Android應用程序管理服務啓動過程淺析（PackageManagerService）

我們知道安卓應用程序的安裝最終都是通過應用程序管理服務PackageManagerService來管理安裝的，系統在啓動時就會啓動該服務，在之前的 Android應用程序安裝過程淺析文章中分析了應用程序的安裝的過程，當時只是使用該服務，並沒有講到該服務的啓動過程，這裏就來說說PackageManagerService的啓動過程。

準備過程

系統進程Zygote創建，Zygote進程會調用SystemServer組件的main函數

Android系統是基於Linux內核的，而在Linux系統中，所有的進程都是init進程的子孫進程，也就是說，所有的進程都是直接或者間接地由init進程fork出來的。Zygote進程也不例外，它是在系統啓動的過程，由init進程創建的。在系統啓動腳本system/core/rootdir/init.rc文件中，我們可以看到啓動Zygote進程的腳本命令：

我們查看init.rc文件的內容，發現沒有任何配置zygote的地方，但是看到他import /init.${ro.zygote}.rc，那我們就去看看import文件，可以發現有;

service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server

socket zygote stream 660 root system

上述代碼的意思是告訴init進程創建一個zygote的進程，執行代碼爲app_process，後面的爲參數。可以去查看init.c代碼的執行過程。

這一段引用自老羅

接下來的socket關鍵字表示這個zygote進程需要一個名稱爲”zygote”的socket資源，這樣，系統啓動後，我們就可以在/dev/socket目錄下看到有一個名爲zygote的文件。這裏定義的socket的類型爲unix
domain
socket，它是用來作本地進程間通信用的，具體可以參考前面一篇文章Android學習啓動篇提到的一書《Linux內核源代碼情景分析》的第七章–基於socket的進程間通信。前面我們說到的ActivityManagerService就是通這個socket來和zygote進程通信請求fork一個應用程序進程的了。

最後的一系列onrestart關鍵字表示這個zygote進程重啓時需要執行的命令。
關於init.rc文件的更多信息，請參考system/core/init/readme.txt文件。

我們去查看一下app_process的代碼，實際執行的是app_main.cpp。

 if (zygote) {
        runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
   } else if (className) {
       runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
   } else {
       fprintf(stderr, "Error: no class name or --zygote supplied.\n");
      app_usage();
       LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");
       return 10;
   }

最後有一段執行的代碼，執行了ZygoteInit的main函數：

public static void main(String argv[]) {
    try {

        registerZygoteSocket(socketName);
        EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
            SystemClock.uptimeMillis());
        preload();
        EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
            SystemClock.uptimeMillis());

        // Finish profiling the zygote initialization.
        SamplingProfilerIntegration.writeZygoteSnapshot();

        // Do an initial gc to clean up after startup
        gcAndFinalize();

        // Disable tracing so that forked processes do not inherit stale tracing tags from
        // Zygote.
        Trace.setTracingEnabled(false);

        if (startSystemServer) {
            startSystemServer(abiList, socketName);
        }

        Log.i(TAG, "Accepting command socket connections");
        runSelectLoop(abiList);

        closeServerSocket();
    } catch (MethodAndArgsCaller caller) {
        caller.run();
    } catch (RuntimeException ex) {
        Log.e(TAG, "Zygote died with exception", ex);
        closeServerSocket();
        throw ex;
    }
}

這時startSystemServer爲true，因此會執行startSystemServer函數：

/**
 * Prepare the arguments and fork for the system server process.
 */
private static boolean startSystemServer(String abiList, String socketName)
        throws MethodAndArgsCaller, RuntimeException {

    /* Hardcoded command line to start the system server */
    String args[] = {
        "--setuid=1000",
        "--setgid=1000",
        "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1032,3001,3002,3003,3006,3007",
        "--capabilities=" + capabilities + "," + capabilities,
        "--nice-name=system_server",
        "--runtime-args",
        "com.android.server.SystemServer",
    };
    ZygoteConnection.Arguments parsedArgs = null;

    int pid;

    try {
        parsedArgs = new ZygoteConnection.Arguments(args);
        ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
        ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);

