_death death;
      unsigned len;
      uint16_t name[0];
  };
  
  struct svcinfo *svclist = 0;
  
  struct svcinfo *find_svc(uint16_t *s16, unsigned len)
  {
      struct svcinfo *si;
  
      for (si = svclist; si; si = si->next) {
          if ((len == si->len) &&
              !memcmp(s16, si->name, len * sizeof(uint16_t))) {
              return si;
          }
      }
      return 0;
  }
  
  void svcinfo_death(struct binder_state *bs, void *ptr)
  {
      struct svcinfo *si = ptr;
      LOGI("service '%s' died\n", str8(si->name));
      if (si->ptr) {
          binder_release(bs, si->ptr);
          si->ptr = 0;
      }   
  }
  
  uint16_t svcmgr_id[] = { 
      'a','n','d','r','o','i','d','.','o','s','.',
      'I','S','e','r','v','i','c','e','M','a','n','a','g','e','r' 
  };
    
  
  void *do_find_service(struct binder_state *bs, uint16_t *s, unsigned len)
  {
      struct svcinfo *si;
      si = find_svc(s, len);
  
  //    LOGI("check_service('%s') ptr = %p\n", str8(s), si ? si->ptr : 0);
      if (si && si->ptr) {
          return si->ptr;
      } else {
          return 0;
      }
  }
  
  int do_add_service(struct binder_state *bs,
                     uint16_t *s, unsigned len,
                     void *ptr, unsigned uid)
  {
      struct svcinfo *si;
  //    LOGI("add_service('%s',%p) uid=%d\n", str8(s), ptr, uid);
  
      if (!ptr || (len == 0) || (len > 127))
          return -1;
  
      if (!svc_can_register(uid, s)) {
          LOGE("add_service('%s',%p) uid=%d - PERMISSION DENIED\n",
               str8(s), ptr, uid);
          return -1;
      }
  
      si = find_svc(s, len);
      if (si) {
          if (si->ptr) {
              LOGE("add_service('%s',%p) uid=%d - ALREADY REGISTERED, OVERRIDE\n",
                   str8(s), ptr, uid);
              svcinfo_death(bs, si);
          }
          si->ptr = ptr;
      } else {
          si = malloc(sizeof(*si) + (len + 1) * sizeof(uint16_t));
          if (!si) {
              LOGE("add_service('%s',%p) uid=%d - OUT OF MEMORY\n",
                   str8(s), ptr, uid);
              return -1;
          }
          si->ptr = ptr;
          si->len = len;
          memcpy(si->name, s, (len + 1) * sizeof(uint16_t));
          si->name[len] = '\0';
          si->death.func = svcinfo_death;
          si->death.ptr = si;
          si->next = svclist;
          svclist = si;
      }
  
      binder_acquire(bs, ptr);
      binder_link_to_death(bs, ptr, &si->death);
      return 0;
  }
  
  int svcmgr_handler(struct binder_state *bs,
                     struct binder_txn *txn,
                     struct binder_io *msg,
                     struct binder_io *reply)
  {
      struct svcinfo *si;
      uint16_t *s;
      unsigned len;
      void *ptr;
      uint32_t strict_policy;
  
  //    LOGI("target=%p code=%d pid=%d uid=%d\n",
  //         txn->target, txn->code, txn->sender_pid, txn->sender_euid);
  
      if (txn->target != svcmgr_handle)
          return -1;
  
      // Equivalent to Parcel::enforceInterface(), reading the RPC
      // header with the strict mode policy mask and the interface name.
      // Note that we ignore the strict_policy and don't propagate it
      // further (since we do no outbound RPCs anyway).
      strict_policy = bio_get_uint32(msg);
      s = bio_get_string16(msg, &len);
      if ((len != (sizeof(svcmgr_id) / 2)) ||
          memcmp(svcmgr_id, s, sizeof(svcmgr_id))) {
          fprintf(stderr,"invalid id %s\n", str8(s));
          return -1;
      }
  
      switch(txn->code) {
      case SVC_MGR_GET_SERVICE:
      case SVC_MGR_CHECK_SERVICE:
          s = bio_get_string16(msg, &len);
          ptr = do_find_service(bs, s, len);
          if (!ptr)
              break;
          bio_put_ref(reply, ptr);
          return 0;
  
      case SVC_MGR_ADD_SERVICE:
          s = bio_get_string16(msg, &len);
          ptr = bio_get_ref(msg);
          if (do_add_service(bs, s, len, ptr, txn->sender_euid))
              return -1;
          break;
  
      case SVC_MGR_LIST_SERVICES: {
          unsigned n = bio_get_uint32(msg);
  
          si = svclist;
          while ((n-- > 0) && si)
              si = si->next;
          if (si) {
              bio_put_string16(reply, si->name);
              return 0;
          }
          return -1;
      }
      default:
          LOGE("unknown code %d\n", txn->code);
          return -1;
      }
  
      bio_put_uint32(reply, 0);
      return 0;
  }
  
  int main(int argc, char **argv)
  {
      struct binder_state *bs;
      void *svcmgr = BINDER_SERVICE_MANAGER;
  
      bs = binder_open(128*1024);
  
      if (binder_become_context_manager(bs)) {
          LOGE("cannot become context manager (%s)\n", strerror(errno));
          return -1;
      }
  
      svcmgr_handle = svcmgr;
      binder_loop(bs, svcmgr_handler);
      return 0;
  }

• service in init.rc

• service servicemanager /system/bin/servicemanager
      class core
      user system
      group system
      critical
      onrestart restart zygote
      onrestart restart media
      onrestart restart surfaceflinger
      onrestart restart drm

• main() in service_manager

• int main(int argc, char **argv)
  {
      struct binder_state *bs;
      void *svcmgr = BINDER_SERVICE_MANAGER;//#define BINDER_SERVICE_MANAGER ((void*) 0),magic object
  
      bs = binder_open(128*1024);
  
      if (binder_become_context_manager(bs)) {
          LOGE("cannot become context manager (%s)\n", strerror(errno));
          return -1;
      }
  
      svcmgr_handle = svcmgr;
      binder_loop(bs, svcmgr_handler);//handler to handle with adding or finding service
      return 0;
  } 

• struct svcinfo in service manager

• struct svcinfo 
  {
      struct svcinfo *next;
      void *ptr;
      struct binder_death death;
      unsigned len;
      uint16_t name[0];
  };

•  add service in service_manager

• int do_add_service(struct binder_state *bs,uint16_t *s, unsigned len,void *ptr, unsigned uid)
  {
      struct svcinfo *si;
      if (!ptr || (len == 0) || (len > 127))
          return -1;
      if (!svc_can_register(uid, s)) {
          LOGE("add_service('%s',%p) uid=%d - PERMISSION DENIED\n",
               str8(s), ptr, uid);
          return -1;
      }
      si = find_svc(s, len);
      if (si) {
          if (si->ptr) {
              LOGE("add_service('%s',%p) uid=%d - ALREADY REGISTERED, OVERRIDE\n",
                   str8(s), ptr, uid);
              svcinfo_death(bs, si);
          }
          si->ptr = ptr;
      } else {
          si = malloc(sizeof(*si) + (len + 1) * sizeof(uint16_t));
          if (!si) {
              LOGE("add_service('%s',%p) uid=%d - OUT OF MEMORY\n",
                   str8(s), ptr, uid);
              return -1;
          }
          si->ptr = ptr;
          si->len = len;
          memcpy(si->name, s, (len + 1) * sizeof(uint16_t));
          si->name[len] = '\0';
          si->death.func = svcinfo_death;
          si->death.ptr = si;
          si->next = svclist;
          svclist = si;
      }
      binder_acquire(bs, ptr);
      binder_link_to_death(bs, ptr, &si->death);
      return 0;
  }

• int svcmgr_handler(struct binder_state *bs,
                     struct binder_txn *txn,
                     struct binder_io *msg,
                     struct binder_io *reply)
  {
      struct svcinfo *si;
      uint16_t *s;
      unsigned len;
      void *ptr;
      uint32_t strict_policy;
      if (txn->target != svcmgr_handle)
          return -1;
      strict_policy = bio_get_uint32(msg);
      s = bio_get_string16(msg, &len);
      if ((len != (sizeof(svcmgr_id) / 2)) ||
          memcmp(svcmgr_id, s, sizeof(svcmgr_id))) {
          fprintf(stderr,"invalid id %s\n", str8(s));
          return -1;
      }
      switch(txn->code) {
      case SVC_MGR_GET_SERVICE:
      case SVC_MGR_CHECK_SERVICE:
          s = bio_get_string16(msg, &len);
          ptr = do_find_service(bs, s, len);
          if (!ptr) break;
          bio_put_ref(reply, ptr);
          return 0;
      case SVC_MGR_ADD_SERVICE:
          s = bio_get_string16(msg, &len);
          ptr = bio_get_ref(msg);
          if (do_add_service(bs, s, len, ptr, txn->sender_euid))
              return -1;
          break;
      case SVC_MGR_LIST_SERVICES: {
          unsigned n = bio_get_uint32(msg);
          si = svclist;
          while ((n-- > 0) && si)
              si = si->next;
          if (si) {
              bio_put_string16(reply, si->name);
              return 0;
          }
          return -1;
      }
      default:
          LOGE("unknown code %d\n", txn->code);
          return -1;
      }
      bio_put_uint32(reply, 0);
      return 0;
  }

• bind.h

• /** Copyright 2008 The Android Open Source Project
   */
  
  #ifndef _BINDER_H_
  #define _BINDER_H_
  
  #include <sys/ioctl.h>
  #include <linux/binder.h>
  
  struct binder_state;
  
  struct binder_object
  {
      uint32_t type;
      uint32_t flags;
      void *pointer;
      void *cookie;
  };
  
  struct binder_txn
  {
      void *target;
      void *cookie;
      uint32_t code;
      uint32_t flags;
  
      uint32_t sender_pid;
      uint32_t sender_euid;
  
      uint32_t data_size;
      uint32_t offs_size;
      void *data;
      void *offs;
  };
  
  struct binder_io
  {
      char *data;            /** pointer to read/write from */
      uint32_t *offs;        /** array of offsets */
      uint32_t data_avail;   /** bytes available in data buffer */
      uint32_t offs_avail;   /** entries available in offsets array */
  
      char *data0;           /** start of data buffer */
      uint32_t *offs0;       /** start of offsets buffer */
      uint32_t flags;
      uint32_t unused;
  };
  
  struct binder_death {
      void (*func)(struct binder_state *bs, void *ptr);
      void *ptr;
  };    
  
  /** the one magic object */
  #define BINDER_SERVICE_MANAGER ((void*) 0)
  
  #define SVC_MGR_NAME "android.os.IServiceManager"
  
  enum {
      SVC_MGR_GET_SERVICE = 1,
      SVC_MGR_CHECK_SERVICE,
      SVC_MGR_ADD_SERVICE,
      SVC_MGR_LIST_SERVICES,
  };
  
  typedef int (*binder_handler)(struct binder_state *bs,
                                struct binder_txn *txn,
                                struct binder_io *msg,
                                struct binder_io *reply);
  
  struct binder_state *binder_open(unsigned mapsize);
  void binder_close(struct binder_state *bs);
  
  /** initiate a blocking binder call
   * - returns zero on success
   */
  int binder_call(struct binder_state *bs,
                  struct binder_io *msg, struct binder_io *reply,
                  void *target, uint32_t code);
  
  /** release any state associate with the binder_io
   * - call once any necessary data has been extracted from the
   *   binder_io after binder_call() returns
   * - can safely be called even if binder_call() fails
   */
  void binder_done(struct binder_state *bs,
                   struct binder_io *msg, struct binder_io *reply);
  
  /** manipulate strong references */
  void binder_acquire(struct binder_state *bs, void *ptr);
  void binder_release(struct binder_state *bs, void *ptr);
  
  void binder_link_to_death(struct binder_state *bs, void *ptr, struct binder_death *death);
  
  void binder_loop(struct binder_state *bs, binder_handler func);
  
  int binder_become_context_manager(struct binder_state *bs);
  
  /** allocate a binder_io, providing a stack-allocated working
   * buffer, size of the working buffer, and how many object
   * offset entries to reserve from the buffer
   */
  void bio_init(struct binder_io *bio, void *data,
             uint32_t maxdata, uint32_t maxobjects);
  
  void bio_destroy(struct binder_io *bio);
  
  void bio_put_obj(struct binder_io *bio, void *ptr);
  void bio_put_ref(struct binder_io *bio, void *ptr);
  void bio_put_uint32(struct binder_io *bio, uint32_t n);
  void bio_put_string16(struct binder_io *bio, const uint16_t *str);
  void bio_put_string16_x(struct binder_io *bio, const char *_str);
  
  uint32_t bio_get_uint32(struct binder_io *bio);
  uint16_t *bio_get_string16(struct binder_io *bio, uint32_t *sz);
  void *bio_get_obj(struct binder_io *bio);
  void *bio_get_ref(struct binder_io *bio);
  
  #endif

• struct of bind

• struct binder_state
  {
      int fd;
      void *mapped;
      unsigned mapsize;
  };
  struct binder_object
  {
      uint32_t type;
      uint32_t flags;
      void *pointer;
      void *cookie;
  };
  struct binder_io
  {
      char *data;            /** pointer to read/write from */
      uint32_t *offs;        /** array of offsets */
      uint32_t data_avail;   /** bytes available in data buffer */
      uint32_t offs_avail;   /** entries available in offsets array */
      char *data0;           /** start of data buffer */
      uint32_t *offs0;       /** start of offsets buffer */
      uint32_t flags;
      uint32_t unused;
  };
  struct binder_death {
      void (*func)(struct binder_state *bs, void *ptr);
      void *ptr;
  };

• bind.c

• /** Copyright 2008 The Android Open Source Project
   */
  
  #include <stdio.h>
  #include <stdlib.h>
  #include <errno.h>
  #include <unistd.h>
  #include <fcntl.h>
  #include <sys/mman.h>
  
  #include "binder.h"
  
  #define MAX_BIO_SIZE (1 << 30)
  
  #define TRACE 0
  
  #define LOG_TAG "Binder"
  #include <cutils/log.h>
  
  void bio_init_from_txn(struct binder_io *io, struct binder_txn *txn);
  
  #if TRACE
  void hexdump(void *_data, unsigned len)
  {
      unsigned char *data = _data;
      unsigned count;
  
      for (count = 0; count < len; count++) {
          if ((count & 15) == 0)
              fprintf(stderr,"%04x:", count);
          fprintf(stderr," %02x %c", *data,
                  (*data < 32) || (*data > 126) ? '.' : *data);
          data++;
          if ((count & 15) == 15)
              fprintf(stderr,"\n");
      }
      if ((count & 15) != 0)
          fprintf(stderr,"\n");
  }
  
  void binder_dump_txn(struct binder_txn *txn)
  {
      struct binder_object *obj;
      unsigned *offs = txn->offs;
      unsigned count = txn->offs_size / 4;
  
      fprintf(stderr,"  target %p  cookie %p  code %08x  flags %08x\n",
              txn->target, txn->cookie, txn->code, txn->flags);
      fprintf(stderr,"  pid %8d  uid %8d  data %8d  offs %8d\n",
              txn->sender_pid, txn->sender_euid, txn->data_size, txn->offs_size);
      hexdump(txn->data, txn->data_size);
      while (count--) {
          obj = (void*) (((char*) txn->data) + *offs++);
          fprintf(stderr,"  - type %08x  flags %08x  ptr %p  cookie %p\n",
                  obj->type, obj->flags, obj->pointer, obj->cookie);
      }
  }
  
  #define NAME(n) case n: return #n
  const char *cmd_name(uint32_t cmd)
  {
      switch(cmd) {
          NAME(BR_NOOP);
          NAME(BR_TRANSACTION_COMPLETE);
          NAME(BR_INCREFS);
          NAME(BR_ACQUIRE);
          NAME(BR_RELEASE);
          NAME(BR_DECREFS);
          NAME(BR_TRANSACTION);
          NAME(BR_REPLY);
          NAME(BR_FAILED_REPLY);
          NAME(BR_DEAD_REPLY);
          NAME(BR_DEAD_BINDER);
      default: return "???";
      }
  }
  #else
  #define hexdump(a,b) do{} while (0)
  #define binder_dump_txn(txn)  do{} while (0)
  #endif
  
  #define BIO_F_SHARED    0x01  /** needs to be buffer freed */
  #define BIO_F_OVERFLOW  0x02  /** ran out of space */
  #define BIO_F_IOERROR   0x04
  #define BIO_F_MALLOCED  0x08  /** needs to be free()'d */
  
  struct binder_state
  {
      int fd;
      void *mapped;
      unsigned mapsize;
  };
  
  struct binder_state *binder_open(unsigned mapsize)
  {
      struct binder_state *bs;
  
      bs = malloc(sizeof(*bs));
      if (!bs) {
          errno = ENOMEM;
          return 0;
      }
  
      bs->fd = open("/dev/binder", O_RDWR);
      if (bs->fd < 0) {
          fprintf(stderr,"binder: cannot open device (%s)\n",
                  strerror(errno));
          goto fail_open;
      }
  
      bs->mapsize = mapsize;
      bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);
      if (bs->mapped == MAP_FAILED) {
          fprintf(stderr,"binder: cannot map device (%s)\n",
                  strerror(errno));
          goto fail_map;
      }
  
          /** TODO: check version */
  
      return bs;
  
  fail_map:
      close(bs->fd);
  fail_open:
      free(bs);
      return 0;
  }
  
  void binder_close(struct binder_state *bs)
  {
      munmap(bs->mapped, bs->mapsize);
      close(bs->fd);
      free(bs);
  }
  
  int binder_become_context_manager(struct binder_state *bs)
  {
      return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
  }
  
  int binder_write(struct binder_state *bs, void *data, unsigned len)
  {
      struct binder_write_read bwr;
      int res;
      bwr.write_size = len;
      bwr.write_consumed = 0;
      bwr.write_buffer = (unsigned) data;
      bwr.read_size = 0;
      bwr.read_consumed = 0;
      bwr.read_buffer = 0;
      res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
      if (res < 0) {
          fprintf(stderr,"binder_write: ioctl failed (%s)\n",
                  strerror(errno));
      }
      return res;
  }
  
  void binder_send_reply(struct binder_state *bs,
                         struct binder_io *reply,
                         void *buffer_to_free,
                         int status)
  {
      struct {
          uint32_t cmd_free;
          void *buffer;
          uint32_t cmd_reply;
          struct binder_txn txn;
      } __attribute__((packed)) data;
  
      data.cmd_free = BC_FREE_BUFFER;
      data.buffer = buffer_to_free;
      data.cmd_reply = BC_REPLY;
      data.txn.target = 0;
      data.txn.cookie = 0;
      data.txn.code = 0;
      if (status) {
          data.txn.flags = TF_STATUS_CODE;
          data.txn.data_size = sizeof(int);
          data.txn.offs_size = 0;
          data.txn.data = &status;
          data.txn.offs = 0;
      } else {
          data.txn.flags = 0;
          data.txn.data_size = reply->data - reply->data0;
          data.txn.offs_size = ((char*) reply->offs) - ((char*) reply->offs0);
          data.txn.data = reply->data0;
          data.txn.offs = reply->offs0;
      }
      binder_write(bs, &data, sizeof(data));
  }
  
  int binder_parse(struct binder_state *bs, struct binder_io *bio,
                   uint32_t *ptr, uint32_t size, binder_handler func)
  {
      int r = 1;
      uint32_t *end = ptr + (size / 4);
  
      while (ptr < end) {
          uint32_t cmd = *ptr++;
  #if TRACE
          fprintf(stderr,"%s:\n", cmd_name(cmd));
  #endif
          switch(cmd) {
          case BR_NOOP:
              break;
          case BR_TRANSACTION_COMPLETE:
              break;
          case BR_INCREFS:
          case BR_ACQUIRE:
          case BR_RELEASE:
          case BR_DECREFS:
  #if TRACE
              fprintf(stderr,"  %08x %08x\n", ptr[0], ptr[1]);
  #endif
              ptr += 2;
              break;
          case BR_TRANSACTION: {
              struct binder_txn *txn = (void *) ptr;
              if ((end - ptr) * sizeof(uint32_t) < sizeof(struct binder_txn)) {
                  LOGE("parse: txn too small!\n");
                  return -1;
              }
              binder_dump_txn(txn);
              if (func) {
                  unsigned rdata[256/4];
                  struct binder_io msg;
                  struct binder_io reply;
                  int res;
  
