开机启动概述：
- step 1: 上电开机
长按power键后引导芯片开始从固化在ROM的预设代码处执行，加载引导程序(BootLoader)到RAM. - step 2: BootLoader启动
跳转到BootLoader的入口函数，开始执行BootLoader的代码.
硬件初始化工作(硬件时钟、手机的主板等)
完成初始化uart端口的操作
arch_init
target_init
apps_init
aboot_init
跳转到内核入口函数start_kernel，启动内核. - step 3: kernel 启动
输出Linux版本信息（printk(linux_banner)）
设置与体系结构相关的环境（setup_arch()）
页表结构初始化（paging_init()）
使用"arch/alpha/kernel/entry.S"中的入口点设置系统自陷入口（trap_init()）
使用alpha_mv结构和entry.S入口初始化系统IRQ（init_IRQ()）
核心进程调度器初始化（包括初始化几个缺省的Bottom-half，sched_init()）
时间、定时器初始化（包括读取CMOS时钟、估测主频、初始化定时器中断等，time_init()）
提取并分析核心启动参数（从环境变量中读取参数，设置相应标志位等待处理，（parse_options()）
控制台初始化（为输出信息而先于PCI初始化，console_init()）
剖析器数据结构初始化（prof_buffer和prof_len变量）
核心Cache初始化（描述Cache信息的Cache，kmem_cache_init()）
延迟校准（获得时钟jiffies与CPU主频ticks的延迟，calibrate_delay()）
内存初始化（设置内存上下界和页表项初始值，mem_init()）
创建和设置内部及通用cache（“slab_cache”，kmem_cache_sizes_init()）
创建uid taskcount SLAB cache（“uid_cache”，uidcache_init()）
创建文件cache（“files_cache”，filescache_init()）
创建目录cache（“dentry_cache”，dcache_init()）
创建与虚存相关的cache（“vm_area_struct”，“mm_struct”，vma_init()）
块设备读写缓冲区初始化（同时创建"buffer_head"cache用户加速访问，buffer_init()）
创建页cache（内存页hash表初始化，page_cache_init()）
创建信号队列cache（“signal_queue”，signals_init()）
初始化内存inode表（inode_init()）
创建内存文件描述符表（“filp_cache”，file_table_init()）
检查体系结构漏洞（对于alpha，此函数为空，check_bugs()）
SMP机器其余CPU（除当前引导CPU）初始化（对于没有配置SMP的内核，此函数为空，smp_init()）
启动init过程（创建第一个核心线程，调用init()函数，原执行序列调用cpu_idle() 等待调度， init()） - step4: init 启动
创建文件系统目录并挂载相关的文件系统
初始化log系统
初始化/设置/启动属性相关的资源
完成SELinux相关工作
装载子进程信号处理器
解析init.rc
atcion/service管理
执行action和启动service，包括启动zygote - step5: zygote进程启动
app_process64 启动
AndroidRuntime 启动
art 启动和初始化
zygote init 启动
启动system_server - step 6: system_server启动
初始化和启动framework service
启动常驻进程
启动Home Activity
详细启动过程记录
1.init进程启动 执行init main入口
//system/core/init/main.cpp
int main(int argc, char** argv) {
#if __has_feature(address_sanitizer)
__asan_set_error_report_callback(AsanReportCallback);
#endif
// Boost prio which will be restored later
setpriority(PRIO_PROCESS, 0, -20);
if (!strcmp(basename(argv[0]), "ueventd")) {
return ueventd_main(argc, argv);// init进程创建子进程ueventd，负责设备节点的创建、权限设定等一些列工作
}
if (argc > 1) {
if (!strcmp(argv[1], "subcontext")) {
android::base::InitLogging(argv, &android::base::KernelLogger);
const BuiltinFunctionMap& function_map = GetBuiltinFunctionMap();
return SubcontextMain(argc, argv, &function_map);// 初始化日志系统
}
if (!strcmp(argv[1], "selinux_setup")) {
return SetupSelinux(argv);//初始化Linux安全策略
}
if (!strcmp(argv[1], "second_stage")) {
return SecondStageMain(argc, argv);//执行第二阶段启动
}
}
return FirstStageMain(argc, argv);//执行第一阶段启动
}
2.执行第一启动阶段
主要是创建文件系统并执行挂载相关分区
//system/core/init/first_stage_main.cpp
int FirstStageMain(int argc, char** argv) {
CHECKCALL(mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755"));// 挂载tmpfs分区
CHECKCALL(mkdir("/dev/pts", 0755));
CHECKCALL(mkdir("/dev/socket", 0755));// 创建dev/socket设备节点
CHECKCALL(mkdir("/dev/dm-user", 0755));
CHECKCALL(mount("devpts", "/dev/pts", "devpts", 0, NULL));// 挂载devpts分区
CHECKCALL(chmod("/proc/cmdline", 0440));
...
