原文地址 http://blog.csdn.net/qq_25806863/article/details/70820063
概括
基于Android7.1源码。
结合一些文章想看一下Android的SystemServer的产生和启动，发现7.1的代码和文章上的不太一样，只玩的源码我也没看过，不知道什么时候开始变得。就做一个记录。
大致流程就是
init进程
init是Android系统中用户级的第一个进程。通过ps命令可以看到，进程ID是1.
既然整个用户系统都是从init开始的，那么SystemService肯定也是从这里创建了。
init进程的入口是main()方法
/system/core/init/init.cpp：
int main(int argc, char** argv) {
parser.ParseConfig("/init.rc");
}要解析一个init.rc文件
/system/core/rootdir/init.rc:
import /init.${ro.zygote}.rc在这个文件夹下还有这些文件：
以init.zygote64.rc为例
/system/core/rootdir/init.zygote64.rc
service zygote /system/bin/app_process64 -Xzygote /system/bin --zygote --start-system-server
class main
socket zygote stream 660 root system
onrestart write /sys/android_power/request_state wake
onrestart write /sys/power/state on
onrestart restart audioserver
onrestart restart cameraserver
onrestart restart media
onrestart restart netd
writepid /dev/cpuset/foreground/tasks通过解析这个文件，会从init进程中fork出zygote进程。
zygote进程
zygote对应的源文件是app_main.cpp,这个进程把自己的名字重命名为zygote。
/frameworks/base/cmds/app_process/app_main.cpp：
static const char ZYGOTE_NICE_NAME[] = "zygote64";
int main(int argc, char* const argv[]){
AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));
while (i < argc) {
const char* arg = argv[i++];
if (strcmp(arg, "--zygote") == 0) {
zygote = true;
niceName = ZYGOTE_NICE_NAME;
}
}
//重命名进程名字
if (!niceName.isEmpty()) {
runtime.setArgv0(niceName.string());
set_process_name(niceName.string());
}
if (zygote) {
runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
} else if (className) {
runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
} else {
fprintf(stderr, "Error: no class name or --zygote supplied.\n");
app_usage();
LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");
return 10;
}
}看到最后又一句runtime.start("com.android.internal.os.ZygoteInit", args, zygote);，把事情交给runtime去做。runtime是AppRuntime，AppRuntime是继承AndroidRuntime的：
/frameworks/base/cmds/app_process/app_main.cpp：
class AppRuntime : public AndroidRuntime{
public:AppRuntime(char* argBlockStart, const size_t argBlockLength)
: AndroidRuntime(argBlockStart, argBlockLength)
, mClass(NULL){}
void setClassNameAndArgs(const String8& className, int argc, char * const *argv) {
......
}
virtual void onVmCreated(JNIEnv* env){
......
}
virtual void onStarted(){
......
}
virtual void onZygoteInit(){
......
}
virtual void onExit(int code){
......
}
}AppRuntime并没有start方法，因此start方法是AndroidRuntime的：
/frameworks/base/core/jni/AndroidRuntime.cpp
void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
{
//设置ANDROID_ROOT环境变量
const char* rootDir = getenv("ANDROID_ROOT");
if (rootDir == NULL) {
rootDir = "/system";
if (!hasDir("/system")) {
LOG_FATAL("No root directory specified, and /android does not exist.");
return;
}
setenv("ANDROID_ROOT", rootDir, 1);
}
//启动虚拟机
if (startVm(&mJavaVM, &env, zygote) != 0) {
return;
}
onVmCreated(env);
//注册Android的JNI函数
if (startReg(env) < 0) {
ALOGE("Unable to register all android natives\n");
return;
}
//用数组保存类名和参数
stringClass = env->FindClass("java/lang/String");
strArray = env->NewObjectArray(options.size() + 1, stringClass, NULL);
classNameStr = env->NewStringUTF(className);
env->SetObjectArrayElement(strArray, 0, classNameStr);
for (size_t i = 0; i < options.size(); ++i) {
jstring optionsStr = env->NewStringUTF(options.itemAt(i).string());
assert(optionsStr != NULL);
env->SetObjectArrayElement(strArray, i + 1, optionsStr);
}
//找到这个类，并执行这个类的main方法，前面调用时传入的是`com.android.internal.os.ZygoteInit`
char* slashClassName = toSlashClassName(className);
jclass startClass = env->FindClass(slashClassName);
if (startClass == NULL) {
ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);
/* keep going */
} else {
//找到main方法
jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
"([Ljava/lang/String;)V");
if (startMeth == NULL) {
ALOGE("JavaVM unable to find main() in '%s'\n", className);
/* keep going */
} else {
//通过JNI执行main方法,com.android.internal.os.ZygoteInit是一个java类
env->CallStaticVoidMethod(startClass, startMeth, strArray);
}
//zygote退出
if (mJavaVM->DetachCurrentThread() != JNI_OK)
ALOGW("Warning: unable to detach main thread\n");
if (mJavaVM->DestroyJavaVM() != 0)
ALOGW("Warning: VM did not shut down cleanly\n");
}这个start方法启动AndroidRuntime，先启动虚拟机，然后注册JNI函数，最后通过传进来的第一个参数找到相应的类，并执行他的main()方法。
这时，从native进入java层了。
进入Java代码 ZygoteInit.java
下面就是ZygoteInit的main方法:
/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java:
public static void main(String argv[]) {
try {
RuntimeInit.enableDdms();
// 开始 zygote 初始化.
