android6.0源码分析之Runtime的初始化

Posted 2022-12-03 古冥

android源码分析之Runtime的初始化

android运行时作为android架构的一部分，起着非常重要的作用，它和核心库(Core Libraries)组成了Android运行时库层。本文将依据android源码对AndroidRuntime(android运行时)的建立过程进行分析。

---

1、Android架构中的AndroidRuntime

android采用的是层次化系统架构，它的架构图如下：

由架构图可知，AndroidRuntime处于Linux内核层以及应用框架层中间，而Java的运行环境依赖于Java虚拟机，所以AndroidRuntime对于android系统非常重要。Init进程是Linux环境下非常重要的一个进程，而Zygote进程是Java环境下的第一个进程，所有其他的Java环境下的进程都是由Zygote进程来进行fork的，而init进程在启动Zygote进程之后，初始化Zygote进程之前，会先进行AndroidRuntime的启动和环境建立，下文将对此过程进行详细分析。

---

2、init进程分析

init进程作为linux启动过程中的一个重要的进程，它主要负责文件系统的挂载，属性的初始化，各种配置的加载启动以及Action触发，Service的启动，而Zygote作为Java环境下的服务进程，也在Init.rc中进行了配置，而init进程是由main函数进行触发的，其main函数如下：

//Init.cpp
int main(int argc, char **argv)
    ...
    //清除umask默认属性
    umask();
    add_environment("PATH",_PATH_DEFPATH);
    //判断是不是初始化的第一阶段
    bool is_first_stage = (arg == 1)||(strcmp(argv[1],"--second-stage")!=0);
    if(is_first_stage)
        //进行系统文件系统等的挂载
        mount("tmpfs","/dev","tmpfs",MS_NOSUID,"mode=0755");
        mkdir("/dev/pts",0755);
        mkdir("/dev/socket",0755);
        mount("devpts","/dev/pts","devpts",0,NULL);
        mount("proc","/proc","proc",0,NULL);
        mount("sysfs","/sys","sysfs",0,NULL);
    
    open_devull_stdio();
    //klog初始化
    klog_init();
    klog_set_level(KLOG_NOTICE_LEVEL);
    if(!is_first_stage)
        //关闭/dev/.booting文件的相关权限
        close("/dev/.booting",O_WRONLY|O_WCREAT|O_CLOEXEC,000);
        //初始化部分属性
        property_init();
        //先初始化DT，因为DT的属性集的优先级高于comand line
        process_kernel_dt();
        //处理内核命令行
        process_kernel_cmdline;
        //导出内核变量
        export_kernel_boot_props();
    
    ...
    //初始化信号量
    signal_handler_init();

    property_load_boot_defaults();
    //开启属性服务
    start_property_service();

    //解析/init.rc文件
    init_parse_config_file(/init.rc);
    ...
 

此处的代码与android 4.4等，在代码上有略微的差别，但是基本的操作还是一样的，首先进行一些属性的初始化，内核命令行等以及信号量的初始化，最后再启动属性服务以及对init.rc文件进行解析，所以，接下来分析Init.rc文件：

//Init.rc
import /init.environ.rc
import /init.usb.rc
import /init.$ro.hardware.rc
import /init.$ro.zygote.rc
import /init.trace.rc
...

由代码可知，与android4.4等有明显的差别，此处采用导入.rc文件的方式来初始化相应模块，此处分析zygote模块，对于android6.0来说，它提供了多个zygote相关的.rc文件，有Init.zygote32.rc、Init.zygote32_64.rc、Init.zygote64.rc、Init.zygote64_32.rc等，本文分析Init.zygote32.rc，其他流程是一样的，但是在源码中，只发现了Init.zygote32.rc的相关实现。
看Init.zygote32.rc文件：

//Init.zygote32.rc
service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
    class main
    socket zygote stream 660 root system
    onrestart write /sys/android_power/request_state wake
    onrestart write /sys/power/state on
    onrestart restart media
    onrestart restart netd

