Android init 启动过程分析23
dvmLoadNativeCode()
LOGD("Trying to load lib %s %p\n", pathName, classLoader);
System.loadLibrary("media_jni");
preloadResources();
startSystemServer()
Zygote.forkSystemServer(parsedArgs.uid, parsedArgs.gid,parsedArgs.gids, debugFlags, null);
//Zygote.java (dalvik\libcore\dalvik\src\main\java\dalvik\system)
forkSystemServer()
forkAndSpecialize() //Zygote.java (dalvik\libcore\dalvik\src\main\java\dalvik\system)
Dalvik_dalvik_system_Zygote_forkAndSpecialize() //dalvik_system_Zygote.c (dalvik\vm\native)
Dalvik_dalvik_system_Zygote_forkAndSpecialize()
setSignalHandler()
fork()
handleSystemServerProcess() //handleChildProc(parsedArgs, descriptors, newStderr);
closeServerSocket();
RuntimeInit.zygoteInit(parsedArgs.remainingArgs);
zygoteInit() //RuntimeInit.java (frameworks\base\core\java\com\android\internal\os)
zygoteInitNative()
invokeStaticMain()
System.loadLibrary("android_servers");
//com.android.server.SystemServer startSystemServer() 函数中
m = cl.getMethod("main", new Class[] { String[].class });
//执行的是SystemServer 类的main函数 SystemServer.java (frameworks\base\services\java\com\android\server)
init1() //SystemServer.java (frameworks\base\services\java\com\android\server)
//init1()实际上是调用android_server_SystemServer_init1(JNIEnv* env, jobject clazz)
//com_android_server_SystemServer.cpp (frameworks\base\services\jni)
android_server_SystemServer_init1()//JNI 调用
system_init() //System_init.cpp (frameworks\base\cmds\system_server\library)
// Start the SurfaceFlinger
SurfaceFlinger::instantiate();
//Start the AudioFlinger media playback camera service
AudioFlinger::instantiate();
MediaPlayerService::instantiate();
CameraService::instantiate();
//调用 SystemServer 类的init2
runtime->callStatic("com/android/server/SystemServer", "init2");
init2()//SystemServer.java (frameworks\base\services\java\com\android\server)
ServerThread()
run()//在run中启动电源管理,蓝牙,等核心服务以及状态,查找等其他服务
((ActivityManagerService)ServiceManager.getService("activity")).setWindowManager(wm);
...
ActivityManagerNative.getDefault().systemReady();
runSelectLoopMode();
done = peers.get(index).runOnce();
forkAndSpecialize() //Zygote.java (dalvik\libcore\dalvik\src\main\java\dalvik\system)
Dalvik_dalvik_system_Zygote_forkAndSpecialize() //dalvik_system_Zygote.c (dalvik\vm\native)
forkAndSpecializeCommon()
setSignalHandler()
RETURN_INT(pid);
closeServerSocket();
见附A
主進程runSelectLoopMode()
5.Runs the zygote process's select loop runSelectLoopMode(), Accepts new connections as they happen, and reads commands from connections one spawn-request's worth at a time.
如果运行正常，则zygote进程会在runSelectLoopMode()中循环：
zygote 被siganl(11)终止
在 dalvik_system_Zygote.c (dalvik\vm\native)
的 static void sigchldHandler(int s) 函数中打印：
"Process %d terminated by signal (%d)\n",
"Exit zygote because system server (%d) has terminated\n",
startSystemServer() ZygoteInit.java (frameworks\base\core\java\com\android\internal\os)
SystemServer 的mian()函数会调用
SystemServer.java (frameworks\base\services\java\com\android\server)中的 init1()函数。
init1()实际执行的是com_android_server_SystemServer.cpp (frameworks\base\services\jni)
中的 android_server_SystemServer_init1()。
android_server_SystemServer_init1()调用的是
System_init.cpp (frameworks\base\cmds\system_server\library) 中的 system_init()函数
system_init()函数定义如下：
extern "C" status_t system_init()
{
...
