Android5.1.1源码 - 分析Android系统服务何时被添加到ServiceManager
@(Android研究)[ServiceManager|PackageManagerService|ActivityManagerService]
[TOC]
前言
本文公开首发于阿里聚安全博客:https://jaq.alibaba.com/community/index.htm?spm=0.0.0.0.ycEUXK
分析
SystemServer类在文件"frameworks/base/services/java/com/android/server/SystemServer.java"中,在这个类的静态方法"main"中创建了SystemServer对象,下面是它的源码:
/**
* The main entry point from zygote.
*/
public static void main(String[] args) {
new SystemServer().run();
}
在创建了SystemServer对象之后调用了SystemServer类的run方法,下面是它的源码:
private void run() {
......
// Start services.
try {
startBootstrapServices();
startCoreServices();
startOtherServices();
} catch (Throwable ex) {
Slog.e("System", "******************************************");
Slog.e("System", "************ Failure starting system services", ex);
throw ex;
}
......
}
在run方法中调用了启动服务的方法,在startBootstrapServices方法中启动了PackageManagerService、ActivityManagerService等服务并将它们添加到了ServiceManager中,下面是startBootstrapServices的源码:
/**
* Starts the small tangle of critical services that are needed to get
* the system off the ground. These services have complex mutual dependencies
* which is why we initialize them all in one place here. Unless your service
* is also entwined in these dependencies, it should be initialized in one of
* the other functions.
*/
private void startBootstrapServices() {
// Wait for installd to finish starting up so that it has a chance to
// create critical directories such as /data/user with the appropriate
// permissions. We need this to complete before we initialize other services.
Installer installer = mSystemServiceManager.startService(Installer.class);
// Activity manager runs the show.
mActivityManagerService = mSystemServiceManager.startService(
ActivityManagerService.Lifecycle.class).getService();
mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
mActivityManagerService.setInstaller(installer);
// Power manager needs to be started early because other services need it.
// Native daemons may be watching for it to be registered so it must be ready
// to handle incoming binder calls immediately (including being able to verify
// the permissions for those calls).
mPowerManagerService = mSystemServiceManager.startService(PowerManagerService.class);
// Now that the power manager has been started, let the activity manager
// initialize power management features.
mActivityManagerService.initPowerManagement();
......
// Start the package manager.
Slog.i(TAG, "Package Manager");
mPackageManagerService = PackageManagerService.main(mSystemContext, installer,
mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore);
mFirstBoot = mPackageManagerService.isFirstBoot();
mPackageManager = mSystemContext.getPackageManager();
Slog.i(TAG, "User Service");
ServiceManager.addService(Context.USER_SERVICE, UserManagerService.getInstance());
// Initialize attribute cache used to cache resources from packages.
AttributeCache.init(mSystemContext);
// Set up the Application instance for the system process and get started.
mActivityManagerService.setSystemProcess();
}
在上面代码中PackageManagerService.main创建了PackageManagerService类对象并将它添加到了ServiceManager中。
PackageManagerService类在文件"frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java"中,下面是它的静态成员方法main的源码:
public static final PackageManagerService main(Context context, Installer installer,
boolean factoryTest, boolean onlyCore) {
PackageManagerService m = new PackageManagerService(context, installer,
factoryTest, onlyCore);
ServiceManager.addService("package", m);
return m;
}
PackageManagerService.main方法创建了PackageManagerService对象,然后执行"ServiceManager.addService"方法将这个对象添加到了ServiceManager中。当调用"ServiceManager.getService("package")"语句时就会返回这个PackageManagerService对象。
回到SystemServer.startBootstrapServices方法中,在这个方法的最后有这么一条语句:mActivityManagerService.setSystemProcess();,这条语句将ActivityManagerService对象添加到了ServiceManager中。
ActivityManagerService类在文件"frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java"中,下面是ActivityManagerService.setSystemProcess方法的源码:
public void setSystemProcess() {
try {
ServiceManager.addService(Context.ACTIVITY_SERVICE, this, true);
ServiceManager.addService(ProcessStats.SERVICE_NAME, mProcessStats);
ServiceManager.addService("meminfo", new MemBinder(this));
ServiceManager.addService("gfxinfo", new GraphicsBinder(this));
ServiceManager.addService("dbinfo", new DbBinder(this));
......
} catch (PackageManager.NameNotFoundException e) {
throw new RuntimeException(
"Unable to find android system package", e);
}
}
在这个方法中向ServiceManager中添加了好几个服务,Context.ACTIVITY_SERVICE的值是字符串"activity",ProcessStats.SERVICE_NAME的值是字符串"procstats"。语句"ServiceManager.addService(Context.ACTIVITY_SERVICE, this, true);"把this添加到了ServiceManager中,这个this就是ActivityManagerService对象。