Android系统启动流程简介
一、启动init进程
Linux下有三个特殊的进程idle进程（PID=0），init进程（PID=1），和kthreadd（PID=2）
idle进程由系统自动创建，运行在内核态,dle进程其pid=0，其前身是系统创建的第一个进程
kthreadd进程由idle通过kernel_thread创建，并始终运行在内核空间，负责所有内核进程的调度和管理
init进程由idle通过kernel_thread创建，在内核空间完成初始化后，加载init程序,
init进程，它是Linux内核启动的第一个用户级进程,Linux中的所有进程都是由init进程创建并运行的。
从如下进程列表可知，system_server（466）进程 及其他应用父进程都是zygote64（331）进程
lilei@lilei-HP-Z4-G4-Workstation:~$ adb shell
northstar:/ $ ps -A
USER PID PPID VSZ RSS WCHAN ADDR S NAME
root 1 0 12399880 11948 0 0 S init
root 2 0 0 0 0 0 S [kthreadd]
...
system 313 1 12678172 52968 do_epoll_+ 0 S surfaceflinger
root 331 1 15686436 169388 0 0 S zygote64
cameraserver 492 1 12452708 17892 binder_th+ 0 S android.hardware.camera.provider@2.4-service_64
cameraserver 873 1 52012 21824 binder_th+ 0 S cameraserver
media 896 1 78160 20468 binder_th+ 0 S mediaserver
system 466 331 18165676 292516 0 0 S system_server
u0_a67 5234 331 15923068 124940 0 0 S com.android.demo.lileidemo
1.kernel 初始化 会做硬件驱动初始化相关的基础工作，创建 1 号init进程，然后启动init进程。
/kernel/init/main.c
static int __ref kernel_init(void *unused)
{
...
kernel_init_freeable();//ramdisk_execute_command = "/init";
rest_init();
}
static noinline void __init_refok rest_init(void)
{
...
kernel_thread(kernel_init, NULL, CLONE_FS); 创建 1 号init进程
}
static int __ref kernel_init(void *unused)
{
...
run_init_process(ramdisk_execute_command)//启动运行init进程
}2.init进程流程
进程名称：init ，对应可执行程序 /init
/system/core/init/init.cpp
2.1.main 函数主要 创建各种目录以及挂载文件系统,
2.2.创建属性服务，属性服务是利用 mmap 实现共享内存实现的,并启动属性服务，
Android 将属性的设置统一交由 init 进程管理，其他进程不能直接修改属性，而只能通知 init 进程来修改。
2.3.解析init.rc
源码路径：/system/core/rootdir/init.rc
import /init.${ro.zygote}.rc
...
on nonencrypted
class_start main
class_start late_startinit.rc文件定义了一系列要被创建的目录，启动zygote进程， adbd、ueventd 进程等
例如/system/core/rootdir/init.zygote32.rc
service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
class main
...zygote进程创建主要有两步
涉及源码文件 system/core/init/service.cpp
步骤一 通过ServiceParser解析 Service 类型语句，ServiceParser 的实现代码在 service.cpp中。
ServiceParser::ParseSection 解析service 命令 创建Service对象并添加到 Service 链表中。
步骤二 init进程解析init.rc 执行 class_start main 命令启动 class名称 为 main 的 Service，zygote 的class名称 就是 main，即会调用zygote 的Service对象的Service::Start(),
该方法调用pid = fork() 创建进程，如果返回值pid为0 则 创建进程成功且在zygote子进程中返回，
最后在zygote子进程中调用 execv(c_strings[0], c_strings.data()) 执行app_main.cpp代码。
即init进程会先 fork 一个命名为 zygote 的进程，然后在该进程中执行/system/bin/app_process程序，并且带上参数--zygote -- start-system-server
app_process进程源码位于 frameworks/base/cmds/app_process/app_main.cpp
service zygote 对应ps 中的NAME列，
socket zygote stream 660 root system
socket是为zygote进程创建一个名称为"zygote"的socket资源，在系统启动后，我们可以在/dev/socket目录下发现一个名为“zygote”的文件
user root 对应ps 中的USER列
2.4.解析其他rc文件
解析 /system/etc/init 、/vendor/etc/init、/odm/etc/init目录中的rc文件
启动 surfaceflinger、mediaserver、cameraserver等系统核心服务
/system/etc/init 包含系统核心服务的定义，如SurfaceFlinger、MediaServer、Logcatd等。
/vendor/etc/init SOC厂商针对SOC核心功能定义的一些服务。比如高通、MTK某一款SOC的相关的服务。
