Android系统启动流程 源码解析

Android系统启动流程

本文链接：https://blog.csdn.net/feather_wch/article/details/132518105

有道云脑图：https://note.youdao.com/s/GZ9d8vzO

1、整体流程

1. Boot Room
2. BootLoader
3. idle
   1. kthread
   2. init
4. init
   1. ServiceManager
   2. zygote
5. zygote
   1. SystemServer
   2. app

一、init

1、kernel/common/init/main.c

kernel_init();
->try_to_run_init_process("/bin/init");->run_init_process(filename)->kernel_execve(filename, xxx, xxx);->// 会执行init

2、andorid.mk->android.bp编译

// init/android.bpcc_binary {name: "init_second_stage",stem: "init",static_libs: ["libinit"],srcs: ["main.cpp"], // main.cpp// ...
}

3、init是用户空间鼻祖

1. 属于C、C++ Framework

1.1 启动源码

FirstStageMain()->挂载文件系统->重定向输入输出
SetupSelinux()->初始化Selinux
SecondStageMain()->初始化属性->设置Selinux->监听子进程终止信号->epoll_ctl 注册监听SIGCHILD 避免僵尸进程->启动属性服务，将sokcet，注册到epoll中->匹配命令和函数->解析init.rc->构造解析器，对应于rc文件里面的service、on、import->parser.ParseConfig：解析rc文件->解析Dir->解析File->按照二进制格式，解析：servicemanager、zygote-> 循环执行脚本，epoll循环等待-> 执行脚本

// frameworks/core/core/init/main.cpp
int main(int argc, char** argv) {// 会反复进入// 2、第二次进来，根据参数执行if (argc > 1) {if (!strcmp(argv[1], "subcontext")) {const BuiltinFunctionMap& function_map = GetBuiltinFunctionMap();// 5、内部while+poll，第四阶段return SubcontextMain(argc, argv, &function_map);}// 3、selinux：第二阶段if (!strcmp(argv[1], "selinux_setup")) {return SetupSelinux(argv);}// 4、第三阶段if (!strcmp(argv[1], "second_stage")) {return SecondStageMain(argc, argv);}}// 1、首次进来：第一阶段return FirstStageMain(argc, argv);
}// 第一阶段：
int FirstStageMain(int argc, char** argv) {if (REBOOT_BOOTLOADER_ON_PANIC) {InstallRebootSignalHandlers();}CHECKCALL(clearenv());CHECKCALL(setenv("PATH", _PATH_DEFPATH, 1));
// 1、挂载文件系统CHECKCALL(mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755"));CHECKCALL(mount("devpts", "/dev/pts", "devpts", 0, NULL));CHECKCALL(mount("sysfs", "/sys", "sysfs", 0, NULL));CHECKCALL(mount("selinuxfs", "/sys/fs/selinux", "selinuxfs", 0, NULL));CHECKCALL(mknod("/dev/random", S_IFCHR | 0666, makedev(1, 8)));CHECKCALL(mknod("/dev/urandom", S_IFCHR | 0666, makedev(1, 9)));// null也是作为管道文件进行处理CHECKCALL(mknod("/dev/null", S_IFCHR | 0666, makedev(1, 3)));CHECKCALL(mkdir("/mnt/vendor", 0755));CHECKCALL(mkdir("/mnt/product", 0755));// 2、重定向输入输出：stdio重定向Dev Null，作为管道文件，输入输出SetStdioToDevNull(argv);// 日志输出初始化InitKernelLogging(argv);
// 3、设置selinux安全策略：重新进入main.cppconst char* path = "/system/bin/init";const char* args[] = {path, "selinux_setup", nullptr};execv(path, const_cast<char**>(args)); // 执行return 1;
}
// Selinux：设置SeLinux安全策略，Android最小权限原则，selinux控制
int SetupSelinux(char** argv) {// 设置selinuxSelinuxSetupKernelLogging();// selinux初始化SelinuxInitialize();// 重新进入第二阶段const char* path = "/system/bin/init";const char* args[] = {path, "second_stage", nullptr};execv(path, const_cast<char**>(args));return 1;
}// frameworks/core/core/init.coo
int SecondStageMain(int argc, char** argv) {// Set init and its forked children's oom_adj.if (auto result = WriteFile("/proc/1/oom_score_adj", StringPrintf("%d", DEFAULT_OOM_SCORE_ADJUST));!result.ok()) {LOG(ERROR) << "Unable to write " << DEFAULT_OOM_SCORE_ADJUST<< " to /proc/1/oom_score_adj: " << result.error();}// 1. 初始化属性：加载属性PropertyInit();// Mount extra filesystems required during second stage initMountExtraFilesystems();// 2. Selinux相关SelinuxSetupKernelLogging();SelabelInitialize();SelinuxRestoreContext();Epoll epoll; // ===============================================================================> epollif (auto result = epoll.Open(); !result.ok()) {PLOG(FATAL) << result.error();}
// 3. 监听子进程中止信号：避免僵尸进程 ==============================================================> 僵尸进程InstallSignalFdHandler(&epoll);InstallInitNotifier(&epoll);
// 4. 启动属性服务StartPropertyService(&property_fd);SetUsbController();// 5. 匹配命令和函数的关系：mount等命令都对应于函数const BuiltinFunctionMap& function_map = GetBuiltinFunctionMap();Action::set_function_map(&function_map);// 6. 解析 init.rcLoadBootScripts(am, sm);// 7. while循环解析脚本：启动zygote、执行重启while (true) {// 解析start等命令am.ExecuteOneCommand();// epoll_wait循环等待 ===================================================================> Handler中Looper.loopauto pending_functions = epoll.Wait(epoll_timeout);}return 0;
}// >>>>>>>>>>>>>>>>>>>>>>>>>>
//在linux当中，父进程是通过捕捉SIGCHLD信号来得知子进程运行结束的情况，
//SIGCHLD信号会在子进程终止的时候发出
//函数的作用就是，接收到SIGCHLD信号时触发HandleSignalFd进行信号处理
// 这样可以在当子进程发出信号后能够及时的将它销毁，避免僵尸进程的存在
static void InstallSignalFdHandler(Epoll* epoll) {const struct sigaction act { .sa_handler = SIG_DFL, .sa_flags = SA_NOCLDSTOP };sigaction(SIGCHLD, &act, nullptr);sigset_t mask;sigemptyset(&mask);sigaddset(&mask, SIGCHLD); //SIGCHLDsignal_fd = signalfd(-1, &mask, SFD_CLOEXEC);// 注册，epoll注册handler。 ===========================> epoll_ctl EPOLL_CTL_ADDif (auto result = epoll->RegisterHandler(signal_fd, HandleSignalFd); !result.ok()) {LOG(FATAL) << result.error();}
}// 注册，epoll注册handler。 ===========================> epoll_ctl EPOLL_CTL_ADD
Result<void> Epoll::RegisterHandler(int fd, std::function<void()> handler, uint32_t events) {epoll_event ev;ev.events = events;ev.data.ptr = reinterpret_cast<void*>(&it->second);if (epoll_ctl(epoll_fd_, EPOLL_CTL_ADD, fd, &ev) == -1) {epoll_handlers_.erase(fd);return result;}return {};
}// >>>>>>>>>>>>>>>>>>> 启动属性服务，注册到epoll中
void StartPropertyService(int* epoll_socket) {InitPropertySet("ro.property_service.version", "2");int sockets[2];if (socketpair(AF_UNIX, SOCK_SEQPACKET | SOCK_CLOEXEC, 0, sockets) != 0) {PLOG(FATAL) << "Failed to socketpair() between property_service and init";}*epoll_socket = from_init_socket = sockets[0];init_socket = sockets[1];StartSendingMessages();if (auto result = CreateSocket(PROP_SERVICE_NAME, SOCK_STREAM | SOCK_CLOEXEC | SOCK_NONBLOCK, false, 0666, 0, 0, {});result.ok()) {property_set_fd = *result;}listen(property_set_fd, 8);auto new_thread = std::thread{PropertyServiceThread};property_service_thread.swap(new_thread);
}

