参考文献

Android Kernel - Boot Loader

Android arm linux kernel启动流程（一）

Android系统启动流程 -- bootloader、linux kernel、android

ARM linux启动分析

android logo：内核、android开机动画


第一步：启动linux 可以参考上文 1.Bootloader 2.Kernel

第二步android系统启动：入口为init.rc(system\core\rootdir)
1./system/bin/service manager: Binder 守护进程；
2.Runtime;
3.Zygote :app-process/app-main;
4.Start VM;
5.Start server
6.Start android service:Register to service Manager
7.Start Launcher

第三步：应用程序启动：运行package Manager
1.Init进程
Android系统在启动时首先会启动Linux系统，引导加载Linux Kernel并启动init进程。Init进程是一个由内核启动的用户级进程，是Android系统的第一个进程。该进程的相关代码在platform\system\core\init\init.c。在main函数中，有如下代码：

[cpp]view plaincopyprint?
  1. open_devnull_stdio();
  2. log_init();
  3. INFO("readingconfigfile\n");
  4. init_parse_config_file("/init.rc");
  6. /*pullthekernelcommandlineandramdiskpropertiesfilein*/
  7. import_kernel_cmdline(0);
  8. get_hardware_name(hardware,&revision);
  9. snprintf(tmp,sizeof(tmp),"/init.%s.rc",hardware);
  10. init_parse_config_file(tmp);

这里会加载解析init.rc和init.hardware.rc两个初始化脚本。*.rc文件定义了在init进程中需要启动哪些进程服务和执行哪些动作。其详细说明参见platform\system\core\init\reademe.txt。init.rc见如下定义：

[cpp]view plaincopyprint?
  1. serviceservicemanager/system/bin/servicemanager
  2. usersystem
  3. critical
  4. onrestartrestartzygote
  5. onrestartrestartmedia
  7. servicevold/system/bin/vold
  8. socketvoldstream0660rootmount
  9. iopriobe2
  11. servicenetd/system/bin/netd
  12. socketnetdstream0660rootsystem
  13. socketdnsproxydstream0660rootinet
  15. servicedebuggerd/system/bin/debuggerd
  17. serviceril-daemon/system/bin/rild
  18. socketrildstream660rootradio
  19. socketrild-debugstream660radiosystem
  20. userroot
  21. groupradiocacheinetmiscaudiosdcard_rw
  23. servicezygote/system/bin/app_process-Xzygote/system/bin--zygote--start-system-server
  24. socketzygotestream666
  25. onrestartwrite/sys/android_power/request_statewake
  26. onrestartwrite/sys/power/stateon
  27. onrestartrestartmedia
  28. onrestartrestartnetd
  30. servicedrm/system/bin/drmserver
  31. userdrm
  32. groupsystemrootinet

具体解析过程见platform\system\core\init\Init_parser.c。解析所得服务添加到service_list中，动作添加到action_list中。
接下来在main函数中执行动作和启动进程服务：

[cpp]view plaincopyprint?
  1. execute_one_command();
  2. restart_processes();

通常init过程需要创建一些系统文件夹并启动USB守护进程、Android Debug Bridge守护进程、Debug守护进程、ServiceManager进程、Zygote进程等。

2. ServiceManager进程
ServiceManager进程是所有服务的管理器。由init.rc对ServiceManager的描述service servicemanager/system/bin/servicemanager可知servicemanager进程从platform\frameworks\base\cmd\servicemanager\Service_manager.cpp启动。在main函数中有如下代码：

[cpp]view plaincopyprint?
  1. intmain(intargc,char**argv)
  2. {
  3. structbinder_state*bs;
  4. void*svcmgr=BINDER_SERVICE_MANAGER;
  6. bs=binder_open(128*1024);
  8. if(binder_become_context_manager(bs)){
  9. LOGE("cannotbecomecontextmanager(%s)\n",strerror(errno));
  10. return-1;
  11. }
  13. svcmgr_handle=svcmgr;
  14. binder_loop(bs,svcmgr_handler);
  15. return0;
  16. }