/odm/etc/init OEM/ODM厂商如小米、华为、TCL其产品所使用的外设以及差异化功能相关的服务。
Android提供一个编译宏LOCAL_INIT_RC 将RC文件编译到 system/etc/init/,init_rc将RC文件编译到vendor/etc/init/。
例如surfaceflinger、mediaserver、cameraserver等：
/frameworks/native/services/surfaceflinger/Android.mk
LOCAL_INIT_RC := surfaceflinger.rc
编译时 将surfaceflinger.rc拷贝到/system/etc/init目录中，
/frameworks/av/media/mediaserver/Android.mk
LOCAL_INIT_RC := mediaserver.rc
/frameworks/av/camera/cameraserver/Android.mk
LOCAL_INIT_RC := cameraserver.rc
hardware/interfaces/camera/provider/2.4/default/Android.bp
init_rc: ["android.hardware.camera.provider@2.4-service.rc"],
2.5 启动 surfaceflinger 服务 简介
进程名称：surfaceflinger 对应的可执行程序： system/bin/surfaceflingerSurfaceFlinger::init 初始化完成后调用 roperty_set("ctl.start", "bootanim")启动bootanim service，开启开机动画，
SurfaceFlinger::bootFinished 调用property_set("service.bootanim.exit", "1")退出开机动画，其中bootFinished是被ams启动完成后调用的后面在分析
frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
void SurfaceFlinger::init() {
...
//初始化完成后调用
if (getHwComposer().hasCapability(
HWC2::Capability::PresentFenceIsNotReliable)) {
mStartPropertySetThread = new StartPropertySetThread(false);
} else {
mStartPropertySetThread = new StartPropertySetThread(true);
}
if (mStartPropertySetThread->Start() != NO_ERROR) {
ALOGE("Run StartPropertySetThread failed!");
}
}
void SurfaceFlinger::bootFinished()
{
...
//退出开机动画
property_set("service.bootanim.exit", "1");
}
frameworks/native/services/surfaceflinger/StartPropertySetThread.cpp
status_t StartPropertySetThread::Start() {
return run("SurfaceFlinger::StartPropertySetThread", PRIORITY_NORMAL);
}
bool StartPropertySetThread::threadLoop() {
// Set property service.sf.present_timestamp, consumer need check its readiness
property_set(kTimestampProperty, mTimestampPropertyValue ? "1" : "0");
// Clear BootAnimation exit flag
property_set("service.bootanim.exit", "0");//设置service.bootanim.exit 为0，该属性值决定开机动画是否退出
// Start BootAnimation if not started
property_set("ctl.start", "bootanim"); //启动bootanim service
// Exit immediately
return false;
}system/core/init/init.cpp
int main(int argc, char** argv) {
...
property_init();
// Set up SELinux, loading the SELinux policy.
selinux_initialize(true); //属性服务的初始化
start_property_service();//启动属性服务
Parser& parser = Parser::GetInstance();
parser.AddSectionParser("service", std::make_unique<ServiceParser>(&sm));
parser.ParseConfig("/init.rc");
parser.set_is_system_etc_init_loaded(
parser.ParseConfig("/system/etc/init"));
parser.set_is_vendor_etc_init_loaded(
parser.ParseConfig("/vendor/etc/init"));
parser.set_is_odm_etc_init_loaded(parser.ParseConfig("/odm/etc/init"));
while (true) {
// 使用epoll机制 + 死循环，使init进程一直运行，类似Looper#loop()
// 默认一直阻塞，直到有事情需要做被唤醒
int epoll_timeout_ms = -1;
if (...) {
am.ExecuteOneCommand();
// 一些赋值逻辑，可能是0
epoll_timeout_ms = ...;
}
// 调用epoll_wait使init进程沉睡或者...
epoll_wait(epoll_fd, &ev, 1, epoll_timeout_ms)；
}
...
