static int __ref kernel_init(void *unused)
{
    ...
    if (execute_command) {
        ret = run_init_process(execute_command);
        if (!ret)
            return 0;
    }
    if (CONFIG_DEFAULT_INIT[0] != '\0') {
    ret = run_init_process(CONFIG_DEFAULT_INIT);
    if (ret)
        pr_err("Default init %s failed (error %d)\n",CONFIG_DEFAULT_INIT, ret);
      else
        return 0;
    }
if (!try_to_run_init_process("/sbin/init") ||!try_to_run_init_process("/etc/init") ||
    !try_to_run_init_process("/bin/init") ||!try_to_run_init_process("/bin/sh"))
    return 0;
}

static int run_init_process(const char *init_filename){
    const char *const *p;
    argv_init[0] = init_filename;
    return kernel_execve(init_filename, argv_init, envp_init);
}

int main(int argc, char** argv) {
#if __has_feature(address_sanitizer)
    __asan_set_error_report_callback(AsanReportCallback);
#endif
    if (!strcmp(basename(argv[0]), "ueventd")) {
        return ueventd_main(argc, argv);
    }
    if (argc > 1) {
        if (!strcmp(argv[1], "subcontext")) {
            android::base::InitLogging(argv, &android::base::KernelLogger);
            const BuiltinFunctionMap function_map;
            return SubcontextMain(argc, argv, &function_map);
        }
        if (!strcmp(argv[1], "selinux_setup")) {
            return SetupSelinux(argv);
        }
        if (!strcmp(argv[1], "second_stage")) {
            return SecondStageMain(argc, argv);
        }
    }
    return FirstStageMain(argc, argv);
}

int FirstStageMain(int argc, char** argv) {
    boot_clock::time_point start_time = boot_clock::now();
#define CHECKCALL(x) \
    if (x != 0) errors.emplace_back(#x " failed", errno);
    // Clear the umask.
    umask(0);
    //初始化系統(tǒng)環(huán)境變量
    CHECKCALL(clearenv());
    CHECKCALL(setenv("PATH", _PATH_DEFPATH, 1));
    // 掛載及創(chuàng)建基本的文件系統(tǒng)，并設(shè)置合適的訪問權(quán)限
    CHECKCALL(mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755"));
    CHECKCALL(mkdir("/dev/pts", 0755));
    CHECKCALL(mkdir("/dev/socket", 0755));
    CHECKCALL(mount("devpts", "/dev/pts", "devpts", 0, NULL));
#define MAKE_STR(x) __STRING(x)
    CHECKCALL(mount("proc", "/proc", "proc", 0, "hidepid=2,gid=" MAKE_STR(AID_READPROC)));
#undef MAKE_STR
    // 不要將原始命令行公開給非特權(quán)進(jìn)程
    CHECKCALL(chmod("/proc/cmdline", 0440));
    gid_t groups[] = {AID_READPROC};
    CHECKCALL(setgroups(arraysize(groups), groups));
    CHECKCALL(mount("sysfs", "/sys", "sysfs", 0, NULL));
    CHECKCALL(mount("selinuxfs", "/sys/fs/selinux", "selinuxfs", 0, NULL));
    CHECKCALL(mknod("/dev/kmsg", S_IFCHR | 0600, makedev(1, 11)));
    if constexpr (WORLD_WRITABLE_KMSG) {
        CHECKCALL(mknod("/dev/kmsg_debug", S_IFCHR | 0622, makedev(1, 11)));
    }
    //創(chuàng)建linux隨機(jī)偽設(shè)備文件
    CHECKCALL(mknod("/dev/random", S_IFCHR | 0666, makedev(1, 8)));
    CHECKCALL(mknod("/dev/urandom", S_IFCHR | 0666, makedev(1, 9)));
    //log wrapper所必須的，需要在ueventd運(yùn)行之前被調(diào)用
    CHECKCALL(mknod("/dev/ptmx", S_IFCHR | 0666, makedev(5, 2)));
    CHECKCALL(mknod("/dev/null", S_IFCHR | 0666, makedev(1, 3)));
    ...
    //將內(nèi)核的stdin/stdout/stderr 全都重定向/dev/null，關(guān)閉默認(rèn)控制臺輸出
    SetStdioToDevNull(argv);
    // tmpfs已經(jīng)掛載到/dev上，同時(shí)我們也掛載了/dev/kmsg,我們能夠與外界開始溝通了
    //初始化內(nèi)核log
    InitKernelLogging(argv);
    //檢測上面的操作是否發(fā)生了錯(cuò)誤
    if (!errors.empty()) {
        for (const auto& [error_string, error_errno] : errors) {
            LOG(ERROR) << error_string << " " << strerror(error_errno);
        }
        LOG(FATAL) << "Init encountered errors starting first stage, aborting";
    }
    LOG(INFO) << "init first stage started!";
    auto old_root_dir = std::unique_ptr<DIR, decltype(&closedir)>{opendir("/"), closedir};
    if (!old_root_dir) {
        PLOG(ERROR) << "Could not opendir("/"), not freeing ramdisk";
    }
    struct stat old_root_info;
    ...
    //掛載 system、cache、data 等系統(tǒng)分區(qū)
    if (!DoFirstStageMount()) {
        LOG(FATAL) << "Failed to mount required partitions early ...";
    }
    ...
    //進(jìn)入下一步，SetupSelinux
    const char* path = "/system/bin/init";
    const char* args[] = {path, "selinux_setup", nullptr};
    execv(path, const_cast<char**>(args));
    return 1;
}