        /* Request to fork the system server process */
        pid = Zygote.forkSystemServer(
                parsedArgs.uid, parsedArgs.gid,
                parsedArgs.gids,
                parsedArgs.debugFlags,
                null,
                parsedArgs.permittedCapabilities,
                parsedArgs.effectiveCapabilities);
    } catch (IllegalArgumentException ex) {
        throw new RuntimeException(ex);
    }

    /* For child process */
    if (pid == 0) {
        if (hasSecondZygote(abiList)) {
            waitForSecondaryZygote(socketName);
        }

        handleSystemServerProcess(parsedArgs);
    }

    return true;
}

可以看到parsedArgs設置了很多參數，比如uid，gid，groups，只fork了一個進程，這就是zygote進程，之後當pid爲0時，執行了handleSystemServerProcess函數，handleSystemServerProcess裏面又調用了 RuntimeInit.zygoteInit函數：

public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
        throws ZygoteInit.MethodAndArgsCaller {
    if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting application from zygote");

    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "RuntimeInit");
    redirectLogStreams();

    commonInit();
    nativeZygoteInit();
    applicationInit(targetSdkVersion, argv, classLoader);
}

這裏傳入的argv參數就是之前new ZygoteConnection.Arguments(args)解析後，不能解析的一段參數，我們先看看commonInit，裏面初始化了很多參數，其中有一個：

/* set default handler; this applies to all threads in the VM */
Thread.setDefaultUncaughtExceptionHandler(new UncaughtHandler());

看到這裏是不是感覺很熟悉，我們全局捕獲應用崩潰日誌是不是用到了這個，：

Thread.setDefaultUncaughtExceptionHandler(new UncaughtExceptionHandler() {
    @Override
    public void uncaughtException(Thread thread, final Throwable ex) {
        // save log
        saveException(ex, true);

        // default uncaught
        uncaughtExceptionHandler.uncaughtException(thread, ex);
    }
});

我們再回到zygoteInit中，繼續執行了applicationInit，applicationInit裏面調用了invokeStaticMain，這裏通過反射調用了SystemServer的main函數。到此第一階段結束了。

啓動過程

我們來看看SystemServer做了什麼？

/**
 * The main entry point from zygote.
 */
public static void main(String[] args) {
    new SystemServer().run();
}

public SystemServer() {
    // Check for factory test mode.
    mFactoryTestMode = FactoryTest.getMode();
}

private void run() {
    Looper.prepareMainLooper();
    // Initialize the system context.
    createSystemContext();

    // Create the system service manager.
    mSystemServiceManager = new SystemServiceManager(mSystemContext);
    LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);

    // Start services.
    try {
        startBootstrapServices();
        startCoreServices();
        startOtherServices();
    } catch (Throwable ex) {
        Slog.e("System", "******************************************");
        Slog.e("System", "************ Failure starting system services", ex);
        throw ex;
    }

    // Loop forever.
    Looper.loop();
    throw new RuntimeException("Main thread loop unexpectedly exited");
}

我們看到main函數中主要調用了new SystemServer().run()，run函數中做了很多操作，這裏主要看與PackageManagerService有關的操作，可以看到先調用了createSystemContext()來創建系統上下文，接着在調用了startBootstrapServices來啓動引導服務，我們先看看系統上下文是怎麼創建的。

private void createSystemContext() {
    ActivityThread activityThread = ActivityThread.systemMain();
    mSystemContext = activityThread.getSystemContext();
    mSystemContext.setTheme(android.R.style.Theme_DeviceDefault_Light_DarkActionBar);
}

