Android源码分析 - SystemServer(下)

·  阅读 1225
Android源码分析 - SystemServer(下)

开篇

本篇以android-11.0.0_r25作为基础解析

上一篇文章Android源码分析 - SystemServer(上)我们分析了SystemServer进程是怎么被启动起来的,今天这篇,我们来分析SystemServer进程启动后做了什么

main

我们上一章中讲到,Zygote进程fork出子进程后,最终调用了SystemServer.main方法,SystemServer源代码在frameworks/base/services/java/com/android/server/SystemServer.java中,我们来看看做了什么

public static void main(String[] args) {
    new SystemServer().run();
}
复制代码

构造方法

非常简单,就是先new了一个SystemServer对象,然后调用它的run方法,我们先看一下构造方法

public SystemServer() {
    //工厂模式
    mFactoryTestMode = FactoryTest.getMode();

    ... //记录启动信息

    //记录是否经历过重启
    mRuntimeRestart = "1".equals(SystemProperties.get("sys.boot_completed"));
}
复制代码

工厂模式

首先,先从系统属性中获取工厂模式级别,有三种属性:

  • FACTORY_TEST_OFF:正常模式
  • FACTORY_TEST_LOW_LEVEL:低级别工厂模式,在此模式下,很多Service不会启动
  • FACTORY_TEST_HIGH_LEVEL:高级别工厂模式,此模式与正常模式基本相同,略有区别

它们被定义在frameworks/base/core/java/android/os/FactoryTest.java

run

紧接着便开始执行run方法

private void run() {
    ... //记录启动信息
    //如果没有设置时区,将时区设置为GMT
    String timezoneProperty = SystemProperties.get("persist.sys.timezone");
    if (timezoneProperty == null || timezoneProperty.isEmpty()) {
        Slog.w(TAG, "Timezone not set; setting to GMT.");
        SystemProperties.set("persist.sys.timezone", "GMT");
    }

    //设置区域与语言
    if (!SystemProperties.get("persist.sys.language").isEmpty()) {
        final String languageTag = Locale.getDefault().toLanguageTag();

        SystemProperties.set("persist.sys.locale", languageTag);
        SystemProperties.set("persist.sys.language", "");
        SystemProperties.set("persist.sys.country", "");
        SystemProperties.set("persist.sys.localevar", "");
    }

    //Binder事务发生阻塞时发出警告
    Binder.setWarnOnBlocking(true);
    //PackageManager相关
    PackageItemInfo.forceSafeLabels();
    ...
    //设置虚拟机库文件libart.so
    SystemProperties.set("persist.sys.dalvik.vm.lib.2", VMRuntime.getRuntime().vmLibrary());
    //清除虚拟机内存增长上限,以获得更多内存
    VMRuntime.getRuntime().clearGrowthLimit();
    // Some devices rely on runtime fingerprint generation, so make sure
    // we've defined it before booting further.
    Build.ensureFingerprintProperty();
    //设置在访问环境变量前,需要明确指定用户
    Environment.setUserRequired(true);
    //设置标记,当发生BadParcelableException异常时保守处理,不要抛出异常
    BaseBundle.setShouldDefuse(true);
    //设置异常跟踪
    Parcel.setStackTraceParceling(true);
    //确保Binder调用优先级总为前台优先级
    BinderInternal.disableBackgroundScheduling(true);
    //设置Binder线程池最大数量
    BinderInternal.setMaxThreads(sMaxBinderThreads);
    //设置进程优先级为前台进程
    // Prepare the main looper thread (this thread).
    android.os.Process.setThreadPriority(
            android.os.Process.THREAD_PRIORITY_FOREGROUND);
    android.os.Process.setCanSelfBackground(false);
    //以当前线程作为MainLooper准备
    Looper.prepareMainLooper();
    Looper.getMainLooper().setSlowLogThresholdMs(
            SLOW_DISPATCH_THRESHOLD_MS, SLOW_DELIVERY_THRESHOLD_MS);