                  bio_init(&reply, rdata, sizeof(rdata), 4);
                  bio_init_from_txn(&msg, txn);
                  res = func(bs, txn, &msg, &reply);
                  binder_send_reply(bs, &reply, txn->data, res);
              }
              ptr += sizeof(*txn) / sizeof(uint32_t);
              break;
          }
          case BR_REPLY: {
              struct binder_txn *txn = (void*) ptr;
              if ((end - ptr) * sizeof(uint32_t) < sizeof(struct binder_txn)) {
                  LOGE("parse: reply too small!\n");
                  return -1;
              }
              binder_dump_txn(txn);
              if (bio) {
                  bio_init_from_txn(bio, txn);
                  bio = 0;
              } else {
                      /** todo FREE BUFFER */
              }
              ptr += (sizeof(*txn) / sizeof(uint32_t));
              r = 0;
              break;
          }
          case BR_DEAD_BINDER: {
              struct binder_death *death = (void*) *ptr++;
              death->func(bs, death->ptr);
              break;
          }
          case BR_FAILED_REPLY:
              r = -1;
              break;
          case BR_DEAD_REPLY:
              r = -1;
              break;
          default:
              LOGE("parse: OOPS %d\n", cmd);
              return -1;
          }
      }
  
      return r;
  }
  
  void binder_acquire(struct binder_state *bs, void *ptr)
  {
      uint32_t cmd[2];
      cmd[0] = BC_ACQUIRE;
      cmd[1] = (uint32_t) ptr;
      binder_write(bs, cmd, sizeof(cmd));
  }
  
  void binder_release(struct binder_state *bs, void *ptr)
  {
      uint32_t cmd[2];
      cmd[0] = BC_RELEASE;
      cmd[1] = (uint32_t) ptr;
      binder_write(bs, cmd, sizeof(cmd));
  }
  
  void binder_link_to_death(struct binder_state *bs, void *ptr, struct binder_death *death)
  {
      uint32_t cmd[3];
      cmd[0] = BC_REQUEST_DEATH_NOTIFICATION;
      cmd[1] = (uint32_t) ptr;
      cmd[2] = (uint32_t) death;
      binder_write(bs, cmd, sizeof(cmd));
  }
  
  
  int binder_call(struct binder_state *bs,
                  struct binder_io *msg, struct binder_io *reply,
                  void *target, uint32_t code)
  {
      int res;
      struct binder_write_read bwr;
      struct {
          uint32_t cmd;
          struct binder_txn txn;
      } writebuf;
      unsigned readbuf[32];
  
      if (msg->flags & BIO_F_OVERFLOW) {
          fprintf(stderr,"binder: txn buffer overflow\n");
          goto fail;
      }
  
      writebuf.cmd = BC_TRANSACTION;
      writebuf.txn.target = target;
      writebuf.txn.code = code;
      writebuf.txn.flags = 0;
      writebuf.txn.data_size = msg->data - msg->data0;
      writebuf.txn.offs_size = ((char*) msg->offs) - ((char*) msg->offs0);
      writebuf.txn.data = msg->data0;
      writebuf.txn.offs = msg->offs0;
  
      bwr.write_size = sizeof(writebuf);
      bwr.write_consumed = 0;
      bwr.write_buffer = (unsigned) &writebuf;
      
      hexdump(msg->data0, msg->data - msg->data0);
      for (;;) {
          bwr.read_size = sizeof(readbuf);
          bwr.read_consumed = 0;
          bwr.read_buffer = (unsigned) readbuf;
  
          res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
  
          if (res < 0) {
              fprintf(stderr,"binder: ioctl failed (%s)\n", strerror(errno));
              goto fail;
          }
  
          res = binder_parse(bs, reply, readbuf, bwr.read_consumed, 0);
          if (res == 0) return 0;
          if (res < 0) goto fail;
      }
  
  fail:
      memset(reply, 0, sizeof(*reply));
      reply->flags |= BIO_F_IOERROR;
      return -1;
  }
  
  void binder_loop(struct binder_state *bs, binder_handler func)
  {
      int res;
      struct binder_write_read bwr;
      unsigned readbuf[32];
  
      bwr.write_size = 0;
      bwr.write_consumed = 0;
      bwr.write_buffer = 0;
      
      readbuf[0] = BC_ENTER_LOOPER;
      binder_write(bs, readbuf, sizeof(unsigned));
  
      for (;;) {
          bwr.read_size = sizeof(readbuf);
          bwr.read_consumed = 0;
          bwr.read_buffer = (unsigned) readbuf;
  
          res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
  
          if (res < 0) {
              LOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));
              break;
          }
  
          res = binder_parse(bs, 0, readbuf, bwr.read_consumed, func);
          if (res == 0) {
              LOGE("binder_loop: unexpected reply?!\n");
              break;
          }
          if (res < 0) {
              LOGE("binder_loop: io error %d %s\n", res, strerror(errno));
              break;
          }
      }
  }
  
  void bio_init_from_txn(struct binder_io *bio, struct binder_txn *txn)
  {
      bio->data = bio->data0 = txn->data;
      bio->offs = bio->offs0 = txn->offs;
      bio->data_avail = txn->data_size;
      bio->offs_avail = txn->offs_size / 4;
      bio->flags = BIO_F_SHARED;
  }
  
  void bio_init(struct binder_io *bio, void *data,
                uint32_t maxdata, uint32_t maxoffs)
  {
      uint32_t n = maxoffs * sizeof(uint32_t);
  
      if (n > maxdata) {
          bio->flags = BIO_F_OVERFLOW;
          bio->data_avail = 0;
          bio->offs_avail = 0;
          return;
      }
  
      bio->data = bio->data0 = data + n;
      bio->offs = bio->offs0 = data;
      bio->data_avail = maxdata - n;
      bio->offs_avail = maxoffs;
      bio->flags = 0;
  }
  
  static void *bio_alloc(struct binder_io *bio, uint32_t size)
  {
      size = (size + 3) & (~3);
      if (size > bio->data_avail) {
          bio->flags |= BIO_F_OVERFLOW;
          return 0;
      } else {
          void *ptr = bio->data;
          bio->data += size;
          bio->data_avail -= size;
          return ptr;
      }
  }
  
  void binder_done(struct binder_state *bs,
                   struct binder_io *msg,
                   struct binder_io *reply)
  {
      if (reply->flags & BIO_F_SHARED) {
          uint32_t cmd[2];
          cmd[0] = BC_FREE_BUFFER;
          cmd[1] = (uint32_t) reply->data0;
          binder_write(bs, cmd, sizeof(cmd));
          reply->flags = 0;
      }
  }
  
  static struct binder_object *bio_alloc_obj(struct binder_io *bio)
  {
      struct binder_object *obj;
  
      obj = bio_alloc(bio, sizeof(*obj));
      
      if (obj && bio->offs_avail) {
          bio->offs_avail--;
          *bio->offs++ = ((char*) obj) - ((char*) bio->data0);
          return obj;
      }
  
      bio->flags |= BIO_F_OVERFLOW;
      return 0;
  }
  
  void bio_put_uint32(struct binder_io *bio, uint32_t n)
  {
      uint32_t *ptr = bio_alloc(bio, sizeof(n));
      if (ptr)
          *ptr = n;
  }
  
  void bio_put_obj(struct binder_io *bio, void *ptr)
  {
      struct binder_object *obj;
  
      obj = bio_alloc_obj(bio);
      if (!obj)
          return;
  
      obj->flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
      obj->type = BINDER_TYPE_BINDER;
      obj->pointer = ptr;
      obj->cookie = 0;
  }
  
  void bio_put_ref(struct binder_io *bio, void *ptr)
  {
      struct binder_object *obj;
  
      if (ptr)
          obj = bio_alloc_obj(bio);
      else
          obj = bio_alloc(bio, sizeof(*obj));
  
      if (!obj)
          return;
  
      obj->flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
      obj->type = BINDER_TYPE_HANDLE;
      obj->pointer = ptr;
      obj->cookie = 0;
  }
  
  void bio_put_string16(struct binder_io *bio, const uint16_t *str)
  {
      uint32_t len;
      uint16_t *ptr;
  
      if (!str) {
          bio_put_uint32(bio, 0xffffffff);
          return;
      }
  
      len = 0;
      while (str[len]) len++;
  
      if (len >= (MAX_BIO_SIZE / sizeof(uint16_t))) {
          bio_put_uint32(bio, 0xffffffff);
          return;
      }
  
      bio_put_uint32(bio, len);
      len = (len + 1) * sizeof(uint16_t);
      ptr = bio_alloc(bio, len);
      if (ptr)
          memcpy(ptr, str, len);
  }
  
  void bio_put_string16_x(struct binder_io *bio, const char *_str)
  {
      unsigned char *str = (unsigned char*) _str;
      uint32_t len;
      uint16_t *ptr;
  
      if (!str) {
          bio_put_uint32(bio, 0xffffffff);
          return;
      }
  
      len = strlen(_str);
  
      if (len >= (MAX_BIO_SIZE / sizeof(uint16_t))) {
          bio_put_uint32(bio, 0xffffffff);
          return;
      }
  
      bio_put_uint32(bio, len);
      ptr = bio_alloc(bio, (len + 1) * sizeof(uint16_t));
      if (!ptr)
          return;
  
      while (*str)
          *ptr++ = *str++;
      *ptr++ = 0;
  }
  
  static void *bio_get(struct binder_io *bio, uint32_t size)
  {
      size = (size + 3) & (~3);
  
      if (bio->data_avail < size){
          bio->data_avail = 0;
          bio->flags |= BIO_F_OVERFLOW;
          return 0;
      }  else {
          void *ptr = bio->data;
          bio->data += size;
          bio->data_avail -= size;
          return ptr;
      }
  }
  
  uint32_t bio_get_uint32(struct binder_io *bio)
  {
      uint32_t *ptr = bio_get(bio, sizeof(*ptr));
      return ptr ? *ptr : 0;
  }
  
  uint16_t *bio_get_string16(struct binder_io *bio, unsigned *sz)
  {
      unsigned len;
      len = bio_get_uint32(bio);
      if (sz)
          *sz = len;
      return bio_get(bio, (len + 1) * sizeof(uint16_t));
  }
  
  static struct binder_object *_bio_get_obj(struct binder_io *bio)
  {
      unsigned n;
      unsigned off = bio->data - bio->data0;
  
          /** TODO: be smarter about this? */
      for (n = 0; n < bio->offs_avail; n++) {
          if (bio->offs[n] == off)
              return bio_get(bio, sizeof(struct binder_object));
      }
  
      bio->data_avail = 0;
      bio->flags |= BIO_F_OVERFLOW;
      return 0;
  }
  
  void *bio_get_ref(struct binder_io *bio)
  {
      struct binder_object *obj;
  
      obj = _bio_get_obj(bio);
      if (!obj)
          return 0;
  
      if (obj->type == BINDER_TYPE_HANDLE)
          return obj->pointer;
  
      return 0;
  }

• bind_loop in bind.c

• void binder_loop(struct binder_state *bs, binder_handler func)
  {
      int res;
      struct binder_write_read bwr;
      unsigned readbuf[32];
      bwr.write_size = 0;
      bwr.write_consumed = 0;
      bwr.write_buffer = 0;    
      readbuf[0] = BC_ENTER_LOOPER;
      binder_write(bs, readbuf, sizeof(unsigned));
      for (;;) {
          bwr.read_size = sizeof(readbuf);
          bwr.read_consumed = 0;
          bwr.read_buffer = (unsigned) readbuf;
          res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
          if (res < 0) {
              LOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));
              break;
          }
          res = binder_parse(bs, 0, readbuf, bwr.read_consumed, func);
          if (res == 0) {
              LOGE("binder_loop: unexpected reply?!\n");
              break;
          }
          if (res < 0) {
              LOGE("binder_loop: io error %d %s\n", res, strerror(errno));
              break;
          }
      }
  }

• parse

• int binder_parse(struct binder_state *bs, struct binder_io *bio,
                   uint32_t *ptr, uint32_t size, binder_handler func)
  {
      int r = 1;
      uint32_t *end = ptr + (size / 4);
      while (ptr < end) {
          uint32_t cmd = *ptr++;
  #if TRACE
          fprintf(stderr,"%s:\n", cmd_name(cmd));
  #endif
          switch(cmd) {
          case BR_NOOP:
              break;
          case BR_TRANSACTION_COMPLETE:
              break;
          case BR_INCREFS:
          case BR_ACQUIRE:
          case BR_RELEASE:
          case BR_DECREFS:
  #if TRACE
              fprintf(stderr,"  %08x %08x\n", ptr[0], ptr[1]);
  #endif
              ptr += 2;
              break;
          case BR_TRANSACTION: {
              struct binder_txn *txn = (void *) ptr;
              if ((end - ptr) * sizeof(uint32_t) < sizeof(struct binder_txn)) {
                  LOGE("parse: txn too small!\n");
                  return -1;
              }
              binder_dump_txn(txn);
              if (func) {
                  unsigned rdata[256/4];
                  struct binder_io msg;
                  struct binder_io reply;
                  int res;
                  bio_init(&reply, rdata, sizeof(rdata), 4);
                  bio_init_from_txn(&msg, txn);
                  res = func(bs, txn, &msg, &reply);
                  binder_send_reply(bs, &reply, txn->data, res);
              }
              ptr += sizeof(*txn) / sizeof(uint32_t);
              break;
          }
          case BR_REPLY: {
              struct binder_txn *txn = (void*) ptr;
              if ((end - ptr) * sizeof(uint32_t) < sizeof(struct binder_txn)) {
                  LOGE("parse: reply too small!\n");
                  return -1;
              }
              binder_dump_txn(txn);
              if (bio) {
                  bio_init_from_txn(bio, txn);
                  bio = 0;
              } else {
                      /** todo FREE BUFFER */
              }
              ptr += (sizeof(*txn) / sizeof(uint32_t));
              r = 0;
              break;
          }
          case BR_DEAD_BINDER: {
              struct binder_death *death = (void*) *ptr++;
              death->func(bs, death->ptr);
              break;
          }
          case BR_FAILED_REPLY:
              r = -1;
              break;
          case BR_DEAD_REPLY:
              r = -1;
              break;
          default:
              LOGE("parse: OOPS %d\n", cmd);
              return -1;
          }
      }
      return r;
  }

• open and close

• struct binder_state *binder_open(unsigned mapsize)
  {
      struct binder_state *bs;
      bs = malloc(sizeof(*bs));
      if (!bs) {
          errno = ENOMEM;
          return 0;
      }
      bs->fd = open("/dev/binder", O_RDWR);//open device
      if (bs->fd < 0) {
          fprintf(stderr,"binder: cannot open device (%s)\n",
                  strerror(errno));
          goto fail_open;
      }
      bs->mapsize = mapsize;
      bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);//memory map
      if (bs->mapped == MAP_FAILED) {
          fprintf(stderr,"binder: cannot map device (%s)\n",
                  strerror(errno));
          goto fail_map;
      }
      return bs;
  fail_map:
      close(bs->fd);
  fail_open:
      free(bs);
      return 0;
  }
  void binder_close(struct binder_state *bs)
  {
      munmap(bs->mapped, bs->mapsize);
      close(bs->fd);
      free(bs);
  }
  int binder_become_context_manager(struct binder_state *bs)
  {
      return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);//as manager
  } 

Service Zygote

• start service in init.rc

• service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
      class main
      socket zygote stream 660 root system
      onrestart write /sys/android_power/request_state wake
      onrestart write /sys/power/state on
      onrestart restart media
      onrestart restart netd

• app_main.cpp

• /**
   * Main entry of app process.
   *
   * Starts the interpreted runtime, then starts up the application.
   *
   */
  
  #define LOG_TAG "appproc"
  
  #include <binder/IPCThreadState.h>
  #include <binder/ProcessState.h>
  #include <utils/Log.h>
  #include <cutils/process_name.h>
  #include <cutils/memory.h>
  #include <android_runtime/AndroidRuntime.h>
  
  #include <stdio.h>
  #include <unistd.h>
  
  namespace android {
  
  void app_usage()
  {
      fprintf(stderr,
          "Usage: app_process [java-options] cmd-dir start-class-name [options]\n");
  }
  
  class AppRuntime : public AndroidRuntime
  {
  public:
      AppRuntime()
          : mParentDir(NULL)
          , mClassName(NULL)
          , mClass(NULL)
          , mArgC(0)
          , mArgV(NULL)
      {
      }
  
  #if 0
      // this appears to be unused
      const char* getParentDir() const
      {
          return mParentDir;
      }
  #endif
  
      const char* getClassName() const
      {
          return mClassName;
      }
  
      virtual void onVmCreated(JNIEnv* env)
      {
          if (mClassName == NULL) {
              return; // Zygote. Nothing to do here.
          }
  
          /**
           * This is a little awkward because the JNI FindClass call uses the
           * class loader associated with the native method we're executing in.
           * If called in onStarted (from RuntimeInit.finishInit because we're
           * launching "am", for example), FindClass would see that we're calling
           * from a boot class' native method, and so wouldn't look for the class
           * we're trying to look up in CLASSPATH. Unfortunately it needs to,
           * because the "am" classes are not boot classes.
           *
           * The easiest fix is to call FindClass here, early on before we start
           * executing boot class Java code and thereby deny ourselves access to
           * non-boot classes.
           */
          char* slashClassName = toSlashClassName(mClassName);
          mClass = env->FindClass(slashClassName);
          if (mClass == NULL) {
              LOGE("ERROR: could not find class '%s'\n", mClassName);
          }
          free(slashClassName);
  
          mClass = reinterpret_cast<jclass>(env->NewGlobalRef(mClass));
      }
  
      virtual void onStarted()
      {
          sp<ProcessState> proc = ProcessState::self();
          LOGV("App process: starting thread pool.\n");
          proc->startThreadPool();
  
          AndroidRuntime* ar = AndroidRuntime::getRuntime();
          ar->callMain(mClassName, mClass, mArgC, mArgV);
  
          IPCThreadState::self()->stopProcess();
      }
  
      virtual void onZygoteInit()
      {
          sp<ProcessState> proc = ProcessState::self();
          LOGV("App process: starting thread pool.\n");
          proc->startThreadPool();
      }
  
      virtual void onExit(int code)
      {
          if (mClassName == NULL) {
              // if zygote
              IPCThreadState::self()->stopProcess();
          }
  
          AndroidRuntime::onExit(code);
      }
  
  
      const char* mParentDir;
      const char* mClassName;
      jclass mClass;
      int mArgC;
      const char* const* mArgV;
  };
  
  }
  
  using namespace android;
  
  /**
   * sets argv0 to as much of newArgv0 as will fit
   */
  static void setArgv0(const char *argv0, const char *newArgv0)
  {
      strlcpy(const_cast<char *>(argv0), newArgv0, strlen(argv0));
  }
  
  int main(int argc, const char* const argv[])
  {
      // These are global variables in ProcessState.cpp
      mArgC = argc;
      mArgV = argv;
  
      mArgLen = 0;
      for (int i=0; i<argc; i++) {
          mArgLen += strlen(argv[i]) + 1;
      }
      mArgLen--;
  
      AppRuntime runtime;
      const char* argv0 = argv[0];
  
      // Process command line arguments
      // ignore argv[0]
      argc--;
      argv++;
  
      // Everything up to '--' or first non '-' arg goes to the vm
  
      int i = runtime.addVmArguments(argc, argv);
  
      // Parse runtime arguments.  Stop at first unrecognized option.
      bool zygote = false;
      bool startSystemServer = false;
      bool application = false;
      const char* parentDir = NULL;
      const char* niceName = NULL;
      const char* className = NULL;
      while (i < argc) {
          const char* arg = argv[i++];
          if (!parentDir) {
              parentDir = arg;
          } else if (strcmp(arg, "--zygote") == 0) {
              zygote = true;
              niceName = "zygote";
          } else if (strcmp(arg, "--start-system-server") == 0) {
              startSystemServer = true;
          } else if (strcmp(arg, "--application") == 0) {
              application = true;
          } else if (strncmp(arg, "--nice-name=", 12) == 0) {
              niceName = arg + 12;
          } else {
              className = arg;
              break;
          }
      }
  
      if (niceName && *niceName) {
          setArgv0(argv0, niceName);
          set_process_name(niceName);
      }
  
      runtime.mParentDir = parentDir;
  
      if (zygote) {
          runtime.start("com.android.internal.os.ZygoteInit",
                  startSystemServer ? "start-system-server" : "");
      } else if (className) {
          // Remainder of args get passed to startup class main()
          runtime.mClassName = className;
          runtime.mArgC = argc - i;
          runtime.mArgV = argv + i;
          runtime.start("com.android.internal.os.RuntimeInit",
                  application ? "application" : "tool");
      } else {
          fprintf(stderr, "Error: no class name or --zygote supplied.\n");
          app_usage();
          LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");
          return 10;
      }
  }

  int main(int argc, const char* const argv[])
  {
      // These are global variables in ProcessState.cpp
      mArgC = argc;
      mArgV = argv;
      mArgLen = 0;
      for (int i=0; i<argc; i++) {
          mArgLen += strlen(argv[i]) + 1;
      }
      mArgLen--;
      AppRuntime runtime;
      const char* argv0 = argv[0];
      argc--;
      argv++;
      int i = runtime.addVmArguments(argc, argv);
      bool zygote = false;
      bool startSystemServer = false;
      bool application = false;
      const char* parentDir = NULL;
      const char* niceName = NULL;
      const char* className = NULL;
      while (i < argc) {
          const char* arg = argv[i++];
          if (!parentDir) {
              parentDir = arg;
          } else if (strcmp(arg, "--zygote") == 0) {
              zygote = true;
              niceName = "zygote";
          } else if (strcmp(arg, "--start-system-server") == 0) {
              startSystemServer = true;
          } else if (strcmp(arg, "--application") == 0) {
              application = true;
          } else if (strncmp(arg, "--nice-name=", 12) == 0) {
              niceName = arg + 12;
          } else {
              className = arg;
              break;
          }
      }
      if (niceName && *niceName) {
          setArgv0(argv0, niceName);
          set_process_name(niceName);
      }
      runtime.mParentDir = parentDir;
      if (zygote) {
  runtime.start("com.android.internal.os.ZygoteInit",
                  startSystemServer ? "start-system-server" : "");
      } else if (className) {
          // Remainder of args get passed to startup class main()
          runtime.mClassName = className;
          runtime.mArgC = argc - i;
          runtime.mArgV = argv + i;
  runtime.start("com.android.internal.os.RuntimeInit",
                  application ? "application" : "tool");
      } else {
          fprintf(stderr, "Error: no class name or --zygote supplied.\n");
          app_usage();
          LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");
          return 10;
      }
  } 

