原文地址 http://blog.csdn.net/qq_25806863/article/details/70820063

概括

基於Android7.1源碼。

結合一些文章想看一下Android的SystemServer的產生和啓動，發現7.1的代碼和文章上的不太一樣，只玩的源碼我也沒看過，不知道什麼時候開始變得。就做一個記錄。

大致流程就是

init進程

init是Android系統中用戶級的第一個進程。通過ps命令可以看到，進程ID是1.

既然整個用戶系統都是從init開始的，那麼SystemService肯定也是從這裏創建了。

init進程的入口是main()方法

/system/core/init/init.cpp：

int main(int argc, char** argv) {
    parser.ParseConfig("/init.rc");
}

要解析一個init.rc文件

/system/core/rootdir/init.rc:

import /init.${ro.zygote}.rc

在這個文件夾下還有這些文件：

以init.zygote64.rc爲例

/system/core/rootdir/init.zygote64.rc

service zygote /system/bin/app_process64 -Xzygote /system/bin --zygote --start-system-server
    class main
    socket zygote stream 660 root system
    onrestart write /sys/android_power/request_state wake
    onrestart write /sys/power/state on
    onrestart restart audioserver
    onrestart restart cameraserver
    onrestart restart media
    onrestart restart netd
    writepid /dev/cpuset/foreground/tasks

通過解析這個文件，會從init進程中fork出zygote進程。

zygote進程

zygote對應的源文件是app_main.cpp,這個進程把自己的名字重命名爲zygote。

/frameworks/base/cmds/app_process/app_main.cpp：

static const char ZYGOTE_NICE_NAME[] = "zygote64";
int main(int argc, char* const argv[]){
    AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));
    while (i < argc) {
        const char* arg = argv[i++];
        if (strcmp(arg, "--zygote") == 0) {
            zygote = true;
            niceName = ZYGOTE_NICE_NAME;
        }
    }
    //重命名進程名字
    if (!niceName.isEmpty()) {
        runtime.setArgv0(niceName.string());
        set_process_name(niceName.string());
    }
    if (zygote) {
        runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
    } else if (className) {
        runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
    } else {
        fprintf(stderr, "Error: no class name or --zygote supplied.\n");
        app_usage();
        LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");
        return 10;
    }
}

看到最後又一句runtime.start("com.android.internal.os.ZygoteInit", args, zygote);，把事情交給runtime去做。runtime是AppRuntime，AppRuntime是繼承AndroidRuntime的：

/frameworks/base/cmds/app_process/app_main.cpp：

class AppRuntime : public AndroidRuntime{
    public:AppRuntime(char* argBlockStart, const size_t argBlockLength)
        : AndroidRuntime(argBlockStart, argBlockLength)
        , mClass(NULL){}

    void setClassNameAndArgs(const String8& className, int argc, char * const *argv) {
        ......
    }

    virtual void onVmCreated(JNIEnv* env){
        ......
    }

    virtual void onStarted(){
        ......
    }

    virtual void onZygoteInit(){
        ......
    }

    virtual void onExit(int code){
        ......
    }
}

AppRuntime並沒有start方法，因此start方法是AndroidRuntime的：

/frameworks/base/core/jni/AndroidRuntime.cpp

void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
{
    //設置ANDROID_ROOT環境變量
    const char* rootDir = getenv("ANDROID_ROOT");
    if (rootDir == NULL) {
        rootDir = "/system";
        if (!hasDir("/system")) {
            LOG_FATAL("No root directory specified, and /android does not exist.");
            return;
        }
        setenv("ANDROID_ROOT", rootDir, 1);
    }

    //啓動虛擬機
    if (startVm(&mJavaVM, &env, zygote) != 0) {
        return;
    }
    onVmCreated(env);

    //註冊Android的JNI函數
    if (startReg(env) < 0) {
        ALOGE("Unable to register all android natives\n");
        return;
    }