init.rc解析

// 解析init.rc
static void LoadBootScripts(ActionManager& action_manager, ServiceList& service_list) {// 1、创建对应解析器 service、on、importParser parser = CreateParser(action_manager, service_list);// 2、解析init.rc init.rc里面有zygote等等std::string bootscript = GetProperty("ro.boot.init_rc", "");if (bootscript.empty()) {parser.ParseConfig("/system/etc/init/hw/init.rc");if (!parser.ParseConfig("/system/etc/init")) {late_import_paths.emplace_back("/system/etc/init");}parser.ParseConfig("/system_ext/etc/init");if (!parser.ParseConfig("/product/etc/init")) {late_import_paths.emplace_back("/product/etc/init");}if (!parser.ParseConfig("/odm/etc/init")) {late_import_paths.emplace_back("/odm/etc/init");}if (!parser.ParseConfig("/vendor/etc/init")) {late_import_paths.emplace_back("/vendor/etc/init");}} else {parser.ParseConfig(bootscript);}
}
// 根据rc文件的内容，创建对应解析器 
Parser CreateParser(ActionManager& action_manager, ServiceList& service_list) {Parser parser;parser.AddSectionParser("service", std::make_unique<ServiceParser>(&service_list, GetSubcontext(), std::nullopt));parser.AddSectionParser("on", std::make_unique<ActionParser>(&action_manager, GetSubcontext()));parser.AddSectionParser("import", std::make_unique<ImportParser>(&parser));return parser;
}// frameworks/core/core/init/parse.cpp
// 解析
bool Parser::ParseConfig(const std::string& path) {if (is_dir(path.c_str())) {return ParseConfigDir(path); // 目录 -> ParseConfigFile}return ParseConfigFile(path); // 文件
}
bool Parser::ParseConfigFile(const std::string& path) {// 解析数据ParseData(path, &config_contents.value());return true;
}// 根据二进制格式要求，解析数据
void Parser::ParseData(const std::string& filename, std::string* data) {for (;;) {switch (next_token(&state)) {case T_EOF:// ...return;case T_NEWLINE: {// ...break;}case T_TEXT:args.emplace_back(state.text);break;}}
}