由代码可知，它将会执行/system/bin/app_process，而后面的是它的参数，请注意–zygote和–start-system-server参数，后面将会分析到，而对于/system/bin/app_process的实现app_main.cpp(frameworks/base/cmds/app_process)，它的配置在frameworks/base/cmds/app_process目录下的Android.mk文件中：

//Android.mk(frameworks/base/cmds/app_process)
LOCAL_PATH = $(call my-dir)
app_process_common-shared_libs:=\\
    libwilhelm\\
include $(CLEAR_VARS)
#看，app_process命令绑定的源码就是该目录下的app_main.cpp
LOCAL_SRC_FILES:=\\
    app_main.cpp
...

所以，app_process命令绑定的源码实现就是app_main.cpp，在解析Init.zygote32.rc文件的时候，会调用到它的main函数，即app_main.cpp的main函数。

---

3、Android运行时的启动分析

上一节分析了Init进程启动与android运行时的关系，因为对于android运行时的启动来说，它是在Init进程之后，zygote进程启动之后，初始化之前初始化的，所以此时它的入口和zygote的入口一致，即app_main.cpp的main函数，代码如下：

//app_main.cpp
int main(int argc, char* const argv[])
    ...
    //AppRuntime继承自AndroidRuntime
    AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));
    ...
    if (zygote) //如果init.rc配置中有--Zygote，参数为com.android.internal.os.ZygoteInit
        runtime.start("com.android.internal.os.ZygoteInit", args);
     else if (className) //否则参数为com.android.internal.os.RuntimeInit
        runtime.start("com.android.internal.os.RuntimeInit", args);
    else
        //显示命令的用法说明
        app_usage();
    
    ...

首先创建一个AppRuntime对象，接着调用它的start方法，而此start方法在父类AndroidRuntime中进行了定义，并且此处的参数为com.android.internal.os.ZygoteInit，而对于两种不同的参数而言，只是最后启动的类不一样，如果有–zygote参数，其最后会启动ZygoteInit类，否则就会执行RuntimeInit类，继续追踪start方法。

//AndroidRuntime.cpp
void AndroidRuntime::start(const char* className, const Vector<String8>& options)
    ...
    //启动虚拟机
    if (startVm(&mJavaVM, &env) != 0) 
        return;
    
    //模板方法模式，只是为了创建VM之后释放slashClassName的内存
    onVmCreated(env);
    //注册Android JNI函数
    if (startReg(env) < 0) 
        ALOGE("Unable to register all android natives\\n");
        return;
    
    ...
    //解析类名
    char* slashClassName = toSlashClassName(className);
    //找到需要启动的java类
    jclass startClass = env->FindClass(slashClassName);
    if (startClass == NULL) 
        ALOGE("JavaVM unable to locate class '%s'\\n", slashClassName);
     else 
        //得到指定类中指定方法的ID，这里得到的是RuntimeInit.main()的方法ID
        jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
            "([Ljava/lang/String;)V");
        if (startMeth == NULL) 
            ALOGE("JavaVM unable to find main() in '%s'\\n", className);
         else 
            //调用上面得到的方法ID和相关参数，即调用Java类ZygoteInit.main();
            env->CallStaticVoidMethod(startClass, startMeth, strArray);
            ...
        
    
    ...