sp<IServiceManager> sm = defaultServiceManager();
...
property_get("system_init.startsurfaceflinger", propBuf, "1");
if (strcmp(propBuf, "1") == 0) {
//读取属性服务器,开启启动 SurfaceFlinger服务
//接着会开始显示机器人图标
//BootAnimation.cpp (frameworks\base\libs\surfaceflinger):status_t BootAnimation::readyToRun()
SurfaceFlinger::instantiate();
}
//在模拟器上 audioflinger 等几个服务与设备上的启动过程不一样，所以
//我们在这里启动他们。
if (!proc->supportsProcesses()) {
//启动 AudioFlinger，media playback service，camera service服务
AudioFlinger::instantiate();
MediaPlayerService::instantiate();
CameraService::instantiate();
}
//现在开始运行 the Android runtime ，我们这样做的目的是因为必须在 core system services
//起来以后才能 Android runtime initialization，其他服务在调用他们自己的main()时，都会
//调用 Android runtime
//before calling the init function.
LOGI("System server: starting Android runtime.\n");
AndroidRuntime* runtime = AndroidRuntime::getRuntime();
LOGI("System server: starting Android services.\n");
//调用 SystemServer.java (frameworks\base\services\java\com\android\server)
//中的init2函数
runtime->callStatic("com/android/server/SystemServer", "init2");
// If running in our own process, just go into the thread
// pool. Otherwise, call the initialization finished
// func to let this process continue its initilization.
if (proc->supportsProcesses()) {
LOGI("System server: entering thread pool.\n");
ProcessState::self()->startThreadPool();
IPCThreadState::self()->joinThreadPool();
LOGI("System server: exiting thread pool.\n");
}
return NO_ERROR;
}
System server: entering thread pool 表明已经进入服务线程 ServerThread
在 ServerThread 类的run 服务中开启核心服务：
@Override
public void run() {
EventLog.writeEvent(LOG_BOOT_PROGRESS_SYSTEM_RUN,
SystemClock.uptimeMillis());
ActivityManagerService.prepareTraceFile(false); // create dir
Looper.prepare();
//设置线程的优先级
android.os.Process.setThreadPriority(
android.os.Process.THREAD_PRIORITY_FOREGROUND);
...
//关键（核心）服务
try {
Log.i(TAG, "Starting Power Manager.");
Log.i(TAG, "Starting activity Manager.");
Log.i(TAG, "Starting telephony registry");
Log.i(TAG, "Starting Package Manager.");
Log.i(TAG, "tarting Content Manager.");
Log.i(TAG, "Starting System Content Providers.");
Log.i(TAG, "Starting Battery Service.");
Log.i(TAG, "Starting Alarm Manager.");
Log.i(TAG, "Starting Sensor Service.");
Log.i(TAG, "Starting Window Manager.");
Log.i(TAG, "Starting Bluetooth Service.");
//如果是模拟器，那么跳过蓝牙服务。
// Skip Bluetooth if we have an emulator kernel
//其他的服务
Log.i(TAG, "Starting Status Bar Service.");
Log.i(TAG, "Starting Clipboard Service.");
Log.i(TAG, "Starting Input Method Service.");
Log.i(TAG, "Starting Hardware Service.");
Log.i(TAG, "Starting NetStat Service.");
Log.i(TAG, "Starting Connectivity Service.");
Log.i(TAG, "Starting Notification Manager.");
// MountService must start after NotificationManagerService
Log.i(TAG, "Starting Mount Service.");
Log.i(TAG, "Starting DeviceStorageMonitor service");
Log.i(TAG, "Starting Location Manager.");
Log.i(TAG, "Starting Search Service.");
...
