Android 6.0启动过程详细解析

Posted 天堂1223

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了Android 6.0启动过程详细解析相关的知识,希望对你有一定的参考价值。

在之前的一篇文章中,从概念上学习了Andoird系统的启动过程,Android系统启动过程学习

而在这篇文章中,我们将从代码角度仔细学习android系统的启动过程,同时,学习Android启动过程中的初始化脚本语言,即init.rc中的语言语法。在这里,不在详细介绍Linux内核的启动过程,主要学习从Linux内核启动之后,init初始化是如何工作的,他是如何启动Android系统的第一个进程–Zygote进程。并且还会继续了解后面其他的进程是如何通过Zygote进程启动的。话不多说,我们现在就来气Android系统启动之路。

## Android系统启动流程图

我们都知道,Android系统内核是基于Linux内核,所以在Android系统启动过程中,首先启动Linux内核,Bootloader加载并启动Linux内核,内核启动完成之后,内核开始启动Android系统的init进程,然后init进程通过init.rc启动脚本语言的执行,来启动Zygote进程,作为Android其他进程的父进程,Zygote进程做完初始化工作之后,启动SystemServer来启动其他系统服务。

下面我们从init进程的启动开始学习。


      int main(int argc, char** argv) 
        if (!strcmp(basename(argv[0]), "ueventd")) 
            return ueventd_main(argc, argv);
        

        if (!strcmp(basename(argv[0]), "watchdogd")) 
            return watchdogd_main(argc, argv);
        

        // Clear the umask.
        umask(0);

        add_environment("PATH", _PATH_DEFPATH);

        bool is_first_stage = (argc == 1) || (strcmp(argv[1], "--second-stage") != 0);

        // Get the basic filesystem setup we need put together in the initramdisk
        // on / and then we'll let the rc file figure out the rest.
        if (is_first_stage) 
            mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755");
            mkdir("/dev/pts", 0755);
            mkdir("/dev/socket", 0755);
            mount("devpts", "/dev/pts", "devpts", 0, NULL);
            mount("proc", "/proc", "proc", 0, NULL);
            mount("sysfs", "/sys", "sysfs", 0, NULL);
        

        // We must have some place other than / to create the device nodes for
        // kmsg and null, otherwise we won't be able to remount / read-only
        // later on. Now that tmpfs is mounted on /dev, we can actually talk
        // to the outside world.
        open_devnull_stdio();
        klog_init();
        klog_set_level(KLOG_NOTICE_LEVEL);

        NOTICE("init%s started!\\n", is_first_stage ? "" : " second stage");

        if (!is_first_stage) 
            // Indicate that booting is in progress to background fw loaders, etc.
            close(open("/dev/.booting", O_WRONLY | O_CREAT | O_CLOEXEC, 0000));

            property_init();

            // If arguments are passed both on the command line and in DT,
            // properties set in DT always have priority over the command-line ones.
            process_kernel_dt();
            process_kernel_cmdline();

            // Propogate the kernel variables to internal variables
            // used by init as well as the current required properties.
            export_kernel_boot_props();
        

        // Set up SELinux, including loading the SELinux policy if we're in the kernel domain.
        selinux_initialize(is_first_stage);

        // If we're in the kernel domain, re-exec init to transition to the init domain now
        // that the SELinux policy has been loaded.
        if (is_first_stage) 
            if (restorecon("/init") == -1) 
                ERROR("restorecon failed: %s\\n", strerror(errno));
                security_failure();
            
            char* path = argv[0];
            char* args[] =  path, const_cast<char*>("--second-stage"), nullptr ;
            if (execv(path, args) == -1) 
                ERROR("execv(\\"%s\\") failed: %s\\n", path, strerror(errno));
                security_failure();
            
        

        // These directories were necessarily created before initial policy load
        // and therefore need their security context restored to the proper value.
        // This must happen before /dev is populated by ueventd.
        INFO("Running restorecon...\\n");
        restorecon("/dev");
        restorecon("/dev/socket");
        restorecon("/dev/__properties__");
        restorecon_recursive("/sys");

        epoll_fd = epoll_create1(EPOLL_CLOEXEC);
        if (epoll_fd == -1) 
            ERROR("epoll_create1 failed: %s\\n", strerror(errno));
            exit(1);
        

        signal_handler_init();

        property_load_boot_defaults();
        start_property_service();

        init_parse_config_file("/init.rc");

        action_for_each_trigger("early-init", action_add_queue_tail);