1.2 init.rc文件

import /system/etc/init/hw/init.${ro.zygote}.rcon init# Mount binderfsmkdir /dev/binderfsmount binder binder /dev/binderfs stats=globalchmod 0755 /dev/binderfssymlink /dev/binderfs/binder /dev/bindersymlink /dev/binderfs/hwbinder /dev/hwbindersymlink /dev/binderfs/vndbinder /dev/vndbinder# Start essential services.start servicemanagerstart hwservicemanagerstart vndservicemanageron late-init# Now we can start zygote for devices with file based encryptiontrigger zygote-starton zygote-start && property:ro.crypto.state=unencrypted# A/B update verifier that marks a successful boot.exec_start update_verifier_nonencryptedstart statsdstart netdstart zygotestart zygote_secondary

二、ServiceManager

ServiceManager启动流程：见Binder部分。

main()
->1.初始化Binder驱动，加载"/dev/binder"
->2.实例化ServiceManager，并将自己作为第一个服务，进行添加注册
->3.将自己设置为IPCThreadState的contextobject，也就是设置服务端的BBinder对象
->4.利用Looper，也就是底层epoll处理事务，设置BinderCallback监听（epoll_ctl），无限等待
->5.while() // Binder驱动遇到事件，会回调handleEvent

三、Zygote

3.1 rc解析

// init.zygote64.rc
# 启动一个服务
service zygote /system/bin/app_process64 -Xzygote /system/bin --zygote --start-system-serverclass mainpriority -20user rootgroup root readproc reserved_disksocket zygote stream 660 root systemsocket usap_pool_primary stream 660 root system# zygote被关闭就会重启Android操作系统 onrestart exec_background - system system -- /system/bin/vdc volume abort_fuseonrestart write /sys/power/state ononrestart restart audioserveronrestart restart cameraserveronrestart restart mediaonrestart restart netdonrestart restart wificondwritepid /dev/cpuset/foreground/tasks

// frameworks/base/cmds/app_process/Android.bp
cc_binary {name: "app_process",srcs: ["app_main.cpp"] // 指明代码为app_main.cpp
}

3.2 启动:app_main.cpp

AppRuntime

class AppRuntime : public AndroidRuntime
{
public:AppRuntime(char* argBlockStart, const size_t argBlockLength): AndroidRuntime(argBlockStart, argBlockLength), mClass(NULL){}void setClassNameAndArgs(const String8& className, int argc, char * const *argv) {mClassName = className;for (int i = 0; i < argc; ++i) {mArgs.add(String8(argv[i]));}}virtual void onVmCreated(JNIEnv* env){if (mClassName.isEmpty()) {return; // Zygote. Nothing to do here.}char* slashClassName = toSlashClassName(mClassName.string());mClass = env->FindClass(slashClassName);if (mClass == NULL) {ALOGE("ERROR: could not find class '%s'\n", mClassName.string());}free(slashClassName);mClass = reinterpret_cast<jclass>(env->NewGlobalRef(mClass));}virtual void onStarted(){sp<ProcessState> proc = ProcessState::self();ALOGV("App process: starting thread pool.\n");proc->startThreadPool();AndroidRuntime* ar = AndroidRuntime::getRuntime();ar->callMain(mClassName, mClass, mArgs);IPCThreadState::self()->stopProcess();hardware::IPCThreadState::self()->stopProcess();}// nativeZygoteInit调用时，被JNI中转到这里。virtual void onZygoteInit(){sp<ProcessState> proc = ProcessState::self(); // 1、初始化ProcessState（初始化Binder驱动）ALOGV("App process: starting thread pool.\n");proc->startThreadPool(); // 2、创建Binder线程池，底层一路到IPCThreadState::self()->joinThreadPool();}virtual void onExit(int code){if (mClassName.isEmpty()) {// if zygoteIPCThreadState::self()->stopProcess();hardware::IPCThreadState::self()->stopProcess();}AndroidRuntime::onExit(code);}String8 mClassName;Vector<String8> mArgs;jclass mClass;
};