CHECKCALL(mount("sysfs", "/sys", "sysfs", 0, NULL));// 挂载sysfs分区
CHECKCALL(mount("selinuxfs", "/sys/fs/selinux", "selinuxfs", 0, NULL));// 挂载selinuxfs分区
CHECKCALL(mknod("/dev/kmsg", S_IFCHR | 0600, makedev(1, 11)));
...
CHECKCALL(mount("tmpfs", "/mnt", "tmpfs", MS_NOEXEC | MS_NOSUID | MS_NODEV,
"mode=0755,uid=0,gid=1000"));
CHECKCALL(mkdir("/mnt/vendor", 0755));
CHECKCALL(mkdir("/mnt/product", 0755));
...
const char* path = "/system/bin/init";
const char* args[] = {path, "selinux_setup", nullptr};
auto fd = open("/dev/kmsg", O_WRONLY | O_CLOEXEC);// 提前创建了kmsg设备节点文件，用于输出log信息
dup2(fd, STDOUT_FILENO);
dup2(fd, STDERR_FILENO);
close(fd);
execv(path, const_cast<char**>(args));
return 1;
}
3.执行第二启动阶段
主要初始化属性及启动属性服务，读取init.rc启动相关进程
int SecondStageMain(int argc, char** argv) {
if (REBOOT_BOOTLOADER_ON_PANIC) {
InstallRebootSignalHandlers();//用于init进程崩溃时，启动bootloader，让开发者定位问题
}
boot_clock::time_point start_time = boot_clock::now();
trigger_shutdown = [](const std::string& command) { shutdown_state.TriggerShutdown(command); };
SetStdioToDevNull(argv);
InitKernelLogging(argv);
...
PropertyInit();// 初始化属性系统，并从指定文件读取属性
UmountSecondStageRes();
MountExtraFilesystems();
SelinuxSetupKernelLogging();
SelabelInitialize();
SelinuxRestoreContext();
Epoll epoll;//新建epoll
if (auto result = epoll.Open(); !result.ok()) {
PLOG(FATAL) << result.error();
}
InstallSignalFdHandler(&epoll); //设置子进程退出的信号处理
InstallInitNotifier(&epoll); //设置属性更改的通知
StartPropertyService(&property_fd); // 设置其他系统属性并开启系统属性服务
...
InitializeSubcontext();
ActionManager& am = ActionManager::GetInstance();
ServiceList& sm = ServiceList::GetInstance();
LoadBootScripts(am, sm);// 解析init.rc等文件，建立rc文件的action 、service，启动其他进程
...
return 0;
}
static void LoadBootScripts(ActionManager& action_manager, ServiceList& service_list) {
Parser parser = CreateParser(action_manager, service_list);//创建解析器
std::string bootscript = GetProperty("ro.boot.init_rc", "");
if (bootscript.empty()) {
parser.ParseConfig("/system/etc/init/hw/init.rc");
if (!parser.ParseConfig("/system/etc/init")) {
late_import_paths.emplace_back("/system/etc/init");
}
// late_import is available only in Q and earlier release. As we don't
// have system_ext in those versions, skip late_import for system_ext.