首先分析Java虚拟机的启动：由以上代码可知，在start方法中，调用startVm()方法进行虚拟机的启动，startVm()的具体代码如下：

//AndroidRuntime.cpp
int AndroidRuntime::startVm(JavaVM** pJavaVM, JNIEnv** pEnv, bool zygote)
    ...
    //读取第一个参数指定的属性操作到buffer，并设置默认的参数
    parseRuntimeOption("dalvik.vm.stack-trace-file", stackTraceFileBuf,
         "-Xstacktracefile:");
    ...
    //添加相应的handler操作
    addOption("exit", (void*) runtime_exit);
    ...
    //读取作为dex2oat compiler运行时操作
    parseCompilerOption(dex2oat_isa_variant_key, dex2oat_isa_variant,
        "--instruction-set-variant=", "-Xcompiler-option");
    // 拷贝特性
    sprintf(dex2oat_isa_features_key, "dalvik.vm.isa.%s.features", instruction_set);
    parseCompilerOption(dex2oat_isa_features_key, dex2oat_isa_features,
                        "--instruction-set-features=", "-Ximage-compiler-option");
    parseCompilerOption(dex2oat_isa_features_key, dex2oat_isa_features,
                        "--instruction-set-features=", "-Xcompiler-option");
    ...
    //初始化虚拟机
    if (JNI_CreateJavaVM(pJavaVM, pEnv, &initArgs) < 0) 
        ALOGE("JNI_CreateJavaVM failed\\n");
        return -1;
    
    ...

由代码可知：首先进行一系列的属性读取到buffer的操作，如JIT相关的options,DexClassLoader的相关options等，并将其添加到操作数组容器里面，最后再调用JNI_CreateJavaVM方法进行VM的创建,如果此调用发挥成功的话，那么我们就能够济宁JNI调用了，继续看此方法的代码，它的定义出现在DdmConnection的start方法里：

//DdmConnection.cpp
void DdmConnection::start(const char* name) 
    ...
    //定义JNI_CreateJavaVM方法
    jint (*JNI_CreateJavaVM)(JavaVM** p_vm, JNIEnv** p_env, void* vm_args);
    //从libart_dso库中解析JNI_CreateJavaVM方法
    JNI_CreateJavaVM = reinterpret_cast<decltype(JNI_CreateJavaVM)>(
            dlsym(libart_dso, "JNI_CreateJavaVM"));
    //定义registerNatives方法
    jint (*registerNatives)(JNIEnv* env, jclass clazz);
    //从libandroid_runtime_dso库中解析registerNatives方法
    registerNatives = reinterpret_cast<decltype(registerNatives)>(
            dlsym(libandroid_runtime_dso,
                "Java_com_android_internal_util_WithFramework_registerNatives"));

    ...

JNI_CreateJavaVM方法是从libart_dso库中解析得到的，同样后面要用到的registerNatives方法从事libandroid_runtime_dso库中解析得到的，而这两个库也是在DdmConnection的start方法中打开的，代码如下：

void* libart_dso = dlopen("libart.so", RTLD_NOW);
ALOGE_IF(!libart_dso, "DdmConnection: %s", dlerror());
void* libandroid_runtime_dso = dlopen("libandroid_runtime.so", RTLD_NOW);
ALOGE_IF(!libandroid_runtime_dso, "DdmConnection: %s", dlerror());

而当JNI_CreateJavaVM函数执行成功后，当前本地线程已经把自己的控制权交给JVM，而具体的JNI_CreateJavaVM方法的实现在libart_dso库中，此处不做深究。至此，成功创建了Java虚拟机，而startVm方法也分析结束。

接着分析onVmCreated方法，它使用的是模板方法的设计模式，在androidRuntime中声明并使用，而具体的实现在appRuntime子类中进行，其代码如下：

virtual void onVmCreated(JNIEnv* env)
    if(mClassName.isEmpty())
        return;//Zygote.Nothing to do here
    
    char* slashClassName = toSlashClassName(mClassName.string());
    mClass = env->FndClass(slashClassName);
    if(mClass == NULL)
        ALOGE("ERROR:could not find class '%s'\\n",mClassName.string);
    
    free(slashClassName);
    mClass = reinterpret<jclass>(env->NewGlobalRef(mClass));

只是简单根据类名获取了类，并释放了类名，所以此处不做过多的分析，接下来分析startReg()方法，方法定义代码如下：

/*static*/ int AndroidRuntime::startReg(JNIEnv* env)
    /*
     * This hook causes all future threads created in this process to be
     * attached to the JavaVM.  (This needs to go away in favor of JNI
     * Attach calls.)
     */
    androidSetCreateThreadFunc((android_create_thread_fn) javaCreateThreadEtc);

    ALOGV("--- registering native functions ---\\n");