main

1、app_main.cpp 启动Zygote或者正常app流程 ->目录frameworks\base\cmds\app_process\

// 核心：根据init.zygote64.rc里面配置的参数，--zygote和--start-system-server，启动zygote，systemserver作为参数传入，以后启动
int main(int argc, char* const argv[])
{/**========================* 1、根据rc配置，解析出需要启动zygote，并且在zygote启动后，*========================*/AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));// 解析传入的参数 -Xzygote /system/bin --zygote --start-system-serverint i;for (i = 0; i < argc; i++) {// 参数解析runtime.addOption(strdup(argv[i]));}// 判断是zygote还是appbool zygote = false;bool startSystemServer = false; // 用于存入参数bool application = false; // appString8 niceName;String8 className;++i;  // Skip unused "parent dir" argument.while (i < argc) {const char* arg = argv[i++];if (strcmp(arg, "--zygote") == 0) {zygote = true;niceName = ZYGOTE_NICE_NAME;} else if (strcmp(arg, "--start-system-server") == 0) {startSystemServer = true;} else if (strcmp(arg, "--application") == 0) {application = true;} else if (strncmp(arg, "--nice-name=", 12) == 0) {niceName.setTo(arg + 12);} else if (strncmp(arg, "--", 2) != 0) {className.setTo(arg);break;} else {--i;break;}}Vector<String8> args;if (!className.isEmpty()) {// 非zygote模式，存入application启动相关参数args.add(application ? String8("application") : String8("tool"));runtime.setClassNameAndArgs(className, argc - i, argv + i);} else {// zygote模式，将systemserver和其他剩余参数，都一次性放入if (startSystemServer) {args.add(String8("start-system-server"));}String8 abiFlag("--abi-list=");abiFlag.append(prop);args.add(abiFlag);// In zygote mode, pass all remaining arguments to the zygote// main() method.for (; i < argc; ++i) {args.add(String8(argv[i]));}}/**===============================================* 2、启动zygote(systemserver等内容作为参数传入)*=====================================================*///  启动zygote的java层调用if (zygote) {zygote 为true 表示正在启动的进程为zygote进程//由此可知app_main.cpp在zygote启动其他进程的时候都会通过main()方法//这里启动的是zygote进程调用runtime start()方法 传入参数runtime.start("com.android.internal.os.ZygoteInit", args, zygote);} else if (className) {  //这个地方是用于启动app的 // application = true时，会解析。runtime.start("com.android.internal.os.RuntimeInit", args, zygote);} else {fprintf(stderr, "Error: no class name or --zygote supplied.\n");app_usage();LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");}
}

2、AndroidRuntime.cpp ->目录frameworks\base\core\jni\

void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
{// 创建虚拟机if (startVm(&mJavaVM, &env, zygote, primary_zygote) != 0) { // heapsize默认16MB，也在这里面设置return;}    // 注册JNIif (startReg(env) < 0) {return;}// 反射调用main方法（进入ZygoteInit.java的main()方法） ==============================> JNI反射char* slashClassName = toSlashClassName(className != NULL ? className : "");jclass startClass = env->FindClass(slashClassName);jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
"([Ljava/lang/String;)V");env->CallStaticVoidMethod(startClass, startMeth, strArray);
}

JNI注册

AndroidRuntime.cpp中注册了所有JNI

/*static*/ int AndroidRuntime::startReg(JNIEnv* env)
{if (register_jni_procs(gRegJNI, NELEM(gRegJNI), env) < 0) {env->PopLocalFrame(NULL);return -1;}
}// 循环执行数组里面的mProc()方法
static int register_jni_procs(const RegJNIRec array[], size_t count, JNIEnv* env)
{for (size_t i = 0; i < count; i++) {if (array[i].mProc(env) < 0) {return -1;}}return 0;
}#define REG_JNI(name)      { name, #name }
struct RegJNIRec {int (*mProc)(JNIEnv*); // mProc函数指针 ============================================> Kotlin函数引用const char* mName;
};// 数组存放了所有JNI对应关系static const RegJNIRec gRegJNI[] = {REG_JNI(register_com_android_internal_os_RuntimeInit), //REG_JNI是RegJNIRec结构体的别名REG_JNI(register_com_android_internal_os_ZygoteInit_nativeZygoteInit),...
}// REG_JNI是将函数名，作为函数指针mProc的内容，后续直接mProc(env)进行调用
int register_com_android_internal_os_ZygoteInit_nativeZygoteInit(JNIEnv* env)
{// JNI动态注册，绑定nativeZygoteInit Java方法 和 底层方法 com_android_internal_os_ZygoteInit_nativeZygoteInitconst JNINativeMethod methods[] = {{ "nativeZygoteInit", "()V",(void*) com_android_internal_os_ZygoteInit_nativeZygoteInit },};return jniRegisterNativeMethods(env, "com/android/internal/os/ZygoteInit",methods, NELEM(methods));
}
static void com_android_internal_os_ZygoteInit_nativeZygoteInit(JNIEnv* env, jobject clazz)
{//gCurRuntime是app_main.cpp中的class AppRuntime : public AndroidRuntime，实现了onZygoteInit()方法gCurRuntime->onZygoteInit();
}

