Android启动流程

Hippo66

已于 2024-09-26 15:03:18 修改

阅读量1k

点赞数 28

文章标签： android

于 2024-09-26 13:50:35 首次发布

本文链接：https://blog.csdn.net/Hippo66/article/details/142553971

版权

流程图

Idle进程

swapper 进程（idle）是通过引导程序加载的 pid 0

kthread

init/main.c--> kernel_init

try_to_run_init_process("/bin/init")

Init进程

init/main.cpp main

调用顺序 FristStageMain-->SetupSelinux-->SecondStageMain

FirstStageMain

1.init crash 时重启引导加载程序这个没有找到地方

2.创建和挂载启动所需的文件目录（mount mkdir /dev/pts /dev/socket）

3.输入输出登重定向到、dev/null

4.初始化 kernel Log

5.启动init 进程 /system/bin/init 启动进程可以参考这个

SetupSelinux

1.主要是用来提高linux的安全，进一步约束访问的权限

2.调用execv开启init进程参数 second_stage

SecondStageMain

2.解析init.rc 文件 /system/core/rootdir/init.rc 在这个里面启动了Zygote-start

Zygote进程

frameworks/base/cmds/app_process/app_main.cpp main() runtime.start("com.android.internal.os.ZygoteInit", args, zygote);@AndroidRuntime --->startVm 先启动Vm然后启动ZygoteInit

-->startReg() 注册JNI方法

-->env-->CallStaticVoidMethod() 使用JNI调用ZygoteInit的main函数进入Java世界

-->ZygoteInit.main()

ZygoteInit.main() 接上面流程

-->preload预加载信息

-->new ZygoteServer() 创建zygote的socket服务

-->r = forkSystemServer() fork 创建systemserver进程

-->r.run() @SystemServer Loop.loop进入无限循环

--> zygoteServer.runSelectLoop() zygote进入无限循环

除了kthread init进程：每个进程都是由zygote复制出来的

zygote 显示copy 只增加不一样的内存

所有的Java进程都是由zygote fork出来的

ZygoteInit

main-->

 zygoteServer = new ZygoteServer(isPrimaryZygote);//详见下面的构造方法
if (startSystemServer) {
            Runnable r = forkSystemServer(abiList, zygoteSocketName, zygoteServer);

            // {@code r == null} in the parent (zygote) process, and {@code r != null} in the
            // child (system_server) process.
            if (r != null) {
                r.run();//会调用到SystemServer.main()里面去
                return;
            }
        }
    Log.i(TAG, "Accepting command socket connections");

    // The select loop returns early in the child process after a fork and
     // loops forever in the zygote.
     caller = zygoteServer.runSelectLoop(abiList);

main-->
-->forkSystemServer r.run();//会调用到SystemServer.main()里面去
--->Zygote.forkSystemServer
--->handleSystemServerProcess
-->ZygoteInit.zygoteInit
-->RuntimeInit.applicationInit
-->findStaticMain
---> m = cl.getMethod("main", new Class[] { String[].class }); //这里通过反射获取到systemServer的main方法对象

ZygoteServer

构造方法

ZygoteServer(boolean isPrimaryZygote) {
    mUsapPoolEventFD = Zygote.getUsapPoolEventFD();

    if (isPrimaryZygote) {
        mZygoteSocket = Zygote.createManagedSocketFromInitSocket(Zygote.PRIMARY_SOCKET_NAME);
        mUsapPoolSocket =
                Zygote.createManagedSocketFromInitSocket(
                        Zygote.USAP_POOL_PRIMARY_SOCKET_NAME);
    } else {
        mZygoteSocket = Zygote.createManagedSocketFromInitSocket(Zygote.SECONDARY_SOCKET_NAME);
        mUsapPoolSocket =
                Zygote.createManagedSocketFromInitSocket(
                        Zygote.USAP_POOL_SECONDARY_SOCKET_NAME);
    }

    mUsapPoolSupported = true;
    fetchUsapPoolPolicyProps();
}

runSlelectLoop 死循环监听connect 监听到

ZygoteConnection connection = peers.get(pollIndex);
final Runnable command = connection.processOneCommand(this);