• AndroidRuntime.h

• /**
   * Copyright (C) 2005 The Android Open Source Project
   *
   * Licensed under the Apache License, Version 2.0 (the "License");
   * you may not use this file except in compliance with the License.
   * You may obtain a copy of the License at
   *
   *      http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  //
  
  #ifndef _RUNTIME_ANDROID_RUNTIME_H
  #define _RUNTIME_ANDROID_RUNTIME_H
  
  #include <utils/Errors.h>
  #include <binder/IBinder.h>
  #include <utils/String8.h>
  #include <utils/String16.h>
  #include <utils/Vector.h>
  #include <utils/threads.h>
  #include <pthread.h>
  #include <nativehelper/jni.h>
  
  
  namespace android {
  
  class AndroidRuntime
  {
  public:
      AndroidRuntime();
      virtual ~AndroidRuntime();
  
      enum StartMode {
          Zygote,
          SystemServer,
          Application,
          Tool,
      };
  
      /***
       * Register a set of methods in the specified class.
       */
      static int registerNativeMethods(JNIEnv* env,
          const char* className, const JNINativeMethod* gMethods, int numMethods);
  
      /***
       * Call a class's static main method with the given arguments,
       */
      status_t callMain(const char* className, jclass clazz, int argc,
          const char* const argv[]);
  
      /***
       * Find a class, with the input either of the form
       * "package/class" or "package.class".
       */
      static jclass findClass(JNIEnv* env, const char* className);
  
      int addVmArguments(int argc, const char* const argv[]);
  
      void start(const char *classname, const char* options);
  
      static AndroidRuntime* getRuntime();
  
      /***
       * This gets called after the VM has been created, but before we
       * run any code. Override it to make any FindClass calls that need
       * to use CLASSPATH.
       */
      virtual void onVmCreated(JNIEnv* env);
  
      /***
       * This gets called after the JavaVM has initialized.  Override it
       * with the system's native entry point.
       */
      virtual void onStarted() = 0;
  
      /***
       * This gets called after the JavaVM has initialized after a Zygote
       * fork. Override it to initialize threads, etc. Upon return, the
       * correct static main will be invoked.
       */
      virtual void onZygoteInit() {};
  
  
      /***
       * Called when the Java application exits.  The default
       * implementation calls exit(code).
       */
      virtual void onExit(int code);
  
      /*** create a new thread that is visible from Java */
      static android_thread_id_t createJavaThread(const char* name, void (*start)(void *),
          void* arg);
  
      /*** return a pointer to the VM running in this process */
      static JavaVM* getJavaVM() { return mJavaVM; }
  
      /*** return a pointer to the JNIEnv pointer for this thread */
      static JNIEnv* getJNIEnv();
  
      /*** return a new string corresponding to 'className' with all '.'s replaced by '/'s. */
      static char* toSlashClassName(const char* className);
  
  private:
      static int startReg(JNIEnv* env);
      void parseExtraOpts(char* extraOptsBuf);
      int startVm(JavaVM** pJavaVM, JNIEnv** pEnv);
  
      Vector<JavaVMOption> mOptions;
  
      /** JNI JavaVM pointer */
      static JavaVM* mJavaVM;
  
      /**
       * Thread creation helpers.
       */
      static int javaCreateThreadEtc(
                                  android_thread_func_t entryFunction,
                                  void* userData,
                                  const char* threadName,
                                  int32_t threadPriority,
                                  size_t threadStackSize,
                                  android_thread_id_t* threadId);
      static int javaThreadShell(void* args);
  };
  
  }
  
  #endif

• AndroidRuntime.cpp

• /* //device/libs/android_runtime/AndroidRuntime.cpp
  **
  ** Copyright 2006, The Android Open Source Project
  **
  ** Licensed under the Apache License, Version 2.0 (the "License"); 
  ** you may not use this file except in compliance with the License. 
  ** You may obtain a copy of the License at 
  **
  **     http://www.apache.org/licenses/LICENSE-2.0 
  **
  ** Unless required by applicable law or agreed to in writing, software 
  ** distributed under the License is distributed on an "AS IS" BASIS, 
  ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 
  ** See the License for the specific language governing permissions and 
  ** limitations under the License.
  */
  
  #define LOG_TAG "AndroidRuntime"
  //#define LOG_NDEBUG 0
  
  #include <android_runtime/AndroidRuntime.h>
  #include <utils/IBinder.h>
  #include <utils/IServiceManager.h>
  #include <utils/Log.h>
  #include <utils/misc.h>
  #include <utils/Parcel.h>
  #include <utils/string_array.h>
  #include <utils/threads.h>
  #include <cutils/properties.h>
  
  #include <SkGraphics.h>
  #include <SkImageDecoder.h>
  #include <SkImageRef_GlobalPool.h>
  
  #include "jni.h"
  #include "JNIHelp.h"
  #include "android_util_Binder.h"
  
  #include <stdio.h>
  #include <signal.h>
  #include <sys/stat.h>
  #include <sys/types.h>
  #include <signal.h>
  #include <dirent.h>
  #include <assert.h>
  
  
  using namespace android;
  
  extern void register_BindTest();
  
  extern int register_android_os_Binder(JNIEnv* env);
  extern int register_android_os_Process(JNIEnv* env);
  extern int register_android_graphics_Bitmap(JNIEnv*);
  extern int register_android_graphics_BitmapFactory(JNIEnv*);
  extern int register_android_graphics_Camera(JNIEnv* env);
  extern int register_android_graphics_Graphics(JNIEnv* env);
  extern int register_android_graphics_Interpolator(JNIEnv* env);
  extern int register_android_graphics_LayerRasterizer(JNIEnv*);
  extern int register_android_graphics_MaskFilter(JNIEnv* env);
  extern int register_android_graphics_Movie(JNIEnv* env);
  extern int register_android_graphics_NinePatch(JNIEnv*);
  extern int register_android_graphics_PathEffect(JNIEnv* env);
  extern int register_android_graphics_Region(JNIEnv* env);
  extern int register_android_graphics_Shader(JNIEnv* env);
  extern int register_android_graphics_Typeface(JNIEnv* env);
  
  extern int register_com_google_android_gles_jni_EGLImpl(JNIEnv* env);
  extern int register_com_google_android_gles_jni_GLImpl(JNIEnv* env);
  extern int register_android_opengl_jni_GLES10(JNIEnv* env);
  extern int register_android_opengl_jni_GLES10Ext(JNIEnv* env);
  extern int register_android_opengl_jni_GLES11(JNIEnv* env);
  extern int register_android_opengl_jni_GLES11Ext(JNIEnv* env);
  
  extern int register_android_hardware_Camera(JNIEnv *env);
  
  extern int register_android_hardware_SensorManager(JNIEnv *env);
  
  extern int register_android_media_AudioRecord(JNIEnv *env);
  extern int register_android_media_AudioSystem(JNIEnv *env);
  extern int register_android_media_AudioTrack(JNIEnv *env);
  extern int register_android_media_JetPlayer(JNIEnv *env);
  extern int register_android_media_ToneGenerator(JNIEnv *env);
  
  extern int register_android_message_digest_sha1(JNIEnv *env);
  
  extern int register_android_util_FloatMath(JNIEnv* env);
  
  // add by nfsnfs 
  extern int register_android_app_ActivityThread(JNIEnv* env);
  extern int register_android_content_ContentResolver(JNIEnv* env);
  //
  
  namespace android {
  
  /*
   * JNI-based registration functions.  Note these are properly contained in
   * namespace android.
   */
  extern int register_android_content_AssetManager(JNIEnv* env);
  extern int register_android_util_EventLog(JNIEnv* env);
  extern int register_android_util_Log(JNIEnv* env);
  extern int register_android_content_StringBlock(JNIEnv* env);
  extern int register_android_content_XmlBlock(JNIEnv* env);
  extern int register_android_emoji_EmojiFactory(JNIEnv* env);
  extern int register_android_graphics_Canvas(JNIEnv* env);
  extern int register_android_graphics_ColorFilter(JNIEnv* env);
  extern int register_android_graphics_DrawFilter(JNIEnv* env);
  extern int register_android_graphics_Matrix(JNIEnv* env);
  extern int register_android_graphics_Paint(JNIEnv* env);
  extern int register_android_graphics_Path(JNIEnv* env);
  extern int register_android_graphics_PathMeasure(JNIEnv* env);
  extern int register_android_graphics_Picture(JNIEnv*);
  extern int register_android_graphics_PorterDuff(JNIEnv* env);
  extern int register_android_graphics_Rasterizer(JNIEnv* env);
  extern int register_android_graphics_Xfermode(JNIEnv* env);
  extern int register_android_graphics_PixelFormat(JNIEnv* env);
  extern int register_com_android_internal_graphics_NativeUtils(JNIEnv *env);
  extern int register_android_view_Display(JNIEnv* env);
  extern int register_android_view_Surface(JNIEnv* env);
  extern int register_android_view_ViewRoot(JNIEnv* env);
  extern int register_android_database_CursorWindow(JNIEnv* env);
  extern int register_android_database_SQLiteDatabase(JNIEnv* env);
  extern int register_android_database_SQLiteDebug(JNIEnv* env);
  extern int register_android_database_SQLiteProgram(JNIEnv* env);
  extern int register_android_database_SQLiteQuery(JNIEnv* env);
  extern int register_android_database_SQLiteStatement(JNIEnv* env);
  extern int register_android_debug_JNITest(JNIEnv* env);
  extern int register_android_nio_utils(JNIEnv* env);
  extern int register_android_pim_EventRecurrence(JNIEnv* env);
  extern int register_android_text_format_Time(JNIEnv* env);
  extern int register_android_os_Debug(JNIEnv* env);
  extern int register_android_os_ParcelFileDescriptor(JNIEnv *env);
  extern int register_android_os_Power(JNIEnv *env);
  extern int register_android_os_StatFs(JNIEnv *env);
  extern int register_android_os_SystemProperties(JNIEnv *env);
  extern int register_android_os_Hardware(JNIEnv* env);
  extern int register_android_os_Exec(JNIEnv *env);
  extern int register_android_os_SystemClock(JNIEnv* env);
  extern int register_android_os_FileObserver(JNIEnv *env);
  extern int register_android_os_FileUtils(JNIEnv *env);
  extern int register_android_os_UEventObserver(JNIEnv* env);
  extern int register_android_os_MemoryFile(JNIEnv* env);
  extern int register_android_net_LocalSocketImpl(JNIEnv* env);
  extern int register_android_net_NetworkUtils(JNIEnv* env);
  extern int register_android_net_wifi_WifiManager(JNIEnv* env);
  extern int register_android_security_Md5MessageDigest(JNIEnv *env);
  extern int register_android_text_AndroidCharacter(JNIEnv *env);
  extern int register_android_text_KeyCharacterMap(JNIEnv *env);
  extern int register_android_opengl_classes(JNIEnv *env);
  extern int register_android_bluetooth_Database(JNIEnv* env);
  extern int register_android_bluetooth_HeadsetBase(JNIEnv* env);
  extern int register_android_bluetooth_BluetoothAudioGateway(JNIEnv* env);
  extern int register_android_bluetooth_RfcommSocket(JNIEnv *env);
  extern int register_android_bluetooth_ScoSocket(JNIEnv *env);
  extern int register_android_server_BluetoothDeviceService(JNIEnv* env);
  extern int register_android_server_BluetoothEventLoop(JNIEnv *env);
  extern int register_android_server_BluetoothA2dpService(JNIEnv* env);
  extern int register_android_ddm_DdmHandleNativeHeap(JNIEnv *env);
  extern int register_com_android_internal_os_ZygoteInit(JNIEnv* env);
  extern int register_android_util_Base64(JNIEnv* env);
  extern int register_android_location_GpsLocationProvider(JNIEnv* env);
  extern int register_android_backup_BackupDataInput(JNIEnv *env);
  extern int register_android_backup_BackupDataOutput(JNIEnv *env);
  extern int register_android_backup_FileBackupHelperBase(JNIEnv *env);
  extern int register_android_backup_BackupHelperDispatcher(JNIEnv *env);
  
  static AndroidRuntime* gCurRuntime = NULL;
  
  static void doThrow(JNIEnv* env, const char* exc, const char* msg = NULL)
  {
      if (jniThrowException(env, exc, msg) != 0)
          assert(false);
  }
  
  /*
   * Code written in the Java Programming Language calls here from main().
   */
  static void com_android_internal_os_RuntimeInit_finishInit(JNIEnv* env, jobject clazz)
  {
      gCurRuntime->onStarted();
  }
  
  static void com_android_internal_os_RuntimeInit_zygoteInit(JNIEnv* env, jobject clazz)
  {
      gCurRuntime->onZygoteInit();
  }
  
  static jint com_android_internal_os_RuntimeInit_isComputerOn(JNIEnv* env, jobject clazz)
  {
      return 1;
  }
  
  static void com_android_internal_os_RuntimeInit_turnComputerOn(JNIEnv* env, jobject clazz)
  {
  }
  
  static jint com_android_internal_os_RuntimeInit_getQwertyKeyboard(JNIEnv* env, jobject clazz)
  {
      char* value = getenv("qwerty");
      if (value != NULL && strcmp(value, "true") == 0) {
          return 1;
      }
      
      return 0;
  }
  
  /*
   * JNI registration.
   */
  static JNINativeMethod gMethods[] = {
      { "finishInit", "()V",
          (void*) com_android_internal_os_RuntimeInit_finishInit },
      { "zygoteInitNative", "()V",
          (void*) com_android_internal_os_RuntimeInit_zygoteInit },
      { "isComputerOn", "()I",
          (void*) com_android_internal_os_RuntimeInit_isComputerOn },
      { "turnComputerOn", "()V",
          (void*) com_android_internal_os_RuntimeInit_turnComputerOn },    
      { "getQwertyKeyboard", "()I",
          (void*) com_android_internal_os_RuntimeInit_getQwertyKeyboard },
  };
  
  int register_com_android_internal_os_RuntimeInit(JNIEnv* env)
  {
      return jniRegisterNativeMethods(env, "com/android/internal/os/RuntimeInit",
          gMethods, NELEM(gMethods));
  }
  
  // ----------------------------------------------------------------------
  
  /*static*/ JavaVM* AndroidRuntime::mJavaVM = NULL;
  
  
  AndroidRuntime::AndroidRuntime()
  {
      SkGraphics::Init();
      // this sets our preference for 16bit images during decode
      // in case the src is opaque and 24bit
      SkImageDecoder::SetDeviceConfig(SkBitmap::kRGB_565_Config);
      // This cache is shared between browser native images, and java "purgeable"
      // bitmaps. This globalpool is for images that do not either use the java
      // heap, or are not backed by ashmem. See BitmapFactory.cpp for the key
      // java call site.
      SkImageRef_GlobalPool::SetRAMBudget(512 * 1024);
      // There is also a global font cache, but its budget is specified in code
      // see SkFontHost_android.cpp
  
      // Pre-allocate enough space to hold a fair number of options.
      mOptions.setCapacity(20);
  
      assert(gCurRuntime == NULL);        // one per process
      gCurRuntime = this;
  }
  
  AndroidRuntime::~AndroidRuntime()
  {
      SkGraphics::Term();
  }
  
  /*
   * Register native methods using JNI.
   */
  /*static*/ int AndroidRuntime::registerNativeMethods(JNIEnv* env,
      const char* className, const JNINativeMethod* gMethods, int numMethods)
  {
      return jniRegisterNativeMethods(env, className, gMethods, numMethods);
  }
  
  /*
   * Call a static Java Programming Language function that takes no arguments and returns void.
   */
  status_t AndroidRuntime::callStatic(const char* className, const char* methodName)
  {
      JNIEnv* env;
      jclass clazz;
      jmethodID methodId;
  
      env = getJNIEnv();
      if (env == NULL)
          return UNKNOWN_ERROR;
  
      clazz = findClass(env, className);
      if (clazz == NULL) {
          LOGE("ERROR: could not find class '%s'\n", className);
          return UNKNOWN_ERROR;
      }
      methodId = env->GetStaticMethodID(clazz, methodName, "()V");
      if (methodId == NULL) {
          LOGE("ERROR: could not find method %s.%s\n", className, methodName);
          return UNKNOWN_ERROR;
      }
  
      env->CallStaticVoidMethod(clazz, methodId);
  
      return NO_ERROR;
  }
  
  status_t AndroidRuntime::callMain(
      const char* className, int argc, const char* const argv[])
  {
      JNIEnv* env;
      jclass clazz;
      jmethodID methodId;
  
      env = getJNIEnv();
      if (env == NULL)
          return UNKNOWN_ERROR;
  
      clazz = findClass(env, className);
      if (clazz == NULL) {
          LOGE("ERROR: could not find class '%s'\n", className);
          return UNKNOWN_ERROR;
      }
  
      methodId = env->GetStaticMethodID(clazz, "main", "([Ljava/lang/String;)V");
      if (methodId == NULL) {
          LOGE("ERROR: could not find method %s.main(String[])\n", className);
          return UNKNOWN_ERROR;
      }
  
      /*
       * We want to call main() with a String array with our arguments in it.
       * Create an array and populate it.
       */
      jclass stringClass;
      jobjectArray strArray;
  
      stringClass = env->FindClass("java/lang/String");
      strArray = env->NewObjectArray(argc, stringClass, NULL);
  
      for (int i = 0; i < argc; i++) {
          jstring argStr = env->NewStringUTF(argv[i]);
          env->SetObjectArrayElement(strArray, i, argStr);
      }
  
      env->CallStaticVoidMethod(clazz, methodId, strArray);
      return NO_ERROR;
  }
  
  /*
   * Find the named class.
   */
  jclass AndroidRuntime::findClass(JNIEnv* env, const char* className)
  {
      char* convName = NULL;
  
      if (env->ExceptionCheck()) {
          LOGE("ERROR: exception pending on entry to findClass()\n");
          return NULL;
      }
  
      /*
       * JNI FindClass uses class names with slashes, but ClassLoader.loadClass
       * uses the dotted "binary name" format.  We don't need to convert the
       * name with the new approach.
       */
  #if 0
      /* (convName only created if necessary -- use className) */
      for (char* cp = const_cast<char*>(className); *cp != '\0'; cp++) {
          if (*cp == '.') {
              if (convName == NULL) {
                  convName = strdup(className);
                  cp = convName + (cp-className);
                  className = convName;
              }
              *cp = '/';
          }
      }
  #endif
  
      /*
       * This is a little awkward because the JNI FindClass call uses the
       * class loader associated with the native method we're executing in.
       * Because this native method is part of a "boot" class, JNI doesn't
       * look for the class in CLASSPATH, which unfortunately is a likely
       * location for it.  (Had we issued the FindClass call before calling
       * into the VM -- at which point there isn't a native method frame on
       * the stack -- the VM would have checked CLASSPATH.  We have to do
       * this because we call into Java Programming Language code and
       * bounce back out.)
       *
       * JNI lacks a "find class in a specific class loader" operation, so we
       * have to do things the hard way.
       */
      jclass cls = NULL;
      //cls = env->FindClass(className);
  
      jclass javaLangClassLoader;
      jmethodID getSystemClassLoader, loadClass;
      jobject systemClassLoader;
      jstring strClassName;
  
