图解 Android 系列（四）原来 SystemServer 启动时干了这么多

https://jeanboy.blog.csdn.net/?type=blog

介绍#

这是一个连载的系列「图解 Android 系列」，我将持续为大家提供尽可能通俗易懂的 Android 源码分析。所有引用的源码片段，我都会在第一行标明源文件完整路径。为了文章篇幅考虑源码中间可能有删减，删减部分会用省略号代替。本系列源码基于：Android Oreo（8.0）

SystemServer.main()#

在上篇探索 SystemServer 进程创建过程中介绍了 SystemServer 进程是从 zygote 进程中 fork 出来的过程，在最后通过反射机制调用到了 SystemServer.main() 方法，我们接下来继续分析 SystemServer 进程后续启动的流程。

1
public static void main(String[] args) {
2
  // 先初始化 SystemServer 对象，再调用对象的 run() 方法
3
  new SystemServer().run();
4
}
5

6
private void run() {
7
  try {
8
    // ...
9
    // 检测上次关机过程是否失败，该方法可能不会返回
10
    performPendingShutdown();
11

12
    // 初始化系统上下文
13
    createSystemContext();
14

15
    // 创建系统服务管理
16
    mSystemServiceManager = new SystemServiceManager(mSystemContext);
17
    mSystemServiceManager.setRuntimeRestarted(mRuntimeRestart);
18
    // 将 mSystemServiceManager 添加到本地服务的成员 sLocalServiceObjects
19
    LocalServices.addService(SystemServiceManager.class,
20
                             mSystemServiceManager);
21
    // Prepare the thread pool for init tasks that can be parallelized
22
    SystemServerInitThreadPool.get();
23
  } finally {
24
    traceEnd();  // InitBeforeStartServices
25
  }
26

27
  // 启动各种系统服务
28
  try {
29
    // 启动引导服务
30
    startBootstrapServices();
31
    // 启动核心服务
32
    startCoreServices();
33
    // 启动其他服务
34
    startOtherServices();
35
    SystemServerInitThreadPool.shutdown();
36
  } catch (Throwable ex) {
37
    throw ex;
38
  } finally {
39
    traceEnd();
40
  }
41

42
  // 用于 debug 版本，将 log 事件不断循环地输出到 dropbox（用于分析）
43
  if (StrictMode.conditionallyEnableDebugLogging()) {
44
    Slog.i(TAG, "Enabled StrictMode for system server main thread.");
45
  }
46
  // ...
47
  // 一直循环执行
48
  Looper.loop();
49
  throw new RuntimeException("Main thread loop unexpectedly exited");
50
}

可以看到 SystemServer 进程由 Zygote 进程 fork 出来，接着会初始化虚拟机环境，然后创建 SystemServiceManager 大管家，启动系统服务，最后进入 loop 状态。

performPendingShutdown()#

1
private void performPendingShutdown() {
2
  // 获取上次的关机信息
3
  final String shutdownAction = SystemProperties.get(
4
    ShutdownThread.SHUTDOWN_ACTION_PROPERTY, "");
5
  if (shutdownAction != null && shutdownAction.length() > 0) {
6
    // 关机信息第一位表示关机是否是为了重启
7
    boolean reboot = (shutdownAction.charAt(0) == '1');
8
    final String reason;
9
    if (shutdownAction.length() > 1) {
10
      // 第一位往后表示关机的原因
11
      reason = shutdownAction.substring(1, shutdownAction.length());
12
    } else {
13
      reason = null;
14
    }
15

16
    if (reason != null
17
        && reason.startsWith(PowerManager.REBOOT_RECOVERY_UPDATE)) {
18
      // 关机原因是否是 REBOOT_RECOVERY_UPDATE，
19
      // 也就是 recovery 模式下，为了执行系统更新而关的机。
20
      // 这种情况下，一定会多重启一次，多的这一次重启，
21
      // 原因就不是 REBOOT_RECOVERY_UPDATE 了。
22
      File packageFile = new File(UNCRYPT_PACKAGE_FILE);
23
      if (packageFile.exists()) {
24
        String filename = null;
25
        try {
26
          // 读取 uncrypt_file 的内容，获取的是一个文件名
27
          filename = FileUtils.readTextFile(packageFile, 0, null);
28
        } catch (IOException e) {
29
          Slog.e(TAG, "Error reading uncrypt package file", e);
30
        }
31
        // 如果读出来的文件名以 /data 开头，也就是在 data 目录内
32
        if (filename != null && filename.startsWith("/data")) {
33
          // 如果 block.map 文件不存在，直接抛异常，重启失败
34
          if (!new File(BLOCK_MAP_FILE).exists()) {
35
            return;
36
          }
37
        }
38
      }
39
    }
40
    // 当 "sys.shutdown.requested" 值不为空，则会重启或者关机
41
    ShutdownThread.rebootOrShutdown(null, reboot, reason);
42
  }
43
}