parser.ParseConfig("/system_ext/etc/init");
if (!parser.ParseConfig("/vendor/etc/init")) {
late_import_paths.emplace_back("/vendor/etc/init");
}
if (!parser.ParseConfig("/odm/etc/init")) {
late_import_paths.emplace_back("/odm/etc/init");
}
if (!parser.ParseConfig("/product/etc/init")) {
late_import_paths.emplace_back("/product/etc/init");
}
} else {
parser.ParseConfig(bootscript);
}
}
init.rc相关语法参考 init.rc android官方文档
4.init.rc触发启动zygote进程
//system/core/rootdir/init.rc
import /system/etc/init/hw/init.${ro.zygote}.rc
...
on property:vold.decrypt=trigger_post_fs_data
trigger post-fs-data
trigger zygote-start
...
on zygote-start && property:ro.crypto.state=encrypted && property:ro.crypto.type=file
wait_for_prop odsign.verification.done 1
# A/B update verifier that marks a successful boot.
exec_start update_verifier_nonencrypted
start statsd
start netd
start zygote
start zygote_secondary
...
${ro.zygote}的取值有4种，在init.rc的同级目录system/core/rootdir/下，可以看到4个Zygote相关的配置文件，表示系统所支持程序的bit位数：
//system/core/rootdir/init.zygote64.rc
service zygote /system/bin/app_process64 -Xzygote /system/bin --zygote --start-system-server
class main
priority -20
user root
group root readproc reserved_disk
socket zygote stream 660 root system
socket usap_pool_primary stream 660 root system
onrestart exec_background - system system -- /system/bin/vdc volume abort_fuse
onrestart write /sys/power/state on
onrestart restart audioserver
onrestart restart cameraserver
onrestart restart media
onrestart restart netd
onrestart restart wificond
writepid /dev/cpuset/foreground/tasks
critical window=${zygote.critical_window.minute:-off} target=zygote-fatal
第一行中，service表示Zygote进程以服务的形式来启动，zygote则是进程的名字， /system/bin/app_process64是执行程序的路径，后面几项则是传给执行程序的参数，其中--start-system-server表示在Zygote进程启动后需要启动system_server进程。然后是Zygote进程是使用socket来进行跨进程通信的，所以会创建一个名为zygote的socket，660表示访问权限rw-rw----，表示文件拥有者和同一群组用户具有读写权限。
init进程启动后，通过fork和execv来启动Zygote进程，如下简化代码所示
//system/core/init/service.cpp
Result<void> Service::Start() {
...
pid_t pid = -1;
if (namespaces_.flags) {
pid = clone(nullptr, nullptr, namespaces_.flags | SIGCHLD, nullptr);
} else {
pid = fork();
}
if (pid == 0) {
umask(077);
...
if (!ExpandArgsAndExecv(args_, sigstop_)) {
PLOG(ERROR) << "cannot execv('" << args_[0]
<< "'). See the 'Debugging init' section of init's README.md for tips";
}
_exit(127);
}
...
}
...
static bool ExpandArgsAndExecv(const std::vector<std::string>& args, bool sigstop) {
std::vector<std::string> expanded_args;
std::vector<char*> c_strings;
expanded_args.resize(args.size());
c_strings.push_back(const_cast<char*>(args[0].data()));
for (std::size_t i = 1; i < args.size(); ++i) {
auto expanded_arg = ExpandProps(args[i]);
if (!expanded_arg.ok()) {
LOG(FATAL) << args[0] << ": cannot expand arguments': " << expanded_arg.error();
}
expanded_args[i] = *expanded_arg;
c_strings.push_back(expanded_args[i].data());
}
c_strings.push_back(nullptr);
if (sigstop) {
kill(getpid(), SIGSTOP);
}
return execv(c_strings[0], c_strings.data()) == 0;
}
5.执行app_process的main入口
//frameworks/base/cmds/app_process/app_main.cpp
int main(int argc, char* const argv[])
{
AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));
...组装参数
// Parse runtime arguments. Stop at first unrecognized option.