    SystemServiceRegistry.sEnableServiceNotFoundWtf = true;

    //加载android_servers.so库
    System.loadLibrary("android_servers");
    //标记该进程的堆可分析
    initZygoteChildHeapProfiling();
    //Debug选项 - 开启一个线程用来监测FD泄漏
    if (Build.IS_DEBUGGABLE) {
        spawnFdLeakCheckThread();
    }
    //检查上次关机过程中是否失败
    performPendingShutdown();
    //初始化System Context
    createSystemContext();
    //创建并设置一些每个进程启动时都需要的一些模块 (TelephonyServiceManager, StatsServiceManager)
    ActivityThread.initializeMainlineModules();
    
    //创建SystemServiceManager(管理所有的系统Service)
    mSystemServiceManager = new SystemServiceManager(mSystemContext);
    mSystemServiceManager.setStartInfo(mRuntimeRestart,
            mRuntimeStartElapsedTime, mRuntimeStartUptime);
    //将SystemServiceManager作为本地进程Service使用
    LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
    //为初始化任务准备线程池
    SystemServerInitThreadPool.start();
    ...
    //设置默认异常处理程序
    RuntimeInit.setDefaultApplicationWtfHandler(SystemServer::handleEarlySystemWtf);

    ...
    //启动引导服务
    startBootstrapServices(t);
    //启动核心服务
    startCoreServices(t);
    //启动其他服务
    startOtherServices(t);
    ...

    //严格模式初始化虚拟机策略
    StrictMode.initVmDefaults(null);
    ...
    //进入Looper死循环,等待Handler事件
    Looper.loop();
    throw new RuntimeException("Main thread loop unexpectedly exited");
}
复制代码

可以看到,run方法主要做了以下工作

  1. 检查并设置各种参数handler
  2. 创建SystemContext
  3. 创建SystemServiceManager
  4. 启动服务
  5. Looper循环

其中,创建SystemContext这一步是由ContextImpl完成的,等后面分析到的时候在详细去看,Looper也是,我们将重点放在启动服务上

启动服务

启动服务分为三步,首先是启动引导服务,其次是启动核心服务,最后是启动其他服务,我们先从引导服务开始

由于启动的服务太多了,我们只介绍一些我们比较熟悉的服务

startBootstrapServices

private void startBootstrapServices(@NonNull TimingsTraceAndSlog t) {
    ...
    //看门狗
    final Watchdog watchdog = Watchdog.getInstance();
    watchdog.start();
    ...
    final String TAG_SYSTEM_CONFIG = "ReadingSystemConfig";
    //读取系统配置
    SystemServerInitThreadPool.submit(SystemConfig::getInstance, TAG_SYSTEM_CONFIG);
    ...
    //Installer服务(实际上是与installd跨进程通信)
    Installer installer = mSystemServiceManager.startService(Installer.class);
    ...
    //创建 ATMS & AMS
    ActivityTaskManagerService atm = mSystemServiceManager.startService(
            ActivityTaskManagerService.Lifecycle.class).getService();
    mActivityManagerService = ActivityManagerService.Lifecycle.startService(
            mSystemServiceManager, atm);
    mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
    mActivityManagerService.setInstaller(installer);
    mWindowManagerGlobalLock = atm.getGlobalLock();
    ...
    //电源管理服务,后面有其他服务依赖它,所以需要较早启动
    mPowerManagerService = mSystemServiceManager.startService(PowerManagerService.class);
    ...
    mActivityManagerService.initPowerManagement();
    ...
    //灯光服务
    mSystemServiceManager.startService(LightsService.class);
    ...
    //显示管理服务
    mDisplayManagerService = mSystemServiceManager.startService(DisplayManagerService.class);
    ...
    //阶段100
    mSystemServiceManager.startBootPhase(t, SystemService.PHASE_WAIT_FOR_DEFAULT_DISPLAY);
    
