Android 初始化流程,从init.c开始
说明: 我已经以word文档的格式将这部分内容上传到我我的资源列表中,感兴趣的朋友可以去下载:
下载地址:http://liranke.download.csdn.net/
Init.c
1.1 Main function
Init is the first process after kernel is started.
1.1.1 Process step:
1. Mount basic file system, and nitialize log system.
2. Parse /init.rc and /init.%hardware%.rc.
3. Execute early-init action in init.rc.
4. Device specific initialize.
5. Initialize property system, and load android image, then print” ANDROID”.
6. Execute init action in init.rc.
7. Start property service.
8. Execute early-boot and boot actions in init.rc.
9. Execute property action in init.rc.
10. Enter into an indefinite loop to wait for device/property set/child process exit events. For example, if an SD card is plugined, init will receive a device add event, so it can make node for the device. Most of the important process is forked in init, so if any of them crashed, init will receive a SIGCHLD then translate it into a child process exit event, so in the loop init can handle the process exit event and execute the commands defined in *.rc(it will run command onrestart).
1.1.2 Start services:
The .rc file is a script file defined by Android. The default is device/system/rootdir/init.rc. We can take a loot at the file format(device/system/init/readme.txt is a good overall introduction of the script). Basically the script file contains actions and services.
Init.rc will run the following services:
console: star a shell. The source is in device/system/bin/sh.
adbd: start adb daemon. The source is in device/tools/adbd. By default is disabled.
servicemanager: start binder system. The source is in device/commands/binder.
mountd: mount all fs defined in /system/etc/mountd.conf if started, receive commands through local socket to mount any fs. The source is in device/system/bin/mountd.
debuggerd: start debug system. The source is in device/system/bin/debuggerd.
rild: start radio interface layer daemon. The source is in device/commands/rild.
zygote: start Android Java Runtime and start system server. It’s the most important service. The source is in device/servers/app.
media: start AudioFlinger, MediaPlayerService and CameraService. The source is in device/commands/mediaserver.
bootsound: play the default boot sound /system/media/audio/ui/boot.mp3. The source is in device/commands/playmp3.
dbus: start dbus daemon, it’s only used by BlueZ. The source is in device/system/Bluetooth/dbus-daemon.
hcid: redirect hcid’s stdout and stderr to the Android logging system. The source is in device/system/bin/logwrapper. By default is disabled.
hfag: start Bluetooth handsfree audio gateway, it’s only used by BlueZ. The source is in device/system/Bluetooth/bluez-utils. By default is disabled.
hsag: start Bluetooth headset audio gateway, it’s only used by BlueZ. The source is in device/system/Bluetooth/bluez-utils. By default is disabled.
installd: start install package daemon. The source is in device/servers/installd.
flash_recovery: load /system/recovery.img. The source is in device/commands/recovery/mtdutils.
1.2 Flow chart:
1.2.1 Flow chart:
1.3 Analyse:
1.3.1 FD:
FD Include :
device _fd, property_set_fd, signal_recv_fd, signal_fd(global value)