SamplingProfilerIntegration.start();
boolean startSystemServer = false;
String socketName = "zygote";
String abiList = null;
for (int i = 1; i < argv.length; i++) {
if ("start-system-server".equals(argv[i])) {
startSystemServer = true;
} else if (argv[i].startsWith(ABI_LIST_ARG)) {
abiList = argv[i].substring(ABI_LIST_ARG.length());
}
}
//注册一个服务端的socket供zygote使用
registerZygoteSocket(socketName);
//预加载，包括类，资源，等等
preload();
// 结束zygote 初始化.
SamplingProfilerIntegration.writeZygoteSnapshot();
// 进行一次垃圾回收
gcAndFinalize();
if (startSystemServer) {
//启动system_server进程
startSystemServer(abiList, socketName);
}
} catch (MethodAndArgsCaller caller) {
......
}
}
static void preload() {
Log.d(TAG, "begin preload");
beginIcuCachePinning();
preloadClasses();
preloadResources();
preloadOpenGL();
preloadSharedLibraries();
preloadTextResources();
// Ask the WebViewFactory to do any initialization that must run in the zygote process,
// for memory sharing purposes.
WebViewFactory.prepareWebViewInZygote();
endIcuCachePinning();
warmUpJcaProviders();
Log.d(TAG, "end preload");
}ZygoteInit的main方法中调用startSystemServer(abiList, socketName)算是启动了system_server进程。
system_server进程的产生
system_server是Android系统Service运行的进程,这个进程死了后，会导致zygote进程重新启动.
startSystemServer也是ZygoteInit的方法：
/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java:
private static boolean startSystemServer(String abiList, String socketName)
throws MethodAndArgsCaller, RuntimeException {
/* 硬编码命令行启动系统服务器 */
String args[] = {
"--setuid=1000",
"--setgid=1000",
"--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1032,3001,3002,3003,3006,3007,3009,3010",
"--capabilities=" + capabilities + "," + capabilities,
"--nice-name=system_server", //进程名system_server
"--runtime-args",
"com.android.server.SystemServer",//启动类 SystemServer
};
ZygoteConnection.Arguments parsedArgs = null;
try {
//把上面的命令转为Arguments对象
parsedArgs = new ZygoteConnection.Arguments(args);
/* 从Zygote进程中fork一个system server 子进程 */
pid = Zygote.forkSystemServer(
parsedArgs.uid, parsedArgs.gid,
parsedArgs.gids,
parsedArgs.debugFlags,
null,
parsedArgs.permittedCapabilities,
parsedArgs.effectiveCapabilities);
} catch (IllegalArgumentException ex) {
throw new RuntimeException(ex);
}
if (pid == 0) {
if (hasSecondZygote(abiList)) {
waitForSecondaryZygote(socketName);
}
handleSystemServerProcess(parsedArgs);
}
return true;
}从Zygote进程中fork一个system server 子进程，那么Zygote.forkSystemServer做了什么，怎么启动SystemServer的呢？
/frameworks/base/core/java/com/android/internal/os/Zygote.java:
public static int forkSystemServer(int uid, int gid, int[] gids, int debugFlags,
int[][] rlimits, long permittedCapabilities, long effectiveCapabilities) {
VM_HOOKS.preFork();
int pid = nativeForkSystemServer(
uid, gid, gids, debugFlags, rlimits, permittedCapabilities, effectiveCapabilities);
// Enable tracing as soon as we enter the system_server.