首先调用binder_open()打开Binder设备(/dev/binder)，调用binder_become_context_manager()把当前进程设置为ServiceManager。ServiceManager本身就是一个服务。

[cpp]view plaincopyprint?
  1. intbinder_become_context_manager(structbinder_state*bs)
  2. {
  3. returnioctl(bs->fd,BINDER_SET_CONTEXT_MGR,0);
  4. }


最后binder_loop()进入循环状态，并设置svcmgr_handler回调函数等待添加、查询、获取服务等请求。

3. Zygote进程
Zygote进程用于产生其他进程。由init.rc对zygote的描述service zygot /system/bin/app_process可知zygote进程从platfrom\frameworks\base\cmds\app_process\App_main.cpp启动。在main函数中有如下代码：

[cpp]view plaincopyprint?
  1. if(0==strcmp("--zygote",arg)){
  2. boolstartSystemServer=(i<argc)?
  3. strcmp(argv[i],"--start-system-server")==0:false;
  4. setArgv0(argv0,"zygote");
  5. set_process_name("zygote");
  6. runtime.start("com.android.internal.os.ZygoteInit",
  7. startSystemServer);
  8. }else{
  9. set_process_name(argv0);
  10. runtime.mClassName=arg;
  12. //Remainderofargsgetpassedtostartupclassmain()
  13. runtime.mArgC=argc-i;
  14. runtime.mArgV=argv+i;
  16. LOGV("Appprocessisstartingwithpid=%d,class=%s.\n",
  17. getpid(),runtime.getClassName());
  18. runtime.start();
  19. }

首先创建AppRuntime，即AndroidRuntime，建立了一个Dalvik虚拟机。通过这个runtime传递com.android.internal.os.ZygoteInit参数，从而由Dalvik虚拟机运行ZygoteInit.java的main()，开始创建Zygote进程。在其main()中，如下所示：

[cpp]view plaincopyprint?
  1. registerZygoteSocket();
  2. EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
  3. SystemClock.uptimeMillis());
  4. preloadClasses();
  5. //cacheRegisterMaps();
  6. preloadResources();
  7. EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
  8. SystemClock.uptimeMillis());
  10. //Finishprofilingthezygoteinitialization.
  11. SamplingProfilerIntegration.writeZygoteSnapshot();
  13. //Doaninitialgctocleanupafterstartup
  14. gc();
  16. //Ifrequested,startsystemserverdirectlyfromZygote
  17. if(argv.length!=2){
  18. thrownewRuntimeException(argv[0]+USAGE_STRING);
  19. }
  21. if(argv[1].equals("true")){
  22. startSystemServer();
  23. }elseif(!argv[1].equals("false")){
  24. thrownewRuntimeException(argv[0]+USAGE_STRING);
  25. }


首先通过registerZygoteSocket()登记端口，接着preloadClasses()装载相关类。这里大概要装载1000多个类，具体装载类见platform\frameworks\base\preloaded-classes。这个文件有WritePreloadedClassFile类自动生成。分析该类的main函数，有如下一段筛选类的代码：

[cpp]view plaincopyprint?
  1. //Preloadclassesthatwereloadedbyatleast2processes.Hopefully,
  2. //thememoryassociatedwiththeseclasseswillbeshared.
  3. for(LoadedClassloadedClass:root.loadedClasses.values()){
  4. Set<String>names=loadedClass.processNames();
  5. if(!Policy.isPreloadable(loadedClass)){
  6. continue;
  7. }
  9. if(names.size()>=MIN_PROCESSES||
  10. (loadedClass.medianTimeMicros()>MIN_LOAD_TIME_MICROS&&names.size()>1)){
  11. toPreload.add(loadedClass);
  12. }
  13. }
  14. intinitialSize=toPreload.size();
  15. System.out.println(initialSize
  16. +"classseswereloadedbymorethanoneapp.");
  17. //Preloadeligableclassesfromapplications(notlong-running
  18. //services).
  19. for(Procproc:root.processes.values()){
  20. if(proc.fromZygote()&&!Policy.isService(proc.name)){
  21. for(Operationoperation:proc.operations){
  22. LoadedClassloadedClass=operation.loadedClass;
  23. if(shouldPreload(loadedClass)){
  24. toPreload.add(loadedClass);
  25. }
  26. }
  27. }
  28. }