bool zygote = false;
bool startSystemServer = false;
bool application = false;
String8 niceName;
String8 className;
++i; // Skip unused "parent dir" argument.
while (i < argc) {
const char* arg = argv[i++];
if (strcmp(arg, "--zygote") == 0) {
zygote = true; // 参数标识启动zygote进程
niceName = ZYGOTE_NICE_NAME;
} else if (strcmp(arg, "--start-system-server") == 0) {
startSystemServer = true; // 参数标识启动system_server进程
} else if (strcmp(arg, "--application") == 0) {
application = true;
} else if (strncmp(arg, "--nice-name=", 12) == 0) {
niceName.setTo(arg + 12);
} else if (strncmp(arg, "--", 2) != 0) {
className.setTo(arg);
break;
} else {
--i;
break;
}
}
...
if (!niceName.isEmpty()) {
runtime.setArgv0(niceName.string(), true /* setProcName */);
}
if (zygote) {
//启动Zygote，进入ZygoteInit.main函数
runtime.start("com.android.internal.os.ZygoteInit", args, zygote); //通过jni的注册：frameworks/base/core/jni/com_android_internal_os_ZygoteInit.cpp 调Java层
} else if (className) {
runtime.start("com.android.internal.os.RuntimeInit", args, zygote); //通过jni的注册：frameworks/base/core/jni/AndroidRuntime.cpp 调Java层
} else {
app_usage();
}
}
6.Runtime启动，启动虚拟机，注册jni，进入java层执行ZygoteInit的main
//frameworks/base/cmds/app_process/app_main.cpp
void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
{
static const String8 startSystemServer("start-system-server");
// Whether this is the primary zygote, meaning the zygote which will fork system server.
bool primary_zygote = false;
/* start the virtual machine */
JniInvocation jni_invocation;
jni_invocation.Init(NULL);
JNIEnv* env;
if (startVm(&mJavaVM, &env, zygote, primary_zygote) != 0) { //启动虚拟机
return;
}
onVmCreated(env);
/*
* Register android functions.
//注册jni服务 REG_JNI(register_com_android_internal_os_RuntimeInit), REG_JNI(register_com_android_internal_os_ZygoteInit_nativeZygoteInit),
*/
if (startReg(env) < 0) {
ALOGE("Unable to register all android natives\n");
return;
}
...
/*
* Start VM. This thread becomes the main thread of the VM, and will
* not return until the VM exits.
*/
char* slashClassName = toSlashClassName(className != NULL ? className : "");
jclass startClass = env->FindClass(slashClassName);
if (startClass == NULL) {
ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);
/* keep going */
} else {
jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
"([Ljava/lang/String;)V");
if (startMeth == NULL) {
ALOGE("JavaVM unable to find main() in '%s'\n", className);
/* keep going */
} else {
//JNI调用进入java层执行ZygoteInit的main函数->runtime.start("com.android.internal.os.ZygoteInit", args, zygote); 开始执行Java的main方法ZygoteInit.main() RuntimeInit.main()
env->CallStaticVoidMethod(startClass, startMeth, strArray);
#if 0
if (env->ExceptionCheck())
threadExitUncaughtException(env);
#endif
}
}
free(slashClassName);
}
7.启动Zygote
//frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
public static void main(String[] argv) {
ZygoteServer zygoteServer = null;
...
try {
...
for (int i = 1; i < argv.length; i++) {
if ("start-system-server".equals(argv[i])) {
// 在init.rc文件中，有--start-system-server参数，表示要创建SystemServer
startSystemServer = true;
} else if ("--enable-lazy-preload".equals(argv[i])) {
enableLazyPreload = true;
}
...
