Android开机启动流程说明

第一步：启动linux

1.Bootloader

2.Kernel

第二步android系统启动：入口为init.rc(system\core\rootdir)

1./system/bin/servicemanager:Binder守护进程；

2.Runtime;

3.Zygote:app-process/app-main;

4.StartVM;

5.Startserver

6.Startandroidservice:RegistertoserviceManager

7.StartLauncher

第三步：应用程序启动：运行packageManager

lInit进程

Android系统在启动时首先会启动Linux系统，引导加载LinuxKernel并启动init进程。Init进程是一个由内核启动的用户级进程，是Android系统的第一个进程。该进程的相关代码在platform\system\core\init\init.c。在main函数中，有如下代码：

open_devnull_stdio();
log_init();

INFO("readingconfigfile\n");
init_parse_config_file("/init.rc");

/*pullthekernelcommandlineandramdiskpropertiesfilein*/
import_kernel_cmdline(0);

get_hardware_name(hardware,&revision);
snprintf(tmp,sizeof(tmp),"/init.%s.rc",hardware);
init_parse_config_file(tmp);

这里会加载解析init.rc和init.hardware.rc两个初始化脚本。*.rc文件定义了在init进程中需要启动哪些进程服务和执行哪些动作。其详细说明参见platform\system\core\init\reademe.txt。init.rc见如下定义：

serviceservicemanager/system/bin/servicemanager
usersystem
critical
onrestartrestartzygote
onrestartrestartmedia

servicevold/system/bin/vold
socketvoldstream0660rootmount
iopriobe2

servicenetd/system/bin/netd
socketnetdstream0660rootsystem
socketdnsproxydstream0660rootinet

servicedebuggerd/system/bin/debuggerd

serviceril-daemon/system/bin/rild
socketrildstream660rootradio
socketrild-debugstream660radiosystem
userroot
groupradiocacheinetmiscaudiosdcard_rw

servicezygote/system/bin/app_process-Xzygote/system/bin--zygote--start-system-server
socketzygotestream666
onrestartwrite/sys/android_power/request_statewake
onrestartwrite/sys/power/stateon
onrestartrestartmedia
onrestartrestartnetd

servicedrm/system/bin/drmserver
userdrm
groupsystemrootinet

具体解析过程见platform\system\core\init\Init_parser.c。解析所得服务添加到service_list中，动作添加到action_list中。

接下来在main函数中执行动作和启动进程服务：

execute_one_command();
restart_processes()

通常init过程需要创建一些系统文件夹并启动USB守护进程、AndroidDebugBridge守护进程、Debug守护进程、ServiceManager进程、Zygote进程等。

lServiceManager进程

ServiceManager进程是所有服务的管理器。由init.rc对ServiceManager的描述serviceservicemanager/system/bin/servicemanager可知servicemanager进程从platform\frameworks\base\cmd\servicemanager\Service_manager.cpp启动。在main函数中有如下代码：

intmain(intargc,char**argv)
{
structbinder_state*bs;
void*svcmgr=BINDER_SERVICE_MANAGER;

bs=binder_open(128*1024);

if(binder_become_context_manager(bs)){
LOGE("cannotbecomecontextmanager(%s)\n",strerror(errno));
return-1;
}

svcmgr_handle=svcmgr;
binder_loop(bs,svcmgr_handler);
return0;
}

首先调用binder_open()打开Binder设备(/dev/binder)，调用binder_become_context_manager()把当前进程设置为ServiceManager。ServiceManager本身就是一个服务。

intbinder_become_context_manager(structbinder_state*bs)
{
returnioctl(bs->fd,BINDER_SET_CONTEXT_MGR,0);
}

最后binder_loop()进入循环状态，并设置svcmgr_handler回调函数等待添加、查询、获取服务等请求。

lZygote进程

Zygote进程用于产生其他进程。由init.rc对zygote的描述servicezygot/system/bin/app_process可知zygote进程从platfrom\frameworks\base\cmds\app_process\App_main.cpp启动。在main函数中有如下代码：

if(0==strcmp("--zygote",arg)){
boolstartSystemServer=(i<argc)?
strcmp(argv[i],"--start-system-server")==0:false;
setArgv0(argv0,"zygote");
set_process_name("zygote");
runtime.start("com.android.internal.os.ZygoteInit",
startSystemServer);
}else{
set_process_name(argv0);

runtime.mClassName=arg;

