Android 6.0 Reboot 流程源代码分析

Shutdown 跟 reboot流程很类似，所以这里以reboot分析：

reboot的类型：

1、手动长按power键选择reboot；

2、adb reboot；

3、手动长按power键11s触发reboot；

4、BUG_ON(1)，触发kernel panic流程reboot;

上面1、2、4的本质上代码跑的是一样的，3 是直接触发hardware实现，下面主要分析第1类正常的关键源码流程。

关机逻辑流程总图：

源代码路径流程图：

一、首先看Android 层.

1、长按power键选择reboot必定走以下接口：

下面开始进入reboot 前的准备工作，大致分为发起有序shutdown广播、执行Activity、安装包管理、无线相关、挂载服务等组件的shutdown工作.

ShutdownThread.javapublic void run() {//SHUTDOWN有序广播结果接受        BroadcastReceiver br = new BroadcastReceiver() {            @Override public void onReceive(Context context, Intent intent) {                actionDone();            }        };...//发送SHUTDOWN有序广播，注意是同步的，如果被阻塞将会block住main thread.        Intent intent = new Intent(Intent.ACTION_SHUTDOWN);        intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);        mContext.sendOrderedBroadcastAsUser(intent,                UserHandle.ALL, null, br, mHandler, 0, null, null);//等待有序广播全部处理完成,也就是等上面的br.onReveive回调.        synchronized (mActionDoneSync) {            while (!mActionDone) {...                try {                    mActionDoneSync.wait(Math.min(delay, PHONE_STATE_POLL_SLEEP_MSEC));                } catch (InterruptedException e) {                }            }        }...//ActivityManagerService执行shutdown操作，写一些相关状态(比如battery)记录到文件.        final IActivityManager am =            ActivityManagerNative.asInterface(ServiceManager.checkService("activity"));        if (am != null) {            try {                am.shutdown(MAX_BROADCAST_TIME);            } catch (RemoteException e) {            }        }...//安装包管理服务执行shutdonw，将当前的packageName写入data/system目录文件中.        final PackageManagerService pm = (PackageManagerService)            ServiceManager.getService("package");        if (pm != null) {            pm.shutdown();        }...//无线相关执行shutdown，比如nfc、电话服务相关等.        shutdownRadios(MAX_RADIO_WAIT_TIME);...//挂载服务卸载完成回调        IMountShutdownObserver observer = new IMountShutdownObserver.Stub() {            public void onShutDownComplete(int statusCode) throws RemoteException {                actionDone();            }        };//执行文件系统挂载服务卸载        synchronized (mActionDoneSync) {            try {                final IMountService mount = IMountService.Stub.asInterface(                        ServiceManager.checkService("mount"));                    mount.shutdown(observer);            } catch (Exception e) {                Log.e(TAG, "Exception during MountService shutdown", e);            }// 等待卸载完成，也就是等上面的 observer.onShutDownComplete执行完            while (!mActionDone) {            ...                try {                    mActionDoneSync.wait(Math.min(delay, PHONE_STATE_POLL_SLEEP_MSEC));                } catch (InterruptedException e) {                }            }        }...//准备工作完成，进入正式reboot流程        rebootOrShutdown(mContext, mReboot, mRebootReason);    }

继续分析准备工作后的reboot流程，主要要干的事情就是把shutdown或者reboot的command从Java层传到native层的reboot接口.

public static void rebootOrShutdown(final Context context, boolean reboot, String reason) {//如果是重启的话就执行lowLevelReboot，否则就执行lowLevelShutdown接口        if (reboot) {            PowerManagerService.lowLevelReboot(reason);        } else if (SHUTDOWN_VIBRATE_MS > 0 && context != null) {//如果是关机命令，则会振动500ms提示            Vibrator vibrator = new SystemVibrator(context);            try {                vibrator.vibrate(SHUTDOWN_VIBRATE_MS, VIBRATION_ATTRIBUTES);            } catch (Exception e) {            }//等500ms待vib完成再进入shutdown.            try {                Thread.sleep(SHUTDOWN_VIBRATE_MS);            } catch (InterruptedException unused) {            }        }        PowerManagerService.lowLevelShutdown();    }    public static void lowLevelReboot(String reason) {...//使用属性服务传入cmd触发reboot的 Action    SystemProperties.set("sys.powerctl", "reboot," + reason);//等待20s，也就是说20s内需要关机完成    try {        Thread.sleep(20 * 1000L);    } catch (InterruptedException e) {        Thread.currentThread().interrupt();    } //下面这条log很关键！！！，如果这条log打出来了，就说明关机失败了，需要找原因了...    Slog.wtf(TAG, "Unexpected return from lowLevelReboot!");}    //如果执行的是shutdown则走执行下面的cmdpublic static void lowLevelShutdown() {    SystemProperties.set("sys.powerctl", "shutdown");}