if (INCLUDE_DEMO) {
Log.i(TAG, "Installing demo data...");
(new DemoThread(context)).start();
}
try {
Log.i(TAG, "Starting Checkin Service.");
Intent intent = new Intent().setComponent(new ComponentName(
"com.google.android.server.checkin",
"com.google.android.server.checkin.CheckinService"));
if (context.startService(intent) == null) {
Log.w(TAG, "Using fallback Checkin Service.");
ServiceManager.addService("checkin", new FallbackCheckinService(context));
}
} catch (Throwable e) {
Log.e(TAG, "Failure starting Checkin Service", e);
}
Log.i(TAG, "Starting Wallpaper Service");
Log.i(TAG, "Starting Audio Service");
Log.i(TAG, "Starting HeadsetObserver");
Log.i(TAG, "Starting AppWidget Service");
...
try {
com.android.server.status.StatusBarPolicy.installIcons(context, statusBar);
} catch (Throwable e) {
Log.e(TAG, "Failure installing status bar icons", e);
}
}
// make sure the ADB_ENABLED setting value matches the secure property value
Settings.Secure.putInt(mContentResolver, Settings.Secure.ADB_ENABLED,
"1".equals(SystemProperties.get("persist.service.adb.enable")) ? 1 : 0);
// register observer to listen for settings changes
mContentResolver.registerContentObserver(Settings.Secure.getUriFor(Settings.Secure.ADB_ENABLED),
false, new AdbSettingsObserver());
// It is now time to start up the app processes...
boolean safeMode = wm.detectSafeMode();
if (statusBar != null) {
statusBar.systemReady();
}
if (imm != null) {
imm.systemReady();
}
wm.systemReady();
power.systemReady();
try {
pm.systemReady();
} catch (RemoteException e) {
}
if (appWidget != null) {
appWidget.systemReady(safeMode);
}
// After making the following code, third party code may be running...
try {
ActivityManagerNative.getDefault().systemReady();
} catch (RemoteException e) {
}
Watchdog.getInstance().start();
Looper.loop();
Log.d(TAG, "System ServerThread is exiting!");
}
startActivity()
mRemote.transact(START_ACTIVITY_TRANSACTION, data, reply, 0);
ActivityManagerService.java 3136p (frameworks\base\services\java\com\android\server\am)
startActivity()
startActivityLocked() //3184
int res = startActivityLocked(caller, intent, resolvedType,grantedUriPermissions, grantedMode, aInfo,
resultTo, resultWho, requestCode, -1, -1,
onlyIfNeeded, componentSpecified);
public abstract class ActivityManagerNative extends Binder implements IActivityManager
ActivityManagerService.java 1071p (frameworks\base\services\java\com\android\server\am)
ActivityManagerService.main()
//ActivityManagerService.java 7375p (frameworks\base\services\java\com\android\server\am)
m.startRunning(null, null, null, null);
//ActivityManagerService.java 7421p (frameworks\base\services\java\com\android\server\am)
systemReady();
ActivityManagerService.java 3136p (frameworks\base\services\java\com\android\server\am)
startActivity(IApplicationThread caller,Intent intent,...)
int startActivityLocked(caller, intent,...) //3184L 定义：2691L
void startActivityLocked() //3132L 定义：2445L
resumeTopActivityLocked(null); //2562p 定义：2176L
if(next=NULL)
{
intent.addCategory(Intent.CATEGORY_HOME);
startActivityLocked(null, intent, null, null, 0, aInfo,null, null, 0, 0, 0, false, false);
}
else
{
startSpecificActivityLocked(next, true, false); //2439L 定义：1628L
realStartActivityLocked() //1640L 定义：1524L
//1651L 定义：1654L
startProcessLocked(r.processName, r.info.applicationInfo, true, 0,"activity", r.intent.getComponent());
//1717L 定义：1721L
startProcessLocked(app, hostingType, hostingNameStr);
//1768L 定义：Process.java 222L(frameworks\base\core\java\android\os)
int pid = Process.start("android.app.ActivityThread",...)