    ...
    //创建PMS
    try {
        Watchdog.getInstance().pauseWatchingCurrentThread("packagemanagermain");
        mPackageManagerService = PackageManagerService.main(mSystemContext, installer,
                mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore);
    } finally {
        Watchdog.getInstance().resumeWatchingCurrentThread("packagemanagermain");
    }

    //捕获dex load行为
    SystemServerDexLoadReporter.configureSystemServerDexReporter(mPackageManagerService);
    //是否首次启动
    mFirstBoot = mPackageManagerService.isFirstBoot();
    //获取PMS
    mPackageManager = mSystemContext.getPackageManager();
    ...
    //用户管理服务
    mSystemServiceManager.startService(UserManagerService.LifeCycle.class);
    ...
    //初始化属性缓存
    AttributeCache.init(mSystemContext);
    ...
    //注册各种系统服务
    mActivityManagerService.setSystemProcess();
    ...
    //使用AMS完成看门狗的设置,并监听重新启动
    watchdog.init(mSystemContext, mActivityManagerService);
    ...
    //设置调度策略
    mDisplayManagerService.setupSchedulerPolicies();
    ...
    //在单独线程中启动传感器服务
    mSensorServiceStart = SystemServerInitThreadPool.submit(() -> {
        TimingsTraceAndSlog traceLog = TimingsTraceAndSlog.newAsyncLog();
        traceLog.traceBegin(START_SENSOR_SERVICE);
        startSensorService();
        traceLog.traceEnd();
    }, START_SENSOR_SERVICE);
    ...
}
复制代码

startCoreServices

private void startCoreServices(@NonNull TimingsTraceAndSlog t) {
    ...
    //电池电量服务,依赖LightsService
    mSystemServiceManager.startService(BatteryService.class);
    ...
    //应用统计服务
    mSystemServiceManager.startService(UsageStatsService.class);
    mActivityManagerService.setUsageStatsManager(
            LocalServices.getService(UsageStatsManagerInternal.class));
    ...
}
复制代码

startOtherServices

private void startOtherServices(@NonNull TimingsTraceAndSlog t) {
    ...
    //AccountManagerService - 账户管理
    mSystemServiceManager.startService(ACCOUNT_SERVICE_CLASS);
    ...
    //ContentService - 内容服务
    mSystemServiceManager.startService(CONTENT_SERVICE_CLASS);
    ...
    //加载SettingProvider
    mActivityManagerService.installSystemProviders();
    ...
    //DropBox日志服务
    mSystemServiceManager.startService(DropBoxManagerService.class);
    ...
    //震动服务
    vibrator = new VibratorService(context);
    ServiceManager.addService("vibrator", vibrator);
    ...
    //时钟/闹钟服务
    mSystemServiceManager.startService(new AlarmManagerService(context));
    //输入服务
    inputManager = new InputManagerService(context);
    ...
    //等待传感器服务准备完毕
    ConcurrentUtils.waitForFutureNoInterrupt(mSensorServiceStart, START_SENSOR_SERVICE);
    mSensorServiceStart = null;
    //启动WindowManagerService
    wm = WindowManagerService.main(context, inputManager, !mFirstBoot, mOnlyCore,
            new PhoneWindowManager(), mActivityManagerService.mActivityTaskManager);
    ServiceManager.addService(Context.WINDOW_SERVICE, wm, /* allowIsolated= */ false,
            DUMP_FLAG_PRIORITY_CRITICAL | DUMP_FLAG_PROTO);
    ServiceManager.addService(Context.INPUT_SERVICE, inputManager,
            /* allowIsolated= */ false, DUMP_FLAG_PRIORITY_CRITICAL);
    ...
    mActivityManagerService.setWindowManager(wm);
    ...
    wm.onInitReady();
    ...
    //HIDL services
    SystemServerInitThreadPool.submit(() -> {
        startHidlServices();
    }, START_HIDL_SERVICES);
    ...
    //关联WMS,启动输入服务
    inputManager.setWindowManagerCallbacks(wm.getInputManagerCallback());
    inputManager.start();
    ...
    mDisplayManagerService.windowManagerAndInputReady();
    ...
    //有蓝牙功能且非低级工厂模式,启动蓝牙服务
    if (mFactoryTestMode == FactoryTest.FACTORY_TEST_LOW_LEVEL) {
        ...
    } else if (!context.getPackageManager().hasSystemFeature
            (PackageManager.FEATURE_BLUETOOTH)) {
        ...
    } else {
        mSystemServiceManager.startService(BluetoothService.class);
    }
    ...
    //输入法/无障碍服务
    if (mFactoryTestMode != FactoryTest.FACTORY_TEST_LOW_LEVEL) {
        if (InputMethodSystemProperty.MULTI_CLIENT_IME_ENABLED) {
            mSystemServiceManager.startService(
                    MultiClientInputMethodManagerService.Lifecycle.class);
        } else {
            mSystemServiceManager.startService(InputMethodManagerService.Lifecycle.class);
        }
        mSystemServiceManager.startService(ACCESSIBILITY_MANAGER_SERVICE_CLASS);
    }