Java层关机流程分析到此结束，进入native层，我们知道，属性服务贯穿整个android系统可以很方便的触发各种Action、启动服务等，那么这里的SystemProperties.set("sys.powerctl", "reboot," + reason)到底干了什么事情呢？这个需要从init.rc找答案(属性服务触发实现机制暂不讨论)。搜索sys.powerctl关键字：

./rootdir/init.rc:544:on property:sys.powerctl=*./rootdir/init.rc:545:    powerctl ${sys.powerctl}

这是一个on 的action，意思是当sys.powerctl的值改变时，执行powerctl命令，参数就是${sys.powerctl}，此处就是上面的reboot,那么具体是什么呢？搜索powerctl会发现：

./init/keywords.h:17:int do_powerctl(int nargs, char **args);./init/keywords.h:79:    KEYWORD(powerctl,    COMMAND, 1, do_powerctl)

很显然其实就是代表的do_powerctl函数！简单来说就是执行SystemProperties.set("sys.powerctl", "reboot," + reason) 函数的时候其实就是会最终下面的函数：

int do_powerctl(int nargs, char **args){    char command[PROP_VALUE_MAX];...    res = expand_props(command, args[1], sizeof(command));...    if (strncmp(command, "shutdown", 8) == 0) {        cmd = ANDROID_RB_POWEROFF;        len = 8;    } else if (strncmp(command, "reboot", 6) == 0) {        cmd = ANDROID_RB_RESTART2;        len = 6;    } else {        ERROR("powerctl: unrecognized command '%s'\n", command);        return -EINVAL;    }...//很简单，就是解析出要下发哪一个cmd，这里显然就是ANDROID_RB_RESTART2了，接着//调用android层最后一个函数接口    return android_reboot(cmd, 0, reboot_target);}int android_reboot(int cmd, int flags UNUSED, const char *arg){    int ret;// 将缓冲区数据写回磁盘,保证数据同步.    sync();    //把filesystem置为read only，不允许proc再往里面写东西.    remount_ro();//下面就是reboot的system call进入内核空间了:    switch (cmd) {        case ANDROID_RB_RESTART:            ret = reboot(RB_AUTOBOOT);            break;        case ANDROID_RB_POWEROFF:            ret = reboot(RB_POWER_OFF);            break;        case ANDROID_RB_RESTART2:            ret = syscall(__NR_reboot, LINUX_REBOOT_MAGIC1, LINUX_REBOOT_MAGIC2,                           LINUX_REBOOT_CMD_RESTART2, arg);            break;        default:            ret = -1;    }    return ret;}

二、Android层关机流程分析完成，进入内核层分析，执行系统调用后进入kernel层系统调用入口：（系统调用是用户程序请求内核服务的标准形式，这里我们不去关注其具体实现）

SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,void __user *, arg){...//忽略前头一堆各种检查细节，关注reboot流程主线.//互斥锁，保证当前就一个CPU在执行此路径.mutex_lock(&reboot_mutex);switch (cmd) {case LINUX_REBOOT_CMD_RESTART:kernel_restart(NULL);break;...case LINUX_REBOOT_CMD_HALT:kernel_halt();do_exit(0);panic("cannot halt");case LINUX_REBOOT_CMD_POWER_OFF:kernel_power_off();do_exit(0);break;case LINUX_REBOOT_CMD_RESTART2:ret = strncpy_from_user(&buffer[0], arg, sizeof(buffer) - 1);if (ret < 0) {ret = -EFAULT;break;}buffer[sizeof(buffer) - 1] = '\0';//进入内核restart入口函数kernel_restart(buffer);break;...mutex_unlock(&reboot_mutex);return ret;}