可以看到先調用了ActivityThread，這個是不是很熟悉，我們的應用程序啓動，Activity啓動都是這個來啓動的。這裏主要啓動了一個ActivityThread實例，我們接着看到獲取了全局上下文對象getSystemContext（），最後設置了系統上下文的主題。ActivityThread的創建就不在跟進了，主要看看getSystemContext的獲取過程，後續用到的很多對象都是在這裏面產生的。

ActivityThread() {
    mResourcesManager = ResourcesManager.getInstance();
 }

public static ActivityThread systemMain() {
    // The system process on low-memory devices do not get to use hardware
    // accelerated drawing, since this can add too much overhead to the
    // process.
    if (!ActivityManager.isHighEndGfx()) {
        HardwareRenderer.disable(true);
    } else {
        HardwareRenderer.enableForegroundTrimming();
    }
    ActivityThread thread = new ActivityThread();
    thread.attach(true);
    return thread;
}

public ContextImpl getSystemContext() {
    synchronized (this) {
        if (mSystemContext == null) {
            mSystemContext = ContextImpl.createSystemContext(this);
        }
        return mSystemContext;
    }
}

getSystemContext主要是創建了一個ContextImpl對象，並且將這個作爲系統的全局上下文。

我們分析完了createSystemContext之後再回到run函數，看看startBootstrapServices的執行過程。

/**
 * Starts the small tangle of critical services that are needed to get
 * the system off the ground.  These services have complex mutual dependencies
 * which is why we initialize them all in one place here.  Unless your service
 * is also entwined in these dependencies, it should be initialized in one of
 * the other functions.
 */
private void startBootstrapServices() {
    // Wait for installd to finish starting up so that it has a chance to
    // create critical directories such as /data/user with the appropriate
    // permissions.  We need this to complete before we initialize other services.
    Installer installer = mSystemServiceManager.startService(Installer.class);

    // Activity manager runs the show.
    mActivityManagerService = mSystemServiceManager.startService(
            ActivityManagerService.Lifecycle.class).getService();
    mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
    mActivityManagerService.setInstaller(installer);

    // Power manager needs to be started early because other services need it.
    // Native daemons may be watching for it to be registered so it must be ready
    // to handle incoming binder calls immediately (including being able to verify
    // the permissions for those calls).
    mPowerManagerService = mSystemServiceManager.startService(PowerManagerService.class);

    // Now that the power manager has been started, let the activity manager
    // initialize power management features.
    mActivityManagerService.initPowerManagement();

    // Manages LEDs and display backlight so we need it to bring up the display.
    mSystemServiceManager.startService(LightsService.class);

    // Display manager is needed to provide display metrics before package manager
    // starts up.
    mDisplayManagerService = mSystemServiceManager.startService(DisplayManagerService.class);

    // We need the default display before we can initialize the package manager.
    mSystemServiceManager.startBootPhase(SystemService.PHASE_WAIT_FOR_DEFAULT_DISPLAY);

    // Only run "core" apps if we're encrypting the device.
    String cryptState = SystemProperties.get("vold.decrypt");
    if (ENCRYPTING_STATE.equals(cryptState)) {
        Slog.w(TAG, "Detected encryption in progress - only parsing core apps");
        mOnlyCore = true;
    } else if (ENCRYPTED_STATE.equals(cryptState)) {
        Slog.w(TAG, "Device encrypted - only parsing core apps");
        mOnlyCore = true;
    }

    // Start the package manager.
    Slog.i(TAG, "Package Manager");
    mPackageManagerService = PackageManagerService.main(mSystemContext, installer,
            mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore);
    mFirstBoot = mPackageManagerService.isFirstBoot();
    mPackageManager = mSystemContext.getPackageManager();

    Slog.i(TAG, "User Service");
    ServiceManager.addService(Context.USER_SERVICE, UserManagerService.getInstance());

    // Initialize attribute cache used to cache resources from packages.
    AttributeCache.init(mSystemContext);

    // Set up the Application instance for the system process and get started.
    mActivityManagerService.setSystemProcess();

