Welcome to Sky's Blog!

当你的才华配不上你的理想的时候, 就静下心来好好学习!

Android 开机启动流程SystemServer上篇(三)

2019-09-15

Android

Systemserver

前言
3.1 forkSystemServer
3.2 nativeForkSystemServer
3.3 ForkAndSpecializeCommon
3.4 handleSystemServerProcess
3.5 zygoteInit
3.6 applicationInit

前言

前面的篇章已经打通了kernel到init只zygote进程，下面就说下怎么从zygote中把SystemServer启动起来的.

/frameworks/base/core/java/com/android/internal/os/
  - ZygoteInit.java
  - RuntimeInit.java
  - Zygote.java

/frameworks/base/core/services/java/com/android/server/
  - SystemServer.java

/frameworks/base/core/jni/
  - com_android_internal_os_Zygote.cpp
  - AndroidRuntime.cpp

3.1 forkSystemServer

从上面的代码我们可以知道在zygote中调用startSystemServer方法，最终会调用到Zygote.forkSystemServer 的方法

public static int forkSystemServer(int uid, int gid, int[] gids, int debugFlags, int[][] rlimits, long permittedCapabilities, long effectiveCapabilities) {
    VM_HOOKS.preFork();
    // 调用native方法fork system_server进程【见小节3】
    int pid = nativeForkSystemServer(
            uid, gid, gids, debugFlags, rlimits, permittedCapabilities, effectiveCapabilities);
    if (pid == 0) {
        Trace.setTracingEnabled(true);
    }
    VM_HOOKS.postForkCommon();
    return pid;
}

nativeForkSystemServer()方法在AndroidRuntime.cpp中注册的,这个我们在上一篇说过会有一个native的对应关系
com_android_internal_os_Zygote.cpp中的  
register_com_android_internal_os_Zygote()所以接下来进入如下方法。

3.2 nativeForkSystemServer

在这个cpp文件里面 com_android_internal_os_Zygote.cpp

static jint com_android_internal_os_Zygote_nativeForkSystemServer(
      JNIEnv* env, jclass, uid_t uid, gid_t gid, jintArray gids,
      jint runtime_flags, jobjectArray rlimits, jlong permittedCapabilities,
      jlong effectiveCapabilities) {
     //fork子进程
pid_t pid = ForkAndSpecializeCommon(env, uid, gid, gids,
                                    runtime_flags, rlimits,
                                    permittedCapabilities, effectiveCapabilities,
                                    MOUNT_EXTERNAL_DEFAULT, NULL, NULL, true, NULL,
                                    NULL, false, NULL, NULL);
if (pid > 0) {
    // The zygote process checks whether the child process has died or not.
         zygote进程，检测system_server进程是否创建
    ALOGI("System server process %d has been created", pid);
    gSystemServerPid = pid;
    // There is a slight window that the system server process has crashed
    // but it went unnoticed because we haven't published its pid yet. So
    // we recheck here just to make sure that all is well.
    int status;
    if (waitpid(pid, &status, WNOHANG) == pid) {
        ALOGE("System server process %d has died. Restarting Zygote!", pid);
             当system_server进程死亡后，重启zygote进程
        RuntimeAbort(env, __LINE__, "System server process has died. Restarting Zygote!");
    }
891
    // Assign system_server to the correct memory cgroup.
    // Not all devices mount /dev/memcg so check for the file first
    // to avoid unnecessarily printing errors and denials in the logs.
    if (!access("/dev/memcg/system/tasks", F_OK) &&
              !WriteStringToFile(StringPrintf("%d", pid), "/dev/memcg/system/tasks")) {
      ALOGE("couldn't write %d to /dev/memcg/system/tasks", pid);
    }
}
return pid;
901}

3.3 ForkAndSpecializeCommon

这个方法太长了，我只截取其中的一小部分的关键字

static pid_t ForkAndSpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArray javaGids,
                                   jint runtime_flags, jobjectArray javaRlimits,
                                   jlong permittedCapabilities, jlong effectiveCapabilities,
                                   jint mount_external,
                                   jstring java_se_info, jstring java_se_name,
                                   bool is_system_server, jintArray fdsToClose,
                                   jintArray fdsToIgnore, bool is_child_zygote,
                                   jstring instructionSet, jstring dataDir) {
547
570
// Temporarily block SIGCHLD during forks. The SIGCHLD handler might
// log, which would result in the logging FDs we close being reopened.
// This would cause failures because the FDs are not whitelisted.
//
// Note that the zygote process is single threaded at this point.
if (sigprocmask(SIG_BLOCK, &sigchld, nullptr) == -1) {
  fail_fn(CREATE_ERROR("sigprocmask(SIG_SETMASK, { SIGCHLD }) failed: %s", strerror(errno)));
}
579
// Close any logging related FDs before we start evaluating the list of
// file descriptors.
__android_log_close();
583
std::string error_msg;
585
// If this is the first fork for this zygote, create the open FD table.
// If it isn't, we just need to check whether the list of open files has
// changed (and it shouldn't in the normal case).
std::vector<int> fds_to_ignore;
if (!FillFileDescriptorVector(env, fdsToIgnore, &fds_to_ignore, &error_msg)) {
  fail_fn(error_msg);
}
if (gOpenFdTable == NULL) {
  gOpenFdTable = FileDescriptorTable::Create(fds_to_ignore, &error_msg);
  if (gOpenFdTable == NULL) {
    fail_fn(error_msg);
  }
} else if (!gOpenFdTable->Restat(fds_to_ignore, &error_msg)) {
  fail_fn(error_msg);
}
//在这里调用linux的标准创建进程的方法
pid_t pid = fork();
603
if (pid == 0) {
  PreApplicationInit();
606
  // Clean up any descriptors which must be closed immediately
  if (!DetachDescriptors(env, fdsToClose, &error_msg)) {
    fail_fn(error_msg);
  }
611
  // Re-open all remaining open file descriptors so that they aren't shared
  // with the zygote across a fork.
  if (!gOpenFdTable->ReopenOrDetach(&error_msg)) {
    fail_fn(error_msg);
  }
       .............
       最后return 这个pid，这里创建已经完成了

       fork()创建新进程，采用copy on write方式，这是linux创建进程的标准方法，会有两次return,
       对于pid==0为子进程的返回，对于pid>0为父进程的返回.到此system_server进程已完成了创建的所有工  
       作，接下来开始了system_server进程的真正工作.在zygoteinit.java中，创建完成systemserver进程之后
       执行handleSystemServerProcess