kernel_restart 函数要干的事情主要分为几部分：

void kernel_restart(char *cmd){//kernel关机准备工作.kernel_restart_prepare(cmd);//挂起其他cpu的工作，只留下当前cpu干活migrate_to_reboot_cpu();//核心设备执行shutdown，比如PM,irq，usb等.syscore_shutdown();if (!cmd)pr_emerg("Restarting system\n");elsepr_emerg("Restarting system with command '%s'\n", cmd);kmsg_dump(KMSG_DUMP_RESTART);//执行各个体系结构相关的关机、restart操作实现machine_restart(cmd);}

kernel_restart_prepare 分析，主要干了两件事情：发通知给感兴趣的dev + 执行dev卸载

void kernel_restart_prepare(char *cmd){//发cmd给通知链中对SYS_RESTART感兴趣的设备，执行nofifier回调.blocking_notifier_call_chain(&reboot_notifier_list, SYS_RESTART, cmd);system_state = SYSTEM_RESTART;//用户模式 disable ？usermodehelper_disable();//设备卸载device_shutdown();}

这里需要重点分析下device_shutdown函数，如果该函数stuck，会导致无法关机.

void device_shutdown(void){struct device *dev, *parent;//自旋锁，关抢断.spin_lock(&devices_kset->list_lock);/* * Walk the devices list backward, shutting down each in turn. * Beware that device unplug events may also start pulling * devices offline, even as the system is shutting down. */while (!list_empty(&devices_kset->list)) {//从device链表使用“内核中经典大法-从实例找容器方式” 遍历各个devdev = list_entry(devices_kset->list.prev, struct device,kobj.entry);/* * hold reference count of device's parent to * prevent it from being freed because parent's * lock is to be held *///激活parent dev和dev，这get,put名字起的容易让人误解，汗..parent = get_device(dev->parent);get_device(dev);/* * Make sure the device is off the kset list, in the * event that dev->*->shutdown() doesn't remove it. */ //把dev从kobj.entry容器中删除list_del_init(&dev->kobj.entry);spin_unlock(&devices_kset->list_lock);/* hold lock to avoid race with probe/release */if (parent)device_lock(parent);device_lock(dev);//阻止任何的runtime相关的dev挂起/* Don't allow any more runtime suspends */pm_runtime_get_noresume(dev);//这个pm runtime相关函数很复杂，暂时没看懂要干什么，汗..pm_runtime_barrier(dev);  //执行各个对关机感兴趣dev的shutdown回调函数if (dev->bus && dev->bus->shutdown) {if (initcall_debug)dev_info(dev, "shutdown\n");dev->bus->shutdown(dev);} else if (dev->driver && dev->driver->shutdown) {if (initcall_debug)dev_info(dev, "shutdown\n");dev->driver->shutdown(dev);}device_unlock(dev);if (parent)device_unlock(parent);//告诉dev，你现在可以挂起了.put_device(dev);put_device(parent);spin_lock(&devices_kset->list_lock);}spin_unlock(&devices_kset->list_lock);}

下面进入执行真正的关机操作：

void machine_restart(char *cmd){//关闭中断local_irq_disable();//停掉别的cpu，只留下当前执行的cpu（smp：多对称处理器结构<Symmetrical Multi-Processing>）smp_send_stop();/* Flush the console to make sure all the relevant messages make it * out to the console drivers */arm_machine_flush_console();//arm_pm_restart 是函数指针，指向各个体系结构和芯片厂商具体的restart入口，传参给pmic执行restart或者shutdwon的动作。//比如高通8937项目对于的就是：do_msm_restart，mtk 6580对应的就是跑默认的接口：if (arm_pm_restart)arm_pm_restart(reboot_mode, cmd);elsedo_kernel_restart(cmd);//等1s时间，若1s后打印出下面的log就说明shutdwon失败了，正常情况就已经断电关机了.mdelay(1000);/* Whoops - the platform was unable to reboot. Tell the user! */printk("Reboot failed -- System halted\n");local_irq_disable();//如果跑到这里就说明关机失败了.while (1);}

Android reboot流程整体比较简单，到此分析完.