//Remainderofargsgetpassedtostartupclassmain()
runtime.mArgC=argc-i;
runtime.mArgV=argv+i;

LOGV("Appprocessisstartingwithpid=%d,class=%s.\n",
getpid(),runtime.getClassName());
runtime.start();
}

首先创建AppRuntime，即AndroidRuntime，建立了一个Dalvik虚拟机。通过这个runtime传递com.android.internal.os.ZygoteInit参数，从而由Dalvik虚拟机运行ZygoteInit.java的main()，开始创建Zygote进程。在其main()中，如下所示：

registerZygoteSocket();
EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
SystemClock.uptimeMillis());
preloadClasses();
//cacheRegisterMaps();
preloadResources();
EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
SystemClock.uptimeMillis());

//Finishprofilingthezygoteinitialization.
SamplingProfilerIntegration.writeZygoteSnapshot();

//Doaninitialgctocleanupafterstartup
gc();

//Ifrequested,startsystemserverdirectlyfromZygote
if(argv.length!=2){
thrownewRuntimeException(argv[0]+USAGE_STRING);
}

if(argv[1].equals("true")){
startSystemServer();
}elseif(!argv[1].equals("false")){
thrownewRuntimeException(argv[0]+USAGE_STRING);
}

首先通过registerZygoteSocket()登记端口，接着preloadClasses()装载相关类。这里大概要装载1000多个类，具体装载类见platform\frameworks\base\preloaded-classes。这个文件有WritePreloadedClassFile类自动生成。分析该类的main函数，有如下一段筛选类的代码：

//Preloadclassesthatwereloadedbyatleast2processes.Hopefully,
//thememoryassociatedwiththeseclasseswillbeshared.
for(LoadedClassloadedClass:root.loadedClasses.values()){
Set<String>names=loadedClass.processNames();
if(!Policy.isPreloadable(loadedClass)){
continue;
}

if(names.size()>=MIN_PROCESSES||
(loadedClass.medianTimeMicros()>MIN_LOAD_TIME_MICROS&&names.size()>1)){
toPreload.add(loadedClass);
}
}

intinitialSize=toPreload.size();
System.out.println(initialSize
+"classseswereloadedbymorethanoneapp.");

//Preloadeligableclassesfromapplications(notlong-running
//services).
for(Procproc:root.processes.values()){
if(proc.fromZygote()&&!Policy.isService(proc.name)){
for(Operationoperation:proc.operations){
LoadedClassloadedClass=operation.loadedClass;
if(shouldPreload(loadedClass)){
toPreload.add(loadedClass);
}
}
}
}

其中MIN_LOAD_TIME_MICROS等于1250，当类的装载时间大于1.25ms，则需要预装载。

Policy.isPreloadable()定于如下：

/**Reportsifthegivenclassshouldbepreloaded.*/
publicstaticbooleanisPreloadable(LoadedClassclazz){
returnclazz.systemClass&&!EXCLUDED_CLASSES.contains(clazz.name);
}

其中EXCLUDED_CLASSES如下定义：

/**
*Classeswhichweshouldn'tloadfromtheZygote.
*/
privatestaticfinalSet<String>EXCLUDED_CLASSES
=newHashSet<String>(Arrays.asList(
//Binders
"android.app.AlarmManager",
"android.app.SearchManager",
"android.os.FileObserver",
"com.android.server.PackageManagerService$AppDirObserver",

//Threads
"android.os.AsyncTask",
"android.pim.ContactsAsyncHelper",
"java.lang.ProcessManager"
));