其中MIN_LOAD_TIME_MICROS等于1250，当类的装载时间大于1.25ms，则需要预装载。

Policy.isPreloadable()定于如下：

[cpp]view plaincopyprint?
  1. /**Reportsifthegivenclassshouldbepreloaded.*/
  2. publicstaticbooleanisPreloadable(LoadedClassclazz){
  3. returnclazz.systemClass&&!EXCLUDED_CLASSES.contains(clazz.name);
  4. }


其中EXCLUDED_CLASSES如下定义：

[cpp]view plaincopyprint?
  1. /**
  2. *Classeswhichweshouldn'tloadfromtheZygote.
  3. */
  4. privatestaticfinalSet<String>EXCLUDED_CLASSES
  5. =newHashSet<String>(Arrays.asList(
  6. //Binders
  7. "android.app.AlarmManager",
  8. "android.app.SearchManager",
  9. "android.os.FileObserver",
  10. "com.android.server.PackageManagerService$AppDirObserver",
  11. //Threads
  12. "android.os.AsyncTask",
  13. "android.pim.ContactsAsyncHelper",
  14. "java.lang.ProcessManager"
  15. ));


这几个Binders和Thread是不会被预加载的。
另外还有一些application需要装载，要求满足条件proc.fromZygote()且不是属于常驻内存的服务。SERVICES定义如下：

[cpp]view plaincopyprint?
  1. /**
  2. *Longrunningservices.Thesearerestrictedintheircontributiontothe
  3. *preloaderbecausetheirlaunchtimeislesscritical.
  4. */
  5. //TODO:Generatethisautomaticallyfrompackagemanager.
  6. privatestaticfinalSet<String>SERVICES=newHashSet<String>(Arrays.asList(
  7. "system_server",
  8. "com.google.process.content",
  9. "android.process.media",
  10. "com.android.bluetooth",
  11. "com.android.calendar",
  12. "com.android.inputmethod.latin",
  13. "com.android.phone",
  14. "com.google.android.apps.maps.FriendService",//prefroyo
  15. "com.google.android.apps.maps:FriendService",//froyo
  16. "com.google.android.apps.maps.LocationFriendService",
  17. "com.google.android.deskclock",
  18. "com.google.process.gapps",
  19. "android.tts"
  20. ));


preloaded-classes是在下载源码的时候生成，WritePreloadedClassFile类并没有被用到，但可以通过这个类了解Android系统对预加载类的默认要求，参考修改preloaded-classes文件，减少开机初始化时要预加载的类，提高开机速度。

最后来通过startSystemServer()启动SystemServer进程。见如下代码：

[cpp]view plaincopyprint?
  1. /*Hardcodedcommandlinetostartthesystemserver*/
  2. Stringargs[]={
  3. "--setuid=1000",
  4. "--setgid=1000",
  5. "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,3001,3002,3003",
  6. "--capabilities=130104352,130104352",
  7. "--runtime-init",
  8. "--nice-name=system_server",
  9. "com.android.server.SystemServer",
  10. };
  12. ZygoteConnection.ArgumentsparsedArgs=null;
  13. intpid;
  14. try{
  15. parsedArgs=newZygoteConnection.Arguments(args);
  16. /*
  17. *Enabledebuggingofthesystemprocessif*either*thecommandlineflags
  18. *indicateitshouldbedebuggableorthero.debuggablesystemproperty
  19. *issetto"1"
  20. */
  21. intdebugFlags=parsedArgs.debugFlags;
  22. if("1".equals(SystemProperties.get("ro.debuggable")))
  23. debugFlags|=Zygote.DEBUG_ENABLE_DEBUGGER;
  25. /*Requesttoforkthesystemserverprocess*/
  26. pid=Zygote.forkSystemServer(
  27. parsedArgs.uid,parsedArgs.gid,
  28. parsedArgs.gids,debugFlags,null,
  29. parsedArgs.permittedCapabilities,
  30. parsedArgs.effectiveCapabilities)