3.3 ZygoteInit

3、ZygoteInit.java ->目录frameworks\base\cor\java\com\android\internal\os\

public static void main(String argv[]) {//step1 重要的函数 preloadpreload(bootTimingsTraceLog);//Step2 重要函数 创建socket服务zygoteServer = new ZygoteServer(isPrimaryZygote);  if (startSystemServer) {//Step3 重要函数 Zygote Fork出的第一个进程 system_serverRunnable r = forkSystemServer(abiList, zygoteSocketName, zygoteServer);r.run(); // r: ZygoteInit.zygoteInitreturn;}//Step4 重要函数 循环等待fork出其他的应用进程，比如Launcher，比如appcaller = zygoteServer.runSelectLoop(abiList);//执行返回的Runnable对象，进入子进程caller.run();}

preload

    static void preload(TimingsTraceLog bootTimingsTraceLog) {preloadClasses();// 加载系统类preloadResources();// 加载系统资源nativePreloadAppProcessHALs();maybePreloadGraphicsDriver();preloadSharedLibraries();// 加载一些共享so库，其实就三个：android、compiler_rt、jnigraphicspreloadTextResources();// 加载字体资源WebViewFactory.prepareWebViewInZygote();// 加载webview相关资源warmUpJcaProviders();// 初始化JCA安全相关的参数}

预加载资源

1、preloadClasses()

"/system/etc/preloaded-classes"
// 会预加载上述文件中的类
// 例如：SurfaceView、TextView、View等等

2、preloadResources()

// 预加载如 com.android.internal.R.xxx 资源
"frameworks/base/core/res/values/arrays.xml"...

ZygoteServer

创建

// 创建ZygoteServer的本质就是创建LocalServerSocket
static void main(){zygoteServer = new ZygoteServer(isPrimaryZygote);  
}
// ZygoteServer.java frameworks\base\core\java\com\android\internal\os\ZygoteServer.javaZygoteServer(boolean isPrimaryZygote) {// 初始化，创建SocketmZygoteSocket = Zygote.createManagedSocketFromInitSocket(Zygote.PRIMARY_SOCKET_NAME);}static LocalServerSocket createManagedSocketFromInitSocket(String socketName) {return new LocalServerSocket(fd);// =======================================================================>LocalServerSocket}

创建连接

AMS会创建连接 ==========> AMS

处理事务

1、ZygoteServer源码

1. poll机制，多路复用
2. 处理客户端连接请求
3. 处理数据处理请求：processOneCommand

  Runnable runSelectLoop(String abiList) {//mZygoteSocket 是socket通信中的服务端，即zygote进程。保存到socketFDs[0]socketFDs.add(mZygoteSocket.getFileDescriptor());while (true) {// Step 1：Poll机制，IO多路复用。没有事件到来就阻塞// 1. 每次循环，都重新创建需要监听的pollFds。并且关注事件：POLLINStructPollfd[] pollFDs;for (FileDescriptor socketFD : socketFDs) {pollFDs[pollIndex].events = (short) POLLIN; // 关注事件的到来}// 2. Poll机制：处理轮询状态，当pollFds有事件到来则往下执行，否则阻塞在这里pollReturnValue = Os.poll(pollFDs, pollTimeoutMs); // ===================================================================================>Pollwhile (--pollIndex >= 0) {// Step 2：处理 客户端发出连接请求if (pollIndex == 0) { // 意味着有客户端连接请求ZygoteConnection newPeer = acceptCommandPeer(abiList);// 则创建ZygoteConnection对象,并添加到socketFDs。peers.add(newPeer); //  加入到peers和socketFDs，下一次也开始监听socketFDs.add(newPeer.getFileDescriptor());}// Step 3：处理 数据处理请求else if (pollIndex < usapPoolEventFDIndex) {//pollIndex>0，则代表通过socket接收来自对端的数据，并执行相应操作ZygoteConnection connection = peers.get(pollIndex);///重要细节/////  进行进程的处理:创建进程final Runnable command = connection.processOneCommand(this);// TODO (chriswailes): Is this extra check necessary?if (mIsForkChild) {return command; // child} else {socketFDs.remove(pollIndex);//处理完则从socketFDs中移除该文件描述符}}}}}// 接受客户端连接private ZygoteConnection acceptCommandPeer(String abiList) {// 用LocalSocket建立连接return createNewConnection(mZygoteSocket.accept(), abiList);}protected ZygoteConnection createNewConnection(LocalSocket socket, String abiList){return new ZygoteConnection(socket, abiList);}// 初始化输入输出流 BIOZygoteConnection(LocalSocket socket, String abiList) throws IOException { // =================================>Java BIOmSocket = socket;this.abiList = abiList;mSocketOutStream = new DataOutputStream(socket.getOutputStream());mSocketReader =new BufferedReader( // ============================> 装饰者模式new InputStreamReader(socket.getInputStream()), Zygote.SOCKET_BUFFER_SIZE);mSocket.setSoTimeout(CONNECTION_TIMEOUT_MILLIS);peer = mSocket.getPeerCredentials();isEof = false;}

