Android之 系统启动流程

在前一篇文章"Android之 看“马达”如何贯通Android系统 (从硬件设计 --> 驱动 --> HAL --> JNI --> Framework --> Application)"中，我们谈到“马达等系统服务都是通过SystemServer启动/管理的”。本章，我们就Android的系统启动流程进行分析；也说说SystemServer到底是如何工作的。

转载请注明出处：http://www.cnblogs.com/skywang12345/p/3405100.html

在详细说明之后，我们先建立个整体思路：
Kernel中启动的第一个用户进程是init程序；而init会通过解析init.rc来启动zygote服务；而zygote又会进一步的启动SystemServer。在SystemServer中，Android会启动一系列的系统服务共用户调用。整个流程大致如此。下面，我们通过源码来查看一下各个环节到底是如何运作的。

1. kernel启动init服务

在Linux的内核init/main.c中，启动的/init程序。源码如下：

 static int __init kernel_init(void * unused)
 {

     ...

     // “设置第一个运行程序是/init”
     if (!ramdisk_execute_command)
         ramdisk_execute_command = "/init";

         ...

     init_post();
     return ;
 }

 static noinline int init_post(void)
     __releases(kernel_lock)
 {

     ...
     // 运行"/init"程序
     if (ramdisk_execute_command) {
         run_init_process(ramdisk_execute_command);
         printk(KERN_WARNING "Failed to execute %s\n",
                 ramdisk_execute_command);
     }

     ...

     run_init_process("/sbin/init");
     run_init_process("/etc/init");
     run_init_process("/bin/init");
     run_init_process("/bin/sh");

     ...
 }

从中，我们发现：kernel_init()中会将ramdisk_execute_command的值初始化为"/init"，进而在init_post()中调用run_init_process()，从而执行"/init"程序。
我们所说的kernel内核空间到用户空间启动的第一个init程序，实际上就是"/init"程序。

2. init服务的定义

2.1 init的配置文件

Android系统中init程序对应的Android.mk所在路径：system/core/init/Android.mk。内容如下：

 LOCAL_PATH:= $(call my-dir)
 include $(CLEAR_VARS)

 LOCAL_SRC_FILES:= \
     builtins.c \
     init.c \
     devices.c \
     property_service.c \
     util.c \
     parser.c \
     logo.c \
     keychords.c \
     signal_handler.c \
     init_parser.c \
     ueventd.c \
     ueventd_parser.c \
     watchdogd.c

 LOCAL_MODULE:= init

 include $(BUILD_EXECUTABLE)

 ...

说明： 在“完整的编译Android系统” 或 “对init执行模块编译(即$ mmm system/core/init)”的时候，会在system下生产文件out/.../root/init。"/root/init"意味着init在rootfs文件系统下，而不是system文件系统下。这也意味着，init会被解压到系统的根目录，即对应/init文件！

2.2 init的程序入口

init程序的入口函数main()定义在system/core/init/init.c中，源码如下：

 int main(int argc, char **argv)
 {

     ...

     // 创建目录
     mkdir("/dev", );
     mkdir("/proc", );
     mkdir("/sys", );

     mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755");
     mkdir("/dev/pts", );
     mkdir("/dev/socket", );
     mount("devpts", "/dev/pts", "devpts", , NULL);
     mount("proc", "/proc", "proc", , NULL);
     mount("sysfs", "/sys", "sysfs", , NULL);

     ...

     init_parse_config_file("/init.rc");

     ...
 }

说明：在init程序中，我们会进行一些列的初始化，包括创建目录，解析"init.rc"文件，启动相应的系统服务和守护进程等。zygote服务定义在init.rc中，它是在init中启动的。