    wm.displayReady();
    
    //存储相关服务
    if (mFactoryTestMode != FactoryTest.FACTORY_TEST_LOW_LEVEL) {
        if (!"0".equals(SystemProperties.get("system_init.startmountservice"))) {
            mSystemServiceManager.startService(STORAGE_MANAGER_SERVICE_CLASS);
            storageManager = IStorageManager.Stub.asInterface(
                        ServiceManager.getService("mount"));
            mSystemServiceManager.startService(STORAGE_STATS_SERVICE_CLASS);
        }
    }

    //UIMode服务(夜间模式,驾驶模式等)
    mSystemServiceManager.startService(UiModeManagerService.class);
    ...
    //执行磁盘清理工作,释放磁盘空间
    mPackageManagerService.performFstrimIfNeeded();

    if (mFactoryTestMode != FactoryTest.FACTORY_TEST_LOW_LEVEL) {
        ...
        final boolean hasPdb = !SystemProperties.get(PERSISTENT_DATA_BLOCK_PROP).equals("");
        ...
        if (hasPdb || OemLockService.isHalPresent()) {
            //OEM锁服务
            mSystemServiceManager.startService(OemLockService.class);
        }
        ...
        if (!isWatch) {
            //状态栏管理服务
            statusBar = new StatusBarManagerService(context);
            ServiceManager.addService(Context.STATUS_BAR_SERVICE, statusBar);
        }
        
        //网络相关服务
        ConnectivityModuleConnector.getInstance().init(context);
        NetworkStackClient.getInstance().init();
        networkManagement = NetworkManagementService.create(context);
        ServiceManager.addService(Context.NETWORKMANAGEMENT_SERVICE, networkManagement);
        ipSecService = IpSecService.create(context, networkManagement);
        ServiceManager.addService(Context.IPSEC_SERVICE, ipSecService);
        
        //文本服务
        mSystemServiceManager.startService(TextServicesManagerService.Lifecycle.class);
        mSystemServiceManager
                    .startService(TextClassificationManagerService.Lifecycle.class);