3.4 handleSystemServerProcess

private static Runnable handleSystemServerProcess(ZygoteConnection.Arguments parsedArgs) {
      // set umask to 0077 so new files and directories will default to owner-only permissions.
      Os.umask(S_IRWXG | S_IRWXO);
456
      if (parsedArgs.niceName != null) {
          Process.setArgV0(parsedArgs.niceName);
      }
      获取SYSTEMSERVERCLASSPATH环境变量中的值
           adb shell, export,查看所有环境变量的值, $SYSTEMSERVERCLASSPATH 取值
      final String systemServerClasspath = Os.getenv("SYSTEMSERVERCLASSPATH");
      if (systemServerClasspath != null) {
          performSystemServerDexOpt(systemServerClasspath);
          // Capturing profiles is only supported for debug or eng builds since selinux normally
          // prevents it.
          boolean profileSystemServer = SystemProperties.getBoolean(
                  "dalvik.vm.profilesystemserver", false);
          if (profileSystemServer && (Build.IS_USERDEBUG || Build.IS_ENG)) {
              try {
                  prepareSystemServerProfile(systemServerClasspath);
              } catch (Exception e) {
                  Log.wtf(TAG, "Failed to set up system server profile", e);
              }
          }
      }
476
      if (parsedArgs.invokeWith != null) {
          String[] args = parsedArgs.remainingArgs;
          // If we have a non-null system server class path, we'll have to duplicate the
          // existing arguments and append the classpath to it. ART will handle the classpath
          // correctly when we exec a new process.
          if (systemServerClasspath != null) {
              String[] amendedArgs = new String[args.length + 2];
              amendedArgs[0] = "-cp";
              amendedArgs[1] = systemServerClasspath;
              System.arraycopy(args, 0, amendedArgs, 2, args.length);
              args = amendedArgs;
          }
489
          WrapperInit.execApplication(parsedArgs.invokeWith,
                  parsedArgs.niceName, parsedArgs.targetSdkVersion,
                  VMRuntime.getCurrentInstructionSet(), null, args);
493
          throw new IllegalStateException("Unexpected return from WrapperInit.execApplication");
      } else {
          ClassLoader cl = null;
          if (systemServerClasspath != null) {
                   //加载SYSTEMSERVERCLASSPATH环境变量中的类
              cl = createPathClassLoader(systemServerClasspath, parsedArgs.targetSdkVersion);
499
              Thread.currentThread().setContextClassLoader(cl);
          }
502
          /*
           * Pass the remaining arguments to SystemServer.
           */
          return ZygoteInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs, cl);
      }
508
      /* should never reach here */
  }

3.5 zygoteInit

public static final Runnable zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader) {
      if (RuntimeInit.DEBUG) {
          Slog.d(RuntimeInit.TAG, "RuntimeInit: Starting application from zygote");
      }
906
      Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ZygoteInit");
      RuntimeInit.redirectLogStreams();
909
      RuntimeInit.commonInit();
      ZygoteInit.nativeZygoteInit();
      return RuntimeInit.applicationInit(targetSdkVersion, argv, classLoader);
  }

在AndroidRuntime.cpp中可以得知 nativeZygoteInit 所对应的c++方法为 com_android_internal_os_ZygoteInit_nativeZygoteInit

int register_com_android_internal_os_ZygoteInit_nativeZygoteInit(JNIEnv* env)
258{
259    const JNINativeMethod methods[] = {
260        { "nativeZygoteInit", "()V",
261            (void*) com_android_internal_os_ZygoteInit_nativeZygoteInit },
262    };
263    return jniRegisterNativeMethods(env, "com/android/internal/os/ZygoteInit",
264        methods, NELEM(methods));
265}

gCurRuntime为zygote中的runtime

static void com_android_internal_os_ZygoteInit_nativeZygoteInit(JNIEnv* env, jobject clazz)
231{
       //开启一个binder线程
232    gCurRuntime->onZygoteInit();
233}
234

3.6 applicationInit

在zygoteinit中继续开启

return RuntimeInit.applicationInit(targetSdkVersion, argv, classLoader);

protected static Runnable applicationInit(int targetSdkVersion, String[] argv,
          ClassLoader classLoader) {
      // If the application calls System.exit(), terminate the process
      // immediately without running any shutdown hooks.  It is not possible to
      // shutdown an Android application gracefully.  Among other things, the
      // Android runtime shutdown hooks close the Binder driver, which can cause
      // leftover running threads to crash before the process actually exits.
      nativeSetExitWithoutCleanup(true);
353
      // We want to be fairly aggressive about heap utilization, to avoid
      // holding on to a lot of memory that isn't needed.
      VMRuntime.getRuntime().setTargetHeapUtilization(0.75f);
      VMRuntime.getRuntime().setTargetSdkVersion(targetSdkVersion);
358
      final Arguments args = new Arguments(argv);
360
      // The end of of the RuntimeInit event (see #zygoteInit).
      Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
363
      // Remaining arguments are passed to the start class's static main
      return findStaticMain(args.startClass, args.startArgs, classLoader);
  }

protected static Runnable findStaticMain(String className, String[] argv,
          ClassLoader classLoader) {
      Class<?> cl;
290
      try {
          cl = Class.forName(className, true, classLoader);
      } catch (ClassNotFoundException ex) {
          throw new RuntimeException(
                  "Missing class when invoking static main " + className,
                  ex);
      }
298
      Method m;
      try {
              获取com.android.server.SystemServer的main方法
          m = cl.getMethod("main", new Class[] { String[].class });
      } catch (NoSuchMethodException ex) {
          throw new RuntimeException(
                  "Missing static main on " + className, ex);
      } catch (SecurityException ex) {
          throw new RuntimeException(
                  "Problem getting static main on " + className, ex);
      }
309
      int modifiers = m.getModifiers();
      if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {
          throw new RuntimeException(
                  "Main method is not public and static on " + className);
      }
315
      /*
       * This throw gets caught in ZygoteInit.main(), which responds
       * by invoking the exception's run() method. This arrangement
       * clears up all the stack frames that were required in setting
       * up the process.
       */
      return new MethodAndArgsCaller(m, argv);
  }

紧接着
static class MethodAndArgsCaller implements Runnable {
      /** method to call */
      private final Method mMethod;
482
      /** argument array */
      private final String[] mArgs;
485
      public MethodAndArgsCaller(Method method, String[] args) {
          mMethod = method;
          mArgs = args;
      }
490
      public void run() {
          try {
              mMethod.invoke(null, new Object[] { mArgs });
          } catch (IllegalAccessException ex) {
              throw new RuntimeException(ex);
          } catch (InvocationTargetException ex) {
              Throwable cause = ex.getCause();
              if (cause instanceof RuntimeException) {
                  throw (RuntimeException) cause;
              } else if (cause instanceof Error) {
                  throw (Error) cause;
              }
              throw new RuntimeException(ex);
          }
      }
  }

最终会返回一个runnable. 会在zygote main函数里面调用. 最终com.android.server.SystemServer中的
main方法执行，并且作为一个fork出来的进程执行

到此终于进入到systemserver中的main方法里面，并且系统中最为重要的一个线程起来了.

Read All

Android 开机启动流程至Launcher zygote篇(二)

2019-09-10

Android

开机启动

2 zygote概述
2.1 zygote 启动
2.1 AndroidRuntime启动
2.2 startVm
2.3 startReg
2.4 register_jni_procs
2.5 zygote main方法执行
2.6 forkSystemServer方法
总结部分

2 zygote概述

Zygote是由init进程通过解析init.zygote.rc文件而创建的，zygote所对应的可执行程序app_process，所对应的源文件是App_main.cpp，进程名为zygote。

2.1 zygote 启动

通过查看http://androidxref.com/9.0.0_r3/xref/system/core/rootdir/init.rc文件
在 /system/core/rootdir/init.rc 文件里面会导入
import /init.${ro.zygote}.rcimport /init.${ro.zygote}.rc 这个目录下面http://androidxref.com/9.0.0_r3/xref/system/core/rootdir/ zygote文件里面

service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
    class main
    socket zygote stream 660 root system
    onrestart write /sys/android_power/request_state wake
    onrestart write /sys/power/state on
    onrestart restart media
    onrestart restart netd