        // Queue an action that waits for coldboot done so we know ueventd has set up all of /dev...
        queue_builtin_action(wait_for_coldboot_done_action, "wait_for_coldboot_done");
        // ... so that we can start queuing up actions that require stuff from /dev.
        queue_builtin_action(mix_hwrng_into_linux_rng_action, "mix_hwrng_into_linux_rng");
        queue_builtin_action(keychord_init_action, "keychord_init");
        queue_builtin_action(console_init_action, "console_init");

        // Trigger all the boot actions to get us started.
        action_for_each_trigger("init", action_add_queue_tail);

        // Repeat mix_hwrng_into_linux_rng in case /dev/hw_random or /dev/random
        // wasn't ready immediately after wait_for_coldboot_done
        queue_builtin_action(mix_hwrng_into_linux_rng_action, "mix_hwrng_into_linux_rng");

        // Don't mount filesystems or start core system services in charger mode.
        char bootmode[PROP_VALUE_MAX];
        if (property_get("ro.bootmode", bootmode) > 0 && strcmp(bootmode, "charger") == 0) 
            action_for_each_trigger("charger", action_add_queue_tail);
         else 
            action_for_each_trigger("late-init", action_add_queue_tail);
        

        // Run all property triggers based on current state of the properties.
        queue_builtin_action(queue_property_triggers_action, "queue_property_triggers");

        while (true) 
            if (!waiting_for_exec) 
                execute_one_command();
                restart_processes();
            

            int timeout = -1;
            if (process_needs_restart) 
                timeout = (process_needs_restart - gettime()) * 1000;
                if (timeout < 0)
                    timeout = 0;
            

            if (!action_queue_empty() || cur_action) 
                timeout = 0;
            

            bootchart_sample(&timeout);

            epoll_event ev;
            int nr = TEMP_FAILURE_RETRY(epoll_wait(epoll_fd, &ev, 1, timeout));
            if (nr == -1) 
                ERROR("epoll_wait failed: %s\\n", strerror(errno));
             else if (nr == 1) 
                ((void (*)()) ev.data.ptr)();
            
        

        return 0;
    

该文件位于system/core/init/init.cpp中,我们来看看init进程都做了哪些工作。

首先,init进程添加环境变量,并且挂载相应的目录。在主目录/之外为kmsg和null创建设备节点。初始化selinux,由于我们这里并不研究selinux的运行机制,所以其初始化细节也不在详究。根据起注释可以知道,如果当前系统处于内核域中,重新执行init来转换到init域中,因为SELinux策略已经被加载了。下面接着通过restorecon命令来将在selinux启动之前创建的目录的安全上下文恢复到正确的属性。

接着,便是信号处理机制的初始化工作,加载启动属性,并启动属性服务器。下面,便进入至关重要的一个函数,也是init进程的主要工作,便是执行init_parse_config_file("/init.rc")函数,该函数的主要作用就是解析init.rc文件,并执行init初始化进程语言。下面我们来看一下这个函数:


    int init_parse_config_file(const char* path) 
        INFO("Parsing %s...\\n", path);
        Timer t;
        std::string data;
        if (!read_file(path, &data)) 
            return -1;
        

        data.push_back('\\n'); // TODO: fix parse_config.
        parse_config(path, data);
        dump_parser_state();

        NOTICE("(Parsing %s took %.2fs.)\\n", path, t.duration());
        return 0;
    

该代码位于system/core/init/init_parser.cpp中,该函数读取init.rc文件,并将数据传入到parse_config(path, data)函数中。

我们来看一下parse_config函数:


    static void parse_config(const char *fn, const std::string& data)
    
        struct listnode import_list;
        struct listnode *node;
        char *args[INIT_PARSER_MAXARGS];

        int nargs = 0;

        parse_state state;
        state.filename = fn;
        state.line = 0;
        state.ptr = strdup(data.c_str());  // TODO: fix this code!
        state.nexttoken = 0;
        state.parse_line = parse_line_no_op;

        list_init(&import_list);
        state.priv = &import_list;

        for (;;) 
            switch (next_token(&state)) 
            case T_EOF:
                state.parse_line(&state, 0, 0);
                goto parser_done;
            case T_NEWLINE:
                state.line++;
                if (nargs) 
                    int kw = lookup_keyword(args[0]);
                    if (kw_is(kw, SECTION)) 
                        state.parse_line(&state, 0, 0);
                        parse_new_section(&state, kw, nargs, args);
                     else 
                        state.parse_line(&state, nargs, args);
                    
                    nargs = 0;
                
                break;
            case T_TEXT:
                if (nargs < INIT_PARSER_MAXARGS) 
                    args[nargs++] = state.text;
                
                break;
            