这个方法主要是针对 recovery 模式下系统更新引起的重启，这种情况要多重启一次。

createSystemContext()#

1
private void createSystemContext() {
2
  // 创建 system_server 进程的上下文信息
3
  ActivityThread activityThread = ActivityThread.systemMain();
4
  mSystemContext = activityThread.getSystemContext();
5
  mSystemContext.setTheme(DEFAULT_SYSTEM_THEME);
6
  // 设置主题
7
  final Context systemUiContext = activityThread.getSystemUiContext();
8
  systemUiContext.setTheme(DEFAULT_SYSTEM_THEME);
9
}

该方法主要是创建系统进程上下文，具体细节暂不深入分析，先走完主流程，后面单独详细分析。

LocalServices#

1
public final class LocalServices {
2
  private LocalServices() {}
3

4
  private static final ArrayMap<Class<?>, Object> sLocalServiceObjects =
5
    new ArrayMap<Class<?>, Object>();
6

7
  @SuppressWarnings("unchecked")
8
  public static <T> T getService(Class<T> type) {
9
    synchronized (sLocalServiceObjects) {
10
      return (T) sLocalServiceObjects.get(type);
11
    }
12
  }
13

14
  public static <T> void addService(Class<T> type, T service) {
15
    synchronized (sLocalServiceObjects) {
16
      if (sLocalServiceObjects.containsKey(type)) {
17
        throw new IllegalStateException("Overriding service registration");
18
      }
19
      sLocalServiceObjects.put(type, service);
20
    }
21
  }
22

23
  @VisibleForTesting
24
  public static <T> void removeServiceForTest(Class<T> type) {
25
    synchronized (sLocalServiceObjects) {
26
      sLocalServiceObjects.remove(type);
27
    }
28
  }
29
}

可以看到 LocalServices 就是一个静态的 ArrayMap。

startBootstrapServices()#

1
private void startBootstrapServices() {
2
  final String TAG_SYSTEM_CONFIG = "ReadingSystemConfig";
3
  SystemServerInitThreadPool.get().submit(SystemConfig::getInstance,
4
                                          TAG_SYSTEM_CONFIG);
5
  // 阻塞等待与 installd 建立 socket 通道
6
  Installer installer =
7
    mSystemServiceManager.startService(Installer.class);
8

9
  mSystemServiceManager.startService(DeviceIdentifiersPolicyService
10
                                     .class);
11
  // 启动服务 ActivityManagerService
12
  mActivityManagerService = mSystemServiceManager.startService(
13
    ActivityManagerService.Lifecycle.class).getService();
14
  mActivityManagerService.setSystemServiceManager(
15
    mSystemServiceManager);
16
  mActivityManagerService.setInstaller(installer);
17

18
  // 启动服务 PowerManagerService
19
  mPowerManagerService = mSystemServiceManager.startService(
20
    PowerManagerService.class);
21

22
  // 初始化 power management
23
  mActivityManagerService.initPowerManagement();
24

25
  // Bring up recovery system in case a rescue party needs a reboot
26
  if (!SystemProperties.getBoolean("config.disable_noncore", false)) {
27
    mSystemServiceManager.startService(RecoverySystemService.class);
28
  }
29

30
  RescueParty.noteBoot(mSystemContext);
31

32
  // 启动服务 LightsService
33
  mSystemServiceManager.startService(LightsService.class);
34

35
  // 启动服务 DisplayManagerService
36
  mDisplayManagerService = mSystemServiceManager.startService(DisplayManagerService.class);
37