大致流程

avatar

这里不在画了，用了gityuan先生的图，很简单的，跟着代码就可以画了

而init.rc文件会在init进程里面解析::

static void LoadBootScripts(ActionManager& action_manager, ServiceList& service_list) {
  Parser parser = CreateParser(action_manager, service_list);
112
  std::string bootscript = GetProperty("ro.boot.init_rc", "");
  if (bootscript.empty()) {
      parser.ParseConfig("/init.rc");
      if (!parser.ParseConfig("/system/etc/init")) {
          late_import_paths.emplace_back("/system/etc/init");
      }
      if (!parser.ParseConfig("/product/etc/init")) {
          late_import_paths.emplace_back("/product/etc/init");
      }
      if (!parser.ParseConfig("/odm/etc/init")) {
          late_import_paths.emplace_back("/odm/etc/init");
      }
      if (!parser.ParseConfig("/vendor/etc/init")) {
          late_import_paths.emplace_back("/vendor/etc/init");
      }
  } else {
      parser.ParseConfig(bootscript);
  }
131}
132

所以zygote进程就启动了
源码所在目录http://androidxref.com/9.0.0_r3/xref/frameworks/base/cmds/app_process/

在zygote文件里面可以看到

service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server

后面的参数是 –zygote 和 –start-system-server

while (i < argc) {
      const char* arg = argv[i++];
      if (strcmp(arg, "--zygote") == 0) {
	             下面要用到
          zygote = true;
          niceName = ZYGOTE_NICE_NAME;
      } else if (strcmp(arg, "--start-system-server") == 0) {
	             需要开启systemserver
          startSystemServer = true;
      } else if (strcmp(arg, "--application") == 0) {
          application = true;
      } else if (strncmp(arg, "--nice-name=", 12) == 0) {
          niceName.setTo(arg + 12);
      } else if (strncmp(arg, "--", 2) != 0) {
          className.setTo(arg);
          break;
      } else {
          --i;
          break;
      }
  }
297

  zygote为true,通过反射调用zygoteinit,开启虚拟机，在开启虚拟机的时候加载android基础的类
       bootclasspath路径下的类
  if (zygote) {
      runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
  //如果是App的话
        } else if (className) {
      runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
  } else {
      fprintf(stderr, "Error: no class name or --zygote supplied.\n");
      app_usage();
      LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");
  }
358}
359

2.1 AndroidRuntime启动

可以看到在app_main.cpp里面定义了runtime

class AppRuntime : public AndroidRuntime
34{
35public:
  AppRuntime(char* argBlockStart, const size_t argBlockLength)
      : AndroidRuntime(argBlockStart, argBlockLength)
      , mClass(NULL)
  {
  }
41
  void setClassNameAndArgs(const String8& className, int argc, char * const *argv) {
      mClassName = className;
      for (int i = 0; i < argc; ++i) {
           mArgs.add(String8(argv[i]));
      }
  }
48
  virtual void onVmCreated(JNIEnv* env)
  {
      if (mClassName.isEmpty()) {
          return; // Zygote. Nothing to do here.
      }
54
      /*
       * This is a little awkward because the JNI FindClass call uses the
       * class loader associated with the native method we're executing in.
       * If called in onStarted (from RuntimeInit.finishInit because we're
       * launching "am", for example), FindClass would see that we're calling
       * from a boot class' native method, and so wouldn't look for the class
       * we're trying to look up in CLASSPATH. Unfortunately it needs to,
       * because the "am" classes are not boot classes.
       *
       * The easiest fix is to call FindClass here, early on before we start
       * executing boot class Java code and thereby deny ourselves access to
       * non-boot classes.
       */
      char* slashClassName = toSlashClassName(mClassName.string());
      mClass = env->FindClass(slashClassName);
      if (mClass == NULL) {
          ALOGE("ERROR: could not find class '%s'\n", mClassName.string());
      }
      free(slashClassName);
74
      mClass = reinterpret_cast<jclass>(env->NewGlobalRef(mClass));
  }
77
  virtual void onStarted()
  {
      sp<ProcessState> proc = ProcessState::self();
      ALOGV("App process: starting thread pool.\n");
      proc->startThreadPool();
83
      AndroidRuntime* ar = AndroidRuntime::getRuntime();
      ar->callMain(mClassName, mClass, mArgs);
86
      IPCThreadState::self()->stopProcess();
      hardware::IPCThreadState::self()->stopProcess();
  }
90
  virtual void onZygoteInit()
  {
      sp<ProcessState> proc = ProcessState::self();
      ALOGV("App process: starting thread pool.\n");
      proc->startThreadPool();
  }
97
  virtual void onExit(int code)
  {
      if (mClassName.isEmpty()) {
          // if zygote
          IPCThreadState::self()->stopProcess();
          hardware::IPCThreadState::self()->stopProcess();
      }
105
      AndroidRuntime::onExit(code);
  }
108
109
  String8 mClassName;
  Vector<String8> mArgs;
  jclass mClass;
113};
114
115}
116

查看AndroidRunTime.cpp

void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
1057{
  ALOGD(">>>>>> START %s uid %d <<<<<<\n",
          className != NULL ? className : "(unknown)", getuid());
1060
  static const String8 startSystemServer("start-system-server");
1062
  /*
   * 'startSystemServer == true' means runtime is obsolete and not run from
   * init.rc anymore, so we print out the boot start event here.
   */
  for (size_t i = 0; i < options.size(); ++i) {
      if (options[i] == startSystemServer) {
         /* track our progress through the boot sequence */
         const int LOG_BOOT_PROGRESS_START = 3000;
         LOG_EVENT_LONG(LOG_BOOT_PROGRESS_START,  ns2ms(systemTime(SYSTEM_TIME_MONOTONIC)));
      }
  }
1074
  const char* rootDir = getenv("ANDROID_ROOT");
  if (rootDir == NULL) {
      rootDir = "/system";
      if (!hasDir("/system")) {
          LOG_FATAL("No root directory specified, and /android does not exist.");
          return;
      }
      setenv("ANDROID_ROOT", rootDir, 1);
  }
1084
  //const char* kernelHack = getenv("LD_ASSUME_KERNEL");
  //ALOGD("Found LD_ASSUME_KERNEL='%s'\n", kernelHack);
1087
  /* start the virtual machine */
  JniInvocation jni_invocation;
  jni_invocation.Init(NULL);
  JNIEnv* env;
        //创建虚拟机，看下面2.2
  if (startVm(&mJavaVM, &env, zygote) != 0) {
      return;
  }
  onVmCreated(env);
1096
  /*
   * Register android functions.
   */
        //JNI方法注册，看下面2.3
  if (startReg(env) < 0) {
      ALOGE("Unable to register all android natives\n");
      return;
  }
1104
  /*
   * We want to call main() with a String array with arguments in it.
   * At present we have two arguments, the class name and an option string.
   * Create an array to hold them.
   */
  jclass stringClass;
  jobjectArray strArray;
  jstring classNameStr;
1113
  stringClass = env->FindClass("java/lang/String");
  assert(stringClass != NULL);
  strArray = env->NewObjectArray(options.size() + 1, stringClass, NULL);
  assert(strArray != NULL);
  classNameStr = env->NewStringUTF(className);
  assert(classNameStr != NULL);
  env->SetObjectArrayElement(strArray, 0, classNameStr);
1121
  for (size_t i = 0; i < options.size(); ++i) {
      jstring optionsStr = env->NewStringUTF(options.itemAt(i).string());
      assert(optionsStr != NULL);
      env->SetObjectArrayElement(strArray, i + 1, optionsStr);
  }
1127
  /*
   * Start VM.  This thread becomes the main thread of the VM, and will
   * not return until the VM exits.
   */
        将"com.android.internal.os.ZygoteInit"转换为"com/android/internal/os/ZygoteInit"
        因为传入进来的是com.android.internal.os.ZygoteInit
  char* slashClassName = toSlashClassName(className != NULL ? className : "");
  jclass startClass = env->FindClass(slashClassName);
  if (startClass == NULL) {
      ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);
      /* keep going */
  } else {
            //进入java的世界了
      jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
          "([Ljava/lang/String;)V");
      if (startMeth == NULL) {
          ALOGE("JavaVM unable to find main() in '%s'\n", className);
          /* keep going */
      } else {
          env->CallStaticVoidMethod(startClass, startMeth, strArray);
1145
1146#if 0
          if (env->ExceptionCheck())
              threadExitUncaughtException(env);
1149#endif
      }
  }
  free(slashClassName);
1153
  ALOGD("Shutting down VM\n");
  if (mJavaVM->DetachCurrentThread() != JNI_OK)
      ALOGW("Warning: unable to detach main thread\n");
  if (mJavaVM->DestroyJavaVM() != 0)
      ALOGW("Warning: VM did not shut down cleanly\n");
1159}