}
...
// In some configurations, we avoid preloading resources and classes eagerly.
// In such cases, we will preload things prior to our first fork.
if (!enableLazyPreload) {
...
preload(bootTimingsTraceLog);// 1.预加载资源
...
}
...
zygoteServer = new ZygoteServer(isPrimaryZygote); // 2.创建Socket服务端
if (startSystemServer) {
// 3.fork启动system_server进程
Runnable r = forkSystemServer(abiList, zygoteSocketName, zygoteServer);
...
}
//4. sokcet服务端等待AMS请求（AMS会通过socket请求Zygote来创建应用程序进程）
caller = zygoteServer.runSelectLoop(abiList);
} catch (Throwable ex) {
Log.e(TAG, "System zygote died with exception", ex);
throw ex;
}
...
}
static void preload(TimingsTraceLog bootTimingsTraceLog) {
...
preloadClasses();// 1.加载system/etc/preloaded-classes文件中定义的各个系统类
...
preloadResources(); // 2.加载系统中定义的各个drawables、color资源
...
}
从代码中可以看到ZygoteInit#main方法中主要fork启动system_server进程：
- zygote进程中预加载类、主题资源、字体资源等，基于linux的copy-on-write机制，从而加速后续zygote fork创建出的应用进程的启动速度；
- 创建socket服务端，用于跨进程通信；
- fork创建启动系统system_server进程；
- Sokcet服务端进入循环监听等待，等待后续AMS请求（AMS会通过socket请求Zygote来创建应用程序进程）。
8.fork SystemServer进程
//frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
private static Runnable forkSystemServer(String abiList, String socketName,
ZygoteServer zygoteServer) {
...
/* Hardcoded command line to start the system server */
// 1.构建启动system_server进程的相关设置参数
String[] args = {
"--setuid=1000",
"--setgid=1000",
"--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1023,"
+ "1024,1032,1065,3001,3002,3003,3006,3007,3009,3010,3011",
"--capabilities=" + capabilities + "," + capabilities,
"--nice-name=system_server",
"--runtime-args",
"--target-sdk-version=" + VMRuntime.SDK_VERSION_CUR_DEVELOPMENT,
// system_server启动的类名
"com.android.server.SystemServer",
};
...
try {
...
/* Request to fork the system server process */
// 2.fork创建system_server进程，具体实现在native层
pid = Zygote.forkSystemServer(
parsedArgs.mUid, parsedArgs.mGid,
parsedArgs.mGids,
parsedArgs.mRuntimeFlags,
null,
parsedArgs.mPermittedCapabilities,
parsedArgs.mEffectiveCapabilities);
} catch (IllegalArgumentException ex) {
throw new RuntimeException(ex);
}
/* For child process */
if (pid == 0) {
if (hasSecondZygote(abiList)) {
waitForSecondaryZygote(socketName);
}
zygoteServer.closeServerSocket();
// 3.pid为0代表在新创建的system_server进程中，继续通过handleSystemServerProcess进一步处理
return handleSystemServerProcess(parsedArgs);
}
return null;
}
/**
* Finish remaining work for the newly forked system server process.
*/
private static Runnable handleSystemServerProcess(ZygoteArguments parsedArgs) {
...
if (parsedArgs.mInvokeWith != null) {
...
} else {
...
/*
* Pass the remaining arguments to SystemServer.
*/
// 调用ZygoteInit#zygoteInit函数具体处理
return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion,
parsedArgs.mDisabledCompatChanges,
parsedArgs.mRemainingArgs, cl);
}
}
public static Runnable zygoteInit(int targetSdkVersion, long[] disabledCompatChanges,
String[] argv, ClassLoader classLoader) {
...
