高通Android设备启动流程分析(从power-on上电到Home Lanucher启动)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

# system\core\init\init.c
int main(int argc, char **argv)
{.../* Get the basic filesystem setup we need put* together in the initramdisk on / and then we'll* let the rc file figure out the rest.*/mkdir("/dev", 0755);mkdir("/proc", 0755);mkdir("/sys", 0755);mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755");mkdir("/dev/pts", 0755);mkdir("/dev/socket", 0755);mount("devpts", "/dev/pts", "devpts", 0, NULL);mount("proc", "/proc", "proc", 0, NULL);mount("sysfs", "/sys", "sysfs", 0, NULL);...property_init(); // 初始化属性服务，主要为属性文件分配存储空间get_hardware_name(hardware, &revision); // 从虚拟文件/proc/cpuinfo中获取hardware及revision，后面init.rc中的hardware变量值从此获取process_kernel_cmdline(); // 导入命令行参数并用属性值设置内核变量， /proc/cmdline...selinux_initialize();// 初始化selinux安全机制init_parse_config_file("/init.rc"); // 解析init.rc文件，主要生成action和service链表/* 解析完init.rc配置文件后，会得到一系列的Action，action_for_each_trigger函数用来将Action加入action_queue，有关init.rc、action等内容下面再分析*/  action_for_each_trigger("early-init", action_add_queue_tail);  // 添加“early-init”actionqueue_builtin_action(wait_for_coldboot_done_action, "wait_for_coldboot_done");queue_builtin_action(mix_hwrng_into_linux_rng_action, "mix_hwrng_into_linux_rng");queue_builtin_action(keychord_init_action, "keychord_init");queue_builtin_action(console_init_action, "console_init");/* execute all the boot actions to get us started */action_for_each_trigger("init", action_add_queue_tail); // 添加“init”actionqueue_builtin_action(mix_hwrng_into_linux_rng_action, "mix_hwrng_into_linux_rng");queue_builtin_action(property_service_init_action, "property_service_init");  // 启动属性服务queue_builtin_action(signal_init_action, "signal_init");/* Don't mount filesystems or start core system services if in charger mode. */if (is_charger) {action_for_each_trigger("charger", action_add_queue_tail);} else {if (is_ffbm) {action_for_each_trigger("ffbm", action_add_queue_tail);} else {action_for_each_trigger("late-init", action_add_queue_tail); // 添加“late-init”action}}/* run all property triggers based on current state of the properties */queue_builtin_action(queue_property_triggers_action, "queue_property_triggers");for(;;) { // 无限循环，建立init子进程...execute_one_command(); // 执行节点command，zygote service也在此启动，稍后再详细分析restart_processes(); // 重启进程# 监听属性服务事件ufds[fd_count].fd = get_property_set_fd();ufds[fd_count].events = POLLIN; // 属性事件ufds[fd_count].fd = get_signal_fd();ufds[fd_count].events = POLLIN;  // 子进程事件ufds[fd_count].fd = get_keychord_fd();ufds[fd_count].events = POLLIN; // keychord热键事件...#if BOOTCHART// bootchart是一个性能统计工具，用于搜集硬件和系统的信息，并将其写入磁盘，以便其他程序使用
#endifnr = poll(ufds, fd_count, timeout); // 等待下一个命令提交# 处理具体消息handle_property_set_fd(); // 处理属性命令handle_keychord(); // adb使能时处理keychordhandle_signal(); // 处理子进程挂掉发来的信号，service重启...}

1
2
3
4

on  <trigger><command1><command2>......

1
2
3
4

service <name> <pathname> [<arguments>]*<option><option>......

1
2
3
4

import /init.environ.rc
import /init.usb.rc
import /init.${ro.hardware}.rc
import /init.trace.rc

