Android之 系統啟動流程

 

在前一篇文章"Android之 看“馬達”如何貫通Android系統 (從硬件設計 --> 驅動 --> HAL --> JNI --> Framework --> Application)"中，我們談到“馬達等系統服務都是通過SystemServer啟動/管理的”。本章，我們就Android的系統啟動流程進行分析；也說說SystemServer到底是如何工作的。

轉載請注明出處：http://www.cnblogs.com/skywang12345/p/3405100.html

在詳細說明之后，我們先建立個整體思路：
Kernel中啟動的第一個用戶進程是init程序；而init會通過解析init.rc來啟動zygote服務；而zygote又會進一步的啟動SystemServer。在SystemServer中，Android會啟動一系列的系統服務共用戶調用。整個流程大致如此。下面，我們通過源碼來查看一下各個環節到底是如何運作的。

1. kernel啟動init服務

在Linux的內核init/main.c中，啟動的/init程序。源碼如下：

static int __init kernel_init(void * unused)
{

    ...
        
    // “設置第一個運行程序是/init”
    if (!ramdisk_execute_command)
        ramdisk_execute_command = "/init";

        ...

    init_post();
    return 0;
}


static noinline int init_post(void)
    __releases(kernel_lock)
{

    ...
    // 運行"/init"程序
    if (ramdisk_execute_command) {
        run_init_process(ramdisk_execute_command);
        printk(KERN_WARNING "Failed to execute %s\n",
                ramdisk_execute_command);
    }

    ...

    run_init_process("/sbin/init");
    run_init_process("/etc/init");
    run_init_process("/bin/init");
    run_init_process("/bin/sh");

    ...
}

從中，我們發現：kernel_init()中會將ramdisk_execute_command的值初始化為"/init"，進而在init_post()中調用run_init_process()，從而執行"/init"程序。
我們所說的kernel內核空間到用戶空間啟動的第一個init程序，實際上就是"/init"程序。

 

2. init服務的定義

2.1 init的配置文件

Android系統中init程序對應的Android.mk所在路徑：system/core/init/Android.mk。內容如下： 

LOCAL_PATH:= $(call my-dir)
include $(CLEAR_VARS)

LOCAL_SRC_FILES:= \
    builtins.c \
    init.c \
    devices.c \
    property_service.c \
    util.c \
    parser.c \
    logo.c \
    keychords.c \
    signal_handler.c \
    init_parser.c \
    ueventd.c \
    ueventd_parser.c \
    watchdogd.c

LOCAL_MODULE:= init

include $(BUILD_EXECUTABLE)

...

說明： 在“完整的編譯Android系統” 或 “對init執行模塊編譯(即$ mmm system/core/init)”的時候，會在system下生產文件out/.../root/init。"/root/init"意味着init在rootfs文件系統下，而不是system文件系統下。這也意味着，init會被解壓到系統的根目錄，即對應/init文件！

 

2.2 init的程序入口

init程序的入口函數main()定義在system/core/init/init.c中，源碼如下：

int main(int argc, char **argv)
{

    ...

    // 創建目錄
    mkdir("/dev", 0755);
    mkdir("/proc", 0755);
    mkdir("/sys", 0755);

    mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755");
    mkdir("/dev/pts", 0755);
    mkdir("/dev/socket", 0755);
    mount("devpts", "/dev/pts", "devpts", 0, NULL);
    mount("proc", "/proc", "proc", 0, NULL);
    mount("sysfs", "/sys", "sysfs", 0, NULL);

    ...

    init_parse_config_file("/init.rc");

    ...
}

說明：在init程序中，我們會進行一些列的初始化，包括創建目錄，解析"init.rc"文件，啟動相應的系統服務和守護進程等。zygote服務定義在init.rc中，它是在init中啟動的。

 

3. init啟動解析init.rc，並啟動zygote

init.rc的路徑：system/core/rootdir/init.rc。zygote在init.rc中的定義如下：

service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server

從中，我們知道：zygote是service名稱，而/system/bin/app_process是zygote對應的進程。后面的內容是service的參數。

 