int SetupSelinux(char** argv) {
   ...
    const char* path = "/system/bin/init";
    const char* args[] = {path, "second_stage", nullptr};
    execv(path, const_cast<char**>(args));
    return 1;
}

int SecondStageMain(int argc, char** argv) {
    // 禁止OOM killer 結(jié)束該進(jìn)程以及它的子進(jìn)程
    if (auto result = WriteFile("/proc/1/oom_score_adj", "-1000"); !result) {
        LOG(ERROR) << "Unable to write -1000 to /proc/1/oom_score_adj: " << result.error();
    }
    // 啟用全局Seccomp,Seccomp是什么請自行查閱資料
    GlobalSeccomp();
    // 設(shè)置所有進(jìn)程都能訪問的會話密鑰
    keyctl_get_keyring_ID(KEY_SPEC_SESSION_KEYRING, 1);
    // 創(chuàng)建 /dev/.booting 文件，就是個(gè)標(biāo)記，表示booting進(jìn)行中
    close(open("/dev/.booting", O_WRONLY | O_CREAT | O_CLOEXEC, 0000));
    //初始化屬性的服務(wù)，并從指定文件讀取屬性
    property_init();
     ...
    // 進(jìn)行SELinux第二階段并恢復(fù)一些文件安全上下文
    SelinuxSetupKernelLogging();
    SelabelInitialize();
    SelinuxRestoreContext();
    //初始化Epoll，android這里對epoll做了一層封裝
    Epoll epoll;
    if (auto result = epoll.Open(); !result) {
        PLOG(FATAL) << result.error();
    }
    //epoll 中注冊signalfd,主要是為了創(chuàng)建handler處理子進(jìn)程終止信號
    InstallSignalFdHandler(&epoll);
    ...
    //epoll 中注冊property_set_fd，設(shè)置其他系統(tǒng)屬性并開啟系統(tǒng)屬性的服務(wù)
    StartPropertyService(&epoll);
    MountHandler mount_handler(&epoll);
    ...
    ActionManager& am = ActionManager::GetInstance();
    ServiceList& sm = ServiceList::GetInstance();
    //解析init.rc等文件，建立rc文件的action 、service，啟動其他進(jìn)程,十分關(guān)鍵的一步
    LoadBootScripts(am, sm);
    ...
    am.QueueBuiltinAction(SetupCgroupsAction, "SetupCgroups");
    //執(zhí)行rc文件中觸發(fā)器為 on early-init 的語句
    am.QueueEventTrigger("early-init");
    // 等冷插拔設(shè)備初始化完成
    am.QueueBuiltinAction(wait_for_coldboot_done_action, "wait_for_coldboot_done");
    am.QueueBuiltinAction(MixHwrngIntoLinuxRngAction, "MixHwrngIntoLinuxRng");
    am.QueueBuiltinAction(SetMmapRndBitsAction, "SetMmapRndBits");
    am.QueueBuiltinAction(SetKptrRestrictAction, "SetKptrRestrict");
    // 設(shè)備組合鍵的初始化操作
    Keychords keychords;
    am.QueueBuiltinAction(
        [&epoll, &keychords](const BuiltinArguments& args) -> Result<Success> {
            for (const auto& svc : ServiceList::GetInstance()) {
                keychords.Register(svc->keycodes());
            }
            keychords.Start(&epoll, HandleKeychord);
            return Success();
        },