ufds: struct pollfd ufds[4] ={ device _fd , property_set_fd , signal_recv_fd , keychord_fd }
1. device_fd
2. property_set_fd
(1)
(2) Property_set_fd C/S chart:
#define PROP_SERVICE_NAME "property_service"
3. signal_recv_fd
signal_recv_fd and signal_fd:
/* create a signalling mechanism for the sigchld handler */
if (socketpair(AF_UNIX, SOCK_STREAM, 0, s) == 0) {
signal_fd = s[0];
signal_recv_fd = s[1];
fcntl(s[0], F_SETFD, FD_CLOEXEC);
fcntl(s[0], F_SETFL, O_NONBLOCK);
fcntl(s[1], F_SETFD, FD_CLOEXEC);
fcntl(s[1], F_SETFL, O_NONBLOCK);
}
……
//read signal
read(signal_recv_fd, tmp, sizeof(tmp);
while (!wait_for_one_process(0)); //阻塞
4. signal_fd( see to signal_recv_fd)
1.4 Data structure
1.5 System status
1.5.1 Process list
USER PID PPID VSIZE RSS WCHAN PC NAME
root 1 0 548 196 c00b8c14 0000d5cc S /init
root 2 0 0 0 c006bf70 00000000 S kthreadd
root 3 2 0 0 c005cc50 00000000 S ksoftirqd/0
root 4 2 0 0 c007e408 00000000 S watchdog/0
root 5 2 0 0 c0068eec 00000000 S events/0
root 6 2 0 0 c0068eec 00000000 S khelper
root 10 2 0 0 c0224f90 00000000 S suspend/0
root 81 2 0 0 c0068eec 00000000 S kblockd/0
root 89 2 0 0 c01f2f7c 00000000 S kseriod
root 111 2 0 0 c0068eec 00000000 S kmmcd
root 117 2 0 0 c0068eec 00000000 S btaddconn
root 118 2 0 0 c0068eec 00000000 S btdelconn
root 135 2 0 0 c00448e0 00000000 S bpmd
root 141 2 0 0 c008b5f4 00000000 S pdflush
root 142 2 0 0 c008b5f4 00000000 S pdflush
root 143 2 0 0 c008f948 00000000 S kswapd0
root 189 2 0 0 c0068eec 00000000 S aio/0
root 195 2 0 0 c01721f0 00000000 S mtdblockd
root 340 2 0 0 c01b4eb0 00000000 S accessory notif
root 349 2 0 0 c0068eec 00000000 S camera_task/0
root 376 2 0 0 c0061438 00000000 S w1_control
root 378 2 0 0 c0061438 00000000 S w1_bus_master1
root 386 2 0 0 c0068eec 00000000 S charge
root 428 2 0 0 c02ca26c 00000000 S krfcommd
root 430 2 0 0 c0068eec 00000000 S rpciod/0
root 724 2 0 0 c0216908 00000000 S mmcqd
root 726 1 772 180 c019dbc4 afe0c1dc S /system/bin/sh
system 727 1 840 188 c022d8a0 afe0c47c S /system/bin/servicemanager
root 729 1 1920 336 ffffffff afe0c1dc S /system/bin/mountd
root 730 1 704 176 c0257854 afe0ce0c S /system/bin/debuggerd
root 731 1 4132 628 c027e2f8 afe0ce0c S /opl/bin/tcmd
root 732 1 852 248 c00b92b0 afe0c5a4 S /opl/bin/adapter
radio 733 1 12796 648 ffffffff beaab18c S /system/bin/rild
root 734 1 72000 14172 c00b92b0 afe0c5a4 S zygote
root 735 1 33848 4512 ffffffff afe0c47c S /system/bin/mediaserver
root 736 1 1080 216 c00b8c14 bedc021c S /system/bin/dbus-daemon
root 737 1 832 208 c02b6e80 afe0c1dc S /system/bin/installd
root 740 1 856 260 c00b92b0 afe0c5a4 S /opl/bin/bpd
root 741 1 828 172 c00b8c14 afe0d27c S /opl/bin/battmond
root 768 1 720 272 c02265ec afe0c1dc S /system/bin/logcat
root 769 1 716 264 c02265ec afe0c1dc S /system/bin/logcat
root 816 2 0 0 c0068eec 00000000 S battery.0
system 825 734 574128 28360 ffffffff afe0c47c S system_server
radio 877 734 158260 20040 ffffffff afe0d404 S com.android.phone
app_5 879 734 100888 13616 ffffffff afe0d404 S android.process.acore
system 882 734 144664 24296 ffffffff afe0d404 S android.process.omsservice
app_45 884 734 92304 10932 ffffffff afe0d404 S com.motorola.motohome
app_22 890 734 117068 30228 ffffffff afe0d404 S oms.home
