Android framework（三）：SystemServer进程

最新推荐文章于 2023-10-13 17:37:37 发布

KWMax

最新推荐文章于 2023-10-13 17:37:37 发布

阅读量5.9k

点赞数

分类专栏： Android开发文章标签： framework systemserver

本文链接：https://blog.csdn.net/yaojie5519/article/details/107731853

版权

Android开发专栏收录该内容

62 篇文章 3 订阅

订阅专栏

一、概述

SystemServer是Android系统的核心之一，大部分Android提供的服务都运行在这个进程里，SystemServer中运行的服务总共有60多种。为了防止应用进程对系统造成破坏，Android的应用进程没有权限直接访问设备的底层资源，只能通过SystemService中的代理访问。通过Binder，用户进程在使用SystemService中的服务并没有太多不便变之处。

上一节已经讲到ZygoteInit的启动，那么ZygoteInit是如何启动SystemServer的呢

二、fork过程

时序图

在这里插入图片描述

代码解析

frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

public static void main(String argv[]) {
	...
	//5、fork一个SystemServer进程
    if (startSystemServer) {
          Runnable r = forkSystemServer(abiList, socketName, zygoteServer);
          if (r != null) {
             r.run();
             return;
          }
     }
     ...
}

ZygoteInit#forkSystemServer()

620 private static Runnable forkSystemServer(String abiList, String socketName,
621            ZygoteServer zygoteServer) {
		   ...
640        /* 硬编码指令行，用于启动SystemServer */
641        String args[] = {
642            "--setuid=1000",
643            "--setgid=1000",
644            "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1023,1032,3001,3002,3003,3006,3007,3009,3010",
645            "--capabilities=" + capabilities + "," + capabilities,
646            "--nice-name=system_server",
647            "--runtime-args",
648            "com.android.server.SystemServer",
649        };
650        ZygoteConnection.Arguments parsedArgs = null;
651
652        int pid;
653
654        try {
655            parsedArgs = new ZygoteConnection.Arguments(args);
656            ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
657            ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);
658
659            /* 请求fork SystemServer进程 */
660            pid = Zygote.forkSystemServer(
661                    parsedArgs.uid, parsedArgs.gid,
662                    parsedArgs.gids,
663                    parsedArgs.debugFlags,
664                    null,
665                    parsedArgs.permittedCapabilities,
666                    parsedArgs.effectiveCapabilities);
667        } catch (IllegalArgumentException ex) {
668            throw new RuntimeException(ex);
669        }
670
671        /* pid为0表示子进程，即SystemServer进程 */
672        if (pid == 0) {
673            if (hasSecondZygote(abiList)) {
674                waitForSecondaryZygote(socketName);
675            }
676
677            zygoteServer.closeServerSocket();
678            return handleSystemServerProcess(parsedArgs);
679        }
680
681        return null;
682    }

ZygoteInit#handleSystemServerProcess()

452    private static Runnable handleSystemServerProcess(ZygoteConnection.Arguments parsedArgs) {
		   ...
456        if (parsedArgs.niceName != null) {
457            Process.setArgV0(parsedArgs.niceName);//进程名为参数里的niceName：system_server
458        }
		   ...
482        if (parsedArgs.invokeWith != null) {//注1
483            String[] args = parsedArgs.remainingArgs;
484            // If we have a non-null system server class path, we'll have to duplicate the
485            // existing arguments and append the classpath to it. ART will handle the classpath
486            // correctly when we exec a new process.
487            if (systemServerClasspath != null) {
488                String[] amendedArgs = new String[args.length + 2];
489                amendedArgs[0] = "-cp";
490                amendedArgs[1] = systemServerClasspath;
491                System.arraycopy(args, 0, amendedArgs, 2, args.length);
492                args = amendedArgs;
493            }
494
495            WrapperInit.execApplication(parsedArgs.invokeWith,
496                    parsedArgs.niceName, parsedArgs.targetSdkVersion,
497                    VMRuntime.getCurrentInstructionSet(), null, args);
498
499            throw new IllegalStateException("Unexpected return from WrapperInit.execApplication");
500        } else {
501            ClassLoader cl = null;
502            if (systemServerClasspath != null) {
503                cl = createPathClassLoader(systemServerClasspath, parsedArgs.targetSdkVersion);
504
505                Thread.currentThread().setContextClassLoader(cl);
506            }
507
508            /*
509             * Pass the remaining arguments to SystemServer.
510             */
511            return ZygoteInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs, cl);
512        }
513
514        /* should never reach here */
515    }