      /* find the "system" class loader; none of this is expected to fail */
      javaLangClassLoader = env->FindClass("java/lang/ClassLoader");
      assert(javaLangClassLoader != NULL);
      getSystemClassLoader = env->GetStaticMethodID(javaLangClassLoader,
          "getSystemClassLoader", "()Ljava/lang/ClassLoader;");
      loadClass = env->GetMethodID(javaLangClassLoader,
          "loadClass", "(Ljava/lang/String;)Ljava/lang/Class;");
      assert(getSystemClassLoader != NULL && loadClass != NULL);
      systemClassLoader = env->CallStaticObjectMethod(javaLangClassLoader,
          getSystemClassLoader);
      assert(systemClassLoader != NULL);
  
      /* create an object for the class name string; alloc could fail */
      strClassName = env->NewStringUTF(className);
      if (env->ExceptionCheck()) {
          LOGE("ERROR: unable to convert '%s' to string\n", className);
          goto bail;
      }
      LOGV("system class loader is %p, loading %p (%s)\n",
          systemClassLoader, strClassName, className);
  
      /* try to find the named class */
      cls = (jclass) env->CallObjectMethod(systemClassLoader, loadClass,
                          strClassName);
      if (env->ExceptionCheck()) {
          LOGE("ERROR: unable to load class '%s' from %p\n",
              className, systemClassLoader);
          cls = NULL;
          goto bail;
      }
  
  bail:
      free(convName);
      return cls;
  }
  
  /*
   * The VM calls this through the "exit" hook.
   */
  static void runtime_exit(int code)
  {
      gCurRuntime->onExit(code);
      exit(code);
  }
  
  /*
   * The VM calls this through the "vfprintf" hook.
   *
   * We ignore "fp" and just write the results to the log file.
   */
  static void runtime_vfprintf(FILE* fp, const char* format, va_list ap)
  {
      LOG_PRI_VA(ANDROID_LOG_INFO, "vm-printf", format, ap);
  }
  
  
  /**
   * Add VM arguments to the to-be-executed VM
   * Stops at first non '-' argument (also stops at an argument of '--')
   * Returns the number of args consumed
   */
  int AndroidRuntime::addVmArguments(int argc, const char* const argv[])
  {
      int i;
      
      for (i = 0; i<argc; i++) {
          if (argv[i][0] != '-') {
              return i;
          }
          if (argv[i][1] == '-' && argv[i][2] == 0) {
              return i+1;
          }
  
          JavaVMOption opt;
          memset(&opt, 0, sizeof(opt));
          opt.optionString = (char*)argv[i];
          mOptions.add(opt);
      }
      return i;
  }
  
  static int hasDir(const char* dir)
  {
      struct stat s;
      int res = stat(dir, &s);
      if (res == 0) {
          return S_ISDIR(s.st_mode);
      }
      return 0;
  }
  
  /*
   * We just want failed write() calls to just return with an error.
   */
  static void blockSigpipe()
  {
      sigset_t mask;
  
      sigemptyset(&mask);
      sigaddset(&mask, SIGPIPE);
      if (sigprocmask(SIG_BLOCK, &mask, NULL) != 0)
          LOGW("WARNING: SIGPIPE not blocked\n");
  }
  
  /*
   * Read the persistent locale.
   */
  static void readLocale(char* language, char* region)
  {
      char propLang[PROPERTY_VALUE_MAX], propRegn[PROPERTY_VALUE_MAX];
      
      property_get("persist.sys.language", propLang, "");
      property_get("persist.sys.country", propRegn, "");
      if (*propLang == 0 && *propRegn == 0) {
          /* Set to ro properties, default is en_US */
          property_get("ro.product.locale.language", propLang, "en");
          property_get("ro.product.locale.region", propRegn, "US");
      }
      strncat(language, propLang, 2);
      strncat(region, propRegn, 2);
      //LOGD("language=%s region=%s\n", language, region);
  }
  
  void AndroidRuntime::start(const char* className, const bool startSystemServer)
  {
      LOGD("\n>>>>>>>>>>>>>> AndroidRuntime START <<<<<<<<<<<<<<\n");
  
      JNIEnv* env;
      JavaVMInitArgs initArgs;
      JavaVMOption opt;
      char propBuf[PROPERTY_VALUE_MAX];
      char stackTraceFileBuf[PROPERTY_VALUE_MAX];
      char dexoptFlagsBuf[PROPERTY_VALUE_MAX];
      char enableAssertBuf[sizeof("-ea:")-1 + PROPERTY_VALUE_MAX];
      char jniOptsBuf[sizeof("-Xjniopts:")-1 + PROPERTY_VALUE_MAX];
      char* stackTraceFile = NULL;
      char* slashClassName = NULL;
      char* cp;
      bool checkJni = false;
      bool logStdio = false;
      enum { kEMDefault, kEMIntPortable, kEMIntFast } executionMode = kEMDefault;
  
      blockSigpipe();
  
      /* 
       * 'startSystemServer == true' means runtime is obslete and not run from 
       * init.rc anymore, so we print out the boot start event here.
       */
      if (startSystemServer) {
          /* track our progress through the boot sequence */
          const int LOG_BOOT_PROGRESS_START = 3000;
          LOG_EVENT_LONG(LOG_BOOT_PROGRESS_START, 
                         ns2ms(systemTime(SYSTEM_TIME_MONOTONIC)));
      }
  
      property_get("dalvik.vm.checkjni", propBuf, "");
      if (strcmp(propBuf, "true") == 0) {
          checkJni = true;
      } else if (strcmp(propBuf, "false") != 0) {
          /* property is neither true nor false; fall back on kernel parameter */
          property_get("ro.kernel.android.checkjni", propBuf, "");
          if (propBuf[0] == '1') {
              checkJni = true;
          }
      }
  
      property_get("dalvik.vm.execution-mode", propBuf, "");
      if (strcmp(propBuf, "int:portable") == 0) {
          executionMode = kEMIntPortable;
      } else if (strcmp(propBuf, "int:fast") == 0) {
          executionMode = kEMIntFast;
      }
  
      property_get("dalvik.vm.stack-trace-file", stackTraceFileBuf, "");
  
      property_get("log.redirect-stdio", propBuf, "");
      if (strcmp(propBuf, "true") == 0) {
          logStdio = true;
      }
  
      strcpy(enableAssertBuf, "-ea:");
      property_get("dalvik.vm.enableassertions", enableAssertBuf+4, "");
  
      strcpy(jniOptsBuf, "-Xjniopts:");
      property_get("dalvik.vm.jniopts", jniOptsBuf+10, "");
  
      const char* rootDir = getenv("ANDROID_ROOT");
      if (rootDir == NULL) {
          rootDir = "/system";
          if (!hasDir("/system")) {
              LOG_FATAL("No root directory specified, and /android does not exist.");
              return;
          }
          setenv("ANDROID_ROOT", rootDir, 1);
      }
  
      const char* kernelHack = getenv("LD_ASSUME_KERNEL");
      //LOGD("Found LD_ASSUME_KERNEL='%s'\n", kernelHack);
  
      /* route exit() to our handler */
      opt.extraInfo = (void*) runtime_exit;
      opt.optionString = "exit";
      mOptions.add(opt);
  
      /* route fprintf() to our handler */
      opt.extraInfo = (void*) runtime_vfprintf;
      opt.optionString = "vfprintf";
      mOptions.add(opt);
  
      opt.extraInfo = NULL;
  
      /* enable verbose; standard options are { jni, gc, class } */
      //options[curOpt++].optionString = "-verbose:jni";
      opt.optionString = "-verbose:gc";
      mOptions.add(opt);
      //options[curOpt++].optionString = "-verbose:class";
  
  #ifdef CUSTOM_RUNTIME_HEAP_MAX
  #define __make_max_heap_opt(val) #val
  #define _make_max_heap_opt(val) "-Xmx" __make_max_heap_opt(val)
      opt.optionString = _make_max_heap_opt(CUSTOM_RUNTIME_HEAP_MAX);
  #undef __make_max_heap_opt
  #undef _make_max_heap_opt
  #else
      /* limit memory use to 16MB */
      opt.optionString = "-Xmx16m";
  #endif
      mOptions.add(opt);
  
      /*
       * Enable or disable dexopt features, such as bytecode verification and
       * calculation of register maps for precise GC.
       */
      property_get("dalvik.vm.dexopt-flags", dexoptFlagsBuf, "");
      if (dexoptFlagsBuf[0] != '\0') {
          const char* opc;
          const char* val;
  
          opc = strstr(dexoptFlagsBuf, "v=");     /* verification */
          if (opc != NULL) {
              switch (*(opc+2)) {
              case 'n':   val = "-Xverify:none";      break;
              case 'r':   val = "-Xverify:remote";    break;
              case 'a':   val = "-Xverify:all";       break;
              default:    val = NULL;                 break;
              }
  
              if (val != NULL) {
                  opt.optionString = val;
                  mOptions.add(opt);
              }
          }
  
          opc = strstr(dexoptFlagsBuf, "o=");     /* optimization */
          if (opc != NULL) {
              switch (*(opc+2)) {
              case 'n':   val = "-Xdexopt:none";      break;
              case 'v':   val = "-Xdexopt:verified";  break;
              case 'a':   val = "-Xdexopt:all";       break;
              default:    val = NULL;                 break;
              }
  
              if (val != NULL) {
                  opt.optionString = val;
                  mOptions.add(opt);
              }
          }
  
          opc = strstr(dexoptFlagsBuf, "m=y");    /* register map */
          if (opc != NULL) {
              opt.optionString = "-Xgenregmap";
              mOptions.add(opt);
          }
      }
  
      /* enable debugging; set suspend=y to pause during VM init */
  #ifdef HAVE_ANDROID_OS
      /* use android ADB transport */
      opt.optionString =
          "-agentlib:jdwp=transport=dt_android_adb,suspend=n,server=y";
  #else
      /* use TCP socket; address=0 means start at port 8000 and probe up */
      LOGI("Using TCP socket for JDWP\n");
      opt.optionString =
          "-agentlib:jdwp=transport=dt_socket,suspend=n,server=y,address=0";
  #endif
      mOptions.add(opt);
  
      char enableDPBuf[sizeof("-Xdeadlockpredict:") + PROPERTY_VALUE_MAX];
      property_get("dalvik.vm.deadlock-predict", propBuf, "");
      if (strlen(propBuf) > 0) {
          strcpy(enableDPBuf, "-Xdeadlockpredict:");
          strcat(enableDPBuf, propBuf);
          opt.optionString = enableDPBuf;
          mOptions.add(opt);
      }
  
      LOGD("CheckJNI is %s\n", checkJni ? "ON" : "OFF");
      if (checkJni) {
          /* extended JNI checking */
          opt.optionString = "-Xcheck:jni";
          mOptions.add(opt);
  
          /* set a cap on JNI global references */
          opt.optionString = "-Xjnigreflimit:2000";
          mOptions.add(opt);
  
          /* with -Xcheck:jni, this provides a JNI function call trace */
          //opt.optionString = "-verbose:jni";
          //mOptions.add(opt);
      }
      if (executionMode == kEMIntPortable) {
          opt.optionString = "-Xint:portable";
          mOptions.add(opt);
      } else if (executionMode == kEMIntFast) {
          opt.optionString = "-Xint:fast";
          mOptions.add(opt);
      }
      if (logStdio) {
          /* convert stdout/stderr to log messages */
          opt.optionString = "-Xlog-stdio";
          mOptions.add(opt);
      }
  
      if (enableAssertBuf[4] != '\0') {
          /* accept "all" to mean "all classes and packages" */
          if (strcmp(enableAssertBuf+4, "all") == 0)
              enableAssertBuf[3] = '\0';
          LOGI("Assertions enabled: '%s'\n", enableAssertBuf);
          opt.optionString = enableAssertBuf;
          mOptions.add(opt);
      } else {
          LOGV("Assertions disabled\n");
      }
  
      if (jniOptsBuf[10] != '\0') {
          LOGI("JNI options: '%s'\n", jniOptsBuf);
          opt.optionString = jniOptsBuf;
          mOptions.add(opt);
      }
  
      if (stackTraceFileBuf[0] != '\0') {
          static const char* stfOptName = "-Xstacktracefile:";
  
          stackTraceFile = (char*) malloc(strlen(stfOptName) +
              strlen(stackTraceFileBuf) +1);
          strcpy(stackTraceFile, stfOptName);
          strcat(stackTraceFile, stackTraceFileBuf);
          opt.optionString = stackTraceFile;
          mOptions.add(opt);
      }
      
      /* Set the properties for locale */
      {
          char langOption[sizeof("-Duser.language=") + 3];
          char regionOption[sizeof("-Duser.region=") + 3];
          strcpy(langOption, "-Duser.language=");
          strcpy(regionOption, "-Duser.region=");
          readLocale(langOption, regionOption);
          opt.extraInfo = NULL;
          opt.optionString = langOption;
          mOptions.add(opt);
          opt.optionString = regionOption;
          mOptions.add(opt);
      }
  
      /*
       * We don't have /tmp on the device, but we often have an SD card.  Apps
       * shouldn't use this, but some test suites might want to exercise it.
       */
      opt.optionString = "-Djava.io.tmpdir=/sdcard";
      mOptions.add(opt);
  
      initArgs.version = JNI_VERSION_1_4;
      initArgs.options = mOptions.editArray();
      initArgs.nOptions = mOptions.size();
      initArgs.ignoreUnrecognized = JNI_FALSE;
  
      /*
       * Initialize the VM.
       *
       * The JavaVM* is essentially per-process, and the JNIEnv* is per-thread.
       * If this call succeeds, the VM is ready, and we can start issuing
       * JNI calls.
       */
      if (JNI_CreateJavaVM(&mJavaVM, &env, &initArgs) < 0) {
          LOGE("JNI_CreateJavaVM failed\n");
          goto bail;
      }
  
      /*
       * Register android functions.
       */
      if (startReg(env) < 0) {
          LOGE("Unable to register all android natives\n");
          goto bail;
      }
  
      /*
       * We want to call main() with a String array with arguments in it.
       * At present we only have one argument, the class name.  Create an
       * array to hold it.
       */
      jclass stringClass;
      jobjectArray strArray;
      jstring classNameStr;
      jstring startSystemServerStr;
  
      stringClass = env->FindClass("java/lang/String");
      assert(stringClass != NULL);
      strArray = env->NewObjectArray(2, stringClass, NULL);
      assert(strArray != NULL);
      classNameStr = env->NewStringUTF(className);
      assert(classNameStr != NULL);
      env->SetObjectArrayElement(strArray, 0, classNameStr);
      startSystemServerStr = env->NewStringUTF(startSystemServer ? 
                                                   "true" : "false");
      env->SetObjectArrayElement(strArray, 1, startSystemServerStr);
  
      /*
       * Start VM.  This thread becomes the main thread of the VM, and will
       * not return until the VM exits.
       */
      jclass startClass;
      jmethodID startMeth;
  
      slashClassName = strdup(className);
      for (cp = slashClassName; *cp != '\0'; cp++)
          if (*cp == '.')
              *cp = '/';
  
      startClass = env->FindClass(slashClassName);
      if (startClass == NULL) {
          LOGE("JavaVM unable to locate class '%s'\n", slashClassName);
          /* keep going */
      } else {
          startMeth = env->GetStaticMethodID(startClass, "main",
              "([Ljava/lang/String;)V");
          if (startMeth == NULL) {
              LOGE("JavaVM unable to find main() in '%s'\n", className);
              /* keep going */
          } else {
              env->CallStaticVoidMethod(startClass, startMeth, strArray);
  
  #if 0
              if (env->ExceptionCheck())
                  threadExitUncaughtException(env);
  #endif
          }
      }
  
      LOGD("Shutting down VM\n");
      if (mJavaVM->DetachCurrentThread() != JNI_OK)
          LOGW("Warning: unable to detach main thread\n");
      if (mJavaVM->DestroyJavaVM() != 0)
          LOGW("Warning: VM did not shut down cleanly\n");
  
  bail:
      free(slashClassName);
      free(stackTraceFile);
  }
  
  void AndroidRuntime::start()
  {
      start("com.android.internal.os.RuntimeInit",
          false /* Don't start the system server */);
  }
  
  void AndroidRuntime::onExit(int code)
  {
      LOGI("AndroidRuntime onExit calling exit(%d)", code);
      exit(code);
  }
  
  /*
   * Get the JNIEnv pointer for this thread.
   *
   * Returns NULL if the slot wasn't allocated or populated.
   */
  /*static*/ JNIEnv* AndroidRuntime::getJNIEnv()
  {
      JNIEnv* env;
      JavaVM* vm = AndroidRuntime::getJavaVM();
      assert(vm != NULL);
  
      if (vm->GetEnv((void**) &env, JNI_VERSION_1_4) != JNI_OK)
          return NULL;
      return env;
  }
  
  /*
   * Makes the current thread visible to the VM.
   *
   * The JNIEnv pointer returned is only valid for the current thread, and
   * thus must be tucked into thread-local storage.
   */
  static int javaAttachThread(const char* threadName, JNIEnv** pEnv)
  {
      JavaVMAttachArgs args;
      JavaVM* vm;
      jint result;
  
      vm = AndroidRuntime::getJavaVM();
      assert(vm != NULL);
  
      args.version = JNI_VERSION_1_4;
      args.name = (char*) threadName;
      args.group = NULL;
  
      result = vm->AttachCurrentThread(pEnv, (void*) &args);
      if (result != JNI_OK)
          LOGE("ERROR: thread attach failed\n");
  
      return result;
  }
  
  /*
   * Detach the current thread from the set visible to the VM.
   */
  static int javaDetachThread(void)
  {
      JavaVM* vm;
      jint result;
  
      vm = AndroidRuntime::getJavaVM();
      assert(vm != NULL);
  
      result = vm->DetachCurrentThread();
      if (result != JNI_OK)
          LOGE("ERROR: thread detach failed\n");
      return result;
  }
  
  /*
   * When starting a native thread that will be visible from the VM, we
   * bounce through this to get the right attach/detach action.
   * Note that this function calls free(args)
   */
  /*static*/ int AndroidRuntime::javaThreadShell(void* args) {
      void* start = ((void**)args)[0];
      void* userData = ((void **)args)[1];
      char* name = (char*) ((void **)args)[2];        // we own this storage
      free(args);
      JNIEnv* env;
      int result;
  
      /* hook us into the VM */
      if (javaAttachThread(name, &env) != JNI_OK)
          return -1;
  
      /* start the thread running */
      result = (*(android_thread_func_t)start)(userData);
  
      /* unhook us */
      javaDetachThread();
      free(name);
  
      return result;
  }
  
  /*
   * This is invoked from androidCreateThreadEtc() via the callback
   * set with androidSetCreateThreadFunc().
   *
   * We need to create the new thread in such a way that it gets hooked
   * into the VM before it really starts executing.
   */
  /*static*/ int AndroidRuntime::javaCreateThreadEtc(
                                  android_thread_func_t entryFunction, 
                                  void* userData,
                                  const char* threadName,
                                  int32_t threadPriority,
                                  size_t threadStackSize,
                                  android_thread_id_t* threadId)
  {
      void** args = (void**) malloc(3 * sizeof(void*));   // javaThreadShell must free
      int result;
  
      assert(threadName != NULL);
  
      args[0] = (void*) entryFunction;
      args[1] = userData;
      args[2] = (void*) strdup(threadName);   // javaThreadShell must free
  
      result = androidCreateRawThreadEtc(AndroidRuntime::javaThreadShell, args,
          threadName, threadPriority, threadStackSize, threadId);
      return result;
  }
  
  /*
   * Create a thread that is visible from the VM.
   *
   * This is called from elsewhere in the library.
   */
  /*static*/ void AndroidRuntime::createJavaThread(const char* name,
      void (*start)(void *), void* arg)
  {
      javaCreateThreadEtc((android_thread_func_t) start, arg, name,
          ANDROID_PRIORITY_DEFAULT, 0, NULL);
  }
  