    //用數組保存類名和參數
    stringClass = env->FindClass("java/lang/String");
    strArray = env->NewObjectArray(options.size() + 1, stringClass, NULL);
    classNameStr = env->NewStringUTF(className);
    env->SetObjectArrayElement(strArray, 0, classNameStr);
    for (size_t i = 0; i < options.size(); ++i) {
        jstring optionsStr = env->NewStringUTF(options.itemAt(i).string());
        assert(optionsStr != NULL);
        env->SetObjectArrayElement(strArray, i + 1, optionsStr);
    }

    //找到這個類，並執行這個類的main方法，前面調用時傳入的是`com.android.internal.os.ZygoteInit`
    char* slashClassName = toSlashClassName(className);
    jclass startClass = env->FindClass(slashClassName);
    if (startClass == NULL) {
        ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);
        /* keep going */
    } else {
        //找到main方法
        jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
            "([Ljava/lang/String;)V");
        if (startMeth == NULL) {
            ALOGE("JavaVM unable to find main() in '%s'\n", className);
            /* keep going */
        } else {
            //通過JNI執行main方法,com.android.internal.os.ZygoteInit是一個java類
            env->CallStaticVoidMethod(startClass, startMeth, strArray);
    }
    //zygote退出
    if (mJavaVM->DetachCurrentThread() != JNI_OK)
        ALOGW("Warning: unable to detach main thread\n");
    if (mJavaVM->DestroyJavaVM() != 0)
        ALOGW("Warning: VM did not shut down cleanly\n");
}

這個start方法啓動AndroidRuntime，先啓動虛擬機，然後註冊JNI函數，最後通過傳進來的第一個參數找到相應的類，並執行他的main()方法。

這時，從native進入java層了。

進入Java代碼 ZygoteInit.java

下面就是ZygoteInit的main方法:

/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java:

public static void main(String argv[]) {
        try {
            RuntimeInit.enableDdms();
            // 開始 zygote 初始化.
            SamplingProfilerIntegration.start();
            boolean startSystemServer = false;
            String socketName = "zygote";
            String abiList = null;
            for (int i = 1; i < argv.length; i++) {
                if ("start-system-server".equals(argv[i])) {
                    startSystemServer = true;
                } else if (argv[i].startsWith(ABI_LIST_ARG)) {
                    abiList = argv[i].substring(ABI_LIST_ARG.length());
                }
            }
            //註冊一個服務端的socket供zygote使用
            registerZygoteSocket(socketName);
            //預加載，包括類，資源，等等
            preload();
            // 結束zygote 初始化.
            SamplingProfilerIntegration.writeZygoteSnapshot();
            // 進行一次垃圾回收
            gcAndFinalize();
            if (startSystemServer) {
                //啓動system_server進程
                startSystemServer(abiList, socketName);
            }
        } catch (MethodAndArgsCaller caller) {
            ......
        }
    }
static void preload() {
        Log.d(TAG, "begin preload");
        beginIcuCachePinning();
        preloadClasses();
        preloadResources();
        preloadOpenGL();
        preloadSharedLibraries();
        preloadTextResources();
        // Ask the WebViewFactory to do any initialization that must run in the zygote process,
        // for memory sharing purposes.
        WebViewFactory.prepareWebViewInZygote();
        endIcuCachePinning();
        warmUpJcaProviders();
        Log.d(TAG, "end preload");
    }

ZygoteInit的main方法中調用startSystemServer(abiList, socketName)算是啓動了system_server進程。

system_server進程的產生

system_server是Android系統Service運行的進程,這個進程死了後，會導致zygote進程重新啓動.

