Android系统Launcher启动流程

您所在的位置：网站首页 › bin文件rom › Android系统Launcher启动流程

Android系统Launcher启动流程

#Android系统Launcher启动流程| 来源: 网络整理| 查看: 265

作者：MannaYang前言

以往我们开发Android应用都在系统桌面点击打开，但桌面Launcher进程是如何加载并展示应用窗口未能深入了解，由此去窥探Android系统整体启动流程以加深对Android开发体系的理解

1.Android系统启动核心流程当开机键按下时Boot Rom激活并加载引导程序BootLoader到RAM启动kernal swapper进程(idle)pid=0初始化进程管理，内存管理加载Binder\Display\Camera Driver创建kthreadd进程(pid=2),初始化内核工作线程kworkder,中断线程ksoftirad,内核守护进程thermal创建init进程2.init进程源码解析2.1 init进程

功能如下：

解析init.rc配置文件，首先开启ServiceManager和MediaServer等关键进程init进程fork启动Zygote服务进程处理子进程的终止(signal方式)提供属性服务的功能int main(int argc, char** argv) { ... //设置进程和用户的进程执行优先级 setpriority(PRIO_PROCESS, 0, -20); //init进程创建ueventd子进程处理设备节点文件，通过ColdBoot.Run()方法冷启动 //具体细节位置：/system/core/init/ueventd.cpp if (!strcmp(basename(argv[0]), "ueventd")) { return ueventd_main(argc, argv); } if (argc > 1) { if (!strcmp(argv[1], "subcontext")) { //内核日志初始化，文件位置：/system/libbase/logging.cpp //[logging.cpp - Android Code Search](https://cs.android.com/android/platform/superproject/+/android13-release:system/libbase/logging.cpp;drc=715a186b5d8903d30c25299ed0ecff0e2e9fbb9c;bpv=1;bpt=1;l=337?hl=zh-cn) android::base::InitLogging(argv, &android::base::KernelLogger); //文件位置：/system/core/init/builtins.cpp，获取内核函数传递给“subcontext” const BuiltinFunctionMap& function_map = GetBuiltinFunctionMap(); //subcontext进程 return SubcontextMain(argc, argv, &function_map); } if (!strcmp(argv[1], "selinux_setup")) { return SetupSelinux(argv); } if (!strcmp(argv[1], "second_stage")) { return SecondStageMain(argc, argv); } } return FirstStageMain(argc, argv); }2.2 进程优先级

setpriority(PRIO_PROCESS, 0, -20);

设置进程和用户的进程执行优先级,源码位置 : bionic/libc/include/sys/resource.h

int getpriority（int __which， id_t __who); int setpriority（int __which， id_t __who， int __priority);int __which : 三个类别可选，PRIO_PROCESS(标记具体进程)、PRIO_PGRP（标记进程组）、PRIO_USER（标记用户进程，通过user id区分）id_t __who : 与which类别一一对应，分别标记上述类别idint __priority : 优先级范围 -20～19，值越小优先级越高

运行adb shell 查看进程nice值

adb shell top

2.3 FirstStageMain

代码位置：system/core/init/first_stage_init.cpp,主要是创建挂载相关文件目录

int FirstStageMain(int argc, char** argv) { //初始化重启系统的处理信号,通过sigaction注册新号并监听,源码位置：system/core/init/reboot_utils.cpp if (REBOOT_BOOTLOADER_ON_PANIC) { InstallRebootSignalHandlers(); } //系统时钟 boot_clock::time_point start_time = boot_clock::now(); ... //一系列文件操作,linux下socket也是特殊文件，0755标记用户具有读/写/执行权限，具体可查看相关命令 CHECKCALL(mkdir("/dev/socket", 0755)); //CMD命令行 CHECKCALL(chmod("/proc/cmdline", 0440)); std::string cmdline; android::base::ReadFileToString("/proc/cmdline", &cmdline); //读取bootconfig chmod("/proc/bootconfig", 0440); std::string bootconfig; android::base::ReadFileToString("/proc/bootconfig", &bootconfig); ... SetStdioToDevNull(argv); //-------------- SetStdioToDevNull 源码如下注释如下 --------------------------------- 最后，在第一阶段初始化中简单地调用 SetStdioToDevNull（）是不够的，因为首先 stage init 仍然在内核上下文中运行，未来的子进程将无权访问它打开的任何 FDS，包括下面为 /dev/null 打开的 FDS。因此 SetStdioToDevNull（）必须在第二阶段 init 中再次调用。 void SetStdioToDevNull(char** argv) { // Make stdin/stdout/stderr all point to /dev/null. int fd = open("/dev/null", O_RDWR); // NOLINT(android-cloexec-open) if (fd == -1) { int saved_errno = errno; android::base::InitLogging(argv, &android::base::KernelLogger, InitAborter); errno = saved_errno; PLOG(FATAL) STDERR_FILENO) close(fd); } //-------------- SetStdioToDevNull（） --------------------------------- //初始化内核日志打印 InitKernelLogging(argv); ... //unique_ptr智能指针主动释放内存 auto old_root_dir = std::unique_ptr{opendir("/"), closedir}; struct stat old_root_info; if (stat("/", &old_root_info) != 0) { PLOG(ERROR) FindClass("java/lang/String"); assert(stringClass != NULL); strArray = env->NewObjectArray(options.size() + 1, stringClass, NULL); assert(strArray != NULL); classNameStr = env->NewStringUTF(className); assert(classNameStr != NULL); env->SetObjectArrayElement(strArray, 0, classNameStr); for (size_t i = 0; i < options.size(); ++i) { jstring optionsStr = env->NewStringUTF(options.itemAt(i).string()); assert(optionsStr != NULL); env->SetObjectArrayElement(strArray, i + 1, optionsStr); } /* * Start VM. This thread becomes the main thread of the VM, and will * not return until the VM exits. */ //JNI中的类名规则：将Java类名中的"."替换成"/" char* slashClassName = toSlashClassName(className != NULL ? className : ""); jclass startClass = env->FindClass(slashClassName); if (startClass == NULL) { ALOGE("JavaVM unable to locate class '%s'\n", slashClassName); /* keep going */ } else { //获取ZygoteInit.java main方法 jmethodID startMeth = env->GetStaticMethodID(startClass, "main", "([Ljava/lang/String;)V"); if (startMeth == NULL) { ALOGE("JavaVM unable to find main() in '%s'\n", className); /* keep going */ } else { //已找到main方法，通过JNI调用Java方法，最终启动zygote init初始化相关 env->CallStaticVoidMethod(startClass, startMeth, strArray); #if 0 if (env->ExceptionCheck()) threadExitUncaughtException(env); #endif } } free(slashClassName); ALOGD("Shutting down VM\n"); if (mJavaVM->DetachCurrentThread() != JNI_OK) ALOGW("Warning: unable to detach main thread\n"); if (mJavaVM->DestroyJavaVM() != 0) ALOGW("Warning: VM did not shut down cleanly\n"); }

通过AndroidRuntime源码我们可以看到它做了以下几点

jni_invocation.Init 加载libart.sostartVm 启动Java虚拟机startReg 注册Android JNI方法FindClass 查找zygote初始化类CallStaticVoidMethod 调用ZygoteInit.java main()3.1 启动JVM ：JniInvocation初始化

JniInvocation实际是头文件代理类，最终调用实现为JniInvocationImpl，通过构造函数初始化impl,接着调用init方法，最终都转向JniInvocationImpl.c中方法调用

JniInvocation.h 源码位置： /libnativehelper/include_platform/nativehelper/JniInvocation.h

JniInvocationImpl.c 源码位置： /libnativehelper/include_platform/nativehelper/JniInvocation.h

static const char* kDefaultJniInvocationLibrary = "libart.so"; bool JniInvocationInit(struct JniInvocationImpl* instance, const char* library_name) { ... //非debug模式返回kDefaultJniInvocationLibrary参数 library_name = JniInvocationGetLibrary(library_name, buffer); //打开"libart.so" DlLibrary library = DlOpenLibrary(library_name); if (library == NULL) { //加载失败返回false if (strcmp(library_name, kDefaultJniInvocationLibrary) == 0) { // Nothing else to try. ALOGE("Failed to dlopen %s: %s", library_name, DlGetError()); return false; } ... } //从当前"libart.so"获取以下3个JNI函数指针 DlSymbol JNI_GetDefaultJavaVMInitArgs_ = FindSymbol(library, "JNI_GetDefaultJavaVMInitArgs"); //获取虚拟机默认初始化参数 if (JNI_GetDefaultJavaVMInitArgs_ == NULL) { return false; } DlSymbol JNI_CreateJavaVM_ = FindSymbol(library, "JNI_CreateJavaVM"); //创建虚拟机 if (JNI_CreateJavaVM_ == NULL) { return false; } DlSymbol JNI_GetCreatedJavaVMs_ = FindSymbol(library, "JNI_GetCreatedJavaVMs"); //获取创建的实例 if (JNI_GetCreatedJavaVMs_ == NULL) { return false; } ... return true; }3.2 启动JVM ：startVM()