    // The sensor service needs access to package manager service, app ops
    // service, and permissions service, therefore we start it after them.
    startSensorService();
}

startBootstrapServices首先啓動了Installer服務，該服務貫穿了整個系統，主要用執行應用程的install，dexopt等操作，接着啓動了ActivityManagerService，這個也是系統非常重要的服務，我們的activity的管理，啓動等全靠他了。最後一步還啓動了startSensorService（）服務，看名字就能知道是傳感器服務，這是一個jni函數，可以查看源代碼，
閒話少扯，言歸正傳，略過其他的服務直接來看PackageManagerService的啓動。PackageManagerService的啓動主要調用了靜態main函數來啓動該服務的，傳入了上下文與Installer服務:

public static PackageManagerService main(Context context, Installer installer,
        boolean factoryTest, boolean onlyCore) {
    PackageManagerService m = new PackageManagerService(context, installer,
            factoryTest, onlyCore);
    ServiceManager.addService("package", m);
    return m;
}

初始化了一個PackageManagerService對象，初始對象時，會調用scanDirLI去掃描某些特定目錄，我們只看看掃描部分的代碼：

 public PackageManagerService(Context context, Installer installer,
            boolean factoryTest, boolean onlyCore) {

        synchronized (mInstallLock) {
        // writer
        synchronized (mPackages) {
            mHandlerThread = new ServiceThread(TAG,
                    Process.THREAD_PRIORITY_BACKGROUND, true /*allowIo*/);
            mHandlerThread.start();
            mHandler = new PackageHandler(mHandlerThread.getLooper());
            Watchdog.getInstance().addThread(mHandler, WATCHDOG_TIMEOUT);

            File dataDir = Environment.getDataDirectory();
            mAppDataDir = new File(dataDir, "data");
            mAppInstallDir = new File(dataDir, "app");
            mAppLib32InstallDir = new File(dataDir, "app-lib");
            mAsecInternalPath = new File(dataDir, "app-asec").getPath();
            mUserAppDataDir = new File(dataDir, "user");
            mDrmAppPrivateInstallDir = new File(dataDir, "app-private");

            // Collect vendor overlay packages.
            // (Do this before scanning any apps.)
            // For security and version matching reason, only consider
            // overlay packages if they reside in VENDOR_OVERLAY_DIR.
            File vendorOverlayDir = new File(VENDOR_OVERLAY_DIR);
            scanDirLI(vendorOverlayDir, PackageParser.PARSE_IS_SYSTEM
                    | PackageParser.PARSE_IS_SYSTEM_DIR, scanFlags | SCAN_TRUSTED_OVERLAY, 0);

            // Find base frameworks (resource packages without code).
            scanDirLI(frameworkDir, PackageParser.PARSE_IS_SYSTEM
                    | PackageParser.PARSE_IS_SYSTEM_DIR
                    | PackageParser.PARSE_IS_PRIVILEGED,
                    scanFlags | SCAN_NO_DEX, 0);

            // Collected privileged system packages.
            final File privilegedAppDir = new File(Environment.getRootDirectory(), "priv-app");
            scanDirLI(privilegedAppDir, PackageParser.PARSE_IS_SYSTEM
                    | PackageParser.PARSE_IS_SYSTEM_DIR
                    | PackageParser.PARSE_IS_PRIVILEGED, scanFlags, 0);

            // Collect ordinary system packages.
            final File systemAppDir = new File(Environment.getRootDirectory(), "app");
            scanDirLI(systemAppDir, PackageParser.PARSE_IS_SYSTEM
                    | PackageParser.PARSE_IS_SYSTEM_DIR, scanFlags, 0);

            // Collect all vendor packages.
            File vendorAppDir = new File("/vendor/app");
            try {
                vendorAppDir = vendorAppDir.getCanonicalFile();
            } catch (IOException e) {
                // failed to look up canonical path, continue with original one
            }
            scanDirLI(vendorAppDir, PackageParser.PARSE_IS_SYSTEM
                    | PackageParser.PARSE_IS_SYSTEM_DIR, scanFlags, 0);

