Android Phone进程启动过程分析

Phone进程 Telephony

字数统计: 2.9k阅读时长: 15 min

 2017/02/21

之前解决一个开机搜网慢的问题时，发现由于Phone进程起来以后才会主动连接RILD,因而在一定程度上Phone进程启动的时间会影响网络状态注册的快慢。适当的将Phone进程提前，可以将网络注册时间提前一点，让状态栏中信号显示的时间提前。那么，Android中作为系统的核心进程之一，Phone进程是如何启动的了？

本文参考代码为Android NN7.0, RIL运行机制请参考: Android RIL概述

Telephony最开始创建的是PhoneFactory对象，直接搜索源码，可以看到在PhoneGlobals.java创建时，会调用PhoneFactory对Telephony进行初始化操作:


/**
 * Global state for the telephony subsystem when running in the primary
 * phone process.
 */
public class PhoneGlobals extends ContextWrapper {

    public void onCreate() {
        Log.v(LOG_TAG, "!@Boot_SVC : PhoneApp OnCrate");
        // CallManager为空
        if (mCM == null) {
            // Initialize the telephony framework
            PhoneFactory.makeDefaultPhones(this);
            // 创建CallManager实例
            mCM = CallManager.getInstance();
            for (Phone phone : PhoneFactory.getPhones()) {
                mCM.registerPhone(phone);
            }
            ....
        }

}

那么，PhoneGlobals又是在哪里创建的了？再次搜索代码，可以看到在同一文件目录下，有一个PhoneApp.java文件:


@Override
 public void onCreate() {
     Log.d("PhoneApp", "onCreate");
    
     if (UserHandle.myUserId() == 0) {
         // 创建PhoneGlobals实例
         mPhoneGlobals = new PhoneGlobals(this);
         mPhoneGlobals.onCreate();
    
         mTelephonyGlobals = new TelephonyGlobals(this);
         mTelephonyGlobals.onCreate();
     } else {
         Log.d("PhoneApp", "Phone app is created as userid not 0, there's no PhoneApp() Instance");
     }
     ....
 }

那么，PhoneApp这个类又是什么时候创建的？我们知道，每一个Android应用都有一个Application与之对应，它是在应用启动过程中创建的，但是在这里搜索所有的源码，也无法看到PhoneApp创建的地方。联想到应用的启动过程，APP的启动的入口是ActivityThread,那么对于任何PhoneApp这样的系统应用来说，启动的入口也应该是ActivityThread。不妨继续看看代码。

打开Phone进程所在的源码路径: /android/applications/sources/services/Telephony/,查看应用对应的AndroidManefest.xml文件:


<manifest xmlns:android="http://schemas.android.com/apk/res/android"
        xmlns:androidprv="http://schemas.android.com/apk/prv/res/android"
        package="com.android.phone"
        android:versionCode="1"
        android:versionName="1.0.0"
        coreApp="true"
        android:sharedUserId="android.uid.phone"
        android:sharedUserLabel="@string/phoneAppLabel" >
        .....
    <application android:name="PhoneApp"
        android:persistent="true"
        android:hardwareAccelerated="true"
        android:label="@string/phoneAppLabel"
        android:icon="@mipmap/ic_launcher_phone"
        android:allowBackup="false"
        android:supportsRtl="true"
        android:usesCleartextTraffic="true"
        android:defaultToDeviceProtectedStorage="true"
        android:directBootAware="true">
        ....
    </application>
</manifest>

在application标签下面，可以看到android:persistent="true"这个属性值，看一看官方的文档怎么解释的：

android:persistent

Whether or not the application should remain running at all times — “true” if it should, and “false” if not. The default value is “false”. Applications should not normally set this flag; persistence mode is intended only for certain system applications.