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

# system\core\rootdir\init.rc# 导入相关.rc文件
import /init.environ.rc
import /init.usb.rc
import /init.${ro.hardware}.rc # hardware变量的值在上面讲的main函数中获取
import /init.${ro.zygote}.rc #导入zygote服务.rc脚本文件
import /init.trace.rc
import /init.ideanfc.preinstall.rcon early-init # 设置init进程以及它创建的子进程的优先级，设置init进程的安全环境
on init # 设置全局环境，为cpu accounting创建cgroup(资源控制)挂载点
...
# Load properties from /system/ + /factory after fs mount.
on load_all_props_actionload_all_propson late-inittrigger early-fs # 触发early-fs动作trigger fs # 触发fs动作，挂载mtd分区trigger post-fstrigger post-fs-datatrigger load_all_props_action...trigger early-boottrigger booton post-fs # 改变系统目录的访问权限
on post-fs-data # 改变/data目录以及它的子目录的访问权限
on boot # 初始化基本网络、内存管理等...chown radio system /sys/power/wake_lock // 修改文件用户组chown radio system /sys/power/wake_unlockchmod 0660 /sys/power/wake_lock // 修改文件操作权限chmod 0660 /sys/power/wake_unlock...class_start core # 开启核心服务service healthd /sbin/healthd # 电源管理服务
service servicemanager /system/bin/servicemanager # 系统服务管理器，管理所有的本地服务，比如位置、音频、Shared preference等等class core  # 声明为core核心服务user systemgroup systemcriticalonrestart restart healthd #重启电池管理服务onrestart restart zygote # 重启zygote服务作为应用进程, 定义在文件头import的zygote.rc脚本中onrestart restart media # 重启音频服务...

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# system\core\init\keywords.h
int do_chroot(int nargs, char **args); //对应于KEYWORD最后一个参数
int do_chdir(int nargs, char **args);
...
int do_write(int nargs, char **args);
int do_copy(int nargs, char **args);
int do_chown(int nargs, char **args);
int do_chmod(int nargs, char **args);
...
KEYWORD(capability,  OPTION,  0, 0)
KEYWORD(chdir,       COMMAND, 1, do_chdir)
KEYWORD(chroot,      COMMAND, 1, do_chroot)
KEYWORD(class,       OPTION,  0, 0)
KEYWORD(class_start, COMMAND, 1, do_class_start)
KEYWORD(class_stop,  COMMAND, 1, do_class_stop)
KEYWORD(class_reset, COMMAND, 1, do_class_reset)
KEYWORD(console,     OPTION,  0, 0)
...
KEYWORD(user,        OPTION,  0, 0)
KEYWORD(wait,        COMMAND, 1, do_wait)
KEYWORD(write,       COMMAND, 2, do_write)
KEYWORD(copy,        COMMAND, 2, do_copy)
KEYWORD(chown,       COMMAND, 2, do_chown)
KEYWORD(chmod,       COMMAND, 2, do_chmod)
...

1
2
3
4
5
6
7
8
9
10
11

# system\core\init\init.c
init_parse_config_file("/init.rc"); // 解析init.rc文件data = read_file(fn, 0);parse_config(fn, data); // 真正的解析函数# system\core\init\init_parser.c ，被parse_config调用
lookup_keyword() //查找关键字
kw_is() // 一个宏，查表lookup_keyword返回关键字，对应上keywords.h中的KEYWORD
parse_new_section() // section起始行，解析service、on小节，import小节汇成一个链表
state.parse_line() // 从属于section的子行
init_parse_config_file(import->filename) //解析import小节

1

class core # 声明section为core服务
class main # 声明section为main服务

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

# system\core\init\property_service.c
void start_property_service(void)
const char* property_get(const char *name)# bionic/libc/bionic/system_properties.c
const prop_info *__system_property_find(const char *name)
static int init_property_area(void)
static int send_prop_msg(prop_msg *msg)
int __system_property_set(const char *key, const char *value)# bionic\libc\include\sys\_system_properties.h ,定义了相关属性文件
#define PROP_PATH_RAMDISK_DEFAULT  "/default.prop"
#define PROP_PATH_SYSTEM_BUILD     "/system/build.prop"
#define PROP_PATH_SYSTEM_DEFAULT   "/system/default.prop"
#define PROP_PATH_VENDOR_BUILD     "/vendor/build.prop"
#define PROP_PATH_LOCAL_OVERRIDE   "/data/local.prop"
#define PROP_PATH_FACTORY          "/factory/factory.prop"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

# 获取所有属性值
C:\Users\Administrator>adb shell
shell@msm8916_32:/ $ getprop
getprop
[DEVICE_PROVISIONED]: [1]
[audio.dolby.ds2.enabled]: [true]
[audio.offload.buffer.size.kb]: [64]
[audio.offload.gapless.enabled]: [true]
[audio.offload.min.duration.secs]: [30]
[av.offload.enable]: [true]
[bluetooth.hfp.client]: [1]
...# 获取指定属性具体属性值
shell@msm8916_32:/ $ getprop ro.build.product
getprop ro.build.product
msm8916_32