3. init启动解析init.rc，并启动zygote

init.rc的路径：system/core/rootdir/init.rc。zygote在init.rc中的定义如下：

service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server

从中，我们知道：zygote是service名称，而/system/bin/app_process是zygote对应的进程。后面的内容是service的参数。

4. zygote服务

4.1 zygote服务的配置文件

通过init.rc中zygote的定义，我们知道zygote对应是通过/system/bin/app_process是启动的。app_process对应的Android.mk的路径：frameworks/base/cmds/app_process/Android.mk。它的内容如下：

 LOCAL_PATH:= $(call my-dir)
 include $(CLEAR_VARS)

 LOCAL_SRC_FILES:= \
     app_main.cpp

 LOCAL_SHARED_LIBRARIES := \
     libcutils \
     libutils \
     libbinder \
     libandroid_runtime

 LOCAL_MODULE:= app_process

 include $(BUILD_EXECUTABLE)

从中，我们知道/system/bin/app_process会执行app_main.cpp。

4.2 zygote对应的程序app_main.app

app_main.cpp的入口main()源码如下：

 int main(int argc, const char* const argv[])
 {
     // These are global variables in ProcessState.cpp
     mArgC = argc;
     mArgV = argv;

     mArgLen = ;
     for (int i=; i<argc; i++) {
         mArgLen += strlen(argv[i]) + ;
     }
     mArgLen--;

     AppRuntime runtime;
     const char* argv0 = argv[];

     // Process command line arguments
     // ignore argv[0]
     argc--;
     argv++;

     // Everything up to '--' or first non '-' arg goes to the vm

     int i = runtime.addVmArguments(argc, argv);

     // Parse runtime arguments.  Stop at first unrecognized option.
     bool zygote = false;
     bool startSystemServer = false;
     bool application = false;
     const char* parentDir = NULL;
     const char* niceName = NULL;
     const char* className = NULL;
     // 解析参数
     while (i < argc) {
         const char* arg = argv[i++];
         if (!parentDir) {
             parentDir = arg;
         } else if (strcmp(arg, "--zygote") == ) {
             // 设置zygote为true
             zygote = true;
             niceName = "zygote";
         } else if (strcmp(arg, "--start-system-server") == ) {
             // 设置startSystemServer为true
             startSystemServer = true;
         } else if (strcmp(arg, "--application") == ) {
             application = true;
         } else if (strncmp(arg, "--nice-name=", ) == ) {
             niceName = arg + ;
         } else {
             className = arg;
             break;
         }
     }

     if (niceName && *niceName) {
         setArgv0(argv0, niceName);
         set_process_name(niceName);
     }

     runtime.mParentDir = parentDir;

     if (zygote) {
         // 启动"com.android.internal.os.ZygoteInit"
         runtime.start("com.android.internal.os.ZygoteInit",
                 startSystemServer ? "start-system-server" : "");
     } else if (className) {
         // Remainder of args get passed to startup class main()
         runtime.mClassName = className;
         runtime.mArgC = argc - i;
         runtime.mArgV = argv + i;
         runtime.start("com.android.internal.os.RuntimeInit",
                 application ? "application" : "tool");
     } else {
         fprintf(stderr, "Error: no class name or --zygote supplied.\n");
         app_usage();
         LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");
         return ;
     }
 }

从中，我们可以知道main()最终会调用以下代码：

runtime.start("com.android.internal.os.ZygoteInit",
        startSystemServer ? "start-system-server" : "");

我们接着看start()的代码。start()的源码定义在frameworks/base/core/jni/AndroidRuntime.cpp中。

runtime是AppRuntime成员。AppRuntime定义在app_main.cpp中，声明如下：

class AppRuntime : public AndroidRuntime {
  ...
}

显然AppRuntime继承于AndroidRuntime。

4. AndroidRuntime.cpp

start()的源码如下：

 void AndroidRuntime::start(const char* className, const char* options)
 {
     ALOGD("\n>>>>>> AndroidRuntime START %s <<<<<<\n",
             className != NULL ? className : "(unknown)");

     blockSigpipe();

