一．Zygote到SystemServer
SystemServer是由Zygote fork生成的，进程名为system_server，这个进程包含里framework中的核心服务，在Zygote的分析中有提到，SystemServer是在zygote中通过startSystemServer来调用起来
1.1 ZygoteInit.java中的startSystemServer函数
private static boolean startSystemServer(String abiList, String socketName)
throws MethodAndArgsCaller, RuntimeException {
…………..
/* Hardcoded command line to start the system server */
// 启动参数设置
String args[] = {
"--setuid=1000",
"--setgid=1000",
"--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1032,3001,3002,3003,3006,3007",
"--capabilities=" + capabilities + "," + capabilities,
"--nice-name=system_server",
"--runtime-args",
"com.android.server.SystemServer",
};
ZygoteConnection.Arguments parsedArgs = null;
int pid;
try {
// 解析参数，将上面的字符串数据转换成Arguments对象
parsedArgs = new ZygoteConnection.Arguments(args);
ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);
/* Request to fork the system server process */
// fork一个子进程，子进程就是system_server进程
pid = Zygote.forkSystemServer(
parsedArgs.uid, parsedArgs.gid,
parsedArgs.gids,
parsedArgs.debugFlags,
null,
parsedArgs.permittedCapabilities,
parsedArgs.effectiveCapabilities);
} catch (IllegalArgumentException ex) {
throw new RuntimeException(ex);
}
/* For child process */
// ford返回值等于0，表明是子进程即system_server所在分支代码
if (pid == 0) {
if (hasSecondZygote(abiList)) {
waitForSecondaryZygote(socketName);
}
// system_server进程所做的工作，在这里会启动各种支撑系统运行的System server
handleSystemServerProcess(parsedArgs);
}
return true;
}
1.2 Zygote.java中的forSystemServer函数
public static int forkSystemServer(int uid, int gid, int[] gids, int debugFlags,
int[][] rlimits, long permittedCapabilities, long effectiveCapabilities) {
VM_HOOKS.preFork();
int pid = nativeForkSystemServer(
uid, gid, gids, debugFlags, rlimits, permittedCapabilities, effectiveCapabilities);
// Enable tracing as soon as we enter the system_server.
if (pid == 0) {
Trace.setTracingEnabled(true);
}
VM_HOOKS.postForkCommon();
return pid;
}
nativeForkSystemServer会通过JNI调用com_android_internal_os_Zygote.cpp中的com_
android_internal_os_Zygote_nativeForkSystemServer方法。1.3 Com_android_internal_os_Zygote.cpp中com_internal_os_Zygote_nativeForkSystemServer方法
static jint com_android_internal_os_Zygote_nativeForkSystemServer(
JNIEnv* env, jclass, uid_t uid, gid_t gid, jintArray gids,
jint debug_flags, jobjectArray rlimits, jlong permittedCapabilities,
jlong effectiveCapabilities) {
// 下面的调用会fork一个子进程
pid_t pid = ForkAndSpecializeCommon(env, uid, gid, gids,
debug_flags, rlimits,
permittedCapabilities, effectiveCapabilities,
MOUNT_EXTERNAL_DEFAULT, NULL, NULL, true, NULL,
NULL, NULL);
if (pid > 0) {
// pid>0 代表在Zygote进程内，下面检测system_server进程是否已经创建
// The zygote process checks whether the child process has died or not.
ALOGI("System server process %d has been created", pid);
gSystemServerPid = pid;
// There is a slight window that the system server process has crashed
// but it went unnoticed because we haven't published its pid yet. So
// we recheck here just to make sure that all is well.
int status;
// 等待子进程退出，WNOHANG表示非阻塞
if (waitpid(pid, &status, WNOHANG) == pid) {
// 如果system_server刚刚创建就crash，重启zygote
ALOGE("System server process %d has died. Restarting Zygote!", pid);
RuntimeAbort(env);
}
}
return pid;
}
当system_server进程创建失败时，将会重启zygote进程。这里需要注意，对于Android 5.0以上系统，有两个zygote进程，分别是zygote、zygote64两个进程，system_server的父进程，一般来说64位系统其父进程是zygote64进程。
- 当kill system_server进程后，只重启zygote64和system_server，不重启zygote;
- 当kill zygote64进程后，只重启zygote64和system_server，也不重启zygote；
- 当kill zygote进程，则重启zygote、zygote64以及system_server。
1.4 com_android_internal_os_Zygote.cpp中ForkAndSpecializeCommon函数
这个函数有点复杂，设置处理信号这边大家还是看原生注释吧，有些地方我这边也不是看得特别明白。
// Utility routine to fork zygote and specialize the child process.
static pid_t ForkAndSpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArray javaGids,
jint debug_flags, jobjectArray javaRlimits,
jlong permittedCapabilities, jlong effectiveCapabilities,
jint mount_external,
jstring java_se_info, jstring java_se_name,
bool is_system_server, jintArray fdsToClose,
jstring instructionSet, jstring dataDir) {
// 设置子进程的signal信号处理函数
SetSigChldHandler();
sigset_t sigchld;
sigemptyset(&sigchld);
sigaddset(&sigchld, SIGCHLD);
// Temporarily block SIGCHLD during forks. The SIGCHLD handler might
// log, which would result in the logging FDs we close being reopened.
