今天的任務從早上搞到現在，才算完成，本來以為比較簡單，就是出一個Demo，將實際業務的邏輯封裝成so庫，放在系統層，對上層不暴露任何東西，中間就一層JNI呼叫，原本以為很簡單，但是由於自己的一個壞習慣，折騰了一天。將處理過程詳細記錄下來，同時吸取教訓，也希望能給大家帶來幫助。

     JNI的封裝很簡單，程式碼就不上了，在Android7.0原始碼目錄下新增共享庫的過程，也有其他網友提到了，最重要的就是修改public.libraries.txt檔案。將自己的要新增的目標庫加到該檔案中，如下圖，可以看到該檔案存在三處，system目錄下兩處，vendor下一處，最終編譯成img檔案燒錄到手機上，分別是system/etc/public.libraries.txt、system/vendor/etc/public.libraries.txt、vendor/etc/public.libraries.txt，只有在這裡宣告過，應用才能呼叫，否則會因為名稱空間的問題導致應用層呼叫失敗。

     自己先完成了業務邏輯的程式碼，然後編譯成so庫，push到手機上，但是發現一直停留在Android字樣的動畫開機介面，無法正常開機，於是開始抓log分析，正常和異常日誌分別如下：

     1、正常開機日誌，可以看到，資料載入完成後，馬上會執行startSystemServer方法啟動system_server程序，相應的日誌都有出現，當system_server啟動成功後，介面也就快顯示出來了。

    Line 1694: 01-03 22:23:11.820   361   361 D Zygote  : begin preload
    Line 1695: 01-03 22:23:11.820   361   361 I Zygote  : Installing ICU cache reference pinning...
    Line 1696: 01-03 22:23:11.820   361   361 I Zygote  : Preloading ICU data...
    Line 1867: 01-03 22:23:12.087   361   361 I Zygote  : Preloading classes...
    Line 1868: 01-03 22:23:12.094   361   361 W Zygote  : Class not found for preloading: [Landroid.view.Display$ColorTransform;
    Line 2304: 01-03 22:23:13.874   361   361 W Zygote  : Class not found for preloading: android.view.Display$ColorTransform
    Line 2305: 01-03 22:23:13.875   361   361 W Zygote  : Class not found for preloading: android.view.Display$ColorTransform$1
    Line 2347: 01-03 22:23:14.546   361   361 I Zygote  : ...preloaded 4158 classes in 2459ms.
    Line 2375: 01-03 22:23:14.734   361   361 I Zygote  : Preloading resources...
    Line 2423: 01-03 22:23:15.081   361   361 I Zygote  : ...preloaded 114 resources in 347ms.
    Line 2426: 01-03 22:23:15.097   361   361 I Zygote  : ...preloaded 41 resources in 17ms.
    Line 2439: 01-03 22:23:15.183   361   361 I Zygote  : Preloading shared libraries...
    Line 2444: 01-03 22:23:15.227   361   361 I Zygote  : Uninstalled ICU cache reference pinning...
    Line 2445: 01-03 22:23:15.239   361   361 I Zygote  : Installed AndroidKeyStoreProvider in 12ms.
    Line 2446: 01-03 22:23:15.264   361   361 I Zygote  : Warmed up JCA providers in 26ms.
    Line 2447: 01-03 22:23:15.265   361   361 D Zygote  : end preload
    Line 2462: 01-03 22:23:15.448   361   361 I Zygote  : System server process 2252 has been created
    Line 2463: 01-03 22:23:15.455   361   361 I Zygote  : Accepting command socket connections
    Line 10398: 01-03 22:25:40.307  2252  2574 I Zygote  : Process: zygote socket opened, supported ABIS: armeabi-v7a,armeabi
    