app_3 918 734 98760 12652 ffffffff afe0d404 S oms.widgetmanager
app_5 928 734 100888 13336 ffffffff afe0d404 S com.android.inputmethod.borqs
app_24 930 734 105176 19168 ffffffff afe0d404 S com.db4o.servo.search
app_18 960 734 104180 15208 ffffffff afe0d404 S com.android.mms
app_8 979 734 118860 14044 ffffffff afe0d404 S android.process.media
app_9 991 734 91980 12264 ffffffff afe0d404 S com.android.alarmclock
app_15 998 734 103144 12908 ffffffff afe0d404 S oms.dcd
system 1018 734 94732 13792 ffffffff afe0d404 S oms.dm
app_14 1025 734 95636 13036 ffffffff afe0d404 S com.android.calendar
app_42 1041 734 93292 11316 ffffffff afe0d404 S com.motorola.smsautoreg
app_40 1090 734 97152 15192 ffffffff afe0d404 S com.motorola.mtc
app_38 1102 734 93832 12868 ffffffff afe0d404 S com.streamezzo.browser.android
app_26 1115 734 96596 15084 ffffffff afe0d404 S oms.mediacenter
app_37 1126 734 98208 15212 ffffffff afe0d404 S com.hyfsoft.docviewer
app_20 1146 734 99260 15320 ffffffff afe0d404 S com.android.music
app_47 1157 734 100204 15964 ffffffff afe0d404 S com.motorola.camera
app_11 1183 734 122672 23576 ffffffff afe0d404 S com.android.browser
app_6 1199 734 117032 20388 ffffffff afe0d404 S oms.mobilemusic
system 1244 734 99292 15940 ffffffff afe0d404 S com.android.settings
app_23 1311 734 96932 16004 ffffffff afe0d404 S oms.bru
root 1334 2 0 0 c0216908 00000000 S mmcqd
app_8 1351 734 100308 15876 ffffffff afe0d404 S com.android.camera
app_1 1424 734 111904 17024 ffffffff afe0d404 S oms.messaging
app_4 1436 734 101172 15504 ffffffff afe0d404 S oms.mail
app_2 1484 734 100716 18128 ffffffff afe0d404 S com.ms
app_16 1663 734 101024 16748 ffffffff afe0d404 S oms.android.filemanager
root 1684 1 3364 176 ffffffff 0000e8f4 S /sbin/adbd
root 1692 1684 776 348 c0059cd4 afe0d0ac S /system/bin/sh
root 1724 1692 920 356 00000000 afe0c1dc R ps
从真正的应用层的角度来看,所有的应用程序(如settings,media……)的父进程都是zygote. 因为任何一个应用都是一个VM。
2 Adbd
Default is disable.
3 Servicemanager
3.1 Introcuce
3.2 Flow chart
3.3 Analyse
3.4 Data structure
3.5 Questions
1. 从进程的角度来看,在zygote_run_oneshot中创建的pid是servicemanager的子进程。
2. 在zygote_run_oneshot中,socket_local_client对ZYGOTE_SOCKET("zygote")进行了connect.
随后,又调用了pid = send_request(fd, 0, newargc, newargv);创建了一个pid,,而且,在这个函数中,进行了数据的发送与接收
3. 在run中,也进行了很多操作,主要是进行了pthread的创建。
4 Mountd
4.1 Introduce
4.2 Chart
1. flow:
Mountd.c:
ReadConfigFile("/system/etc/mountd.conf");
StartAutoMounter(); //在这里,调用了MountDevices和pthread_create.
return RunServer();
RunServer function:
Step1: get socket "mountd" à
Step2: listen
Step3: 阻塞, as below:
while (1)
{
Accept
Read
}
典型的server, 那么,client就是各个设备驱动.
4.3 Analyse
4.4 Other
5 Debuggerd
5.1 Introduce
5.2 Chart
这里,既有client,也有server。
5.3 Analyse
5.4 Other
6 Rild
6.1 Introduce
6.2 Chart
6.2.1 RIL Architecture:
6.2.2 RIL Flow:
6.3 Analyse
Refernce telephony.rar doc
7 Zygote
7.1 Introduce
It is the first Dalvik VM
7.2 Chart
7.3 Analyse
7.3.1 Introduce
1. from network
Zygote service does the following tasks step by step:
1. Create JAVA VM
2. Register android native function for JAVA VM.
3. Call the main function in the JAVA class named
com.android.internal.os.ZygoteInit whose source is device/java/android/com/android/internal/os/ZygoteInit.java.