// This would cause failures because the FDs are not whitelisted.
//
// Note that the zygote process is single threaded at this point.
// 大概意思是暂时屏蔽SIGCHLD信号，不然SIGCHLD会产生log，而被我们关闭掉的
// logging文件描述符会对这个信号进行相应，所以会报错
if (sigprocmask(SIG_BLOCK, &sigchld, NULL) == -1) {
ALOGE("sigprocmask(SIG_SETMASK, { SIGCHLD }) failed: %s", strerror(errno));
RuntimeAbort(env, __LINE__, "Call to sigprocmask(SIG_BLOCK, { SIGCHLD }) failed.");
}
// Close any logging related FDs before we start evaluating the list of
// file descriptors.
__android_log_close();
// If this is the first fork for this zygote, create the open FD table.
// If it isn't, we just need to check whether the list of open files has
// changed (and it shouldn't in the normal case).
if (gOpenFdTable == NULL) {
gOpenFdTable = FileDescriptorTable::Create();
if (gOpenFdTable == NULL) {
RuntimeAbort(env, __LINE__, "Unable to construct file descriptor table.");
}
} else if (!gOpenFdTable->Restat()) {
RuntimeAbort(env, __LINE__, "Unable to restat file descriptor table.");
}
// Linux fork调用，创建子进程
pid_t pid = fork();
if (pid == 0) {
// The child process.
gMallocLeakZygoteChild = 1;
// Clean up any descriptors which must be closed immediately
// 清除一部分文件描述符
DetachDescriptors(env, fdsToClose);
// Re-open all remaining open file descriptors so that they aren't shared
// with the zygote across a fork.
if (!gOpenFdTable->ReopenOrDetach()) {
RuntimeAbort(env, __LINE__, "Unable to reopen whitelisted descriptors.");
}
if (sigprocmask(SIG_UNBLOCK, &sigchld, NULL) == -1) {
ALOGE("sigprocmask(SIG_SETMASK, { SIGCHLD }) failed: %s", strerror(errno));
RuntimeAbort(env, __LINE__, "Call to sigprocmask(SIG_UNBLOCK, { SIGCHLD }) failed.");
}
// Keep capabilities across UID change, unless we're staying root.
// 非root，禁止动态改变进程权限
if (uid != 0) {
EnableKeepCapabilities(env);
}
// 取消进程已有的Capabilities权限
DropCapabilitiesBoundingSet(env);
bool use_native_bridge = !is_system_server && (instructionSet != NULL)
&& android::NativeBridgeAvailable();
if (use_native_bridge) {
ScopedUtfChars isa_string(env, instructionSet);
use_native_bridge = android::NeedsNativeBridge(isa_string.c_str());
}
if (use_native_bridge && dataDir == NULL) {
// dataDir should never be null if we need to use a native bridge.
// In general, dataDir will never be null for normal applications. It can only happen in
// special cases (for isolated processes which are not associated with any app). These are
// launched by the framework and should not be emulated anyway.
use_native_bridge = false;
ALOGW("Native bridge will not be used because dataDir == NULL.");
}
if (!MountEmulatedStorage(uid, mount_external, use_native_bridge)) {
ALOGW("Failed to mount emulated storage: %s", strerror(errno));
if (errno == ENOTCONN || errno == EROFS) {
// When device is actively encrypting, we get ENOTCONN here
// since FUSE was mounted before the framework restarted.
// When encrypted device is booting, we get EROFS since
// FUSE hasn't been created yet by init.
// In either case, continue without external storage.
} else {
ALOGE("Cannot continue without emulated storage");
RuntimeAbort(env);
}
}
if (!is_system_server) {
// 对于非system_server，创建进程组
int rc = createProcessGroup(uid, getpid());
if (rc != 0) {
if (rc == -EROFS) {
ALOGW("createProcessGroup failed, kernel missing CONFIG_CGROUP_CPUACCT?");
} else {
ALOGE("createProcessGroup(%d, %d) failed: %s", uid, pid, strerror(-rc));
}
}
}
// 设置组代码
SetGids(env, javaGids);
// 设置资源限制
SetRLimits(env, javaRlimits);
if (use_native_bridge) {
ScopedUtfChars isa_string(env, instructionSet);
ScopedUtfChars data_dir(env, dataDir);
android::PreInitializeNativeBridge(data_dir.c_str(), isa_string.c_str());
}
// 设置真实的、有效的和保存过的组ID
int rc = setresgid(gid, gid, gid);
if (rc == -1) {
ALOGE("setresgid(%d) failed: %s", gid, strerror(errno));
RuntimeAbort(env);
}
// 设置真实的、有效的和保存过的用户ID
rc = setresuid(uid, uid, uid);
if (rc == -1) {
ALOGE("setresuid(%d) failed: %s", uid, strerror(errno));
RuntimeAbort(env);
}
if (NeedsNoRandomizeWorkaround()) {
// Work around ARM kernel ASLR lossage (http://b/5817320).