4. zygote服務

4.1 zygote服務的配置文件

通過init.rc中zygote的定義，我們知道zygote對應是通過/system/bin/app_process是啟動的。app_process對應的Android.mk的路徑：frameworks/base/cmds/app_process/Android.mk。它的內容如下：

LOCAL_PATH:= $(call my-dir)
include $(CLEAR_VARS)

LOCAL_SRC_FILES:= \
    app_main.cpp

LOCAL_SHARED_LIBRARIES := \
    libcutils \
    libutils \
    libbinder \
    libandroid_runtime

LOCAL_MODULE:= app_process

include $(BUILD_EXECUTABLE)

從中，我們知道/system/bin/app_process會執行app_main.cpp。

 

4.2 zygote對應的程序app_main.app

app_main.cpp的入口main()源碼如下：

int main(int argc, const char* const argv[])
{
    // These are global variables in ProcessState.cpp
    mArgC = argc;
    mArgV = argv;

    mArgLen = 0;
    for (int i=0; i<argc; i++) {
        mArgLen += strlen(argv[i]) + 1;
    }
    mArgLen--;

    AppRuntime runtime;
    const char* argv0 = argv[0];

    // Process command line arguments
    // ignore argv[0]
    argc--;
    argv++;

    // Everything up to '--' or first non '-' arg goes to the vm

    int i = runtime.addVmArguments(argc, argv);

    // Parse runtime arguments.  Stop at first unrecognized option.
    bool zygote = false;
    bool startSystemServer = false;
    bool application = false;
    const char* parentDir = NULL;
    const char* niceName = NULL;
    const char* className = NULL;
    // 解析參數
    while (i < argc) {
        const char* arg = argv[i++];
        if (!parentDir) {
            parentDir = arg;
        } else if (strcmp(arg, "--zygote") == 0) {
            // 設置zygote為true
            zygote = true;
            niceName = "zygote";
        } else if (strcmp(arg, "--start-system-server") == 0) {
            // 設置startSystemServer為true
            startSystemServer = true;
        } else if (strcmp(arg, "--application") == 0) {
            application = true;
        } else if (strncmp(arg, "--nice-name=", 12) == 0) {
            niceName = arg + 12;
        } else {
            className = arg;
            break;
        }
    }

    if (niceName && *niceName) {
        setArgv0(argv0, niceName);
        set_process_name(niceName);
    }

    runtime.mParentDir = parentDir;

    if (zygote) {
        // 啟動"com.android.internal.os.ZygoteInit"
        runtime.start("com.android.internal.os.ZygoteInit",
                startSystemServer ? "start-system-server" : "");
    } else if (className) {
        // Remainder of args get passed to startup class main()
        runtime.mClassName = className;
        runtime.mArgC = argc - i;
        runtime.mArgV = argv + i;
        runtime.start("com.android.internal.os.RuntimeInit",
                application ? "application" : "tool");
    } else {
        fprintf(stderr, "Error: no class name or --zygote supplied.\n");
        app_usage();
        LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");
        return 10;
    }
}

從中，我們可以知道main()最終會調用以下代碼：

runtime.start("com.android.internal.os.ZygoteInit",
        startSystemServer ? "start-system-server" : "");

我們接着看start()的代碼。start()的源碼定義在frameworks/base/core/jni/AndroidRuntime.cpp中。

runtime是AppRuntime成員。AppRuntime定義在app_main.cpp中，聲明如下：

class AppRuntime : public AndroidRuntime {
  ...
}

顯然AppRuntime繼承於AndroidRuntime。

 

4. AndroidRuntime.cpp

start()的源碼如下：

void AndroidRuntime::start(const char* className, const char* options)
{
    ALOGD("\n>>>>>> AndroidRuntime START %s <<<<<<\n",
            className != NULL ? className : "(unknown)");

    blockSigpipe();