Zygote包装了Linux的fork。forkSystemServer()调用forkAndSpecialize()，最终穿过虚拟机调用platform\dalvik\vm\native\dalvik_system_Zygote.c中Dalvik_dalvik_system_Zygote_forkAndSpecialize()。由dalvik完成fork新的进程。
main()最后会调用runSelectLoopMode()，进入while循环，由peers创建新的进程。

4. SystemService进程
SystemService用于创建init.rc定义的服务之外的所有服务。在main()的最后有如下代码：

[cpp]view plaincopyprint?
  1. //Thesystemserverhastorunallofthetime,soitneedstobe
  2. //asefficientaspossiblewithitsmemoryusage.
  3. VMRuntime.getRuntime().setTargetHeapUtilization(0.8f);
  5. System.loadLibrary("android_servers");
  6. init1(args);

Init1()是在native空间实现的，用于启动native空间的服务，其实现在com_android_server_SystemServer.cpp中的android_server_SystemServer_init1()：

[cpp]view plaincopyprint?
  1. staticvoidandroid_server_SystemServer_init1(JNIEnv*env,jobjectclazz)
  2. {
  3. system_init();
  4. }

而system_init()服务初始化创建native层的各个服务：

[cpp]view plaincopyprint?
  1. //Startthesensorservice
  2. SensorService::instantiate();
  4. //Onthesimulator,audioflingeretaldon'tgetstartedthe
  5. //samewayasonthedevice,andweneedtostartthemhere
  6. if(!proc->supportsProcesses()){
  7. //StarttheAudioFlinger
  8. AudioFlinger::instantiate();
  10. //Startthemediaplaybackservice
  11. MediaPlayerService::instantiate();
  13. //Startthecameraservice
  14. CameraService::instantiate();
  16. //Starttheaudiopolicyservice
  17. AudioPolicyService::instantiate();
  18. }

最后通过如下代码:

[cpp]view plaincopyprint?
  1. LOGI("Systemserver:startingAndroidservices.\n");
  2. runtime->callStatic("com/android/server/SystemServer","init2");

回到SystemServer.java，调用init2()：

[cpp]view plaincopyprint?
  1. publicstaticfinalvoidinit2(){
  2. Slog.i(TAG,"EnteredtheAndroidsystemserver!");
  3. Threadthr=newServerThread();
  4. thr.setName("android.server.ServerThread");
  5. thr.start();
  6. }