该方法主要处理以下内容

配置虚拟机参数和选项调用JNI_CreateJavaVM()创建并初始化，该方法原始位置：/art/runtime/jni/http://java_vm_ext.cc3.3 startReg 注册Android JNI方法/* * Register android native functions with the VM. */ /*static*/ int AndroidRuntime::startReg(JNIEnv* env){ ATRACE_NAME("RegisterAndroidNatives"); /* * This hook causes all future threads created in this process to be * attached to the JavaVM. (This needs to go away in favor of JNI * Attach calls.) */ //根据源码注释，此处调用javaCreateThreadEtc创建的线程会attached jvm,这样C++、Java代码都能执行 androidSetCreateThreadFunc((android_create_thread_fn) javaCreateThreadEtc); /* * Every "register" function calls one or more things that return * a local reference (e.g. FindClass). Because we haven't really * started the VM yet, they're all getting stored in the base frame * and never released. Use Push/Pop to manage the storage. */ //jni局部引用 - 入栈 env->PushLocalFrame(200); //注册jni方法 if (register_jni_procs(gRegJNI, NELEM(gRegJNI), env) < 0) { env->PopLocalFrame(NULL); return -1; } //jni局部引用 - 出栈 env->PopLocalFrame(NULL); //createJavaThread("fubar", quickTest, (void*) "hello"); return 0; } //JNI函数数组 static const RegJNIRec gRegJNI[] = { REG_JNI(register_com_android_internal_os_RuntimeInit), REG_JNI(register_com_android_internal_os_ZygoteInit_nativeZygoteInit), ... ... } //循环调用gRegJNI数组中所有的函数 static int register_jni_procs(const RegJNIRec array[], size_t count, JNIEnv* env){ for (size_t i = 0; i < count; i++) { if (array[i].mProc(env) < 0) { ... return -1; } } return 0; } //gRegJNI函数数组实例，JNI函数相关调用 int register_com_android_internal_os_RuntimeInit(JNIEnv* env){ const JNINativeMethod methods[] = { {"nativeFinishInit", "()V", (void*)com_android_internal_os_RuntimeInit_nativeFinishInit}, {"nativeSetExitWithoutCleanup", "(Z)V", (void*)com_android_internal_os_RuntimeInit_nativeSetExitWithoutCleanup}, }; return jniRegisterNativeMethods(env, "com/android/internal/os/RuntimeInit", methods, NELEM(methods)); } int register_com_android_internal_os_ZygoteInit_nativeZygoteInit(JNIEnv* env){ const JNINativeMethod methods[] = { { "nativeZygoteInit", "()V", (void*) com_android_internal_os_ZygoteInit_nativeZygoteInit }, }; return jniRegisterNativeMethods(env, "com/android/internal/os/ZygoteInit", methods, NELEM(methods)); }

通过以上JVM虚拟机配置/创建，JNI引用注册/函数查找，以及对ZygoteInit main()调用，我们可以进入ZygoteInit.java代码了，一起看看Java层是如何实现

4. ZygoteInit.java类

源码路径：frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

下面先看看main()源码定义,然后再继续分析

public static void main(String[] argv) { ZygoteServer zygoteServer = null; // Mark zygote start. This ensures that thread creation will throw // an error. ZygoteHooks.startZygoteNoThreadCreation(); // Zygote goes into its own process group. try { Os.setpgid(0, 0); } catch(ErrnoException ex) { throw new RuntimeException("Failed to setpgid(0,0)", ex); } Runnable caller; try { // Store now for StatsLogging later. final long startTime = SystemClock.elapsedRealtime(); final boolean isRuntimeRestarted = "1".equals(SystemProperties.get("sys.boot_completed")); String bootTimeTag = Process.is64Bit() ? "Zygote64Timing": "Zygote32Timing"; TimingsTraceLog bootTimingsTraceLog = new TimingsTraceLog(bootTimeTag, Trace.TRACE_TAG_DALVIK); bootTimingsTraceLog.traceBegin("ZygoteInit"); RuntimeInit.preForkInit(); //设置startSystemServer，abiList,argvs参数，sokcet name等 boolean startSystemServer = false; String zygoteSocketName = "zygote"; String abiList = null; boolean enableLazyPreload = false; for (int i = 1; i < argv.length; i++) { if ("start-system-server".equals(argv[i])) { startSystemServer = true; } else if ("--enable-lazy-preload".equals(argv[i])) { enableLazyPreload = true; } else if (argv[i].startsWith(ABI_LIST_ARG)) { abiList = argv[i].substring(ABI_LIST_ARG.length()); } else if (argv[i].startsWith(SOCKET_NAME_ARG)) { zygoteSocketName = argv[i].substring(SOCKET_NAME_ARG.length()); } else { throw new RuntimeException("Unknown command line argument: " + argv[i]); } } final boolean isPrimaryZygote = zygoteSocketName.equals(Zygote.PRIMARY_SOCKET_NAME); if (!isRuntimeRestarted) { if (isPrimaryZygote) { FrameworkStatsLog.write(FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME_REPORTED, BOOT_TIME_EVENT_ELAPSED_TIME__EVENT__ZYGOTE_INIT_START, startTime); } else if (zygoteSocketName.equals(Zygote.SECONDARY_SOCKET_NAME)) { FrameworkStatsLog.write(FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME_REPORTED, BOOT_TIME_EVENT_ELAPSED_TIME__EVENT__SECONDARY_ZYGOTE_INIT_START, startTime); } } if (abiList == null) { throw new RuntimeException("No ABI list supplied."); } // In some configurations, we avoid preloading resources and classes eagerly. // In such cases, we will preload things prior to our first fork. if (!enableLazyPreload) { bootTimingsTraceLog.traceBegin("ZygotePreload"); EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START, SystemClock.uptimeMillis()); preload(bootTimingsTraceLog); EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END, SystemClock.uptimeMillis()); bootTimingsTraceLog.traceEnd(); // ZygotePreload } // Do an initial gc to clean up after startup bootTimingsTraceLog.traceBegin("PostZygoteInitGC"); gcAndFinalize(); bootTimingsTraceLog.traceEnd(); // PostZygoteInitGC bootTimingsTraceLog.traceEnd(); // ZygoteInit Zygote.initNativeState(isPrimaryZygote); ZygoteHooks.stopZygoteNoThreadCreation(); zygoteServer = new ZygoteServer(isPrimaryZygote); if (startSystemServer) { Runnable r = forkSystemServer(abiList, zygoteSocketName, zygoteServer); // {@code r == null} in the parent (zygote) process, and {@code r != null} in the // child (system_server) process. if (r != null) { r.run(); return; } } Log.i(TAG, "Accepting command socket connections"); // The select loop returns early in the child process after a fork and // loops forever in the zygote. caller = zygoteServer.runSelectLoop(abiList); } catch(Throwable ex) { Log.e(TAG, "System zygote died with fatal exception", ex); throw ex; } finally { if (zygoteServer != null) { zygoteServer.closeServerSocket(); } } // We're in the child process and have exited the select loop. Proceed to execute the // command. if (caller != null) { caller.run(); } }

main方法主要处理以下内容：

ZygoteHooks.startZygoteNoThreadCreation() 标记zygote启动,单线程模式Java层调用native方法，源码：art/runtime/native/http://dalvik_system_ZygoteHooks.ccstatic void ZygoteHooks_startZygoteNoThreadCreation(JNIEnv* env ATTRIBUTE_UNUSED,jclass klass ATTRIBUTE_UNUSED) { Runtime::Current()->SetZygoteNoThreadSection(true); } static void ZygoteHooks_stopZygoteNoThreadCreation(JNIEnv* env ATTRIBUTE_UNUSED,jclass klass ATTRIBUTE_UNUSED) { Runtime::Current()->SetZygoteNoThreadSection(false); } //调用上面2个方法设置zygote_no_threads_参数值，源码：/art/runtime/runtime.h void SetZygoteNoThreadSection(bool val) { zygote_no_threads_ = val; }android.system.Os.setpgid(0, 0) 设置进程组id为0RuntimeInit.preForkInit() Zygote Init预初始化，开启DDMS，设置MimeMappreload(bootTimingsTraceLog) 开始预加载resources，class,tffstatic void preload(TimingsTraceLog bootTimingsTraceLog) { //开始 beginPreload(); //加载pre class,文件位置：frameworks/base/boot/preloaded-classes frameworks/base/config/preloaded-classes preloadClasses(); //加载无法放入Boot classpath的文件,/system/framework/android.hidl.base-V1.0-java.jar /system/framework/android.test.base.jar cacheNonBootClasspathClassLoaders(); //加载drawables、colors preloadResources(); //加载hal 硬件 nativePreloadAppProcessHALs(); //调用OpenGL/Vulkan加载图形驱动程序 maybePreloadGraphicsDriver(); //加载共享库，System.loadLibrary("android")（“jnigraphics”）（“compiler_rt”） preloadSharedLibraries(); //初始化TextView preloadTextResources(); //初始化WebView WebViewFactory.prepareWebViewInZygote(); //结束 endPreload(); warmUpJcaProviders(); sPreloadComplete = true; }gcAndFinalize() 在fork之前主动调用Java gcZygote.initNativeState(isPrimaryZygote) [1]从环境中获取套接字FD [2]初始化安全属性 [3]适当地卸载存储 [4]加载必要的性能配置文件信息ZygoteHooks.stopZygoteNoThreadCreation() 标记zygote停止维护单线程模式，可创建子线程zygoteServer = new ZygoteServer 初始化ZygoteServer - socket