// 1.RuntimeInit初始化，通过setDefaultUncaughtExceptionHandler设置默认的异常处理机制
RuntimeInit.commonInit();
// 2.触发启动进程的Binder线程池
ZygoteInit.nativeZygoteInit();
// 3.内部经过层层调用，最终通过反射创建"com.android.server.SystemServer"类对象并执行其main函数
return RuntimeInit.applicationInit(targetSdkVersion, disabledCompatChanges, argv,
classLoader);
}
继续结合代码看看RuntimeInit#applicationInit是如何实现反射创建"com.android.server.SystemServer"类对象并执行其main函数的：
9.启动Runtime，以及applicationInit方法
//frameworks/base/core/java/com/android/internal/os/RuntimeInit.java
public static final void main(String[] argv) {
preForkInit();
if (argv.length == 2 && argv[1].equals("application")) {
if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting application");
redirectLogStreams();
} else {
if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting tool");
}
commonInit();
/*
* Now that we're running in interpreted code, call back into native code
* to run the system.
*/
nativeFinishInit();
}
protected static Runnable applicationInit(int targetSdkVersion, long[] disabledCompatChanges,
String[] argv, ClassLoader classLoader) {
...
return findStaticMain(args.startClass, args.startArgs, classLoader);
}
protected static Runnable findStaticMain(String className, String[] argv,
ClassLoader classLoader) {
Class<?> cl;
try {
// 1.通过反射加载构建"com.android.server.SystemServer"类对象
cl = Class.forName(className, true, classLoader);
} catch (ClassNotFoundException ex) {
throw new RuntimeException(
"Missing class when invoking static main " + className,
ex);
}
Method m;
try {
//2.访问获取"com.android.server.SystemServer"的main方法
m = cl.getMethod("main", new Class[] { String[].class });
} catch (NoSuchMethodException ex) {
throw new RuntimeException(
"Missing static main on " + className, ex);
} catch (SecurityException ex) {
throw new RuntimeException(
"Problem getting static main on " + className, ex);
}
...
/*
* This throw gets caught in ZygoteInit.main(), which responds
* by invoking the exception's run() method. This arrangement
* clears up all the stack frames that were required in setting
* up the process.
*/
// 3.通过抛异常触发执行main函数并清除调用栈
return new MethodAndArgsCaller(m, argv);
}
static class MethodAndArgsCaller implements Runnable {
/** method to call */
private final Method mMethod;
/** argument array */
private final String[] mArgs;
public MethodAndArgsCaller(Method method, String[] args) {
mMethod = method;
mArgs = args;
}
public void run() {
try {
// 通过反射调用main函数
mMethod.invoke(null, new Object[] { mArgs });
} catch (IllegalAccessException ex) {
throw new RuntimeException(ex);
} catch (InvocationTargetException ex) {
Throwable cause = ex.getCause();
if (cause instanceof RuntimeException) {
throw (RuntimeException) cause;
} else if (cause instanceof Error) {
throw (Error) cause;
}
throw new RuntimeException(ex);
}
}
}
从上面的分析中可以看到，system_server进程创建后，会通过反射创建"com.android.server.SystemServer"入口类对象并执行其main方法
10.SystemServer启动
//frameworks/base/services/java/com/android/server/SystemServer.java
public static void main(String[] args) {
new SystemServer().run();
}
private void run() {
...
// 1.创建主线程Looper
Looper.prepareMainLooper();
// Initialize native services.
System.loadLibrary("android_servers");
// Allow heap / perf profiling.
initZygoteChildHeapProfiling();
// Check whether we failed to shut down last time we tried.