}/system/core/rootdir/init.rc
...
import /init.${ro.zygote}.rc
on post-fs-data
mkdir /data/misc/cameraserver 0700 cameraserver cameraserver
.../system/core/rootdir/init.zygote32.rc
service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
class main
priority -20
user root
group root readproc
socket zygote stream 660 root system
onrestart write /sys/android_power/request_state wake
onrestart write /sys/power/state on
onrestart restart audioserver
onrestart restart cameraserver
onrestart restart media
onrestart restart netd
onrestart restart wificond
writepid /dev/cpuset/foreground/tasks二、启动zygote进程
进程名称：zygote ，对应可执行程序 /system/bin/app_process
1.app_main.cpp 的main方法 解析启动zygote进程传递参数 (init.rc中设置)，开机处理--zygote 和-start-system-server
设置zygote为true，startSystemServer为true
AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv)); AppRuntime 继承 AndroidRuntime，
runtime是AndroidRuntime实例化对象
runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
调用AndroidRuntime::start方法，该方法主要执行如下3步：
1.1是调用函数startVM启动虚拟机，
1.2是调用函数startReg 注册Android的JNI方法，
1.3 通过反射调用了 com.android.internal.os.ZygoteInit java类的main方法。
frameworks/base/cmds/app_process/app_main.cpp
int main(int argc, char* const argv[])
{
AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));
//解析启动zygote进程传递参数，开机处理--zygote 和-start-system-server
设置zygote为true，startSystemServer为true，
while (i < argc) {
const char* arg = argv[i++];
if (strcmp(arg, "--zygote") == 0) {
zygote = true;
niceName = ZYGOTE_NICE_NAME;
} else if (strcmp(arg, "--start-system-server") == 0) {
startSystemServer = true;
} else if (strcmp(arg, "--application") == 0) {
application = true;
} else if (strncmp(arg, "--nice-name=", 12) == 0) {
niceName.setTo(arg + 12);
} else if (strncmp(arg, "--", 2) != 0) {
className.setTo(arg);
break;
} else {
--i;
break;
}
}
Vector<String8> args;
if (startSystemServer) {
args.add(String8("start-system-server"));
}
if (zygote) {
runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
} else if (className) {
runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
}
}frameworks/base/core/jni/AndroidRuntime.cpp
void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
{
...
/* start the virtual machine */
JniInvocation jni_invocation;
jni_invocation.Init(NULL);
JNIEnv* env;
if (startVm(&mJavaVM, &env, zygote) != 0) {
return;
}
startReg(env);
char* slashClassName = toSlashClassName(className);
jclass startClass = env->FindClass(slashClassName);
jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
"([Ljava/lang/String;)V");
//将options参数赋值到strArray传递给ZygoteInit.java
env->CallStaticVoidMethod(startClass, startMeth, strArray);
}2.ZygoteInit.java的main方法主要执行如下4步：
2.1创建一个名为zygote的 Socket 资源
zygoteServer.registerServerSocket(socketName)
2.2 加载framework类和资源文件
preload(bootTimingsTraceLog)
2.3 创建system_server进程，并执行SystemServer.java的main方法
Zygote.forkSystemServer
2.4 创建一个无限循环，在前面创建的socket接口上等待ActivityManagerService请求创建新的应用程序进程
zygoteServer.runSelectLoop(abiList)
流程如下：
zygoteServer的runSelectLoop方法 循环等待ams的socket请求，
收到请求后调用ZygoteConnection.processOneCommand(this)
调用 Zygote.forkAndSpecialize 通过native方法fork出进程。frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
public static void main(String argv[]) {
...
boolean startSystemServer = false;
String socketName = "zygote";
for (int i = 1; i < argv.length; i++) {
if ("start-system-server".equals(argv[i])) {
startSystemServer = true;
}
...