// TODO (chriswailes): Is this extra check necessary?
if (mIsForkChild) {
    // We're in the child. We should always have a command to run at
    // this stage if processOneCommand hasn't called "exec".
    if (command == null) {
        throw new IllegalStateException("command == null");
    }

    return command;
} else {
    // We're in the server - we should never have any commands to run.
    if (command != null) {
        throw new IllegalStateException("command != null");
    }

    // We don't know whether the remote side of the socket was closed or
    // not until we attempt to read from it from processOneCommand. This
    // shows up as a regular POLLIN event in our regular processing
    // loop.
    if (connection.isClosedByPeer()) {
        connection.closeSocket();
        peers.remove(pollIndex);
        socketFDs.remove(pollIndex);
    }
}

connection.processOneCommand 读 ZygoteProcess 发过来的参数 ZygoteProcess@attemptUsapSendArgsAndGetResult

然后 Zygote.forkAndSpecialize fork一个进程然后启动一个进程

ZygoteConnection@handleChidProc 目的获取binder

-->ZygoteInit.zygoteInit()

-->ZygoteInit.nativeZygoteInit()

- ->AndroidRuntime@com_android_internal_os_ZygoteInit_nativeZygoteInit

- ->app_main.cpp@onZygoteInit

- ->Processstate::self()

-->new ProcessState (kDefaultDriver) const char* kDefaultDriver = "/dev/binder";

获取binder

ProcessState::ProcessState(const char *driver) 下面是mmap代码

Zygote fork一个进程出来必须要获得binder 给systemServer 让systemServer和App通信

-->RuntimeInit.applicationInit

-->findStaticMain 通过反射找到ActivityThread main方法执行

ActivityThread

main

-->thread.attach()

  @UnsupportedAppUsage
    private void attach(boolean system, long startSeq) {
        sCurrentActivityThread = this;
        mSystemThread = system;
        if (!system) {
            android.ddm.DdmHandleAppName.setAppName("<pre-initialized>",
                                                    UserHandle.myUserId());
            RuntimeInit.setApplicationObject(mAppThread.asBinder());
            //获取AMS的本地代理类
            final IActivityManager mgr = ActivityManager.getService();
            try {
                //通过Binder调用AMS的attachApplication方法
                mgr.attachApplication(mAppThread, startSeq);//mAppThread是ApplicationThread 是一个Binder
                                                           //成员变量默认就赋值了
            } catch (RemoteException ex) {
                throw ex.rethrowFromSystemServer();
            }

经过上面的调用到

ActivityManagerService

attachApplication

-->attachApplicationLocked()

-->thread.bindApplication //会调用到ApplicationThread.bindApplication()

-->ApplicationThread.bindApplication()

-->handleBindApplication@ActivityThread

-->mInstrumentation.callApplicationOnCreate(app);//app.onCreate()

-->app.makeActive(thread, mProcessStats);//thread IApplicationThread

-->mProcessList.updateLruProcessLocked

-->mAtmInternal.attachApplicatio

AMS --> ProcessList:ProcessRecord:applicationThread

AMS-->applicationThread-->App

class ProcessRecord{

IApplicationThread thread;

}

SystemServer

systemServer启动了九十多个服务

见/android/SystemServer.mdj

通过SystemServiceManager来管理所有的服务都继承SystemService 使用一套start stop逻辑

Lifecycle 是ActivityTaskManagerService的静态内部类

public static final class Lifecycle extends SystemService 解决java只能单继承的问题最终调用到

main

-->run

ActivityTaskManagerService atm = mSystemServiceManager.startService(
            ActivityTaskManagerService.Lifecycle.class).getService();//启动atms
    mActivityManagerService = ActivityManagerService.Lifecycle.startService(
            mSystemServiceManager, atm);//启动AMS

SystemServiceManager mSystemServiceManager

SystemServiceManager.startService

-->systemService.onStart()

-->调用各自服务的实现

ActivityTaskManagerService.Lifecycle onstart实现

--> publishBinderService(Context.ACTIVITY_TASK_SERVICE, mService);

---> ServiceManager.addService(name, service, allowIsolated, dumpPriority);