if (pid == 0) {
Trace.setTracingEnabled(true);
}
VM_HOOKS.postForkCommon();
return pid;
}
native private static int nativeForkSystemServer(int uid, int gid, int[] gids, int debugFlags,
int[][] rlimits, long permittedCapabilities, long effectiveCapabilities);调用了native方法nativeForkSystemServe，这个方位定义在com_android_internal_os_Zygote.cpp中
/frameworks/base/core/jni/com_android_internal_os_Zygote.cpp：
static jint com_android_internal_os_Zygote_nativeForkSystemServer(
JNIEnv* env, jclass, uid_t uid, gid_t gid, jintArray gids,
jint debug_flags, jobjectArray rlimits, jlong permittedCapabilities,
jlong effectiveCapabilities) {
pid_t pid = ForkAndSpecializeCommon(env, uid, gid, gids,
debug_flags, rlimits,
permittedCapabilities, effectiveCapabilities,
MOUNT_EXTERNAL_DEFAULT, NULL, NULL, true, NULL,
NULL, NULL);
if (pid > 0) {
gSystemServerPid = pid;
if (waitpid(pid, &status, WNOHANG) == pid) {
RuntimeAbort(env, __LINE__, "System server process has died. Restarting Zygote!");
}
}
return pid;
}
static pid_t ForkAndSpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArray javaGids,
jint debug_flags, jobjectArray javaRlimits,
jlong permittedCapabilities, jlong effectiveCapabilities,
jint mount_external,
jstring java_se_info, jstring java_se_name,
bool is_system_server, jintArray fdsToClose,
jstring instructionSet, jstring dataDir) {
pid_t pid = fork();
return pid;
}
system_server进程的执行
上面fork了一个进程后，返回了pid,在回到ZygoteInit的startSystemServer方法：
/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java:
private static boolean startSystemServer(String abiList, String socketName)
throws MethodAndArgsCaller, RuntimeException {
/* 硬编码命令行启动系统服务器 */
try {
//把上面的命令转为Arguments对象
parsedArgs = new ZygoteConnection.Arguments(args);
/* 从Zygote进程中fork一个system server 子进程 */
pid = Zygote.forkSystemServer(
);
} catch (IllegalArgumentException ex) {
throw new RuntimeException(ex);
}
if (pid == 0) {
handleSystemServerProcess(parsedArgs);
}
return true;
}通过Zygote.forkSystemServer方法之后，system_server进程就产生了。下面就该这个进程干活了。
system_server进程生成后，执行了handleSystemServerProcess(parsedArgs)方法：
/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java:
private static void handleSystemServerProcess(
ZygoteConnection.Arguments parsedArgs)
throws ZygoteInit.MethodAndArgsCaller {
if (parsedArgs.invokeWith != null) {
} else {
ClassLoader cl = null;
if (systemServerClasspath != null) {
cl = createSystemServerClassLoader(systemServerClasspath,parsedArgs.targetSdkVersion);
Thread.currentThread().setContextClassLoader(cl);
}
/* 将参数传递给SystemServer. */
RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs, cl);
}
}下面是RuntimeInit.zygoteInit：
/frameworks/base/core/java/com/android/internal/os/RuntimeInit.java
public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
throws ZygoteInit.MethodAndArgsCaller {
if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting application from zygote");
commonInit();
nativeZygoteInit();
applicationInit(targetSdkVersion, argv, classLoader);
}
private static void applicationInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
throws ZygoteInit.MethodAndArgsCaller {
nativeSetExitWithoutCleanup(true);
// 将参数传递给类的主方法 main()，也就是com.android.server.SystemServer的main方法。
invokeStaticMain(args.startClass, args.startArgs, classLoader);
}
private static void invokeStaticMain(String className, String[] argv, ClassLoader classLoader)
throws ZygoteInit.MethodAndArgsCaller {
Class<?> cl;
try {
cl = Class.forName(className, true, classLoader);
} catch (ClassNotFoundException ex) {
throw new RuntimeException(
"Missing class when invoking static main " + className,ex);
}
Method m;
try {
//找到main方法
m = cl.getMethod("main", new Class[] { String[].class });
} catch (NoSuchMethodException ex) {
throw new RuntimeException(
"Missing static main on " + className, ex);
} catch (SecurityException ex) {
throw new RuntimeException(