}
zygoteServer.registerServerSocket(socketName);//创建一个名为 ANDROID_SOCKET_zygote 的 Socket 资源，赋值给变量 mServerSocket
preload(bootTimingsTraceLog);//加载framework类和资源文件
if (startSystemServer) {
//system_server
Runnable r = forkSystemServer(abiList, socketName, zygoteServer);
}
//进入一个无限循环在前面创建的zygote socket接口上等待ActivityManagerService请求创建新的应用程序进程
caller = zygoteServer.runSelectLoop(abiList);
}
private static Runnable forkSystemServer(String abiList, String socketName,
ZygoteServer zygoteServer) {
String args[] = {
"--setuid=1000",
"--setgid=1000",
"--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1023,1032,3001,3002,3003,3006,3007,3009,3010",
"--capabilities=" + capabilities + "," + capabilities,
"--nice-name=system_server", // 指定进程名字 system_server
"--runtime-args",
"com.android.server.SystemServer", // 指定进程fork后要执行的程序
};
ZygoteConnection.Arguments parsedArgs = null;
parsedArgs = new ZygoteConnection.Arguments(args);
ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);
/* Request to fork the system server process */
//创建system_server进程
pid = Zygote.forkSystemServer(
parsedArgs.uid, parsedArgs.gid,
parsedArgs.gids,
parsedArgs.debugFlags,
null,
parsedArgs.permittedCapabilities,
parsedArgs.effectiveCapabilities);
}frameworks/base/core/java/com/android/internal/os/ZygoteServer.java
class ZygoteServer {
/**
* Set by the child process, immediately after a call to {@code Zygote.forkAndSpecialize}.
*/
private boolean mIsForkChild;
void setForkChild() {
mIsForkChild = true;
}
/**
* Runs the zygote process's select loop. Accepts new connections as
* they happen, and reads commands from connections one spawn-request's
* worth at a time.
*/
Runnable runSelectLoop(String abiList) {
ArrayList<FileDescriptor> socketFDs = new ArrayList<>();
ArrayList<ZygoteConnection> peers = new ArrayList<>();
fds.add(mServerSocket.getFileDescriptor());
peers.add(null);
while (true) {
StructPollfd[] pollFds = new StructPollfd[fds.size()];
//第一次进来 fds.size()为1
for (int i = 0; i < pollFds.length; ++i) {
pollFds[i] = new StructPollfd();
pollFds[i].fd = fds.get(i);
pollFds[i].events = (short) POLLIN;
}
try {
Os.poll(pollFds, -1);
} catch (ErrnoException ex) {
throw new RuntimeException("poll failed", ex);
}
for (int i = pollFds.length - 1; i >= 0; --i) {
if ((pollFds[i].revents & POLLIN) == 0) {
continue;
}
if (i == 0) {
ZygoteConnection newPeer = acceptCommandPeer(abiList);
peers.add(newPeer);
//如果i为0 即只有 ANDROID_SOCKET_zygote，则fds添加一个，进入循环等待。
fds.add(newPeer.getFileDesciptor());
} else {
try {
ZygoteConnection connection = peers.get(i);
// 如果有新的socket请求 processOneCommand方法中会分裂出子进程。
// 子进程会调用setForkChild将mIsForkChild设置为true
final Runnable command = connection.processOneCommand(this);
if (mIsForkChild) {
// We're in the child. We should always have a command to run at this
// stage if processOneCommand hasn't called "exec".
if (command == null) {
throw new IllegalStateException("command == null");
}
return command;
} else {
// We're in the server - we should never have any commands to run.