调用Zygote.createManagedSocketFromInitSocket方法实例化LocalServerSocketImpl对象

//源码位置：/frameworks/base/core/java/android/net/LocalServerSocket.java // /frameworks/base/core/java/android/net/LocalSocketImpl.java public LocalServerSocket(String name) throws IOException { //实例化 impl = new LocalSocketImpl(); //创建socket流 impl.create(LocalSocket.SOCKET_STREAM); //建立本地通信地址 localAddress = new LocalSocketAddress(name); //绑定该地址 impl.bind(localAddress); //Linux函数listen 开启监听 impl.listen(LISTEN_BACKLOG); }Runnable r = forkSystemServer : fork出SystemServer，对应com.android.server.SystemServercaller = zygoteServer.runSelectLoop 一直循环接收socket消息 在runSelectLoop死循环中，会先创建StructPollfd数组并通过Os.poll函数转换为struct pollfd数组，如果是ZygoteServer socket对应的fd，则调用ZygoteConnection newPeer = acceptCommandPeer(abiList)建立socket连接，源码如下：//acceptCommandPeer private ZygoteConnection acceptCommandPeer(String abiList) { try { return createNewConnection(mZygoteSocket.accept(), abiList); } catch(IOException ex) { throw new RuntimeException("IOException during accept()", ex); } } //调用LocalSocketImpl的accept方法接受socket public LocalSocket accept() throws IOException { LocalSocketImpl acceptedImpl = new LocalSocketImpl(); impl.accept(acceptedImpl); //把LocalSocketImpl包装成LocalSocket对象 return LocalSocket.createLocalSocketForAccept(acceptedImpl); } //然后将LocalSocket包装成ZygoteConnection socket连接 ZygoteConnection(LocalSocket socket, String abiList) throws IOException { mSocket = socket; this.abiList = abiList; //开启写入流，准备写入数据 mSocketOutStream = new DataOutputStream(socket.getOutputStream()); mSocket.setSoTimeout(CONNECTION_TIMEOUT_MILLIS); try { peer = mSocket.getPeerCredentials(); } catch(IOException ex) { Log.e(TAG, "Cannot read peer credentials", ex); throw ex; } isEof = false; }

循环继续往下走，调用connection.processOneCommand执行socket命令，通过Zygote.readArgumentList读取socket传递参数，ZygoteArguments对象处理参数，一系列参数校验完成，开始调用Zygote.forkAndSpecialize创建子进程

static int forkAndSpecialize(int uid, int gid, int[] gids, int runtimeFlags, int[][] rlimits, int mountExternal, String seInfo, String niceName, int[] fdsToClose, int[] fdsToIgnore, boolean startChildZygote, String instructionSet, String appDataDir, boolean isTopApp, String[] pkgDataInfoList, String[] allowlistedDataInfoList, boolean bindMountAppDataDirs, boolean bindMountAppStorageDirs) { //1.预先fork时会停止zygote创建的4个守护进程，释放资源 //HeapTaskDaemon.INSTANCE.stop(); Java堆任务线程 //ReferenceQueueDaemon.INSTANCE.stop(); 引用队列线程 //FinalizerDaemon.INSTANCE.stop(); 析构线程 //FinalizerWatchdogDaemon.INSTANCE.stop(); 析构监控线程 //2.调用native方法完成gc heap初始化 //3.等待所有子线程结束 ZygoteHooks.preFork(); //调用native方法 int pid = nativeForkAndSpecialize(uid, gid, gids, runtimeFlags, rlimits, mountExternal, seInfo, niceName, fdsToClose, fdsToIgnore, startChildZygote, instructionSet, appDataDir, isTopApp, pkgDataInfoList, allowlistedDataInfoList, bindMountAppDataDirs, bindMountAppStorageDirs); if (pid == 0) { //监控handleChildProc处理，直到子进程fork完毕 Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "PostFork"); // If no GIDs were specified, don't make any permissions changes based on groups. if (gids != null && gids.length > 0) { NetworkUtilsInternal.setAllowNetworkingForProcess(containsInetGid(gids)); } } // Set the Java Language thread priority to the default value for new apps. Thread.currentThread().setPriority(Thread.NORM_PRIORITY); //fork结束后恢复其它线程 ZygoteHooks.postForkCommon(); return pid; } //nativeFork方法，源码位置：frameworks/base/core/jni/com_android_internal_os_Zygote.cpp private static native int nativeForkAndSpecialize(int uid, int gid, int[] gids, int runtimeFlags, int[][] rlimits, int mountExternal, String seInfo, String niceName, int[] fdsToClose, int[] fdsToIgnore, boolean startChildZygote, String instructionSet, String appDataDir, boolean isTopApp, String[] pkgDataInfoList, String[] allowlistedDataInfoList, boolean bindMountAppDataDirs, boolean bindMountAppStorageDirs); 我们继续往下查看handleChildProc子进程处理， private Runnable handleChildProc(ZygoteArguments parsedArgs, FileDescriptor pipeFd, boolean isZygote) { //进程创建完毕关闭socket closeSocket(); //设置进程名称 Zygote.setAppProcessName(parsedArgs, TAG); Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER); //这个地方mInvokeWith未找到调用源 if (parsedArgs.mInvokeWith != null) { WrapperInit.execApplication(parsedArgs.mInvokeWith, parsedArgs.mNiceName, parsedArgs.mTargetSdkVersion, VMRuntime.getCurrentInstructionSet(), pipeFd, parsedArgs.mRemainingArgs); throw new IllegalStateException("WrapperInit.execApplication unexpectedly returned"); } else { if (!isZygote) { return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion, parsedArgs.mDisabledCompatChanges, parsedArgs.mRemainingArgs, null); } else { return ZygoteInit.childZygoteInit(parsedArgs.mRemainingArgs); } } } //ZygoteInit.zygoteInit 源码位置：frameworks/base/core/java/com/android/internal/os/ZygoteInit.java public static Runnable zygoteInit(int targetSdkVersion, long[] disabledCompatChanges, String[] argv, ClassLoader classLoader) { ... Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ZygoteInit"); //重定向log流 RuntimeInit.redirectLogStreams(); //log、thread、AndroidConfig初始化 RuntimeInit.commonInit(); //最终调用AndroidRuntime-AppRuntime-onZygoteInit(),初始化binder ZygoteInit.nativeZygoteInit(); //应用初始化 return RuntimeInit.applicationInit(targetSdkVersion, disabledCompatChanges, argv, classLoader); } //源码位置：frameworks/base/core/java/com/android/internal/os/RuntimeInit.java protected static Runnable applicationInit(int targetSdkVersion, long[] disabledCompatChanges, String[] argv, ClassLoader classLoader) { //如果应用程序调用System.exit()，则终止进程立即运行，而不运行hooks;不可能优雅地关闭Android应用程序。 //除其他外Android运行时关闭挂钩关闭Binder驱动程序，这可能导致剩余的运行线程在进程实际退出之前崩溃 nativeSetExitWithoutCleanup(true); //设置targetVersion\disabledCompatChanges参数 VMRuntime.getRuntime().setTargetSdkVersion(targetSdkVersion); VMRuntime.getRuntime().setDisabledCompatChanges(disabledCompatChanges); //解析参数 final Arguments args = new Arguments(argv); // The end of of the RuntimeInit event (see #zygoteInit). Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER); //解析参数，调用startClass对应的main方法，此处class为：android.app.ActivityThread //通过反射查找main方法并创建MethodAndArgsCaller runnable执行对象 //通过调用ZygoteInit.runSelectLoop返回runnable caller,如果不为空caller.run return findStaticMain(args.startClass, args.startArgs, classLoader); }zygoteServer.closeServerSocket() 关闭接收socket消息5.SystemServer.java

Zygote的forkSystemServer方法最终会走到nativeForkSystemServer进行处理，对应源码位置：frameworks/base/core/jni/com_android_internal_os_Zygote.cpp

String[] args = { "--setuid=1000", "--setgid=1000", "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1023," + "1024,1032,1065,3001,3002,3003,3005,3006,3007,3009,3010,3011,3012", "--capabilities=" + capabilities + "," + capabilities, "--nice-name=system_server", "--runtime-args", "--target-sdk-version=" + VMRuntime.SDK_VERSION_CUR_DEVELOPMENT, "com.android.server.SystemServer", };

调用方法传参时定义了 "com.android.server.SystemServer",由此后续在调用ZygoteInit.zygoteInit、RuntimeInit.applicationInit、findStaticMain等方法后，最终会调用com.android.server.SystemServer main()方法，省略以上过程我们直接进入主入口源码