  #if 0
  static void quickTest(void* arg)
  {
      const char* str = (const char*) arg;
  
      printf("In quickTest: %s\n", str);
  }
  #endif
  
  #ifdef NDEBUG
      #define REG_JNI(name)      { name }
      struct RegJNIRec {
          int (*mProc)(JNIEnv*);
      };
  #else
      #define REG_JNI(name)      { name, #name }
      struct RegJNIRec {
          int (*mProc)(JNIEnv*);
          const char* mName;
      };
  #endif
  
  typedef void (*RegJAMProc)();
  
  static int register_jni_procs(const RegJNIRec array[], size_t count, JNIEnv* env)
  {
      for (size_t i = 0; i < count; i++) {
          if (array[i].mProc(env) < 0) {
  #ifndef NDEBUG
              LOGD("----------!!! %s failed to load\n", array[i].mName);
  #endif
              return -1;
          }
      }
      return 0;
  }
  
  static void register_jam_procs(const RegJAMProc array[], size_t count)
  {
      for (size_t i = 0; i < count; i++) {
          array[i]();
      }
  }
  
  static const RegJNIRec gRegJNI[] = {
      REG_JNI(register_android_debug_JNITest),
      REG_JNI(register_com_android_internal_os_RuntimeInit),
      REG_JNI(register_android_os_SystemClock),
      REG_JNI(register_android_util_EventLog),
      REG_JNI(register_android_util_Log),
      REG_JNI(register_android_util_FloatMath),
      REG_JNI(register_android_text_format_Time),
      REG_JNI(register_android_pim_EventRecurrence),
      REG_JNI(register_android_content_AssetManager),
      REG_JNI(register_android_content_StringBlock),
      REG_JNI(register_android_content_XmlBlock),
      REG_JNI(register_android_emoji_EmojiFactory),
      REG_JNI(register_android_security_Md5MessageDigest),
      REG_JNI(register_android_text_AndroidCharacter),
      REG_JNI(register_android_text_KeyCharacterMap),
      REG_JNI(register_android_os_Process),
      REG_JNI(register_android_os_Binder),
      REG_JNI(register_android_os_Hardware),
      REG_JNI(register_android_view_Display),
      REG_JNI(register_android_nio_utils),
      REG_JNI(register_android_graphics_PixelFormat),
      REG_JNI(register_android_graphics_Graphics),
      REG_JNI(register_android_view_Surface),
      REG_JNI(register_android_view_ViewRoot),
      REG_JNI(register_com_google_android_gles_jni_EGLImpl),
      REG_JNI(register_com_google_android_gles_jni_GLImpl),
      REG_JNI(register_android_opengl_jni_GLES10),
      REG_JNI(register_android_opengl_jni_GLES10Ext),
      REG_JNI(register_android_opengl_jni_GLES11),
      REG_JNI(register_android_opengl_jni_GLES11Ext),
  
      REG_JNI(register_android_graphics_Bitmap),
      REG_JNI(register_android_graphics_BitmapFactory),
      REG_JNI(register_android_graphics_Camera),
      REG_JNI(register_android_graphics_Canvas),
      REG_JNI(register_android_graphics_ColorFilter),
      REG_JNI(register_android_graphics_DrawFilter),
      REG_JNI(register_android_graphics_Interpolator),
      REG_JNI(register_android_graphics_LayerRasterizer),
      REG_JNI(register_android_graphics_MaskFilter),
      REG_JNI(register_android_graphics_Matrix),
      REG_JNI(register_android_graphics_Movie),
      REG_JNI(register_android_graphics_NinePatch),
      REG_JNI(register_android_graphics_Paint),
      REG_JNI(register_android_graphics_Path),
      REG_JNI(register_android_graphics_PathMeasure),
      REG_JNI(register_android_graphics_PathEffect),
      REG_JNI(register_android_graphics_Picture),
      REG_JNI(register_android_graphics_PorterDuff),
      REG_JNI(register_android_graphics_Rasterizer),
      REG_JNI(register_android_graphics_Region),
      REG_JNI(register_android_graphics_Shader),
      REG_JNI(register_android_graphics_Typeface),
      REG_JNI(register_android_graphics_Xfermode),
      REG_JNI(register_com_android_internal_graphics_NativeUtils),
  
      REG_JNI(register_android_database_CursorWindow),
      REG_JNI(register_android_database_SQLiteDatabase),
      REG_JNI(register_android_database_SQLiteDebug),
      REG_JNI(register_android_database_SQLiteProgram),
      REG_JNI(register_android_database_SQLiteQuery),
      REG_JNI(register_android_database_SQLiteStatement),
      REG_JNI(register_android_os_Debug),
      REG_JNI(register_android_os_Exec),
      REG_JNI(register_android_os_FileObserver),
      REG_JNI(register_android_os_FileUtils),
      REG_JNI(register_android_os_ParcelFileDescriptor),
      REG_JNI(register_android_os_Power),
      REG_JNI(register_android_os_StatFs),
      REG_JNI(register_android_os_SystemProperties),
      REG_JNI(register_android_os_UEventObserver),
      REG_JNI(register_android_net_LocalSocketImpl),
      REG_JNI(register_android_net_NetworkUtils),
      REG_JNI(register_android_net_wifi_WifiManager),
      REG_JNI(register_android_os_MemoryFile),
      REG_JNI(register_com_android_internal_os_ZygoteInit),
      REG_JNI(register_android_hardware_Camera),
      REG_JNI(register_android_hardware_SensorManager),
      REG_JNI(register_android_media_AudioRecord),
      REG_JNI(register_android_media_AudioSystem),
      REG_JNI(register_android_media_AudioTrack),
      REG_JNI(register_android_media_JetPlayer),
      REG_JNI(register_android_media_ToneGenerator),
  
      REG_JNI(register_android_opengl_classes),
      REG_JNI(register_android_bluetooth_Database),
      REG_JNI(register_android_bluetooth_HeadsetBase),
      REG_JNI(register_android_bluetooth_BluetoothAudioGateway),
      REG_JNI(register_android_bluetooth_RfcommSocket),
      REG_JNI(register_android_bluetooth_ScoSocket),
      REG_JNI(register_android_server_BluetoothDeviceService),
      REG_JNI(register_android_server_BluetoothEventLoop),
      REG_JNI(register_android_server_BluetoothA2dpService),
      REG_JNI(register_android_message_digest_sha1),
      REG_JNI(register_android_ddm_DdmHandleNativeHeap),
      REG_JNI(register_android_util_Base64),
      REG_JNI(register_android_location_GpsLocationProvider),
      REG_JNI(register_android_backup_BackupDataInput),
      REG_JNI(register_android_backup_BackupDataOutput),
      REG_JNI(register_android_backup_FileBackupHelperBase),
      REG_JNI(register_android_backup_BackupHelperDispatcher),
      // add by nfsnfs
      REG_JNI(register_android_app_ActivityThread),
      REG_JNI(register_android_content_ContentResolver),
      //
  };
  
  /*
   * Register android native functions with the VM.
   */
  /*static*/ int AndroidRuntime::startReg(JNIEnv* env)
  {
      /*
       * This hook causes all future threads created in this process to be
       * attached to the JavaVM.  (This needs to go away in favor of JNI
       * Attach calls.)
       */
      androidSetCreateThreadFunc((android_create_thread_fn) javaCreateThreadEtc);
  
      LOGD("--- registering native functions ---\n");
  
      /*
       * Every "register" function calls one or more things that return
       * a local reference (e.g. FindClass).  Because we haven't really
       * started the VM yet, they're all getting stored in the base frame
       * and never released.  Use Push/Pop to manage the storage.
       */
      env->PushLocalFrame(200);
  
      if (register_jni_procs(gRegJNI, NELEM(gRegJNI), env) < 0) {
          env->PopLocalFrame(NULL);
          return -1;
      }
      env->PopLocalFrame(NULL);
  
      //createJavaThread("fubar", quickTest, (void*) "hello");
  
      return 0;
  }
  
  AndroidRuntime* AndroidRuntime::getRuntime()
  {
      return gCurRuntime;
  }
  
  /**
   * Used by WithFramework to register native functions.
   */
  extern "C"
  jint Java_com_android_internal_util_WithFramework_registerNatives(
          JNIEnv* env, jclass clazz) {
      return register_jni_procs(gRegJNI, NELEM(gRegJNI), env);
  }
  
  /**
   * Used by LoadClass to register native functions.
   */
  extern "C"
  jint Java_LoadClass_registerNatives(JNIEnv* env, jclass clazz) {
      return register_jni_procs(gRegJNI, NELEM(gRegJNI), env);
  }
  
  }   // namespace android

• Constructor in AndroidRuntime

• AndroidRuntime::AndroidRuntime()
  {
      SkGraphics::Init();
      SkImageDecoder::SetDeviceConfig(SkBitmap::kRGB_565_Config);
      SkImageRef_GlobalPool::SetRAMBudget(512 * 1024);
      mOptions.setCapacity(20);
      assert(gCurRuntime == NULL);    
      gCurRuntime = this;
  }

• start method in AndroidRuntime

• void AndroidRuntime::start(const char* className, const bool startSystemServer)
  {
      JNIEnv* env;
      JavaVMInitArgs initArgs;
      JavaVMOption opt;
      char propBuf[PROPERTY_VALUE_MAX];
      char stackTraceFileBuf[PROPERTY_VALUE_MAX];
      char dexoptFlagsBuf[PROPERTY_VALUE_MAX];
      char enableAssertBuf[sizeof("-ea:")-1 + PROPERTY_VALUE_MAX];
      char jniOptsBuf[sizeof("-Xjniopts:")-1 + PROPERTY_VALUE_MAX];
      char* stackTraceFile = NULL;
      char* slashClassName = NULL;
      char* cp;
      bool checkJni = false;
      bool logStdio = false;
      enum { kEMDefault, kEMIntPortable, kEMIntFast } executionMode = kEMDefault;
      blockSigpipe();   
      if (startSystemServer) {
          /* track our progress through the boot sequence */
          const int LOG_BOOT_PROGRESS_START = 3000;
          LOG_EVENT_LONG(LOG_BOOT_PROGRESS_START,ns2ms(systemTime(SYSTEM_TIME_MONOTONIC)));
      }
      property_get("dalvik.vm.checkjni", propBuf, "");
      if (strcmp(propBuf, "true") == 0) {
          checkJni = true;
      } else if (strcmp(propBuf, "false") != 0) {
          property_get("ro.kernel.android.checkjni", propBuf, "");
          if (propBuf[0] == '1') {
              checkJni = true;
          }
      }
      property_get("dalvik.vm.execution-mode", propBuf, "");
      if (strcmp(propBuf, "int:portable") == 0) {
          executionMode = kEMIntPortable;
      } else if (strcmp(propBuf, "int:fast") == 0) {
          executionMode = kEMIntFast;
      }
      property_get("dalvik.vm.stack-trace-file", stackTraceFileBuf, "");
      property_get("log.redirect-stdio", propBuf, "");
      if (strcmp(propBuf, "true") == 0) {
          logStdio = true;
      }
      strcpy(enableAssertBuf, "-ea:");
      property_get("dalvik.vm.enableassertions", enableAssertBuf+4, "");
      strcpy(jniOptsBuf, "-Xjniopts:");
      property_get("dalvik.vm.jniopts", jniOptsBuf+10, "");
      const char* rootDir = getenv("ANDROID_ROOT");
      if (rootDir == NULL) {
          rootDir = "/system";
          if (!hasDir("/system")) {
              LOG_FATAL("No root directory specified, and /android does not exist.");
              return;
          }
          setenv("ANDROID_ROOT", rootDir, 1);
      }
      const char* kernelHack = getenv("LD_ASSUME_KERNEL");
      opt.extraInfo = (void*) runtime_exit;
      opt.optionString = "exit";
      mOptions.add(opt);
      /* route fprintf() to our handler */
      opt.extraInfo = (void*) runtime_vfprintf;
      opt.optionString = "vfprintf";
      mOptions.add(opt);
      opt.extraInfo = NULL;
      /* enable verbose; standard options are { jni, gc, class } */
      //options[curOpt++].optionString = "-verbose:jni";
      opt.optionString = "-verbose:gc";
      mOptions.add(opt);
      //options[curOpt++].optionString = "-verbose:class";
  
  #ifdef CUSTOM_RUNTIME_HEAP_MAX
  #define __make_max_heap_opt(val) #val
  #define _make_max_heap_opt(val) "-Xmx" __make_max_heap_opt(val)
      opt.optionString = _make_max_heap_opt(CUSTOM_RUNTIME_HEAP_MAX);
  #undef __make_max_heap_opt
  #undef _make_max_heap_opt
  #else
      /* limit memory use to 16MB */
      opt.optionString = "-Xmx16m";
  #endif
      mOptions.add(opt);
  
      /*
       * Enable or disable dexopt features, such as bytecode verification and
       * calculation of register maps for precise GC.
       */
      property_get("dalvik.vm.dexopt-flags", dexoptFlagsBuf, "");
      if (dexoptFlagsBuf[0] != '\0') {
          const char* opc;
          const char* val;
  
          opc = strstr(dexoptFlagsBuf, "v=");     /* verification */
          if (opc != NULL) {
              switch (*(opc+2)) {
              case 'n':   val = "-Xverify:none";      break;
              case 'r':   val = "-Xverify:remote";    break;
              case 'a':   val = "-Xverify:all";       break;
              default:    val = NULL;                 break;
              }
  
              if (val != NULL) {
                  opt.optionString = val;
                  mOptions.add(opt);
              }
          }
  
          opc = strstr(dexoptFlagsBuf, "o=");     /* optimization */
          if (opc != NULL) {
              switch (*(opc+2)) {
              case 'n':   val = "-Xdexopt:none";      break;
              case 'v':   val = "-Xdexopt:verified";  break;
              case 'a':   val = "-Xdexopt:all";       break;
              default:    val = NULL;                 break;
              }
  
              if (val != NULL) {
                  opt.optionString = val;
                  mOptions.add(opt);
              }
          }
  
          opc = strstr(dexoptFlagsBuf, "m=y");    /* register map */
          if (opc != NULL) {
              opt.optionString = "-Xgenregmap";
              mOptions.add(opt);
          }
      }
  
      /* enable debugging; set suspend=y to pause during VM init */
  #ifdef HAVE_ANDROID_OS
      /* use android ADB transport */
      opt.optionString =
          "-agentlib:jdwp=transport=dt_android_adb,suspend=n,server=y";
  #else
      /* use TCP socket; address=0 means start at port 8000 and probe up */
      LOGI("Using TCP socket for JDWP\n");
      opt.optionString =
          "-agentlib:jdwp=transport=dt_socket,suspend=n,server=y,address=0";
  #endif
      mOptions.add(opt);
  
      char enableDPBuf[sizeof("-Xdeadlockpredict:") + PROPERTY_VALUE_MAX];
      property_get("dalvik.vm.deadlock-predict", propBuf, "");
      if (strlen(propBuf) > 0) {
          strcpy(enableDPBuf, "-Xdeadlockpredict:");
          strcat(enableDPBuf, propBuf);
          opt.optionString = enableDPBuf;
          mOptions.add(opt);
      }
  
      LOGD("CheckJNI is %s\n", checkJni ? "ON" : "OFF");
      if (checkJni) {
          /* extended JNI checking */
          opt.optionString = "-Xcheck:jni";
          mOptions.add(opt);
  
          /* set a cap on JNI global references */
          opt.optionString = "-Xjnigreflimit:2000";
          mOptions.add(opt);
  
          /* with -Xcheck:jni, this provides a JNI function call trace */
          //opt.optionString = "-verbose:jni";
          //mOptions.add(opt);
      }
      if (executionMode == kEMIntPortable) {
          opt.optionString = "-Xint:portable";
          mOptions.add(opt);
      } else if (executionMode == kEMIntFast) {
          opt.optionString = "-Xint:fast";
          mOptions.add(opt);
      }
      if (logStdio) {
          /* convert stdout/stderr to log messages */
          opt.optionString = "-Xlog-stdio";
          mOptions.add(opt);
      }
  
      if (enableAssertBuf[4] != '\0') {
          /* accept "all" to mean "all classes and packages" */
          if (strcmp(enableAssertBuf+4, "all") == 0)
              enableAssertBuf[3] = '\0';
          LOGI("Assertions enabled: '%s'\n", enableAssertBuf);
          opt.optionString = enableAssertBuf;
          mOptions.add(opt);
      } else {
          LOGV("Assertions disabled\n");
      }
  
      if (jniOptsBuf[10] != '\0') {
          LOGI("JNI options: '%s'\n", jniOptsBuf);
          opt.optionString = jniOptsBuf;
          mOptions.add(opt);
      }
  
      if (stackTraceFileBuf[0] != '\0') {
          static const char* stfOptName = "-Xstacktracefile:";
  
          stackTraceFile = (char*) malloc(strlen(stfOptName) +
              strlen(stackTraceFileBuf) +1);
          strcpy(stackTraceFile, stfOptName);
          strcat(stackTraceFile, stackTraceFileBuf);
          opt.optionString = stackTraceFile;
          mOptions.add(opt);
      }
      
      /* Set the properties for locale */
      {
          char langOption[sizeof("-Duser.language=") + 3];
          char regionOption[sizeof("-Duser.region=") + 3];
          strcpy(langOption, "-Duser.language=");
          strcpy(regionOption, "-Duser.region=");
          readLocale(langOption, regionOption);
          opt.extraInfo = NULL;
          opt.optionString = langOption;
          mOptions.add(opt);
          opt.optionString = regionOption;
          mOptions.add(opt);
      }
  
      /*
       * We don't have /tmp on the device, but we often have an SD card.  Apps
       * shouldn't use this, but some test suites might want to exercise it.
       */
      opt.optionString = "-Djava.io.tmpdir=/sdcard";
      mOptions.add(opt);
  
      initArgs.version = JNI_VERSION_1_4;
      initArgs.options = mOptions.editArray();
      initArgs.nOptions = mOptions.size();
      initArgs.ignoreUnrecognized = JNI_FALSE;    
      if (JNI_CreateJavaVM(&mJavaVM, &env, &initArgs) < 0) {
          LOGE("JNI_CreateJavaVM failed\n");
          goto bail;
      }
      /*
       * Register android functions.
       */
      if (startReg(env) < 0) {
          LOGE("Unable to register all android natives\n");
          goto bail;
      }
  
      /*
       * We want to call main() with a String array with arguments in it.
       * At present we only have one argument, the class name.  Create an
       * array to hold it.
       */
      jclass stringClass;
      jobjectArray strArray;
      jstring classNameStr;
      jstring startSystemServerStr;
  
      stringClass = env->FindClass("java/lang/String");
      assert(stringClass != NULL);
      strArray = env->NewObjectArray(2, stringClass, NULL);
      assert(strArray != NULL);
      classNameStr = env->NewStringUTF(className);
      assert(classNameStr != NULL);
      env->SetObjectArrayElement(strArray, 0, classNameStr);
      startSystemServerStr = env->NewStringUTF(startSystemServer ? 
                                                   "true" : "false");
      env->SetObjectArrayElement(strArray, 1, startSystemServerStr);
  
      /*
       * Start VM.  This thread becomes the main thread of the VM, and will
       * not return until the VM exits.
       */
      jclass startClass;
      jmethodID startMeth;
  
      slashClassName = strdup(className);
      for (cp = slashClassName; *cp != '\0'; cp++)
          if (*cp == '.')
              *cp = '/';
  
      startClass = env->FindClass(slashClassName);
      if (startClass == NULL) {
          LOGE("JavaVM unable to locate class '%s'\n", slashClassName);
          /* keep going */
      } else {
          startMeth = env->GetStaticMethodID(startClass, "main",
              "([Ljava/lang/String;)V");
          if (startMeth == NULL) {
              LOGE("JavaVM unable to find main() in '%s'\n", className);
              /* keep going */
          } else {
              env->CallStaticVoidMethod(startClass, startMeth, strArray);
  
  #if 0
              if (env->ExceptionCheck())
                  threadExitUncaughtException(env);
  #endif
          }
      }
  
      LOGD("Shutting down VM\n");
      if (mJavaVM->DetachCurrentThread() != JNI_OK)
          LOGW("Warning: unable to detach main thread\n");
      if (mJavaVM->DestroyJavaVM() != 0)
          LOGW("Warning: VM did not shut down cleanly\n");
  
  bail:
      free(slashClassName);
      free(stackTraceFile);
  }
  
  void AndroidRuntime::start()
  {
      start("com.android.internal.os.RuntimeInit",
          false /* Don't start the system server */);
  }

• Zygote

• /*
   * Copyright (C) 2006 The Android Open Source Project
   *
   * Licensed under the Apache License, Version 2.0 (the "License");
   * you may not use this file except in compliance with the License.
   * You may obtain a copy of the License at
   *
   *      http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  package dalvik.system;
  
  /**
   * Provides access to the Dalvik "zygote" feature, which allows a VM instance to
   * be partially initialized and then fork()'d from the partially initialized
   * state.
   *
   * @hide
   */
  public class Zygote {
      /*
       * Bit values for "debugFlags" argument.  The definitions are duplicated
       * in the native code.
       */
      /** enable debugging over JDWP */
      public static final int DEBUG_ENABLE_DEBUGGER   = 1;
      /** enable JNI checks */
      public static final int DEBUG_ENABLE_CHECKJNI   = 1 << 1;
      /** enable Java programming language "assert" statements */
      public static final int DEBUG_ENABLE_ASSERT     = 1 << 2;
      /** disable the JIT compiler */
      public static final int DEBUG_ENABLE_SAFEMODE   = 1 << 3;
  