     /*
      * 'startSystemServer == true' means runtime is obsolete and not run from
      * init.rc anymore, so we print out the boot start event here.
      */
     if (strcmp(options, "start-system-server") == ) {
         /* track our progress through the boot sequence */
         const int LOG_BOOT_PROGRESS_START = ;
         LOG_EVENT_LONG(LOG_BOOT_PROGRESS_START,
                        ns2ms(systemTime(SYSTEM_TIME_MONOTONIC)));
     }

     const char* rootDir = getenv("ANDROID_ROOT");
     if (rootDir == NULL) {
         rootDir = "/system";
         if (!hasDir("/system")) {
             LOG_FATAL("No root directory specified, and /android does not exist.");
             return;
         }
         setenv("ANDROID_ROOT", rootDir, );
     }

     //const char* kernelHack = getenv("LD_ASSUME_KERNEL");
     //ALOGD("Found LD_ASSUME_KERNEL='%s'\n", kernelHack);

     /* start the virtual machine */
     JNIEnv* env;
     if (startVm(&mJavaVM, &env) != ) {
         return;
     }
     onVmCreated(env);

     /*
      * Register android functions.
      */
     if (startReg(env) < ) {
         ALOGE("Unable to register all android natives\n");
         return;
     }

     /*
      * We want to call main() with a String array with arguments in it.
      * At present we have two arguments, the class name and an option string.
      * Create an array to hold them.
      */
     jclass stringClass;
     jobjectArray strArray;
     jstring classNameStr;
     jstring optionsStr;

     stringClass = env->FindClass("java/lang/String");
     assert(stringClass != NULL);
     strArray = env->NewObjectArray(, stringClass, NULL);
     assert(strArray != NULL);
     classNameStr = env->NewStringUTF(className);
     assert(classNameStr != NULL);
     env->SetObjectArrayElement(strArray, , classNameStr);
     optionsStr = env->NewStringUTF(options);
     env->SetObjectArrayElement(strArray, , optionsStr);

     /*
      * Start VM.  This thread becomes the main thread of the VM, and will
      * not return until the VM exits.
      */
     // 将"com.android.internal.os.ZygoteInit"转换为"com/android/internal/os/ZygoteInit"
     char* slashClassName = toSlashClassName(className);
     // 获取"com/android/internal/os/ZygoteInit"对应的class对象
     jclass startClass = env->FindClass(slashClassName);
     if (startClass == NULL) {
         ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);
         /* keep going */
     } else {
         // 找到"com/android/internal/os/ZygoteInit"中main()方法的methodID
         jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
             "([Ljava/lang/String;)V");
         if (startMeth == NULL) {
             ALOGE("JavaVM unable to find main() in '%s'\n", className);
             /* keep going */
         } else {
             // 执行"com/android/internal/os/ZygoteInit"中main()方法
             env->CallStaticVoidMethod(startClass, startMeth, strArray);

 #if 0
             if (env->ExceptionCheck())
                 threadExitUncaughtException(env);
 #endif
         }
     }
     free(slashClassName);

     ALOGD("Shutting down VM\n");
     if (mJavaVM->DetachCurrentThread() != JNI_OK)
         ALOGW("Warning: unable to detach main thread\n");
     if (mJavaVM->DestroyJavaVM() != )
         ALOGW("Warning: VM did not shut down cleanly\n");
 }

说明：start()是通过JNI回调java层的方法，它主要的目的是执行"com/android/internal/os/ZygoteInit"中main()方法，即frameworks/base/core/java/com/android/internal/os/ZygoteInit.java中的main()函数。

5. ZygoteInit.java

frameworks/base/core/java/com/android/internal/os/ZygoteInit.java中的main()源码如下：

 public static void main(String argv[]) {
     try {
         // Start profiling the zygote initialization.
         SamplingProfilerIntegration.start();

         registerZygoteSocket();
         EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
             SystemClock.uptimeMillis());
         preload();
         EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
             SystemClock.uptimeMillis());