//源码路径：frameworks/base/services/java/com/android/server/SystemServer.java public static void main(String[] args) { new SystemServer().run(); } public SystemServer() { // Check for factory test mode. mFactoryTestMode = FactoryTest.getMode(); //记录进程启动信息 mStartCount = SystemProperties.getInt(SYSPROP_START_COUNT, 0) + 1; //设置时间 mRuntimeStartElapsedTime = SystemClock.elapsedRealtime(); mRuntimeStartUptime = SystemClock.uptimeMillis(); Process.setStartTimes(mRuntimeStartElapsedTime, mRuntimeStartUptime, mRuntimeStartElapsedTime, mRuntimeStartUptime); //记录是运行时重启还是重新启动 mRuntimeRestart = "1".equals(SystemProperties.get("sys.boot_completed")); } //run private void run() { TimingsTraceAndSlog t = new TimingsTraceAndSlog(); try { //监控开始 t.traceBegin("InitBeforeStartServices"); //进程系统属性信息 SystemProperties.set(SYSPROP_START_COUNT, String.valueOf(mStartCount)); SystemProperties.set(SYSPROP_START_ELAPSED, String.valueOf(mRuntimeStartElapsedTime)); SystemProperties.set(SYSPROP_START_UPTIME, String.valueOf(mRuntimeStartUptime)); EventLog.writeEvent(EventLogTags.SYSTEM_SERVER_START, mStartCount, mRuntimeStartUptime, mRuntimeStartElapsedTime); //设置时区 String timezoneProperty = SystemProperties.get("persist.sys.timezone"); if (!isValidTimeZoneId(timezoneProperty)) { Slog.w(TAG, "persist.sys.timezone is not valid (" + timezoneProperty + "); setting to GMT."); SystemProperties.set("persist.sys.timezone", "GMT"); } //设置系统语言 // NOTE: Most changes made here will need an equivalent change to // core/jni/AndroidRuntime.cpp if (!SystemProperties.get("persist.sys.language").isEmpty()) { final String languageTag = Locale.getDefault().toLanguageTag(); SystemProperties.set("persist.sys.locale", languageTag); SystemProperties.set("persist.sys.language", ""); SystemProperties.set("persist.sys.country", ""); SystemProperties.set("persist.sys.localevar", ""); } // The system server should never make non-oneway calls Binder.setWarnOnBlocking(true); // The system server should always load safe labels PackageItemInfo.forceSafeLabels(); // Default to FULL within the system server. SQLiteGlobal.sDefaultSyncMode = SQLiteGlobal.SYNC_MODE_FULL; // Deactivate SQLiteCompatibilityWalFlags until settings provider is initialized SQLiteCompatibilityWalFlags.init(null); // Here we go! Slog.i(TAG, "Entered the Android system server!"); final long uptimeMillis = SystemClock.elapsedRealtime(); EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_SYSTEM_RUN, uptimeMillis); if (!mRuntimeRestart) { FrameworkStatsLog.write(FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME_REPORTED, FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME__EVENT__SYSTEM_SERVER_INIT_START, uptimeMillis); } // In case the runtime switched since last boot (such as when // the old runtime was removed in an OTA), set the system // property so that it is in sync. We can't do this in // libnativehelper's JniInvocation::Init code where we already // had to fallback to a different runtime because it is // running as root and we need to be the system user to set // the property. http://b/11463182 //设置虚拟机属性 SystemProperties.set("persist.sys.dalvik.vm.lib.2", VMRuntime.getRuntime().vmLibrary()); //清理内存 VMRuntime.getRuntime().clearGrowthLimit(); // Some devices rely on runtime fingerprint generation, so make sure // we've defined it before booting further. Build.ensureFingerprintProperty(); // Within the system server, it is an error to access Environment paths without // explicitly specifying a user. Environment.setUserRequired(true); // Within the system server, any incoming Bundles should be defused // to avoid throwing BadParcelableException. BaseBundle.setShouldDefuse(true); // Within the system server, when parceling exceptions, include the stack trace Parcel.setStackTraceParceling(true); // Ensure binder calls into the system always run at foreground priority. BinderInternal.disableBackgroundScheduling(true); // Increase the number of binder threads in system_server BinderInternal.setMaxThreads(sMaxBinderThreads); // Prepare the main looper thread (this thread) android.os.Process.setThreadPriority(android.os.Process.THREAD_PRIORITY_FOREGROUND); android.os.Process.setCanSelfBackground(false); Looper.prepareMainLooper(); SystemServiceRegistry.sEnableServiceNotFoundWtf = true; // Initialize native services. System.loadLibrary("android_servers"); // Allow heap / perf profiling. initZygoteChildHeapProfiling(); // Debug builds - spawn a thread to monitor for fd leaks. if (Build.IS_DEBUGGABLE) { spawnFdLeakCheckThread(); } // Check whether we failed to shut down last time we tried. // This call may not return. performPendingShutdown(); // Initialize the system context. createSystemContext(); // Call per-process mainline module initialization. ActivityThread.initializeMainlineModules(); // Sets the dumper service ServiceManager.addService("system_server_dumper", mDumper); mDumper.addDumpable(this); // Create the system service manager. mSystemServiceManager = new SystemServiceManager(mSystemContext); mSystemServiceManager.setStartInfo(mRuntimeRestart, mRuntimeStartElapsedTime, mRuntimeStartUptime); mDumper.addDumpable(mSystemServiceManager); LocalServices.addService(SystemServiceManager.class, mSystemServiceManager); // Prepare the thread pool for init tasks that can be parallelized SystemServerInitThreadPool tp = SystemServerInitThreadPool.start(); mDumper.addDumpable(tp); // Load preinstalled system fonts for system server, so that WindowManagerService, etc // can start using Typeface. Note that fonts are required not only for text rendering, // but also for some text operations (e.g. TextUtils.makeSafeForPresentation()). if (Typeface.ENABLE_LAZY_TYPEFACE_INITIALIZATION) { Typeface.loadPreinstalledSystemFontMap(); } // Attach JVMTI agent if this is a debuggable build and the system property is set. if (Build.IS_DEBUGGABLE) { // Property is of the form "library_path=parameters". String jvmtiAgent = SystemProperties.get("persist.sys.dalvik.jvmtiagent"); if (!jvmtiAgent.isEmpty()) { int equalIndex = jvmtiAgent.indexOf('='); String libraryPath = jvmtiAgent.substring(0, equalIndex); String parameterList = jvmtiAgent.substring(equalIndex + 1, jvmtiAgent.length()); // Attach the agent. try { Debug.attachJvmtiAgent(libraryPath, parameterList, null); } catch(Exception e) { Slog.e("System", "*************************************************"); Slog.e("System", "********** Failed to load jvmti plugin: " + jvmtiAgent); } } } } finally { t.traceEnd(); // InitBeforeStartServices } // Setup the default WTF handler RuntimeInit.setDefaultApplicationWtfHandler(SystemServer: :handleEarlySystemWtf); // Start services. try { t.traceBegin("StartServices"); //引导服务[Watchdog][FileIntegrityService][Installer][AMS][PMS]... startBootstrapServices(t); //启动核心服务[Battery][SystemConfig][LooperState][GpuService]... startCoreServices(t); //其它服务[Network][Vpn][WMS][IMS][TelephonyRegistry]... startOtherServices(t); //Android Q APEX格式文件 startApexServices(t); } catch(Throwable ex) { Slog.e("System", "******************************************"); Slog.e("System", "************ Failure starting system services", ex); throw ex; } finally { t.traceEnd(); // StartServices } //初始化虚拟机StrictMode StrictMode.initVmDefaults(null); //非运行时重启或者首次启动或更新 if (!mRuntimeRestart && !isFirstBootOrUpgrade()) { final long uptimeMillis = SystemClock.elapsedRealtime(); FrameworkStatsLog.write(FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME_REPORTED, FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME__EVENT__SYSTEM_SERVER_READY, uptimeMillis); final long maxUptimeMillis = 60 * 1000; if (uptimeMillis > maxUptimeMillis) { Slog.wtf(SYSTEM_SERVER_TIMING_TAG, "SystemServer init took too long. uptimeMillis=" + uptimeMillis); } } // Loop forever. Looper.loop(); throw new RuntimeException("Main thread loop unexpectedly exited"); }

以上run方法源码原始英文注释非常详细，流程执行也很清晰，核心步骤如下

调用SystemServerInitThreadPool初始化线程池创建SystemServiceManager服务管理对象调用startBootstrapServices启动引导服务调用startCoreServices启动核心服务调用startOtherServices启动其它服务调用startApexServices启动APEX文件服务6. ActivityManagerService

