system_server进程启动过程

/base/core/java/com/android/internal/os/
 - ZygoteInit.java
 - Zygote.java
 - RuntimeInit.java
/base/core/jni/
 - com_android_internal_os_Zygote.cpp
/base/services/java/com/android/server/
 - SystemServer.java
/base/core/java/android/app/
 - ActivityThread.java
复制代码

phone进程是由system_server进程的startOtherServices发起创建的，有必要了解system_server进程启动过程。

1 启动zygote进程

zygote进程创建后，会进入ZygoteInit的main方法，main会去调用startSystemServer方法，开始创建system_server进程。

/base/core/java/com/android/internal/os/ZygoteInit.java
复制代码

public static void main(String argv[]) {
    try{
        if (startSystemServer) {
            startSystemServer(abiList, socketName);
        }
    } catch (MethodAndArgsCaller caller) {
    //RuntimeInit的invokeStaticMain抛出MethodAndArgsCaller被捕获，
    //反射进入SystemServer的main方法
            caller.run();
    } 
}

 private static boolean startSystemServer(String abiList, String socketName)
            throws MethodAndArgsCaller, RuntimeException {
    /* Hardcoded command line to start the system server */
        String args[] = {
            "--setuid=1000",
            "--setgid=1000",
            "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1032,3001,3002,3003,3006,3007",
            "--capabilities=" + capabilities + "," + capabilities,
            "--nice-name=system_server",
            "--runtime-args",
            "com.android.server.SystemServer",
        };
        ...
        /* Request to fork the system server process */
        //创建systemserver进程
            pid = Zygote.forkSystemServer(
                    parsedArgs.uid, parsedArgs.gid,
                    parsedArgs.gids,
                    parsedArgs.debugFlags,
                    null,
                    parsedArgs.permittedCapabilities,
                    parsedArgs.effectiveCapabilities);
        ...
        //进入systemserver进程，继续处理system_server中的任务
        handleSystemServerProcess(parsedArgs);
}
复制代码

2 native方式forksystem_server进程

参数 "--nice-name=system_server"中可以看出，startSystemServer将创建system_server进程，而且是通过JNI方式调用native方法nativeForkSystemServer。

base/core/java/com/android/internal/os/Zygote.java
复制代码

public static int forkSystemServer(int uid, int gid, int[] gids, int debugFlags,
            int[][] rlimits, long permittedCapabilities, long effectiveCapabilities) {
        VM_HOOKS.preFork();
        int pid = nativeForkSystemServer(
复制代码

nativeForkSystemServer的实现在/base/core/jni/com_android_internal_os_Zygote.cpp,最终会去调用fork方法，创建system_server进程。

/base/core/jni/com_android_internal_os_Zygote.cpp
复制代码

static jint com_android_internal_os_Zygote_nativeForkSystemServer(
        JNIEnv* env, jclass, uid_t uid, gid_t gid, jintArray gids,
        jint debug_flags, jobjectArray rlimits, jlong permittedCapabilities,
        jlong effectiveCapabilities) {
  pid_t pid = ForkAndSpecializeCommon(env, uid, gid, gids,
                                      debug_flags, rlimits,
                                      permittedCapabilities, effectiveCapabilities,
                                      MOUNT_EXTERNAL_DEFAULT, NULL, NULL, true, NULL,
                                      NULL, NULL);
}
static pid_t ForkAndSpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArray javaGids,
                                     jint debug_flags, jobjectArray javaRlimits,
                                     jlong permittedCapabilities, jlong effectiveCapabilities,
                                     jint mount_external,
                                     jstring java_se_info, jstring java_se_name,
                                     bool is_system_server, jintArray fdsToClose,
                                     jstring instructionSet, jstring dataDir) {
  SetSigChldHandler();

  pid_t pid = fork();//fork子进程
  }
复制代码

3 进程创建完成，继续初始化进程参数

system_server进程创建完之后，继续进入handleSystemServerProcess。

/base/core/java/com/android/internal/os/ZygoteInit.java
复制代码

private static void handleSystemServerProcess(
            ZygoteConnection.Arguments parsedArgs)
            throws ZygoteInit.MethodAndArgsCaller {
            /*
             * Pass the remaining arguments to SystemServer.
             */
            RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs, cl);进入system_server进程
    }
复制代码