if (command != null) {
throw new IllegalStateException("command != null");
}
if (connection.isClosedByPeer()) {
//处理完新请求之后，则fds删除这个请求。
connection.closeSocket();
peers.remove(i);
fds.remove(i);
}
}
}
}
}
}
}
}frameworks/base/core/java/com/android/internal/os/ZygoteConnection.java
class ZygoteConnection {
/**
* 返回一个Runnable，内容为fork子进程。
* zygote进程此处返回的pid为子进程pid，该方法返回值为null
* 子进程，返回的pid为0，该方法返回handleChildProc方法的返回值
*/
Runnable processOneCommand(ZygoteServer zygoteServer) {
// 读取传给Zygote进程的参数列表
String[] args = Zygote.readArgumentList(mSocketReader);
ZygoteArguments parsedArgs = new ZygoteArguments(args);
// 通过native方法fork出进程。
// zygote进程的pid为子进程的pid。
// fork出的子进程的pid为0
int pid = Zygote.forkAndSpecialize(parsedArgs.mUid, parsedArgs.mGid, parsedArgs.mGids,
parsedArgs.mRuntimeFlags, rlimits, parsedArgs.mMountExternal, parsedArgs.mSeInfo,
parsedArgs.mNiceName, fdsToClose, fdsToIgnore, parsedArgs.mStartChildZygote,
parsedArgs.mInstructionSet, parsedArgs.mAppDataDir, parsedArgs.mIsTopApp,
parsedArgs.mPkgDataInfoList, parsedArgs.mWhitelistedDataInfoList,
parsedArgs.mBindMountAppDataDirs, parsedArgs.mBindMountAppStorageDirs);
try {
if (pid == 0) {
// 子进程中的ZygoteServer的mIsForkChild设置为true
zygoteServer.setForkChild();
// 子进程关闭socket
zygoteServer.closeServerSocket();
// 处理子进程，内部会通过反射调用ActivityThread的main方法
return handleChildProc(parsedArgs, childPipeFd, parsedArgs.mStartChildZygote);
} else {
return null;
}
}
}
// 处理子进程
private Runnable handleChildProc(ZygoteArguments parsedArgs,
FileDescriptor pipeFd, boolean isZygote) {
// 设置进程名称
Zygote.setAppProcessName(parsedArgs, TAG);
// 这里会通过反射，调用ActivityThread的main方法
return ZygoteInit.childZygoteInit(parsedArgs.mTargetSdkVersion,
parsedArgs.mRemainingArgs, null /* classLoader */);
}
}三、启动 SystemServer
进程名称：system_server
编译生成： system/framework/services.jar 和 system/lib/libandroid_servers.so
源码路径：frameworks/base/services/Android.mk
1.初始化一些零碎事务
2.createSystemContext 创建ActivityThread对象，,初始化 system_server 进程的context
3.startBootstrapServices 启动系统Boot级别服务，包括引导服务 AMS.PMS等
4.startCoreServices启动系统级别核心服务
5.startOtherServices启动其它类型服务，主要是厂家可以根据实际情况配置的服务
最后操作是调用ActivityManagerService.systemReady，最后进入PHASE_BOOT_COMPLETED阶段
命令查看system_server 进程中的所有线程：
可知AMS（ActivityManager）.PMS（PowerManagerSer）,WMS（android.display）都是system_server进程中的线程
命令如下：
msmnile_gvmq:/ $ ps -A | grep system_server
system 466 331 18283044 295768 0 0 S system_server
msmnile_gvmq:/ $ ps -Ao USER,PID,PPID,CMD -T 466
USER PID PPID CMD
system 466 331 Binder:466_3
system 466 331 Signal Catcher
system 466 331 perfetto_hprof_
system 466 331 ADB-JDWP Connec
system 466 331 Jit thread pool
system 466 331 HeapTaskDaemon
system 466 331 ReferenceQueueD
system 466 331 FinalizerDaemon
system 466 331 FinalizerWatchd
system 466 331 Binder:466_1
system 466 331 Binder:466_2
system 466 331 SystemServerBol
system 466 331 system_server
system 466 331 android.fg
system 466 331 android.ui
system 466 331 android.io
system 466 331 android.display
system 466 331 android.anim
system 466 331 android.anim.lf
system 466 331 watchdog
system 466 331 android.bg
system 466 331 ActivityManager
system 466 331 ActivityManager
system 466 331 ActivityManager
system 466 331 ActivityManager
system 466 331 Thread-2
system 466 331 OomAdjuster
system 466 331 batterystats-wo
system 466 331 FileObserver
system 466 331 CpuTracker
system 466 331 Thread-4
system 466 331 Thread-5
system 466 331 Thread-3
system 466 331 PowerManagerSer
system 466 331 HwBinder:466_1