startSystemServer也是ZygoteInit的方法：

/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java:

private static boolean startSystemServer(String abiList, String socketName)
            throws MethodAndArgsCaller, RuntimeException {
        /* 硬編碼命令行啓動系統服務器 */
        String args[] = {
            "--setuid=1000",
            "--setgid=1000",
            "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1032,3001,3002,3003,3006,3007,3009,3010",
            "--capabilities=" + capabilities + "," + capabilities,
            "--nice-name=system_server", //進程名system_server
            "--runtime-args",
            "com.android.server.SystemServer",//啓動類 SystemServer
        };
        ZygoteConnection.Arguments parsedArgs = null;
        try {
            //把上面的命令轉爲Arguments對象
            parsedArgs = new ZygoteConnection.Arguments(args);
            /* 從Zygote進程中fork一個system server 子進程 */
            pid = Zygote.forkSystemServer(
                    parsedArgs.uid, parsedArgs.gid,
                    parsedArgs.gids,
                    parsedArgs.debugFlags,
                    null,
                    parsedArgs.permittedCapabilities,
                    parsedArgs.effectiveCapabilities);
        } catch (IllegalArgumentException ex) {
            throw new RuntimeException(ex);
        }
        if (pid == 0) {
            if (hasSecondZygote(abiList)) {
                waitForSecondaryZygote(socketName);
            }

            handleSystemServerProcess(parsedArgs);
        }
        return true;
    }

從Zygote進程中fork一個system server 子進程，那麼Zygote.forkSystemServer做了什麼，怎麼啓動SystemServer的呢？

/frameworks/base/core/java/com/android/internal/os/Zygote.java:

public static int forkSystemServer(int uid, int gid, int[] gids, int debugFlags,
            int[][] rlimits, long permittedCapabilities, long effectiveCapabilities) {
        VM_HOOKS.preFork();
        int pid = nativeForkSystemServer(
                uid, gid, gids, debugFlags, rlimits, permittedCapabilities, effectiveCapabilities);
        // Enable tracing as soon as we enter the system_server.
        if (pid == 0) {
            Trace.setTracingEnabled(true);
        }
        VM_HOOKS.postForkCommon();
        return pid;
    }

native private static int nativeForkSystemServer(int uid, int gid, int[] gids, int debugFlags,
            int[][] rlimits, long permittedCapabilities, long effectiveCapabilities);

調用了native方法nativeForkSystemServe，這個方位定義在com_android_internal_os_Zygote.cpp中

/frameworks/base/core/jni/com_android_internal_os_Zygote.cpp：

static jint com_android_internal_os_Zygote_nativeForkSystemServer(
        JNIEnv* env, jclass, uid_t uid, gid_t gid, jintArray gids,
        jint debug_flags, jobjectArray rlimits, jlong permittedCapabilities,
        jlong effectiveCapabilities) {
  pid_t pid = ForkAndSpecializeCommon(env, uid, gid, gids,
                                      debug_flags, rlimits,
                                      permittedCapabilities, effectiveCapabilities,
                                      MOUNT_EXTERNAL_DEFAULT, NULL, NULL, true, NULL,
                                      NULL, NULL);
  if (pid > 0) {
      gSystemServerPid = pid;
      if (waitpid(pid, &status, WNOHANG) == pid) {
          RuntimeAbort(env, __LINE__, "System server process has died. Restarting Zygote!");
      }
  }
  return pid;
}

static pid_t ForkAndSpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArray javaGids,
                                     jint debug_flags, jobjectArray javaRlimits,
                                     jlong permittedCapabilities, jlong effectiveCapabilities,
                                     jint mount_external,
                                     jstring java_se_info, jstring java_se_name,
                                     bool is_system_server, jintArray fdsToClose,
                                     jstring instructionSet, jstring dataDir) {
  pid_t pid = fork();
  return pid;
}

system_server進程的執行

上面fork了一個進程後，返回了pid,在回到ZygoteInit的startSystemServer方法：

/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java:

private static boolean startSystemServer(String abiList, String socketName)
            throws MethodAndArgsCaller, RuntimeException {
        /* 硬編碼命令行啓動系統服務器 */
        try {
            //把上面的命令轉爲Arguments對象
            parsedArgs = new ZygoteConnection.Arguments(args);
            /* 從Zygote進程中fork一個system server 子進程 */
            pid = Zygote.forkSystemServer(
                    );
        } catch (IllegalArgumentException ex) {
            throw new RuntimeException(ex);
        }
        if (pid == 0) {
            handleSystemServerProcess(parsedArgs);
        }
        return true;
    }