注：1、parsedArgs.invokeWith属性默认为null，通过调用ZygoteInit.zygoteInit来进一步启动SystemServer。

ZygoteInit#zygoteInit()

 	public static final Runnable zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader) {
852        if (RuntimeInit.DEBUG) {
853            Slog.d(RuntimeInit.TAG, "RuntimeInit: Starting application from zygote");
854        }
855
856        Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ZygoteInit");
857        RuntimeInit.redirectLogStreams();
858        //初始化运行环境
859        RuntimeInit.commonInit();
           //调用Native层的代码,启动Binder线程池
860        ZygoteInit.nativeZygoteInit();
           //调用程序入口函数
861        return RuntimeInit.applicationInit(targetSdkVersion, argv, classLoader);
862

nativeZygoteInit函数对应的JNI文件为AndroidRuntime.cpp

/frameworks/base/core/jni/AndroidRuntime.cpp

	static void com_android_internal_os_ZygoteInit_nativeZygoteInit(JNIEnv* env, jobject clazz)
223{
224    gCurRuntime->onZygoteInit();
225}


	int register_com_android_internal_os_ZygoteInit_nativeZygoteInit(JNIEnv* env)
250{
251    const JNINativeMethod methods[] = {
252        { "nativeZygoteInit", "()V",
253            (void*) com_android_internal_os_ZygoteInit_nativeZygoteInit },
254    };
255    return jniRegisterNativeMethods(env, "com/android/internal/os/ZygoteInit",
256        methods, NELEM(methods));
257}

通过代码可以看到，实际调用的函数是onZygoteInit()

/frameworks/base/cmds/app_process/app_main.cpp

virtual void onZygoteInit()
92    {
93        sp<ProcessState> proc = ProcessState::self();
94        ALOGV("App process: starting thread pool.\n");
95        proc->startThreadPool();
96    }

/frameworks/native/libs/binder/ProcessState.cpp

void ProcessState::startThreadPool()
152{
153    AutoMutex _l(mLock);
154    if (!mThreadPoolStarted) {
155        mThreadPoolStarted = true;
156        spawnPooledThread(true);
157    }
158}

注：支持Binder通信的进程中都有一个ProcessState类，它里面有一个mThreadPoolStarted 变量，来表示Binder线程池是否已经被启动过，默认值为false。在每次调用这个函数时都会先去检查这个标记，从而确保Binder线程池只会被启动一次。

ProcessState#spawnPooledThread()

void ProcessState::spawnPooledThread(bool isMain)
347{
348    if (mThreadPoolStarted) {
349        String8 name = makeBinderThreadName();
350        ALOGV("Spawning new pooled thread, name=%s\n", name.string());
351        sp<Thread> t = new PoolThread(isMain);
352        t->run(name.string());//注1
353    }
354}

注：1、调用PoolThread的run函数来启动一个新的线程

ProcessState#PoolThread

class PoolThread : public Thread
51{
52public:
53    explicit PoolThread(bool isMain)
54        : mIsMain(isMain)
55    {
56    }
57
58protected:
59    virtual bool threadLoop()
60    {
61        IPCThreadState::self()->joinThreadPool(mIsMain);//注1
62        return false;
63    }
64
65    const bool mIsMain;
66};

注：1、PoolThread类继承了Thread类。注释1处会将调用IPCThreadState的joinThreadPool函数，将当前线程注册到Binder驱动程序中，这样我们创建的线程就加入了Binder线程池中，这样新创建的SyetemServer进程就支持Binder进程间通信了。

/frameworks/base/core/java/com/android/internal/os/RuntimeInit.java

protected static Runnable applicationInit(int targetSdkVersion, String[] argv,
291            ClassLoader classLoader) {
292        // If the application calls System.exit(), terminate the process
293        // immediately without running any shutdown hooks.  It is not possible to
294        // shutdown an Android application gracefully.  Among other things, the
295        // Android runtime shutdown hooks close the Binder driver, which can cause
296        // leftover running threads to crash before the process actually exits.
297        nativeSetExitWithoutCleanup(true);

           //虚拟机环境设置
301        VMRuntime.getRuntime().setTargetHeapUtilization(0.75f);
302        VMRuntime.getRuntime().setTargetSdkVersion(targetSdkVersion);
303
304        final Arguments args = new Arguments(argv);
305
306        // The end of of the RuntimeInit event (see #zygoteInit).
307        Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
308
309        // Remaining arguments are passed to the start class's static main
310        return findStaticMain(args.startClass, args.startArgs, classLoader);
311    }