system 466 331 BatteryStats_wa
system 466 331 PackageManager
system 466 331 appsFilter
system 466 331 PackageManager
system 466 331 PackageInstalle
system 466 331 HealthServiceHw
system 466 331 SensorEventAckR
system 466 331 SensorService
system 466 331 RollbackPackage
system 466 331 RollbackManager
system 466 331 AccountManagerS
system 466 331 SettingsProvide
system 466 331 AlarmManager
system 466 331 InputDispatcher
system 466 331 InputReader
system 466 331 AppIntegrityMan
system 466 331 NetworkWatchlis
system 466 331 StorageManagerS
system 466 331 LockSettingsSer
system 466 331 NetworkStats
system 466 331 NetworkPolicy
system 466 331 tworkPolicy.uid
system 466 331 AsyncChannelHan
system 466 331 WifiHandlerThre
system 466 331 WifiP2pService
system 466 331 PasspointProvis
system 466 331 WifiScanningSer
system 466 331 ConnectivitySer
system 466 331 roid.pacmanager
system 466 331 NsdService
system 466 331 mDnsConnector
system 466 331 ranker
system 466 331 onProviders.ECP
system 466 331 DeviceStorageMo
system 466 331 AS.SfxWorker
system 466 331 AudioService
system 466 331 Binder:466_4
system 466 331 AudioDeviceBrok
system 466 331 HwBinder:466_2
system 466 331 HwBinder:466_3
system 466 331 UEventObserver
system 466 331 ConnectivityThr
system 466 331 HwBinder:466_4
system 466 331 GraphicsStats-d
system 466 331 BlobStore
system 466 331 SessionRecordTh
system 466 331 CameraService_p
system 466 331 SliceManagerSer
system 466 331 StatsCompanionS
system 466 331 EthernetService
system 466 331 TaskSnapshotPer
system 466 331 WifiManagerThre
system 466 331 HealthServiceHw
system 466 331 Binder:466_5
system 466 331 PhotonicModulat
system 466 331 SyncHandler-0
system 466 331 SyncManager
system 466 331 UsbService host
system 466 331 Thread-8
system 466 331 AsyncTask #1
system 466 331 HwBinder:466_5
system 466 331 NetworkStatsObs
system 466 331 EmergencyAfford
system 466 331 NetworkTimeUpda
system 466 331 LazyTaskWriterT
system 466 331 StorageUserConn
system 466 331 pool-6-thread-1
system 466 331 Binder:466_6
system 466 331 Binder:466_7
system 466 331 Binder:466_8
system 466 331 Binder:466_9
system 466 331 BluetoothRouteM
system 466 331 AudioPortEventH
system 466 331 uteStateMachine
system 466 331 CallAudioModeSt
system 466 331 ConnectionSvrFo
system 466 331 NDK MediaCodec_
system 466 331 queued-work-loo
system 466 331 Timer-0
system 466 331 Binder:466_A
system 466 331 Binder:466_B
system 466 331 AdbDebuggingMan
system 466 331 Binder:466_C
system 466 331 Binder:466_D
system 466 331 Binder:466_E
system 466 331 Binder:466_F
system 466 331 Binder:466_10
system 466 331 Binder:466_11
system 466 331 Binder:466_12
system 466 331 Binder:466_13
system 466 331 Binder:466_14
system 466 331 Binder:466_15
system 466 331 Binder:466_16
system 466 331 Binder:466_17
system 466 331 Binder:466_18
system 466 331 Binder:466_19
system 466 331 Binder:466_1A
system 466 331 Binder:466_1B
system 466 331 Binder:466_1C
system 466 331 Binder:466_1D
system 466 331 Binder:466_1E
system 466 331 RedirectListene
system 466 331 OsuServerHandle
system 466 331 SyncHandler-1
system 466 331 AsyncQueryWorke
system 466 331 AudioTrack
system 466 331 RenderThreadframeworks/base/services/java/com/android/server/SystemServer.java
public final class SystemServer {
/**
* The main entry point from zygote.zygote调用SystemServer主入口
*/
public static void main(String[] args) {
new SystemServer().run();
}
private void run() {
//初始化一些零碎事务
..