通過Zygote.forkSystemServer方法之後，system_server進程就產生了。下面就該這個進程幹活了。

system_server進程生成後，執行了handleSystemServerProcess(parsedArgs)方法：

/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java:

private static void handleSystemServerProcess(
            ZygoteConnection.Arguments parsedArgs)
            throws ZygoteInit.MethodAndArgsCaller {
        if (parsedArgs.invokeWith != null) {

        } else {
            ClassLoader cl = null;
            if (systemServerClasspath != null) {
                cl = createSystemServerClassLoader(systemServerClasspath,parsedArgs.targetSdkVersion);
                Thread.currentThread().setContextClassLoader(cl);
            }
            /* 將參數傳遞給SystemServer. */
            RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs, cl);
        }
    }

下面是RuntimeInit.zygoteInit：

/frameworks/base/core/java/com/android/internal/os/RuntimeInit.java

public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
            throws ZygoteInit.MethodAndArgsCaller {
        if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting application from zygote");
        commonInit();
        nativeZygoteInit();
        applicationInit(targetSdkVersion, argv, classLoader);
    }
private static void applicationInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
            throws ZygoteInit.MethodAndArgsCaller {
        nativeSetExitWithoutCleanup(true);
        // 將參數傳遞給類的主方法 main()，也就是com.android.server.SystemServer的main方法。
        invokeStaticMain(args.startClass, args.startArgs, classLoader);
    }

private static void invokeStaticMain(String className, String[] argv, ClassLoader classLoader)
            throws ZygoteInit.MethodAndArgsCaller {
        Class<?> cl;
        try {
            cl = Class.forName(className, true, classLoader);
        } catch (ClassNotFoundException ex) {
            throw new RuntimeException(
                    "Missing class when invoking static main " + className,ex);
        }

        Method m;
        try {
            //找到main方法
            m = cl.getMethod("main", new Class[] { String[].class });
        } catch (NoSuchMethodException ex) {
            throw new RuntimeException(
                    "Missing static main on " + className, ex);
        } catch (SecurityException ex) {
            throw new RuntimeException(
                    "Problem getting static main on " + className, ex);
        }

        int modifiers = m.getModifiers();
        if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {
            throw new RuntimeException(
                    "Main method is not public and static on " + className);
        }
         //然後並沒喲着這裏執行，而是拋出了異常。
        throw new ZygoteInit.MethodAndArgsCaller(m, argv);
    }

上面說是執行main方法，但是真正功能只是找到了main方法，然後並沒有執行，而是拋出了一個異常ZygoteInit.MethodAndArgsCaller。這是ZygoteInit內部定義的一個異常。

/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java:

public static class MethodAndArgsCaller extends Exception
            implements Runnable {
        /** method to call */
        private final Method mMethod;
        /** argument array */
        private final String[] mArgs;
        public MethodAndArgsCaller(Method method, String[] args) {
            mMethod = method;
            mArgs = args;
        }
        public void run() {
            try {
                mMethod.invoke(null, new Object[] { mArgs });
            } catch (IllegalAccessException ex) {
                throw new RuntimeException(ex);
            } catch (InvocationTargetException ex) {
                Throwable cause = ex.getCause();
                if (cause instanceof RuntimeException) {
                    throw (RuntimeException) cause;
                } else if (cause instanceof Error) {
                    throw (Error) cause;
                }
                throw new RuntimeException(ex);
            }
        }
    }

這個異常會一直向上拋，一直到ZygoteInit的main方法裏纔會捕捉處理：

/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java:

public static void main(String argv[]) {
        try {
            if (startSystemServer) {
                startSystemServer(abiList, socketName);
            }
        } catch (MethodAndArgsCaller caller) {
            caller.run();
        } catch (Throwable ex) {
            Log.e(TAG, "Zygote died with exception", ex);
            closeServerSocket();
            throw ex;
        }
    }

看到上面的caller.run()，結合上面的MethodAndArgsCaller，這裏纔是真正執行SystemServer.main()方法的地方。

SystemServer.main()