        

    parser_done:
        list_for_each(node, &import_list) 
             struct import *import = node_to_item(node, struct import, list);
             int ret;

             ret = init_parse_config_file(import->filename);
             if (ret)
                 ERROR("could not import file '%s' from '%s'\\n",
                       import->filename, fn);
        
    

该函数和刚刚那个函数位于同一个文件中,很明显,该函数用于解析读取的init.rc文件的字符串,该函数与文件parse.cpp中的next_token()函数配合,进行字符串的解析,然后通过调用parse_new_section()函数将services和actions等添加到运行队列中,等待trigger触发器的触发运行。

有关与Android init language(Android初始化语言)我在博客 Android Init Language(android初始化语言)

中已经进行了详细的介绍。下面我们接着看init进程中的main函数中所做的工作:

init.rc解析完成之后,所有的启动项目都被放入到action_add_queue_tail中,接着调用action_for_each_trigger("early-init", action_add_queue_tail),触发early-init触发器来出发这些相关services和actions的运行。

我们来看一下,在init.rc中,我们看early-init相关启动的services和actions。在这里基本上是恢复某些文件或文件夹的安全上下文,然后调用init_zygote32_64.rc文件中的命令启动zygote。


  service zygote /system/bin/app_process32 -Xzygote /system/bin --zygote --start-system-server --socket-name=zygote
    class main
    socket zygote stream 660 root system
    onrestart write /sys/android_power/request_state wake
    onrestart write /sys/power/state on
    onrestart restart media
    onrestart restart netd

这里的意思是通过/system/bin/app_process32程序启动zygote进程,参数为--zygote--start-system-server,这两个参数在后面我们会用到的。下面我们来看一下Zygote的main函数。


      public static void main(String argv[]) 
            try 
                RuntimeInit.enableDdms();
                // Start profiling the zygote initialization.
                SamplingProfilerIntegration.start();

                boolean startSystemServer = false;
                String socketName = "zygote";
                String abiList = null;
                for (int i = 1; i < argv.length; i++) 
                    if ("start-system-server".equals(argv[i])) 
                        startSystemServer = true;
                     else if (argv[i].startsWith(ABI_LIST_ARG)) 
                        abiList = argv[i].substring(ABI_LIST_ARG.length());
                     else if (argv[i].startsWith(SOCKET_NAME_ARG)) 
                        socketName = argv[i].substring(SOCKET_NAME_ARG.length());
                     else 
                        throw new RuntimeException("Unknown command line argument: " + argv[i]);
                    
                

                if (abiList == null) 
                    throw new RuntimeException("No ABI list supplied.");
                

                registerZygoteSocket(socketName);
                EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
                    SystemClock.uptimeMillis());

                preload();
                EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
                    SystemClock.uptimeMillis());

                // Finish profiling the zygote initialization.
                SamplingProfilerIntegration.writeZygoteSnapshot();

                // Do an initial gc to clean up after startup
                gcAndFinalize();

                // Disable tracing so that forked processes do not inherit stale tracing tags from
                // Zygote.
                Trace.setTracingEnabled(false);

                if (startSystemServer) 
                    startSystemServer(abiList, socketName);
                

                Log.i(TAG, "Accepting command socket connections");
                runSelectLoop(abiList);

                closeServerSocket();
             catch (MethodAndArgsCaller caller) 
                caller.run();
             catch (RuntimeException ex) 
                Log.e(TAG, "Zygote died with exception", ex);
                closeServerSocket();
                throw ex;
            
        

该代码位于frameworks/base/core/java/com/android/internal/os/ZygiteInit.java中。在代码中,他首先通过参数判断是否启动systemServer,也就是通过刚刚我们记录下来的参数--start-system-server判定startSystemServertrue;接着通过调用registerZygoteSocket(socketName)函数来注册zygote套接字,进行进程间的通信,我们来看一下这个函数:


          /**
         * Registers a server socket for zygote command connections
         *
         * @throws RuntimeException when open fails
         */
        private static void registerZygoteSocket(String socketName) 
            if (sServerSocket == null) 
                int fileDesc;
                final String fullSocketName = ANDROID_SOCKET_PREFIX + socketName;
                try 
                    String env = System.getenv(fullSocketName);
                    fileDesc = Integer.parseInt(env);
                 catch (RuntimeException ex) 
                    throw new RuntimeException(fullSocketName + " unset or invalid", ex);
                

                try 
                    FileDescriptor fd = new FileDescriptor();
                    fd.setInt$(fileDesc);
                    sServerSocket = new LocalServerSocket(fd);
                 catch (IOException ex) 
                    throw new RuntimeException(
                            "Error binding to local socket '" + fileDesc + "'", ex);
                
            
        

该代码位于同一个文件中,通过代码我们可以看到,创建zygote套接字的方式是通过创建一个LocalServerSocket对象来建立进程间的通信,在注释中有说明,注册一个服务套接字用于zygote命令连接。

创建完成zygote套接字之后,执行preload()函数来进行资源文件的预加载工作。


      static void preload() 
            Log.d(TAG, "begin preload");
            preloadClasses();
            preloadResources();
            preloadOpenGL();
            preloadSharedLibraries();
            preloadTextResources();
            // Ask the WebViewFactory to do any initialization that must run in the zygote process,
            // for memory sharing purposes.
            WebViewFactory.prepareWebViewInZygote();
            Log.d(TAG, "end preload");
        

在这里,加载类,加载资源文件,加载OPenGl,加载共享库,文本资源以及准备WebView。这里不在所说,我们接着往下看。

接着便调用startSystemServer(abiList, socketName)方法启动系统服务,我们来看一下这个函数:


         /**
         * Prepare the arguments and fork for the system server process.
         */
        private static boolean startSystemServer(String abiList, String socketName)
                throws MethodAndArgsCaller, RuntimeException 
            long capabilities = posixCapabilitiesAsBits(
                OsConstants.CAP_BLOCK_SUSPEND,
                OsConstants.CAP_KILL,
                OsConstants.CAP_NET_ADMIN,
                OsConstants.CAP_NET_BIND_SERVICE,
                OsConstants.CAP_NET_BROADCAST,
                OsConstants.CAP_NET_RAW,
                OsConstants.CAP_SYS_MODULE,
                OsConstants.CAP_SYS_NICE,
                OsConstants.CAP_SYS_RESOURCE,
                OsConstants.CAP_SYS_TIME,
                OsConstants.CAP_SYS_TTY_CONFIG
            );
            /* Hardcoded command line to start the system server */
            String args[] = 
                "--setuid=1000",
                "--setgid=1000",
                "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1032,3001,3002,3003,3006,3007",
                "--capabilities=" + capabilities + "," + capabilities,
                "--nice-name=system_server",
                "--runtime-args",
                "com.android.server.SystemServer",
            ;
            ZygoteConnection.Arguments parsedArgs = null;

            int pid;

            try 
                parsedArgs = new ZygoteConnection.Arguments(args);
                ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
                ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);

                /* Request to fork the system server process */
                pid = Zygote.forkSystemServer(
                        parsedArgs.uid, parsedArgs.gid,
                        parsedArgs.gids,
                        parsedArgs.debugFlags,
                        null,
                        parsedArgs.permittedCapabilities,
                        parsedArgs.effectiveCapabilities);
             catch (IllegalArgumentException ex) 
                throw new RuntimeException(ex);
            

            /* For child process */
            if (pid == 0) 
                if (hasSecondZygote(abiList)) 
                    waitForSecondaryZygote(socketName);
                

                handleSystemServerProcess(parsedArgs);
            

            return true;
        

在这里准备系统服启动的参数,并通过forkSystemServer来创建系统服务进程,接着调用handleSystemServerProcess(parsedArgs)来进行系统服务的处理。


        /**
         * Finish remaining work for the newly forked system server process.
         */
        private static void handleSystemServerProcess(
                ZygoteConnection.Arguments parsedArgs)
                throws ZygoteInit.MethodAndArgsCaller 

            closeServerSocket();