RuntimeInit#findStaticMain()

	private static Runnable findStaticMain(String className, String[] argv,
233            ClassLoader classLoader) {
234        Class<?> cl;
235
236        try {
237            cl = Class.forName(className, true, classLoader);//注1
238        } catch (ClassNotFoundException ex) {
239            throw new RuntimeException(
240                    "Missing class when invoking static main " + className,
241                    ex);
242        }
243
244        Method m;
245        try {
               // 获取main方法
246            m = cl.getMethod("main", new Class[] { String[].class });
247        } catch (NoSuchMethodException ex) {
248            throw new RuntimeException(
249                    "Missing static main on " + className, ex);
250        } catch (SecurityException ex) {
251            throw new RuntimeException(
252                    "Problem getting static main on " + className, ex);
253        }
254
           // 判断修饰符，须是static且是public类型
255        int modifiers = m.getModifiers();
256        if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {
257            throw new RuntimeException(
258                    "Main method is not public and static on " + className);
259        }
260
261        /*
262         * This throw gets caught in ZygoteInit.main(), which responds
263         * by invoking the exception's run() method. This arrangement
264         * clears up all the stack frames that were required in setting
265         * up the process.
266         */
267        return new MethodAndArgsCaller(m, argv);//注2
268    }

注：1、传入的className就是com.android.server.SystemServer ，因此通过反射返回的cl为SystemServer类。

2、将找到的main函数传入到MethodAndArgsCaller并返回。这个会在ZygoteInit中forkSystemServer之后执行run函数。

RuntimeInit#MethodAndArgsCaller

static class MethodAndArgsCaller implements Runnable {
425        /** method to call */
426        private final Method mMethod;
427
428        /** argument array */
429        private final String[] mArgs;
430
431        public MethodAndArgsCaller(Method method, String[] args) {
432            mMethod = method;
433            mArgs = args;
434        }
435
436        public void run() {
437            try {
                   //注1
438                mMethod.invoke(null, new Object[] { mArgs });
439            } catch (IllegalAccessException ex) {
440                throw new RuntimeException(ex);
441            } catch (InvocationTargetException ex) {
442                Throwable cause = ex.getCause();
443                if (cause instanceof RuntimeException) {
444                    throw (RuntimeException) cause;
445                } else if (cause instanceof Error) {
446                    throw (Error) cause;
447                }
448                throw new RuntimeException(ex);
449            }
450        }
451    }
452}

注：1、通过反射调用了com.android.server.SystemServer#main(String[] args)。至此，Zygote进程fork出SystemServer进程，并成功调用SystemServer#main()

三、运行过程

SystemServer的运行比较清晰，此处就不画时序图了。

主要做了几件事：

调用createSystemContext()来创建系统上下文
创建SystemServiceManager
启动各种服务

源码解析

/frameworks/base/services/java/com/android/server/SystemServer.java

	public static void main(String[] args) {
267        new SystemServer().run();
268    }

	private void run() {
278        try {
279            traceBeginAndSlog("InitBeforeStartServices");
280            //设置系统时钟最早为1970，早于1970很多api无法正常工作
284            if (System.currentTimeMillis() < EARLIEST_SUPPORTED_TIME) {
285                Slog.w(TAG, "System clock is before 1970; setting to 1970.");
286                SystemClock.setCurrentTimeMillis(EARLIEST_SUPPORTED_TIME);
287            }

               // 默认时区GMT.
292            String timezoneProperty =  SystemProperties.get("persist.sys.timezone");
293            if (timezoneProperty == null || timezoneProperty.isEmpty()) {
294                Slog.w(TAG, "Timezone not set; setting to GMT.");
295                SystemProperties.set("persist.sys.timezone", "GMT");
296            }
               ...
366            //注1
367            System.loadLibrary("android_servers");

			   // 初始化系统上下文
374            createSystemContext();
               ...
376            // 创建SystemServiceManager.
377            mSystemServiceManager = new SystemServiceManager(mSystemContext);
378            mSystemServiceManager.setRuntimeRestarted(mRuntimeRestart);
379            LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
380            // Prepare the thread pool for init tasks that can be parallelized
381            SystemServerInitThreadPool.get();
382        } finally {
383            traceEnd();  // InitBeforeStartServices
384        }
385
386        // 启动各种系统服务.
387        try {
388            traceBeginAndSlog("StartServices");
389            startBootstrapServices();
390            startCoreServices();
391            startOtherServices();
392            SystemServerInitThreadPool.shutdown();
393        } catch (Throwable ex) {
394            Slog.e("System", "******************************************");
395            Slog.e("System", "************ Failure starting system services", ex);
396            throw ex;
397        } finally {
398            traceEnd();
399        }
           ...
414
415        // Loop forever.
416        Looper.loop();
417        throw new RuntimeException("Main thread loop unexpectedly exited");
418    }