Init2启动一个线程，专门用来启动java空间的所有服务。如下代码所示启动部分服务：

[cpp]view plaincopyprint?
  1. //Criticalservices...
  2. try{
  3. Slog.i(TAG,"EntropyService");
  4. ServiceManager.addService("entropy",newEntropyService());
  6. Slog.i(TAG,"PowerManager");
  7. power=newPowerManagerService();
  8. ServiceManager.addService(Context.POWER_SERVICE,power);
  10. Slog.i(TAG,"ActivityManager");
  11. context=ActivityManagerService.main(factoryTest);
  13. Slog.i(TAG,"TelephonyRegistry");
  14. ServiceManager.addService("telephony.registry",newTelephonyRegistry(context));
  16. AttributeCache.init(context);
  18. Slog.i(TAG,"PackageManager");
  19. //Onlyrun"core"appsifwe'reencryptingthedevice.
  20. StringcryptState=SystemProperties.get("vold.decrypt");
  21. booleanonlyCore=false;
  22. if(ENCRYPTING_STATE.equals(cryptState)){
  23. Slog.w(TAG,"Detectedencryptioninprogress-onlyparsingcoreapps");
  24. onlyCore=true;
  25. }elseif(ENCRYPTED_STATE.equals(cryptState)){
  26. Slog.w(TAG,"Deviceencrypted-onlyparsingcoreapps");
  27. onlyCore=true;
  28. }
  30. pm=PackageManagerService.main(context,
  31. factoryTest!=SystemServer.FACTORY_TEST_OFF,
  32. onlyCore);
  33. booleanfirstBoot=false;
  34. try{
  35. firstBoot=pm.isFirstBoot();
  36. }catch(RemoteExceptione){
  37. }
  39. ActivityManagerService.setSystemProcess();
  41. mContentResolver=context.getContentResolver();
  43. //TheAccountManagermustcomebeforetheContentService
  44. try{
  45. Slog.i(TAG,"AccountManager");
  46. ServiceManager.addService(Context.ACCOUNT_SERVICE,
  47. newAccountManagerService(context));
  48. }catch(Throwablee){
  49. Slog.e(TAG,"FailurestartingAccountManager",e);
  50. }
  52. Slog.i(TAG,"ContentManager");
  53. ContentService.main(context,
  54. factoryTest==SystemServer.FACTORY_TEST_LOW_LEVEL);
  56. Slog.i(TAG,"SystemContentProviders");
  57. ActivityManagerService.installSystemProviders();
  59. Slog.i(TAG,"LightsService");
  60. lights=newLightsService(context);
  62. Slog.i(TAG,"BatteryService");
  63. battery=newBatteryService(context,lights);
  64. ServiceManager.addService("battery",battery);
  66. Slog.i(TAG,"VibratorService");
  67. ServiceManager.addService("vibrator",newVibratorService(context));
  69. //onlyinitializethepowerserviceafterwehavestartedthe
  70. //lightsservice,contentprovidersandthebatteryservice.
  71. power.init(context,lights,ActivityManagerService.self(),battery);
  73. Slog.i(TAG,"AlarmManager");
  74. alarm=newAlarmManagerService(context);
  75. ServiceManager.addService(Context.ALARM_SERVICE,alarm);
  77. Slog.i(TAG,"InitWatchdog");
  78. Watchdog.getInstance().init(context,battery,power,alarm,
  79. ActivityManagerService.self());
  81. Slog.i(TAG,"WindowManager");
  82. wm=WindowManagerService.main(context,power,
  83. factoryTest!=SystemServer.FACTORY_TEST_LOW_LEVEL,
  84. !firstBoot);
  85. ServiceManager.addService(Context.WINDOW_SERVICE,wm);
  87. ActivityManagerService.self().setWindowManager(wm);
  89. //SkipBluetoothifwehaveanemulatorkernel
  90. //TODO:Useamorereliablechecktoseeifthisproductshould
  91. //supportBluetooth-seebug988521
  92. if(SystemProperties.get("ro.kernel.qemu").equals("1")){
  93. Slog.i(TAG,"NoBluetoohService(emulator)");
  94. }elseif(factoryTest==SystemServer.FACTORY_TEST_LOW_LEVEL){
  95. Slog.i(TAG,"NoBluetoothService(factorytest)");
  96. }else{
  97. Slog.i(TAG,"BluetoothService");
  98. bluetooth=newBluetoothService(context);
  99. ServiceManager.addService(BluetoothAdapter.BLUETOOTH_SERVICE,bluetooth);
  100. bluetooth.initAfterRegistration();
  101. bluetoothA2dp=newBluetoothA2dpService(context,bluetooth);
  102. ServiceManager.addService(BluetoothA2dpService.BLUETOOTH_A2DP_SERVICE,
  103. bluetoothA2dp);
  104. bluetooth.initAfterA2dpRegistration();
  106. intairplaneModeOn=Settings.System.getInt(mContentResolver,
  107. Settings.System.AIRPLANE_MODE_ON,0);
  108. intbluetoothOn=Settings.Secure.getInt(mContentResolver,
  109. Settings.Secure.BLUETOOTH_ON,0);
  110. if(airplaneModeOn==0&&bluetoothOn!=0){
  111. bluetooth.enable();
  112. }
  113. }
  115. }catch(RuntimeExceptione){
  116. Slog.e("System","******************************************");
  117. Slog.e("System","************Failurestartingcoreservice",e);
  118. }


并且把这些服务添加到ServiceManager中，以便管理和进程间通讯。
在该线程后半部分，ActivityManagerService会等待AppWidget、WallPaper、IMM等systemReady后调用自身的systemReady()。