2.2 startVm

只是列出了一些常用的参数,是不是很熟悉，这些都可以在配置文件里面看到

...................
parseRuntimeOption("dalvik.vm.heapstartsize", heapstartsizeOptsBuf, "-Xms", "4m");
716    parseRuntimeOption("dalvik.vm.heapsize", heapsizeOptsBuf, "-Xmx", "16m");
717
718    parseRuntimeOption("dalvik.vm.heapgrowthlimit", heapgrowthlimitOptsBuf, "-XX:HeapGrowthLimit=");
719    parseRuntimeOption("dalvik.vm.heapminfree", heapminfreeOptsBuf, "-XX:HeapMinFree=");
720    parseRuntimeOption("dalvik.vm.heapmaxfree", heapmaxfreeOptsBuf, "-XX:HeapMaxFree=");
721    parseRuntimeOption("dalvik.vm.heaptargetutilization",
722                       heaptargetutilizationOptsBuf,
723                       "-XX:HeapTargetUtilization=");
724
...................
/*
1009     * Initialize the VM.
1010     *
1011     * The JavaVM* is essentially per-process, and the JNIEnv* is per-thread.
1012     * If this call succeeds, the VM is ready, and we can start issuing
1013     * JNI calls.
1014     */
        //去创建jvm
1015    if (JNI_CreateJavaVM(pJavaVM, pEnv, &initArgs) < 0) {
1016        ALOGE("JNI_CreateJavaVM failed\n");
1017        return -1;
1018    }
1019

2.3 startReg

int AndroidRuntime::startReg(JNIEnv* env)
{
    //设置线程创建javaCreateThreadEtc
    androidSetCreateThreadFunc((android_create_thread_fn) javaCreateThreadEtc);

    env->PushLocalFrame(200);
    //注册jni方法
    if (register_jni_procs(gRegJNI, NELEM(gRegJNI), env) < 0) {
        env->PopLocalFrame(NULL);
        return -1;
    }
    env->PopLocalFrame(NULL);
    return 0;
}

2.4 register_jni_procs

注册系统里面的jni方法, 以便上层Api可以调用到Native方法，这里举一个例子

extern int register_android_hardware_Camera(JNIEnv *env);
REG_JNI(register_android_hardware_Camera)

extern 是c++中的关键字,代表着不用引入.h 或者 .cpp文件，也可以调用到.意思是别的地方已经定义过了
//举一个列子camera register_android_hardware_Camera 这个方法会在下面这个文件里面注册
/frameworks/base/core/jni/android_hardware_Camera.cpp

6int register_android_hardware_Camera(JNIEnv *env)
1127{
        //注册成员变量
  field fields_to_find[] = {
      { "android/hardware/Camera", "mNativeContext",   "J", &fields.context },
      { "android/hardware/Camera$CameraInfo", "facing",   "I", &fields.facing },
      { "android/hardware/Camera$CameraInfo", "orientation",   "I", &fields.orientation },
      { "android/hardware/Camera$CameraInfo", "canDisableShutterSound",   "Z",
        &fields.canDisableShutterSound },
      { "android/hardware/Camera$Face", "rect", "Landroid/graphics/Rect;", &fields.face_rect },
      { "android/hardware/Camera$Face", "leftEye", "Landroid/graphics/Point;", &fields.face_left_eye},
      { "android/hardware/Camera$Face", "rightEye", "Landroid/graphics/Point;", &fields.face_right_eye},
      { "android/hardware/Camera$Face", "mouth", "Landroid/graphics/Point;", &fields.face_mouth},
      { "android/hardware/Camera$Face", "score", "I", &fields.face_score },
      { "android/hardware/Camera$Face", "id", "I", &fields.face_id},
      { "android/graphics/Rect", "left", "I", &fields.rect_left },
      { "android/graphics/Rect", "top", "I", &fields.rect_top },
      { "android/graphics/Rect", "right", "I", &fields.rect_right },
      { "android/graphics/Rect", "bottom", "I", &fields.rect_bottom },
      { "android/graphics/Point", "x", "I", &fields.point_x},
      { "android/graphics/Point", "y", "I", &fields.point_y},
  };
1147
  find_fields(env, fields_to_find, NELEM(fields_to_find));
1149
  jclass clazz = FindClassOrDie(env, "android/hardware/Camera");
  fields.post_event = GetStaticMethodIDOrDie(env, clazz, "postEventFromNative",
                                             "(Ljava/lang/Object;IIILjava/lang/Object;)V");
1153
  clazz = FindClassOrDie(env, "android/graphics/Rect");
  fields.rect_constructor = GetMethodIDOrDie(env, clazz, "<init>", "()V");
1156
  clazz = FindClassOrDie(env, "android/hardware/Camera$Face");
  fields.face_constructor = GetMethodIDOrDie(env, clazz, "<init>", "()V");
1159
  clazz = env->FindClass("android/graphics/Point");
  fields.point_constructor = env->GetMethodID(clazz, "<init>", "()V");
  if (fields.point_constructor == NULL) {
      ALOGE("Can't find android/graphics/Point()");
      return -1;
  }
1166
  // Register native functions
        // camMethods 注册方法，java层的方法和native层方法对应
  return RegisterMethodsOrDie(env, "android/hardware/Camera", camMethods, NELEM(camMethods));
1169}

//注册方法
static const JNINativeMethod camMethods[] = {
{ "getNumberOfCameras",
  "()I",
  (void *)android_hardware_Camera_getNumberOfCameras },
{ "_getCameraInfo",
  "(ILandroid/hardware/Camera$CameraInfo;)V",
  (void*)android_hardware_Camera_getCameraInfo },
{ "native_setup",
  "(Ljava/lang/Object;IILjava/lang/String;)I",
  (void*)android_hardware_Camera_native_setup },
{ "native_release",
  "()V",
  (void*)android_hardware_Camera_release },
      }

这个地方真正的进入了java的世界,接着是各种系统服务的创建

2.5 zygote main方法执行

在/frameworks/base/core/jni/AndroidRuntime.cpp 里面的start方法会通过反射开始zygote

/*
   * Start VM.  This thread becomes the main thread of the VM, and will
   * not return until the VM exits.
   */
  char* slashClassName = toSlashClassName(className != NULL ? className : "");
  jclass startClass = env->FindClass(slashClassName);
  if (startClass == NULL) {
      ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);
      /* keep going */
  } else {
            //找到类里面的main函数，进入java的世界
            //http://androidxref.com/9.0.0_r3/xref/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
      jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
          "([Ljava/lang/String;)V");
      if (startMeth == NULL) {
          ALOGE("JavaVM unable to find main() in '%s'\n", className);
          /* keep going */
      } else {
                //c++调用
          env->CallStaticVoidMethod(startClass, startMeth, strArray);
1145
1146#if 0
          if (env->ExceptionCheck())
              threadExitUncaughtException(env);
1149#endif
      }
  }