a) Load ZygoteInit class
b) Register zygote socket
c) Load preload classes(the default file is device/java/android/preloaded-classes)
d) Load preload resources
e) Call Zygote::forkSystemServer (implemented in device/dalvik/vm/InternalNative.c) to fork a new process. In the new process, call the main function in the JAVA class named com.android.server.SystemServer, whose source is in device/java/services/com/android/server.
i. Load libandroid_servers.so
ii. Call JNI native init1 function implemented in device/libs/android_servers/com_android_server_SystemServers. It only calls system_init implemented in device/servers/system/library/system_init.cpp.
. If running on simulator, instantiate AudioFlinger, MediaPlayerService and CameraService here.
. Call init2 function in JAVA class named com.android.server.SystemServer, whose source is in device/java/services/com/android/server. This function is very critical for Android because it start all of Android JAVA services.
. If not running on simulator, call IPCThreadState::self()->joinThreadPool() to enter into service dispatcher.
2. from qcom
Zygote daemon(first Dalvik VM)
Starts rutime process
Starts service manager – lookup service for binder.
Sends command to Zyhgote to start system server.
System server.
System server starts up surface flinger, audio flinger, which registers with the service manager.
Starts up all core services, which also registers with the service manger via a java proxy(how to do?)
Activity manager sends a command to Zygote to start home process with its own dalvik VM.
Home task may start other applications, which run in their own VM.
3. SP(smart pointer)
用到了智能指针。
7.3.2 startSystemServer
1. 由于前面的servicemanager(runtime)已经初始化,所以,这里的zygoteinit可以是java代码。
2. registerZygoteSocket创建的socket名为“ANDROID_SOCKET_zygote”,从创建过程不难看出,这是一个server;
3. preloadClasses():正如注释中所说的一样,“Performs Zygote process initialization. Loads and initializes commonly used classes”;有log信息,通过调用Log.i(TAG, "Preloading classes..."); load count and used time: preloaded 1166 classes in 8951ms; 另外,有哪些资源被load了,共有48+15个。
4. dalvik+lib = runtime;
5. startSystemServer:” Prepare the arguments and fork for the system server process”
pid = Zygote.forkSystemServer /* Request to fork the system server process */
另外,从ps中也可以看出,Zygote 是system_server的父进程。
root 734 1 72000 14172 c00b92b0 afe0c5a4 S zygote
system 825 734 574128 28360 ffffffff afe0c47c S system_server
7.3.3 runSelectLoopMode
通过调用peers.get(index).runOnce();来创建 一个pid.这个Pid 是Zygote的一个子进程。
System_server:
1. 从log 也可以看出,调用init1,而它通过runtime又调用init2,而init2 又通过create thread的方式启动。
2. 调用完Looper.prepare()之后,就开始了Critical services 的创建了,可以从代码和log中清楚地看到这些。
3. 可以这样理解,zygote创建了一个进程system_server,而在这个进程中,做了如下工作:
创建线程,run()的时候,又new 了很多java Critical services.而这些servoces,都是独立的线程,它们的父进程都是Zygote.
8 Media
9 Bootsound
10 Dbus
11 Installd
11.1 Chart
11.2 Analyse
典型的server.
12 Note
1. 这份文档只是从代码调用的顺序过程来看一下启动的流程,仅仅是流程而已, 其并没介绍各个进程间如何通信,以及应用是如何与系统交互的。其中,很多东西都还是没有理解,仅仅是将其列出来而已。
2.整个启动过程中,运用了大量的系统调用函数,特别是socket(广义的,并不只限于网络)和文件操作,这也体现了linux中文件为核心的思想。大家可以参考《linux编程白皮书》和《Unix环境高级编程》来进一步深入理解和运用这些系统调用函数。
3.附带一份启动的log(从模拟环境保存下来的)“log_init.txt”,供参考。
4.用Java 调用C/C++的JNI接口的运用。
5.要分清所在的应用什么时候是运行在用户态,具体在用户态的哪一层?什么时候是运行在核心态?
13 Reference
ps.txt
meminfo.txt
log_init.txt