这几个Binders和Thread是不会被预加载的。

另外还有一些application需要装载，要求满足条件proc.fromZygote()且不是属于常驻内存的服务。SERVICES定义如下：

/**
*Longrunningservices.Thesearerestrictedintheircontributiontothe
*preloaderbecausetheirlaunchtimeislesscritical.
*/
//TODO:Generatethisautomaticallyfrompackagemanager.
privatestaticfinalSet<String>SERVICES=newHashSet<String>(Arrays.asList(
"system_server",
"com.google.process.content",
"android.process.media",
"com.android.bluetooth",
"com.android.calendar",
"com.android.inputmethod.latin",
"com.android.phone",
"com.google.android.apps.maps.FriendService",//prefroyo
"com.google.android.apps.maps:FriendService",//froyo
"com.google.android.apps.maps.LocationFriendService",
"com.google.android.deskclock",
"com.google.process.gapps",
"android.tts"
));

preloaded-classes是在下载源码的时候生成，WritePreloadedClassFile类并没有被用到，但可以通过这个类了解Android系统对预加载类的默认要求，参考修改preloaded-classes文件，减少开机初始化时要预加载的类，提高开机速度。

最后来通过startSystemServer()启动SystemServer进程。见如下代码：

/*Hardcodedcommandlinetostartthesystemserver*/
Stringargs[]={
"--setuid=1000",
"--setgid=1000",
"--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,3001,3002,3003",
"--capabilities=130104352,130104352",
"--runtime-init",
"--nice-name=system_server",
"com.android.server.SystemServer",
};
ZygoteConnection.ArgumentsparsedArgs=null;

intpid;

try{
parsedArgs=newZygoteConnection.Arguments(args);

/*
*Enabledebuggingofthesystemprocessif*either*thecommandlineflags
*indicateitshouldbedebuggableorthero.debuggablesystemproperty
*issetto"1"
*/
intdebugFlags=parsedArgs.debugFlags;
if("1".equals(SystemProperties.get("ro.debuggable")))
debugFlags|=Zygote.DEBUG_ENABLE_DEBUGGER;

/*Requesttoforkthesystemserverprocess*/
pid=Zygote.forkSystemServer(
parsedArgs.uid,parsedArgs.gid,
parsedArgs.gids,debugFlags,null,
parsedArgs.permittedCapabilities,
parsedArgs.effectiveCapabilities)

Zygote包装了Linux的fork。forkSystemServer()调用forkAndSpecialize()，最终穿过虚拟机调用platform\dalvik\vm\native\dalvik_system_Zygote.c中Dalvik_dalvik_system_Zygote_forkAndSpecialize()。由dalvik完成fork新的进程。

main()最后会调用runSelectLoopMode()，进入while循环，由peers创建新的进程。

lSystemService进程

SystemService用于创建init.rc定义的服务之外的所有服务。在main()的最后有如下代码：

//Thesystemserverhastorunallofthetime,soitneedstobe
//asefficientaspossiblewithitsmemoryusage.
VMRuntime.getRuntime().setTargetHeapUtilization(0.8f);

System.loadLibrary("android_servers");
init1(args);

Init1()是在native空间实现的，用于启动native空间的服务，其实现在com_android_server_SystemServer.cpp中的android_server_SystemServer_init1()：

staticvoidandroid_server_SystemServer_init1(JNIEnv*env,jobjectclazz)
{
system_init();
}

而system_init()服务初始化创建native层的各个服务：

//Startthesensorservice
SensorService::instantiate();

//Onthesimulator,audioflingeretaldon'tgetstartedthe
//samewayasonthedevice,andweneedtostartthemhere
if(!proc->supportsProcesses()){

//StarttheAudioFlinger
AudioFlinger::instantiate();

//Startthemediaplaybackservice
MediaPlayerService::instantiate();

//Startthecameraservice
CameraService::instantiate();

//Starttheaudiopolicyservice
AudioPolicyService::instantiate();
}

最后通过如下代码:

LOGI("Systemserver:startingAndroidservices.\n");
runtime->callStatic("com/android/server/SystemServer","init2");