38
  // Phase 100: 在初始化 package manager 之前，需要默认的显示
39
  mSystemServiceManager.startBootPhase(
40
    SystemService.PHASE_WAIT_FOR_DEFAULT_DISPLAY);
41

42
  // 当设备正在加密时，仅运行核心
43
  String cryptState = SystemProperties.get("vold.decrypt");
44
  if (ENCRYPTING_STATE.equals(cryptState)) {
45
  } else if (ENCRYPTED_STATE.equals(cryptState)) {
46
    mOnlyCore = true;
47
  }
48

49
  // 启动服务 PackageManagerService
50
  if (!mRuntimeRestart) {
51
    MetricsLogger.histogram(null, "boot_package_manager_init_start",
52
                            (int) SystemClock.elapsedRealtime());
53
  }
54
  mPackageManagerService = PackageManagerService.main(mSystemContext,
55
           installer, mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF,
56
                                                      mOnlyCore);
57
  mFirstBoot = mPackageManagerService.isFirstBoot();
58
  mPackageManager = mSystemContext.getPackageManager();
59
  if (!mRuntimeRestart && !isFirstBootOrUpgrade()) {
60
    MetricsLogger.histogram(null, "boot_package_manager_init_ready",
61
                            (int) SystemClock.elapsedRealtime());
62
  }
63

64
  if (!mOnlyCore) {
65
    boolean disableOtaDexopt = SystemProperties
66
      .getBoolean("config.disable_otadexopt", false);
67
    if (!disableOtaDexopt) {
68
      OtaDexoptService.main(mSystemContext, mPackageManagerService);
69
    }
70
  }
71

72
  // 启动服务 UserManagerService，新建目录 /data/user/
73
  mSystemServiceManager.startService(UserManagerService
74
                                     .LifeCycle.class);
75

76
  AttributeCache.init(mSystemContext);
77

78
  // 设置 ActivityManagerService
79
  mActivityManagerService.setSystemProcess();
80

81
  mDisplayManagerService.setupSchedulerPolicies();
82

83
  // Manages Overlay packages
84
  mSystemServiceManager.startService(
85
    new OverlayManagerService(mSystemContext, installer));
86

87
  // 启动传感器服务
88
  mSensorServiceStart = SystemServerInitThreadPool.get().submit(() -> {
89
    BootTimingsTraceLog traceLog = new BootTimingsTraceLog(
90
      SYSTEM_SERVER_TIMING_ASYNC_TAG, Trace.TRACE_TAG_SYSTEM_SERVER);
91
    startSensorService();
92
  }, START_SENSOR_SERVICE);
93
}

可以看到该方法创建了 ActivityManagerService、PowerManagerService、LightsService、DisplayManagerService、PackageManagerService、UserManagerService、SensorService 这些服务。

startCoreServices()#

1
private void startCoreServices() {
2
  // 启动服务 DropBoxManagerService，用于记录错误日志
3
  mSystemServiceManager.startService(DropBoxManagerService.class);
4

5
  // 启动服务 BatteryService，用于统计电池电量，需要 LightService.
6
  mSystemServiceManager.startService(BatteryService.class);
7

8
  // 启动服务 UsageStatsService，用于统计应用使用情况
9
  mSystemServiceManager.startService(UsageStatsService.class);
10
  mActivityManagerService.setUsageStatsManager(
11
    LocalServices.getService(UsageStatsManagerInternal.class));
12

13
  // 启动服务 WebViewUpdateService
14
  mWebViewUpdateService = mSystemServiceManager
15
    .startService(WebViewUpdateService.class);
16
}

可以看到该方法创建了 DropBoxManagerService、BatteryService、UsageStatsService、WebViewUpdateService 这些服务。

startOtherServices()#

1
private void startOtherServices() {
2
  final Context context = mSystemContext;
3
  // ...
4
  try {
5
    // ...
6
    telephonyRegistry = new TelephonyRegistry(context);
7
    ServiceManager.addService("telephony.registry", telephonyRegistry);
8
    // ...
9
    mContentResolver = context.getContentResolver();
10