/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
public static void main(String argv[]) {
      ZygoteServer zygoteServer = new ZygoteServer();
752
      // Mark zygote start. This ensures that thread creation will throw
      // an error.
      ZygoteHooks.startZygoteNoThreadCreation();
756
      // Zygote goes into its own process group.
      try {
          Os.setpgid(0, 0);
      } catch (ErrnoException ex) {
          throw new RuntimeException("Failed to setpgid(0,0)", ex);
      }
763
      final Runnable caller;
      try {
          // Report Zygote start time to tron unless it is a runtime restart
          if (!"1".equals(SystemProperties.get("sys.boot_completed"))) {
              MetricsLogger.histogram(null, "boot_zygote_init",
                      (int) SystemClock.elapsedRealtime());
          }
771
          String bootTimeTag = Process.is64Bit() ? "Zygote64Timing" : "Zygote32Timing";
          TimingsTraceLog bootTimingsTraceLog = new TimingsTraceLog(bootTimeTag,
                  Trace.TRACE_TAG_DALVIK);
          bootTimingsTraceLog.traceBegin("ZygoteInit");
          RuntimeInit.enableDdms();
777
          boolean startSystemServer = false;
          String socketName = "zygote";
          String abiList = null;
          boolean enableLazyPreload = false;
          for (int i = 1; i < argv.length; i++) {
              if ("start-system-server".equals(argv[i])) {
                       //这个地方设置为true，是在native zygote 进程里面孵化出来的
                  startSystemServer = true;
              } else if ("--enable-lazy-preload".equals(argv[i])) {
                  enableLazyPreload = true;
              } else if (argv[i].startsWith(ABI_LIST_ARG)) {
                  abiList = argv[i].substring(ABI_LIST_ARG.length());
              } else if (argv[i].startsWith(SOCKET_NAME_ARG)) {
                  socketName = argv[i].substring(SOCKET_NAME_ARG.length());
              } else {
                  throw new RuntimeException("Unknown command line argument: " + argv[i]);
              }
          }
795
          if (abiList == null) {
              throw new RuntimeException("No ABI list supplied.");
          }
           
               //注册监听，以后通过这个这个socket来创建新的进程
          zygoteServer.registerServerSocketFromEnv(socketName);
          // In some configurations, we avoid preloading resources and classes eagerly.
          // In such cases, we will preload things prior to our first fork.
          if (!enableLazyPreload) {
              bootTimingsTraceLog.traceBegin("ZygotePreload");
              EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
                  SystemClock.uptimeMillis());
                   //加载一些新的资源
              preload(bootTimingsTraceLog);
              EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
                  SystemClock.uptimeMillis());
              bootTimingsTraceLog.traceEnd(); // ZygotePreload
          } else {
              Zygote.resetNicePriority();
          }
814
          // Do an initial gc to clean up after startup
          bootTimingsTraceLog.traceBegin("PostZygoteInitGC");
          gcAndFinalize();
          bootTimingsTraceLog.traceEnd(); // PostZygoteInitGC
819
          bootTimingsTraceLog.traceEnd(); // ZygoteInit
          // Disable tracing so that forked processes do not inherit stale tracing tags from
          // Zygote.
          Trace.setTracingEnabled(false, 0);
824
          Zygote.nativeSecurityInit();
826
          // Zygote process unmounts root storage spaces.
          Zygote.nativeUnmountStorageOnInit();
829
          ZygoteHooks.stopZygoteNoThreadCreation();
831
          if (startSystemServer) {
              Runnable r = forkSystemServer(abiList, socketName, zygoteServer);
834
              // {@code r == null} in the parent (zygote) process, and {@code r != null} in the
              // child (system_server) process.
              if (r != null) {
                  r.run();
                  return;
              }
          }
842
          Log.i(TAG, "Accepting command socket connections");
844
          // The select loop returns early in the child process after a fork and
          // loops forever in the zygote.
          caller = zygoteServer.runSelectLoop(abiList);
      } catch (Throwable ex) {
          Log.e(TAG, "System zygote died with exception", ex);
          throw ex;
      } finally {
          zygoteServer.closeServerSocket();
      }
854
      // We're in the child process and have exited the select loop. Proceed to execute the
      // command.
      if (caller != null) {
          caller.run();
      }
  }


static void preload(TimingsTraceLog bootTimingsTraceLog) {
      Log.d(TAG, "begin preload");
      bootTimingsTraceLog.traceBegin("BeginIcuCachePinning");
      beginIcuCachePinning();
      bootTimingsTraceLog.traceEnd(); // BeginIcuCachePinning
      bootTimingsTraceLog.traceBegin("PreloadClasses");
           //加载/system/etc/preloaded-classes 这个列表里面的类，会用到Class.forName方法
           Class.forName(xxx.xx.xx);的作用是要求JVM查找并加载指定的类，也就是说JVM会执行该类的静态代码段
      preloadClasses();
      bootTimingsTraceLog.traceEnd(); // PreloadClasses
      bootTimingsTraceLog.traceBegin("PreloadResources");
      preloadResources();
      bootTimingsTraceLog.traceEnd(); // PreloadResources
      Trace.traceBegin(Trace.TRACE_TAG_DALVIK, "PreloadAppProcessHALs");
      nativePreloadAppProcessHALs();
      Trace.traceEnd(Trace.TRACE_TAG_DALVIK);
      Trace.traceBegin(Trace.TRACE_TAG_DALVIK, "PreloadOpenGL");
      preloadOpenGL();
      Trace.traceEnd(Trace.TRACE_TAG_DALVIK);
           //一些动态库
      preloadSharedLibraries();
      preloadTextResources();
      // Ask the WebViewFactory to do any initialization that must run in the zygote process,
      // for memory sharing purposes.
      WebViewFactory.prepareWebViewInZygote();
      endIcuCachePinning();
      warmUpJcaProviders();
      Log.d(TAG, "end preload");
148
      sPreloadComplete = true;
  }

这里引用gityuan先生的图，侵权请联系我 zygote进程内加载了preload()方法中的所有资源，当需要fork新进程时，采用copy on write技术，如下： avatar