         // Finish profiling the zygote initialization.
         SamplingProfilerIntegration.writeZygoteSnapshot();

         // Do an initial gc to clean up after startup
         gc();

         // If requested, start system server directly from Zygote
         if (argv.length != 2) {
             throw new RuntimeException(argv[0] + USAGE_STRING);
         }

         if (argv[1].equals("start-system-server")) {
             // 调用startSystemServer()
             startSystemServer();
         } else if (!argv[1].equals("")) {
             throw new RuntimeException(argv[0] + USAGE_STRING);
         }

         Log.i(TAG, "Accepting command socket connections");

         if (ZYGOTE_FORK_MODE) {
             runForkMode();
         } else {
             runSelectLoopMode();
         }

         closeServerSocket();
     } catch (MethodAndArgsCaller caller) {
         caller.run();
     } catch (RuntimeException ex) {
         Log.e(TAG, "Zygote died with exception", ex);
         closeServerSocket();
         throw ex;
     }
 }

说明：main()会执行startSystemServer()来启动系统服务。

startSystemServer()也是定义在ZygoteInit.java中，源码如下：

 private static boolean startSystemServer()
         throws MethodAndArgsCaller, RuntimeException {
     /* Hardcoded command line to start the system server */
     String args[] = {
         "--setuid=1000",
         "--setgid=1000",
         "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,3001,3002,3003,3006,3007",
         "--capabilities=130104352,130104352",
         "--runtime-init",
         "--nice-name=system_server",
         "com.android.server.SystemServer",
     };
     ZygoteConnection.Arguments parsedArgs = null;

     int pid;

     try {
         parsedArgs = new ZygoteConnection.Arguments(args);
         ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
         ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);

         /* Request to fork the system server process */
         pid = Zygote.forkSystemServer(
                 parsedArgs.uid, parsedArgs.gid,
                 parsedArgs.gids,
                 parsedArgs.debugFlags,
                 null,
                 parsedArgs.permittedCapabilities,
                 parsedArgs.effectiveCapabilities);
     } catch (IllegalArgumentException ex) {
         throw new RuntimeException(ex);
     }

     /* For child process */
     if (pid == 0) {
         handleSystemServerProcess(parsedArgs);
     }

     return true;
 }

说明：
     startSystemServer()会通过Zygote.forkSystemServer()函数来创建一个新的进程来启动SystemServer组件，返回值pid等0的地方就是新的进程要执行的路径，即新创建的进程会执行handleSystemServerProcess()函数。

handleSystemServerProcess()也是定义在ZygoteInit.java中，源码如下：

 private static void handleSystemServerProcess(
         ZygoteConnection.Arguments parsedArgs)
         throws ZygoteInit.MethodAndArgsCaller {

     closeServerSocket();

     // set umask to 0077 so new files and directories will default to owner-only permissions.
     Libcore.os.umask(S_IRWXG | S_IRWXO);

     if (parsedArgs.niceName != null) {
         Process.setArgV0(parsedArgs.niceName);
     }

     if (parsedArgs.invokeWith != null) {
         WrapperInit.execApplication(parsedArgs.invokeWith,
                 parsedArgs.niceName, parsedArgs.targetSdkVersion,
                 null, parsedArgs.remainingArgs);
     } else {
         /*
          * Pass the remaining arguments to SystemServer.
          */
         RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs);
     }

     /* should never reach here */
 }

说明：handleSystemServerProcess()会调用 RuntimeInit.zygoteInit()器初始化zygote。

6. RuntimeInit.java

zygoteInit()定义在frameworks/base/core/java/com/android/internal/os/RuntimeInit.java中，源码如下：

 public static final void zygoteInit(int targetSdkVersion, String[] argv)
         throws ZygoteInit.MethodAndArgsCaller {
     if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting application from zygote");

     redirectLogStreams();

     commonInit();
     nativeZygoteInit();