ActivityManagerService主要管理系统中所有的应用进程和四大组件服务， LifeCycle.getService()返回ActivityTaskManagerService对象(Lifecycle继承于SystemService)，mSystemServiceManager.startService通过反射查找class并最终startService,我们接着看ActivityManagerService的构造函数

public ActivityManagerService(Context systemContext, ActivityTaskManagerService atm) { LockGuard.installLock(this, LockGuard.INDEX_ACTIVITY); // 初始化Injector对象 mInjector = new Injector(systemContext); mContext = systemContext; mFactoryTest = FactoryTest.getMode(); //获取SystemServer.createSystemContext函数中初始化的ActivityThread mSystemThread = ActivityThread.currentActivityThread(); mUiContext = mSystemThread.getSystemUiContext(); //TAG线程名，默认TAG_AM即ActivityManager前台线程,获取mHandler mHandlerThread = new ServiceThread(TAG, THREAD_PRIORITY_FOREGROUND, false/*allowIo*/); mHandlerThread.start(); //创建MainHandler,与mHandlerThread关联 mHandler = new MainHandler(mHandlerThread.getLooper()); //初始化UiHandler对象，继承于Handler mUiHandler = mInjector.getUiHandler(this); //新建mProcStartHandlerThread线程并于创建handle关联 mProcStartHandlerThread = new ServiceThread(TAG + ":procStart", THREAD_PRIORITY_FOREGROUND, false /* allowIo */ ); mProcStartHandlerThread.start(); mProcStartHandler = new ProcStartHandler(this, mProcStartHandlerThread.getLooper()); //ActivityManager常量管理 mConstants = new ActivityManagerConstants(mContext, this, mHandler); final ActiveUids activeUids = new ActiveUids(this, true /* postChangesToAtm */ ); mPlatformCompat = (PlatformCompat) ServiceManager.getService(Context.PLATFORM_COMPAT_SERVICE); mProcessList = mInjector.getProcessList(this); mProcessList.init(this, activeUids, mPlatformCompat); //profiler,低内存监控 mAppProfiler = new AppProfiler(this, BackgroundThread.getHandler().getLooper(), new LowMemDetector(this)); mPhantomProcessList = new PhantomProcessList(this); //OOM监控 mOomAdjuster = new OomAdjuster(this, mProcessList, activeUids); //监听BROADCAST_BG_CONSTANTS广播相关 // Broadcast policy parameters final BroadcastConstants foreConstants = new BroadcastConstants(Settings.Global.BROADCAST_FG_CONSTANTS); foreConstants.TIMEOUT = BROADCAST_FG_TIMEOUT; final BroadcastConstants backConstants = new BroadcastConstants(Settings.Global.BROADCAST_BG_CONSTANTS); backConstants.TIMEOUT = BROADCAST_BG_TIMEOUT; final BroadcastConstants offloadConstants = new BroadcastConstants(Settings.Global.BROADCAST_OFFLOAD_CONSTANTS); offloadConstants.TIMEOUT = BROADCAST_BG_TIMEOUT; // by default, no "slow" policy in this queue offloadConstants.SLOW_TIME = Integer.MAX_VALUE; mEnableOffloadQueue = SystemProperties.getBoolean("persist.device_config.activity_manager_native_boot.offload_queue_enabled", true); //初始化广播队列 mFgBroadcastQueue = new BroadcastQueue(this, mHandler, "foreground", foreConstants, false); mBgBroadcastQueue = new BroadcastQueue(this, mHandler, "background", backConstants, true); mBgOffloadBroadcastQueue = new BroadcastQueue(this, mHandler, "offload_bg", offloadConstants, true); mFgOffloadBroadcastQueue = new BroadcastQueue(this, mHandler, "offload_fg", foreConstants, true); mBroadcastQueues[0] = mFgBroadcastQueue; mBroadcastQueues[1] = mBgBroadcastQueue; mBroadcastQueues[2] = mBgOffloadBroadcastQueue; mBroadcastQueues[3] = mFgOffloadBroadcastQueue; //初始化后台服务管理对象 mServices = new ActiveServices(this); //ContentProvider helper mCpHelper = new ContentProviderHelper(this, true); //监控系统运行状况 mPackageWatchdog = PackageWatchdog.getInstance(mUiContext); //处理错误信息 mAppErrors = new AppErrors(mUiContext, this, mPackageWatchdog); mUidObserverController = new UidObserverController(mUiHandler); //初始化/data/system目录 final File systemDir = SystemServiceManager.ensureSystemDir(); //BatteryStatsService mBatteryStatsService = new BatteryStatsService(systemContext, systemDir, BackgroundThread.get().getHandler()); mBatteryStatsService.getActiveStatistics().readLocked(); mBatteryStatsService.scheduleWriteToDisk(); mOnBattery = DEBUG_POWER ? true: mBatteryStatsService.getActiveStatistics().getIsOnBattery(); mBatteryStatsService.getActiveStatistics().setCallback(this); mOomAdjProfiler.batteryPowerChanged(mOnBattery); //创建进程统计服务 mProcessStats = new ProcessStatsService(this, new File(systemDir, "procstats")); //AppOpsService mAppOpsService = mInjector.getAppOpsService(new File(systemDir, "appops.xml"), mHandler); mUgmInternal = LocalServices.getService(UriGrantsManagerInternal.class); //UserController管理多用户进程 mUserController = new UserController(this); //PendingIntent管理 mPendingIntentController = new PendingIntentController(mHandlerThread.getLooper(), mUserController, mConstants); ... //初始化ActivityTaskManagerService配置 mActivityTaskManager = atm; mActivityTaskManager.initialize(mIntentFirewall, mPendingIntentController, DisplayThread.get().getLooper()); //获取LocalService对象，继承于ActivityTaskManagerInternal mAtmInternal = LocalServices.getService(ActivityTaskManagerInternal.class); mHiddenApiBlacklist = new HiddenApiSettings(mHandler, mContext); mSdkSandboxSettings = new SdkSandboxSettings(mContext); //初始化监控 Watchdog.getInstance().addMonitor(this); //监控线程是否死锁 Watchdog.getInstance().addThread(mHandler); // bind background threads to little cores // this is expected to fail inside of framework tests because apps can't touch cpusets directly // make sure we've already adjusted system_server's internal view of itself first updateOomAdjLocked(OomAdjuster.OOM_ADJ_REASON_NONE); try { Process.setThreadGroupAndCpuset(BackgroundThread.get().getThreadId(), Process.THREAD_GROUP_SYSTEM); Process.setThreadGroupAndCpuset(mOomAdjuster.mCachedAppOptimizer.mCachedAppOptimizerThread.getThreadId(), Process.THREAD_GROUP_SYSTEM); } catch(Exception e) { Slog.w(TAG, "Setting background thread cpuset failed"); } mInternal = new LocalService(); mPendingStartActivityUids = new PendingStartActivityUids(); mTraceErrorLogger = new TraceErrorLogger(); mComponentAliasResolver = new ComponentAliasResolver(this); }

结合AMS的构造函数，大致处理以下内容

创建ServiceThread消息循环线程，并于MainHandler关联创建一些服务以及/data/system系统目录创建初始化Watchdog并监控系统、线程运行状况初始化广播队列其它初始化内容

ActivityManagerService.start() 启动方法，主要将服务注册到ServiceManager和LocalServices中供后续调用

private void start() { //注册服务到LocalService //LocalServices.addService(BatteryStatsInternal.class, new LocalService()); //ServiceManager.addService(BatteryStats.SERVICE_NAME, asBinder()); mBatteryStatsService.publish(); //系统操作 //ServiceManager.addService(Context.APP_OPS_SERVICE, asBinder()); //LocalServices.addService(AppOpsManagerInternal.class, mAppOpsManagerInternal); mAppOpsService.publish(); //应用进程信息 //LocalServices.addService(ProcessStatsInternal.class, new LocalService()); mProcessStats.publish(); //添加本地系统服务接口 //mAmInternal = LocalServices.getService(ActivityManagerInternal.class); //mUgmInternal = LocalServices.getService(UriGrantsManagerInternal.class); LocalServices.addService(ActivityManagerInternal.class, mInternal); LocalManagerRegistry.addManager(ActivityManagerLocal.class, (ActivityManagerLocal) mInternal); //LocalServices注册完成后，在ActivityTaskManagerService获取该对象 mActivityTaskManager.onActivityManagerInternalAdded(); //LocalServices注册完成后，在PendingIntentController获取该对象 mPendingIntentController.onActivityManagerInternalAdded(); //AppProfiler获取 mAppProfiler.onActivityManagerInternalAdded(); //初始化最近关键事件日志 CriticalEventLog.init(); }6.1 startBootstrapServices