// This call may not return.
performPendingShutdown();
// 2.创建系统Context上下文
createSystemContext();
// 3.创建SystemServiceManager，用于后续系统服务（AMS、WMS等）的创建、启动和生命周期管理
mSystemServiceManager = new SystemServiceManager(mSystemContext);
mSystemServiceManager.setStartInfo(mRuntimeRestart, mRuntimeStartElapsedTime, mRuntimeStartUptime);
LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
// 4.服务根据优先级被分成3批来启动：
try {
t.traceBegin("StartServices");
//启动引导服务，如AMS、PMS等
startBootstrapServices(t);
//启动核心服务
startCoreServices(t);
//启动其他服务
startOtherServices(t);
} catch (Throwable ex) {
throw ex;
} finally {
t.traceEnd(); // StartServices
}
// 5.开启looper循环
Looper.loop();
}
private void startBootstrapServices(@NonNull TimingsTraceAndSlog t) {
ActivityTaskManagerService atm = mSystemServiceManager.startService(
ActivityTaskManagerService.Lifecycle.class).getService();
mActivityManagerService = ActivityManagerService.Lifecycle.startService(
mSystemServiceManager, atm);
mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
mActivityManagerService.setInstaller(installer);
mWindowManagerGlobalLock = atm.getGlobalLock();
try {
Watchdog.getInstance().pauseWatchingCurrentThread("packagemanagermain");
mPackageManagerService = PackageManagerService.main(mSystemContext, installer,
domainVerificationService, mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF,
mOnlyCore);
} finally {
Watchdog.getInstance().resumeWatchingCurrentThread("packagemanagermain");
}
}
private void startCoreServices(@NonNull TimingsTraceAndSlog t) {
...
}
private void startOtherServices(@NonNull TimingsTraceAndSlog t) {
// WMS needs sensor service ready
mSystemServiceManager.startBootPhase(t, SystemService.PHASE_WAIT_FOR_SENSOR_SERVICE);
wm = WindowManagerService.main(context, inputManager, !mFirstBoot, mOnlyCore,
new PhoneWindowManager(), mActivityManagerService.mActivityTaskManager);
ServiceManager.addService(Context.WINDOW_SERVICE, wm, /* allowIsolated= */ false,
DUMP_FLAG_PRIORITY_CRITICAL | DUMP_FLAG_PROTO);
ServiceManager.addService(Context.INPUT_SERVICE, inputManager,
/* allowIsolated= */ false, DUMP_FLAG_PRIORITY_CRITICAL);
...
mActivityManagerService.systemReady(() -> {
...
}
}
总结一下上述流程，system_server进程创建之后，主要做了如下几件事情：
- 启动进程的Binder线程池；
- 创建SystemServiceManager大管家，用于后续系统服务（AMS、WMS等）的创建、启动和生命周期管理；
- 用SystemServiceManager按照优先级启动系统各个服务；
- 创建并启动进程的主线程的loop循环；
11.AMS服务创建
//frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
public static final class Lifecycle extends SystemService {
private final ActivityManagerService mService;
private static ActivityTaskManagerService sAtm;
public Lifecycle(Context context) {
super(context);
mService = new ActivityManagerService(context, sAtm);
}
public static ActivityManagerService startService(
SystemServiceManager ssm, ActivityTaskManagerService atm) {
sAtm = atm;
return ssm.startService(ActivityManagerService.Lifecycle.class).getService();
}
@Override
public void onStart() {
mService.start();
}
@Override
public void onBootPhase(int phase) {
mService.mBootPhase = phase;
if (phase == PHASE_SYSTEM_SERVICES_READY) {
mService.mBatteryStatsService.systemServicesReady();
mService.mServices.systemServicesReady();
} else if (phase == PHASE_ACTIVITY_MANAGER_READY) {
mService.startBroadcastObservers();
} else if (phase == PHASE_THIRD_PARTY_APPS_CAN_START) {
mService.mPackageWatchdog.onPackagesReady();
}
}
@Override
public void onUserStopped(@NonNull TargetUser user) {
mService.mBatteryStatsService.onCleanupUser(user.getUserIdentifier());
