frameworks 之SystemServer

哥咫匙传说

已于 2024-07-08 00:26:15 修改

阅读量547

点赞数 9

文章标签：车载系统

于 2024-07-08 00:17:21 首次发布

本文链接：https://blog.csdn.net/u011410770/article/details/140247615

版权

frameworks 之SystemServer

反射创建 SystemServer
SystemServer 启动服务

上文 Zygote 孵化出来后会创建 SystemServcer，该类会创建出系统服务。涉及到的类如下

frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
frameworks/base/core/java/com/android/internal/os/ZygoteCommandBuffer.java
frameworks/base/core/java/com/android/internal/os/ZygoteArguments.java
frameworks/base/core/java/com/android/internal/os/RuntimeInit.java
frframeworks/base/core/jni/AndroidRuntime.cpp
frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
frameworks/base/services/java/com/android/server/SystemServer.java

反射创建 SystemServer

上文可以看到调用 forkSystemServer 会创建一个新进程。重要的参数在 com.android.server.SystemServer 后续会通过该参数反射调用类。parsedArgs = ZygoteArguments.getInstance(commandBuffer) 解析参数，并该最后的一个参数放到 remainArg 里

String[] args = {
                "--setuid=1000",
                "--setgid=1000",
                "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1023,"
                        + "1024,1032,1065,3001,3002,3003,3006,3007,3009,3010,3011,3012",
                "--capabilities=" + capabilities + "," + capabilities,
                "--nice-name=system_server",
                "--runtime-args",
                "--target-sdk-version=" + VMRuntime.SDK_VERSION_CUR_DEVELOPMENT,
                "com.android.server.SystemServer",
        };
        ZygoteArguments parsedArgs;

        int pid;

        try {
            ZygoteCommandBuffer commandBuffer = new ZygoteCommandBuffer(args);
            try {
            // 解析参数
                parsedArgs = ZygoteArguments.getInstance(commandBuffer);
            } catch (EOFException e) {
                throw new AssertionError("Unexpected argument error for forking system server", e);
            }
            commandBuffer.close();
            Zygote.applyDebuggerSystemProperty(parsedArgs);
            Zygote.applyInvokeWithSystemProperty(parsedArgs);

            if (Zygote.nativeSupportsMemoryTagging()) {
                /* The system server has ASYNC MTE by default, in order to allow
                 * system services to specify their own MTE level later, as you
                 * can't re-enable MTE once it's disabled. */
                String mode = SystemProperties.get("arm64.memtag.process.system_server", "async");
                if (mode.equals("async")) {
                    parsedArgs.mRuntimeFlags |= Zygote.MEMORY_TAG_LEVEL_ASYNC;
                } else if (mode.equals("sync")) {
                    parsedArgs.mRuntimeFlags |= Zygote.MEMORY_TAG_LEVEL_SYNC;
                } else if (!mode.equals("off")) {
                    /* When we have an invalid memory tag level, keep the current level. */
                    parsedArgs.mRuntimeFlags |= Zygote.nativeCurrentTaggingLevel();
                    Slog.e(TAG, "Unknown memory tag level for the system server: \"" + mode + "\"");
                }
            } else if (Zygote.nativeSupportsTaggedPointers()) {
                /* Enable pointer tagging in the system server. Hardware support for this is present
                 * in all ARMv8 CPUs. */
                parsedArgs.mRuntimeFlags |= Zygote.MEMORY_TAG_LEVEL_TBI;
            }

            /* Enable gwp-asan on the system server with a small probability. This is the same
             * policy as applied to native processes and system apps. */
            parsedArgs.mRuntimeFlags |= Zygote.GWP_ASAN_LEVEL_LOTTERY;

            if (shouldProfileSystemServer()) {
                parsedArgs.mRuntimeFlags |= Zygote.PROFILE_SYSTEM_SERVER;
            }

            /* Request to fork the system server process */
            pid = Zygote.forkSystemServer(
                    parsedArgs.mUid, parsedArgs.mGid,
                    parsedArgs.mGids,
                    parsedArgs.mRuntimeFlags,
                    null,
                    parsedArgs.mPermittedCapabilities,
                    parsedArgs.mEffectiveCapabilities);
        } catch (IllegalArgumentException ex) {
            throw new RuntimeException(ex);
        }

        /* For child process */
        if (pid == 0) {
            if (hasSecondZygote(abiList)) {
                waitForSecondaryZygote(socketName);
            }
			// 因为是新创建的另一个进程 不需要zygote的进程
            zygoteServer.closeServerSocket();
            return handleSystemServerProcess(parsedArgs);
        }