注：1、加载“android_servers.so”库，该库包含源码在frameworks/base/services/目录下

1、初始化系统上下文

/frameworks/base/services/java/com/android/server/SystemServer.java

	private void createSystemContext() {
		   // 进行ActivityThread初始化
484        ActivityThread activityThread = ActivityThread.systemMain();
           // 获取系统上下文
485        mSystemContext = activityThread.getSystemContext();
486        mSystemContext.setTheme(DEFAULT_SYSTEM_THEME);
487
488        final Context systemUiContext = activityThread.getSystemUiContext();
489        systemUiContext.setTheme(DEFAULT_SYSTEM_THEME);
490    }

/frameworks/base/core/java/android/app/ActivityThread.java

	public static ActivityThread systemMain() {
6399        // The system process on low-memory devices do not get to use hardware
6400        // accelerated drawing, since this can add too much overhead to the
6401        // process.
6402        if (!ActivityManager.isHighEndGfx()) {
6403            ThreadedRenderer.disable(true);
6404        } else {
6405            ThreadedRenderer.enableForegroundTrimming();
6406        }
6407        ActivityThread thread = new ActivityThread();
6408        thread.attach(true);
6409        return thread;
6410    }

注：创建了了一个ActivityThread对象。然后调用attach(boolean)方法来进行初始化，ActivityThread是一个Application的主线程类，(记住，它不是Thread，因为它既没有继承Thread，也没有实现Runnable)

ActivityThread创建实例会创建ApplicationThread对象（用于基于的BinderIPC通信）、H对象mH，以及主线的Looper对象mLooper。

/frameworks/base/core/java/android/app/ActivityThread.java

	private void attach(boolean system) {
6316        sCurrentActivityThread = this;
            //system为true，即该进程为系统进程
6317        mSystemThread = system;
6318        if (!system) {
6319            ViewRootImpl.addFirstDrawHandler(new Runnable() {
6320                @Override
6321                public void run() {
						// 检查jit能否用，6.0即ART，不用jit，
                        // 不过由于向下兼容，所以这里还有检查jit
6322                    ensureJitEnabled();
6323                }
6324            });
6325            android.ddm.DdmHandleAppName.setAppName("<pre-initialized>",
6326                                                    UserHandle.myUserId());
6327            RuntimeInit.setApplicationObject(mAppThread.asBinder());
6328            final IActivityManager mgr = ActivityManager.getService();
6329            try {
6330                mgr.attachApplication(mAppThread);
6331            } catch (RemoteException ex) {
6332                throw ex.rethrowFromSystemServer();
6333            }
6334            // 添加GC观察者
6335            BinderInternal.addGcWatcher(new Runnable() {
6336                @Override public void run() {
6337                    if (!mSomeActivitiesChanged) {
6338                        return;
6339                    }
6340                    Runtime runtime = Runtime.getRuntime();
6341                    long dalvikMax = runtime.maxMemory();
6342                    long dalvikUsed = runtime.totalMemory() - runtime.freeMemory();
6343                    if (dalvikUsed > ((3*dalvikMax)/4)) {
6344                        if (DEBUG_MEMORY_TRIM) Slog.d(TAG, "Dalvik max=" + (dalvikMax/1024)
6345                                + " total=" + (runtime.totalMemory()/1024)
6346                                + " used=" + (dalvikUsed/1024));
6347                        mSomeActivitiesChanged = false;
6348                        try {
6349                            mgr.releaseSomeActivities(mAppThread);
6350                        } catch (RemoteException e) {
6351                            throw e.rethrowFromSystemServer();
6352                        }
6353                    }
6354                }
6355            });
6356        } else {
6357            // Don't set application object here -- if the system crashes,
6358            // we can't display an alert, we just want to die die die.
				//设置Java Application 在DDM里面的名称 即 system_process
6359            android.ddm.DdmHandleAppName.setAppName("system_process",
6360                    UserHandle.myUserId());
6361            try {
					// 创建 系统应用的Instrumentation对象
6362                mInstrumentation = new Instrumentation();
				    // 创建 ContextImpl对象
6363                ContextImpl context = ContextImpl.createAppContext(
6364                        this, getSystemContext().mPackageInfo);
				    // 创建系统进程的Application对象
6365                mInitialApplication = context.mPackageInfo.makeApplication(true, null);
					// 调用系统进程的onCreate()方法
6366                mInitialApplication.onCreate();
6367            } catch (Exception e) {
6368                throw new RuntimeException(
6369                        "Unable to instantiate Application():" + e.toString(), e);
6370            }
6371        }
6372
6373        // add dropbox logging to libcore
6374        DropBox.setReporter(new DropBoxReporter());
6375
6376        ViewRootImpl.ConfigChangedCallback configChangedCallback
6377                = (Configuration globalConfig) -> {
6378            synchronized (mResourcesManager) {
6379                // We need to apply this change to the resources immediately, because upon returning
6380                // the view hierarchy will be informed about it.
6381                if (mResourcesManager.applyConfigurationToResourcesLocked(globalConfig,
6382                        null /* compat */)) {
6383                    updateLocaleListFromAppContext(mInitialApplication.getApplicationContext(),
6384                            mResourcesManager.getConfiguration().getLocales());
6385
6386                    // This actually changed the resources! Tell everyone about it.
6387                    if (mPendingConfiguration == null
6388                            || mPendingConfiguration.isOtherSeqNewer(globalConfig)) {
6389                        mPendingConfiguration = globalConfig;
6390                        sendMessage(H.CONFIGURATION_CHANGED, globalConfig);
6391                    }
6392                }
6393            }
6394        };
6395        ViewRootImpl.addConfigCallback(configChangedCallback);
6396    }

