Android开机启动作业流程.doc

Android开机流程

1.    系统引导bootloader
1)        源码：bootable/bootloader/*
2)        阐明：加电后，CPU将先执行bootloader程序，此处有三种选取
a)        开机按Camera+Power启动到fastboot，即命令或SD卡烧写模式，不加载内核及文献系统，此处可以进行工厂模式烧写
b)        开机按Home+Power启动到recovery模式，加载recovery.img，recovery.img包括内核，基本文献系统，用于工程模式烧写
c)        开机按Power，正常启动系统，加载boot.img，boot.img包括内核，基本文献系统，用于正常启动手机（如下只分析正常启动状况）
2.    内核kernel
1)        源码：kernel/*
2)        阐明：kernel由bootloader加载
3.    文献系统及应用init
1)        源码：system/core/init/*
2)        配备文献：system/rootdir/init.rc，
3)        阐明：init是一种由内核启动顾客级进程，它按照init.rc中设立执行：启动服务（这里服务指linux底层服务，如adbd提供adb支持，vold提供SD卡挂载等），执行命令和按其中配备语句执行相应功能
4.    重要后台程序zygote
1)        源码：frameworks/base/cmds/app_main.cpp等
2)        阐明：zygote是一种在init.rc中被指定启动服务，该服务相应命令是/system/bin/app_process
a)        建立Java Runtime，建立虚拟机
b)        建立Socket接受ActivityManangerService祈求，用于Fork应用程序
c)        启动System Server
5.    系统服务system server
1)        源码：frameworks/base/services/java/com/android/server/SystemServer.java
2)        阐明：被zygote启动，通过System Manager管理android服务（这里服务指frameworks/base/services下服务，如卫星定位服务，剪切板服务等）
6.    桌面launcher
1)        源码：ActivityManagerService.java为入口，packages/apps/launcher*实现
2)        阐明：系统启动成功后SystemServer使用xxx.systemReady()告知各个服务，系统已经就绪，桌面程序Home就是在ActivityManagerService.systemReady()告知过程中建立，最后调用 ()启launcher
7.    解锁
1)        源码：
frameworks/policies/base/phone/com/android/internal/policy/impl/*lock*
2)        阐明：系统启动成功后SystemServer调用wm.systemReady()告知WindowManagerService进而调用PhoneWindowManager，最后通过LockPatternKeyguardView显示解锁界面，跟踪代码可以看到解锁界面并不是一种Activity，这是只是向特定层上绘图，其代码了存储在特殊位置
8.    开机自启动第三方应用程序
1)        源码：
frameworks/base/services/java/com/android/server/am/ActivityManagerService.java
2)        阐明：系统启动成功后SystemServer调用ActivityManagerNative.getDefault().systemReady()告知ActivityManager启动成功，ActivityManager会通过置变量mBooting，告知它另一线程，该线程会发送广播android.intent.action.BOOT_COMPLETED以告知已注册第三方程序在开机时自动启动。
9.    总结
综上所述，系统层次关于启动最核心某些是zygote(即app_process)和system server，zygote它负责最基本虚拟机建立，以支持各个应用程序启动，而system server用于管理android后台服务，启动环节及顺序。
10. 参照

Android 启动过程详解
Android从Linux系统启动有4个环节；
(1) init进程启动
(2) Native服务启动
(3) System Server，Android服务启动
(4) Home启动
总体启动框架图如：

第一步：initial进程(system/core/init)
     init进程，它是一种由内核启动顾客级进程。内核自行启动（已经被载入内存，开始运营，并已初始化所有设备驱动程序和数据构造等）之后，就通过启动一种顾客级程序init方式，完毕引导进程。init始终是第一种进程.
Init.rc
Init.marvell.rc