2、ZygoteServer和select、poll、epoll

1. select <= Andorid 5.0，使用复杂，最大1024FD
2. poll >= Android 6.0，取消FD数量限制

3、为什么使用poll，不使用epoll？

1. fork进程频率远不如Handler的Looper，epoll在低并发场景下并没有特别优势
2. epoll还需要维护事件队列，没有必要

poll

Title
死磕epoll

四、SystemServer

1、是什么

1. 是独立进程
2. 管理服务（90+）

4.0 forkSystemServer

forkSystemServer()
->nativeFork()->fork()
->ZygoteInit.zygoteInit()->Runtime.commonInit // 初始化运行时环境->设置异常处理器KillApplicationHandler->ZygoteInit.nativeZygoteInit // JNI注册时，可以发现通过JNI转到了AppRuntime的onZygoteInit回调->构造ProcessSate::self()->open_driver->初始化Binder驱动->设置最大线程数15->mmap 1024-8kb->通过IPCThreadState启动Binder线程池->main()

1、fork出SystemServer
ZygoteInit.java ->目录frameworks\base\core\java\com\android\internal\os\

private static Runnable forkSystemServer(String abiList, String socketName,ZygoteServer zygoteServer) {int pid = Zygote.forkSystemServer(parsedArgs.mUid, parsedArgs.mGid,parsedArgs.mGids,parsedArgs.mRuntimeFlags,null,parsedArgs.mPermittedCapabilities,parsedArgs.mEffectiveCapabilities);// 子进程继续处理if (pid == 0) { if (hasSecondZygote(abiList)) {waitForSecondaryZygote(socketName);}zygoteServer.closeServerSocket();return handleSystemServerProcess(parsedArgs);}// 父进程什么也不做return null;
}

2、Zygote.java frameworks\base\core\java\com\android\internal\os\Zygote.java

    static int forkSystemServer(int uid, int gid, int[] gids, int runtimeFlags, int[][] rlimits, long permittedCapabilities, long effectiveCapabilities) {int pid = nativeForkSystemServer(uid, gid, gids, runtimeFlags, rlimits,permittedCapabilities, effectiveCapabilities);return pid;}// 核心作用：调用底层fork()private static native int nativeForkSystemServer(int uid, int gid, int[] gids, int runtimeFlags,int[][] rlimits, long permittedCapabilities, long effectiveCapabilities);

3、ZygoteInit.java frameworks\base\core\java\com\android\internal\os\

private static Runnable handleSystemServerProcess(ZygoteArguments parsedArgs) // pathclassloaderClassLoader cl = createPathClassLoader(systemServerClasspath, parsedArgs.mTargetSdkVersion); // ===============================> PathClassLoaderreturn ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion,parsedArgs.mDisabledCompatChanges,parsedArgs.mRemainingArgs, cl);
}// 双亲委派，用BootClassLoader构造PathClassLoader，传入库路径："java.library.path"static ClassLoader createPathClassLoader(String classPath, int targetSdkVersion) {String libraryPath = System.getProperty("java.library.path");ClassLoader parent = ClassLoader.getSystemClassLoader().getParent(); // We use the boot class loader, that's what the runtime expects at AOT.return ClassLoaderFactory.createClassLoader(classPath, libraryPath, libraryPath,parent, targetSdkVersion, true /* isNamespaceShared */, null /* classLoaderName */);}

4、ZygoteInit.java frameworks\base\core\java\com\android\internal\os\

    public static final Runnable zygoteInit(xxx) {//1. 初始化运行环境RuntimeInit.commonInit();//初始化运行环境 //2. 启动Binder ，方法在 androidRuntime.cpp中注册       ZygoteInit.nativeZygoteInit();//3. 通过反射创建程序入口函数的 Method 对象，并返回 Runnable 对象// ActivityThread.mainreturn RuntimeInit.applicationInit(targetSdkVersion, disabledCompatChanges, argv, classLoader);}protected static Runnable applicationInit(xxx, ClassLoader classLoader) {// startClass: 如果AMS通过socket传递过来的是 ActivityThreadreturn findStaticMain(args.startClass, args.startArgs, classLoader);}

4.1 commonInit

framworks\base\core\java\com\android\internal\os\

    protected static final void commonInit() {if (DEBUG) Slog.d(TAG, "Entered RuntimeInit!");//1、设置异常处理器：
// 1. 设置未捕获异常的预处理器（pre-handler）为 LoggingHandler，用于处理未捕获的异常日志。
// 2. 设置默认的未捕获异常处理器为 KillApplicationHandler，用于处理应用程序崩溃并终止应用。 =========================> ANR KillApplicationHandlerLoggingHandler loggingHandler = new LoggingHandler();RuntimeHooks.setUncaughtExceptionPreHandler(loggingHandler);Thread.setDefaultUncaughtExceptionHandler(new KillApplicationHandler(loggingHandler));//2、设置日志管理器LogManager.getLogManager().reset();new AndroidConfig();//3、关联套接字标记和流量统计：NetworkManagementSocketTagger.install();
// 省略initialized = true;}

4.2 main()