      /**
       * When set by the system server, all subsequent apps will be launched in
       * VM safe mode.
       *
       * @hide
       */
      public static boolean systemInSafeMode = false;
  
      private Zygote() {}
  
      /**
       * Forks a new Zygote instance, but does not leave the zygote mode.
       * The current VM must have been started with the -Xzygote flag. The
       * new child is expected to eventually call forkAndSpecialize()
       *
       * @return 0 if this is the child, pid of the child
       * if this is the parent, or -1 on error
       */
      native public static int fork();
  
      /**
       * Forks a new VM instance.  The current VM must have been started
       * with the -Xzygote flag. <b>NOTE: new instance keeps all
       * root capabilities. The new process is expected to call capset()</b>.
       *
       * @param uid the UNIX uid that the new process should setuid() to after
       * fork()ing and and before spawning any threads.
       * @param gid the UNIX gid that the new process should setgid() to after
       * fork()ing and and before spawning any threads.
       * @param gids null-ok; a list of UNIX gids that the new process should
       * setgroups() to after fork and before spawning any threads.
       * @param debugFlags bit flags that enable debugging features.
       * @param rlimits null-ok an array of rlimit tuples, with the second
       * dimension having a length of 3 and representing
       * (resource, rlim_cur, rlim_max). These are set via the posix
       * setrlimit(2) call.
       *
       * @return 0 if this is the child, pid of the child
       * if this is the parent, or -1 on error.
       */
      native public static int forkAndSpecialize(int uid, int gid, int[] gids,
              int debugFlags, int[][] rlimits);
  
      /**
       * Forks a new VM instance.
       * @deprecated use {@link Zygote#forkAndSpecialize(int, int, int[], int, int[][])}
       */
      @Deprecated
      public static int forkAndSpecialize(int uid, int gid, int[] gids,
              boolean enableDebugger, int[][] rlimits) {
          int debugFlags = enableDebugger ? DEBUG_ENABLE_DEBUGGER : 0;
          return forkAndSpecialize(uid, gid, gids, debugFlags, rlimits);
      }
  
      /**
       * Special method to start the system server process. In addition to the
       * common actions performed in forkAndSpecialize, the pid of the child
       * process is recorded such that the death of the child process will cause
       * zygote to exit.
       *
       * @param uid the UNIX uid that the new process should setuid() to after
       * fork()ing and and before spawning any threads.
       * @param gid the UNIX gid that the new process should setgid() to after
       * fork()ing and and before spawning any threads.
       * @param gids null-ok; a list of UNIX gids that the new process should
       * setgroups() to after fork and before spawning any threads.
       * @param debugFlags bit flags that enable debugging features.
       * @param rlimits null-ok an array of rlimit tuples, with the second
       * dimension having a length of 3 and representing
       * (resource, rlim_cur, rlim_max). These are set via the posix
       * setrlimit(2) call.
       * @param permittedCapabilities argument for setcap()
       * @param effectiveCapabilities argument for setcap()
       *
       * @return 0 if this is the child, pid of the child
       * if this is the parent, or -1 on error.
       */
      native public static int forkSystemServer(int uid, int gid,
              int[] gids, int debugFlags, int[][] rlimits,
              long permittedCapabilities, long effectiveCapabilities);
  
      /**
       * Special method to start the system server process.
       * @deprecated use {@link Zygote#forkSystemServer(int, int, int[], int, int[][])}
       */
      @Deprecated
      public static int forkSystemServer(int uid, int gid, int[] gids,
              boolean enableDebugger, int[][] rlimits) {
          int debugFlags = enableDebugger ? DEBUG_ENABLE_DEBUGGER : 0;
          return forkAndSpecialize(uid, gid, gids, debugFlags, rlimits);
      }
  }

• ZygoteInit

• /*
   * Copyright (C) 2007 The Android Open Source Project
   *
   * Licensed under the Apache License, Version 2.0 (the "License");
   * you may not use this file except in compliance with the License.
   * You may obtain a copy of the License at
   *
   *      http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  package com.android.internal.os;
  
  import android.content.pm.ActivityInfo;
  import android.content.res.Resources;
  import android.content.res.TypedArray;
  import android.graphics.drawable.Drawable;
  import android.net.LocalServerSocket;
  import android.os.Debug;
  import android.os.FileUtils;
  import android.os.Process;
  import android.os.SystemClock;
  import android.os.SystemProperties;
  import android.util.EventLog;
  import android.util.Log;
  
  import dalvik.system.VMRuntime;
  import dalvik.system.Zygote;
  
  import libcore.io.IoUtils;
  
  import java.io.BufferedReader;
  import java.io.FileDescriptor;
  import java.io.IOException;
  import java.io.InputStream;
  import java.io.InputStreamReader;
  import java.lang.reflect.InvocationTargetException;
  import java.lang.reflect.Method;
  import java.lang.reflect.Modifier;
  import java.util.ArrayList;
  
  /**
   * Startup class for the zygote process.
   *
   * Pre-initializes some classes, and then waits for commands on a UNIX domain
   * socket. Based on these commands, forks off child processes that inherit
   * the initial state of the VM.
   *
   * Please see {@link ZygoteConnection.Arguments} for documentation on the
   * client protocol.
   *
   * @hide
   */
  public class ZygoteInit {
  
      private static final String TAG = "Zygote";
  
      private static final String ANDROID_SOCKET_ENV = "ANDROID_SOCKET_zygote";
  
      private static final int LOG_BOOT_PROGRESS_PRELOAD_START = 3020;
      private static final int LOG_BOOT_PROGRESS_PRELOAD_END = 3030;
  
      /** when preloading, GC after allocating this many bytes */
      private static final int PRELOAD_GC_THRESHOLD = 50000;
  
      public static final String USAGE_STRING =
              " <\"start-system-server\"|\"\" for startSystemServer>";
  
      private static LocalServerSocket sServerSocket;
  
      /**
       * Used to pre-load resources.  We hold a global reference on it so it
       * never gets destroyed.
       */
      private static Resources mResources;
  
      /**
       * The number of times that the main Zygote loop
       * should run before calling gc() again.
       */
      static final int GC_LOOP_COUNT = 10;
  
      /**
       * If true, zygote forks for each peer. If false, a select loop is used
       * inside a single process. The latter is preferred.
       */
      private static final boolean ZYGOTE_FORK_MODE = false;
  
      /**
       * The name of a resource file that contains classes to preload.
       */
      private static final String PRELOADED_CLASSES = "preloaded-classes";
  
      /** Controls whether we should preload resources during zygote init. */
      private static final boolean PRELOAD_RESOURCES = true;
  
      /**
       * Invokes a static "main(argv[]) method on class "className".
       * Converts various failing exceptions into RuntimeExceptions, with
       * the assumption that they will then cause the VM instance to exit.
       *
       * @param loader class loader to use
       * @param className Fully-qualified class name
       * @param argv Argument vector for main()
       */
      static void invokeStaticMain(ClassLoader loader,
              String className, String[] argv)
              throws ZygoteInit.MethodAndArgsCaller {
          Class<?> cl;
  
          try {
              cl = loader.loadClass(className);
          } catch (ClassNotFoundException ex) {
              throw new RuntimeException(
                      "Missing class when invoking static main " + className,
                      ex);
          }
  
          Method m;
          try {
              m = cl.getMethod("main", new Class[] { String[].class });
          } catch (NoSuchMethodException ex) {
              throw new RuntimeException(
                      "Missing static main on " + className, ex);
          } catch (SecurityException ex) {
              throw new RuntimeException(
                      "Problem getting static main on " + className, ex);
          }
  
          int modifiers = m.getModifiers();
          if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {
              throw new RuntimeException(
                      "Main method is not public and static on " + className);
          }
  
          /*
           * This throw gets caught in ZygoteInit.main(), which responds
           * by invoking the exception's run() method. This arrangement
           * clears up all the stack frames that were required in setting
           * up the process.
           */
          throw new ZygoteInit.MethodAndArgsCaller(m, argv);
      }
  
      /**
       * Registers a server socket for zygote command connections
       *
       * @throws RuntimeException when open fails
       */
      private static void registerZygoteSocket() {
          if (sServerSocket == null) {
              int fileDesc;
              try {
                  String env = System.getenv(ANDROID_SOCKET_ENV);
                  fileDesc = Integer.parseInt(env);
              } catch (RuntimeException ex) {
                  throw new RuntimeException(
                          ANDROID_SOCKET_ENV + " unset or invalid", ex);
              }
  
              try {
                  sServerSocket = new LocalServerSocket(
                          createFileDescriptor(fileDesc));
              } catch (IOException ex) {
                  throw new RuntimeException(
                          "Error binding to local socket '" + fileDesc + "'", ex);
              }
          }
      }
  
      /**
       * Waits for and accepts a single command connection. Throws
       * RuntimeException on failure.
       */
      private static ZygoteConnection acceptCommandPeer() {
          try {
              return new ZygoteConnection(sServerSocket.accept());
          } catch (IOException ex) {
              throw new RuntimeException(
                      "IOException during accept()", ex);
          }
      }
  
      /**
       * Close and clean up zygote sockets. Called on shutdown and on the
       * child's exit path.
       */
      static void closeServerSocket() {
          try {
              if (sServerSocket != null) {
                  sServerSocket.close();
              }
          } catch (IOException ex) {
              Log.e(TAG, "Zygote:  error closing sockets", ex);
          }
  
          sServerSocket = null;
      }
  
      private static final int UNPRIVILEGED_UID = 9999;
      private static final int UNPRIVILEGED_GID = 9999;
  
      private static final int ROOT_UID = 0;
      private static final int ROOT_GID = 0;
  
      /**
       * Sets effective user ID.
       */
      private static void setEffectiveUser(int uid) {
          int errno = setreuid(ROOT_UID, uid);
          if (errno != 0) {
              Log.e(TAG, "setreuid() failed. errno: " + errno);
          }
      }
  
      /**
       * Sets effective group ID.
       */
      private static void setEffectiveGroup(int gid) {
          int errno = setregid(ROOT_GID, gid);
          if (errno != 0) {
              Log.e(TAG, "setregid() failed. errno: " + errno);
          }
      }
  
      static void preload() {
          preloadClasses();
          preloadResources();
      }
  
      /**
       * Performs Zygote process initialization. Loads and initializes
       * commonly used classes.
       *
       * Most classes only cause a few hundred bytes to be allocated, but
       * a few will allocate a dozen Kbytes (in one case, 500+K).
       */
      private static void preloadClasses() {
          final VMRuntime runtime = VMRuntime.getRuntime();
  
          InputStream is = ZygoteInit.class.getClassLoader().getResourceAsStream(
                  PRELOADED_CLASSES);
          if (is == null) {
              Log.e(TAG, "Couldn't find " + PRELOADED_CLASSES + ".");
          } else {
              Log.i(TAG, "Preloading classes...");
              long startTime = SystemClock.uptimeMillis();
  
              // Drop root perms while running static initializers.
              setEffectiveGroup(UNPRIVILEGED_GID);
              setEffectiveUser(UNPRIVILEGED_UID);
  
              // Alter the target heap utilization.  With explicit GCs this
              // is not likely to have any effect.
              float defaultUtilization = runtime.getTargetHeapUtilization();
              runtime.setTargetHeapUtilization(0.8f);
  
              // Start with a clean slate.
              System.gc();
              runtime.runFinalizationSync();
              Debug.startAllocCounting();
  
              try {
                  BufferedReader br
                      = new BufferedReader(new InputStreamReader(is), 256);
  
                  int count = 0;
                  String line;
                  while ((line = br.readLine()) != null) {
                      // Skip comments and blank lines.
                      line = line.trim();
                      if (line.startsWith("#") || line.equals("")) {
                          continue;
                      }
  
                      try {
                          if (false) {
                              Log.v(TAG, "Preloading " + line + "...");
                          }
                          Class.forName(line);
                          if (Debug.getGlobalAllocSize() > PRELOAD_GC_THRESHOLD) {
                              if (false) {
                                  Log.v(TAG,
                                      " GC at " + Debug.getGlobalAllocSize());
                              }
                              System.gc();
                              runtime.runFinalizationSync();
                              Debug.resetGlobalAllocSize();
                          }
                          count++;
                      } catch (ClassNotFoundException e) {
                          Log.w(TAG, "Class not found for preloading: " + line);
                      } catch (Throwable t) {
                          Log.e(TAG, "Error preloading " + line + ".", t);
                          if (t instanceof Error) {
                              throw (Error) t;
                          }
                          if (t instanceof RuntimeException) {
                              throw (RuntimeException) t;
                          }
                          throw new RuntimeException(t);
                      }
                  }
  
                  Log.i(TAG, "...preloaded " + count + " classes in "
                          + (SystemClock.uptimeMillis()-startTime) + "ms.");
              } catch (IOException e) {
                  Log.e(TAG, "Error reading " + PRELOADED_CLASSES + ".", e);
              } finally {
                  IoUtils.closeQuietly(is);
                  // Restore default.
                  runtime.setTargetHeapUtilization(defaultUtilization);
  
                  Debug.stopAllocCounting();
  
                  // Bring back root. We'll need it later.
                  setEffectiveUser(ROOT_UID);
                  setEffectiveGroup(ROOT_GID);
              }
          }
      }
  
      /**
       * Load in commonly used resources, so they can be shared across
       * processes.
       *
       * These tend to be a few Kbytes, but are frequently in the 20-40K
       * range, and occasionally even larger.
       */
      private static void preloadResources() {
          final VMRuntime runtime = VMRuntime.getRuntime();
  
          Debug.startAllocCounting();
          try {
              System.gc();
              runtime.runFinalizationSync();
              mResources = Resources.getSystem();
              mResources.startPreloading();
              if (PRELOAD_RESOURCES) {
                  Log.i(TAG, "Preloading resources...");
  
                  long startTime = SystemClock.uptimeMillis();
                  TypedArray ar = mResources.obtainTypedArray(
                          com.android.internal.R.array.preloaded_drawables);
                  int N = preloadDrawables(runtime, ar);
                  Log.i(TAG, "...preloaded " + N + " resources in "
                          + (SystemClock.uptimeMillis()-startTime) + "ms.");
  
                  startTime = SystemClock.uptimeMillis();
                  ar = mResources.obtainTypedArray(
                          com.android.internal.R.array.preloaded_color_state_lists);
                  N = preloadColorStateLists(runtime, ar);
                  Log.i(TAG, "...preloaded " + N + " resources in "
                          + (SystemClock.uptimeMillis()-startTime) + "ms.");
              }
              mResources.finishPreloading();
          } catch (RuntimeException e) {
              Log.w(TAG, "Failure preloading resources", e);
          } finally {
              Debug.stopAllocCounting();
          }
      }
  
      private static int preloadColorStateLists(VMRuntime runtime, TypedArray ar) {
          int N = ar.length();
          for (int i=0; i<N; i++) {
              if (Debug.getGlobalAllocSize() > PRELOAD_GC_THRESHOLD) {
                  if (false) {
                      Log.v(TAG, " GC at " + Debug.getGlobalAllocSize());
                  }
                  System.gc();
                  runtime.runFinalizationSync();
                  Debug.resetGlobalAllocSize();
              }
              int id = ar.getResourceId(i, 0);
              if (false) {
                  Log.v(TAG, "Preloading resource #" + Integer.toHexString(id));
              }
              if (id != 0) {
                  mResources.getColorStateList(id);
              }
          }
          return N;
      }
  
  
      private static int preloadDrawables(VMRuntime runtime, TypedArray ar) {
          int N = ar.length();
          for (int i=0; i<N; i++) {
              if (Debug.getGlobalAllocSize() > PRELOAD_GC_THRESHOLD) {
                  if (false) {
                      Log.v(TAG, " GC at " + Debug.getGlobalAllocSize());
                  }
                  System.gc();
                  runtime.runFinalizationSync();
                  Debug.resetGlobalAllocSize();
              }
              int id = ar.getResourceId(i, 0);
              if (false) {
                  Log.v(TAG, "Preloading resource #" + Integer.toHexString(id));
              }
              if (id != 0) {
                  Drawable dr = mResources.getDrawable(id);
                  if ((dr.getChangingConfigurations()&~ActivityInfo.CONFIG_FONT_SCALE) != 0) {
                      Log.w(TAG, "Preloaded drawable resource #0x"
                              + Integer.toHexString(id)
                              + " (" + ar.getString(i) + ") that varies with configuration!!");
                  }
              }
          }
          return N;
      }
  
      /**
       * Runs several special GCs to try to clean up a few generations of
       * softly- and final-reachable objects, along with any other garbage.
       * This is only useful just before a fork().
       */
      /*package*/ static void gc() {
          final VMRuntime runtime = VMRuntime.getRuntime();
  
          /* runFinalizationSync() lets finalizers be called in Zygote,
           * which doesn't have a HeapWorker thread.
           */
          System.gc();
          runtime.runFinalizationSync();
          System.gc();
          runtime.runFinalizationSync();
          System.gc();
          runtime.runFinalizationSync();
      }
  
      /**
       * Finish remaining work for the newly forked system server process.
       */
      private static void handleSystemServerProcess(
              ZygoteConnection.Arguments parsedArgs)
              throws ZygoteInit.MethodAndArgsCaller {
  
          closeServerSocket();
  
          // set umask to 0077 so new files and directories will default to owner-only permissions.
          FileUtils.setUMask(FileUtils.S_IRWXG | FileUtils.S_IRWXO);
  
          if (parsedArgs.niceName != null) {
              Process.setArgV0(parsedArgs.niceName);
          }
  
          if (parsedArgs.invokeWith != null) {
              WrapperInit.execApplication(parsedArgs.invokeWith,
                      parsedArgs.niceName, parsedArgs.targetSdkVersion,
                      null, parsedArgs.remainingArgs);
          } else {
              /*
               * Pass the remaining arguments to SystemServer.
               */
              RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs);
          }
  
          /* should never reach here */
      }
  
      /**
       * Prepare the arguments and fork for the system server process.
       */
      private static boolean startSystemServer()
              throws MethodAndArgsCaller, RuntimeException {
          /* Hardcoded command line to start the system server */
          String args[] = {
              "--setuid=1000",
              "--setgid=1000",
              "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,3001,3002,3003,3006,3007",
              "--capabilities=130104352,130104352",
              "--runtime-init",
              "--nice-name=system_server",
              "com.android.server.SystemServer",
          };
          ZygoteConnection.Arguments parsedArgs = null;
  
          int pid;
  
          try {
              parsedArgs = new ZygoteConnection.Arguments(args);
              ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
              ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);
  
              /* Request to fork the system server process */
              pid = Zygote.forkSystemServer(
                      parsedArgs.uid, parsedArgs.gid,
                      parsedArgs.gids,
                      parsedArgs.debugFlags,
                      null,
                      parsedArgs.permittedCapabilities,
                      parsedArgs.effectiveCapabilities);
          } catch (IllegalArgumentException ex) {
              throw new RuntimeException(ex);
          }
  
          /* For child process */
          if (pid == 0) {
              handleSystemServerProcess(parsedArgs);
          }
  
          return true;
      }
  
      public static void main(String argv[]) {
          try {
              // Start profiling the zygote initialization.
              SamplingProfilerIntegration.start();
  
              registerZygoteSocket();
              EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
                  SystemClock.uptimeMillis());
              preload();
              EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
                  SystemClock.uptimeMillis());
  
              // Finish profiling the zygote initialization.
              SamplingProfilerIntegration.writeZygoteSnapshot();
  
              // Do an initial gc to clean up after startup
              gc();
  
              // If requested, start system server directly from Zygote
              if (argv.length != 2) {
                  throw new RuntimeException(argv[0] + USAGE_STRING);
              }
  
              if (argv[1].equals("start-system-server")) {
                  startSystemServer();
              } else if (!argv[1].equals("")) {
                  throw new RuntimeException(argv[0] + USAGE_STRING);
              }
  
              Log.i(TAG, "Accepting command socket connections");
  
              if (ZYGOTE_FORK_MODE) {
                  runForkMode();
              } else {
                  runSelectLoopMode();
              }
  
              closeServerSocket();
          } catch (MethodAndArgsCaller caller) {
              caller.run();
          } catch (RuntimeException ex) {
              Log.e(TAG, "Zygote died with exception", ex);
              closeServerSocket();
              throw ex;
          }
      }
  
      /**
       * Runs the zygote in accept-and-fork mode. In this mode, each peer
       * gets its own zygote spawner process. This code is retained for
       * reference only.
       *
       * @throws MethodAndArgsCaller in a child process when a main() should
       * be executed.
       */
      private static void runForkMode() throws MethodAndArgsCaller {
          while (true) {
              ZygoteConnection peer = acceptCommandPeer();
  
              int pid;
  
              pid = Zygote.fork();
  
              if (pid == 0) {
                  // The child process should handle the peer requests
  
