Android FrameWork - 開機啓動 SystemServer 進程

相關文章鏈接：

1. Android FrameWork - 學習啓動篇
2. Android FrameWork - 開機啓動 Zygote 進程
3. Android FrameWork - 開機啓動 SystemServer 進程

相關源碼文件：

/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
/frameworks/base/core/java/com/android/internal/os/Zygote.java
/frameworks/base/core/jni/com_android_internal_os_Zygote.cpp
/frameworks/base/core/java/com/android/internal/os/RuntimeInit.java
/frameworks/base/services/java/com/android/server/SystemServer.java
/frameworks/base/core/java/android/os/ServiceManager.java
/frameworks/base/core/java/android/os/ServiceManagerNative.java
/frameworks/base/core/java/com/android/internal/os/BinderInternal.java

Zygote 進程 的啓動過程中會調用 startSystemServer 方法來啓動 SystemServer 進程：

private static boolean startSystemServer(String abiList, String socketName) throws MethodAndArgsCaller, RuntimeException {
    ...
    // 設置一些參數 
    String args[] = {
        "--setuid=1000",
        "--setgid=1000",
        "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1032,3001,3002,3003,3006,3007",
        "--capabilities=" + capabilities + "," + capabilities,
        "--nice-name=system_server",
        "--runtime-args",
        "com.android.server.SystemServer",
    };

    ZygoteConnection.Arguments parsedArgs = null;
    int pid;
    try {
        ...
        // fork 創建 system_server 進程，後面會具體分析
        pid = Zygote.forkSystemServer(
                parsedArgs.uid, parsedArgs.gid,
                parsedArgs.gids,
                parsedArgs.debugFlags,
                null,
                parsedArgs.permittedCapabilities,
                parsedArgs.effectiveCapabilities);
    } catch (IllegalArgumentException ex) {
        throw new RuntimeException(ex);
    }

    //  pid == 0 代表子進程，也就是 system_server 進程
    if (pid == 0) {
        // 執行初始化 system_server 進程
        handleSystemServerProcess(parsedArgs);
    }
    return true;
}

1. 啓動 SystemServer

public static int forkSystemServer(int uid, int gid, int[] gids, int debugFlags,
  int[][] rlimits, long permittedCapabilities, long effectiveCapabilities) {
    VM_HOOKS.preFork();
    int pid = nativeForkSystemServer(uid, gid, gids, debugFlags, rlimits, permittedCapabilities, effectiveCapabilities);
    // Enable tracing as soon as we enter the system_server.
    if (pid == 0) {
      Trace.setTracingEnabled(true);
    }
    VM_HOOKS.postForkCommon();
    return pid;
}

// 調用的 native 方法去創建的，nativeForkSystemServer() 方法在 AndroidRuntime.cpp 中註冊的，調用 com_android_internal_os_Zygote.cpp 中的 com_android_internal_os_Zygote_nativeForkSystemServer() 方法
native private static int nativeForkSystemServer(int uid, int gid, int[] gids, int debugFlags,int[][] rlimits, long permittedCapabilities, long effectiveCapabilities);


static jint com_android_internal_os_Zygote_nativeForkSystemServer(
  JNIEnv* env, jclass, uid_t uid, gid_t gid, jintArray gids,
  jint debug_flags, jobjectArray rlimits, jlong permittedCapabilities,
  jlong effectiveCapabilities) {
  // fork 創建 systemserver 進程
  pid_t pid = ForkAndSpecializeCommon(env, uid, gid, gids,
    debug_flags, rlimits, permittedCapabilities, effectiveCapabilities,
    MOUNT_EXTERNAL_DEFAULT, NULL, NULL, true, NULL,NULL, NULL);
  // pid > 0 是父進程執行的邏輯
  if (pid > 0) {
      // waitpid 等待 SystemServer 進程的退出，如果退出了重啓 zygote 進程
      if (waitpid(pid, &status, WNOHANG) == pid) {
          RuntimeAbort(env);
      }
  }
  return pid;
}