SystemServer.java

    public static void main(String[] args) {new SystemServer().run(); // 构造SystemServer执行run方法}private void run() {/**=====================================* 1、startService之前的准备工作*=======================================*/TimingsTraceAndSlog t = new TimingsTraceAndSlog();try {// Binder线程池 线程数量 -> 31BinderInternal.setMaxThreads(sMaxBinderThreads);// 线程优先级android.os.Process.setThreadPriority(android.os.Process.THREAD_PRIORITY_FOREGROUND);android.os.Process.setCanSelfBackground(false);// STEP 1: 主线程Looper =================================================> HandlerLooper.prepareMainLooper();// load android_servers.so // 服务相关System.loadLibrary("android_servers");// STEP 2: 创建SystemServer的Context，用于黑白屏的启动createSystemContext();// STEP 3: 构造SystemServiceManager并且添加到本地服务中。系统服务（SystemServer）的管理者mSystemServiceManager = new SystemServiceManager(mSystemContext);// 添加到LocalServicesLocalServices.addService(SystemServiceManager.class, mSystemServiceManager);// 启动SystemServer内部线程池：mService = ConcurrentUtils.newFixedThreadPoolSystemServerInitThreadPool.start(); // // JVMTI相关if (Build.IS_DEBUGGABLE) {// Property is of the form "library_path=parameters".String jvmtiAgent = SystemProperties.get("persist.sys.dalvik.jvmtiagent");int equalIndex = jvmtiAgent.indexOf('=');String libraryPath = jvmtiAgent.substring(0, equalIndex);String parameterList =jvmtiAgent.substring(equalIndex + 1, jvmtiAgent.length());Debug.attachJvmtiAgent(libraryPath, parameterList, null);}} finally {t.traceEnd();  // InitBeforeStartServices}/**=====================================* 2、startService*=======================================*/// STEP 4: 启动各类服务startBootstrapServices(t);startCoreServices(t);startOtherServices(t);// STEP 5: loop 无限循环Looper.loop();}

createSystemContext()

// SystemServer.java ：attach(创建Context和Application执行onCreate)、设置主题private void createSystemContext() {// 1、attach，参数一 system：trueActivityThread activityThread = ActivityThread.systemMain();mSystemContext = activityThread.getSystemContext();// 2、设置主题mSystemContext.setTheme(DEFAULT_SYSTEM_THEME);final Context systemUiContext = activityThread.getSystemUiContext();systemUiContext.setTheme(DEFAULT_SYSTEM_THEME);}
// ActivityThread.java-attachpublic static ActivityThread systemMain() {ActivityThread thread = new ActivityThread();thread.attach(true, 0); // system:true startSeq:0return thread;}
// ActivityThread.java: context和application+onCreateprivate void attach(boolean system, long startSeq) {mSystemThread = system;if (system) {mInstrumentation = new Instrumentation();mInstrumentation.basicInit(this);// 1、创建系统的ContextImplContextImpl context = ContextImpl.createAppContext(this, getSystemContext().mPackageInfo);// 2、构造Applicaiton，执行onCreatemInitialApplication = context.mPackageInfo.makeApplication(true, null);mInitialApplication.onCreate();}}

BinderInternal.setMaxThreads

BinderInternal.setMaxThreads(sMaxBinderThreads);

// 增加SystemServer的binder线程池中线程数量，15---->31
// JNI转给ProcessState
status_t ProcessState::setThreadPoolMaxThreadCount(size_t maxThreads) {status_t result = NO_ERROR;// ioctlif (ioctl(mDriverFD, BINDER_SET_MAX_THREADS, &maxThreads) != -1) {mMaxThreads = maxThreads;}return result;
}

LocalServices

LocalServices

// ArrayMap  key=服务.class, value=服务对象                ====================================================> ArrayMapprivate static final ArrayMap<Class<?>, Object> sLocalServiceObjects = new ArrayMap<Class<?>, Object>();public static <T> void addService(Class<T> type, T service) {synchronized (sLocalServiceObjects) { // =================================>synchronizedif (sLocalServiceObjects.containsKey(type)) {throw new IllegalStateException("Overriding service registration");}sLocalServiceObjects.put(type, service);}}