2.6 forkSystemServer方法

private static Runnable forkSystemServer(String abiList, String socketName,
          ZygoteServer zygoteServer) {
      long capabilities = posixCapabilitiesAsBits(
          OsConstants.CAP_IPC_LOCK,
          OsConstants.CAP_KILL,
          OsConstants.CAP_NET_ADMIN,
          OsConstants.CAP_NET_BIND_SERVICE,
          OsConstants.CAP_NET_BROADCAST,
          OsConstants.CAP_NET_RAW,
          OsConstants.CAP_SYS_MODULE,
          OsConstants.CAP_SYS_NICE,
          OsConstants.CAP_SYS_PTRACE,
          OsConstants.CAP_SYS_TIME,
          OsConstants.CAP_SYS_TTY_CONFIG,
          OsConstants.CAP_WAKE_ALARM,
          OsConstants.CAP_BLOCK_SUSPEND
      );
      /* Containers run without some capabilities, so drop any caps that are not available. */
      StructCapUserHeader header = new StructCapUserHeader(
              OsConstants._LINUX_CAPABILITY_VERSION_3, 0);
      StructCapUserData[] data;
      try {
          data = Os.capget(header);
      } catch (ErrnoException ex) {
          throw new RuntimeException("Failed to capget()", ex);
      }
      capabilities &= ((long) data[0].effective) | (((long) data[1].effective) << 32);
684
      /* Hardcoded command line to start the system server */
           //system_server的group id，uid名字
      String args[] = {
          "--setuid=1000",
          "--setgid=1000",
          "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1023,1024,1032,1065,3001,3002,3003,3006,3007,3009,3010",
          "--capabilities=" + capabilities + "," + capabilities,
          "--nice-name=system_server",
          "--runtime-args",
          "--target-sdk-version=" + VMRuntime.SDK_VERSION_CUR_DEVELOPMENT,
          "com.android.server.SystemServer",
      };
      ZygoteConnection.Arguments parsedArgs = null;
697
      int pid;
699
      try {
          parsedArgs = new ZygoteConnection.Arguments(args);
          ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
          ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);
704
          boolean profileSystemServer = SystemProperties.getBoolean(
                  "dalvik.vm.profilesystemserver", false);
          if (profileSystemServer) {
              parsedArgs.runtimeFlags |= Zygote.PROFILE_SYSTEM_SERVER;
          }
710
          /* Request to fork the system server process */
               //fork子进程，用于运行system_server
          pid = Zygote.forkSystemServer(
                  parsedArgs.uid, parsedArgs.gid,
                  parsedArgs.gids,
                  parsedArgs.runtimeFlags,
                  null,
                  parsedArgs.permittedCapabilities,
                  parsedArgs.effectiveCapabilities);
      } catch (IllegalArgumentException ex) {
          throw new RuntimeException(ex);
      }
722
      /* For child process */
      if (pid == 0) {
          if (hasSecondZygote(abiList)) {
              waitForSecondaryZygote(socketName);
          }
728
          zygoteServer.closeServerSocket();
          return handleSystemServerProcess(parsedArgs);
      }
732
      return null;
  }

在zygote的main方法中会执行循环操作，一方面保证zygote不退出，一方面监听是否有创建进程的消息

Runnable runSelectLoop(String abiList) {
      ArrayList<FileDescriptor> fds = new ArrayList<FileDescriptor>();
      ArrayList<ZygoteConnection> peers = new ArrayList<ZygoteConnection>();
176
      fds.add(mServerSocket.getFileDescriptor());
      peers.add(null);
179
      while (true) {
          StructPollfd[] pollFds = new StructPollfd[fds.size()];
          for (int i = 0; i < pollFds.length; ++i) {
              pollFds[i] = new StructPollfd();
              pollFds[i].fd = fds.get(i);
              pollFds[i].events = (short) POLLIN;
          }
          try {
                   //处理轮询状态，当pollFds有事件到来则往下执行，否则阻塞在这里,我也没太看懂这个地方
                   //暂且理解为类似loop那种机制吧，如果有客户端请求就会向下走
              Os.poll(pollFds, -1);
          } catch (ErrnoException ex) {
              throw new RuntimeException("poll failed", ex);
          }
          for (int i = pollFds.length - 1; i >= 0; --i) {
              if ((pollFds[i].revents & POLLIN) == 0) {
                  continue;
              }
196
              if (i == 0) {
                    即fds[0]，代表的是sServerSocket，则意味着有客户端连接请求；
                    // 则创建ZygoteConnection对象,并添加到fds。
                  ZygoteConnection newPeer = acceptCommandPeer(abiList);
                  peers.add(newPeer);
                  fds.add(newPeer.getFileDesciptor());
              } else {
                  try {
                      ZygoteConnection connection = peers.get(i);
                           会调用到Zygote里面的方法 Zygote.forkAndSpecialize,
                           nativeForkAndSpecialize
                      final Runnable command = connection.processOneCommand(this);
205
                      if (mIsForkChild) {
                          // We're in the child. We should always have a command to run at this
                          // stage if processOneCommand hasn't called "exec".
                          if (command == null) {
                              throw new IllegalStateException("command == null");
                          }
212
                          return command;
                      } else {
                          // We're in the server - we should never have any commands to run.
                          if (command != null) {
                              throw new IllegalStateException("command != null");
                          }
219
                          // We don't know whether the remote side of the socket was closed or
                          // not until we attempt to read from it from processOneCommand. This shows up as
                          // a regular POLLIN event in our regular processing loop.
                          if (connection.isClosedByPeer()) {
                              connection.closeSocket();
                              peers.remove(i);
                              fds.remove(i);
                          }
                      }
                  } catch (Exception e) {
                      if (!mIsForkChild) {
                          // We're in the server so any exception here is one that has taken place
                          // pre-fork while processing commands or reading / writing from the
                          // control socket. Make a loud noise about any such exceptions so that
                          // we know exactly what failed and why.
235
                          Slog.e(TAG, "Exception executing zygote command: ", e);
237
                          // Make sure the socket is closed so that the other end knows immediately
                          // that something has gone wrong and doesn't time out waiting for a
                          // response.
                          ZygoteConnection conn = peers.remove(i);
                          conn.closeSocket();
243
                          fds.remove(i);
                      } else {
                          // We're in the child so any exception caught here has happened post
                          // fork and before we execute ActivityThread.main (or any other main()
                          // method). Log the details of the exception and bring down the process.
                          Log.e(TAG, "Caught post-fork exception in child process.", e);
                          throw e;
                      }
                  } finally {
                      // Reset the child flag, in the event that the child process is a child-
                      // zygote. The flag will not be consulted this loop pass after the Runnable
                      // is returned.
                      mIsForkChild = false;
                  }
              }
          }
      }
  }

总结部分

这里引用gityuan先生的图
avatar

然后这个地方总结的很好:

解析init.zygote.rc中的参数，创建AppRuntime并调用AppRuntime.start()方法；
调用AndroidRuntime的startVM()方法创建虚拟机，再调用startReg()注册JNI函数；
通过JNI方式调用ZygoteInit.main()，第一次进入Java世界；
registerZygoteSocket()建立socket通道，zygote作为通信的服务端，用于响应客户端请求；
preload()预加载通用类、drawable和color资源、openGL以及共享库以及WebView，用于提高app启动效率；
zygote完毕大部分工作，接下来再通过startSystemServer()，fork得力帮手system_server进程，也是上层framework的运行载体。
zygote功成身退，调用runSelectLoop()，随时待命，当接收到请求创建新进程请求时立即唤醒并执行相应工作。

在次感谢gityuan先生。

Read All

Android 开机启动流程至Launcher init篇(一)

2019-09-10

Android

开机启动

前言
1. 下面是整个流程图
具体的细节流程
- 1.1 kernel是怎么初始化init进程的,
- 1.2 init 进程

前言

对于Android的开机流程，不管是做为App开发者还是Framework开发者都应该了解的，做为App开发者来说
了解关于系统的开机流程, 对App的开发也是大有裨益的,对于bug的解决定位更快捷点. 所以我们一起来学习
下系统的开机流程.

1. 下面是整个流程图

avatar

具体的细节流程

1.1 kernel是怎么初始化init进程的,

avatar 可以看到是通过do_execve方法来开启了一个新的进程源码部分:: http://androidxref.com/kernel_3.18/xref/init/main.c#run_init_process

关于内核靠下部分，内核部分初始化了好多驱动的操作以及一些cpu的配置操作，我也是看了个大概就不拿出来现丑了.