11
    if (!disableCameraService) {
12
      mSystemServiceManager.startService(CameraServiceProxy.class);
13
    }
14
    // ...
15
    // 启动服务 InputManagerService
16
    mSystemServiceManager.startService(AlarmManagerService.class);
17
    // 启动 Watchdog
18
    final Watchdog watchdog = Watchdog.getInstance();
19
    watchdog.init(context, mActivityManagerService);
20
    // 创建服务 InputManagerService
21
    inputManager = new InputManagerService(context);
22

23
    // WMS needs sensor service ready
24
    ConcurrentUtils.waitForFutureNoInterrupt(mSensorServiceStart,
25
                                             START_SENSOR_SERVICE);
26
    mSensorServiceStart = null;
27
    // 启动服务 WindowManagerService
28
    wm = WindowManagerService.main(context, inputManager,
29
             mFactoryTestMode != FactoryTest.FACTORY_TEST_LOW_LEVEL,
30
             !mFirstBoot, mOnlyCore, new PhoneWindowManager());
31
    ServiceManager.addService(Context.WINDOW_SERVICE, wm);
32
    ServiceManager.addService(Context.INPUT_SERVICE, inputManager);
33
    // ...
34
    mActivityManagerService.setWindowManager(wm);
35
    // 启动服务 InputManagerService
36
    inputManager.setWindowManagerCallbacks(wm.getInputMonitor());
37
    inputManager.start();
38

39
    mDisplayManagerService.windowManagerAndInputReady();
40

41
    if (isEmulator) {
42
      // ...
43
    } else { // 非模拟器，启动服务 BluetoothService
44
      mSystemServiceManager.startService(BluetoothService.class);
45
    }
46
    // ...
47
  } catch (RuntimeException e) {
48
  }
49
  // ...
50
  // Bring up services needed for UI.
51
  if (mFactoryTestMode != FactoryTest.FACTORY_TEST_LOW_LEVEL) {
52
    mSystemServiceManager.startService(InputMethodManagerService
53
                                       .Lifecycle.class);
54
    ServiceManager.addService(Context.ACCESSIBILITY_SERVICE,
55
                              new AccessibilityManagerService(context));
56
  }
57
  wm.displayReady();
58
  // ...
59
  if (mFactoryTestMode != FactoryTest.FACTORY_TEST_LOW_LEVEL) {
60
    // ...
61
    if (!disableSystemUI) {
62
      // 创建服务 StatusBarManagerService
63
      statusBar = new StatusBarManagerService(context, wm);
64
      ServiceManager.addService(Context.STATUS_BAR_SERVICE,
65
                                  statusBar);
66
    }
67
    // 启动服务 JobSchedulerService
68
    mSystemServiceManager.startService(JobSchedulerService.class);
69
    // ...
70
    if (!disableNonCoreServices) {
71
      // 启动服务 DreamManagerService
72
      mSystemServiceManager.startService(DreamManagerService.class);
73
    }
74
    // ...
75
    mSystemServiceManager.startService(LauncherAppsService.class);
76
  }
77
  // ...
78
  // phase 480
79
  mSystemServiceManager.startBootPhase(SystemService
80
                                       .PHASE_LOCK_SETTINGS_READY);
81
  // phase 500
82
  mSystemServiceManager.startBootPhase(SystemService
83
                                       .PHASE_SYSTEM_SERVICES_READY);
84

85
  // 准备好 window、power、package、display 服务
86
  wm.systemReady();
87
  // ...
88
  mPowerManagerService.systemReady(mActivityManagerService
89
                                     .getAppOpsService());
90
  mPackageManagerService.systemReady();
91
  mDisplayManagerService.systemReady(safeMode, mOnlyCore);
92
  // ...
93
  mActivityManagerService.systemReady(() -> {
94
    // phase 550
95
    mSystemServiceManager.startBootPhase(SystemService
96
                                         .PHASE_ACTIVITY_MANAGER_READY);
97
    // ...
98
    // phase 600
99
    mSystemServiceManager.startBootPhase(
100
                    SystemService.PHASE_THIRD_PARTY_APPS_CAN_START);
101
  }, BOOT_TIMINGS_TRACE_LOG);
102
}

SystemServer 启动各种服务中最后的一个环节便是 AMS.systemReady()。到此，System_server 主线程的启动工作总算完成，进入 Looper.loop() 状态，等待其他线程通过 handler 发送消息到主线再处理。