int old_personality = personality(0xffffffff);
int new_personality = personality(old_personality | ADDR_NO_RANDOMIZE);
if (new_personality == -1) {
ALOGW("personality(%d) failed: %s", new_personality, strerror(errno));
}
}
// 设置新的capabilities权限
SetCapabilities(env, permittedCapabilities, effectiveCapabilities);
// 设置调度策略
SetSchedulerPolicy(env);
const char* se_info_c_str = NULL;
ScopedUtfChars* se_info = NULL;
if (java_se_info != NULL) {
se_info = new ScopedUtfChars(env, java_se_info);
se_info_c_str = se_info->c_str();
if (se_info_c_str == NULL) {
ALOGE("se_info_c_str == NULL");
RuntimeAbort(env);
}
}
const char* se_name_c_str = NULL;
ScopedUtfChars* se_name = NULL;
if (java_se_name != NULL) {
se_name = new ScopedUtfChars(env, java_se_name);
se_name_c_str = se_name->c_str();
if (se_name_c_str == NULL) {
ALOGE("se_name_c_str == NULL");
RuntimeAbort(env);
}
}
// 设置selinux domain上下文
rc = selinux_android_setcontext(uid, is_system_server, se_info_c_str, se_name_c_str);
if (rc == -1) {
ALOGE("selinux_android_setcontext(%d, %d, \"%s\", \"%s\") failed", uid,
is_system_server, se_info_c_str, se_name_c_str);
RuntimeAbort(env);
}
// Make it easier to debug audit logs by setting the main thread's name to the
// nice name rather than "app_process".
if (se_info_c_str == NULL && is_system_server) {
se_name_c_str = "system_server";
}
if (se_info_c_str != NULL) {
SetThreadName(se_name_c_str);
}
delete se_info;
delete se_name;
// 将子进程system_server的SIGCHLD信号的处理函数修改回系统默认函数
UnsetSigChldHandler();
// JNI调，相当于zygote.callPostForkChildHooks()
env->CallStaticVoidMethod(gZygoteClass, gCallPostForkChildHooks, debug_flags,
is_system_server ? NULL : instructionSet);
if (env->ExceptionCheck()) {
ALOGE("Error calling post fork hooks.");
RuntimeAbort(env);
}
} else if (pid > 0) {
// 父进程中取消上面被屏蔽的SIGCHLD信号处理
// the parent process
// We blocked SIGCHLD prior to a fork, we unblock it here.
if (sigprocmask(SIG_UNBLOCK, &sigchld, NULL) == -1) {
ALOGE("sigprocmask(SIG_SETMASK, { SIGCHLD }) failed: %s", strerror(errno));
RuntimeAbort(env, __LINE__, "Call to sigprocmask(SIG_UNBLOCK, { SIGCHLD }) failed.");
}
}
return pid;
}
至此，fork的工作就基本做完了，剩下的就是在handleSystemServerProcess中对SystemServer的剩余工作进行处理了。
1.5 ZygoteInit.java中的handleSystemServerProcess函数
/**
* Finish remaining work for the newly forked system server process.
*/
private static void handleSystemServerProcess(
ZygoteConnection.Arguments parsedArgs)
throws ZygoteInit.MethodAndArgsCaller {
// 关闭从父进程Zygote中继承得来的sServersocket
closeServerSocket();
// set umask to 0077 so new files and directories will default to owner-only permissions.
Os.umask(S_IRWXG | S_IRWXO);
// 设置进程名为system_server
if (parsedArgs.niceName != null) {
Process.setArgV0(parsedArgs.niceName);
}
// SYSTEMSERVERCLASSPATH=/system/framework/services.jar:/system/framework/ethernet-service.jar:/system/framework/wifi-service.jar
final String systemServerClasspath = Os.getenv("SYSTEMSERVERCLASSPATH");
if (systemServerClasspath != null) {
// 进行dexopt优化
performSystemServerDexOpt(systemServerClasspath);
}
// system_server的invokeWith为null
if (parsedArgs.invokeWith != null) {
String[] args = parsedArgs.remainingArgs;
// If we have a non-null system server class path, we'll have to duplicate the
// existing arguments and append the classpath to it. ART will handle the classpath
// correctly when we exec a new process.