[cpp]view plaincopyprint?
  1. Slog.i(TAG,"ContentManager");
  2. ContentService.main(context,
  3. factoryTest==SystemServer.FACTORY_TEST_LOW_LEVEL);
  5. ((ActivityManagerService)ServiceManager.getService("activity"))
  6. .setWindowManager(wm);
  9. //SkipBluetoothifwehaveanemulatorkernel
  10. //TODO:Useamorereliablechecktoseeifthisproductshould
  11. //supportBluetooth-seebug988521
  12. if(SystemProperties.get("ro.kernel.qemu").equals("1")){
  13. Slog.i(TAG,"RegisteringnullBluetoothService(emulator)");
  14. ServiceManager.addService(BluetoothAdapter.BLUETOOTH_SERVICE,null);
  15. }elseif(factoryTest==SystemServer.FACTORY_TEST_LOW_LEVEL){
  16. Slog.i(TAG,"RegisteringnullBluetoothService(factorytest)");
  17. ServiceManager.addService(BluetoothAdapter.BLUETOOTH_SERVICE,null);
  18. }else{
  19. Slog.i(TAG,"BluetoothService");
  20. bluetooth=newBluetoothService(context);
  21. ServiceManager.addService(BluetoothAdapter.BLUETOOTH_SERVICE,bluetooth);
  22. bluetooth.initAfterRegistration();
  23. bluetoothA2dp=newBluetoothA2dpService(context,bluetooth);
  24. ServiceManager.addService(BluetoothA2dpService.BLUETOOTH_A2DP_SERVICE,
  25. bluetoothA2dp);
  27. intbluetoothOn=Settings.Secure.getInt(mContentResolver,
  28. Settings.Secure.BLUETOOTH_ON,0);
  30. if(bluetoothOn>0){
  31. bluetooth.enable();
  32. }
  33. }

而在ActivityManagerService的systemReady()最后会执行如下代码：

[cpp]view plaincopyprint?
  1. mMainStack.resumeTopActivityLocked(null);

由于Activity管理栈为空，因此启动Launcher。

[cpp]view plaincopyprint?
  1. //Findthefirstactivitythatisnotfinishing.
  2. ActivityRecordnext=topRunningActivityLocked(null);
  4. //Rememberhowwe'llprocessthispause/resumesituation,andensure
  5. //thatthestateisresethoweverwewindupproceeding.
  6. finalbooleanuserLeaving=mUserLeaving;
  7. mUserLeaving=false;
  9. if(next==null){
  10. //Therearenomoreactivities!Let'sjuststartupthe
  11. //Launcher...
  12. if(mMainStack){
  13. returnmService.startHomeActivityLocked();
  14. }
  15. }


在startHomeActivityLocked()中创建一个带Category为CATEGORY_HOME的Intent，由此去启动相应Activity，即Launcher。

[cpp]view plaincopyprint?
  1. Intentintent=newIntent(
  2. mTopAction,
  3. mTopData!=null?Uri.parse(mTopData):null);
  4. intent.setComponent(mTopComponent);
  6. if(mFactoryTest!=SystemServer.FACTORY_TEST_LOW_LEVEL){
  7. intent.addCategory(Intent.CATEGORY_HOME);
  8. }

这样，Android系统便启动起来进入到待机界面。

更多相关文章

  1. android 调用call
  2. Android(安卓)Studio 使用Gradle在Terminal终端用命令打包
  3. Android(安卓)process与Thread 的问题
  4. android捕获开机启动(原)
  5. Android动态壁纸开发
  6. 第一行代码笔记之——Activity启动模式
  7. 2019博客汇总
  8. android 启动报错
  9. Android基础（32）Android内存及进程包活

随机推荐

  1. SPEEX ON ANDROID
  2. ProgressBar 颜色的设置
  3. android xlistview
  4. Talking about Android Process
  5. android 系统编译要求，官方资料
  6. Android(安卓)BroadcastReceiver 简介
  7. Android local manifest
  8. android 设置Button为圆形按钮
  9. 不自动弹出键盘
  10. android中怎么在文字两边划线