4.3 startServices

    private void startBootstrapServices(@NonNull TimingsTraceAndSlog t) {t.traceBegin("startBootstrapServices");// WatchDog SystemServer可能crash =========================> crash、anrt.traceBegin("StartWatchdog");final Watchdog watchdog = Watchdog.getInstance();watchdog.start();// 等待安装完成，安装好后创建/data/user目录（需要先启动）t.traceBegin("StartInstaller");Installer installer = mSystemServiceManager.startService(Installer.class);t.traceEnd();// ATMS// MASt.traceBegin("StartActivityManager");ActivityTaskManagerService atm = mSystemServiceManager.startService(ActivityTaskManagerService.Lifecycle.class).getService(); //启动atmsmActivityManagerService = ActivityManagerService.Lifecycle.startService(mSystemServiceManager, atm); // 启动AMSmActivityManagerService.setSystemServiceManager(mSystemServiceManager);mActivityManagerService.setInstaller(installer);mWindowManagerGlobalLock = atm.getGlobalLock();t.traceEnd();// PwerManagert.traceBegin("StartPowerManager");mPowerManagerService = mSystemServiceManager.startService(PowerManagerService.class);t.traceEnd();// 需要reboot是提供recoery服务t.traceBegin("StartRecoverySystemService");mSystemServiceManager.startService(RecoverySystemService.Lifecycle.class);t.traceEnd();// LED服务，灯服务t.traceBegin("StartLightsService");mSystemServiceManager.startService(LightsService.class);t.traceEnd();// Display服务，用于提供display metricst.traceBegin("StartDisplayManager");mDisplayManagerService = mSystemServiceManager.startService(DisplayManagerService.class);t.traceEnd();// PKMSt.traceBegin("StartPackageManagerService");try {Watchdog.getInstance().pauseWatchingCurrentThread("packagemanagermain");mPackageManagerService = PackageManagerService.main(mSystemContext, installer,mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore);} finally {Watchdog.getInstance().resumeWatchingCurrentThread("packagemanagermain");}// User管理t.traceBegin("StartUserManagerService");mSystemServiceManager.startService(UserManagerService.LifeCycle.class);t.traceEnd();// 没有加密，otadexoptif (!mOnlyCore) {boolean disableOtaDexopt = SystemProperties.getBoolean("config.disable_otadexopt",false);if (!disableOtaDexopt) {t.traceBegin("StartOtaDexOptService");try {Watchdog.getInstance().pauseWatchingCurrentThread("moveab");OtaDexoptService.main(mSystemContext, mPackageManagerService);} catch (Throwable e) {reportWtf("starting OtaDexOptService", e);} finally {Watchdog.getInstance().resumeWatchingCurrentThread("moveab");t.traceEnd();}}}// 核心内容，为app进程安排系统进程的以便后期监控t.traceBegin("SetSystemProcess");mActivityManagerService.setSystemProcess();t.traceEnd();t.traceEnd(); // startBootstrapServices}

• 不需要Binder通信的，比如电源服务，可以直接继承SystemService

SystemServiceManager.startService

// SystemServiceManager.javapublic SystemService startService(String className) {// Class.forNamefinal Class<SystemService> serviceClass = loadClassFromLoader(className, this.getClass().getClassLoader());return startService(serviceClass);}public <T extends SystemService> T startService(Class<T> serviceClass) {// 反射构造final String name = serviceClass.getName();final T service;Constructor<T> constructor = serviceClass.getConstructor(Context.class);service = constructor.newInstance(mContext);startService(service);return service;  }private final ArrayList<SystemService> mServices = new ArrayList<SystemService>();public void startService(@NonNull final SystemService service) {
// 1、添加到ArrayList中mServices.add(service);
// 2、执行SystemService接口的onStart()方法long time = SystemClock.elapsedRealtime();try {service.onStart();} catch (RuntimeException ex) {throw new RuntimeException("Failed to start service " + service.getClass().getName()+ ": onStart threw an exception", ex);}warnIfTooLong(SystemClock.elapsedRealtime() - time, service, "onStart");}// xxxService: 如BatteryService.javapublic void onStart() {mBinderService = new BinderService();// 是SystemService接口，发布到ServiceManager中publishBinderService("battery", mBinderService);mBatteryPropertiesRegistrar = new BatteryPropertiesRegistrar();publishBinderService("batteryproperties", mBatteryPropertiesRegistrar);publishLocalService(BatteryManagerInternal.class, new LocalService());}
// ServiceManager.addService()protected final void publishBinderService(String name, IBinder service,boolean allowIsolated, int dumpPriority) {ServiceManager.addService(name, service, allowIsolated, dumpPriority);}

答疑

1、挂载是什么意思？

1. U盘插入，会绑定到一个文件，才能看到

2、先分配进程还是先分配虚拟机？

1. 先分配进程
2. 再分配虚拟机：虚拟机是一段代码，并且实现了内存管理

3、孤儿进程是什么？

1. 父进程先退出
2. 子进程还没有退出
3. 会托孤给init进程（任何一个进程都必须有父进程）

4、僵尸进程

1. 子进程先退出
2. 父进程还没有退出
3. 子进程必须等待父进程捕获子进程的退出状态，子进程会变成僵尸进程（只保留一部分退出信息，等着父进程查询）

5、子进程和父进程的区别

1. 除了文件锁以外，其他锁都会被继承 ========================>mmkv

6、Zygote的native为什么要启动虚拟机？

1. 要跑Java代码就需要JVM
2. 需要做预处理工作，不然都交给App进程去做，太慢了。
3. 所有进程时Zygote fork出来的，因此JVM、预加载的东西都会被fork出来。
4. 如果zygote是多线程的，fork出来的东西没什么用。

7、车载中需要增加一个系统服务帮助其他模块之间通信，需要增加fdbus

1. 增加系统服务
2. 修改init
3. 修改selinux

自我检测

1. nativeZygoteInit是谁调用的？
2. nativeZygoteInit的作用是什么？
3. IPCThreadState的作用是什么？