if (systemServerClasspath != null) {
String[] amendedArgs = new String[args.length + 2];
amendedArgs[0] = "-cp";
amendedArgs[1] = systemServerClasspath;
System.arraycopy(parsedArgs.remainingArgs, 0, amendedArgs, 2, parsedArgs.remainingArgs.length);
}
// 启动应用程序
WrapperInit.execApplication(parsedArgs.invokeWith,
parsedArgs.niceName, parsedArgs.targetSdkVersion,
VMRuntime.getCurrentInstructionSet(), null, args);
} else {
// system_server走该分支
ClassLoader cl = null;
if (systemServerClasspath != null) {
// 创建类加载器
cl = new PathClassLoader(systemServerClasspath, ClassLoader.getSystemClassLoader());
// 设置当前进程即system_server的类加载器
Thread.currentThread().setContextClassLoader(cl);
}
/*
* Pass the remaining arguments to SystemServer.
*/
// 最后调用zygoteinit
RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs, cl);
}
/* should never reach here */
}
1.6 ZygoteInit.java中的performSystemServerDexOpt函数
/**
* Performs dex-opt on the elements of {@code classPath}, if needed. We
* choose the instruction set of the current runtime.
*/
private static void performSystemServerDexOpt(String classPath) {
final String[] classPathElements = classPath.split(":");
// 创建一个InstallerConnection对象
final InstallerConnection installer = new InstallerConnection();
// 等待，直到与installed服务端连通为止
installer.waitForConnection();
final String instructionSet = VMRuntime.getRuntime().vmInstructionSet();
try {
for (String classPathElement : classPathElements) {
final int dexoptNeeded = DexFile.getDexOptNeeded(
classPathElement, "*", instructionSet, false /* defer */);
if (dexoptNeeded != DexFile.NO_DEXOPT_NEEDED) {
// 以system身份，执行dex优化
installer.dexopt(classPathElement, Process.SYSTEM_UID, false,
instructionSet, dexoptNeeded);
}
}
} catch (IOException ioe) {
throw new RuntimeException("Error starting system_server", ioe);
} finally {
// 断开与installed的socket连接
installer.disconnect();
}
}
1.7 RuntimeInit.java中的ZygoteInit函数
public static final void zygoteInit(int targetSdkVersion, String[] argv) throws MethodAndArgsCaller {
redirectLogStreams(); // 重定向Log输出
commonInit(); // 通用初始化
nativeZygoteInit(); // Zygote初始化
applicationInit(targetSdkVersion, argv); // 应用初始化
}
1.8 RuntimeInit.java中的commonInit函数
private static final void commonInit() {
// 设置当前线程的未捕获异常处设置为默认处理方法
Thread.setDefaultUncaughtExceptionHandler(new RuntimeInit.UncaughtHandler(null));
// 设置时区
TimezoneGetter.setInstance(new TimezoneGetter() {
public String getId() {
return SystemProperties.get("persist.sys.timezone");
}
});
TimeZone.setDefault((TimeZone)null);
// 重置Log设置
LogManager.getLogManager().reset();
// 设置Android Log
new AndroidConfig();
// 获取默认的userAgent
String userAgent = getDefaultUserAgent();
// 获取默认的HTTP user-agent，用于HttpURLConnection连接
System.setProperty("http.agent", userAgent);
// 设置网络流量统计
NetworkManagementSocketTagger.install();
// 如果是通过模拟器启动Android，可以通过F9/F10随时追踪kernel运行情况
String trace = SystemProperties.get("ro.kernel.android.tracing");
if(trace.equals("1")) {
Slog.i("AndroidRuntime", "NOTE: emulator trace profiling enabled");
Debug.enableEmulatorTraceOutput();
}
initialized = true;
}
1.9 AndroidRuntime.cpp中的com_android_internal_os_RuntimeInit_nativeZygoteInit方法
static void com_android_internal_os_RuntimeInit_nativeZygoteInit(JNIEnv* env, jobject clazz)
{
gCurRuntime->onZygoteInit();
}
onZygote的代码在app_main.cpp中，代码如下：
virtual void onZygoteInit()
{
// 获取ProcessState对象
sp proc = ProcessState::self();
ALOGV("App process: starting thread pool.\n");
// 启动线程池
proc->startThreadPool();
}
1.10 RuntimeInit.java中的applicationInit方法
private static void applicationInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
throws ZygoteInit.MethodAndArgsCaller {
// If the application calls System.exit(), terminate the process
// immediately without running any shutdown hooks. It is not possible to
// shutdown an Android application gracefully. Among other things, the
// Android runtime shutdown hooks close the Binder driver, which can cause
// leftover running threads to crash before the process actually exits.
// true代表在退出的时候不调用AppRuntime.onExit（）
nativeSetExitWithoutCleanup(true);
// We want to be fairly aggressive about heap utilization, to avoid
// holding on to a lot of memory that isn't needed.