bootstrap源码内容

private void startBootstrapServices(@NonNull TimingsTraceAndSlog t) { //初始化Watchdog final Watchdog watchdog = Watchdog.getInstance(); watchdog.start(); //加入dumper集合 mDumper.addDumpable(watchdog); //提交系统配置初始化任务到线程池 final String TAG_SYSTEM_CONFIG = "ReadingSystemConfig"; SystemServerInitThreadPool.submit(SystemConfig: :getInstance, TAG_SYSTEM_CONFIG); // Platform compat service is used by ActivityManagerService, PackageManagerService, and // possibly others in the future. b/135010838. //系统内部api变更 PlatformCompat platformCompat = new PlatformCompat(mSystemContext); ServiceManager.addService(Context.PLATFORM_COMPAT_SERVICE, platformCompat); ServiceManager.addService(Context.PLATFORM_COMPAT_NATIVE_SERVICE, new PlatformCompatNative(platformCompat)); AppCompatCallbacks.install(new long[0]); //启动文件完整性操作服务 mSystemServiceManager.startService(FileIntegrityService.class); // Wait for installd to finish starting up so that it has a chance to // create critical directories such as /data/user with the appropriate // permissions. We need this to complete before we initialize other services. //Installer继承于SystemSerivce,等待系统服务安装完成再初始化其它服务 Installer installer = mSystemServiceManager.startService(Installer.class); // In some cases after launching an app we need to access device identifiers, // therefore register the device identifier policy before the activity manager. //在ActivityManager启动前注册设备标识符(序列号) mSystemServiceManager.startService(DeviceIdentifiersPolicyService.class); // Uri Grants Manager. //管理Uri Permission mSystemServiceManager.startService(UriGrantsManagerService.Lifecycle.class); // Tracks rail data to be used for power statistics. //启动系统服务电量使用统计服务，WI-FI、GPS、显示器，提供数据监听回调 mSystemServiceManager.startService(PowerStatsService.class); //native方法，启动跨进程通信服务 //startStatsHidlService(); //startStatsAidlService(); startIStatsService(); // Start MemtrackProxyService before ActivityManager, so that early calls // to Memtrack::getMemory() don't fail. //内存监控代理服务 startMemtrackProxyService(); // Activity manager runs the show. // TODO: Might need to move after migration to WM. //获取ActivityManager ActivityTaskManagerService atm = mSystemServiceManager.startService(ActivityTaskManagerService.Lifecycle.class).getService(); mActivityManagerService = ActivityManagerService.Lifecycle.startService(mSystemServiceManager, atm); mActivityManagerService.setSystemServiceManager(mSystemServiceManager); mActivityManagerService.setInstaller(installer); mWindowManagerGlobalLock = atm.getGlobalLock(); // Data loader manager service needs to be started before package manager //SystemService数据加载管理器 mDataLoaderManagerService = mSystemServiceManager.startService(DataLoaderManagerService.class); // Incremental service needs to be started before package manager t.traceBegin("StartIncrementalService"); mIncrementalServiceHandle = startIncrementalService(); t.traceEnd(); // Power manager needs to be started early because other services need it. // Native daemons may be watching for it to be registered so it must be ready // to handle incoming binder calls immediately (including being able to verify // the permissions for those calls). //启动电源管理服务 mPowerManagerService = mSystemServiceManager.startService(PowerManagerService.class); //启动hal监听事件服务 mSystemServiceManager.startService(ThermalManagerService.class); mSystemServiceManager.startService(HintManagerService.class); t.traceEnd(); // Now that the power manager has been started, let the activity manager // initialize power management features. //前面已启动电源管理服务，现在通过ActivityManager初始化电源管理 mActivityManagerService.initPowerManagement(); // Bring up recovery system in case a rescue party needs a reboot //恢复模式 mSystemServiceManager.startService(RecoverySystemService.Lifecycle.class); // Now that we have the bare essentials of the OS up and running, take // note that we just booted, which might send out a rescue party if // we're stuck in a runtime restart loop. //已启动完基本配置服务，注册系统情况监听 RescueParty.registerHealthObserver(mSystemContext); PackageWatchdog.getInstance(mSystemContext).noteBoot(); // Manages LEDs and display backlight so we need it to bring up the display. //启动显示器服务 mSystemServiceManager.startService(LightsService.class); // Package manager isn't started yet; need to use SysProp not hardware feature if (SystemProperties.getBoolean("config.enable_display_offload", false)) { mSystemServiceManager.startService(WEAR_DISPLAYOFFLOAD_SERVICE_CLASS); } // Package manager isn't started yet; need to use SysProp not hardware feature if (SystemProperties.getBoolean("config.enable_sidekick_graphics", false)) { mSystemServiceManager.startService(WEAR_SIDEKICK_SERVICE_CLASS); } // Display manager is needed to provide display metrics before package manager // starts up. //启动显示窗口服务 mDisplayManagerService = mSystemServiceManager.startService(DisplayManagerService.class); // We need the default display before we can initialize the package manager. mSystemServiceManager.startBootPhase(t, SystemService.PHASE_WAIT_FOR_DEFAULT_DISPLAY); // Only run "core" apps if we're encrypting the device. String cryptState = VoldProperties.decrypt().orElse(""); if (ENCRYPTING_STATE.equals(cryptState)) { Slog.w(TAG, "Detected encryption in progress - only parsing core apps"); mOnlyCore = true; } else if (ENCRYPTED_STATE.equals(cryptState)) { Slog.w(TAG, "Device encrypted - only parsing core apps"); mOnlyCore = true; } // Start the package manager. if (!mRuntimeRestart) { FrameworkStatsLog.write(FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME_REPORTED, FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME__EVENT__PACKAGE_MANAGER_INIT_START, SystemClock.elapsedRealtime()); } //启动域名验证服务 DomainVerificationService domainVerificationService = new DomainVerificationService(mSystemContext, SystemConfig.getInstance(), platformCompat); mSystemServiceManager.startService(domainVerificationService); //包管理器 IPackageManager iPackageManager; t.traceBegin("StartPackageManagerService"); try { Watchdog.getInstance().pauseWatchingCurrentThread("packagemanagermain"); Pair < PackageManagerService, IPackageManager > pmsPair = PackageManagerService.main(mSystemContext, installer, domainVerificationService, mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore); mPackageManagerService = pmsPair.first; iPackageManager = pmsPair.second; } finally { Watchdog.getInstance().resumeWatchingCurrentThread("packagemanagermain"); } // Now that the package manager has started, register the dex load reporter to capture any // dex files loaded by system server. // These dex files will be optimized by the BackgroundDexOptService. SystemServerDexLoadReporter.configureSystemServerDexReporter(iPackageManager); mFirstBoot = mPackageManagerService.isFirstBoot(); mPackageManager = mSystemContext.getPackageManager(); if (!mRuntimeRestart && !isFirstBootOrUpgrade()) { FrameworkStatsLog.write(FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME_REPORTED, FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME__EVENT__PACKAGE_MANAGER_INIT_READY, SystemClock.elapsedRealtime()); } // Manages A/B OTA dexopting. This is a bootstrap service as we need it to rename // A/B artifacts after boot, before anything else might touch/need them. // Note: this isn't needed during decryption (we don't have /data anyways). if (!mOnlyCore) { boolean disableOtaDexopt = SystemProperties.getBoolean("config.disable_otadexopt", false); if (!disableOtaDexopt) { t.traceBegin("StartOtaDexOptService"); try { Watchdog.getInstance().pauseWatchingCurrentThread("moveab"); OtaDexoptService.main(mSystemContext, mPackageManagerService); } catch(Throwable e) { reportWtf("starting OtaDexOptService", e); } finally { Watchdog.getInstance().resumeWatchingCurrentThread("moveab"); t.traceEnd(); } } } //启动用户管理服务 mSystemServiceManager.startService(UserManagerService.LifeCycle.class); //初始化系统属性资源 // Initialize attribute cache used to cache resources from packages. AttributeCache.init(mSystemContext); // Set up the Application instance for the system process and get started. //1.添加meminfo\dbinfo\permission\processinfo\cacheinfo服务 //2.启动线程安装ApplicationInfo //3.同步监控并锁定ApplicationInfo 进程，缓存监控，OOM监控 //4.监控应用程序操作 mActivityManagerService.setSystemProcess(); // The package receiver depends on the activity service in order to get registered. platformCompat.registerPackageReceiver(mSystemContext); // Complete the watchdog setup with an ActivityManager instance and listen for reboots // Do this only after the ActivityManagerService is properly started as a system process //初始化watchdog watchdog.init(mSystemContext, mActivityManagerService); // DisplayManagerService needs to setup android.display scheduling related policies // since setSystemProcess() would have overridden policies due to setProcessGroup //设置DMS调度策略 mDisplayManagerService.setupSchedulerPolicies(); // Manages Overlay packages //启动Overlay资源管理服务 mSystemServiceManager.startService(new OverlayManagerService(mSystemContext)); // Manages Resources packages ResourcesManagerService resourcesService = new ResourcesManagerService(mSystemContext); resourcesService.setActivityManagerService(mActivityManagerService); mSystemServiceManager.startService(resourcesService); //传感器 mSystemServiceManager.startService(new SensorPrivacyService(mSystemContext)); if (SystemProperties.getInt("persist.sys.displayinset.top", 0) > 0) { // DisplayManager needs the overlay immediately. mActivityManagerService.updateSystemUiContext(); LocalServices.getService(DisplayManagerInternal.class).onOverlayChanged(); } // The sensor service needs access to package manager service, app op // service, and permissions service, therefore we start it after them. t.traceBegin("StartSensorService"); mSystemServiceManager.startService(SensorService.class); t.traceEnd(); t.traceEnd(); // startBootstrapServices completed }6.2 startCoreServices

启动的核心服务[Battery][SystemConfig][LooperState][GpuService][UsageStatsService][BugreportManagerService]等，具体细节可看源码