    /*
     * Every "register" function calls one or more things that return
     * a local reference (e.g. FindClass).  Because we haven't really
     * started the VM yet, they're all getting stored in the base frame
     * and never released.  Use Push/Pop to manage the storage.
     */
    env->PushLocalFrame(200);

    if (register_jni_procs(gRegJNI, NELEM(gRegJNI), env) < 0) 
        env->PopLocalFrame(NULL);
        return -1;
    
    env->PopLocalFrame(NULL);
    ...

startReg方法主要的作用是进行android JNI函数的注册，从代码可知：它调用函数register_jni_procs()方法将gRegJNI中的方法注册到虚拟机，而gRegJNI中的Native方法如下：

static const RegJNIRec gRegJNI[] = 
    REG_JNI(register_com_android_internal_os_RuntimeInit),
    REG_JNI(register_android_os_SystemClock),
    REG_JNI(register_android_util_EventLog),
    REG_JNI(register_android_util_Log),
    REG_JNI(register_android_content_AssetManager),
    REG_JNI(register_android_content_StringBlock),
    REG_JNI(register_android_content_XmlBlock),
    REG_JNI(register_android_emoji_EmojiFactory),
    REG_JNI(register_android_text_AndroidCharacter),
    REG_JNI(register_android_text_StaticLayout),
    REG_JNI(register_android_text_AndroidBidi),
    REG_JNI(register_android_view_InputDevice),
    REG_JNI(register_android_view_KeyCharacterMap),
    REG_JNI(register_android_os_Process),
    REG_JNI(register_android_os_SystemProperties),
    REG_JNI(register_android_os_Binder),
    REG_JNI(register_android_os_Parcel),
    REG_JNI(register_android_nio_utils),
    REG_JNI(register_android_graphics_Graphics),
    REG_JNI(register_android_view_DisplayEventReceiver),
    REG_JNI(register_android_view_RenderNode),
    REG_JNI(register_android_view_RenderNodeAnimator),
    REG_JNI(register_android_view_GraphicBuffer),
    REG_JNI(register_android_view_DisplayListCanvas),
    REG_JNI(register_android_view_HardwareLayer),
    REG_JNI(register_android_view_ThreadedRenderer),
    REG_JNI(register_android_view_Surface),
    REG_JNI(register_android_view_SurfaceControl),
    REG_JNI(register_android_view_SurfaceSession),
    REG_JNI(register_android_view_TextureView),
                              REG_JNI(register_com_android_internal_view_animation_NativeInterpolatorFactoryHelper),
    REG_JNI(register_com_google_android_gles_jni_EGLImpl),
    REG_JNI(register_com_google_android_gles_jni_GLImpl),
    REG_JNI(register_android_opengl_jni_EGL14),
    REG_JNI(register_android_opengl_jni_EGLExt),
    REG_JNI(register_android_opengl_jni_GLES10),
    REG_JNI(register_android_opengl_jni_GLES10Ext),
    REG_JNI(register_android_opengl_jni_GLES11),
    REG_JNI(register_android_opengl_jni_GLES11Ext),
    REG_JNI(register_android_opengl_jni_GLES20),
    REG_JNI(register_android_opengl_jni_GLES30),
    REG_JNI(register_android_opengl_jni_GLES31),
    REG_JNI(register_android_opengl_jni_GLES31Ext),