                  // The child does not accept any more connections
                  try {
                      sServerSocket.close();
                  } catch (IOException ex) {
                      Log.e(TAG, "Zygote Child: error closing sockets", ex);
                  } finally {
                      sServerSocket = null;
                  }
  
                  peer.run();
                  break;
              } else if (pid > 0) {
                  peer.closeSocket();
              } else {
                  throw new RuntimeException("Error invoking fork()");
              }
          }
      }
  
      /**
       * Runs the zygote process's select loop. Accepts new connections as
       * they happen, and reads commands from connections one spawn-request's
       * worth at a time.
       *
       * @throws MethodAndArgsCaller in a child process when a main() should
       * be executed.
       */
      private static void runSelectLoopMode() throws MethodAndArgsCaller {
          ArrayList<FileDescriptor> fds = new ArrayList();
          ArrayList<ZygoteConnection> peers = new ArrayList();
          FileDescriptor[] fdArray = new FileDescriptor[4];
  
          fds.add(sServerSocket.getFileDescriptor());
          peers.add(null);
  
          int loopCount = GC_LOOP_COUNT;
          while (true) {
              int index;
  
              /*
               * Call gc() before we block in select().
               * It's work that has to be done anyway, and it's better
               * to avoid making every child do it.  It will also
               * madvise() any free memory as a side-effect.
               *
               * Don't call it every time, because walking the entire
               * heap is a lot of overhead to free a few hundred bytes.
               */
              if (loopCount <= 0) {
                  gc();
                  loopCount = GC_LOOP_COUNT;
              } else {
                  loopCount--;
              }
  
  
              try {
                  fdArray = fds.toArray(fdArray);
                  index = selectReadable(fdArray);
              } catch (IOException ex) {
                  throw new RuntimeException("Error in select()", ex);
              }
  
              if (index < 0) {
                  throw new RuntimeException("Error in select()");
              } else if (index == 0) {
                  ZygoteConnection newPeer = acceptCommandPeer();
                  peers.add(newPeer);
                  fds.add(newPeer.getFileDesciptor());
              } else {
                  boolean done;
                  done = peers.get(index).runOnce();
  
                  if (done) {
                      peers.remove(index);
                      fds.remove(index);
                  }
              }
          }
      }
  
      /**
       * The Linux syscall "setreuid()"
       * @param ruid real uid
       * @param euid effective uid
       * @return 0 on success, non-zero errno on fail
       */
      static native int setreuid(int ruid, int euid);
  
      /**
       * The Linux syscall "setregid()"
       * @param rgid real gid
       * @param egid effective gid
       * @return 0 on success, non-zero errno on fail
       */
      static native int setregid(int rgid, int egid);
  
      /**
       * Invokes the linux syscall "setpgid"
       *
       * @param pid pid to change
       * @param pgid new process group of pid
       * @return 0 on success or non-zero errno on fail
       */
      static native int setpgid(int pid, int pgid);
  
      /**
       * Invokes the linux syscall "getpgid"
       *
       * @param pid pid to query
       * @return pgid of pid in question
       * @throws IOException on error
       */
      static native int getpgid(int pid) throws IOException;
  
      /**
       * Invokes the syscall dup2() to copy the specified descriptors into
       * stdin, stdout, and stderr. The existing stdio descriptors will be
       * closed and errors during close will be ignored. The specified
       * descriptors will also remain open at their original descriptor numbers,
       * so the caller may want to close the original descriptors.
       *
       * @param in new stdin
       * @param out new stdout
       * @param err new stderr
       * @throws IOException
       */
      static native void reopenStdio(FileDescriptor in,
              FileDescriptor out, FileDescriptor err) throws IOException;
  
      /**
       * Toggles the close-on-exec flag for the specified file descriptor.
       *
       * @param fd non-null; file descriptor
       * @param flag desired close-on-exec flag state
       * @throws IOException
       */
      static native void setCloseOnExec(FileDescriptor fd, boolean flag)
              throws IOException;
  
      /**
       * Retrieves the permitted capability set from another process.
       *
       * @param pid &gt;=0 process ID or 0 for this process
       * @throws IOException on error
       */
      static native long capgetPermitted(int pid)
              throws IOException;
  
      /**
       * Sets the permitted and effective capability sets of this process.
       *
       * @param permittedCapabilities permitted set
       * @param effectiveCapabilities effective set
       * @throws IOException on error
       */
      static native void setCapabilities(
              long permittedCapabilities,
              long effectiveCapabilities) throws IOException;
  
      /**
       * Invokes select() on the provider array of file descriptors (selecting
       * for readability only). Array elements of null are ignored.
       *
       * @param fds non-null; array of readable file descriptors
       * @return index of descriptor that is now readable or -1 for empty array.
       * @throws IOException if an error occurs
       */
      static native int selectReadable(FileDescriptor[] fds) throws IOException;
  
      /**
       * Creates a file descriptor from an int fd.
       *
       * @param fd integer OS file descriptor
       * @return non-null; FileDescriptor instance
       * @throws IOException if fd is invalid
       */
      static native FileDescriptor createFileDescriptor(int fd)
              throws IOException;
  
      /**
       * Class not instantiable.
       */
      private ZygoteInit() {
      }
  
      /**
       * Helper exception class which holds a method and arguments and
       * can call them. This is used as part of a trampoline to get rid of
       * the initial process setup stack frames.
       */
      public static class MethodAndArgsCaller extends Exception
              implements Runnable {
          /** method to call */
          private final Method mMethod;
  
          /** argument array */
          private final String[] mArgs;
  
          public MethodAndArgsCaller(Method method, String[] args) {
              mMethod = method;
              mArgs = args;
          }
  
          public void run() {
              try {
                  mMethod.invoke(null, new Object[] { mArgs });
              } catch (IllegalAccessException ex) {
                  throw new RuntimeException(ex);
              } catch (InvocationTargetException ex) {
                  Throwable cause = ex.getCause();
                  if (cause instanceof RuntimeException) {
                      throw (RuntimeException) cause;
                  } else if (cause instanceof Error) {
                      throw (Error) cause;
                  }
                  throw new RuntimeException(ex);
              }
          }
      }
  }

      public static void main(String argv[]) {
          try {
              // Start profiling the zygote initialization.
              SamplingProfilerIntegration.start();
              registerZygoteSocket();
              EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
                  SystemClock.uptimeMillis());
              preload();
              EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
                  SystemClock.uptimeMillis());
              // Finish profiling the zygote initialization.
              SamplingProfilerIntegration.writeZygoteSnapshot();
              // Do an initial gc to clean up after startup
              gc();
              // If requested, start system server directly from Zygote
              if (argv.length != 2) {
                  throw new RuntimeException(argv[0] + USAGE_STRING);
              }
              if (argv[1].equals("start-system-server")) {
                 startSystemServer();
              } else if (!argv[1].equals("")) {
                  throw new RuntimeException(argv[0] + USAGE_STRING);
              }
              Log.i(TAG, "Accepting command socket connections");
              if (ZYGOTE_FORK_MODE) {
                  runForkMode();
              } else {
                  runSelectLoopMode();
              }
              closeServerSocket();
          } catch (MethodAndArgsCaller caller) {
              caller.run();
          } catch (RuntimeException ex) {
              Log.e(TAG, "Zygote died with exception", ex);
              closeServerSocket();
              throw ex;
          }
      }

SystemServer(androidService)

• SystemServer.java

• /**
   * Copyright (C) 2006 The Android Open Source Project
   *
   * Licensed under the Apache License, Version 2.0 (the "License");
   * you may not use this file except in compliance with the License.
   * You may obtain a copy of the License at
   *
   *      http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  package com.android.server;
  
  import android.accounts.AccountManagerService;
  import android.app.ActivityManagerNative;
  import android.bluetooth.BluetoothAdapter;
  import android.content.ComponentName;
  import android.content.ContentResolver;
  import android.content.ContentService;
  import android.content.Context;
  import android.content.Intent;
  import android.content.pm.IPackageManager;
  import android.content.res.Configuration;
  import android.media.AudioService;
  import android.net.wifi.p2p.WifiP2pService;
  import android.os.Looper;
  import android.os.RemoteException;
  import android.os.ServiceManager;
  import android.os.StrictMode;
  import android.os.SystemClock;
  import android.os.SystemProperties;
  import android.provider.Settings;
  import android.server.BluetoothA2dpService;
  import android.server.BluetoothService;
  import android.server.search.SearchManagerService;
  import android.util.DisplayMetrics;
  import android.util.EventLog;
  import android.util.Log;
  import android.util.Slog;
  import android.view.WindowManager;
  
  import com.android.internal.app.ShutdownThread;
  import com.android.internal.os.BinderInternal;
  import com.android.internal.os.SamplingProfilerIntegration;
  import com.android.server.accessibility.AccessibilityManagerService;
  import com.android.server.am.ActivityManagerService;
  import com.android.server.net.NetworkPolicyManagerService;
  import com.android.server.net.NetworkStatsService;
  import com.android.server.pm.PackageManagerService;
  import com.android.server.usb.UsbService;
  import com.android.server.wm.WindowManagerService;
  
  import dalvik.system.VMRuntime;
  import dalvik.system.Zygote;
  
  import java.io.File;
  import java.util.Timer;
  import java.util.TimerTask;
  
  class ServerThread extends Thread {
      private static final String TAG = "SystemServer";
      private static final String ENCRYPTING_STATE = "trigger_restart_min_framework";
      private static final String ENCRYPTED_STATE = "1";
  
      ContentResolver mContentResolver;
  
      void reportWtf(String msg, Throwable e) {
          Slog.w(TAG, "***********************************************");
          Log.wtf(TAG, "BOOT FAILURE " + msg, e);
      }
  
      @Override
      public void run() {
          EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_SYSTEM_RUN,
              SystemClock.uptimeMillis());
  
          Looper.prepare();
  
          android.os.Process.setThreadPriority(
                  android.os.Process.THREAD_PRIORITY_FOREGROUND);
  
          BinderInternal.disableBackgroundScheduling(true);
          android.os.Process.setCanSelfBackground(false);
  
          // Check whether we failed to shut down last time we tried.
          {
              final String shutdownAction = SystemProperties.get(
                      ShutdownThread.SHUTDOWN_ACTION_PROPERTY, "");
              if (shutdownAction != null && shutdownAction.length() > 0) {
                  boolean reboot = (shutdownAction.charAt(0) == '1');
  
                  final String reason;
                  if (shutdownAction.length() > 1) {
                      reason = shutdownAction.substring(1, shutdownAction.length());
                  } else {
                      reason = null;
                  }
  
                  ShutdownThread.rebootOrShutdown(reboot, reason);
              }
          }
  
          String factoryTestStr = SystemProperties.get("ro.factorytest");
          int factoryTest = "".equals(factoryTestStr) ? SystemServer.FACTORY_TEST_OFF
                  : Integer.parseInt(factoryTestStr);
  
          LightsService lights = null;
          PowerManagerService power = null;
          BatteryService battery = null;
          AlarmManagerService alarm = null;
          NetworkManagementService networkManagement = null;
          NetworkStatsService networkStats = null;
          NetworkPolicyManagerService networkPolicy = null;
          ConnectivityService connectivity = null;
          WifiP2pService wifiP2p = null;
          WifiService wifi = null;
          IPackageManager pm = null;
          Context context = null;
          WindowManagerService wm = null;
          BluetoothService bluetooth = null;
          BluetoothA2dpService bluetoothA2dp = null;
          DockObserver dock = null;
          UsbService usb = null;
          UiModeManagerService uiMode = null;
          RecognitionManagerService recognition = null;
          ThrottleService throttle = null;
          NetworkTimeUpdateService networkTimeUpdater = null;
  
          // Critical services...
          try {
              Slog.i(TAG, "Entropy Service");
              ServiceManager.addService("entropy", new EntropyService());
  
              Slog.i(TAG, "Power Manager");
              power = new PowerManagerService();
              ServiceManager.addService(Context.POWER_SERVICE, power);
  
              Slog.i(TAG, "Activity Manager");
              context = ActivityManagerService.main(factoryTest);
  
              Slog.i(TAG, "Telephony Registry");
              ServiceManager.addService("telephony.registry", new TelephonyRegistry(context));
  
              AttributeCache.init(context);
  
              Slog.i(TAG, "Package Manager");
              // Only run "core" apps if we're encrypting the device.
              String cryptState = SystemProperties.get("vold.decrypt");
              boolean onlyCore = false;
              if (ENCRYPTING_STATE.equals(cryptState)) {
                  Slog.w(TAG, "Detected encryption in progress - only parsing core apps");
                  onlyCore = true;
              } else if (ENCRYPTED_STATE.equals(cryptState)) {
                  Slog.w(TAG, "Device encrypted - only parsing core apps");
                  onlyCore = true;
              }
  
              pm = PackageManagerService.main(context,
                      factoryTest != SystemServer.FACTORY_TEST_OFF,
                      onlyCore);
              boolean firstBoot = false;
              try {
                  firstBoot = pm.isFirstBoot();
              } catch (RemoteException e) {
              }
  
              ActivityManagerService.setSystemProcess();
  
              mContentResolver = context.getContentResolver();
  
              // The AccountManager must come before the ContentService
              try {
                  Slog.i(TAG, "Account Manager");
                  ServiceManager.addService(Context.ACCOUNT_SERVICE,
                          new AccountManagerService(context));
              } catch (Throwable e) {
                  Slog.e(TAG, "Failure starting Account Manager", e);
              }
  
              Slog.i(TAG, "Content Manager");
              ContentService.main(context,
                      factoryTest == SystemServer.FACTORY_TEST_LOW_LEVEL);
  
              Slog.i(TAG, "System Content Providers");
              ActivityManagerService.installSystemProviders();
  
              Slog.i(TAG, "Lights Service");
              lights = new LightsService(context);
  
              Slog.i(TAG, "Battery Service");
              battery = new BatteryService(context, lights);
              ServiceManager.addService("battery", battery);
  
              Slog.i(TAG, "Vibrator Service");
              ServiceManager.addService("vibrator", new VibratorService(context));
  
              // only initialize the power service after we have started the
              // lights service, content providers and the battery service.
              power.init(context, lights, ActivityManagerService.self(), battery);
  
              Slog.i(TAG, "Alarm Manager");
              alarm = new AlarmManagerService(context);
              ServiceManager.addService(Context.ALARM_SERVICE, alarm);
  
              Slog.i(TAG, "Init Watchdog");
              Watchdog.getInstance().init(context, battery, power, alarm,
                      ActivityManagerService.self());
  
              Slog.i(TAG, "Window Manager");
              wm = WindowManagerService.main(context, power,
                      factoryTest != SystemServer.FACTORY_TEST_LOW_LEVEL,
                      !firstBoot);
              ServiceManager.addService(Context.WINDOW_SERVICE, wm);
  
              ActivityManagerService.self().setWindowManager(wm);
  
              // Skip Bluetooth if we have an emulator kernel
              // TODO: Use a more reliable check to see if this product should
              // support Bluetooth - see bug 988521
              if (SystemProperties.get("ro.kernel.qemu").equals("1")) {
                  Slog.i(TAG, "No Bluetooh Service (emulator)");
              } else if (factoryTest == SystemServer.FACTORY_TEST_LOW_LEVEL) {
                  Slog.i(TAG, "No Bluetooth Service (factory test)");
              } else {
                  Slog.i(TAG, "Bluetooth Service");
                  bluetooth = new BluetoothService(context);
                  ServiceManager.addService(BluetoothAdapter.BLUETOOTH_SERVICE, bluetooth);
                  bluetooth.initAfterRegistration();
                  bluetoothA2dp = new BluetoothA2dpService(context, bluetooth);
                  ServiceManager.addService(BluetoothA2dpService.BLUETOOTH_A2DP_SERVICE,
                                            bluetoothA2dp);
                  bluetooth.initAfterA2dpRegistration();
  
                  int airplaneModeOn = Settings.System.getInt(mContentResolver,
                          Settings.System.AIRPLANE_MODE_ON, 0);
                  int bluetoothOn = Settings.Secure.getInt(mContentResolver,
                      Settings.Secure.BLUETOOTH_ON, 0);
                  if (airplaneModeOn == 0 && bluetoothOn != 0) {
                      bluetooth.enable();
                  }
              }
  
          } catch (RuntimeException e) {
              Slog.e("System", "******************************************");
              Slog.e("System", "************ Failure starting core service", e);
          }
  
          DevicePolicyManagerService devicePolicy = null;
          StatusBarManagerService statusBar = null;
          InputMethodManagerService imm = null;
          AppWidgetService appWidget = null;
          NotificationManagerService notification = null;
          WallpaperManagerService wallpaper = null;
          LocationManagerService location = null;
          CountryDetectorService countryDetector = null;
          TextServicesManagerService tsms = null;
  
          // Bring up services needed for UI.
          if (factoryTest != SystemServer.FACTORY_TEST_LOW_LEVEL) {
              try {
                  Slog.i(TAG, "Input Method Service");
                  imm = new InputMethodManagerService(context);
                  ServiceManager.addService(Context.INPUT_METHOD_SERVICE, imm);
              } catch (Throwable e) {
                  reportWtf("starting Input Manager Service", e);
              }
  
              try {
                  Slog.i(TAG, "Accessibility Manager");
                  ServiceManager.addService(Context.ACCESSIBILITY_SERVICE,
                          new AccessibilityManagerService(context));
              } catch (Throwable e) {
                  reportWtf("starting Accessibility Manager", e);
              }
          }
  
          try {
              wm.displayReady();
          } catch (Throwable e) {
              reportWtf("making display ready", e);
          }
  
          try {
              pm.performBootDexOpt();
          } catch (Throwable e) {
              reportWtf("performing boot dexopt", e);
          }
  
          try {
              ActivityManagerNative.getDefault().showBootMessage(
                      context.getResources().getText(
                              com.android.internal.R.string.android_upgrading_starting_apps),
                              false);
          } catch (RemoteException e) {
          }
  
          if (factoryTest != SystemServer.FACTORY_TEST_LOW_LEVEL) {
              try {
                  Slog.i(TAG, "Device Policy");
                  devicePolicy = new DevicePolicyManagerService(context);
                  ServiceManager.addService(Context.DEVICE_POLICY_SERVICE, devicePolicy);
              } catch (Throwable e) {
                  reportWtf("starting DevicePolicyService", e);
              }
  
              try {
                  Slog.i(TAG, "Status Bar");
                  statusBar = new StatusBarManagerService(context, wm);
                  ServiceManager.addService(Context.STATUS_BAR_SERVICE, statusBar);
              } catch (Throwable e) {
                  reportWtf("starting StatusBarManagerService", e);
              }
  
              try {
                  Slog.i(TAG, "Clipboard Service");
                  ServiceManager.addService(Context.CLIPBOARD_SERVICE,
                          new ClipboardService(context));
              } catch (Throwable e) {
                  reportWtf("starting Clipboard Service", e);
              }
  
              try {
                  Slog.i(TAG, "NetworkManagement Service");
                  networkManagement = NetworkManagementService.create(context);
                  ServiceManager.addService(Context.NETWORKMANAGEMENT_SERVICE, networkManagement);
              } catch (Throwable e) {
                  reportWtf("starting NetworkManagement Service", e);
              }
  
              try {
                  Slog.i(TAG, "Text Service Manager Service");
                  tsms = new TextServicesManagerService(context);
                  ServiceManager.addService(Context.TEXT_SERVICES_MANAGER_SERVICE, tsms);
              } catch (Throwable e) {
                  reportWtf("starting Text Service Manager Service", e);
              }
  
              try {
                  Slog.i(TAG, "NetworkStats Service");
                  networkStats = new NetworkStatsService(context, networkManagement, alarm);
                  ServiceManager.addService(Context.NETWORK_STATS_SERVICE, networkStats);
              } catch (Throwable e) {
                  reportWtf("starting NetworkStats Service", e);
              }
  
              try {
                  Slog.i(TAG, "NetworkPolicy Service");
                  networkPolicy = new NetworkPolicyManagerService(
                          context, ActivityManagerService.self(), power,
                          networkStats, networkManagement);
                  ServiceManager.addService(Context.NETWORK_POLICY_SERVICE, networkPolicy);
              } catch (Throwable e) {
                  reportWtf("starting NetworkPolicy Service", e);
              }
  
             try {
                  Slog.i(TAG, "Wi-Fi P2pService");
                  wifiP2p = new WifiP2pService(context);
                  ServiceManager.addService(Context.WIFI_P2P_SERVICE, wifiP2p);
              } catch (Throwable e) {
                  reportWtf("starting Wi-Fi P2pService", e);
              }
  
             try {
                  Slog.i(TAG, "Wi-Fi Service");
                  wifi = new WifiService(context);
                  ServiceManager.addService(Context.WIFI_SERVICE, wifi);
              } catch (Throwable e) {
                  reportWtf("starting Wi-Fi Service", e);
              }
  