        //网络相关服务
        mSystemServiceManager.startService(NetworkScoreService.Lifecycle.class);
        networkStats = NetworkStatsService.create(context, networkManagement);
        ServiceManager.addService(Context.NETWORK_STATS_SERVICE, networkStats);
        networkPolicy = new NetworkPolicyManagerService(context, mActivityManagerService,
                    networkManagement);
        ServiceManager.addService(Context.NETWORK_POLICY_SERVICE, networkPolicy);
        if (context.getPackageManager().hasSystemFeature(
                PackageManager.FEATURE_WIFI)) {
            mSystemServiceManager.startServiceFromJar(
                    WIFI_SERVICE_CLASS, WIFI_APEX_SERVICE_JAR_PATH);
            mSystemServiceManager.startServiceFromJar(
                    WIFI_SCANNING_SERVICE_CLASS, WIFI_APEX_SERVICE_JAR_PATH);
        }
        if (context.getPackageManager().hasSystemFeature(
                PackageManager.FEATURE_WIFI_RTT)) {
            mSystemServiceManager.startServiceFromJar(
                    WIFI_RTT_SERVICE_CLASS, WIFI_APEX_SERVICE_JAR_PATH);
        }
        if (context.getPackageManager().hasSystemFeature(
                PackageManager.FEATURE_WIFI_AWARE)) {
            mSystemServiceManager.startServiceFromJar(
                    WIFI_AWARE_SERVICE_CLASS, WIFI_APEX_SERVICE_JAR_PATH);
        }
        if (context.getPackageManager().hasSystemFeature(
                PackageManager.FEATURE_WIFI_DIRECT)) {
            mSystemServiceManager.startServiceFromJar(
                    WIFI_P2P_SERVICE_CLASS, WIFI_APEX_SERVICE_JAR_PATH);
        }
        if (context.getPackageManager().hasSystemFeature(
                PackageManager.FEATURE_LOWPAN)) {
            mSystemServiceManager.startService(LOWPAN_SERVICE_CLASS);
        }
        if (mPackageManager.hasSystemFeature(PackageManager.FEATURE_ETHERNET) ||
                mPackageManager.hasSystemFeature(PackageManager.FEATURE_USB_HOST)) {
            mSystemServiceManager.startService(ETHERNET_SERVICE_CLASS);
        }
        connectivity = new ConnectivityService(
                    context, networkManagement, networkStats, networkPolicy);
        ServiceManager.addService(Context.CONNECTIVITY_SERVICE, connectivity,
                    /* allowIsolated= */ false,
                    DUMP_FLAG_PRIORITY_HIGH | DUMP_FLAG_PRIORITY_NORMAL);
        networkPolicy.bindConnectivityManager(connectivity);
        ...
        //系统更新服务
        ServiceManager.addService(Context.SYSTEM_UPDATE_SERVICE,
                    new SystemUpdateManagerService(context));
        ServiceManager.addService(Context.UPDATE_LOCK_SERVICE,
                    new UpdateLockService(context));
        //通知服务
        mSystemServiceManager.startService(NotificationManagerService.class);
        SystemNotificationChannels.removeDeprecated(context);
        SystemNotificationChannels.createAll(context);
        notification = INotificationManager.Stub.asInterface(
                ServiceManager.getService(Context.NOTIFICATION_SERVICE));
        ...
        //位置服务
        mSystemServiceManager.startService(LocationManagerService.Lifecycle.class);
        ...
        //墙纸服务
        if (context.getResources().getBoolean(R.bool.config_enableWallpaperService)) {
            mSystemServiceManager.startService(WALLPAPER_SERVICE_CLASS);
        } else {
            ...
        }
        //音频服务
        if (!isArc) {
            mSystemServiceManager.startService(AudioService.Lifecycle.class);
        } else {
            String className = context.getResources()
                    .getString(R.string.config_deviceSpecificAudioService);
            mSystemServiceManager.startService(className + "$Lifecycle");
        }
        ...
        //ADB服务
        mSystemServiceManager.startService(ADB_SERVICE_CLASS);
        //USB服务
        if (mPackageManager.hasSystemFeature(PackageManager.FEATURE_USB_HOST)
                || mPackageManager.hasSystemFeature(
                PackageManager.FEATURE_USB_ACCESSORY)
                || isEmulator) {
            mSystemServiceManager.startService(USB_SERVICE_CLASS);
        }
        //微件(小组件)服务
        if (mPackageManager.hasSystemFeature(PackageManager.FEATURE_APP_WIDGETS)
                || context.getResources().getBoolean(R.bool.config_enableAppWidgetService)) {
            mSystemServiceManager.startService(APPWIDGET_SERVICE_CLASS);
        }
        ...
        //Android10新增,用于报告来自运行时模块的信息
        ServiceManager.addService("runtime", new RuntimeService(context));
        ...
        //App后台Dex优化
        BackgroundDexOptService.schedule(context);
        ...
    }
    ...
    //相机服务
    if (!disableCameraService) {
        mSystemServiceManager.startService(CameraServiceProxy.class);
    }
    //进入安全模式
    if (safeMode) {
        mActivityManagerService.enterSafeMode();
    }