由此可见，Phone应用是系统常驻进程，一旦起来后就会一直运行，不会被杀死（除非Phone进程自己发生了的运行时错误而崩溃）。对于这类常驻进程，ActivityManagerService(以下简称AMS)会在初始化完成后，主动启动。在SystemServer初始化完系统的核心服务后，会调用AMS的systemReady(Runnable r)函数。

ActivityManagerService.java


public void systemReady(final Runnable goingCallback) {

    synchronized (this) {
    
             // Only start up encryption-aware persistent apps; once user is
            // unlocked we'll come back around and start unaware apps
            // 正是在这里，phone进程被创建
            startPersistentApps(PackageManager.MATCH_DIRECT_BOOT_AWARE);
    
            // Start up initial activity.
            mBooting = true;
            // Enable home activity for system user, so that the system can always boot
            if (UserManager.isSplitSystemUser()) {
                ComponentName cName = new ComponentName(mContext, SystemUserHomeActivity.class);
                try {
                    AppGlobals.getPackageManager().setComponentEnabledSetting(cName,
                            PackageManager.COMPONENT_ENABLED_STATE_ENABLED, 0,
                            UserHandle.USER_SYSTEM);
                } catch (RemoteException e) {
                    throw e.rethrowAsRuntimeException();
                }
            }
            startHomeActivityLocked(currentUserId, "systemReady");
    
    }

}

启动所有PackageManager.MATCH_DIRECT_BOOT_AWARE标志为true的应用:


private void startPersistentApps(int matchFlags) {

    synchronized (this) {
        try {
            //获取系统所有常驻应用程序信息
            final List<ApplicationInfo> apps = AppGlobals.getPackageManager()
                    .getPersistentApplications(STOCK_PM_FLAGS | matchFlags).getList();
            for (ApplicationInfo app : apps) {
                if (!"android".equals(app.packageName)) {
                    //加载应用
                    addAppLocked(app, false, null /* ABI override */);
                }
            }
        } catch (RemoteException ex) {
        }
    }
}

//添加应用程序进程到LRU列表中，并创建进程
final ProcessRecord addAppLocked(ApplicationInfo info, boolean isolated,
        String abiOverride) {
    ProcessRecord app;
    if (!isolated) {
        app = getProcessRecordLocked(info.processName, info.uid, true);
    } else {
        app = null;
    }

    // 没有进程记录，因此创建一个进程记录
    if (app == null) {
        app = newProcessRecordLocked(info, null, isolated, 0);
        updateLruProcessLocked(app, false, null);
        updateOomAdjLocked();
    }
    ....

    if ((info.flags & PERSISTENT_MASK) == PERSISTENT_MASK) {
        app.persistent = true;
        app.maxAdj = ProcessList.PERSISTENT_PROC_ADJ;
    }
    
    // Start the process.  It will either succeed and return a result containing
    // the PID of the new process, or else throw a RuntimeException.
    boolean isActivityProcess = (entryPoint == null);
    // 进程入口为ActivityThread
    if (entryPoint == null) entryPoint = "android.app.ActivityThread";        

    //启动应用进程
    if (app.thread == null && mPersistentStartingProcesses.indexOf(app) < 0) {
        mPersistentStartingProcesses.add(app);
        startProcessLocked(app, "added application", app.processName, abiOverride,
                null /* entryPoint */, null /* entryPointArgs */);
    }

    return app;
}

准备创建应用进程:


private final void startProcessLocked(ProcessRecord app, String hostingType,
        String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs) {

        Process.ProcessStartResult startResult = null;
        ....

        startResult = Process.start(entryPoint,
        app.processName, uid, uid, gids, debugFlags, mountExternal,
        app.info.targetSdkVersion, aasaSeInfo != null ? new String(aasaSeInfo) : app.info.seinfo, //AASA--4 : changed orginal : only "app.info.seinfo"
        app.info.category, app.info.accessInfo,
        requiredAbi, instructionSet,
        app.info.dataDir, mountKnoxPoint, entryPointArgs);