查看kernel log的方法，启动后进入adb模式,然后命令:: dmesg

1.2 init 进程

然后我们可以看到从kernel的kernel_init方法里面启动一个进程就是init进程，就是手机根目录下的init可执行程序

一切都始于init，bootloader 加载了内核，内核启动了init 进程。Linux系统中的init进程(pid=1)是除了idle进程(pid=0，也就是init_task)之外另一个比较特殊的进程，它是Linux内核开始建立起进程概念时第一个通过kernel_thread产生的进程，其开始在内核态执行，然后通过一个系统调用，开始执行用户空间的/sbin/init程序，期间Linux内核也经历了从内核态到用户态的特权级转变，然后所有的用户进程都有该进程派生出来。

init进程的源代码位于system/core/init http://androidxref.com/9.0.0_r3/xref/system/core/init/init.cpp
查看mk文件得到编译生成的bin路径: LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)

int main(int argc, char** argv) {
546    if (!strcmp(basename(argv[0]), "ueventd")) {
           //创建设备节点,在这里会解析, ueventd.rc
           //ueventd.rc 这个文件里面会有设备节点,类似dev/
547        return ueventd_main(argc, argv);
548    }
549
550    if (!strcmp(basename(argv[0]), "watchdogd")) {
           //watchdogd俗称看门狗，用于系统出问题时重启系统
551        return watchdogd_main(argc, argv);
552    }
553
554    if (argc > 1 && !strcmp(argv[1], "subcontext")) {
555        InitKernelLogging(argv);
556        const BuiltinFunctionMap function_map;
557        return SubcontextMain(argc, argv, &function_map);
558    }
559
560    if (REBOOT_BOOTLOADER_ON_PANIC) {
            //初始化重启系统的处理信号，内部通过sigaction 注册信号，当监听到该信号时重启系统
561        InstallRebootSignalHandlers();
562    }
563
564    bool is_first_stage = (getenv("INIT_SECOND_STAGE") == nullptr);
565     //第一阶段:: 这个时候为true，
        //挂载文件系统并创建目录
566    if (is_first_stage) {
567        boot_clock::time_point start_time = boot_clock::now();
568
569        // Clear the umask.
570        umask(0);
571
572        clearenv();
573        setenv("PATH", _PATH_DEFPATH, 1);
574        // Get the basic filesystem setup we need put together in the initramdisk
575        // on / and then we'll let the rc file figure out the rest.
576        mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755");
577        mkdir("/dev/pts", 0755);
578        mkdir("/dev/socket", 0755);
579        mount("devpts", "/dev/pts", "devpts", 0, NULL);
580        #define MAKE_STR(x) __STRING(x)
581        mount("proc", "/proc", "proc", 0, "hidepid=2,gid=" MAKE_STR(AID_READPROC));
582        // Don't expose the raw commandline to unprivileged processes.
583        chmod("/proc/cmdline", 0440);
584        gid_t groups[] = { AID_READPROC };
585        setgroups(arraysize(groups), groups);
586        mount("sysfs", "/sys", "sysfs", 0, NULL);
587        mount("selinuxfs", "/sys/fs/selinux", "selinuxfs", 0, NULL);
588
589        mknod("/dev/kmsg", S_IFCHR | 0600, makedev(1, 11));
590
591        if constexpr (WORLD_WRITABLE_KMSG) {
592            mknod("/dev/kmsg_debug", S_IFCHR | 0622, makedev(1, 11));
593        }
594				 //mknod mknod用于创建Linux中的设备文件
					 path：设备所在目录
					 mode：指定设备的类型和读写访问标志
					 可能的类型

					 S_IFMT	type of file ，文件类型掩码
					 S_IFREG	regular 普通文件
					 S_IFBLK	block special 块设备文件
					 S_IFDIR	directory 目录文件
					 S_IFCHR	character special 字符设备文件
					 S_IFIFO	fifo 管道文件
					 S_IFNAM	special named file 特殊文件
					 S_IFLNK	symbolic link 链接文件

595        mknod("/dev/random", S_IFCHR | 0666, makedev(1, 8));
596        mknod("/dev/urandom", S_IFCHR | 0666, makedev(1, 9));
597
598        // Mount staging areas for devices managed by vold
599        // See storage config details at http://source.android.com/devices/storage/
           //mount属于Linux系统调用
					 mount 命令参数：

					 source：将要挂上的文件系统，通常是一个设备名。
					 target：文件系统所要挂载的目标目录。
					 filesystemtype：文件系统的类型，可以是"ext2"，"msdos"，"proc"，"ntfs"，"iso9660"。

600        mount("tmpfs", "/mnt", "tmpfs", MS_NOEXEC | MS_NOSUID | MS_NODEV,
601              "mode=0755,uid=0,gid=1000");
602        // /mnt/vendor is used to mount vendor-specific partitions that can not be
603        // part of the vendor partition, e.g. because they are mounted read-write.

					 //mkdir也是Linux系统调用，作用是创建目录，第一个参数是目录路径，第二个是读写权限
604        mkdir("/mnt/vendor", 0755);
605
606        // Now that tmpfs is mounted on /dev and we have /dev/kmsg, we can actually
607        // talk to the outside world...
608        InitKernelLogging(argv);
609
610        LOG(INFO) << "init first stage started!";
611
612        if (!DoFirstStageMount()) {
613            LOG(FATAL) << "Failed to mount required partitions early ...";
614        }
615
616        SetInitAvbVersionInRecovery();
617
618        // Enable seccomp if global boot option was passed (otherwise it is enabled in zygote).
619        global_seccomp();
620
621        // Set up SELinux, loading the SELinux policy.
622        SelinuxSetupKernelLogging();
623        SelinuxInitialize();
624
625        // We're in the kernel domain, so re-exec init to transition to the init domain now
626        // that the SELinux policy has been loaded.
627        if (selinux_android_restorecon("/init", 0) == -1) {
628            PLOG(FATAL) << "restorecon failed of /init failed";
629        }
630				 //设置第二阶段的变量
631        setenv("INIT_SECOND_STAGE", "true", 1);
632
633        static constexpr uint32_t kNanosecondsPerMillisecond = 1e6;
634        uint64_t start_ms = start_time.time_since_epoch().count() / kNanosecondsPerMillisecond;
635        setenv("INIT_STARTED_AT", std::to_string(start_ms).c_str(), 1);
636
637        char* path = argv[0];
638        char* args[] = { path, nullptr };
					 //重新执行main函数, exec是函数族提供了一个在进程中执行另一个进程的方法
639        execv(path, args);
640
641        // execv() only returns if an error happened, in which case we
642        // panic and never fall through this conditional.
643        PLOG(FATAL) << "execv(\"" << path << "\") failed";
644    }
645
646    // At this point we're in the second stage of init.