    //短信服务
    mmsService = mSystemServiceManager.startService(MmsServiceBroker.class);
    ...
    //剪贴板服务
    mSystemServiceManager.startService(ClipboardService.class);
    ...
    
    //调用各大服务的systemReady方法

    vibrator.systemReady();
    lockSettings.systemReady();
    
    //阶段480
    mSystemServiceManager.startBootPhase(t, SystemService.PHASE_LOCK_SETTINGS_READY);
    //阶段500
    mSystemServiceManager.startBootPhase(t, SystemService.PHASE_SYSTEM_SERVICES_READY);

    wm.systemReady();
    ...
    //手动更新Context Configuration
    final Configuration config = wm.computeNewConfiguration(DEFAULT_DISPLAY);
    DisplayMetrics metrics = new DisplayMetrics();
    context.getDisplay().getMetrics(metrics);
    context.getResources().updateConfiguration(config, metrics);

    final Theme systemTheme = context.getTheme();
    if (systemTheme.getChangingConfigurations() != 0) {
        systemTheme.rebase();
    }

    mPowerManagerService.systemReady(mActivityManagerService.getAppOpsService());
    ...
    mPackageManagerService.systemReady();
    mDisplayManagerService.systemReady(safeMode, mOnlyCore);
    
    mSystemServiceManager.setSafeMode(safeMode);

    //阶段520
    mSystemServiceManager.startBootPhase(t, SystemService.PHASE_DEVICE_SPECIFIC_SERVICES_READY);
    ...
    //最后运行AMS.systemReady
    mActivityManagerService.systemReady(() -> {
        //阶段550
        mSystemServiceManager.startBootPhase(t, SystemService.PHASE_ACTIVITY_MANAGER_READY);
        ...
        //阶段600
        mSystemServiceManager.startBootPhase(t, SystemService.PHASE_THIRD_PARTY_APPS_CAN_START);
        ...
    }, t);
}
复制代码

服务的启动是分阶段完成的,从0-100-480-500-520-550-600-1000,最后的阶段1000,是在AMS调用finishBooting方法后进入

可以看到,启动的服务非常之多,不可能全看得完,其中最重要的几个:ActivityManagerServiceWindowManagerServicePackageManagerServiceInputManagerService,后面我们会慢慢看过去,在此之前,我们还是先看看服务启动的方式

SystemServiceManager

绝大部分的服务是通过SystemServiceManager启动的,它的源码路径为frameworks/base/services/core/java/com/android/server/SystemServiceManager.java

startService

我们来看看这个类里的启动服务方法

这个类中有三个方法用于启动Serivce,分别是:

  • public SystemService startService(String className)
  • public SystemService startServiceFromJar(String className, String path)
  • public <T extends SystemService> T startService(Class<T> serviceClass)
  • public void startService(@NonNull final SystemService service)

实际上最后都是调用了最后一个方法

先看参数为StringstartService方法

public SystemService startService(String className) {
    final Class<SystemService> serviceClass = loadClassFromLoader(className,
            this.getClass().getClassLoader());
    return startService(serviceClass);
}
复制代码
private static Class<SystemService> loadClassFromLoader(String className,
        ClassLoader classLoader) {
    try {
        return (Class<SystemService>) Class.forName(className, true, classLoader);
    } catch (ClassNotFoundException ex) {
        ...
    }
}
复制代码