        ....
}

Process.java

调用Process.start()，创建一个新的进程, Telephony服务以及RIL相关代码都运行在此进程中：


public static final ProcessStartResult start(final String processClass,
                              final String niceName,
                              int uid, int gid, int[] gids,
                              int debugFlags, int mountExternal,
                              int targetSdkVersion,
                              String seInfo,
                              int category,
                              int accessInfo,
                              String abi,
                              String instructionSet,
                              String appDataDir,
                              boolean mountKnoxPoint,
                              String[] zygoteArgs) {
    try {
        return startViaZygote(processClass, niceName, uid, gid, gids,
                debugFlags, mountExternal, targetSdkVersion, seInfo, category, accessInfo,
                abi, instructionSet, appDataDir, mountKnoxPoint, zygoteArgs);
    } catch (ZygoteStartFailedEx ex) {
        Log.e(LOG_TAG,
                "Starting VM process through Zygote failed");
        throw new RuntimeException(
                "Starting VM process through Zygote failed", ex);
    }
}

发送消息到zygote服务进程的socket端口，请求创建新的进程:


private static ProcessStartResult startViaZygote(final String processClass,
                                 final String niceName,
                                 final int uid, final int gid,
                                 final int[] gids,
                                 int debugFlags, int mountExternal,
                                 int targetSdkVersion,
                                 String seInfo,
                                 int category,
                                 int accessInfo,
                                 String abi,
                                 String instructionSet,
                                 String appDataDir,
                                 boolean mountKnoxPoint,
                                 String[] extraArgs)
                                 throws ZygoteStartFailedEx {
       synchronized(Process.class) {
           ArrayList<String> argsForZygote = new ArrayList<String>();

           // --runtime-args, --setuid=, --setgid=,
           // and --setgroups= must go first
           argsForZygote.add("--runtime-args");
           argsForZygote.add("--setuid=" + uid);
           argsForZygote.add("--setgid=" + gid);
           ....
           if (appDataDir != null) {
               argsForZygote.add("--app-data-dir=" + appDataDir);
           }
           ....
           argsForZygote.add(processClass);

           if (extraArgs != null) {
               for (String arg : extraArgs) {
                   argsForZygote.add(arg);
               }
           }

           //发送消息到zygote的socket端口，请求创建新的进程
           if (Zygote.isEnhancedZygoteASLREnabled) {
               ....
               return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), argsForZygote);
               // End of isEnhancedZygoteASLREnabled case
           } else {
               // Original case
               return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), argsForZygote);
           }
       }
   }

ZygoteConnection.java

zygote进程接收到AMS的请求后，由ZygoteConnection负责处理请求：


boolean runOnce() throws ZygoteInit.MethodAndArgsCaller {

    String args[];
    Arguments parsedArgs = null;
    FileDescriptor[] descriptors;

    try {
        // 从socket中读取参数
        args = readArgumentList();
        descriptors = mSocket.getAncillaryFileDescriptors();
    } catch (IOException ex) {
        Log.w(TAG, "IOException on command socket " + ex.getMessage());
        closeSocket();
        return true;
    }

    if (args == null) {
        // EOF reached.
        closeSocket();
        return true;
    }

    int pid = -1;
    FileDescriptor childPipeFd = null;
    FileDescriptor serverPipeFd = null;
    ...
    try {
        parsedArgs = new Arguments(args);
        //Zygote调用本地方法创建进程
        pid = Zygote.forkAndSpecialize(parsedArgs.uid, parsedArgs.gid, parsedArgs.gids,
                parsedArgs.debugFlags, rlimits, parsedArgs.mountExternal, parsedArgs.seInfo, parsedArgs.category, parsedArgs.accessInfo,
                parsedArgs.niceName, fdsToClose, parsedArgs.instructionSet,
                parsedArgs.appDataDir, parsedArgs.mountKnoxPoint);
    } catch (ErrnoException ex) {
        logAndPrintError(newStderr, "Exception creating pipe", ex);
    } catch (IllegalArgumentException ex) {
        logAndPrintError(newStderr, "Invalid zygote arguments", ex);
    } catch (ZygoteSecurityException ex) {
        logAndPrintError(newStderr,
                "Zygote security policy prevents request: ", ex);
    }

    try {
        if (pid == 0) {
            // in child
            IoUtils.closeQuietly(serverPipeFd);
            serverPipeFd = null;
            handleChildProc(parsedArgs, descriptors, childPipeFd, newStderr);