attach的主要作用：

创建Instrumentation对象
通过调用ContextImpl.createAppContext方法来创建ContextImpl对象
通过调用context.mPackageInfo.makeApplication创建mInitialApplication对象
调用mInitialApplication对象的onCreate()

所以，attach方法在参数system为true的时候，会创建一个类似的Application的环境。

这就是为什么在SystemServer中要创建ActivityThread的原因了，因为SystemServer不仅仅是一个后台进程，同时它还是一个运行着组件的Service进程，很多系统的对话框就是从SystemServer中显示出来的，因此，SystemServer本身也需要一个和APK应用类似的上下文环境。

/frameworks/base/core/java/android/app/LoadedApk.java

	public Application makeApplication(boolean forceDefaultAppClass,
960            Instrumentation instrumentation) {
961        if (mApplication != null) {
962            return mApplication;
963        }
964
965        Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "makeApplication");
966
967        Application app = null;
968
969        String appClass = mApplicationInfo.className;
970        if (forceDefaultAppClass || (appClass == null)) {
971            appClass = "android.app.Application";
972        }
973
974        try {
975            java.lang.ClassLoader cl = getClassLoader();
976            if (!mPackageName.equals("android")) {
977                Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER,
978                        "initializeJavaContextClassLoader");
979                initializeJavaContextClassLoader();
980                Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
981            }
982            ContextImpl appContext = ContextImpl.createAppContext(mActivityThread, this);
			   // 创建Application对象
983            app = mActivityThread.mInstrumentation.newApplication(
984                    cl, appClass, appContext);
985            appContext.setOuterContext(app);
986        } catch (Exception e) {
987            if (!mActivityThread.mInstrumentation.onException(app, e)) {
988                Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
989                throw new RuntimeException(
990                    "Unable to instantiate application " + appClass
991                    + ": " + e.toString(), e);
992            }
993        }
994        mActivityThread.mAllApplications.add(app);
995        mApplication = app;
996
997        if (instrumentation != null) {
998            try {
				   // 利用instrumentation调用Application的onCreate方法
999                instrumentation.callApplicationOnCreate(app);
1000            } catch (Exception e) {
1001                if (!instrumentation.onException(app, e)) {
1002                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
1003                    throw new RuntimeException(
1004                        "Unable to create application " + app.getClass().getName()
1005                        + ": " + e.toString(), e);
1006                }
1007            }
1008        }
1009
1010        // Rewrite the R 'constants' for all library apks.
1011        SparseArray<String> packageIdentifiers = getAssets().getAssignedPackageIdentifiers();
1012        final int N = packageIdentifiers.size();
1013        for (int i = 0; i < N; i++) {
1014            final int id = packageIdentifiers.keyAt(i);
1015            if (id == 0x01 || id == 0x7f) {
1016                continue;
1017            }
1018
1019            rewriteRValues(getClassLoader(), packageIdentifiers.valueAt(i), id);
1020        }
1021
1022        Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
1023
1024        return app;
1025    }

/frameworks/base/core/java/android/app/ActivityThread.java

	 public ContextImpl getSystemContext() {
2154        synchronized (this) {
2155            if (mSystemContext == null) {
2156                mSystemContext = ContextImpl.createSystemContext(this);
2157            }
2158            return mSystemContext;
2159        }
2160    }

/frameworks/base/core/java/android/app/ContextImpl.java

	static ContextImpl createSystemContext(ActivityThread mainThread) {
2244        LoadedApk packageInfo = new LoadedApk(mainThread);
2245        ContextImpl context = new ContextImpl(null, mainThread, packageInfo, null, null, null, 0,
2246                null);
2247        context.setResources(packageInfo.getResources());
2248        context.mResources.updateConfiguration(context.mResourcesManager.getConfiguration(),
2249                context.mResourcesManager.getDisplayMetrics());
2250        return context;
2251    }