       把log写入dev/kmsg中
647    InitKernelLogging(argv);
648    LOG(INFO) << "init second stage started!";
649
650    // Set up a session keyring that all processes will have access to. It
651    // will hold things like FBE encryption keys. No process should override
652    // its session keyring.
653    keyctl_get_keyring_ID(KEY_SPEC_SESSION_KEYRING, 1);
654
655    // Indicate that booting is in progress to background fw loaders, etc.
656    close(open("/dev/.booting", O_WRONLY | O_CREAT | O_CLOEXEC, 0000));
657
658    property_init();
659
660    // If arguments are passed both on the command line and in DT,
661    // properties set in DT always have priority over the command-line ones.
662    process_kernel_dt();
663    process_kernel_cmdline();
664
665    // Propagate the kernel variables to internal variables
666    // used by init as well as the current required properties.
667    export_kernel_boot_props();
668
669    // Make the time that init started available for bootstat to log.
670    property_set("ro.boottime.init", getenv("INIT_STARTED_AT"));
671    property_set("ro.boottime.init.selinux", getenv("INIT_SELINUX_TOOK"));
672
673    // Set libavb version for Framework-only OTA match in Treble build.
674    const char* avb_version = getenv("INIT_AVB_VERSION");
675    if (avb_version) property_set("ro.boot.avb_version", avb_version);
676
			 //清除所设置的变量
677    // Clean up our environment.
678    unsetenv("INIT_SECOND_STAGE");
679    unsetenv("INIT_STARTED_AT");
680    unsetenv("INIT_SELINUX_TOOK");
681    unsetenv("INIT_AVB_VERSION");
682
683    // Now set up SELinux for second stage.
684    SelinuxSetupKernelLogging();
685    SelabelInitialize();
686    SelinuxRestoreContext();
687
688    epoll_fd = epoll_create1(EPOLL_CLOEXEC);
689    if (epoll_fd == -1) {
690        PLOG(FATAL) << "epoll_create1 failed";
691    }
692
693    sigchld_handler_init();
694
695    if (!IsRebootCapable()) {
696        // If init does not have the CAP_SYS_BOOT capability, it is running in a container.
697        // In that case, receiving SIGTERM will cause the system to shut down.
698        InstallSigtermHandler();
699    }
700
701    property_load_boot_defaults();
702    export_oem_lock_status();
703    start_property_service();
704    set_usb_controller();
705
706    const BuiltinFunctionMap function_map;
707    Action::set_function_map(&function_map);
708
709    subcontexts = InitializeSubcontexts();
710
711    ActionManager& am = ActionManager::GetInstance();
712    ServiceList& sm = ServiceList::GetInstance();
713
			 //解析init文件,init.rc文件,然后根据文件里面的配置来启动进程native或者service
			 //一般情况下这些service是daemon 也就是守护进程
714    LoadBootScripts(am, sm);
715
716    // Turning this on and letting the INFO logging be discarded adds 0.2s to
717    // Nexus 9 boot time, so it's disabled by default.
718    if (false) DumpState();
719
720    am.QueueEventTrigger("early-init");
721
722    // Queue an action that waits for coldboot done so we know ueventd has set up all of /dev...
723    am.QueueBuiltinAction(wait_for_coldboot_done_action, "wait_for_coldboot_done");
724    // ... so that we can start queuing up actions that require stuff from /dev.
725    am.QueueBuiltinAction(MixHwrngIntoLinuxRngAction, "MixHwrngIntoLinuxRng");
726    am.QueueBuiltinAction(SetMmapRndBitsAction, "SetMmapRndBits");
727    am.QueueBuiltinAction(SetKptrRestrictAction, "SetKptrRestrict");
728    am.QueueBuiltinAction(keychord_init_action, "keychord_init");
729    am.QueueBuiltinAction(console_init_action, "console_init");
730
731    // Trigger all the boot actions to get us started.
732    am.QueueEventTrigger("init");
733
734    // Repeat mix_hwrng_into_linux_rng in case /dev/hw_random or /dev/random
735    // wasn't ready immediately after wait_for_coldboot_done
736    am.QueueBuiltinAction(MixHwrngIntoLinuxRngAction, "MixHwrngIntoLinuxRng");
737
738    // Don't mount filesystems or start core system services in charger mode.
739    std::string bootmode = GetProperty("ro.bootmode", "");
740    if (bootmode == "charger") {
741        am.QueueEventTrigger("charger");
742    } else {
743        am.QueueEventTrigger("late-init");
744    }
745
746    // Run all property triggers based on current state of the properties.
747    am.QueueBuiltinAction(queue_property_triggers_action, "queue_property_triggers");
748
       //进入loop循环，保证init进程不会退出
749    while (true) {
750        // By default, sleep until something happens.
751        int epoll_timeout_ms = -1;
752
753        if (do_shutdown && !shutting_down) {
754            do_shutdown = false;
755            if (HandlePowerctlMessage(shutdown_command)) {
756                shutting_down = true;
757            }
758        }
759
760        if (!(waiting_for_prop || Service::is_exec_service_running())) {
761            am.ExecuteOneCommand();
762        }
763        if (!(waiting_for_prop || Service::is_exec_service_running())) {
764            if (!shutting_down) {
765                auto next_process_restart_time = RestartProcesses();
766
767                // If there's a process that needs restarting, wake up in time for that.
768                if (next_process_restart_time) {
769                    epoll_timeout_ms = std::chrono::ceil<std::chrono::milliseconds>(
770                                           *next_process_restart_time - boot_clock::now())
771                                           .count();
772                    if (epoll_timeout_ms < 0) epoll_timeout_ms = 0;
773                }
774            }
775
776            // If there's more work to do, wake up again immediately.
777            if (am.HasMoreCommands()) epoll_timeout_ms = 0;
778        }
779
780        epoll_event ev;
781        int nr = TEMP_FAILURE_RETRY(epoll_wait(epoll_fd, &ev, 1, epoll_timeout_ms));
782        if (nr == -1) {
783            PLOG(ERROR) << "epoll_wait failed";
784        } else if (nr == 1) {
785            ((void (*)()) ev.data.ptr)();
786        }
787    }
788
789    return 0;
790}
791
792}  // namespace init
793}  // namesp

Read All

Android 屏幕适配方案

2019-09-06

Android

屏幕适配
- 一个很全的网站，有
- 为什么要屏幕适配
一个很全的网站，有

屏幕尺寸大全

为什么要屏幕适配
Read All
对Apache http client 引出来的一些思考

2019-09-06

Android

对Apache http client 引发的一些思考

#####

Read All
源码下调用Hiden Api以及对mk文件里面属性的一些思考

2019-09-05

Android

源码下调用Hiden Api以及对mk文件里面属性的一些思考
- 原因
- 美梦泡汤
原因

最近在做HIDL相关的工作，HIDL暂且不谈，现在我编译完HIDL的接口之后会给上层App
提供一个jar包，以供App来调用HIDL接口. 当时我的想法很简单，我编译完之后用studio来
引入jar包。然后我就可以美滋滋的调用了.

美梦泡汤

熟悉的在out/target/…目录下找到生成的jar包.add library. 在类里面直接引用jar包
里面的方法. 走起. run。。。。
Read All

2/6

Welcome to Sky's Blog!

Android 开机启动流程SystemServer上篇(三)

前言

3.1 forkSystemServer

3.2 nativeForkSystemServer

3.3 ForkAndSpecializeCommon

3.4 handleSystemServerProcess

3.5 zygoteInit

3.6 applicationInit

Android 开机启动流程至Launcher zygote篇(二)

2 zygote概述

2.1 zygote 启动

2.1 AndroidRuntime启动

2.2 startVm

2.3 startReg

2.4 register_jni_procs

2.5 zygote main方法执行

2.6 forkSystemServer方法

总结部分

Android 开机启动流程至Launcher init篇(一)

前言

1. 下面是整个流程图

具体的细节流程

1.1 kernel是怎么初始化init进程的,

1.2 init 进程

Android 屏幕适配方案

一个很全的网站，有

为什么要屏幕适配

对Apache http client 引出来的一些思考

源码下调用Hiden Api以及对mk文件里面属性的一些思考

原因

美梦泡汤