其中 ZygoteArguments 会解析参数并把没解析的参数放到 mRemainingArgs 中，接着会判断pid 等于 0 调用handleSystemServerProcess方法。里面通过调用 Os.getenv(“SYSTEMSERVERCLASSPATH”) 获取对应的环境变量（可以通过 adb shell 后通过 env | grep SYSTEMSERVERCLASSPATH）查看该环境变量值并获取 mRemainingArgs 传入 ZygoteInit.zygoteInit 方法

private static Runnable handleSystemServerProcess(ZygoteArguments parsedArgs) {
	final String systemServerClasspath = Os.getenv("SYSTEMSERVERCLASSPATH");
	...
	return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion,
                    parsedArgs.mDisabledCompatChanges,
                    parsedArgs.mRemainingArgs, cl);
}

zygoteInit 方法里面主要有 nativeZygoteInit 主要是用来启动一个Binder线程池这样SystemServer进程就可以与其他进程进行通信了,zygote进程没有bidner，该方法不在zygote.cpp里面，而是在AndroidRuntime.cpp里面，可以全局搜索 grep “_nativeZygoteInit” ./ -rn 搜索出。

public static Runnable zygoteInit(int targetSdkVersion, long[] disabledCompatChanges,
            String[] argv, ClassLoader classLoader) {
        if (RuntimeInit.DEBUG) {
            Slog.d(RuntimeInit.TAG, "RuntimeInit: Starting application from zygote");
        }

        Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ZygoteInit");
        RuntimeInit.redirectLogStreams();

        RuntimeInit.commonInit();
        // 创建binder线程池
        ZygoteInit.nativeZygoteInit();
        return RuntimeInit.applicationInit(targetSdkVersion, disabledCompatChanges, argv,
                classLoader);
    }


/*framework/base/core/jni/AndroidRuntime.cpp*/
static void com_android_internal_os_RuntimeInit_nativeZygoteInit(JNIEnv* env, jobject clazz) {
    //此处的gCurRuntime为AppRuntime，是在AndroidRuntime.cpp中定义的
    gCurRuntime->onZygoteInit();
}
 
 
/*framework/base/cmds/app_process_app_main.cpp*/
virtual void onZygoteInit() {
    sp<ProcessState> proc = ProcessState::self();
    proc->startThreadPool(); //启动新binder线程, 关于binder线程的介绍,后续专题介绍
}

applicationInit 方法又会调用 findStaticMain 方法。

protected static Runnable applicationInit(int targetSdkVersion, long[] disabledCompatChanges,
            String[] argv, ClassLoader classLoader) {
        ...
        // Remaining arguments are passed to the start class's static main
        return findStaticMain(args.startClass, args.startArgs, classLoader);
    }

findStaticMain 方法会解析一开始的参数用反射获取对应类和 main 方法, 最后 MethodAndArgsCaller 启动 Runnable 方法。通过里面的run方法调用 main。

protected static Runnable findStaticMain(String className, String[] argv,
            ClassLoader classLoader) {
        ...
        // 获取类
		try {
            cl = Class.forName(className, true, classLoader);
        } catch (ClassNotFoundException ex) {
            throw new RuntimeException(
                    "Missing class when invoking static main " + className,
                    ex);
        }
        // 获取 main 方法
        Method m;
        try {
            m = cl.getMethod("main", new Class[] { String[].class });
        } catch (NoSuchMethodException ex) {
            throw new RuntimeException(
                    "Missing static main on " + className, ex);
        } catch (SecurityException ex) {
            throw new RuntimeException(
                    "Problem getting static main on " + className, ex);
        }
        ...
        return new MethodAndArgsCaller(m, argv);
}

static class MethodAndArgsCaller implements Runnable {
		...
		public void run() {
            try {
            // 启动 main 方法
                mMethod.invoke(null, new Object[] { mArgs });
            } catch (IllegalAccessException ex) {
                throw new RuntimeException(ex);
            } catch (InvocationTargetException ex) {
                Throwable cause = ex.getCause();
                if (cause instanceof RuntimeException) {
                    throw (RuntimeException) cause;
                } else if (cause instanceof Error) {
                    throw (Error) cause;
                }
                throw new RuntimeException(ex);
            }
        }
}