/frameworks/base/core/java/android/app/LoadedApk.java

	LoadedApk(ActivityThread activityThread) {
185        mActivityThread = activityThread;
186        mApplicationInfo = new ApplicationInfo();
187        mApplicationInfo.packageName = "android";
188        mPackageName = "android";
189        mAppDir = null;
190        mResDir = null;
191        mSplitAppDirs = null;
192        mSplitResDirs = null;
193        mSplitClassLoaderNames = null;
194        mOverlayDirs = null;
195        mDataDir = null;
196        mDataDirFile = null;
197        mDeviceProtectedDataDirFile = null;
198        mCredentialProtectedDataDirFile = null;
199        mLibDir = null;
200        mBaseClassLoader = null;
201        mSecurityViolation = false;
202        mIncludeCode = true;
203        mRegisterPackage = false;
204        mClassLoader = ClassLoader.getSystemClassLoader();
205        mResources = Resources.getSystem();
206    }

注：LoadApk对象用来保存一个apk信息，这个构造方法中会将使用的包名指定为"android"

/frameworks/base/core/java/android/app/ContextImpl.java

	private ContextImpl(@Nullable ContextImpl container, @NonNull ActivityThread mainThread,
2324            @NonNull LoadedApk packageInfo, @Nullable String splitName,
2325            @Nullable IBinder activityToken, @Nullable UserHandle user, int flags,
2326            @Nullable ClassLoader classLoader) {
2327        mOuterContext = this;
2328
2329        // If creator didn't specify which storage to use, use the default
2330        // location for application.
2331        if ((flags & (Context.CONTEXT_CREDENTIAL_PROTECTED_STORAGE
2332                | Context.CONTEXT_DEVICE_PROTECTED_STORAGE)) == 0) {
2333            final File dataDir = packageInfo.getDataDirFile();
2334            if (Objects.equals(dataDir, packageInfo.getCredentialProtectedDataDirFile())) {
2335                flags |= Context.CONTEXT_CREDENTIAL_PROTECTED_STORAGE;
2336            } else if (Objects.equals(dataDir, packageInfo.getDeviceProtectedDataDirFile())) {
2337                flags |= Context.CONTEXT_DEVICE_PROTECTED_STORAGE;
2338            }
2339        }
2340
2341        mMainThread = mainThread;
2342        mActivityToken = activityToken;
2343        mFlags = flags;
2344
2345        if (user == null) {
2346            user = Process.myUserHandle();
2347        }
2348        mUser = user;
2349
2350        mPackageInfo = packageInfo;
2351        mSplitName = splitName;
2352        mClassLoader = classLoader;
2353        mResourcesManager = ResourcesManager.getInstance();
2354
2355        if (container != null) {
2356            mBasePackageName = container.mBasePackageName;
2357            mOpPackageName = container.mOpPackageName;
2358            setResources(container.mResources);
2359            mDisplay = container.mDisplay;
2360        } else {
2361            mBasePackageName = packageInfo.mPackageName;
2362            ApplicationInfo ainfo = packageInfo.getApplicationInfo();
2363            if (ainfo.uid == Process.SYSTEM_UID && ainfo.uid != Process.myUid()) {
2364                // Special case: system components allow themselves to be loaded in to other
2365                // processes.  For purposes of app ops, we must then consider the context as
2366                // belonging to the package of this process, not the system itself, otherwise
2367                // the package+uid verifications in app ops will fail.
2368                mOpPackageName = ActivityThread.currentPackageName();
2369            } else {
2370                mOpPackageName = mBasePackageName;
2371            }
2372        }
2373
2374        mContentResolver = new ApplicationContentResolver(this, mainThread, user);
2375    }

在ContextImpl的构造方法中会初始化该进程的各个字段，例如资源、包信息、屏幕配置等。

2、创建SystemServiceManager

/frameworks/base/services/core/java/com/android/server/SystemServiceManager.java

	SystemServiceManager(Context context) {
49        mContext = context;
50    }

/frameworks/base/core/java/com/android/server/LocalServices.java

	public static <T> void addService(Class<T> type, T service) {
55        synchronized (sLocalServiceObjects) {
56            if (sLocalServiceObjects.containsKey(type)) {
57                throw new IllegalStateException("Overriding service registration");
58            }
59            sLocalServiceObjects.put(type, service);
60        }
61    }

addService函数把SystemServiceManager放到LocalServicesd的sLocalServiceObjects中，其中sLocalServiceObjects是一个ArrayMap。