}
public ActivityManagerService getService() {
return mService;
}
}
public ActivityManagerService(Context systemContext, ActivityTaskManagerService atm) {
mHandlerThread = new ServiceThread(TAG,
THREAD_PRIORITY_FOREGROUND, false /*allowIo*/);
mHandlerThread.start();
mHandler = new MainHandler(mHandlerThread.getLooper());
mUiHandler = mInjector.getUiHandler(this);
mProcStartHandlerThread = new ServiceThread(TAG + ":procStart",
THREAD_PRIORITY_FOREGROUND, false /* allowIo */);
mProcStartHandlerThread.start();
mProcStartHandler = new Handler(mProcStartHandlerThread.getLooper());
mActivityTaskManager = atm;
mActivityTaskManager.initialize(mIntentFirewall, mPendingIntentController,
DisplayThread.get().getLooper());
//mAtmInternal，LocalServices类里面是一个类与对象的键值对，而ActivityTaskManagerInternal是一个抽象类，我们找到它的唯一继承类ActivityTaskManagerService.LocalService
mAtmInternal = LocalServices.getService(ActivityTaskManagerInternal.class);
}
public void systemReady(final Runnable goingCallback, @NonNull TimingsTraceAndSlog t) {
//可以分为三部分
before goingCallback;
//非persistent进程加入procsToKill，杀掉procsToKill中的进程, 杀掉进程且不允许重启
goingCallback.run();
//这个goingCallback是在startOtherServices时传入的Callback 启动监听Native Crash 启动WebView，并且会创建进程，这是zygote正式创建的第一个进程 启动SystemUI 启动WatchDog 执行一系列服务的systemRunning方法启动
after goingCallback;
//回调所有SystemService的onStartUser()方法；启动persistent app（常驻内存应用）；启动home Activity;发送广播USER_STARTED和USER_STARTING；恢复栈顶Activity;发送广播USER_SWITCHED；
startPersistentApps(PackageManager.MATCH_DIRECT_BOOT_AWARE);
if (bootingSystemUser) {
mAtmInternal.startHomeOnAllDisplays(currentUserId, "systemReady");//由于Android系统支持多用户和多显示，调用startHomeOnAllDisplays启动每个display上的Home Activity
}
mAtmInternal.resumeTopActivities(false /* scheduleIdle */);
}
12.启动launcher
//frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerInternal.java
//frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
public class ActivityTaskManagerService extends IActivityTaskManager.Stub {
final class LocalService extends ActivityTaskManagerInternal {
@Override
public SleepTokenAcquirer createSleepTokenAcquirer(@NonNull String tag) {
Objects.requireNonNull(tag);
return new SleepTokenAcquirerImpl(tag);
}
@Override
public ComponentName getHomeActivityForUser(int userId) {
synchronized (mGlobalLock) {
final ActivityRecord homeActivity =
mRootWindowContainer.getDefaultDisplayHomeActivityForUser(userId);
return homeActivity == null ? null : homeActivity.mActivityComponent;
}
}
}
if (bootingSystemUser) {
t.traceBegin("startHomeOnAllDisplays");
mAtmInternal.startHomeOnAllDisplays(currentUserId, "systemReady");
t.traceEnd();
}
/**
* This starts home activity on display areas that can have system decorations based on
* displayId - default display area always uses primary home component.
* For secondary display areas, the home activity must have category SECONDARY_HOME and then
* resolves according to the priorities listed below.
* - If default home is not set, always use the secondary home defined in the config.
* - Use currently selected primary home activity.
* - Use the activity in the same package as currently selected primary home activity.
* If there are multiple activities matched, use first one.
* - Use the secondary home defined in the config.
*/
boolean startHomeOnTaskDisplayArea(int userId, String reason, TaskDisplayArea taskDisplayArea,
boolean allowInstrumenting, boolean fromHomeKey) {
mService.getActivityStartController().startHomeActivity(homeIntent, aInfo, myReason,
taskDisplayArea);
}