    
    2、異常開機日誌，從日誌中明顯可以看到，Zygote程序在載入完資料後，根據沒有成功啟動system_server，導致無法開機。    
    Line 1743: 01-03 22:16:43.383   347   347 D Zygote  : begin preload
    Line 1744: 01-03 22:16:43.383   347   347 I Zygote  : Installing ICU cache reference pinning...
    Line 1745: 01-03 22:16:43.384   347   347 I Zygote  : Preloading ICU data...
    Line 1914: 01-03 22:16:43.600   347   347 I Zygote  : Preloading classes...
    Line 1915: 01-03 22:16:43.607   347   347 W Zygote  : Class not found for preloading: [Landroid.view.Display$ColorTransform;
    Line 2347: 01-03 22:16:45.403   347   347 W Zygote  : Class not found for preloading: android.view.Display$ColorTransform
    Line 2348: 01-03 22:16:45.404   347   347 W Zygote  : Class not found for preloading: android.view.Display$ColorTransform$1
    Line 2376: 01-03 22:16:46.015   347   347 I Zygote  : ...preloaded 4158 classes in 2414ms.
    Line 2396: 01-03 22:16:46.191   347   347 I Zygote  : Preloading resources...
    Line 2438: 01-03 22:16:46.567   347   347 I Zygote  : ...preloaded 114 resources in 375ms.
    Line 2441: 01-03 22:16:46.583   347   347 I Zygote  : ...preloaded 41 resources in 17ms.
    Line 2472: 01-03 22:16:46.682   347   347 I Zygote  : Preloading shared libraries...
    Line 2477: 01-03 22:16:46.740   347   347 I Zygote  : Uninstalled ICU cache reference pinning...
    Line 2478: 01-03 22:16:46.757   347   347 I Zygote  : Installed AndroidKeyStoreProvider in 16ms.
    Line 2479: 01-03 22:16:46.780   347   347 I Zygote  : Warmed up JCA providers in 24ms.
    Line 2480: 01-03 22:16:46.781   347   347 D Zygote  : end preload

     啟動system_server的程式碼是從frameworks\base\cmds\app_process\app_main.cpp檔案中的main方法開始的，再往上就是init.rc角本了，main方法中組裝啟動引數，然後呼叫父類AndroidRuntime的start方法，程式碼如下：

int main(int argc, char* const argv[])
{
    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
        // Older kernels don't understand PR_SET_NO_NEW_PRIVS and return
        // EINVAL. Don't die on such kernels.
        if (errno != EINVAL) {
            LOG_ALWAYS_FATAL("PR_SET_NO_NEW_PRIVS failed: %s", strerror(errno));
            return 12;
        }
    }

    AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));
    // Process command line arguments
    // ignore argv[0]
    argc--;
    argv++;

    // Everything up to '--' or first non '-' arg goes to the vm.
    //
    // The first argument after the VM args is the "parent dir", which
    // is currently unused.
    //
    // After the parent dir, we expect one or more the following internal
    // arguments :
    //
    // --zygote : Start in zygote mode
    // --start-system-server : Start the system server.
    // --application : Start in application (stand alone, non zygote) mode.
    // --nice-name : The nice name for this process.
    //
    // For non zygote starts, these arguments will be followed by
    // the main class name. All remaining arguments are passed to
    // the main method of this class.
    //
    // For zygote starts, all remaining arguments are passed to the zygote.
    // main function.
    //
    // Note that we must copy argument string values since we will rewrite the
    // entire argument block when we apply the nice name to argv0.

    int i;
    for (i = 0; i < argc; i++) {
        if (argv[i][0] != '-') {
            break;
        }
        if (argv[i][1] == '-' && argv[i][2] == 0) {
            ++i; // Skip --.
            break;
        }
        runtime.addOption(strdup(argv[i]));
    }

    // Parse runtime arguments.  Stop at first unrecognized option.
    bool zygote = false;
    bool startSystemServer = false;
    bool application = false;
    String8 niceName;
    String8 className;

    ++i;  // Skip unused "parent dir" argument.
    while (i < argc) {
        const char* arg = argv[i++];
        if (strcmp(arg, "--zygote") == 0) {
            zygote = true;
            niceName = ZYGOTE_NICE_NAME;
        } else if (strcmp(arg, "--start-system-server") == 0) {
            startSystemServer = true;
        } else if (strcmp(arg, "--application") == 0) {
            application = true;
        } else if (strncmp(arg, "--nice-name=", 12) == 0) {
            niceName.setTo(arg + 12);
        } else if (strncmp(arg, "--", 2) != 0) {
            className.setTo(arg);
            break;
        } else {
            --i;
            break;
        }
    }

    Vector<String8> args;
    if (!className.isEmpty()) {
        // We're not in zygote mode, the only argument we need to pass
        // to RuntimeInit is the application argument.
        //
        // The Remainder of args get passed to startup class main(). Make
        // copies of them before we overwrite them with the process name.
        args.add(application ? String8("application") : String8("tool"));
        runtime.setClassNameAndArgs(className, argc - i, argv + i);
    } else {
        // We're in zygote mode.
        maybeCreateDalvikCache();

        if (startSystemServer) {
            args.add(String8("start-system-server"));
        }

        char prop[PROP_VALUE_MAX];
        if (property_get(ABI_LIST_PROPERTY, prop, NULL) == 0) {
            LOG_ALWAYS_FATAL("app_process: Unable to determine ABI list from property %s.",
                ABI_LIST_PROPERTY);
            return 11;
        }