// 设置虚拟机内存堆利用率为%75
VMRuntime.getRuntime().setTargetHeapUtilization(0.75f);
VMRuntime.getRuntime().setTargetSdkVersion(targetSdkVersion);
final Arguments args;
try {
// 解析传入的参数
args = new Arguments(argv);
} catch (IllegalArgumentException ex) {
Slog.e(TAG, ex.getMessage());
// let the process exit
return;
}
// The end of of the RuntimeInit event (see #zygoteInit).
Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
// Remaining arguments are passed to the start class's static main
// 调用startClass=“com.android.server.Systemserver”的static main方法
invokeStaticMain(args.startClass, args.startArgs, classLoader);
}
1.11 RuntimeInit.java中的invokeStaticMain方法
/**
* Invokes a static "main(argv[]) method on class "className".
* Converts various failing exceptions into RuntimeExceptions, with
* the assumption that they will then cause the VM instance to exit.
*
* @param className Fully-qualified class name
* @param argv Argument vector for main()
* @param classLoader the classLoader to load {@className} with
*/
// 用于启动className指向的类的static main(argv[])方法
private static void invokeStaticMain(String className, String[] argv, ClassLoader classLoader)
throws ZygoteInit.MethodAndArgsCaller {
Class<?> cl;
try {
// 装载className=”com.android.server.Systemserver”类，并初始化
cl = Class.forName(className, true, classLoader);
} catch (ClassNotFoundException ex) {
throw new RuntimeException(
"Missing class when invoking static main " + className,
ex);
}
Method m;
try {
// 获取className=”com.android.server.Systemserver”中的main方法
m = cl.getMethod("main", new Class[] { String[].class });
} catch (NoSuchMethodException ex) {
throw new RuntimeException(
"Missing static main on " + className, ex);
} catch (SecurityException ex) {
throw new RuntimeException(
"Problem getting static main on " + className, ex);
}
// 获取main方法的修饰符
int modifiers = m.getModifiers();
// main方法的修饰符需要是public static
if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {
throw new RuntimeException(
"Main method is not public and static on " + className);
}
/*
* This throw gets caught in ZygoteInit.main(), which responds
* by invoking the exception's run() method. This arrangement
* clears up all the stack frames that were required in setting
* up the process.
*/
// 通过抛出异常的方式，将调用返回到ZygoteInit.main函数中
throw new ZygoteInit.MethodAndArgsCaller(m, argv);
}
上面的函数调用最后是通过抛出ZygoteInit.MethodAndArgsCaller异常的方法，将方法的调用栈返回到ZygoteInit.main()函数中，下面我们在重新看看ZygoteInit的main函数是怎么处理这个异常的。
1.12 ZygoteInit.java中的main函数
public static void main(String argv[]) {
// 前面的代码在前面分析了，这里就省略不贴出来
………………
/// M: Added for BOOTPROF
addBootEvent(new String("Zygote:Preload End"));
if (startSystemServer) {
startSystemServer(abiList, socketName);
}
Log.i(TAG, "Accepting command socket connections");
runSelectLoop(abiList);
closeServerSocket();
} catch (MethodAndArgsCaller caller) {
// 在RuntimeInit.java的invokeStaticMain方法中抛出的异常在这里捕获
// 然后调用MethodAndArgsCaller的run方法
caller.run();
} catch (RuntimeException ex) {
Log.e(TAG, "Zygote died with exception", ex);
closeServerSocket();
throw ex;
}
}
1.13 ZygoteInit.java中的MethodAndArgsCaller类
/**
* Helper exception class which holds a method and arguments and
* can call them. This is used as part of a trampoline to get rid of
* the initial process setup stack frames.
*/
public static class MethodAndArgsCaller extends Exception
implements Runnable {
/** method to call */
private final Method mMethod;
/** argument array */
private final String[] mArgs;
public MethodAndArgsCaller(Method method, String[] args) {
// com.android.server.SystemServer类的main方法
mMethod = method;
// 传给main方法的参数
mArgs = args;
}
public void run() {
try {
// 调用com.android.server.SystemServer类的main方法
mMethod.invoke(null, new Object[] { mArgs });
} catch (IllegalAccessException ex) {
throw new RuntimeException(ex);
} catch (InvocationTargetException ex) {
Throwable cause = ex.getCause();
if (cause instanceof RuntimeException) {
throw (RuntimeException) cause;
} else if (cause instanceof Error) {
throw (Error) cause;
}
throw new RuntimeException(ex);
}
}
}
2. SystemServer的实际内容
第一部分介绍到Zygote最后会执行com.android.server.Systemserver的main函数，那程序就会直接跳转到main函数。
2.1 SystemServer.java中的main函数
/**
* The main entry point from zygote.
*/
public static void main(String[] args) {
new SystemServer().run();
}
2.2 SystemServer.java中的run函数
private void run() {
// If a device's clock is before 1970 (before 0), a lot of
// APIs crash dealing with negative numbers, notably
// java.io.File#setLastModified, so instead we fake it and
// hope that time from cell towers or NTP fixes it shortly.