    /*
     * 'startSystemServer == true' means runtime is obsolete and not run from
     * init.rc anymore, so we print out the boot start event here.
     */
    if (strcmp(options, "start-system-server") == 0) {
        /* track our progress through the boot sequence */
        const int LOG_BOOT_PROGRESS_START = 3000;
        LOG_EVENT_LONG(LOG_BOOT_PROGRESS_START,
                       ns2ms(systemTime(SYSTEM_TIME_MONOTONIC)));
    }

    const char* rootDir = getenv("ANDROID_ROOT");
    if (rootDir == NULL) {
        rootDir = "/system";
        if (!hasDir("/system")) {
            LOG_FATAL("No root directory specified, and /android does not exist.");
            return;
        }
        setenv("ANDROID_ROOT", rootDir, 1);
    }

    //const char* kernelHack = getenv("LD_ASSUME_KERNEL");
    //ALOGD("Found LD_ASSUME_KERNEL='%s'\n", kernelHack);

    /* start the virtual machine */
    JNIEnv* env;
    if (startVm(&mJavaVM, &env) != 0) {
        return;
    }
    onVmCreated(env);

    /*
     * Register android functions.
     */
    if (startReg(env) < 0) {
        ALOGE("Unable to register all android natives\n");
        return;
    }

    /*
     * We want to call main() with a String array with arguments in it.
     * At present we have two arguments, the class name and an option string.
     * Create an array to hold them.
     */
    jclass stringClass;
    jobjectArray strArray;
    jstring classNameStr;
    jstring optionsStr;

    stringClass = env->FindClass("java/lang/String");
    assert(stringClass != NULL);
    strArray = env->NewObjectArray(2, stringClass, NULL);
    assert(strArray != NULL);
    classNameStr = env->NewStringUTF(className);
    assert(classNameStr != NULL);
    env->SetObjectArrayElement(strArray, 0, classNameStr);
    optionsStr = env->NewStringUTF(options);
    env->SetObjectArrayElement(strArray, 1, optionsStr);

    /*
     * Start VM.  This thread becomes the main thread of the VM, and will
     * not return until the VM exits.
     */
    // 將"com.android.internal.os.ZygoteInit"轉換為"com/android/internal/os/ZygoteInit"
    char* slashClassName = toSlashClassName(className);
    // 獲取"com/android/internal/os/ZygoteInit"對應的class對象
    jclass startClass = env->FindClass(slashClassName);
    if (startClass == NULL) {
        ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);
        /* keep going */
    } else {
        // 找到"com/android/internal/os/ZygoteInit"中main()方法的methodID
        jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
            "([Ljava/lang/String;)V");
        if (startMeth == NULL) {
            ALOGE("JavaVM unable to find main() in '%s'\n", className);
            /* keep going */
        } else {
            // 執行"com/android/internal/os/ZygoteInit"中main()方法
            env->CallStaticVoidMethod(startClass, startMeth, strArray);

#if 0
            if (env->ExceptionCheck())
                threadExitUncaughtException(env);
#endif
        }
    }
    free(slashClassName);

    ALOGD("Shutting down VM\n");
    if (mJavaVM->DetachCurrentThread() != JNI_OK)
        ALOGW("Warning: unable to detach main thread\n");
    if (mJavaVM->DestroyJavaVM() != 0)
        ALOGW("Warning: VM did not shut down cleanly\n");
}

說明：start()是通過JNI回調java層的方法，它主要的目的是執行"com/android/internal/os/ZygoteInit"中main()方法，即frameworks/base/core/java/com/android/internal/os/ZygoteInit.java中的main()函數。

 

5. ZygoteInit.java

frameworks/base/core/java/com/android/internal/os/ZygoteInit.java中的main()源碼如下：

public static void main(String argv[]) {
    try {
        // Start profiling the zygote initialization.
        SamplingProfilerIntegration.start();

        registerZygoteSocket();
        EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
            SystemClock.uptimeMillis());
        preload();
        EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
            SystemClock.uptimeMillis());