    REG_JNI(register_android_graphics_Bitmap),
    REG_JNI(register_android_graphics_BitmapFactory),
    REG_JNI(register_android_graphics_BitmapRegionDecoder),
    REG_JNI(register_android_graphics_Camera),
    REG_JNI(register_android_graphics_CreateJavaOutputStreamAdaptor),
    REG_JNI(register_android_graphics_Canvas),
    REG_JNI(register_android_graphics_CanvasProperty),
    REG_JNI(register_android_graphics_ColorFilter),
    REG_JNI(register_android_graphics_DrawFilter),
    REG_JNI(register_android_graphics_FontFamily),
    REG_JNI(register_android_graphics_Interpolator),
    REG_JNI(register_android_graphics_LayerRasterizer),
    REG_JNI(register_android_graphics_MaskFilter),
    REG_JNI(register_android_graphics_Matrix),
    REG_JNI(register_android_graphics_Movie),
    REG_JNI(register_android_graphics_NinePatch),
    REG_JNI(register_android_graphics_Paint),
    REG_JNI(register_android_graphics_Path),
    REG_JNI(register_android_graphics_PathMeasure),
    REG_JNI(register_android_graphics_PathEffect),
    REG_JNI(register_android_graphics_Picture),
    REG_JNI(register_android_graphics_PorterDuff),
    REG_JNI(register_android_graphics_Rasterizer),
    REG_JNI(register_android_graphics_Region),
    REG_JNI(register_android_graphics_Shader),
    REG_JNI(register_android_graphics_SurfaceTexture),
    REG_JNI(register_android_graphics_Typeface),
    REG_JNI(register_android_graphics_Xfermode),
    REG_JNI(register_android_graphics_YuvImage),
    REG_JNI(register_android_graphics_pdf_PdfDocument),
    REG_JNI(register_android_graphics_pdf_PdfEditor),
    REG_JNI(register_android_graphics_pdf_PdfRenderer),

    REG_JNI(register_android_database_CursorWindow),
    REG_JNI(register_android_database_SQLiteConnection),
    REG_JNI(register_android_database_SQLiteGlobal),
    REG_JNI(register_android_database_SQLiteDebug),
    REG_JNI(register_android_os_Debug),
    REG_JNI(register_android_os_FileObserver),
    REG_JNI(register_android_os_MessageQueue),
    REG_JNI(register_android_os_SELinux),
    REG_JNI(register_android_os_Trace),
    REG_JNI(register_android_os_UEventObserver),
    REG_JNI(register_android_net_LocalSocketImpl),
    REG_JNI(register_android_net_NetworkUtils),
    REG_JNI(register_android_net_TrafficStats),
    REG_JNI(register_android_os_MemoryFile),
    REG_JNI(register_com_android_internal_os_Zygote),
    REG_JNI(register_com_android_internal_util_VirtualRefBasePtr),
    REG_JNI(register_android_hardware_Camera),
    REG_JNI(register_android_hardware_camera2_CameraMetadata),
    REG_JNI(register_android_hardware_camera2_legacy_LegacyCameraDevice),
    REG_JNI(register_android_hardware_camera2_legacy_PerfMeasurement),
    REG_JNI(register_android_hardware_camera2_DngCreator),
    REG_JNI(register_android_hardware_Radio),
    REG_JNI(register_android_hardware_SensorManager),
    REG_JNI(register_android_hardware_SerialPort),
    REG_JNI(register_android_hardware_SoundTrigger),
    REG_JNI(register_android_hardware_UsbDevice),
    REG_JNI(register_android_hardware_UsbDeviceConnection),
    REG_JNI(register_android_hardware_UsbRequest),
    REG_JNI(register_android_hardware_location_ActivityRecognitionHardware),
    REG_JNI(register_android_media_AudioRecord),
    REG_JNI(register_android_media_Audiosystem),
    REG_JNI(register_android_media_AudioTrack),
    REG_JNI(register_android_media_JetPlayer),
    REG_JNI(register_android_media_RemoteDisplay),
    REG_JNI(register_android_media_ToneGenerator),

    REG_JNI(register_android_opengl_classes),
    REG_JNI(register_android_server_NetworkManagementSocketTagger),
    REG_JNI(register_android_ddm_DdmHandleNativeHeap),
    REG_JNI(register_android_backup_BackupDataInput),
    REG_JNI(register_android_backup_BackupDataOutput),
    REG_JNI(register_android_backup_FileBackupHelperBase),
    REG_JNI(register_android_backup_BackupHelperDispatcher),
    REG_JNI(register_android_app_backup_FullBackup),
    REG_JNI(register_android_app_ActivityThread),
    REG_JNI(register_android_app_NativeActivity),
    REG_JNI(register_android_view_InputChannel),
    REG_JNI(register_android_view_InputEventReceiver),
    REG_JNI(register_android_view_InputEventSender),
    REG_JNI(register_android_view_InputQueue),
    REG_JNI(register_android_view_KeyEvent),
    REG_JNI(register_android_view_MotionEvent),
    REG_JNI(register_android_view_PointerIcon),
    REG_JNI(register_android_view_VelocityTracker),