            // Collect all OEM packages.
            final File oemAppDir = new File(Environment.getOemDirectory(), "app");
            scanDirLI(oemAppDir, PackageParser.PARSE_IS_SYSTEM
                    | PackageParser.PARSE_IS_SYSTEM_DIR, scanFlags, 0);

            if (!mOnlyCore) {
                EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_PMS_DATA_SCAN_START,
                        SystemClock.uptimeMillis());
                scanDirLI(mAppInstallDir, 0, scanFlags | SCAN_REQUIRE_KNOWN, 0);

                scanDirLI(mDrmAppPrivateInstallDir, PackageParser.PARSE_FORWARD_LOCK,
                        scanFlags | SCAN_REQUIRE_KNOWN, 0);


                /**
                 * Make sure all system apps that we expected to appear on
                 * the userdata partition actually showed up. If they never
                 * appeared, crawl back and revive the system version.
                 */
                for (int i = 0; i < mExpectingBetter.size(); i++) {
                    final String packageName = mExpectingBetter.keyAt(i);
                    if (!mPackages.containsKey(packageName)) {
                        final File scanFile = mExpectingBetter.valueAt(i);

                        logCriticalInfo(Log.WARN, "Expected better " + packageName
                                + " but never showed up; reverting to system");

                        final int reparseFlags;
                        if (FileUtils.contains(privilegedAppDir, scanFile)) {
                            reparseFlags = PackageParser.PARSE_IS_SYSTEM
                                    | PackageParser.PARSE_IS_SYSTEM_DIR
                                    | PackageParser.PARSE_IS_PRIVILEGED;
                        } else if (FileUtils.contains(systemAppDir, scanFile)) {
                            reparseFlags = PackageParser.PARSE_IS_SYSTEM
                                    | PackageParser.PARSE_IS_SYSTEM_DIR;
                        } else if (FileUtils.contains(vendorAppDir, scanFile)) {
                            reparseFlags = PackageParser.PARSE_IS_SYSTEM
                                    | PackageParser.PARSE_IS_SYSTEM_DIR;
                        } else if (FileUtils.contains(oemAppDir, scanFile)) {
                            reparseFlags = PackageParser.PARSE_IS_SYSTEM
                                    | PackageParser.PARSE_IS_SYSTEM_DIR;
                        } else {
                            Slog.e(TAG, "Ignoring unexpected fallback path " + scanFile);
                            continue;
                        }

                        mSettings.enableSystemPackageLPw(packageName);

                        try {
                            scanPackageLI(scanFile, reparseFlags, scanFlags, 0, null);
                        } catch (PackageManagerException e) {
                            Slog.e(TAG, "Failed to parse original system package: "
                                    + e.getMessage());
                        }
                    }
                }
            }
            mExpectingBetter.clear();

    }

從上面的代碼可以會掃描某些目錄，主要掃描了以下目錄：

“/vendor/overlay”;

“/system/framework”

“/system/priv-app”

“/system/app”

“/vendor/app”

“/oem/app”

“/data/app”

“/data/app-private”

初始化完成後，然後把這個服務添加到ServiceManager中去，ServiceManager是Android系統Binder進程間通信機制的守護進程，負責管理系統中的Binder對象；

到此整個流程就回到了之前Android應用程序安裝過程淺析的流程中。到處整個安裝過程就分析結束了。

Android應用程序管理服務啓動過程淺析（PackageManagerService）

準備過程

啓動過程

Binary XML file line #17 tag requires viewportWidth >0

Android應用程序管理服務啓動過程淺析（PackageManagerService）

一步一步學習JNI（一）

Android 標題欄（一）

Android拖拽動畫實現

https://yachay.unat.edu.pe/blog/index.php?comment_area=format_blog&comment_component=blog&comment_co

linux以太網驅動總結