Init进程一起来就依照init.rc和init.xxx.rc脚本文献建立了几种基本服务：
 servicemanamger
 zygote
。。。
最后Init并不退出，而是担当起property service功能。
1.1脚本文献
init@System/Core/Init
Init.c： parse_config_file(Init.rc)
  @parse_config_file(Init.marvel.rc)
解析脚本文献：Init.rc和Init.xxxx.rc(硬件平台有关)
Init.rc是Android自己规定初始化脚本(Android Init Language，System/Core/Init/readme.txt)
该脚本包括四个类型声明：
Actions
Commands
Services
Options.
1.2 服务启动机制
咱们来看看Init是这样解析.rc文献启动服务。
（1）打开.rc文献，解析文献内容@ system/core/init/init.c
将service信息放置到service_list中。@ system/core/init parser.c
（2）restart_service()@ system/core/init/init.c
service_start
execve(…).建立service进程。
第二步 Zygote
Servicemanager和zygote进程就奠定了Android基本。Zygote这个进程起来才会建立起真正Android运营空间，初始化建立Service都是Navtive service.在.rc脚本文献中zygote描述：
service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
因此Zygote从main(…)@frameworks/base/cmds/app_main.cpp开始。
(1) main(…)@frameworks/base/cmds/app_main.cpp
建立Java Runtime
runtime.start("com.android.internal.os.ZygoteInit"，startSystemServer)；
(2)
建立虚拟机
运营：com.android.internal.os.ZygoteInit：main函数。
（3）main()@com.android.internal.os.ZygoteInit//正真Zygote。

registerZygoteSocket();//登记Listen端口
startSystemServer()；
进入Zygote服务框架。
通过这几种环节，Zygote就建立好了，运用Socket通讯，接受ActivityManangerService祈求，Fork应用程序。
第三步 System Server
在Zygote上fork了一种进程: com.android.server.SystemServer.于是SystemServer@(SystemServer.java）就建立了。Android所有服务循环框架都是建立SystemServer@(SystemServer.java）上。在SystemServer.java中看不到循环构造，只是可以看到建立了init2实现函数，建立了一大堆服务，并AddService到service Manager。
main() @ com/android/server/SystemServer
{
init1();
}
Init1()是在Native空间实现（com_andoird_server_systemServer.cpp）。咱们一看这个函数就懂得了，init1->system_init() @System_init.cpp
在system_init()咱们看到了循环闭合管理框架。
{
Call "com/android/server/SystemServer"，"init2"
…..
ProcessState::self()->startThreadPool();
    IPCThreadState::self()->joinThreadPool();
}

init2()@SystemServer.java中建立了Android中所有要用到服务。
这个init2（）建立了一种线程，来New Service和AddService来建立服务

第三步 Home启动
在后半段，咱们可以看到系统在启动完所有Android服务后，做了这样某些动作：
（1） 使用xxx.systemReady()告知各个服务，系统已经就绪。
(2)  特别对于ActivityManagerService.systemReady(回调)
Widget.wallpaper,imm(输入法)等ready告知。
Home就是在ActivityManagerService.systemReady()告知过程中建立。下面是ActivityManagerService.systemReady()伪代码：
systemReady()@ActivityManagerService.java
resumeTopActivityLocked()
startHomeActivityLocked();//如果是第一种则启动HomeActivity。
startActivityLocked（。。。）CATEGORY_HOME

Android Booting:
init is the first process after kernel started. The corresponding source code lies in：device/system/init. It does the following tasks step by step：
1.Initialize log system.
2.Parse /init.rc and /init.%hardware%.rc.
3. Execute early-init action in the two files parsed in step 2.
4. Device specific initialize. For example，make all device node in /dev and download firmwares.
5. Initialize property system. Actually the property system is working as a share memory. Logically it looks like a registry under Windows system.
6. Execute init action in the two files parsed in step 2.
7. Start property service.
8. Execute early-boot and boot actions in the two files parsed in step 2.
9. Execute property action in the two files parsed in step 2.
10. Enter into an indefinite loop to wait for device/property set/child process exit events. For example，if an SD card is plugined，init will receive a device add event，so it can make node for the device. Most of the important process is forked in init，so if any of them crashed，init will receive a SIGCHLD then translate it into a child process exit event，so in the loop init can handle the process exit event and execute the commands defined in *.rc(it will run command onrestart).