6.3 startOtherServices

启动其它服务为运行应用准备，该方法源码特别长，大致启动服务[Network][Vpn][WMS][IMS][TelephonyRegistry]如有需要可进入源码阅读,我们继续看主要节点

mActivityManagerService.systemReady(() - >{ //系统service已经准备完成 mSystemServiceManager.startBootPhase(t, SystemService.PHASE_ACTIVITY_MANAGER_READY); //监控native crashs try { mActivityManagerService.startObservingNativeCrashes(); } catch(Throwable e) { reportWtf("observing native crashes", e); } ... // No dependency on Webview preparation in system server. But this should // be completed before allowing 3rd party //在webView准备好后，第三方apk可以调用 final String WEBVIEW_PREPARATION = "WebViewFactoryPreparation"; Future < ?>webviewPrep = null; if (!mOnlyCore && mWebViewUpdateService != null) { webviewPrep = SystemServerInitThreadPool.submit(() - >{ Slog.i(TAG, WEBVIEW_PREPARATION); TimingsTraceAndSlog traceLog = TimingsTraceAndSlog.newAsyncLog(); traceLog.traceBegin(WEBVIEW_PREPARATION); ConcurrentUtils.waitForFutureNoInterrupt(mZygotePreload, "Zygote preload"); mZygotePreload = null; mWebViewUpdateService.prepareWebViewInSystemServer(); traceLog.traceEnd(); },WEBVIEW_PREPARATION); } //一系列系统组件准备完成 ... networkManagementF.systemReady(); networkPolicyF.networkScoreAndNetworkManagementServiceReady(); connectivityF.systemReady(); vpnManagerF.systemReady(); vcnManagementF.systemReady(); networkPolicyF.systemReady(networkPolicyInitReadySignal); ... //等待所有app数据预加载 mPackageManagerService.waitForAppDataPrepared(); // It is now okay to let the various system services start their // third party code... // confirm webview completion before starting 3rd party //等待WebView准备完成 if (webviewPrep != null) { ConcurrentUtils.waitForFutureNoInterrupt(webviewPrep, WEBVIEW_PREPARATION); } //三方app可以启动 mSystemServiceManager.startBootPhase(t, SystemService.PHASE_THIRD_PARTY_APPS_CAN_START); //启动在单独模块中运行的网络堆栈通信服务 try { // Note : the network stack is creating on-demand objects that need to send // broadcasts, which means it currently depends on being started after // ActivityManagerService.mSystemReady and ActivityManagerService.mProcessesReady // are set to true. Be careful if moving this to a different place in the // startup sequence. NetworkStackClient.getInstance().start(); } catch(Throwable e) { reportWtf("starting Network Stack", e); } //一系列组件已经准备好并运行 ... countryDetectorF.systemRunning(); networkTimeUpdaterF.systemRunning(); inputManagerF.systemRunning(); telephonyRegistryF.systemRunning(); mediaRouterF.systemRunning(); ... incident.systemRunning(); ... },t);//启动SystemUI,快接近Launcher启动 try { startSystemUi(context, windowManagerF); } catch(Throwable e) { reportWtf("starting System UI", e); }//startSystemUi private static void startSystemUi(Context context, WindowManagerService windowManager) { //获取本地包管理服务 PackageManagerInternal pm = LocalServices.getService(PackageManagerInternal.class); //设置启动intent Intent intent = new Intent(); intent.setComponent(pm.getSystemUiServiceComponent()); intent.addFlags(Intent.FLAG_DEBUG_TRIAGED_MISSING); //对阵系统用户启动服务 context.startServiceAsUser(intent, UserHandle.SYSTEM); //systemUI启动后调用 windowManager.onSystemUiStarted(); }//onSystemUiStarted实际调用最终指向PhoneWindowManager.java private void bindKeyguard() { synchronized(mLock) { if (mKeyguardBound) { return; } mKeyguardBound = true; } //绑定keyguardService服务 mKeyguardDelegate.bindService(mContext); }7.AMS.systemReady方法//通过以上所有ready\running工作，现在正式进入AMS.systemReady方法 public void systemReady(final Runnable goingCallback, @NonNull TimingsTraceAndSlog t) { //ActivityManager准备完成 mSystemServiceManager.preSystemReady(); //锁定并执行上述所有ready\running服务 synchronized(this) { if (mSystemReady) { // If we're done calling all the receivers, run the next "boot phase" passed in // by the SystemServer if (goingCallback != null) { goingCallback.run(); } return; } //所有工作准备就绪 mLocalDeviceIdleController = LocalServices.getService(DeviceIdleInternal.class); mActivityTaskManager.onSystemReady(); // Make sure we have the current profile info, since it is needed for security checks. mUserController.onSystemReady(); mAppOpsService.systemReady(); mProcessList.onSystemReady(); mAppRestrictionController.onSystemReady(); //设置准备完成标记 mSystemReady = true; } try { sTheRealBuildSerial = IDeviceIdentifiersPolicyService.Stub.asInterface(ServiceManager.getService(Context.DEVICE_IDENTIFIERS_SERVICE)).getSerial(); } catch(RemoteException e) {} //清理进程 ArrayList < ProcessRecord > procsToKill = null; synchronized(mPidsSelfLocked) { for (int i = mPidsSelfLocked.size() - 1; i >= 0; i--) { ProcessRecord proc = mPidsSelfLocked.valueAt(i); if (!isAllowedWhileBooting(proc.info)) { if (procsToKill == null) { procsToKill = new ArrayList < ProcessRecord > (); } procsToKill.add(proc); } } } synchronized(this) { if (procsToKill != null) { for (int i = procsToKill.size() - 1; i >= 0; i--) { ProcessRecord proc = procsToKill.get(i); Slog.i(TAG, "Removing system update proc: " + proc); mProcessList.removeProcessLocked(proc, true, false, ApplicationExitInfo.REASON_OTHER, ApplicationExitInfo.SUBREASON_SYSTEM_UPDATE_DONE, "system update done"); } } // Now that we have cleaned up any update processes, we // are ready to start launching real processes and know that // we won't trample on them any more. mProcessesReady = true; } ... ... //如果systemReady = true 未标记完成，执行此处ready\running服务 if (goingCallback != null) goingCallback.run(); ... ... //给BatteryStatsService发送状态 mBatteryStatsService.onSystemReady(); mBatteryStatsService.noteEvent(BatteryStats.HistoryItem.EVENT_USER_RUNNING_START, Integer.toString(currentUserId), currentUserId); mBatteryStatsService.noteEvent(BatteryStats.HistoryItem.EVENT_USER_FOREGROUND_START, Integer.toString(currentUserId), currentUserId); ... ... synchronized(this) { // Only start up encryption-aware persistent apps; once user is // unlocked we'll come back around and start unaware apps t.traceBegin("startPersistentApps"); //启动startPersistentApps startPersistentApps(PackageManager.MATCH_DIRECT_BOOT_AWARE); ... boolean isBootingSystemUser = currentUserId == UserHandle.USER_SYSTEM; // Some systems - like automotive - will explicitly unlock system user then switch // to a secondary user. // TODO(b/242195409): this workaround shouldn't be necessary once we move // the headless-user start logic to UserManager-land. if (isBootingSystemUser && !UserManager.isHeadlessSystemUserMode()) { //启动Launcher进程,回调给RootWindowContainer.startHomeOnAllDisplays， mAtmInternal.startHomeOnAllDisplays(currentUserId, "systemReady"); } ... t.traceBegin("resumeTopActivities"); mAtmInternal.resumeTopActivities(false ... } }//startHomeOnAllDisplays最终调用 - RootWindowContainer.java public boolean startHomeOnTaskDisplayArea(int userId, String reason, TaskDisplayArea taskDisplayArea, boolean allowInstrumenting, boolean fromHomeKey) { ... ... //获取homeIntent Intent homeIntent = null; //查询ActivityInfo ActivityInfo aInfo = null; if (taskDisplayArea == getDefaultTaskDisplayArea()) { //通过ActivityTaskManagerService获取intent homeIntent = mService.getHomeIntent(); //通过PackageManagerService解析intent aInfo = resolveHomeActivity(userId, homeIntent); } else if (shouldPlaceSecondaryHomeOnDisplayArea(taskDisplayArea)) { Pair < ActivityInfo, Intent > info = resolveSecondaryHomeActivity(userId, taskDisplayArea); aInfo = info.first; homeIntent = info.second; } ... ... // Updates the home component of the intent. //更新设置intent参数 homeIntent.setComponent(new ComponentName(aInfo.applicationInfo.packageName, aInfo.name)); homeIntent.setFlags(homeIntent.getFlags() | FLAG_ACTIVITY_NEW_TASK); // Updates the extra information of the intent. if (fromHomeKey) { homeIntent.putExtra(WindowManagerPolicy.EXTRA_FROM_HOME_KEY, true); if (mWindowManager.getRecentsAnimationController() != null) { mWindowManager.getRecentsAnimationController().cancelAnimationForHomeStart(); } } homeIntent.putExtra(WindowManagerPolicy.EXTRA_START_REASON, reason); // Update the reason for ANR debugging to verify if the user activity is the one that // actually launched. final String myReason = reason + ":" + userId + ":" + UserHandle.getUserId(aInfo.applicationInfo.uid) + ":" + taskDisplayArea.getDisplayId(); //通过获取到的intent、aInfo调用startHomeActivity启动launcher mService.getActivityStartController().startHomeActivity(homeIntent, aInfo, myReason, taskDisplayArea); return true; }//startHomeActivity方法 - ActivityStartController.java void startHomeActivity(Intent intent, ActivityInfo aInfo, String reason, TaskDisplayArea taskDisplayArea) { //ActivityOptions一系列参数 final ActivityOptions options = ActivityOptions.makeBasic(); options.setLaunchWindowingMode(WINDOWING_MODE_FULLSCREEN); if (!ActivityRecord.isResolverActivity(aInfo.name)) { options.setLaunchActivityType(ACTIVITY_TYPE_HOME); } final int displayId = taskDisplayArea.getDisplayId(); options.setLaunchDisplayId(displayId); options.setLaunchTaskDisplayArea(taskDisplayArea.mRemoteToken.toWindowContainerToken()); //执行启动executeRequest - execute()在ActivityStarter.java中 mLastHomeActivityStartResult = obtainStarter(intent, "startHomeActivity: " + reason).setOutActivity(tmpOutRecord).setCallingUid(0).setActivityInfo(aInfo).setActivityOptions(options.toBundle()).execute(); ... }execute()方法处理Activity启动请求，进入到executeRequest(mRequest);执行执行一系列权限检查，进入到startActivityUnchecked()校验初步权限检查是否完成，进入到startActivityInner()启动 Activity，并确定是否将activity添加到栈顶,进入到startActivityLocked()判断当前activity是否可见以及是否需要为其新建Task，并将ActivityRecord加入到Task栈顶中,进入到resumeFocusedTasksTopActivities() - RootWindowContainer.java ,主要判断targetRootTask是否处于栈顶，同时判断task是否处于暂停状态，进入到resumeTopActivityUncheckedLocked() - Task.java,递归调用该方法并查找栈顶可显示activity以及状态是否暂停，进入到resumeTopActivityInnerLocked() - Task.java,该方法主要处理ActivityRecord、设置resume状态、准备启动activity，进入到resumeTopActivity() - TaskFragment.java,查找栈顶activity是否处于running，检查所有暂停操作是否完成，进入到startSpecificActivity() - ActivityTaskSupervisor.java,如果activity已运行则直接启动，未运行则启动目标Activity,开启启动新进程，进入到startProcessAsync() - ActivityTaskManagerService.java，通过handle发送消息给AMS启动进程，ATMS不持有该锁，回到AMS中，进入到startProcessLocked() - ActivityManagerService.java,继续调用ProcessList.startProcessLocked() - ProcessList.java,最终调用startProcess(),定义final String entryPoint = "android.app.ActivityThread"; final Process.ProcessStartResult startResult = startProcess(hostingRecord, entryPoint, app, uid, gids, runtimeFlags, zygotePolicyFlags, mountExternal, seInfo, requiredAbi, instructionSet, invokeWith, startUptime);