服务启动阶段#

1
public static final int PHASE_WAIT_FOR_DEFAULT_DISPLAY = 100;
2
public static final int PHASE_LOCK_SETTINGS_READY = 480;
3
public static final int PHASE_SYSTEM_SERVICES_READY = 500;
4
public static final int PHASE_ACTIVITY_MANAGER_READY = 550;
5
public static final int PHASE_THIRD_PARTY_APPS_CAN_START = 600;
6
public static final int PHASE_BOOT_COMPLETED = 1000;

在 startBootstrapServices() 方法中创建了四大引导服务：

ActivityManagerService
PowerManagerService
LightsService
DisplayManagerService

接着进入阶段 PHASE_WAIT_FOR_DEFAULT_DISPLAY = 100 回调服务。

1
private void startBootstrapServices() {
2
  // ...
3
  // 启动服务 ActivityManagerService
4
  mActivityManagerService = mSystemServiceManager.startService(
5
    ActivityManagerService.Lifecycle.class).getService();
6
  // ...
7
  // 启动服务 PowerManagerService
8
  mPowerManagerService = mSystemServiceManager.startService(
9
    PowerManagerService.class);
10
  // ...
11
  // 启动服务 LightsService
12
  mSystemServiceManager.startService(LightsService.class);
13

14
  // 启动服务 DisplayManagerService
15
  mDisplayManagerService = mSystemServiceManager.startService(DisplayManagerService.class);
16

17
  // Phase 100: 在初始化 package manager 之前，需要默认的显示
18
  mSystemServiceManager.startBootPhase(
19
    SystemService.PHASE_WAIT_FOR_DEFAULT_DISPLAY);
20
  // ...
21
}

Phase 100#

1
public void startBootPhase(final int phase) {
2
  if (phase <= mCurrentPhase) {
3
    throw new IllegalArgumentException("Next phase must be larger than previous");
4
  }
5
  mCurrentPhase = phase;
6

7
  try {
8
    final int serviceLen = mServices.size();
9
    for (int i = 0; i < serviceLen; i++) {
10
      final SystemService service = mServices.get(i);
11
      // ...
12
      try {
13
        service.onBootPhase(mCurrentPhase);
14
      } catch (Exception ex) {
15
        // ...
16
      }
17
    }
18
  } finally {
19
    // ...
20
  }
21
}

可以看到这里遍历了一下服务列表，然后回调到各服务的 onBootPhase() 方法中了。这里不再继续分析，等详细分析具体服务时再详细分析。然后继续创建服务：

1
private void startBootstrapServices() {
2
  // ...
3
  // Phase 100: 在初始化 package manager 之前，需要默认的显示
4
  mSystemServiceManager.startBootPhase(
5
    SystemService.PHASE_WAIT_FOR_DEFAULT_DISPLAY);
6
  // ...
7
  // 启动服务 PackageManagerService
8
  mPackageManagerService = PackageManagerService.main(mSystemContext,
9
           installer, mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF,
10
                                                      mOnlyCore);
11
   // ...
12
  // 启动服务 UserManagerService，新建目录 /data/user/
13
  mSystemServiceManager.startService(UserManagerService
14
                                     .LifeCycle.class);
15
  // 设置 ActivityManagerService
16
  mActivityManagerService.setSystemProcess();
17
  // ...
18
  // Manages Overlay packages
19
  mSystemServiceManager.startService(
20
    new OverlayManagerService(mSystemContext, installer));
21
  // 启动传感器服务
22
  mSensorServiceStart = SystemServerInitThreadPool.get().submit(() -> {
23
    BootTimingsTraceLog traceLog = new BootTimingsTraceLog(
24
      SYSTEM_SERVER_TIMING_ASYNC_TAG, Trace.TRACE_TAG_SYSTEM_SERVER);
25
    startSensorService();
26
  }, START_SENSOR_SERVICE);
27
}