        String8 abiFlag("--abi-list=");
        abiFlag.append(prop);
        args.add(abiFlag);

        // In zygote mode, pass all remaining arguments to the zygote
        // main() method.
        for (; i < argc; ++i) {
            args.add(String8(argv[i]));
        }
    }

    if (!niceName.isEmpty()) {
        runtime.setArgv0(niceName.string());
        set_process_name(niceName.string());
    }

    if (zygote) {
        runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
    } else if (className) {
        runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
    } else {
        fprintf(stderr, "Error: no class name or --zygote supplied.\n");
        app_usage();
        LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");
        return 10;
    }
}
 

     這裡的runtime是一個AppRuntime型別的物件，它是AndroidRuntime的子類，start方法也是呼叫父類的，AndroidRuntime類的start方法程式碼如下：

void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
{
    ALOGD(">>>>>> START %s uid %d <<<<<<\n",
            className != NULL ? className : "(unknown)", getuid());

    static const String8 startSystemServer("start-system-server");

    /*
     * 'startSystemServer == true' means runtime is obsolete and not run from
     * init.rc anymore, so we print out the boot start event here.
     */
    for (size_t i = 0; i < options.size(); ++i) {
        if (options[i] == startSystemServer) {
           /* track our progress through the boot sequence */
           const int LOG_BOOT_PROGRESS_START = 3000;
           LOG_EVENT_LONG(LOG_BOOT_PROGRESS_START,  ns2ms(systemTime(SYSTEM_TIME_MONOTONIC)));
        }
    }

    const char* rootDir = getenv("ANDROID_ROOT");
    if (rootDir == NULL) {
        rootDir = "/system";
        if (!hasDir("/system")) {
            LOG_FATAL("No root directory specified, and /android does not exist.");
            return;
        }
        setenv("ANDROID_ROOT", rootDir, 1);
    }

    //const char* kernelHack = getenv("LD_ASSUME_KERNEL");
    //ALOGD("Found LD_ASSUME_KERNEL='%s'\n", kernelHack);

    /* start the virtual machine */
    JniInvocation jni_invocation;
    jni_invocation.Init(NULL);
    JNIEnv* env;
    if (startVm(&mJavaVM, &env, zygote) != 0) {
        return;
    }
    onVmCreated(env);

    /*
     * Register android functions.
     */
    if (startReg(env) < 0) {
        ALOGE("Unable to register all android natives\n");
        return;
    }

    /*
     * We want to call main() with a String array with arguments in it.
     * At present we have two arguments, the class name and an option string.
     * Create an array to hold them.
     */
    jclass stringClass;
    jobjectArray strArray;
    jstring classNameStr;

    stringClass = env->FindClass("java/lang/String");
    assert(stringClass != NULL);
    strArray = env->NewObjectArray(options.size() + 1, stringClass, NULL);
    assert(strArray != NULL);
    classNameStr = env->NewStringUTF(className);
    assert(classNameStr != NULL);
    env->SetObjectArrayElement(strArray, 0, classNameStr);

    for (size_t i = 0; i < options.size(); ++i) {
        jstring optionsStr = env->NewStringUTF(options.itemAt(i).string());
        assert(optionsStr != NULL);
        env->SetObjectArrayElement(strArray, i + 1, optionsStr);
    }

    /*
     * Start VM.  This thread becomes the main thread of the VM, and will
     * not return until the VM exits.
     */
    char* slashClassName = toSlashClassName(className);
    jclass startClass = env->FindClass(slashClassName);
    if (startClass == NULL) {
        ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);
        /* keep going */
    } else {
        jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
            "([Ljava/lang/String;)V");
        if (startMeth == NULL) {
            ALOGE("JavaVM unable to find main() in '%s'\n", className);
            /* keep going */
        } else {
            env->CallStaticVoidMethod(startClass, startMeth, strArray);

#if 0
            if (env->ExceptionCheck())
                threadExitUncaughtException(env);
#endif
        }
    }
    free(slashClassName);

    ALOGD("Shutting down VM\n");
    if (mJavaVM->DetachCurrentThread() != JNI_OK)
        ALOGW("Warning: unable to detach main thread\n");
    if (mJavaVM->DestroyJavaVM() != 0)
        ALOGW("Warning: VM did not shut down cleanly\n");
}