    REG_JNI(register_android_content_res_ObbScanner),
    REG_JNI(register_android_content_res_Configuration),

    REG_JNI(register_android_animation_PropertyValuesHolder),
    REG_JNI(register_com_android_internal_content_NativeLibraryHelper),
    REG_JNI(register_com_android_internal_net_NetworkStatsFactory),
;

由上可知，在系统建立androidRuntime的时候，创建Java虚拟机，并将系统中一些JNI函数注册到Java虚拟机中，此后只需要通过JNI的方法就可以调用这些Native方法，此外JNI函数的注册还有一种方法，即通过静态代码块System.LoadLibrary(“…”);来加载自定义的JNI方法。至此，其实Runtime已经初始化完成了。，其时序图如下：

---

4、非zygote模式的RuntimeInit分析

非zygote模式下，app_process命令行的输入参数没有了–zygote等，所以className变成了com.android.internal.os.RuntimeInit，但是前面的流程还是差不多，只是在AndroidRuntime的start方法中的最后有代码：

//AndroidRuntime.cpp
void AndroidRuntime::start(const char* className, const Vector<String8>& options)
    ...
    //调用上面得到的方法ID和相关参数，这里调用的是RuntimeInit.main();
    env->CallStaticVoidMethod(startClass, startMeth, strArray);
    ...

它会根据输入的参数com.android.internal.os.ZygoteInit和RuntimeInit，通过反射以及JNI，找到相应的类，并调用类的main方法，本文是在Init进程中来进行Runtime的初始化并启动Zygote进程(Java域的第一个进程)的，它的启动分析请参考我的文章android6.0源码分析之Zygote进程分析，另外，系统提供app_process的命令，我们可以利用此命令来实现很多供我们自己开发、测试、定制一些特殊的程序，给开发带来了很大的便利。所以，接下来继续分析非zygote模式下的RuntimeInit，首先分析RuntimeInit类的main方法：

//RuntimeInit.java
public static final void main(String[] argv)
    //看到没有，Ddms使能，我们调试时要用到的
    enaleDdms();
    if(argv.length == 2&&argv[1].equals("application"))
        //设置系统输出System.out和System.err的Log Stream
        redirectLogStreams();
    else
    ...
    commonInit();
    nativeFinishInit();

commonInit方法主要就是初始化VM里的线程的默认Handler，初始化Log Manager以及一些属性的初始化等，接着看nativeFinishInit方法:

//AndroidRuntime.cpp
static void com_android_internal_os_RuntimeInit_nativeFinishInit(JNIEnv* env,jobject clazz)
    gCurRuntime->onStarted();

onStarted方法的实现在app_main.cpp的AppRuntime类中：

//app_main.cpp
virtual void onStarted()
    //在进程中开启线程池
    sp<ProcessState> proc = ProcessState::self();
    proc->startThreadPool();
    //获取运行时对象
    AndroidRuntime* ar = AndroidRuntime::getRuntime();
    //调用mClassName的main方法
    ar->callMain(mClassName,mClass,mArgs);
    //停止线程池
    IPCThreadState::self()->stopProcess();

其中最主要的就是callMain的调用：

//AndroidRuntime
status_t AndroidRuntime::callMain(const String8& className,jclass clazz,const Vector<String8>& 
        args)
    ...
    env = getJNIEnv();
    ...
    env.CallStaticVoidMethod(clazz,methodId,strArray);
    return NO_ERROR;

最后，在进行相应的RuntimeInit初始化后，会执行命令中相应测试应用（或命令）的main方法。其时序图如下：

---