static pid_t ForkAndSpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArray javaGids, jint debug_flags, jobjectArray javaRlimits, jlong permittedCapabilities, jlong effectiveCapabilities, jint mount_external, jstring java_se_info, jstring java_se_name, bool is_system_server, jintArray fdsToClose, jstring instructionSet, jstring dataDir) {
  //設置子進程的 signal 信號處理函數
  SetSigChldHandler(); 
  // fork 子進程(SystemServer)
  pid_t pid = fork();
  if (pid == 0) {
    // 進入子進程
    ...
    // gZygoteClass = com/android/internal/os/Zygote
    // gCallPostForkChildHooks = GetStaticMethodIDOrDie(env, gZygoteClass, "callPostForkChildHooks", "(ILjava/lang/String;)V");
    // 等價於調用 Zygote.callPostForkChildHooks()
    env->CallStaticVoidMethod(gZygoteClass, gCallPostForkChildHooks, debug_flags,is_system_server ? NULL : instructionSet);
    ...
  } else if (pid > 0) {
    // the parent process
  }
  return pid;
}

private static void handleSystemServerProcess( ZygoteConnection.Arguments parsedArgs) throws ZygoteInit.MethodAndArgsCaller {
  ...
  if (parsedArgs.invokeWith != null) {
    ...
  } else {
    ClassLoader cl = null;
    if (systemServerClasspath != null) {
      // 創建類加載器，並賦予當前線程
      cl = new PathClassLoader(systemServerClasspath, ClassLoader.getSystemClassLoader());
      Thread.currentThread().setContextClassLoader(cl);
    }
    // RuntimeInit.zygoteInit
    RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs, cl);
  }
}

public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader) throws ZygoteInit.MethodAndArgsCaller {
  ...
  // 通用的一些初始化
  commonInit();
  // 這個方法是 native 方法，主要是打開 binder 驅動，啓動 binder 線程，後面分析 binder 驅動的時候再詳解。
  nativeZygoteInit(); 
  // 應用初始化
  applicationInit(targetSdkVersion, argv, classLoader); 
}

private static void applicationInit(int targetSdkVersion, String[] argv, ClassLoader classLoader) throws ZygoteInit.MethodAndArgsCaller {
  ...  
  final Arguments args;
  try {
    // 解析參數 Arguments
    args = new Arguments(argv); 
  } catch (IllegalArgumentException ex) {
    return;
  }
  ...
  invokeStaticMain(args.startClass, args.startArgs, classLoader);
}

private static void invokeStaticMain(String className, String[] argv, ClassLoader classLoader) throws ZygoteInit.MethodAndArgsCaller {
  Class<?> cl = Class.forName(className, true, classLoader);
  ...

  Method m;
  try {
    m = cl.getMethod("main", new Class[] { String[].class });
  } catch (NoSuchMethodException ex) {
    ...
  } catch (SecurityException ex) {
    ...
  }
  ...
  // 通過拋出異常，回到了 ZygoteInit.main() 
  // try{} catch (MethodAndArgsCaller caller) {caller.run();}
  throw new ZygoteInit.MethodAndArgsCaller(m, argv);
}

繞了一大圈我們發現是通過拋異常回到了 ZygoteInit.main() 方法中的 try...catch(){ MethodAndArgsCaller.run() }

2. 創建 SystemServer

public static class MethodAndArgsCaller extends Exception implements Runnable {
  ...
  public void run() {
    try {
      // 根據傳遞過來的參數可知，此處通過反射機制調用的是 SystemServer.main() 方法
      mMethod.invoke(null, new Object[] { mArgs });
    } catch (IllegalAccessException ex) {
      ...
    }
}

public final class SystemServer {
  ...
  public static void main(String[] args) {
    new SystemServer().run();
  }

  private void run() {
    // 主線程 looper
    Looper.prepareMainLooper();

    // 初始化系統上下文
    createSystemContext();

    // 創建系統服務管理
    mSystemServiceManager = new SystemServiceManager(mSystemContext);
    // 將 mSystemServiceManager 添加到本地服務的成員 sLocalServiceObjects，sLocalServiceObjects 裏面是一個靜態的 map 集合
    LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);

    //啓動各種系統服務
    try {
      // 啓動引導服務 
      startBootstrapServices(); 
      // 啓動核心服務 
      startCoreServices();
      // 啓動其他服務
      startOtherServices();     
    } catch (Throwable ex) {
      Slog.e("System", "************ Failure starting system services", ex);
      throw ex;
    }

    // 一直循環執行
    Looper.loop();
    throw new RuntimeException("Main thread loop unexpectedly exited");
  }

  private void createSystemContext() {
    // 創建系統進程的上下文信息，這個在進程啓動再詳解
    ActivityThread activityThread = ActivityThread.systemMain();
    mSystemContext = activityThread.getSystemContext();
    ...
  }

  private void startBootstrapServices() {
    // 阻塞等待與 installd 建立 socket 通道
    Installer installer = mSystemServiceManager.startService(Installer.class);