// 如果时间早于1970年，这里就将时间强制设置为1970年
if (System.currentTimeMillis() < EARLIEST_SUPPORTED_TIME) {
Slog.w(TAG, "System clock is before 1970; setting to 1970.");
SystemClock.setCurrentTimeMillis(EARLIEST_SUPPORTED_TIME);
}
// If the system has "persist.sys.language" and friends set, replace them with
// "persist.sys.locale". Note that the default locale at this point is calculated
// using the "-Duser.locale" command line flag. That flag is usually populated by
// AndroidRuntime using the same set of system properties, but only the system_server
// and system apps are allowed to set them.
//
// NOTE: Most changes made here will need an equivalent change to
// core/jni/AndroidRuntime.cpp
if (!SystemProperties.get("persist.sys.language").isEmpty()) {
final String languageTag = Locale.getDefault().toLanguageTag();
SystemProperties.set("persist.sys.locale", languageTag);
SystemProperties.set("persist.sys.language", "");
SystemProperties.set("persist.sys.country", "");
SystemProperties.set("persist.sys.localevar", "");
}
// Here we go!
Slog.i(TAG, "Entered the Android system server!");
EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_SYSTEM_RUN, SystemClock.uptimeMillis());
/// M: BOOTPROF @{
mMTPROF_disable = "1".equals(SystemProperties.get("ro.mtprof.disable"));
addBootEvent(new String("Android:SysServerInit_START"));
/// @}
// In case the runtime switched since last boot (such as when
// the old runtime was removed in an OTA), set the system
// property so that it is in sync. We can't do this in
// libnativehelper's JniInvocation::Init code where we already
// had to fallback to a different runtime because it is
// running as root and we need to be the system user to set
// the property. http://b/11463182
SystemProperties.set("persist.sys.dalvik.vm.lib.2", VMRuntime.getRuntime().vmLibrary());
// Enable the sampling profiler.
// 启动SampleingProfilerIntegration进行性能统计
if (SamplingProfilerIntegration.isEnabled()) {
SamplingProfilerIntegration.start();
mProfilerSnapshotTimer = new Timer();
mProfilerSnapshotTimer.schedule(new TimerTask() {
@Override
public void run() {
SamplingProfilerIntegration.writeSnapshot("system_server", null);
}
// SNAPSHOT_INTERVAL=60*60*1000，所以是一个小时进行一次性能统计
// 保存的snapshot保存到/data/snapshots/system_server中
}, SNAPSHOT_INTERVAL, SNAPSHOT_INTERVAL);
}
// Mmmmmm... more memory!
// 清除虚拟机运行时内存增长上限
VMRuntime.getRuntime().clearGrowthLimit();
// The system server has to run all of the time, so it needs to be
// as efficient as possible with its memory usage.
// 设置虚拟机运行时内存堆利用率为80%
VMRuntime.getRuntime().setTargetHeapUtilization(0.8f);
// Some devices rely on runtime fingerprint generation, so make sure
// we've defined it before booting further.
// 确认ro.build.fingerprint属性值是否存在，如果不存在则设置该属性值
Build.ensureFingerprintProperty();
// Within the system server, it is an error to access Environment paths without
// explicitly specifying a user.
// 需要设置指定用户后才能够访问环境变量
Environment.setUserRequired(true);
// Ensure binder calls into the system always run at foreground priority.
// 确保binder系统调用运行在前台优先级
BinderInternal.disableBackgroundScheduling(true);
// Prepare the main looper thread (this thread).
// 设置system_server的优先级为前台优先级
android.os.Process.setThreadPriority(
android.os.Process.THREAD_PRIORITY_FOREGROUND);
// 禁止system_server将自身设置为后台优先级
android.os.Process.setCanSelfBackground(false);
// 创建主线程looper
Looper.prepareMainLooper();
// Initialize native services.
// 加载android_servers.so库
System.loadLibrary("android_servers");
///M:Add for low storage feature,to delete the reserver file.@{
try {
Runtime.getRuntime().exec("rm -r /data/piggybank");
} catch (IOException e) {
Slog.e(TAG, "system server init delete piggybank fail" + e);
}
///@}
// Check whether we failed to shut down last time we tried.
// This call may not return.
// 检查上次是否是正常关闭，该方法可能不会返回
performPendingShutdown();
// Initialize the system context.
// 初始化系统上下文
createSystemContext();
// Create the system service manager.