继续执行到 startOtherServices() 方法中创建服务：

1
private void startOtherServices() {
2
  try {
3
    // ...
4
    // 启动服务 InputManagerService
5
    mSystemServiceManager.startService(AlarmManagerService.class);
6
    // 启动 Watchdog
7
    final Watchdog watchdog = Watchdog.getInstance();
8
    watchdog.init(context, mActivityManagerService);
9
    // 创建服务 InputManagerService
10
    inputManager = new InputManagerService(context);
11
    // 启动服务 WindowManagerService
12
    wm = WindowManagerService.main(context, inputManager,
13
             mFactoryTestMode != FactoryTest.FACTORY_TEST_LOW_LEVEL,
14
             !mFirstBoot, mOnlyCore, new PhoneWindowManager());
15
    // ...
16
    mActivityManagerService.setWindowManager(wm);
17
    // 启动服务 InputManagerService
18
    inputManager.setWindowManagerCallbacks(wm.getInputMonitor());
19
    inputManager.start();
20

21
    mDisplayManagerService.windowManagerAndInputReady();
22
    // ...
23
  } catch (RuntimeException e) {
24
  }
25
  wm.displayReady();
26
  // ...
27
  if (mFactoryTestMode != FactoryTest.FACTORY_TEST_LOW_LEVEL) {
28
    // ...
29
    if (!disableSystemUI) {
30
      // 创建服务 StatusBarManagerService
31
      statusBar = new StatusBarManagerService(context, wm);
32
      ServiceManager.addService(Context.STATUS_BAR_SERVICE,
33
                                  statusBar);
34
    }
35
    // 启动服务 JobSchedulerService
36
    mSystemServiceManager.startService(JobSchedulerService.class);
37
    // ...
38
    if (!disableNonCoreServices) {
39
      // 启动服务 DreamManagerService
40
      mSystemServiceManager.startService(DreamManagerService.class);
41
    }
42
    // ...
43
    mSystemServiceManager.startService(LauncherAppsService.class);
44
  }
45
  // ...
46
  // phase 480
47
  mSystemServiceManager.startBootPhase(SystemService
48
                                       .PHASE_LOCK_SETTINGS_READY);
49
  // ...
50
}

Phase 480#

进入 480 阶段后马上进入了 500 阶段。

1
private void startOtherServices() {
2
  // ...
3
  // phase 480
4
  mSystemServiceManager.startBootPhase(SystemService
5
                                       .PHASE_LOCK_SETTINGS_READY);
6
  // phase 500
7
  mSystemServiceManager.startBootPhase(SystemService
8
                                       .PHASE_SYSTEM_SERVICES_READY);
9
  // ...
10
}

Phase 500#

进入此启动阶段后，服务可以安全地调用核心系统服务了，如 PowerManage r或 PackageManager。各大服务执行 systemReady()：

1
private void startOtherServices() {
2
  // ...
3
  // phase 500
4
  mSystemServiceManager.startBootPhase(SystemService
5
                                       .PHASE_SYSTEM_SERVICES_READY);
6

7
  // 准备好 window、power、package、display 服务
8
  wm.systemReady();
9
  // ...
10
  mPowerManagerService.systemReady(mActivityManagerService
11
                                     .getAppOpsService());
12
  mPackageManagerService.systemReady();
13
  mDisplayManagerService.systemReady(safeMode, mOnlyCore);
14
  // ...
15
  mActivityManagerService.systemReady(() -> {
16
    // phase 550
17
    mSystemServiceManager.startBootPhase(SystemService
18
                                         .PHASE_ACTIVITY_MANAGER_READY);
19
    // ...
20
    // phase 600
21
    mSystemServiceManager.startBootPhase(
22
                    SystemService.PHASE_THIRD_PARTY_APPS_CAN_START);
23
  }, BOOT_TIMINGS_TRACE_LOG);
24
}

最后是 AMS.systemReady() 方法。

Phase 550#

进入此启动阶段后，服务可以发送广播 Intents 了，但是 system_server 主线程并没有就绪。

Phase 600#

进入此启动阶段后，服务可以启动/绑定到第三方应用程序。此时，应用程序可以使用 Binder 服务了。

Phase 1000#

在经过一系列流程，再调用 AMS.finishBooting() 时，则进入 Phase 1000阶段。到此，系统服务启动阶段完成就绪，system_server 进程启动完成则进入 Looper.loop() 状态，随时待命，等待消息队列 MessageQueue 中的消息到来，则马上进入执行状态。 systemReady() 函数调用完成之后，桌面就可见了，用户就真正见到了 Android 系统的可操作界面。

介绍#