        // Finish profiling the zygote initialization.
        SamplingProfilerIntegration.writeZygoteSnapshot();

        // Do an initial gc to clean up after startup
        gc();

        // If requested, start system server directly from Zygote
        if (argv.length != 2) {
            throw new RuntimeException(argv[0] + USAGE_STRING);
        }

        if (argv[1].equals("start-system-server")) {
            // 調用startSystemServer()
            startSystemServer();
        } else if (!argv[1].equals("")) {
            throw new RuntimeException(argv[0] + USAGE_STRING);
        }

        Log.i(TAG, "Accepting command socket connections");

        if (ZYGOTE_FORK_MODE) {
            runForkMode();
        } else {
            runSelectLoopMode();
        }

        closeServerSocket();
    } catch (MethodAndArgsCaller caller) {
        caller.run();
    } catch (RuntimeException ex) {
        Log.e(TAG, "Zygote died with exception", ex);
        closeServerSocket();
        throw ex;
    }
}

說明：main()會執行startSystemServer()來啟動系統服務。

startSystemServer()也是定義在ZygoteInit.java中，源碼如下：

private static boolean startSystemServer()
        throws MethodAndArgsCaller, RuntimeException {
    /* Hardcoded command line to start the system server */
    String args[] = {
        "--setuid=1000",
        "--setgid=1000",
        "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,3001,3002,3003,3006,3007",
        "--capabilities=130104352,130104352",
        "--runtime-init",
        "--nice-name=system_server",
        "com.android.server.SystemServer",
    };
    ZygoteConnection.Arguments parsedArgs = null;

    int pid;

    try {
        parsedArgs = new ZygoteConnection.Arguments(args);
        ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
        ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);

        /* Request to fork the system server process */
        pid = Zygote.forkSystemServer(
                parsedArgs.uid, parsedArgs.gid,
                parsedArgs.gids,
                parsedArgs.debugFlags,
                null,
                parsedArgs.permittedCapabilities,
                parsedArgs.effectiveCapabilities);
    } catch (IllegalArgumentException ex) {
        throw new RuntimeException(ex);
    }

    /* For child process */
    if (pid == 0) {
        handleSystemServerProcess(parsedArgs);
    }

    return true;
}

說明：
     startSystemServer()會通過Zygote.forkSystemServer()函數來創建一個新的進程來啟動SystemServer組件，返回值pid等0的地方就是新的進程要執行的路徑，即新創建的進程會執行handleSystemServerProcess()函數。 

handleSystemServerProcess()也是定義在ZygoteInit.java中，源碼如下：

private static void handleSystemServerProcess(
        ZygoteConnection.Arguments parsedArgs)
        throws ZygoteInit.MethodAndArgsCaller {

    closeServerSocket();

    // set umask to 0077 so new files and directories will default to owner-only permissions.
    Libcore.os.umask(S_IRWXG | S_IRWXO);

    if (parsedArgs.niceName != null) {
        Process.setArgV0(parsedArgs.niceName);
    }

    if (parsedArgs.invokeWith != null) {
        WrapperInit.execApplication(parsedArgs.invokeWith,
                parsedArgs.niceName, parsedArgs.targetSdkVersion,
                null, parsedArgs.remainingArgs);
    } else {
        /*
         * Pass the remaining arguments to SystemServer.
         */
        RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs);
    }

    /* should never reach here */
}

說明：handleSystemServerProcess()會調用 RuntimeInit.zygoteInit()器初始化zygote。

 

6. RuntimeInit.java

zygoteInit()定義在frameworks/base/core/java/com/android/internal/os/RuntimeInit.java中，源碼如下：

public static final void zygoteInit(int targetSdkVersion, String[] argv)
        throws ZygoteInit.MethodAndArgsCaller {
    if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting application from zygote");

    redirectLogStreams();

    commonInit();
    nativeZygoteInit();