实际上就是通过反射拿到类名对应的Class,再调用Class为参的startService方法

startServiceFromJar实际上也是一样,只不过是先通过PathClassLoader加载了jar而已

public SystemService startServiceFromJar(String className, String path) {
    PathClassLoader pathClassLoader = mLoadedPaths.get(path);
    if (pathClassLoader == null) {
        // NB: the parent class loader should always be the system server class loader.
        // Changing it has implications that require discussion with the mainline team.
        pathClassLoader = new PathClassLoader(path, this.getClass().getClassLoader());
        mLoadedPaths.put(path, pathClassLoader);
    }
    final Class<SystemService> serviceClass = loadClassFromLoader(className, pathClassLoader);
    return startService(serviceClass);
}
复制代码

接着我们看看Class为参数的startService方法

public <T extends SystemService> T startService(Class<T> serviceClass) {
    final String name = serviceClass.getName();

    // Create the service.
    if (!SystemService.class.isAssignableFrom(serviceClass)) {
        throw new RuntimeException("Failed to create " + name
                + ": service must extend " + SystemService.class.getName());
    }
    final T service;
    try {
        Constructor<T> constructor = serviceClass.getConstructor(Context.class);
        service = constructor.newInstance(mContext);
    } catch (...) {
        ...
    }

    startService(service);
    return service;
}
复制代码

看函数泛型我们就可以知道,这个方法只接受SystemService的子类,并且在方法的开头,还使用了isAssignableFrom方法做了类型校验,避免通过String反射获取的ClassSystemService的子类

之后的逻辑也很简单,反射实例化对象,然后调用另一个以SystemService对象为参数的重载方法

public void startService(@NonNull final SystemService service) {
    mServices.add(service);
    try {
        service.onStart();
    } catch (RuntimeException ex) {
        throw new RuntimeException("Failed to start service " + service.getClass().getName()
                + ": onStart threw an exception", ex);
    }
}
复制代码

这个方法会将SystemService对象加入一个List中,然后调用它的onStart方法,通知SystemService自行处理启动

startBootPhase

因为各种服务之间是存在依赖关系的,所以Android将服务的启动划分了8个阶段:0-100-480-500-520-550-600-1000,而startBootPhase方法便是用来通知各个服务进行到哪一阶段了

public void startBootPhase(@NonNull TimingsTraceAndSlog t, int phase) {
    if (phase <= mCurrentPhase) {
        throw new IllegalArgumentException("Next phase must be larger than previous");
    }
    mCurrentPhase = phase;

    final int serviceLen = mServices.size();
    for (int i = 0; i < serviceLen; i++) {
        final SystemService service = mServices.get(i);
        service.onBootPhase(mCurrentPhase);
    }

    if (phase == SystemService.PHASE_BOOT_COMPLETED) {
        SystemServerInitThreadPool.shutdown();
    }
}
复制代码

每进入到一个阶段,便会调用Service List中所有SystemServiceonBootPhase方法,通知SystemService阶段变换,而当阶段达到1000 (PHASE_BOOT_COMPLETED) 时,就代表着所有的服务都已准备完毕,关闭SystemServerInitThreadPool线程池

ServiceManager

当服务被创建出来后,会调用ServiceManager.addService方法添加服务,以供其他地方使用这些服务

addService有三个重载,最终调用的为:

public static void addService(String name, IBinder service, boolean allowIsolated,
        int dumpPriority) {
    try {
        getIServiceManager().addService(name, service, allowIsolated, dumpPriority);
    } catch (RemoteException e) {
        Log.e(TAG, "error in addService", e);
    }
}
复制代码
private static IServiceManager getIServiceManager() {
    if (sServiceManager != null) {
        return sServiceManager;
    }