在ZygoteInit的startSystemServer方法中传递的参数中有"com.android.server.SystemServer",继续传给zygoteInit，最终作为invokeStaticMain反射调用的参数。

4 抛出MethodAndArgsCaller

./base/core/java/com/android/internal/os/RuntimeInit.java
复制代码

public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
            throws ZygoteInit.MethodAndArgsCaller {
            applicationInit(targetSdkVersion, argv, classLoader);
            }
private static void applicationInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
            throws ZygoteInit.MethodAndArgsCaller {
            // Remaining arguments are passed to the start class's static main
        //args.startClass为com.android.server.SystemServer
        invokeStaticMain(args.startClass, args.startArgs, classLoader);
}
private static void invokeStaticMain(String className, String[] argv, ClassLoader classLoader)
            throws ZygoteInit.MethodAndArgsCaller {
        try {
            m = cl.getMethod("main", new Class[] { String[].class });
        }
        ...
        throw new ZygoteInit.MethodAndArgsCaller(m, argv);
}
复制代码

5 ZygoteInit捕获MethodAndArgsCaller，反射进入SystemServer的main

在RuntimeInit的invokeStaticMain抛出MethodAndArgsCaller，并被ZygoteInit的main方法捕获，进入ZygoteInit.MethodAndArgsCaller的run方法

/base/core/java/com/android/internal/os/ZygoteInit.java
复制代码

public static void main(String argv[]) {
    try{
        if (startSystemServer) {
            startSystemServer(abiList, socketName);
        }
    } catch (MethodAndArgsCaller caller) {
            caller.run();
    } 
}
public static class MethodAndArgsCaller extends Exception
            implements Runnable {
            public void run() {
                mMethod.invoke(null, new Object[] { mArgs });
            }
复制代码

6 system_server启动

开始进入SystemServer的main方法

./base/services/java/com/android/server/SystemServer.java
复制代码

public static void main(String[] args) {
        new SystemServer().run();
    }
    
private void run() {
            // Initialize the system context.
            createSystemContext();
            ...
            startBootstrapServices();
            startCoreServices();
            startOtherServices();//发起创建phone进程
}

    private void createSystemContext() {
        ActivityThread activityThread = ActivityThread.systemMain();
        mSystemContext = activityThread.getSystemContext();
        mSystemContext.setTheme(android.R.style.Theme_DeviceDefault_Light_DarkActionBar);
    }
复制代码

至此system_server进程就可以进行初始化，创建application对象，并启动一些核心服务,包括发起fork phone进程Android Phone进程启动过程。

7 创建system_server进程的application对象

frameworks/base/core/java/android/app/ActivityThread.java
复制代码

    public static ActivityThread systemMain() {
        // The system process on low-memory devices do not get to use hardware
        // accelerated drawing, since this can add too much overhead to the
        // process.
        ActivityThread thread = new ActivityThread();
        thread.attach(true);
        return thread;
    }

private void attach(boolean system) {
    if (!system) {
    ...
    }else {
            // Don't set application object here -- if the system crashes,
            // we can't display an alert, we just want to die die die.
            android.ddm.DdmHandleAppName.setAppName("system_process",
                    UserHandle.myUserId());
            try {
                mInstrumentation = new Instrumentation();
                ContextImpl context = ContextImpl.createAppContext(
                        this, getSystemContext().mPackageInfo);
                mInitialApplication = context.mPackageInfo.makeApplication(true, null);
                mInitialApplication.onCreate();
            } catch (Exception e) {
                throw new RuntimeException(
                        "Unable to instantiate Application():" + e.toString(), e);
            }
        }
}
复制代码

zygote进程启动过程

转载于:https://juejin.im/post/5c7cdd806fb9a049dc02fa6b