    // 通過applicationInit()啟動SystemServer
    applicationInit(targetSdkVersion, argv);
}

說明：zygoteInit()會調用applicationInit()函數初始化應用程序SystemServer。

 

applicationInit()也定義在RuntimeInit.java中，源碼如下：

private static void applicationInit(int targetSdkVersion, String[] argv)
        throws ZygoteInit.MethodAndArgsCaller {
    nativeSetExitWithoutCleanup(true);

    VMRuntime.getRuntime().setTargetHeapUtilization(0.75f);
    VMRuntime.getRuntime().setTargetSdkVersion(targetSdkVersion);

    final Arguments args;
    try {
        args = new Arguments(argv);
    } catch (IllegalArgumentException ex) {
        Slog.e(TAG, ex.getMessage());
        // let the process exit
        return;
    }

    // invokeStaticMain()會執行SystemServer的main()方法。
    invokeStaticMain(args.startClass, args.startArgs);
}

說明：applicationInit()會調用invokeStaticMain()來執行SystemServer的main()方法。

 

invokeStaticMain()也定義在RuntimeInit.java中，源碼如下：

private static void invokeStaticMain(String className, String[] argv)
        throws ZygoteInit.MethodAndArgsCaller {
    Class<?> cl;

    try {
        // 根據“反射”查找SystemServer對應的Class
        cl = Class.forName(className);
    } catch (ClassNotFoundException ex) {
        throw new RuntimeException(
                "Missing class when invoking static main " + className,
                ex);
    }

    Method m;
    try {
        // 獲取SystemServer對應的main()方法
        m = cl.getMethod("main", new Class[] { String[].class });
    } catch (NoSuchMethodException ex) {
        throw new RuntimeException(
                "Missing static main on " + className, ex);
    } catch (SecurityException ex) {
        throw new RuntimeException(
                "Problem getting static main on " + className, ex);
    }

    int modifiers = m.getModifiers();
    if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {
        throw new RuntimeException(
                "Main method is not public and static on " + className);
    }

    // 通過ZygoteInit.MethodAndArgsCaller()執行該main()方法
    throw new ZygoteInit.MethodAndArgsCaller(m, argv);
}

說明：
    首先，我們要搞清楚invokeStaticMain()的輸入參數className，實際上它的值是"com.android.server.SystemServer"。
              我們看從startSystemServer()方法中的args成員開始查看，在args通過ZygoteConnection.Arguments(args)解析之后得到parsedArgs對象；其中,parsedArgs.remainingArgs就是"com.android.server.SystemServer"。。
    接着，parseArgs傳遞給handleSystemServerProcess()；
   再接着，將parsedArgs.remainingArgs，也就是"com.android.server.SystemServer"傳遞給了RuntimeInit.zygoteInit()。

 

7. ZygoteInit.MethodAndArgsCaller

MethodAndArgsCaller是一個實現了Runnable的類，它定義在frameworks/base/core/java/com/android/internal/os/ZygoteInit.java中。源碼如下：

public static class MethodAndArgsCaller extends Exception
        implements Runnable {
    private final Method mMethod;

    private final String[] mArgs;

    public MethodAndArgsCaller(Method method, String[] args) {
        mMethod = method;
        mArgs = args;
    }

    public void run() {
        try {
            // 通過反射，執行方法mMethod
            mMethod.invoke(null, new Object[] { mArgs });
        } catch (IllegalAccessException ex) {
            throw new RuntimeException(ex);
        } catch (InvocationTargetException ex) {
            Throwable cause = ex.getCause();
            if (cause instanceof RuntimeException) {
                throw (RuntimeException) cause;
            } else if (cause instanceof Error) {
                throw (Error) cause;
            }
            throw new RuntimeException(ex);
        }
    }
}

說明：MethodAndArgsCaller()是個線程，它會執行方法mMethod。也就是執行"com.android.server.SystemServer"中的main()方法。
至此，我們就啟動了SystemServer了!