// 创建SystemServiceManager
mSystemServiceManager = new SystemServiceManager(mSystemContext);
// 将SystemServiceManager成员添加到本地service对象中
LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
// Start services.
try {
// 启动引导服务
startBootstrapServices();
// 启动核心服务
startCoreServices();
// 启动剩余的其他服务
startOtherServices();
} catch (Throwable ex) {
Slog.e("System", "******************************************");
Slog.e("System", "************ Failure starting system services", ex);
/// M: RecoveryManagerService @{
if (mRecoveryManagerService != null && ex instanceof RuntimeException) {
mRecoveryManagerService.handleException((RuntimeException) ex, true);
} else {
throw ex;
}
/// @}
}
// For debug builds, log event loop stalls to dropbox for analysis.
if (StrictMode.conditionallyEnableDebugLogging()) {
Slog.i(TAG, "Enabled StrictMode for system server main thread.");
}
/// M: BOOTPROF
addBootEvent(new String("Android:SysServerInit_END"));
// Loop forever.
// 进入消息处理循环
Looper.loop();
throw new RuntimeException("Main thread loop unexpectedly exited");
}
2.3 SystemServer.java中的performPendingShutdown函数
private void performPendingShutdown() {
// SHUTDOWN_ACTION_PROPERTY=”sys.shutdown.requested”
final String shutdownAction = SystemProperties.get(
ShutdownThread.SHUTDOWN_ACTION_PROPERTY, "");
if (shutdownAction != null && shutdownAction.length() > 0) {
boolean reboot = (shutdownAction.charAt(0) == '1');
final String reason;
if (shutdownAction.length() > 1) {
reason = shutdownAction.substring(1, shutdownAction.length());
} else {
reason = null;
}
// 如果sys.shutdown.requested的值不为空，就会重启或者关机
ShutdownThread.rebootOrShutdown(null, reboot, reason);
}
}
2.4 SystemServer.java中的createSystemcontext函数
private void createSystemContext() {
// 获取ActivityThread对象
ActivityThread activityThread = ActivityThread.systemMain();
// 创建并获取ContextImpl对象
mSystemContext = activityThread.getSystemContext();
// 设置系统主题
mSystemContext.setTheme(android.R.style.Theme_DeviceDefault_Light_DarkActionBar);
}
2.5 SystemServer.java中的startBootstrapServices函数
/**
* Starts the small tangle of critical services that are needed to get
* the system off the ground. These services have complex mutual dependencies
* which is why we initialize them all in one place here. Unless your service
* is also entwined in these dependencies, it should be initialized in one of
* the other functions.
*/
private void startBootstrapServices() {
// Wait for installd to finish starting up so that it has a chance to
// create critical directories such as /data/user with the appropriate
// permissions. We need this to complete before we initialize other services.
// 启动Installer系统服务
Installer installer = mSystemServiceManager.startService(Installer.class);
/// M: MSG Logger Manager @{
if (!IS_USER_BUILD) {
try {
MessageMonitorService msgMonitorService = null;
msgMonitorService = new MessageMonitorService();
Slog.e(TAG, "Create message monitor service successfully .");
// Add this service to service manager
ServiceManager.addService(Context.MESSAGE_MONITOR_SERVICE,
msgMonitorService.asBinder());
} catch (Throwable e) {
Slog.e(TAG, "Starting message monitor service exception ", e);
}
}
/// MSG Logger Manager @}
// Activity manager runs the show.
// 启动AMS，同时设置AMS的SystemServiceManager和Installer
mActivityManagerService = mSystemServiceManager.startService(
ActivityManagerService.Lifecycle.class).getService();
mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
mActivityManagerService.setInstaller(installer);
// Power manager needs to be started early because other services need it.
// Native daemons may be watching for it to be registered so it must be ready
// to handle incoming binder calls immediately (including being able to verify
// the permissions for those calls).
// 启动PowerManagerService
mPowerManagerService = mSystemServiceManager.startService(PowerManagerService.class);
// Now that the power manager has been started, let the activity manager
// initialize power management features.
// 初始化PowerManagerService
mActivityManagerService.initPowerManagement();
// Manages LEDs and display backlight so we need it to bring up the display.
// 启动LightService
mSystemServiceManager.startService(LightsService.class);
// Display manager is needed to provide display metrics before package manager
// starts up.
// 启动DisplayManagerService
mDisplayManagerService = mSystemServiceManager.startService(DisplayManagerService.class);
// We need the default display before we can initialize the package manager.
// 等待Display默认显示
mSystemServiceManager.startBootPhase(SystemService.PHASE_WAIT_FOR_DEFAULT_DISPLAY);
// Only run "core" apps if we're encrypting the device.
// 当设备处于加密过程中，则只运行核心应用程序
String cryptState = SystemProperties.get("vold.decrypt");
if (ENCRYPTING_STATE.equals(cryptState)) {
Slog.w(TAG, "Detected encryption in progress - only parsing core apps");
mOnlyCore = true;
} else if (ENCRYPTED_STATE.equals(cryptState)) {
Slog.w(TAG, "Device encrypted - only parsing core apps");
mOnlyCore = true;
}
// Start the package manager.