1
2
3
4
5
6
7

service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server # 此处定义了启动zygote时会启动那些进程class mainsocket zygote stream 660 root systemonrestart write /sys/android_power/request_state wakeonrestart write /sys/power/state ononrestart restart mediaonrestart restart netd

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

# system\core\init\builtins.c
int do_class_start(int nargs, char **args)
{/* Starting a class does not start services* which are explicitly disabled.  They must* be started individually.*/service_for_each_class(args[1], service_start_if_not_disabled); // 从service_list链表找到class_name和参数一致的，然后调用service_start_if_not_disabled启动服务return 0;
}static void service_start_if_not_disabled(struct service *svc)
{if (!(svc->flags & SVC_DISABLED)) {service_start(svc, NULL);  //启动服务} else {svc->flags |= SVC_DISABLED_START;}
}# system\core\init\init.c
void service_start(struct service *svc, const char *dynamic_args)
{.../* 检查需要开启进程的可执行文件是否存在，如：Zygote路径/system/bin/app_process */if (stat(svc->args[0], &s) != 0) {ERROR("cannot find '%s', disabling '%s'\n", svc->args[0], svc->name);svc->flags |= SVC_DISABLED;return;}...pid = fork(); // 创建子进程，父进程为init创建的service进程...execve(svc->args[0], (char**) arg_ptrs, (char**) ENV); // 执行进程，如/system/bin/app_process...if (properties_inited())notify_service_state(svc->name, "running"); // 设置服务为running状态
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

# frameworks\base\cmds\app_process\app_main.cpp
int main(int argc, char* const argv[])
{...AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));...if (zygote) {runtime.start("com.android.internal.os.ZygoteInit", args);}...
}# frameworks\base\core\jni\AndroidRuntime.cpp
/* 开始Android运行， 打开虚拟机，调用"static void main(String[] args)"*/
void AndroidRuntime::start(const char* className, const Vector<String8>& options)
{.../* start the virtual machine */JniInvocation jni_invocation;jni_invocation.Init(NULL);JNIEnv* env;if (startVm(&mJavaVM, &env) != 0) {return;}onVmCreated(env);.../** Register android functions.*/if (startReg(env) < 0) {ALOGE("Unable to register all android natives\n");return;}.../** Start VM.  This thread becomes the main thread of the VM, and will* not return until the VM exits.*/char* slashClassName = toSlashClassName(className);jclass startClass = env->FindClass(slashClassName);jmethodID startMeth = env->GetStaticMethodID(startClass, "main","([Ljava/lang/String;)V"); //获取静态main方法env->CallStaticVoidMethod(startClass, startMeth, strArray); // 调用main方法

1
2
3
4
5
6
7
8
9
10
11
12
13

# frameworks\base\core\java\com\android\internal\os\ZygoteInit.java
public static void main(String argv[]) {// Start profiling the zygote initialization.SamplingProfilerIntegration.start();...registerZygoteSocket(socketName);  // 为Zygote注册服务器套接字（server socket）...preload(); // 调用preloadClassed()：加载一系列类的文本文件（“preloaded-classes”），位于/frameworks/base调用preloadResources():  加载本地主题、布局以及android.R文件中包含的所有东西...startSystemServer(abiList, socketName); // 准备参数，通过Zygote孵化新 system server 进程runSelectLoop(abiList); // 运行Zygote进程选中的loop，此函数中不断接受新的connections，并读取command执行...

1
2
3
4
5
6
7
8
9
10

# system\core\init\init.c
queue_builtin_action(signal_init_action, "signal_init"); //main函数中
static int signal_init_action(int nargs, char **args) //此函数调用singal_init# system\core\init\signal_handler.c
void signal_init(void)
static void sigchld_handler(int s)
int get_signal_fd()
void handle_signal(void)
static int wait_for_one_process(int block) // 此函数中将发出restarting信号，然后init.c中的main函数收到此信号后将重启相应进程

1
2
3
4
5
6
7
8
9
10
11

# frameworks\base\services\java\com\android\server\SystemServer.java
# frameworks\base\services\core\java\com\android\server\am\ActivityManagerService.java
public void systemReady(final Runnable goingCallback) {// Start up initial activity.mBooting = true;startHomeActivityLocked(mCurrentUserId, "systemReady");
}
boolean startHomeActivityLocked(int userId, String reason) {setDefaultLauncher(); // 第一次开机时设置mStackSupervisor.startHomeActivity(intent, aInfo, reason); // 开启homeActivity
}