"Problem getting static main on " + className, ex);
}
int modifiers = m.getModifiers();
if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {
throw new RuntimeException(
"Main method is not public and static on " + className);
}
//然后并没哟着这里执行，而是抛出了异常。
throw new ZygoteInit.MethodAndArgsCaller(m, argv);
}上面说是执行main方法，但是真正功能只是找到了main方法，然后并没有执行，而是抛出了一个异常ZygoteInit.MethodAndArgsCaller。这是ZygoteInit内部定义的一个异常。
/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java:
public static class MethodAndArgsCaller extends Exception
implements Runnable {
/** method to call */
private final Method mMethod;
/** argument array */
private final String[] mArgs;
public MethodAndArgsCaller(Method method, String[] args) {
mMethod = method;
mArgs = args;
}
public void run() {
try {
mMethod.invoke(null, new Object[] { mArgs });
} catch (IllegalAccessException ex) {
throw new RuntimeException(ex);
} catch (InvocationTargetException ex) {
Throwable cause = ex.getCause();
if (cause instanceof RuntimeException) {
throw (RuntimeException) cause;
} else if (cause instanceof Error) {
throw (Error) cause;
}
throw new RuntimeException(ex);
}
}
}这个异常会一直向上抛，一直到ZygoteInit的main方法里才会捕捉处理：
/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java:
public static void main(String argv[]) {
try {
if (startSystemServer) {
startSystemServer(abiList, socketName);
}
} catch (MethodAndArgsCaller caller) {
caller.run();
} catch (Throwable ex) {
Log.e(TAG, "Zygote died with exception", ex);
closeServerSocket();
throw ex;
}
}看到上面的caller.run()，结合上面的MethodAndArgsCaller，这里才是真正执行SystemServer.main()方法的地方。
SystemServer.main()
这下终于进入SystemServer了
直接看进入的main方法,就一句：
/frameworks/base/services/java/com/android/server/SystemServer.java
private static final long SNAPSHOT_INTERVAL = 60 * 60 * 1000; // 1hr
public static void main(String[] args) {
new SystemServer().run();
}
public SystemServer() {
// Check for factory test mode.
mFactoryTestMode = FactoryTest.getMode();
}
private void run() {
try {
// 调整系统时间
if (System.currentTimeMillis() < EARLIEST_SUPPORTED_TIME) {
Slog.w(TAG, "System clock is before 1970; setting to 1970.");
SystemClock.setCurrentTimeMillis(EARLIEST_SUPPORTED_TIME);
}
//这里系统已经欢迎我们来到Android system server了。！。
// Here we go!
Slog.i(TAG, "Entered the Android system server!");
EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_SYSTEM_RUN, SystemClock.uptimeMillis());
// 性能采样分析，输出到文件.一小时执行一次
if (SamplingProfilerIntegration.isEnabled()) {
SamplingProfilerIntegration.start();
mProfilerSnapshotTimer = new Timer();
mProfilerSnapshotTimer.schedule(new TimerTask() {
@Override
public void run() {
SamplingProfilerIntegration.writeSnapshot("system_server", null);
}
}, SNAPSHOT_INTERVAL, SNAPSHOT_INTERVAL);
}
//这里开启了一个Looper
android.os.Process.setThreadPriority(
android.os.Process.THREAD_PRIORITY_FOREGROUND);
android.os.Process.setCanSelfBackground(false);
Looper.prepareMainLooper();
System.loadLibrary("android_servers");
performPendingShutdown();
//初始化系统Context
createSystemContext();
// 创建SystemServiceManager
mSystemServiceManager = new SystemServiceManager(mSystemContext);
LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
} finally {
Trace.traceEnd(Trace.TRACE_TAG_SYSTEM_SERVER);
}
// 启动一些系统服务.
try {
startBootstrapServices();
startCoreServices();
startOtherServices();
} catch (Throwable ex) {
Slog.e("System", "******************************************");
Slog.e("System", "************ Failure starting system services", ex);
throw ex;
} finally {
Trace.traceEnd(Trace.TRACE_TAG_SYSTEM_SERVER);
}
Looper.loop();
throw new RuntimeException("Main thread loop unexpectedly exited");
}
private void createSystemContext() {
//创建系统的Context是在ActivityThread中完成的。
ActivityThread activityThread = ActivityThread.systemMain();
mSystemContext = activityThread.getSystemContext();
mSystemContext.setTheme(DEFAULT_SYSTEM_THEME);
}
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