     // 通过applicationInit()启动SystemServer
     applicationInit(targetSdkVersion, argv);
 }

说明：zygoteInit()会调用applicationInit()函数初始化应用程序SystemServer。

applicationInit()也定义在RuntimeInit.java中，源码如下：

 private static void applicationInit(int targetSdkVersion, String[] argv)
         throws ZygoteInit.MethodAndArgsCaller {
     nativeSetExitWithoutCleanup(true);

     VMRuntime.getRuntime().setTargetHeapUtilization(0.75f);
     VMRuntime.getRuntime().setTargetSdkVersion(targetSdkVersion);

     final Arguments args;
     try {
         args = new Arguments(argv);
     } catch (IllegalArgumentException ex) {
         Slog.e(TAG, ex.getMessage());
         // let the process exit
         return;
     }

     // invokeStaticMain()会执行SystemServer的main()方法。
     invokeStaticMain(args.startClass, args.startArgs);
 }

说明：applicationInit()会调用invokeStaticMain()来执行SystemServer的main()方法。

invokeStaticMain()也定义在RuntimeInit.java中，源码如下：

 private static void invokeStaticMain(String className, String[] argv)
         throws ZygoteInit.MethodAndArgsCaller {
     Class<?> cl;

     try {
         // 根据“反射”查找SystemServer对应的Class
         cl = Class.forName(className);
     } catch (ClassNotFoundException ex) {
         throw new RuntimeException(
                 "Missing class when invoking static main " + className,
                 ex);
     }

     Method m;
     try {
         // 获取SystemServer对应的main()方法
         m = cl.getMethod("main", new Class[] { String[].class });
     } catch (NoSuchMethodException ex) {
         throw new RuntimeException(
                 "Missing static main on " + className, ex);
     } catch (SecurityException ex) {
         throw new RuntimeException(
                 "Problem getting static main on " + className, ex);
     }

     int modifiers = m.getModifiers();
     if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {
         throw new RuntimeException(
                 "Main method is not public and static on " + className);
     }

     // 通过ZygoteInit.MethodAndArgsCaller()执行该main()方法
     throw new ZygoteInit.MethodAndArgsCaller(m, argv);
 }

说明：
    首先，我们要搞清楚invokeStaticMain()的输入参数className，实际上它的值是"com.android.server.SystemServer"。
              我们看从startSystemServer()方法中的args成员开始查看，在args通过ZygoteConnection.Arguments(args)解析之后得到parsedArgs对象；其中,parsedArgs.remainingArgs就是"com.android.server.SystemServer"。。
    接着，parseArgs传递给handleSystemServerProcess()；
   再接着，将parsedArgs.remainingArgs，也就是"com.android.server.SystemServer"传递给了RuntimeInit.zygoteInit()。

7. ZygoteInit.MethodAndArgsCaller

MethodAndArgsCaller是一个实现了Runnable的类，它定义在frameworks/base/core/java/com/android/internal/os/ZygoteInit.java中。源码如下：

 public static class MethodAndArgsCaller extends Exception
         implements Runnable {
     private final Method mMethod;

     private final String[] mArgs;

     public MethodAndArgsCaller(Method method, String[] args) {
         mMethod = method;
         mArgs = args;
     }

     public void run() {
         try {
             // 通过反射，执行方法mMethod
             mMethod.invoke(null, new Object[] { mArgs });
         } catch (IllegalAccessException ex) {
             throw new RuntimeException(ex);
         } catch (InvocationTargetException ex) {
             Throwable cause = ex.getCause();
             if (cause instanceof RuntimeException) {
                 throw (RuntimeException) cause;
             } else if (cause instanceof Error) {
                 throw (Error) cause;
             }
             throw new RuntimeException(ex);
         }
     }
 }

说明：MethodAndArgsCaller()是个线程，它会执行方法mMethod。也就是执行"com.android.server.SystemServer"中的main()方法。
至此，我们就启动了SystemServer了!