            // set umask to 0077 so new files and directories will default to owner-only permissions.
            Os.umask(S_IRWXG | S_IRWXO);

            if (parsedArgs.niceName != null) 
                Process.setArgV0(parsedArgs.niceName);
            

            final String systemServerClasspath = Os.getenv("SYSTEMSERVERCLASSPATH");
            if (systemServerClasspath != null) 
                performSystemServerDexOpt(systemServerClasspath);
            

            if (parsedArgs.invokeWith != null) 
                String[] args = parsedArgs.remainingArgs;
                // If we have a non-null system server class path, we'll have to duplicate the
                // existing arguments and append the classpath to it. ART will handle the classpath
                // correctly when we exec a new process.
                if (systemServerClasspath != null) 
                    String[] amendedArgs = new String[args.length + 2];
                    amendedArgs[0] = "-cp";
                    amendedArgs[1] = systemServerClasspath;
                    System.arraycopy(parsedArgs.remainingArgs, 0, amendedArgs, 2, parsedArgs.remainingArgs.length);
                

                WrapperInit.execApplication(parsedArgs.invokeWith,
                        parsedArgs.niceName, parsedArgs.targetSdkVersion,
                        VMRuntime.getCurrentInstructionSet(), null, args);
             else 
                ClassLoader cl = null;
                if (systemServerClasspath != null) 
                    cl = new PathClassLoader(systemServerClasspath, ClassLoader.getSystemClassLoader());
                    Thread.currentThread().setContextClassLoader(cl);
                

                /*
                 * Pass the remaining arguments to SystemServer.
                 */
                RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs, cl);
            

            /* should never reach here */
        

在这里完成对创建的系统服务剩余的工作,最后调用RuntimeInit.zygoteInit将剩余的参数传递到系统服务中。


        public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
                throws ZygoteInit.MethodAndArgsCaller 
            if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting application from zygote");

            Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "RuntimeInit");
            redirectLogStreams();

            commonInit();
            nativeZygoteInit();
            applicationInit(targetSdkVersion, argv, classLoader);
        

该函数位于同目录下面的RuntimeInit.java文件中。这里的nativeZygoteInit()用于进程间通信的初始化操作,applicationInit函数用于服务的启动,我们来看一下:


    private static void applicationInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
                throws ZygoteInit.MethodAndArgsCaller 
            // If the application calls System.exit(), terminate the process
            // immediately without running any shutdown hooks.  It is not possible to
            // shutdown an Android application gracefully.  Among other things, the
            // Android runtime shutdown hooks close the Binder driver, which can cause
            // leftover running threads to crash before the process actually exits.
            nativeSetExitWithoutCleanup(true);

            // We want to be fairly aggressive about heap utilization, to avoid
            // holding on to a lot of memory that isn't needed.
            VMRuntime.getRuntime().setTargetHeapUtilization(0.75f);
            VMRuntime.getRuntime().setTargetSdkVersion(targetSdkVersion);

            final Arguments args;
            try 
                args = new Arguments(argv);
             catch (IllegalArgumentException ex) 
                Slog.e(TAG, ex.getMessage());
                // let the process exit
                return;
            

            // The end of of the RuntimeInit event (see #zygoteInit).
            Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);

            // Remaining arguments are passed to the start class's static main
            invokeStaticMain(args.startClass, args.startArgs, classLoader);
        

该函数主要是一些运行时的一些工作,同时调用invokeStaticMain来进行main函数的执行,看这个方法的注释,意思便是剩下的参数被传递,用于启动类的静态main函数。这里传递的类参数便是SystemServer类,所以这个函数的工作便是启动SystemServer的main函数。


     /**
         * The main entry point from zygote.
         */
        public static void main(String[] args) 
            new SystemServer().run();
        

该函数位于frameworks/base/services/java/com/android/server/SystemServer.java类中,这里运行SystemServer的run函数,该函数设置环境变量,启动其他服务,后面就不再赘述了。

接着返回到ZygoteInit.java的main函数中,这个函数最后执行runSelectLoop函数,这里运行一个循环,接收新的连接,读取来自连接的命令。

至此,Android系统的启动过程就到了启动系统服务以及其他服务阶段了,后面我们会在别的博客中进行学习和讲解。

以上是关于Android 6.0启动过程详细解析的主要内容,如果未能解决你的问题,请参考以下文章

Android源代码解析之(十三)--&gt;apk安装流程

Android应用进程启动过程(前篇)

Android 6.0 运行时权限处理完全解析

Android启动过程深入解析

Android 6.0 运行时权限处理完全解析

Android深入四大组件应用程序启动过程