The .rc file is a script file defined by Android. The default is device/system/rootdir/init.rc. We can take a loot at the file format(device/system/init/readme.txt is a good overall introduction of the script). Basically the script file contains actions and services.
Actions
Actions are named sequences of commands. Actions have a trigger which is used to determine when the action should occur.  When an event occurs which matches an action's trigger，that action is added to the tail of a to-be-executed queue (unless it is already on the queue).
Each action in the queue is dequeued in sequence and each command in that action is executed in sequence.  Init handles other activities (device creation/destruction，property setting，process restarting) "between" the execution of the commands in activities.
Actions take the form of：
on

...
Services
Services are programs which init launches and (optionally) restarts when they exit.  Services take the form of：
service [ ]*

   ...
Options
Options are modifiers to services.  They affect how and when init runs the service.

Triggers
Triggers are strings which can be used to match certain kinds of events and used to cause an action to occur.

The builtin supported commands are defined in device/system/init/keywords.h. Commands are implementd in device/system/init/bultins.c.

The init program only executes five kinds of triggers：“early-init”，“init”，“early-boot”，“boot”，“property:*”. Take a look at the following line in default init.rc.
class_start default
This line is a command for the action corresponding to “boot” trigger. It will start all services whose class name equals to “default”. By default，if no class option is defined for a service，the service’s class name is “default”. So this line will start all the services in the order of position in the file by default. (BTW，you can start any service using start commands，if you like.) Any service is run as a forked process of init，take a look at the source code of service_start in device/system/init.c.

So according to the default init.rc，the following services will be executed step by step：
console：star a shell. The source is in device/system/bin/ash.
adbd：start adb daemon. The source is in device/tools/adbd. By default is disabled.
servicemanager：start binder system. The source is in device/commands/binder.
mountd：mount all fs defined in /system/etc/mountd.conf if started，receive commands through local socket to mount any fs. The source is in device/system/bin/mountd.
debuggerd：start debug system. The source is in device/system/bin/debuggerd.
rild：start radio interface layer daemon. The source is in device/commands/rind.
zygote：start Android Java Runtime and start system server. It’s the most important service. The source is in device/servers/app.
media：start AudioFlinger，MediaPlayerService and CameraService. The source is in device/commands/mediaserver.
bootsound：play the default boot sound /system/media/audio/ui/boot.mp3. The source is in device/commands/playmp3.
dbus：start dbus daemon，it’s only used by BlueZ. The source is in device/system/Bluetooth/dbus-daemon.
hcid：redirect hcid’s stdout and stderr to the Android logging system. The source is in device/system/bin/logwrapper. By default is disabled.
hfag：start Bluetooth handsfree audio gateway，it’s only used by BlueZ. The source is in device/system/Bluetooth/bluez-utils. By default is disabled.
hsag：start Bluetooth headset audio gateway，it’s only used by BlueZ. The source is in device/system/Bluetooth/bluez-utils. By default is disabled.
installd：start install package daemon. The source is in device/servers/installd.
flash_recovery：load /system/recovery.img. The source is in device/commands/recovery/mtdutils.

Zygote service does the following tasks step by step：
1. Create JAVA VM.
2. Register android native function for JAVA VM.
3. Call the main function in the JAVA class named com.android.internal.os.ZygoteInit whose source is device/java/android/com/android/internal/os/ZygoteInit.java.
a)  Load ZygoteInit class
b)  Register zygote socket
c)  Load preload classes(the default file is device/java/android/preloaded-classes)
d)  Load preload resources
e)  Call Zygote::forkSystemServer (implemented in device/dalvik/vm/InternalNative.c) to fork a new process. In the new process，call the main function in the JAVA class named com.android.server.SystemServer，whose source is in device/java/services/com/android/server.
                         i.              Load libandroid_servers.so
                       ii.              Call JNI native init1 function implemented in device/libs/android_servers/com_android_server_SystemServers. It only calls system_init implemented in device/servers/system/library/system_init.cpp.
l         If running on simulator，instantiate AudioFlinger，MediaPlayerService and CameraService here.
l         Call init2 function in JAVA class named com.android.server.SystemServer，whose source is in device/java/services/com/android/server. This function is very critical for Android because it start all of Android JAVA services.
l         If not running on simulator，call IPCThreadState::self()->joinThreadPool() to enter into service dispatcher.