3、启动各种服务

startBootstrapServices()

引导服务	作用
Installer	系统安装apk时的一个服务类，启动完成Installer服务之后才能启动其他的系统服务
ActivityManagerService	负责四大组件的启动、切换、调度。
PowerManagerService	计算系统中和Power相关的计算，然后决策系统应该如何反应
LightsService	管理和显示背光LED
DisplayManagerService	用来管理所有显示设备
UserManagerService	多用户模式管理
SensorService	为系统提供各种感应器服务
PackageManagerService	用来对apk进行安装、解析、删除、卸载等等操作

startCoreServices()

核心服务	作用
BatteryService	管理电池相关的服务
UsageStatsService	收集用户使用每一个APP的频率、使用时常
WebViewUpdateService	WebView更新服务

startOtherServices()

其他服务	作用
CameraService	摄像头相关服务
AlarmManagerService	全局定时器管理服务
InputManagerService	管理输入事件
WindowManagerService	窗口管理服务
VrManagerService	VR模式管理服务
BluetoothService	蓝牙管理服务
NotificationManagerService	通知管理服务
DeviceStorageMonitorService	存储相关管理服务
LocationManagerService	定位管理服务
AudioService	音频相关管理服务
…	…

启动服务的两种方式

先观察startBootstrapServices()的代码

	private void startBootstrapServices() {
           ...
531        traceBeginAndSlog("StartPowerManager");
532        mPowerManagerService = mSystemServiceManager.startService(PowerManagerService.class);
533        traceEnd();
		   ...
566        mSystemServiceManager.startBootPhase(SystemService.PHASE_WAIT_FOR_DEFAULT_DISPLAY);
		   ...
585        mPackageManagerService = PackageManagerService.main(mSystemContext, installer,
586                mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore);
587        mFirstBoot = mPackageManagerService.isFirstBoot();
588        mPackageManager = mSystemContext.getPackageManager();
589        traceEnd();
		   ...
646}

以PowerManagerService的启动为例，执行startService方法，之后进过一段时间，会调用startBootPhase方法。

 	public <T extends SystemService> T startService(Class<T> serviceClass) {
83        try {
84            final String name = serviceClass.getName();
85            Slog.i(TAG, "Starting " + name);
86            Trace.traceBegin(Trace.TRACE_TAG_SYSTEM_SERVER, "StartService " + name);
87
88            // Create the service.
89            if (!SystemService.class.isAssignableFrom(serviceClass)) {
90                throw new RuntimeException("Failed to create " + name
91                        + ": service must extend " + SystemService.class.getName());
92            }
93            final T service;
94            try {
95                Constructor<T> constructor = serviceClass.getConstructor(Context.class);
96                service = constructor.newInstance(mContext);
97            } catch (InstantiationException ex) {
98                throw new RuntimeException("Failed to create service " + name
99                        + ": service could not be instantiated", ex);
100            } catch (IllegalAccessException ex) {
101                throw new RuntimeException("Failed to create service " + name
102                        + ": service must have a public constructor with a Context argument", ex);
103            } catch (NoSuchMethodException ex) {
104                throw new RuntimeException("Failed to create service " + name
105                        + ": service must have a public constructor with a Context argument", ex);
106            } catch (InvocationTargetException ex) {
107                throw new RuntimeException("Failed to create service " + name
108                        + ": service constructor threw an exception", ex);
109            }
110
111            startService(service);
112            return service;
113        } finally {
114            Trace.traceEnd(Trace.TRACE_TAG_SYSTEM_SERVER);
115        }
116    }
117
118    public void startService(@NonNull final SystemService service) {
119        // Register it.
120        mServices.add(service);
121        // Start it.
122        long time = SystemClock.elapsedRealtime();
123        try {
124            service.onStart();
125        } catch (RuntimeException ex) {
126            throw new RuntimeException("Failed to start service " + service.getClass().getName()
127                    + ": onStart threw an exception", ex);
128        }
129        warnIfTooLong(SystemClock.elapsedRealtime() - time, service, "onStart");
130    }

启动服务实际调用了对应服务的onStart方法。

而PackageManagerService执行的却是PackageManagerService的main方法。

/frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java

	public static PackageManagerService main(Context context, Installer installer,
2311            boolean factoryTest, boolean onlyCore) {
2312        // Self-check for initial settings.
2313        PackageManagerServiceCompilerMapping.checkProperties();
2314
2315        PackageManagerService m = new PackageManagerService(context, installer,
2316                factoryTest, onlyCore);
2317        m.enableSystemUserPackages();
2318        ServiceManager.addService("package", m);
2319        final PackageManagerNative pmn = m.new PackageManagerNative();
2320        ServiceManager.addService("package_native", pmn);
2321        return m;
2322    }