        "KeychordInit");
    am.QueueBuiltinAction(console_init_action, "console_init");
   // 執(zhí)行rc文件中觸發(fā)器為on init的語句
    am.QueueEventTrigger("init");
    // Starting the BoringSSL self test, for NIAP certification compliance.
    am.QueueBuiltinAction(StartBoringSslSelfTest, "StartBoringSslSelfTest");
    // Repeat mix_hwrng_into_linux_rng in case /dev/hw_random or /dev/random
    // wasn't ready immediately after wait_for_coldboot_done
    am.QueueBuiltinAction(MixHwrngIntoLinuxRngAction, "MixHwrngIntoLinuxRng");
    am.QueueBuiltinAction(InitBinder, "InitBinder");
    // 當(dāng)設(shè)備處于充電模式時(shí)，不需要mount文件系統(tǒng)或者啟動系統(tǒng)服務(wù)，充電模式下，將charger設(shè)為執(zhí)行隊(duì)列，否則把late-init設(shè)為執(zhí)行隊(duì)列
    std::string bootmode = GetProperty("ro.bootmode", "");
    if (bootmode == "charger") {
        am.QueueEventTrigger("charger");
    } else {
        am.QueueEventTrigger("late-init");
    }
    // 基于屬性當(dāng)前狀態(tài) 運(yùn)行所有的屬性觸發(fā)器.
    am.QueueBuiltinAction(queue_property_triggers_action, "queue_property_triggers");
    while (true) {
        //開始進(jìn)入死循環(huán)狀態(tài)
        auto epoll_timeout = std::optional<std::chrono::milliseconds>{};
        //執(zhí)行關(guān)機(jī)重啟流程
        if (do_shutdown && !shutting_down) {
            do_shutdown = false;
            if (HandlePowerctlMessage(shutdown_command)) {
                shutting_down = true;
            }
        }
        if (!(waiting_for_prop || Service::is_exec_service_running())) {
            am.ExecuteOneCommand();
        }
        if (!(waiting_for_prop || Service::is_exec_service_running())) {
            if (!shutting_down) {
                auto next_process_action_time = HandleProcessActions();
                // If there's a process that needs restarting, wake up in time for that.
                if (next_process_action_time) {
                    epoll_timeout = std::chrono::ceil<std::chrono::milliseconds>(
                            *next_process_action_time - boot_clock::now());
                    if (*epoll_timeout < 0ms) epoll_timeout = 0ms;
                }
            }
            // If there's more work to do, wake up again immediately.
            if (am.HasMoreCommands()) epoll_timeout = 0ms;
        }
        // 循環(huán)等待事件發(fā)生
        if (auto result = epoll.Wait(epoll_timeout); !result) {
            LOG(ERROR) << result.error();
        }
    }
    return 0;
}