    // 啓動服務 ActivityManagerService
    mActivityManagerService = mSystemServiceManager.startService(ActivityManagerService.Lifecycle.class).getService();
    mActivityManagerService.setSystemServiceManager(mSystemServiceManager);

    // 啓動服務 PackageManagerService
    mPackageManagerService = PackageManagerService.main(mSystemContext, installer, mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore);
    mPackageManager = mSystemContext.getPackageManager();

    // 設置 AMS , 把自己交給 ServiceManager. addService 去管理
    mActivityManagerService.setSystemProcess();

    ...
  }

  private void startCoreServices() {
      ...
  }

  private void startOtherServices() {
    // 啓動鬧鐘服務
    mSystemServiceManager.startService(AlarmManagerService.class); 
    // 初始化 Watchdog
    final Watchdog watchdog = Watchdog.getInstance();
    watchdog.init(context, mActivityManagerService); 
    // 輸入管理的 service
    inputManager = new InputManagerService(context);
    // WindowManagerService
    wm = WindowManagerService.main(...); 
    // InputManagerService 和 WindowManagerService 都交給 ServiceManager 管理
    ServiceManager.addService(Context.WINDOW_SERVICE, wm);
    ServiceManager.addService(Context.INPUT_SERVICE, inputManager);
    // 啓動input
    inputManager.start(); 
    // 顯示啓動界面
    ActivityManagerNative.getDefault().showBootMessage(...); 
    // 狀態欄管理
    statusBar = new StatusBarManagerService(context, wm); 
    // JobSchedulerService
    mSystemServiceManager.startService(JobSchedulerService.class); 
    ...
    // 準備好了 wms,  pms, ams 服務
    wm.systemReady();
    mPackageManagerService.systemReady();
    mActivityManagerService.systemReady();
  }

  ...
}

在 Android 系統中大約有 80 個系統服務，都是由 SystemServer 進程來創建的。作爲一個應用開發者來說，需要特別熟悉的大概有這麼四個：ActivityManagerService、WindowManagerService、PackageManagerService 和 InputManagerService，也就是我們常說的 ams、wms、pms 和 ims。

3. 管理 SystemServer

系統服務啓動後都會交給 ServiceManager 來管理，無論是 mSystemServiceManager.startService 還是 ServiceManager.addService 都是走的 ServiceManager.addService() 方法：

public static void addService(String name, IBinder service) {
  try {
    getIServiceManager().addService(name, service, false);
  } catch (RemoteException e) {
    Log.e(TAG, "error in addService", e);
  }
}

private static IServiceManager getIServiceManager() {
  if (sServiceManager != null) {
    return sServiceManager;
  }
  sServiceManager = ServiceManagerNative.asInterface(BinderInternal.getContextObject());
  return sServiceManager;
}

public abstract class ServiceManagerNative extends Binder implements IServiceManager {
  static public IServiceManager asInterface(IBinder obj)  {
    if (obj == null) {
      return null;
    }
    IServiceManager in =(IServiceManager)obj.queryLocalInterface(descriptor);
    if (in != null) {
      return in;
    }
    // 創建 ServiceManagerProxy 對象 
    return new ServiceManagerProxy(obj);
  }
}

class ServiceManagerProxy implements IServiceManager {
    private IBinder mRemote;
    
    public ServiceManagerProxy(IBinder remote) {
        mRemote = remote;
    }
    ...
    // IPC binder 驅動
    public void addService(String name, IBinder service, boolean allowIsolated)
           throws RemoteException {
      Parcel data = Parcel.obtain();
      Parcel reply = Parcel.obtain();
      data.writeInterfaceToken(IServiceManager.descriptor);
      data.writeString(name);
      data.writeStrongBinder(service);
      data.writeInt(allowIsolated ? 1 : 0);
      // mRemote 是 IBinder 對象
      mRemote.transact(ADD_SERVICE_TRANSACTION, data, reply, 0);
      reply.recycle();
      data.recycle();
    }
}

最後我們再來總結一下：SystemServer 進程是由 Zygote 進程 fork 創建的，SystemServer 進程創建後會創建啓動引導服務、核心服務和其他服務，並且將所創建的服務，通過跨進程通信交給 ServiceManager 進程來管理。至於怎麼啓動 ServiceManager 和 Binder 驅動跨進程通信，我們到後面的文章再去詳細分析，同時 Binder 驅動也是 FrameWork 源碼分析中最難的一個部分，希望我們能有所準備。