// Here we go!
Slog.i(TAG, "Entered the Android system server!");
Looper.prepareMainLooper();//创建主程序Looper
// Initialize native services. 这个android_servers 是frameworks/base/services/编译的
System.loadLibrary("android_servers");
// Check whether we failed to shut down last time we tried.
// This call may not return.
//读取系统属性SHUTDOWN_ACTION_PROPERTY 判断是否需要关机或重启，如果需要则重启机器
performPendingShutdown();
// Initialize the system context.调用ActivityThread.systemMain() 创建ActivityThread对象,调用ActivityThread 类接口new ContextImpl创建ContextImpl对象
createSystemContext();
// Create the system service manager.创建SystemServiceManager 会对系统服务进行创建、启动、和生命周期管理
mSystemServiceManager = new SystemServiceManager(mSystemContext);
mSystemServiceManager.setRuntimeRestarted(mRuntimeRestart);
LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
traceBeginAndSlog("StartServices");
//引导服务 AMS.PMS等
startBootstrapServices();
startCoreServices();
startOtherServices();
SystemServerInitThreadPool.shutdown();
// Loop forever. 进入无限循环
Looper.loop(); //遍历MessageQueue
}
private void startBootstrapServices() {
//解析一些系统配置信息,将解析的结果赋值给SystemConfig里的各个数据结构，供我们查询
final String TAG_SYSTEM_CONFIG = "ReadingSystemConfig";
SystemServerInitThreadPool.get().submit(SystemConfig::getInstance, TAG_SYSTEM_CONFIG);
//系统安装APK时的一个服务类,installd 进程具有 CAP_DAC_OVERRIDE 特权（Privilege）可以访问任何目录，
//pms 没有访问应用程序目录的权限，需要委托给 installd 处理，Installer与 installd 的连接通讯
Installer installer = mSystemServiceManager.startService(Installer.class);
// 在某些情况下，启动应用程序后，我们需要访问设备标识符，因此在活动管理器之前注册设备标识符策略服务
mSystemServiceManager.startService(DeviceIdentifiersPolicyService.class);
// 启动AMS
mActivityManagerService = mSystemServiceManager.startService(
ActivityManagerService.Lifecycle.class).getService();
mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
mActivityManagerService.setInstaller(installer);
// 启动电源管理服务
mPowerManagerService = mSystemServiceManager.startService(PowerManagerService.class);
//PowerManagerService已经启动，将其传入AMS
mActivityManagerService.initPowerManagement();
//启动恢复出厂设置服务
mSystemServiceManager.startService(RecoverySystemService.class);
//启动灯光管理服务
mSystemServiceManager.startService(LightsService.class);
//启动显示管理服务，该服务需要在包管理服务前启动以提供相关服务
mDisplayManagerService = mSystemServiceManager.startService(DisplayManagerService.class);
// 在初始化package manager之前，需要默认的显示.
// 逐个调用已启动的服务的onBootPharse()方法,也就是等待mServices中各个服务启动完毕
mSystemServiceManager.startBootPhase(SystemService.PHASE_WAIT_FOR_DEFAULT_DISPLAY);
//启动PackageManagerService
mPackageManagerService = PackageManagerService.main(mSystemContext, installer,
mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore);
..
}
private void startCoreServices() {
// 启动DropBoxManagerService，记录errors和logs
mSystemServiceManager.startService(DropBoxManagerService.class);
// 启动电池管理服务，要求LightService启动完毕
mSystemServiceManager.startService(BatteryService.class);
// 启动UsageStatsService，这是一个Android私有service，主要作用是收集用户使用每一个APP的频率、使用时常
mSystemServiceManager.startService(UsageStatsService.class);
mActivityManagerService.setUsageStatsManager(
LocalServices.getService(UsageStatsManagerInternal.class));
// 启动WebViewUpdateService，该服务跟踪可更新的WebView是否处于就绪状态并观察更新安装
mWebViewUpdateService = mSystemServiceManager.startService(WebViewUpdateService.class);
}
private void startOtherServices() {
...