    // Find the service manager
    sServiceManager = ServiceManagerNative
            .asInterface(Binder.allowBlocking(BinderInternal.getContextObject()));
    return sServiceManager;
}
复制代码
public static IServiceManager asInterface(IBinder obj) {
    if (obj == null) {
        return null;
    }

    // ServiceManager is never local
    return new ServiceManagerProxy(obj);
}
复制代码
class ServiceManagerProxy implements IServiceManager {
    public ServiceManagerProxy(IBinder remote) {
        mRemote = remote;
        mServiceManager = IServiceManager.Stub.asInterface(remote);
    }

    public IBinder asBinder() {
        return mRemote;
    }
    ...
    public void addService(String name, IBinder service, boolean allowIsolated, int dumpPriority)
            throws RemoteException {
        mServiceManager.addService(name, service, allowIsolated, dumpPriority);
    }
    ...
    private IBinder mRemote;

    private IServiceManager mServiceManager;
}
复制代码

从这里就能看出来ServiceManager实际上是一个单独的进程,名为servicemanager,它负责管理所有服务,使用了Binder IPC机制,我们调用addService方法实际上是调用了Binder Proxy的方法,他向/dev/binder中写入消息,在servicemanager进程中接收到了这个消息并处理这个请求

关于Binder机制,我们随后便会分析它

最终调用了frameworks/native/cmds/servicemanager/ServiceManager.cpp中的addService函数

Status ServiceManager::addService(const std::string& name, const sp<IBinder>& binder, bool allowIsolated, int32_t dumpPriority) {
    auto ctx = mAccess->getCallingContext();
    ...
    //添加服务
    auto entry = mNameToService.emplace(name, Service {
        .binder = binder,
        .allowIsolated = allowIsolated,
        .dumpPriority = dumpPriority,
        .debugPid = ctx.debugPid,
    });

    auto it = mNameToRegistrationCallback.find(name);
    if (it != mNameToRegistrationCallback.end()) {
        for (const sp<IServiceCallback>& cb : it->second) {
            entry.first->second.guaranteeClient = true;
            // permission checked in registerForNotifications
            cb->onRegistration(name, binder);
        }
    }

    return Status::ok();
}
复制代码

可以看到,最终通过service name和传过来的binder对象构造出一个Service结构体,并将其保存至mNameToService这个Map中,以供后面使用

关于进程

SystemServer启动的服务大多都运行在systemserver进程中,但也有一些例外

譬如Installer服务,便是从init进程单独fork出了一个installd进程

下面是它的rc文件,frameworks/native/cmds/installd/installd.rc

service installd /system/bin/installd
class main
...
复制代码

而在SystemServer进程中start的Installer,便是通过binder连接到installd进程提供服务

源码路径frameworks/base/services/core/java/com/android/server/pm/Installer.java

@Override
public void onStart() {
    if (mIsolated) {
        mInstalld = null;
    } else {
        connect();
    }
}

private void connect() {
    IBinder binder = ServiceManager.getService("installd");
    if (binder != null) {
        try {
            binder.linkToDeath(new DeathRecipient() {
                @Override
                public void binderDied() {
                    Slog.w(TAG, "installd died; reconnecting");
                    connect();
                }
            }, 0);
        } catch (RemoteException e) {
            binder = null;
        }
    }

    if (binder != null) {
        mInstalld = IInstalld.Stub.asInterface(binder);
        try {
            invalidateMounts();
        } catch (InstallerException ignored) {
        }
    } else {
        Slog.w(TAG, "installd not found; trying again");
        BackgroundThread.getHandler().postDelayed(() -> {
            connect();
        }, DateUtils.SECOND_IN_MILLIS);
    }
}
复制代码

结束

SystemServer启动了非常多的服务,并将这些服务添加到了ServiceManager中,我们又从中引申出了Binder机制,我们下一章便开始分析Binder

分类:
Android
标签:
收藏成功!
已添加到「」, 点击更改