static void LoadBootScripts(ActionManager& action_manager, ServiceList& service_list) {
   //初始化ServiceParse、ActionParser、ImportParser三個(gè)解析器
   Parser parser = CreateParser(action_manager, service_list);
   std::string bootscript = GetProperty("ro.boot.init_rc", "");
   if (bootscript.empty()) {
       //bootscript為空，進(jìn)入此分支
       parser.ParseConfig("/init.rc");
       if (!parser.ParseConfig("/system/etc/init")) {
           late_import_paths.emplace_back("/system/etc/init");
       }
       if (!parser.ParseConfig("/product/etc/init")) {
           late_import_paths.emplace_back("/product/etc/init");
       }
       if (!parser.ParseConfig("/product_services/etc/init")) {
           late_import_paths.emplace_back("/product_services/etc/init");
       }
       if (!parser.ParseConfig("/odm/etc/init")) {
           late_import_paths.emplace_back("/odm/etc/init");
       }
       if (!parser.ParseConfig("/vendor/etc/init")) {
           late_import_paths.emplace_back("/vendor/etc/init");
       }
   } else {
       parser.ParseConfig(bootscript);
   }
}

 parser.ParseConfig("/init.rc")

import /init.environ.rc  //導(dǎo)入全局環(huán)境變量
import /init.usb.rc   //adb 服務(wù)、USB相關(guān)內(nèi)容的定義
import /init.${ro.hardware}.rc  //硬件相關(guān)的初始化，一般是廠商定制
import /vendor/etc/init/hw/init.${ro.hardware}.rc  
import /init.usb.configfs.rc  
import /init.${ro.zygote}.rc   //定義Zygote服務(wù)

on early-init
    # Disable sysrq from keyboard
    write /proc/sys/kernel/sysrq 0
    # Set the security context of /adb_keys if present.
    restorecon /adb_keys
    # Set the security context of /postinstall if present.
    restorecon /postinstall
    mkdir /acct/uid
    # memory.pressure_level used by lmkd
    chown root system /dev/memcg/memory.pressure_level
    chmod 0040 /dev/memcg/memory.pressure_level
    # app mem cgroups, used by activity manager, lmkd and zygote
    mkdir /dev/memcg/apps/ 0755 system system
    # cgroup for system_server and surfaceflinger
    mkdir /dev/memcg/system 0550 system system
    start ueventd
    # Run apexd-bootstrap so that APEXes that provide critical libraries
    # become available. Note that this is executed as exec_start to ensure that
    # the libraries are available to the processes started after this statement.
    exec_start apexd-bootstrap

service ueventd    //ueventd服務(wù)的可執(zhí)行文件的路徑為 /system/bin/ueventd
    class core    //ueventd 歸屬于 core class,同樣歸屬于core class的還有adbd 、console等服務(wù)
    critical //表明這個(gè)Service對設(shè)備至關(guān)重要，如果Service在四分鐘內(nèi)退出超過4次，則設(shè)備將重啟進(jìn)入恢復(fù)模式。
    seclabel u:r:ueventd:s0 //selinux相關(guān)的配置
    shutdown critical  //ueventd服務(wù)關(guān)閉行為

am.QueueEventTrigger("early-init");

on init
    ...
    # Start logd before any other services run to ensure we capture all of their logs.
    start logd
    # Start essential services.
    start servicemanager
    ...

on late-init
    //啟動vold服務(wù)(管理和控制Android平臺外部存儲設(shè)備,包括SD插撥、掛載、卸載、格式化等)
    trigger early-fs
    trigger fs
    trigger post-fs
    trigger late-fs
    //掛載/data , 啟動 apexd 服務(wù)
    trigger post-fs-data
    # 讀取持久化屬性或者從/data 中讀取并覆蓋屬性
    trigger load_persist_props_action
    //啟動zygote服務(wù)??！在啟動zygote服務(wù)前會先啟動netd服務(wù)（專門負(fù)責(zé)網(wǎng)絡(luò)管理和控制的后臺守護(hù)進(jìn)程）
    trigger zygote-start
    //移除/dev/.booting 文件
    trigger firmware_mounts_complete
    trigger early-boot
    trigger boot  //初始化網(wǎng)絡(luò)環(huán)境，設(shè)置系統(tǒng)環(huán)境和守護(hù)進(jìn)程的權(quán)限