     這裡就是組裝引數，然後通過反射呼叫到frameworks\base\core\java\com\android\internal\os\ZygoteInit.java類的main方法，ZygoteInit類的main方法的程式碼如下：

    public static void main(String argv[]) {
        // Mark zygote start. This ensures that thread creation will throw
        // an error.
        ZygoteHooks.startZygoteNoThreadCreation();

        try {
            Trace.traceBegin(Trace.TRACE_TAG_DALVIK, "ZygoteInit");
            RuntimeInit.enableDdms();
            // Start profiling the zygote initialization.
            SamplingProfilerIntegration.start();

            boolean startSystemServer = false;
            String socketName = "zygote";
            String abiList = null;
            for (int i = 1; i < argv.length; i++) {
                if ("start-system-server".equals(argv[i])) {
                    startSystemServer = true;
                } else if (argv[i].startsWith(ABI_LIST_ARG)) {
                    abiList = argv[i].substring(ABI_LIST_ARG.length());
                } else if (argv[i].startsWith(SOCKET_NAME_ARG)) {
                    socketName = argv[i].substring(SOCKET_NAME_ARG.length());
                } else {
                    throw new RuntimeException("Unknown command line argument: " + argv[i]);
                }
            }

            if (abiList == null) {
                throw new RuntimeException("No ABI list supplied.");
            }

            registerZygoteSocket(socketName);
            Trace.traceBegin(Trace.TRACE_TAG_DALVIK, "ZygotePreload");
            EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
                SystemClock.uptimeMillis());
            preload();
            EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
                SystemClock.uptimeMillis());
            Trace.traceEnd(Trace.TRACE_TAG_DALVIK);

            // Finish profiling the zygote initialization.
            SamplingProfilerIntegration.writeZygoteSnapshot();

            // Do an initial gc to clean up after startup
            Trace.traceBegin(Trace.TRACE_TAG_DALVIK, "PostZygoteInitGC");
            gcAndFinalize();
            Trace.traceEnd(Trace.TRACE_TAG_DALVIK);

            Trace.traceEnd(Trace.TRACE_TAG_DALVIK);

            // Disable tracing so that forked processes do not inherit stale tracing tags from
            // Zygote.
            Trace.setTracingEnabled(false);

            // Zygote process unmounts root storage spaces.
            Zygote.nativeUnmountStorageOnInit();

            ZygoteHooks.stopZygoteNoThreadCreation();

            if (startSystemServer) {
                startSystemServer(abiList, socketName);
            }

            Log.i(TAG, "Accepting command socket connections");
            runSelectLoop(abiList);

            closeServerSocket();
        } catch (MethodAndArgsCaller caller) {
            caller.run();
        } catch (Throwable ex) {
            Log.e(TAG, "Zygote died with exception", ex);
            closeServerSocket();
            throw ex;
        }
    }

     這裡和日誌上對應的就是呼叫preload()方法，它會去載入所有的類、資源、動態庫，日誌也都有列印，載入完成後，因為在app_main.cpp檔案中有封裝start-system-server引數，所以startSystemServer值為true，繼續呼叫startSystemServer(abiList, socketName)去啟動system_server，我的問題也就是在這裡產生的，於是，在這裡加日誌，發現這裡的邏輯是正常的，於是繼續往下查，到Zygote類中的forkSystemServer方法的呼叫也都是正常，但是for的方法沒有返回，fork真正的邏輯是在frameworks\base\core\jni\com_android_internal_os_Zygote.cpp檔案中的ForkAndSpecializeCommon方法中呼叫完成的，我之前的部落格中也都有提及，但是這裡往上沒辦法加日誌了，加了日誌編譯不通過，沒辦法只能往回找。

     開始將自己cpp檔案中的邏輯全部刪掉，但是編譯後仍然無法正常啟動，因為我就是搞簡單Demo，所以就兩個檔案，一個cpp，一個mk，於是繼續排查mk，最終在這裡找到了答案，原來我的mk中依賴了另一個so庫，而那個so庫cpp檔案中定義了一個全域性變數，該變數在so加載入時就會構造，而構造方法中寫了部分和串列埠通訊的邏輯，然而問題出現的場景中，系統還未啟動，而且我的裝置根本沒有串列埠，導致fork無返回，部分程式碼截圖如下：

     註釋掉和串列埠通訊的那行邏輯，就可以正常啟動了。看到下面Zygote已經開始fork其他程序，說明我們已經成功了，馬上鬆口氣。

     問題解決了，得到什麼教訓呢？就是我們以後要實現一個功能，如果有依賴時，先從最簡單的開始，什麼都不要依賴，條件超少越好，最簡單的能實現，然後再往上加邏輯，這樣即使出問題，也比較容易排查。如果我們一開始就把業務邏輯加上去，依賴的東西比較多，那麼此時出問題的話， 排查起來方向也很多，難度就大了很多，像我這樣，如果按照前面的思路去查Zygote，估計這問題肯定把我折騰死了。

     非常深刻的教訓，希望大家能有所啟發。夜深了，該休息了！！