SystemServer 启动服务

进入 main 方法后，调用 run。 run方法里面有主要几个事项,设置线程池的属性，
初始化 prepareMainLooper
创建上下文 createSystemContext
初始化 SystemServiceManager
添加到缓存 LocalServices.addService
启动系统相关 startBootstrapServices
启动核心服务 startCoreServices
启动其他服务 startOtherServices

public static void main(String[] args) {
        new SystemServer().run();
}

private void run() {
			...
			// 设置线程优先级
			// Ensure binder calls into the system always run at foreground priority.
            BinderInternal.disableBackgroundScheduling(true);
            // 设置线程数 为31
            // Increase the number of binder threads in system_server
            BinderInternal.setMaxThreads(sMaxBinderThreads);
            // Prepare the main looper thread (this thread).
            android.os.Process.setThreadPriority(
                    android.os.Process.THREAD_PRIORITY_FOREGROUND);
            android.os.Process.setCanSelfBackground(false);
            // Looper 创建对于的looper 
            Looper.prepareMainLooper();
            ...
            // 加载so库
            System.loadLibrary("android_servers");
            ...
            // 初始化 上下文
            // Initialize the system context.
            createSystemContext();
            ...
            // 初始化 SystemServiceManager
            // Create the system service manager.
            mSystemServiceManager = new SystemServiceManager(mSystemContext);
            // 添加到服务缓存
            LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
            ...
            // 启动各种服务
            // Start services.
        try {
            t.traceBegin("StartServices");
            startBootstrapServices(t);
            startCoreServices(t);
            startOtherServices(t);
        } catch (Throwable ex) {
            Slog.e("System", "******************************************");
            Slog.e("System", "************ Failure starting system services", ex);
            throw ex;
        } finally {
            t.traceEnd(); // StartServices
        }
}

private void createSystemContext() {
		// 此处并不是线程的概念,只是一个对象而已
        ActivityThread activityThread = ActivityThread.systemMain();
        // 获取system context
        mSystemContext = activityThread.getSystemContext();
        mSystemContext.setTheme(DEFAULT_SYSTEM_THEME);
		//获取systemui context
        final Context systemUiContext = activityThread.getSystemUiContext();
        systemUiContext.setTheme(DEFAULT_SYSTEM_THEME);
}

启动服务服务的 IBind 服务都会保存在 ServiceManager 他类似一个DNS路由器，保存各种 AIDL。添加AMS 服务是通过 startService 启动 ActivityTaskManagerService.Lifecycle.class 后在通过 getService()

private void startBootstrapServices(@NonNull TimingsTraceAndSlog t) {
	...
	// 添加 AMS 服务
	ActivityTaskManagerService atm = mSystemServiceManager.startService(
                ActivityTaskManagerService.Lifecycle.class).getService();
}

startService 里面通过反射创建对应的类，在调用 start 方法。

public <T extends SystemService> T startService(Class<T> serviceClass) {
			try {
                Constructor<T> constructor = serviceClass.getConstructor(Context.class);
                service = constructor.newInstance(mContext);
            } 
            // 调用 startService
            startService(service);
}

public void startService(@NonNull final SystemService service) {
        // Register it.
        mServices.add(service);
       	try {
       		// 调用 onStart 方法
            service.onStart();
        } catch (RuntimeException ex) {
            throw new RuntimeException("Failed to start service " + service.getClass().getName()
                    + ": onStart threw an exception", ex);
        }
    }

AMS 对应的start 方法如下会启动start , 里面的 publishBinderService 会将该服务添加到 ServiceManager

public static final class Lifecycle extends SystemService {
		private final ActivityTaskManagerService mService;
		public Lifecycle(Context context) {
            super(context);
            mService = new ActivityTaskManagerService(context);
        }

        @Override
        public void onStart() {
            publishBinderService(Context.ACTIVITY_TASK_SERVICE, mService);
            mService.start();
        }
}
// frameworks/base/services/core/java/com/android/server/SystemService.java
protected final void publishBinderService(String name, IBinder service,
            boolean allowIsolated, int dumpPriority) {
        ServiceManager.addService(name, service, allowIsolated, dumpPriority);
    }

// frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
private void start() {
     LocalServices.addService(ActivityTaskManagerInternal.class, mInternal);
 }

其中一些 wms input 也会直接直接 add到 ServiceManager 里面

			// 初始化 后直接 add 
			wm = WindowManagerService.main(context, inputManager, !mFirstBoot, mOnlyCore,
                    new PhoneWindowManager(), mActivityManagerService.mActivityTaskManager);
            ServiceManager.addService(Context.WINDOW_SERVICE, wm, /* allowIsolated= */ false,
                    DUMP_FLAG_PRIORITY_CRITICAL | DUMP_FLAG_PROTO);
            ServiceManager.addService(Context.INPUT_SERVICE, inputManager,
                    /* allowIsolated= */ false, DUMP_FLAG_PRIORITY_CRITICAL);