由代码可见，这里以addService的方法添加到ServiceManager中去。

那么为什么执行startBootPhase又是为什么呢？

	public void startBootPhase(final int phase) {
139        if (phase <= mCurrentPhase) {
140            throw new IllegalArgumentException("Next phase must be larger than previous");
141        }
142        mCurrentPhase = phase;
143
144        Slog.i(TAG, "Starting phase " + mCurrentPhase);
145        try {
146            Trace.traceBegin(Trace.TRACE_TAG_SYSTEM_SERVER, "OnBootPhase " + phase);
147            final int serviceLen = mServices.size();
			   //遍历服务执行onBootPhase方法
148            for (int i = 0; i < serviceLen; i++) {
149                final SystemService service = mServices.get(i);
150                long time = SystemClock.elapsedRealtime();
151                Trace.traceBegin(Trace.TRACE_TAG_SYSTEM_SERVER, service.getClass().getName());
152                try {
153                    service.onBootPhase(mCurrentPhase);
154                } catch (Exception ex) {
155                    throw new RuntimeException("Failed to boot service "
156                            + service.getClass().getName()
157                            + ": onBootPhase threw an exception during phase "
158                            + mCurrentPhase, ex);
159                }
160                warnIfTooLong(SystemClock.elapsedRealtime() - time, service, "onBootPhase");
161                Trace.traceEnd(Trace.TRACE_TAG_SYSTEM_SERVER);
162            }
163        } finally {
164            Trace.traceEnd(Trace.TRACE_TAG_SYSTEM_SERVER);
165        }
166    }

代码可见，会遍历所有向SystemServiceManager注册过的service的onBootPhase()方法

查看SystemService类，可见系统服务有多个阶段。

/frameworks/base/services/core/java/com/android/server/SystemService.java

	public abstract class SystemService {
48    /*
49     * Boot Phases
50     */
51    public static final int PHASE_WAIT_FOR_DEFAULT_DISPLAY = 100; // maybe should be a dependency?
52
53    /**
54     * After receiving this boot phase, services can obtain lock settings data.
55     */
56    public static final int PHASE_LOCK_SETTINGS_READY = 480;
57
58    /**
59     * After receiving this boot phase, services can safely call into core system services
60     * such as the PowerManager or PackageManager.
61     */
62    public static final int PHASE_SYSTEM_SERVICES_READY = 500;
63
64    /**
65     * After receiving this boot phase, services can broadcast Intents.
66     */
67    public static final int PHASE_ACTIVITY_MANAGER_READY = 550;
68
69    /**
70     * After receiving this boot phase, services can start/bind to third party apps.
71     * Apps will be able to make Binder calls into services at this point.
72     */
73    public static final int PHASE_THIRD_PARTY_APPS_CAN_START = 600;
74
75    /**
76     * After receiving this boot phase, services can allow user interaction with the device.
77     * This phase occurs when boot has completed and the home application has started.
78     * System services may prefer to listen to this phase rather than registering a
79     * broadcast receiver for ACTION_BOOT_COMPLETED to reduce overall latency.
80     */
81    public static final int PHASE_BOOT_COMPLETED = 1000;
         ..... 
120    /**
121     * Called on each phase of the boot process. Phases before the service's start phase
122     * (as defined in the @Service annotation) are never received.
123     *
124     * @param phase The current boot phase.
125     */
126    public void onBootPhase(int phase) {}
           ....
}

SystemServer会依次启动许多服务，但服务之间的功能是相互依赖的。因此，每个服务刚被启动的时候，都必须完成最基本的初始化。所以当系统运动到某个阶段时，调用SystemServiceManager的startBootPhase，这样所有的服务都可以进一步完成换这个阶段可以进行的初始化工作。

通过这个方式，每个服务的初始化过程可以按阶段分为好几个部分，增加了不同阶段的初始化工作的清晰度；同时，每个阶段调用startBootPhase函数，就像一种同步机制一样，让所有服务的初始化进程保持一致的步调。

总结一下启动服务的两种方式：

startService()。主要功能：创建serviceClass的对象，将刚创建的对象添加到SystemServiceManager的成员变量mServices，再调用刚创建对象的onStart()方法。对于服务启动到一定阶段，进入相应的Phase时，会调用SystemServiceManager的startBootPhase()方法完成初始化
addService()。该方法用于初始化继承于IBinder的服务。主要功能将服务向Native层的ServiceManager注册服务。