這下終於進入SystemServer了

直接看進入的main方法,就一句：

/frameworks/base/services/java/com/android/server/SystemServer.java

private static final long SNAPSHOT_INTERVAL = 60 * 60 * 1000; // 1hr
public static void main(String[] args) {
        new SystemServer().run();
    }

public SystemServer() {
        // Check for factory test mode.
        mFactoryTestMode = FactoryTest.getMode();
    }
private void run() {
        try {
            // 調整系統時間
            if (System.currentTimeMillis() < EARLIEST_SUPPORTED_TIME) {
                Slog.w(TAG, "System clock is before 1970; setting to 1970.");
                SystemClock.setCurrentTimeMillis(EARLIEST_SUPPORTED_TIME);
            }

            //這裏系統已經歡迎我們來到Android system server了。！。
            // Here we go!
            Slog.i(TAG, "Entered the Android system server!");
            EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_SYSTEM_RUN, SystemClock.uptimeMillis());

            // 性能採樣分析，輸出到文件.一小時執行一次
            if (SamplingProfilerIntegration.isEnabled()) {
                SamplingProfilerIntegration.start();
                mProfilerSnapshotTimer = new Timer();
                mProfilerSnapshotTimer.schedule(new TimerTask() {
                        @Override
                        public void run() {
                            SamplingProfilerIntegration.writeSnapshot("system_server", null);
                        }
                    }, SNAPSHOT_INTERVAL, SNAPSHOT_INTERVAL);
            }
            //這裏開啓了一個Looper
            android.os.Process.setThreadPriority(
                android.os.Process.THREAD_PRIORITY_FOREGROUND);
            android.os.Process.setCanSelfBackground(false);
            Looper.prepareMainLooper();
            System.loadLibrary("android_servers");
            performPendingShutdown();
            //初始化系統Context
            createSystemContext();
            // 創建SystemServiceManager
            mSystemServiceManager = new SystemServiceManager(mSystemContext);
            LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
        } finally {
            Trace.traceEnd(Trace.TRACE_TAG_SYSTEM_SERVER);
        }

        // 啓動一些系統服務.
        try {
            startBootstrapServices();
            startCoreServices();
            startOtherServices();
        } catch (Throwable ex) {
            Slog.e("System", "******************************************");
            Slog.e("System", "************ Failure starting system services", ex);
            throw ex;
        } finally {
            Trace.traceEnd(Trace.TRACE_TAG_SYSTEM_SERVER);
        }
        Looper.loop();
        throw new RuntimeException("Main thread loop unexpectedly exited");
    }
private void createSystemContext() {
    //創建系統的Context是在ActivityThread中完成的。
        ActivityThread activityThread = ActivityThread.systemMain();
        mSystemContext = activityThread.getSystemContext();
        mSystemContext.setTheme(DEFAULT_SYSTEM_THEME);
    }

喵了個嗚s

發佈了74 篇原創文章 · 獲贊 199 · 訪問量 51萬+

私信關注

SystemServer的產生和啓動

概括

init進程

zygote進程

進入Java代碼 ZygoteInit.java

system_server進程的產生

system_server進程的執行

SystemServer.main()

[轉帖]使用NMT和pmap解決JVM資源泄漏問題原創

Python實現大麥網搶票的四大關鍵技術點解析

Python 安裝庫指令大全

salesforce零基礎學習（一百三十八）零碎知識點小總結（十）

一款開源的.NET程序集反編譯、編輯和調試神器

關於接口協議，你必須要知道這些！

基於 Milvus + LlamaIndex 實現高級 RAG

【2024-05-21】以茶會友

Android動畫-屬性動畫-AnimatorSet

Android動畫-View動畫,插值器

用過的Intent的用法

Android設計模式（二十）-裝飾模式

Android設計模式（二十一）-享元模式

https://yachay.unat.edu.pe/blog/index.php?comment_area=format_blog&comment_component=blog&comment_co

linux以太網驅動總結