startViaZygote(processClass, niceName, uid, gid, gids,debugFlags, zygoteArgs);
pid = zygoteSendArgsAndGetPid(argsForZygote);
sZygoteWriter.write(Integer.toString(args.size()));
}
runSelectLoopMode();
done = peers.get(index).runOnce();
forkAndSpecialize() //Zygote.java (dalvik\libcore\dalvik\src\main\java\dalvik\system)
Dalvik_dalvik_system_Zygote_forkAndSpecialize() //dalvik_system_Zygote.c (dalvik\vm\native)
,&,nbsp; forkAndSpecializeCommo,n()
setSignalHandler()
RETURN_INT(pid);
ActivityThread main()
ActivityThread attach() //ActivityThread.java 3870p (frameworks\base\core\java\android\app)
mgr.attachApplication(mAppThread)
//ActivityManagerService.java 4677p (frameworks\base\services\java\com\android\server\am)
attachApplication()
//ActivityManagerService.java 4677p (frameworks\base\services\java\com\android\server\am)
attachApplicationLocked()
if (realStartActivityLocked(hr, app, true, true)) //ActivityManagerService.java 4609p (frameworks\base\services\java\com\android\server\am)
realStartActivityLocked()
//ActivityManagerService.java (frameworks\base\services\java\com\android\server\am)
app.thread.scheduleLaunchActivity(new Intent(r.intent), r,r.info, r.icicle, results, newIntents, !andResume,isNextTransitionForward());
scheduleLaunchActivity()
queueOrSendMessage(H.LAUNCH_ACTIVITY, r);
ActivityThread.H.handleMessage()
handleLaunchActivity() //ActivityThread.java (frameworks\base\core\java\android\app)
performLaunchActivity() //ActivityThread.java (frameworks\base\core\java\android\app)
activity = mInstrumentation.newActivity(cl, component.getClassName(), r.intent);
/////////////////////////////////////////////////
init 守护进程：
//andriod init 函数启动过程分析：
在main循环中会重复调用
drain_action_queue();
restart_processes();
static void restart_processes()
{
process_needs_restart = 0;
service_for_each_flags(SVC_RESTARTING,
restart_service_if_needed);
}
通过循环检测服务列表service_list 中每个服务的 svc->flags 标记，如果为 SVC_RESTARTING，
那么在满足条件的情况下调用：restart_service_if_needed
通过 service_start 来再次启动该服务。
ActivityManagerService.main
I/SystemServer( 45): Starting Power Manager.
I/ServiceManager( 26): service 'SurfaceFlinger' died
D/Zygote ( 30): Process 45 terminated by signal (11)
I/Zygote ( 30): Exit zygote because system server (45) has terminated
通过错误信息发现程序在调用 SurfaceFlinger服务的时候被中止。
Service_manager.c (frameworks\base\cmds\servicemanager):
LOGI("service '%s' died\n", str8(si->name));
Binder.c (frameworks\base\cmds\servicemanager):
death->func(bs, death->ptr);
Binder.c (kernel\drivers\misc)中的函数
binder_thread_read()
struct binder_work *w;
switch (w->type)
为 BINDER_WORK_DEAD_BINDER 的时候
binder_parse()中
当 cmd 为 BR_DEAD_BINDER的时候
执行 death->func(bs, death->ptr)
因为函数
int do_add_service(struct binder_state *bs,
uint16_t *s, unsigned len,
void *ptr, unsigned uid)
的 si->death.func = svcinfo_death;
所以 death->func(bs, death->ptr) 实际上执行的是
svcinfo_death()//Service_manager.c (frameworks\base\cmds\servicemanager)
所以会打印出：service 'SurfaceFlinger' died
I/ServiceManager( 26): service 'SurfaceFlinger' died
Thread::run
_threadLoop() // Threads.cpp (frameworks\base\libs\utils)
status_t SurfaceFlinger::readyToRun()
mBootAnimation = new BootAnimation(this);