Slog.i(TAG, "Package Manager");
// 启动PackageManagerService
mPackageManagerService = PackageManagerService.main(mSystemContext, installer,
mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore);
// 判断手机是否是第一次启动
mFirstBoot = mPackageManagerService.isFirstBoot();
// 获取PakcageManager对象
mPackageManager = mSystemContext.getPackageManager();
Slog.i(TAG, "User Service");
// 启动UserManagerService，并添加到ServiceManager中
ServiceManager.addService(Context.USER_SERVICE, UserManagerService.getInstance());
// Initialize attribute cache used to cache resources from packages.
// 初始化属性缓存
AttributeCache.init(mSystemContext);
// Set up the Application instance for the system process and get started.
// 设置AMS
mActivityManagerService.setSystemProcess();
// The sensor service needs access to package manager service, app ops
// service, and permissions service, therefore we start it after them.
// 启动SensorService
startSensorService();
}
2.6 SystemServer.java中的startCoreServices函数
/**
* Starts some essential services that are not tangled up in the bootstrap process.
*/
private void startCoreServices() {
// Tracks the battery level. Requires LightService.
// 启动BatteryService，用于统计电池电量信息
mSystemServiceManager.startService(BatteryService.class);
// Tracks application usage stats.
// 启动UsageStatsService，用于统计应用使用情况
mSystemServiceManager.startService(UsageStatsService.class);
mActivityManagerService.setUsageStatsManager(
LocalServices.getService(UsageStatsManagerInternal.class));
// Update after UsageStatsService is available, needed before performBootDexOpt.
mPackageManagerService.getUsageStatsIfNoPackageUsageInfo();
// Tracks whether the updatable WebView is in a ready state and watches for update installs.
// 启动WebViewUpdateService
mSystemServiceManager.startService(WebViewUpdateService.class);
}
2.7 其余Service
最后就是通过SystemServer.java中的startOtherService方法启动的service了，因为start OtherService这个方法里面启动的service比较多，例如：AudioService、CameraService、AccountService等，而且方法内容长，所以就不贴出来了，各位有兴趣可以自己去看，后续如果有分析到具体的某一个service，到时候再拿出来看就好了。
2.8 小总结
从代码中可以看到，System_server启动service的方法主要是通过两种方式：一种是通过SystemServiceManager的startService()，这个方法主要是用来启动继承于SystemService的服务。主要过程为，首先创建serviceClass类的对象，然后将刚刚创建的serviceClass类对象添加到SystemServiceManager的成员对象mServices（是一个Arraylist），然后再调用刚创建对象的onStart方法。对于那些启动到一定阶段的服务，进入到相应阶段的Phase后，还会调用到SystemServiceManager的startBootPhase()回掉方法，这个方法会循环遍历所有向SystemServiceManager注册过的service的onBootPhase()方法；另外一种就是通过ServiceManager的addService(String name, IBinder service)，该方法用于初始化继承于IBinder的服务。
启动过程中各个Phase所代表的阶段如下：
/*
* Boot Phases
*/
// 该阶段需要等待Display有默认显示
public static final int PHASE_WAIT_FOR_DEFAULT_DISPLAY = 100; // maybe should be a dependency?
/**
* After receiving this boot phase, services can obtain lock settings data.
*/
// 该阶段后服务可以获取到锁屏设置的数据了
public static final int PHASE_LOCK_SETTINGS_READY = 480;
/**
* After receiving this boot phase, services can safely call into core system services
* such as the PowerManager or PackageManager.
*/
// 该阶段后，服务可以安全的调用核心系统服务了，例如Power Manager和PackageManager
public static final int PHASE_SYSTEM_SERVICES_READY = 500;
/**
* After receiving this boot phase, services can broadcast Intents.
*/
// 该阶段后，服务可以接收到广播Intents
public static final int PHASE_ACTIVITY_MANAGER_READY = 550;
/**
* After receiving this boot phase, services can start/bind to third party apps.
* Apps will be able to make Binder calls into services at this point.
*/
// 该阶段后，服务可以启动/绑定到第三方的app了
public static final int PHASE_THIRD_PARTY_APPS_CAN_START = 600;
/**
* After receiving this boot phase, services can allow user interaction with the device.
* This phase occurs when boot has completed and the home application has started.
* System services may prefer to listen to this phase rather than registering a
* broadcast receiver for ACTION_BOOT_COMPLETED to reduce overall latency.
*/
// 该阶段后，允许用户和设备进行交互了，该阶段发生再启动完成以及home ap已经启动了，系统的服务更倾向于注册监听该广播而非ACTION_BOOT_COMPLETED
public static final int PHASE_BOOT_COMPLETED = 1000;
本文章为转载内容，我们尊重原作者对文章享有的著作权。如有内容错误或侵权问题，欢迎原作者联系我们进行内容更正或删除文章。