回到SystemServer.java，调用init2()：

publicstaticfinalvoidinit2(){
Slog.i(TAG,"EnteredtheAndroidsystemserver!");
Threadthr=newServerThread();
thr.setName("android.server.ServerThread");
thr.start();
}

Init2启动一个线程，专门用来启动java空间的所有服务。如下代码所示启动部分服务：

Slog.i(TAG,"ContentManager");
ContentService.main(context,
factoryTest==SystemServer.FACTORY_TEST_LOW_LEVEL);

Slog.i(TAG,"SystemContentProviders");
ActivityManagerService.installSystemProviders();

Slog.i(TAG,"BatteryService");
battery=newBatteryService(context);
ServiceManager.addService("battery",battery);

Slog.i(TAG,"LightsService");
lights=newLightsService(context);

Slog.i(TAG,"VibratorService");
ServiceManager.addService("vibrator",newVibratorService(context));

//onlyinitializethepowerserviceafterwehavestartedthe
//lightsservice,contentprovidersandthebatteryservice.
power.init(context,lights,ActivityManagerService.getDefault(),battery);

Slog.i(TAG,"AlarmManager");
AlarmManagerServicealarm=newAlarmManagerService(context);
ServiceManager.addService(Context.ALARM_SERVICE,alarm);

并且把这些服务添加到ServiceManager中，以便管理和进程间通讯。

在该线程后半部分，ActivityManagerService会等待AppWidget、WallPaper、IMM等systemReady后调用自身的systemReady()。

((ActivityManagerService)ServiceManager.getService("activity"))
.setWindowManager(wm);

//SkipBluetoothifwehaveanemulatorkernel
//TODO:Useamorereliablechecktoseeifthisproductshould
//supportBluetooth-seebug988521
if(SystemProperties.get("ro.kernel.qemu").equals("1")){
Slog.i(TAG,"RegisteringnullBluetoothService(emulator)");
ServiceManager.addService(BluetoothAdapter.BLUETOOTH_SERVICE,null);
}elseif(factoryTest==SystemServer.FACTORY_TEST_LOW_LEVEL){
Slog.i(TAG,"RegisteringnullBluetoothService(factorytest)");
ServiceManager.addService(BluetoothAdapter.BLUETOOTH_SERVICE,null);
}else{
Slog.i(TAG,"BluetoothService");
bluetooth=newBluetoothService(context);
ServiceManager.addService(BluetoothAdapter.BLUETOOTH_SERVICE,bluetooth);
bluetooth.initAfterRegistration();
bluetoothA2dp=newBluetoothA2dpService(context,bluetooth);
ServiceManager.addService(BluetoothA2dpService.BLUETOOTH_A2DP_SERVICE,
bluetoothA2dp);

intbluetoothOn=Settings.Secure.getInt(mContentResolver,
Settings.Secure.BLUETOOTH_ON,0);
if(bluetoothOn>0){
bluetooth.enable();
}
}

而在ActivityManagerService的systemReady()最后会执行如下代码：

mMainStack.resumeTopActivityLocked(null);

由于Activity管理栈为空，因此启动Launcher。

//Findthefirstactivitythatisnotfinishing.
ActivityRecordnext=topRunningActivityLocked(null);

//Rememberhowwe'llprocessthispause/resumesituation,andensure
//thatthestateisresethoweverwewindupproceeding.
finalbooleanuserLeaving=mUserLeaving;
mUserLeaving=false;

if(next==null){
//Therearenomoreactivities!Let'sjuststartupthe
//Launcher...
if(mMainStack){
returnmService.startHomeActivityLocked();
}
}

在startHomeActivityLocked()中创建一个带Category为CATEGORY_HOME的Intent，由此去启动相应Activity，即Launcher。

Intentintent=newIntent(
mTopAction,
mTopData!=null?Uri.parse(mTopData):null);
intent.setComponent(mTopComponent);
if(mFactoryTest!=SystemServer.FACTORY_TEST_LOW_LEVEL){
intent.addCategory(Intent.CATEGORY_HOME);
}

这样，Android系统便启动起来进入到待机界面。

更多相关文章

随机推荐