              try {
                  Slog.i(TAG, "Connectivity Service");
                  connectivity = new ConnectivityService(
                          context, networkManagement, networkStats, networkPolicy);
                  ServiceManager.addService(Context.CONNECTIVITY_SERVICE, connectivity);
                  networkStats.bindConnectivityManager(connectivity);
                  networkPolicy.bindConnectivityManager(connectivity);
                  wifi.checkAndStartWifi();
                  wifiP2p.connectivityServiceReady();
              } catch (Throwable e) {
                  reportWtf("starting Connectivity Service", e);
              }
  
              try {
                  Slog.i(TAG, "Throttle Service");
                  throttle = new ThrottleService(context);
                  ServiceManager.addService(
                          Context.THROTTLE_SERVICE, throttle);
              } catch (Throwable e) {
                  reportWtf("starting ThrottleService", e);
              }
  
              try {
                  /**
                   * NotificationManagerService is dependant on MountService,
                   * (for media / usb notifications) so we must start MountService first.
                   */
                  Slog.i(TAG, "Mount Service");
                  ServiceManager.addService("mount", new MountService(context));
              } catch (Throwable e) {
                  reportWtf("starting Mount Service", e);
              }
  
              try {
                  Slog.i(TAG, "Notification Manager");
                  notification = new NotificationManagerService(context, statusBar, lights);
                  ServiceManager.addService(Context.NOTIFICATION_SERVICE, notification);
                  networkPolicy.bindNotificationManager(notification);
              } catch (Throwable e) {
                  reportWtf("starting Notification Manager", e);
              }
  
              try {
                  Slog.i(TAG, "Device Storage Monitor");
                  ServiceManager.addService(DeviceStorageMonitorService.SERVICE,
                          new DeviceStorageMonitorService(context));
              } catch (Throwable e) {
                  reportWtf("starting DeviceStorageMonitor service", e);
              }
  
              try {
                  Slog.i(TAG, "Location Manager");
                  location = new LocationManagerService(context);
                  ServiceManager.addService(Context.LOCATION_SERVICE, location);
              } catch (Throwable e) {
                  reportWtf("starting Location Manager", e);
              }
  
              try {
                  Slog.i(TAG, "Country Detector");
                  countryDetector = new CountryDetectorService(context);
                  ServiceManager.addService(Context.COUNTRY_DETECTOR, countryDetector);
              } catch (Throwable e) {
                  reportWtf("starting Country Detector", e);
              }
  
              try {
                  Slog.i(TAG, "Search Service");
                  ServiceManager.addService(Context.SEARCH_SERVICE,
                          new SearchManagerService(context));
              } catch (Throwable e) {
                  reportWtf("starting Search Service", e);
              }
  
              try {
                  Slog.i(TAG, "DropBox Service");
                  ServiceManager.addService(Context.DROPBOX_SERVICE,
                          new DropBoxManagerService(context, new File("/data/system/dropbox")));
              } catch (Throwable e) {
                  reportWtf("starting DropBoxManagerService", e);
              }
  
              try {
                  Slog.i(TAG, "Wallpaper Service");
                  wallpaper = new WallpaperManagerService(context);
                  ServiceManager.addService(Context.WALLPAPER_SERVICE, wallpaper);
              } catch (Throwable e) {
                  reportWtf("starting Wallpaper Service", e);
              }
  
              try {
                  Slog.i(TAG, "Audio Service");
                  ServiceManager.addService(Context.AUDIO_SERVICE, new AudioService(context));
              } catch (Throwable e) {
                  reportWtf("starting Audio Service", e);
              }
  
              try {
                  Slog.i(TAG, "Dock Observer");
                  // Listen for dock station changes
                  dock = new DockObserver(context, power);
              } catch (Throwable e) {
                  reportWtf("starting DockObserver", e);
              }
  
              try {
                  Slog.i(TAG, "Wired Accessory Observer");
                  // Listen for wired headset changes
                  new WiredAccessoryObserver(context);
              } catch (Throwable e) {
                  reportWtf("starting WiredAccessoryObserver", e);
              }
  
              try {
                  Slog.i(TAG, "USB Service");
                  // Manage USB host and device support
                  usb = new UsbService(context);
                  ServiceManager.addService(Context.USB_SERVICE, usb);
              } catch (Throwable e) {
                  reportWtf("starting UsbService", e);
              }
  
              try {
                  Slog.i(TAG, "UI Mode Manager Service");
                  // Listen for UI mode changes
                  uiMode = new UiModeManagerService(context);
              } catch (Throwable e) {
                  reportWtf("starting UiModeManagerService", e);
              }
  
              try {
                  Slog.i(TAG, "Backup Service");
                  ServiceManager.addService(Context.BACKUP_SERVICE,
                          new BackupManagerService(context));
              } catch (Throwable e) {
                  Slog.e(TAG, "Failure starting Backup Service", e);
              }
  
              try {
                  Slog.i(TAG, "AppWidget Service");
                  appWidget = new AppWidgetService(context);
                  ServiceManager.addService(Context.APPWIDGET_SERVICE, appWidget);
              } catch (Throwable e) {
                  reportWtf("starting AppWidget Service", e);
              }
  
              try {
                  Slog.i(TAG, "Recognition Service");
                  recognition = new RecognitionManagerService(context);
              } catch (Throwable e) {
                  reportWtf("starting Recognition Service", e);
              }
  
              try {
                  Slog.i(TAG, "DiskStats Service");
                  ServiceManager.addService("diskstats", new DiskStatsService(context));
              } catch (Throwable e) {
                  reportWtf("starting DiskStats Service", e);
              }
  
              try {
                  // need to add this service even if SamplingProfilerIntegration.isEnabled()
                  // is false, because it is this service that detects system property change and
                  // turns on SamplingProfilerIntegration. Plus, when sampling profiler doesn't work,
                  // there is little overhead for running this service.
                  Slog.i(TAG, "SamplingProfiler Service");
                  ServiceManager.addService("samplingprofiler",
                              new SamplingProfilerService(context));
              } catch (Throwable e) {
                  reportWtf("starting SamplingProfiler Service", e);
              }
  
              try {
                  Slog.i(TAG, "NetworkTimeUpdateService");
                  networkTimeUpdater = new NetworkTimeUpdateService(context);
              } catch (Throwable e) {
                  reportWtf("starting NetworkTimeUpdate service", e);
              }
          }
  
          // Before things start rolling, be sure we have decided whether
          // we are in safe mode.
          final boolean safeMode = wm.detectSafeMode();
          if (safeMode) {
              ActivityManagerService.self().enterSafeMode();
              // Post the safe mode state in the Zygote class
              Zygote.systemInSafeMode = true;
              // Disable the JIT for the system_server process
              VMRuntime.getRuntime().disableJitCompilation();
          } else {
              // Enable the JIT for the system_server process
              VMRuntime.getRuntime().startJitCompilation();
          }
  
          // It is now time to start up the app processes...
  
          if (devicePolicy != null) {
              try {
                  devicePolicy.systemReady();
              } catch (Throwable e) {
                  reportWtf("making Device Policy Service ready", e);
              }
          }
  
          if (notification != null) {
              try {
                  notification.systemReady();
              } catch (Throwable e) {
                  reportWtf("making Notification Service ready", e);
              }
          }
  
          try {
              wm.systemReady();
          } catch (Throwable e) {
              reportWtf("making Window Manager Service ready", e);
          }
  
          if (safeMode) {
              ActivityManagerService.self().showSafeModeOverlay();
          }
  
          // Update the configuration for this context by hand, because we're going
          // to start using it before the config change done in wm.systemReady() will
          // propagate to it.
          Configuration config = wm.computeNewConfiguration();
          DisplayMetrics metrics = new DisplayMetrics();
          WindowManager w = (WindowManager)context.getSystemService(Context.WINDOW_SERVICE);
          w.getDefaultDisplay().getMetrics(metrics);
          context.getResources().updateConfiguration(config, metrics);
  
          power.systemReady();
          try {
              pm.systemReady();
          } catch (Throwable e) {
              reportWtf("making Package Manager Service ready", e);
          }
  
          // These are needed to propagate to the runnable below.
          final Context contextF = context;
          final BatteryService batteryF = battery;
          final NetworkManagementService networkManagementF = networkManagement;
          final NetworkStatsService networkStatsF = networkStats;
          final NetworkPolicyManagerService networkPolicyF = networkPolicy;
          final ConnectivityService connectivityF = connectivity;
          final DockObserver dockF = dock;
          final UsbService usbF = usb;
          final ThrottleService throttleF = throttle;
          final UiModeManagerService uiModeF = uiMode;
          final AppWidgetService appWidgetF = appWidget;
          final WallpaperManagerService wallpaperF = wallpaper;
          final InputMethodManagerService immF = imm;
          final RecognitionManagerService recognitionF = recognition;
          final LocationManagerService locationF = location;
          final CountryDetectorService countryDetectorF = countryDetector;
          final NetworkTimeUpdateService networkTimeUpdaterF = networkTimeUpdater;
          final TextServicesManagerService textServiceManagerServiceF = tsms;
          final StatusBarManagerService statusBarF = statusBar;
  
          // We now tell the activity manager it is okay to run third party
          // code.  It will call back into us once it has gotten to the state
          // where third party code can really run (but before it has actually
          // started launching the initial applications), for us to complete our
          // initialization.
          ActivityManagerService.self().systemReady(new Runnable() {
              public void run() {
                  Slog.i(TAG, "Making services ready");
  
                  startSystemUi(contextF);
                  try {
                      if (batteryF != null) batteryF.systemReady();
                  } catch (Throwable e) {
                      reportWtf("making Battery Service ready", e);
                  }
                  try {
                      if (networkManagementF != null) networkManagementF.systemReady();
                  } catch (Throwable e) {
                      reportWtf("making Network Managment Service ready", e);
                  }
                  try {
                      if (networkStatsF != null) networkStatsF.systemReady();
                  } catch (Throwable e) {
                      reportWtf("making Network Stats Service ready", e);
                  }
                  try {
                      if (networkPolicyF != null) networkPolicyF.systemReady();
                  } catch (Throwable e) {
                      reportWtf("making Network Policy Service ready", e);
                  }
                  try {
                      if (connectivityF != null) connectivityF.systemReady();
                  } catch (Throwable e) {
                      reportWtf("making Connectivity Service ready", e);
                  }
                  try {
                      if (dockF != null) dockF.systemReady();
                  } catch (Throwable e) {
                      reportWtf("making Dock Service ready", e);
                  }
                  try {
                      if (usbF != null) usbF.systemReady();
                  } catch (Throwable e) {
                      reportWtf("making USB Service ready", e);
                  }
                  try {
                      if (uiModeF != null) uiModeF.systemReady();
                  } catch (Throwable e) {
                      reportWtf("making UI Mode Service ready", e);
                  }
                  try {
                      if (recognitionF != null) recognitionF.systemReady();
                  } catch (Throwable e) {
                      reportWtf("making Recognition Service ready", e);
                  }
                  Watchdog.getInstance().start();
  
                  // It is now okay to let the various system services start their
                  // third party code...
  
                  try {
                      if (appWidgetF != null) appWidgetF.systemReady(safeMode);
                  } catch (Throwable e) {
                      reportWtf("making App Widget Service ready", e);
                  }
                  try {
                      if (wallpaperF != null) wallpaperF.systemReady();
                  } catch (Throwable e) {
                      reportWtf("making Wallpaper Service ready", e);
                  }
                  try {
                      if (immF != null) immF.systemReady(statusBarF);
                  } catch (Throwable e) {
                      reportWtf("making Input Method Service ready", e);
                  }
                  try {
                      if (locationF != null) locationF.systemReady();
                  } catch (Throwable e) {
                      reportWtf("making Location Service ready", e);
                  }
                  try {
                      if (countryDetectorF != null) countryDetectorF.systemReady();
                  } catch (Throwable e) {
                      reportWtf("making Country Detector Service ready", e);
                  }
                  try {
                      if (throttleF != null) throttleF.systemReady();
                  } catch (Throwable e) {
                      reportWtf("making Throttle Service ready", e);
                  }
                  try {
                      if (networkTimeUpdaterF != null) networkTimeUpdaterF.systemReady();
                  } catch (Throwable e) {
                      reportWtf("making Network Time Service ready", e);
                  }
                  try {
                      if (textServiceManagerServiceF != null) textServiceManagerServiceF.systemReady();
                  } catch (Throwable e) {
                      reportWtf("making Text Services Manager Service ready", e);
                  }
              }
          });
  
          // For debug builds, log event loop stalls to dropbox for analysis.
          if (StrictMode.conditionallyEnableDebugLogging()) {
              Slog.i(TAG, "Enabled StrictMode for system server main thread.");
          }
  
          Looper.loop();
          Slog.d(TAG, "System ServerThread is exiting!");
      }
  
      static final void startSystemUi(Context context) {
          Intent intent = new Intent();
          intent.setComponent(new ComponentName("com.android.systemui",
                      "com.android.systemui.SystemUIService"));
          Slog.d(TAG, "Starting service: " + intent);
          context.startService(intent);
      }
  }
  
  public class SystemServer {
      private static final String TAG = "SystemServer";
  
      public static final int FACTORY_TEST_OFF = 0;
      public static final int FACTORY_TEST_LOW_LEVEL = 1;
      public static final int FACTORY_TEST_HIGH_LEVEL = 2;
  
      static Timer timer;
      static final long SNAPSHOT_INTERVAL = 60 * 60 * 1000; // 1hr
  
      // The earliest supported time.  We pick one day into 1970, to
      // give any timezone code room without going into negative time.
      private static final long EARLIEST_SUPPORTED_TIME = 86400 * 1000;
  
      /***
       * This method is called from Zygote to initialize the system. This will cause the native
       * services (SurfaceFlinger, AudioFlinger, etc..) to be started. After that it will call back
       * up into init2() to start the Android services.
       */
      native public static void init1(String[] args);
  
      public static void main(String[] args) {
          if (System.currentTimeMillis() < EARLIEST_SUPPORTED_TIME) {
              // If a device's clock is before 1970 (before 0), a lot of
              // APIs crash dealing with negative numbers, notably
              // java.io.File#setLastModified, so instead we fake it and
              // hope that time from cell towers or NTP fixes it
              // shortly.
              Slog.w(TAG, "System clock is before 1970; setting to 1970.");
              SystemClock.setCurrentTimeMillis(EARLIEST_SUPPORTED_TIME);
          }
  
          if (SamplingProfilerIntegration.isEnabled()) {
              SamplingProfilerIntegration.start();
              timer = new Timer();
              timer.schedule(new TimerTask() {
                  @Override
                  public void run() {
                      SamplingProfilerIntegration.writeSnapshot("system_server", null);
                  }
              }, SNAPSHOT_INTERVAL, SNAPSHOT_INTERVAL);
          }
  
          // Mmmmmm... more memory!
          dalvik.system.VMRuntime.getRuntime().clearGrowthLimit();
  
          // The system server has to run all of the time, so it needs to be
          // as efficient as possible with its memory usage.
          VMRuntime.getRuntime().setTargetHeapUtilization(0.8f);
  
          System.loadLibrary("android_servers");
          init1(args);
      }
      public static final void init2() {
          Slog.i(TAG, "Entered the Android system server!");
          Thread thr = new ServerThread();
          thr.setName("android.server.ServerThread");
          thr.start();
      }
  }

   
• JNI of com/android/server/SystemServer: com_android_server_SystemServer.cpp

• #include <utils/Log.h>
  #include <utils/misc.h>
  #include "jni.h"
  #include "JNIHelp.h"
  namespace android {
  extern "C" int system_init();
  static void android_server_SystemServer_init1(JNIEnv* env, jobject clazz)
  {
      system_init();
  }
  static JNINativeMethod gMethods[] = {
      /** name, signature, funcPtr */
      { "init1", "([Ljava/lang/String;)V", (void*) android_server_SystemServer_init1 },
  };
  int register_android_server_SystemServer(JNIEnv* env)
  {
      return jniRegisterNativeMethods(env, "com/android/server/SystemServer",
              gMethods, NELEM(gMethods));
  }
  };

• System_Init.cpp

• /**
   * System server main initialization.
   *
   * The system server is responsible for becoming the Binder
   * context manager, supplying the root ServiceManager object
   * through which other services can be found.
   */
  
  #define LOG_TAG "sysproc"
  
  #include <binder/IPCThreadState.h>
  #include <binder/ProcessState.h>
  #include <binder/IServiceManager.h>
  #include <utils/TextOutput.h>
  #include <utils/Log.h>
  
  #include <SurfaceFlinger.h>
  #include <AudioFlinger.h>
  #include <CameraService.h>
  #include <AudioPolicyService.h>
  #include <MediaPlayerService.h>
  #include <SensorService.h>
  
  #include <android_runtime/AndroidRuntime.h>
  
  #include <signal.h>
  #include <stdlib.h>
  #include <stdio.h>
  #include <unistd.h>
  #include <sys/time.h>
  #include <cutils/properties.h>
  
  using namespace android;
  
  namespace android {
  /***
   * This class is used to kill this process when the runtime dies.
   */
  class GrimReaper : public IBinder::DeathRecipient {
  public:
      GrimReaper() { }
  
      virtual void binderDied(const wp<IBinder>& who)
      {
          LOGI("Grim Reaper killing system_server...");
          kill(getpid(), SIGKILL);
      }
  };
  
  } // namespace android
  
  
  
  extern "C" status_t system_init()
  {
      LOGI("Entered system_init()");
  
      sp<ProcessState> proc(ProcessState::self());
  
      sp<IServiceManager> sm = defaultServiceManager();
      LOGI("ServiceManager: %p\n", sm.get());
  
      sp<GrimReaper> grim = new GrimReaper();
      sm->asBinder()->linkToDeath(grim, grim.get(), 0);
  
      char propBuf[PROPERTY_VALUE_MAX];
      property_get("system_init.startsurfaceflinger", propBuf, "1");
      if (strcmp(propBuf, "1") == 0) {
          // Start the SurfaceFlinger
          SurfaceFlinger::instantiate();
      }
  
      property_get("system_init.startsensorservice", propBuf, "1");
      if (strcmp(propBuf, "1") == 0) {
          // Start the sensor service
          SensorService::instantiate();
      }
  
      // And now start the Android runtime.  We have to do this bit
      // of nastiness because the Android runtime initialization requires
      // some of the core system services to already be started.
      // All other servers should just start the Android runtime at
      // the beginning of their processes's main(), before calling
      // the init function.
      LOGI("System server: starting Android runtime.\n");
      AndroidRuntime* runtime = AndroidRuntime::getRuntime();
  
      LOGI("System server: starting Android services.\n");
      JNIEnv* env = runtime->getJNIEnv();
      if (env == NULL) {
          return UNKNOWN_ERROR;
      }
      jclass clazz = env->FindClass("com/android/server/SystemServer");
      if (clazz == NULL) {
          return UNKNOWN_ERROR;
      }
      jmethodID methodId = env->GetStaticMethodID(clazz, "init2", "()V");
      if (methodId == NULL) {
          return UNKNOWN_ERROR;
      }
      env->CallStaticVoidMethod(clazz, methodId);
  
      LOGI("System server: entering thread pool.\n");
      ProcessState::self()->startThreadPool();
      IPCThreadState::self()->joinThreadPool();
      LOGI("System server: exiting thread pool.\n");
  
      return NO_ERROR;
  }

    

  extern "C" status_t system_init()//all android services run in this process
  {
      LOGI("Entered system_init()");
      sp<ProcessState> proc(ProcessState::self());
      sp<IServiceManager> sm = defaultServiceManager();
      sp<GrimReaper> grim = new GrimReaper();
      sm->asBinder()->linkToDeath(grim, grim.get(), 0);
      char propBuf[PROPERTY_VALUE_MAX];
      property_get("system_init.startsurfaceflinger", propBuf, "1");
      if (strcmp(propBuf, "1") == 0) { 
          SurfaceFlinger::instantiate();
      }
      property_get("system_init.startsensorservice", propBuf, "1");
      if (strcmp(propBuf, "1") == 0) {
          SensorService::instantiate();
      }
      AndroidRuntime* runtime = AndroidRuntime::getRuntime();
      LOGI("System server: starting Android services.\n");
      JNIEnv* env = runtime->getJNIEnv();
      if (env == NULL) {
          return UNKNOWN_ERROR;
      }
      jclass clazz = env->FindClass("com/android/server/SystemServer");
      if (clazz == NULL) {
          return UNKNOWN_ERROR;
      }
      jmethodID methodId = env->GetStaticMethodID(clazz, "init2", "()V");//let android runtime call java method
      if (methodId == NULL) {
          return UNKNOWN_ERROR;
      }
      env->CallStaticVoidMethod(clazz, methodId); 
      ProcessState::self()->startThreadPool();
      IPCThreadState::self()->joinThreadPool();   
      return NO_ERROR;
  }

   

•