SystemServer::init2 will start a new thread to start all JAVA services as follows：
Core Services：
1.       Starting Power Manager //
2.       Creating Activity Manager
3.       Starting Telephony Registry //
4.       Starting Package Manager //
5.       Set Activity Manager Service as System Process
6.       Starting Context Manager
7.       Starting System Context Providers
8.       Starting Battery Service //
9.       Starting Alarm Manager //
10.   Starting Sensor Service
11.   Starting Window Manager
12.   Starting Bluetooth Service //
13.   Starting Mount Service //
Other services //
1.       Starting Status Bar Service
2.       Starting Hardware Service
3.       Starting NetStat Service
4.       Starting Connectivity Service
5.       Starting Notification Manager
6.       Starting DeviceStorageMonitor Service
7.       Starting Location Manager
8.       Starting Search Service
9.       Starting Clipboard Service

10.   Starting Checkin Service
11.   Starting Wallpaper Service
12.   Starting Audio Service
13.   Starting HeadsetObserver
14.   Starting AdbSettingsObserver
Finally SystemServer::init2 will call ActivityManagerService.systemReady to launch the first activity by senting Intent.CATEGORY_HOME intent.

There is another way to start system server，which is through a program named system_server whose source is device/servers/system/system_main.cpp. It also calls system_init to start system services. So there is a question：why does Android have two methods to start system services?My guess is that directly start system_server may have synchronous problem with zygote because system_server will call JNI to start SystemServer::init2，while at that time zygote may not start JAVA VM yet. So Android uses another method. After zynote is initialized，fork a new process to start system services.

Android 启动过程

1. Boot系统初始化， 详细过程参见(system\core\init\Init.c)中main函数，这时候，手机或者模仿器浮现画面是一种console，显示“ANDROID”msg。

2. 初始化成功后，就开始mounting系统，详细参见(system\core\mountd\Mountd.c)  中main函数。

3．接下来运营ndroidRuntime，并开始启动java虚拟机dalvikvm。

4. Java虚拟机启动成功后，开始系统初始化。系统初始第一步是用JNI方式实现，相应java代码为(frameworks\base\services\java\com\android\server\SystemServer.java) init1（Native）函数，相应JNI C++代码为(frameworks\base\core\jni\server\com_android_server_SystemServer.cpp)，而实现C++代码为
(frameworks\base\cmds\system_server\library\ System_init.cpp)   中system_init（）函数。

5. system_init调用SurfaceFlinger，SurfaceFlingerreadyToRun()函数用BootAnimation来实现开机动画，这时候手机或者模仿器显示是一副背景图加一种动态小机器人。

6. 系统初始化第二步，将启动ServerThread进程，参见SystemServer.init2()。ServerThread将启动各种系统服务，如Power Manager、Activity Manager等等，详细参见ServerThreadrun函数，ServerThread同在SystemServer.java中。

7.这之后事，应当就是进入系统了。（这某些没有调查过）。

对Android启动过程进一步研究
对于关注Android底层朋友来说，其详细启动过程应当是比较吸引咱们。但是诸多启动文献什么，都得adb push到host上来看，挺不以便，都怪Android自带Toolbox太简略了。因此在进一步理解Android启动流程之前，咱们来把Busybox安装到Android上去，这样，就有诸多工具供咱们使用了。
　　一方面去busybox主页 下载最新版本源代码，然后用arm交叉编译器编译出busybox可执行程序，编译时候需要注意某些设立选项，例如
　　Build Options —>
　　Build BusyBox as a static binary (no shared libs) 这个要选上，因上这样子编译出来busyBox才是可以独立运营。
　　│Do you want to build BusyBox with a Cross Compiler?│ │
　　│ │(/HOME/toolchains/gcc-4.0.2-glibc-2.3.5/arm-9tdmi-linux-gnu/bin/arm-9tdmi-linux-gnu│ 这是交叉编译器途径，要依照详细状况来设立。
　　Installation Options —>
　　Don