以上调用链最终进入startProcess() - ProcessList.java，根据参数类型启动进程

final Process.ProcessStartResult startResult; boolean regularZygote = false; if (hostingRecord.usesWebviewZygote()) { startResult = startWebView(entryPoint, app.processName, uid, uid, gids, runtimeFlags, mountExternal, app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet, app.info.dataDir, null, app.info.packageName, app.getDisabledCompatChanges(), new String[] { PROC_START_SEQ_IDENT + app.getStartSeq() }); } else if (hostingRecord.usesAppZygote()) { final AppZygote appZygote = createAppZygoteForProcessIfNeeded(app); // We can't isolate app data and storage data as parent zygote already did that. startResult = appZygote.getProcess().start(entryPoint, app.processName, uid, uid, gids, runtimeFlags, mountExternal, app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet, app.info.dataDir, null, app.info.packageName, /*zygotePolicyFlags=*/ ZYGOTE_POLICY_FLAG_EMPTY, isTopApp, app.getDisabledCompatChanges(), pkgDataInfoMap, allowlistedAppDataInfoMap, false, false, new String[] { PROC_START_SEQ_IDENT + app.getStartSeq() }); } else { regularZygote = true; startResult = Process.start(entryPoint, app.processName, uid, uid, gids, runtimeFlags, mountExternal, app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet, app.info.dataDir, invokeWith, app.info.packageName, zygotePolicyFlags, isTopApp, app.getDisabledCompatChanges(), pkgDataInfoMap, allowlistedAppDataInfoMap, bindMountAppsData, bindMountAppStorageDirs, new String[] { PROC_START_SEQ_IDENT + app.getStartSeq() }); }

regularZygote表示常规的zygote32/zygote64，此处最终调用Process.start()创建进程，通过zygoteWriter发送给zygote进程，通知zygote开始fork进程，在前文ZygoteServer中【5. ZygoteInit.java类 - 8小节】，此处会循环接收来自AMS发送的消息，且entryPoint携带标记 "android.app.ActivityThread"，此时子进程入口即为：ActivityThread的main(), 基于此launcher进程已经启动，ActivityThread.main()最后调用Looper.loop()进入循环等待，子进程启动完成后AMS接着完成activity启动操作

8.启动Activity

经过上一节繁杂的的调用链，最终来到应用启动入口

public static void main(String[] args) { //安装选择性系统调用拦截 AndroidOs.install(); //关闭CloseGuard CloseGuard.setEnabled(false); //初始化user environment Environment.initForCurrentUser(); ... // Call per-process mainline module initialization. initializeMainlineModules(); //设置进程args Process.setArgV0(""); Looper.prepareMainLooper(); // Find the value for {@link #PROC_START_SEQ_IDENT} if provided on the command line. // It will be in the format "seq=114" long startSeq = 0; if (args != null) { for (int i = args.length - 1; i >= 0; --i) { if (args[i] != null && args[i].startsWith(PROC_START_SEQ_IDENT)) { startSeq = Long.parseLong(args[i].substring(PROC_START_SEQ_IDENT.length())); } } } //初始化ActivityThread ActivityThread thread = new ActivityThread(); thread.attach(false, startSeq); //获取MainThreadHandler if (sMainThreadHandler == null) { sMainThreadHandler = thread.getHandler(); } if (false) { Looper.myLooper().setMessageLogging(new LogPrinter(Log.DEBUG, "ActivityThread")); } //进入循环等待 Looper.loop(); throw new RuntimeException("Main thread loop unexpectedly exited"); } //继续看下thread.attach() private void attach(boolean system, long startSeq) { sCurrentActivityThread = this; mConfigurationController = new ConfigurationController(this); mSystemThread = system; if (!system) { android.ddm.DdmHandleAppName.setAppName("", UserHandle.myUserId()); //RuntimeInit设置launcher binder服务：ApplicationThread RuntimeInit.setApplicationObject(mAppThread.asBinder()); //获取ActivityManagerService,由IActivityManager代理 final IActivityManager mgr = ActivityManager.getService(); try { //通过IApplicationThread跨进程通知launcher进程开始绑定 mgr.attachApplication(mAppThread, startSeq); } catch(RemoteException ex) { throw ex.rethrowFromSystemServer(); } ... } else { ... } ... }@Override public final void attachApplication(IApplicationThread thread, long startSeq) { synchronized (this) { //通过binder获取进程id int callingPid = Binder.getCallingPid(); //获取user id final int callingUid = Binder.getCallingUid(); final long origId = Binder.clearCallingIdentity(); //启动正在等待的activity attachApplicationLocked(thread, callingPid, callingUid, startSeq); Binder.restoreCallingIdentity(origId); } }

再往下就是创建Application对象，回调attachBaseContext(),初始化ContentProvider,回调onCreate(),继续回调Application onCreate(), 此后就是Activity创建，调用attach(),执行onCreate方法，回调Activity各个生命周期方法，至此Launcher整体启动完成，AMS启动activity涉及多次跨进程通信，与zygote通信判断进程是否存在，不存在则fork新进程，并回调AMS执行其初始化方法，最后执行ActivityThread.main(),整体调用链非常繁杂，但各个模块各司其职，我们在应用层进行组件工程基础模型分割时也可参考其内部的架构方式

Android 学习手册

Android Framework底层原理篇：https://qr18.cn/AQpN4JAndroid 性能优化篇：https://qr18.cn/FVlo89Android 车载篇：https://qr18.cn/F05ZCMFlutter 篇：https://qr18.cn/DIvKmaAndroid 音视频篇：https://qr18.cn/Ei3VPDJetpack全家桶篇（内含Compose）：https://qr18.cn/A0gajpKotlin 篇：https://qr18.cn/CdjtAFGradle 篇：https://qr18.cn/DzrmMBOkHttp 源码解析笔记：https://qr18.cn/Cw0pBDAndroid 八大知识体：https://qr18.cn/CyxarUAndroid 核心笔记：https://qr21.cn/CaZQLoAndroid 面试题锦：https://qr18.cn/CKV8OZ

【本文地址】

Android系统Launcher启动流程

Android系统Launcher启动流程

今日新闻

推荐新闻