//WMS的启动需要SensorService启动完毕，这里可能会发生等待
ConcurrentUtils.waitForFutureNoInterrupt(mSensorServiceStart, START_SENSOR_SERVICE);
mSensorServiceStart = null;
wm = WindowManagerService.main(context, inputManager,
mFactoryTestMode != FactoryTest.FACTORY_TEST_LOW_LEVEL,
!mFirstBoot, mOnlyCore, new PhoneWindowManager());
ServiceManager.addService(Context.WINDOW_SERVICE, wm);
//启动StatusBarManagerService
statusBar = new StatusBarManagerService(context, wm);
ServiceManager.addService(Context.STATUS_BAR_SERVICE, statusBar);
mSystemServiceManager.startService(CameraServiceProxy.class);
...
wm.systemReady();
mPowerManagerService.systemReady(mActivityManagerService.getAppOpsService());
mPackageManagerService.systemReady();
mDisplayManagerService.systemReady(safeMode, mOnlyCore);
//最后操作是调用AMS.systemReady，最后进入PHASE_BOOT_COMPLETED阶段
mActivityManagerService.systemReady(() -> {
}, BOOT_TIMINGS_TRACE_LOG);
}
}/frameworks/base/services/core/java/com/android/server/SystemServiceManager.java
public class SystemServiceManager {
public SystemService startService(String className) {
final Class<SystemService> serviceClass;
serviceClass = (Class<SystemService>)Class.forName(className);
return startService(serviceClass);
}
public <T extends SystemService> T startService(Class<T> serviceClass) {
final String name = serviceClass.getName();
Constructor<T> constructor = serviceClass.getConstructor(Context.class);
service = constructor.newInstance(mContext);
startService(service);
return service;
}
public void startService(@NonNull final SystemService service) {
// Register it.
mServices.add(service);
service.onStart();
}
}四、启动 ActivityManagerService 简介
ActivityManagerService通过Binder机制与ActivityManager进行通信，提供对系统中其它组件的管理和监控功能.
从上面可知SystemServer.startBootstrapServices 启动系统Boot级别服务 会启动ams,调用如下：
mSystemServiceManager.startService(ActivityManagerService.Lifecycle.class).getService()
SystemServiceManager.startService(@NonNull final SystemService service) 方法
创建ActivityManagerService 对象实例,ActivityManagerService构造函数 初始化一些对象的主要作用：
1.处理ContentProvider 信息, mProviderMap缓存所有的ProviderInfo .installSystemProviders
2.管理activity 任务栈 ，mRecentTasks RecentTasks对象 缓存所有task信息
3.进程处理 比如 sKillHandler用来杀进程
打印关键日志：Successfully killed process cgroup uid 1000 pid 24528 in 49ms
4.管理服务mServices ActiveServices对象
5.管理广播 mFgBroadcastQueue,mBgBroadcastQueue
6.管理activity启动 ActivityStarter
7.管理activity 生命周期 ActivityStackSupervisor,ActivityStack,ActivityThread(SystemServer.java 初始化时候创建)
SystemServer 最后会调用mActivityManagerService.systemReady
ActivityManagerService.systemReady(..) 调用 startHomeActivityLocked(currentUserId, "systemReady")
ActivityManagerService.startHomeActivityLocked(int userId, String reason)
该方法启动桌面Intent拉起launcher界面,该intent action为ACTION_MAIN category为CATEGORY_HOME。
五、Android开机流程简单总结：
->kernel启动运行init进程。
->init进程解析init.rc时fork zygote 进程(传参--start-system-server) 及surfaceflinger(初始化完成调用开机动画)、 cameraserver等native系统进程。
->zygote进程 启动虚拟机调用ZygoteInit.java 创建system_server进程,并循环等待ams请求创建新的应用程序进程。
->system_server进程 启动ams等系统服务，最后调用ams 的systemReady方法,调用退出开机动画，并启动launcher。
扫一扫
5156
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