            // should never get here, the child is expected to either
            // throw ZygoteInit.MethodAndArgsCaller or exec().
            return true;
        } else {
            // in parent...pid of < 0 means failure
            IoUtils.closeQuietly(childPipeFd);
            childPipeFd = null;
            return handleParentProc(pid, descriptors, serverPipeFd, parsedArgs);
        }
    } finally {
        IoUtils.closeQuietly(childPipeFd);
        IoUtils.closeQuietly(serverPipeFd);
    }
}

ZygoteInit.java

至此phone进程已经创建完成了，但实际上PhoneApp的代码还没有加载。继续看，在启动的进程里，调用ZygoteInit.zygoteInit来加载phoneApp的代码:


private void handleChildProc(Arguments parsedArgs,
            FileDescriptor[] descriptors, FileDescriptor pipeFd, PrintStream newStderr)
            throws Zygote.MethodAndArgsCaller {
        /**
         * By the time we get here, the native code has closed the two actual Zygote
         * socket connections, and substituted /dev/null in their place.  The LocalSocket
         * objects still need to be closed properly.
         */
        closeSocket();
        if (descriptors != null) {
            try {
                Os.dup2(descriptors[0], STDIN_FILENO);
                Os.dup2(descriptors[1], STDOUT_FILENO);
                Os.dup2(descriptors[2], STDERR_FILENO);

                for (FileDescriptor fd: descriptors) {
                    IoUtils.closeQuietly(fd);
                }
                newStderr = System.err;
            } catch (ErrnoException ex) {
                Log.e(TAG, "Error reopening stdio", ex);
            }
        }

        if (parsedArgs.niceName != null) {
            Process.setArgV0(parsedArgs.niceName);
        }

        // End of the postFork event.
        Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
        // 这里没有指定invokewith参数
        if (parsedArgs.invokeWith != null) {
            WrapperInit.execApplication(parsedArgs.invokeWith,
                    parsedArgs.niceName, parsedArgs.targetSdkVersion,
                    VMRuntime.getCurrentInstructionSet(),
                    pipeFd, parsedArgs.remainingArgs);
        } else {
            // 这里remaingArgs的第一参数是android.app.ActivityThread, 就是之前的entrypoint
            RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion,
                    parsedArgs.remainingArgs, null /* classLoader */);
        }
    }

RuntimeInit.java

通过RuntimeInit来加载phone APP的代码, zygoteInit函数主要做三件事：

做一些通用的初始化，比如设置虚拟机中线程的exception handler;设置默认时区；
完成VM本地的初始化操作；
加载APP代码，也就是调用ActivityThread.main函数来加载整个phone APP；


public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
        throws ZygoteInit.MethodAndArgsCaller {
    if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting application from zygote");

    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "RuntimeInit");
    redirectLogStreams();

    commonInit();
    nativeZygoteInit();
    // 初始化应用代码
    applicationInit(targetSdkVersion, argv, classLoader);
}

函数applicationInit通过方法invokeStaticMain反射调用ActivityThread.main:


protected static void applicationInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
            throws Zygote.MethodAndArgsCaller {
        // If the application calls System.exit(), terminate the process
        // immediately without running any shutdown hooks.  It is not possible to
        // shutdown an Android application gracefully.  Among other things, the
        // Android runtime shutdown hooks close the Binder driver, which can cause
        // leftover running threads to crash before the process actually exits.
        nativeSetExitWithoutCleanup(true);

        // We want to be fairly aggressive about heap utilization, to avoid
        // holding on to a lot of memory that isn't needed.
        VMRuntime.getRuntime().setTargetHeapUtilization(0.75f);
        VMRuntime.getRuntime().setTargetSdkVersion(targetSdkVersion);

        final Arguments args;
        try {
            args = new Arguments(argv);
        } catch (IllegalArgumentException ex) {
            Slog.e(TAG, ex.getMessage());
            // let the process exit
            return;
        }
        // Remaining arguments are passed to the start class's static main
        invokeStaticMain(args.startClass, args.startArgs, classLoader);
    }

invokeStaticMain通过抛出一个MethodAndArgsCaller的异常，被ZygoteInit.main方法捕获后，调用MethodAndArgsCaller.run，至此就调用了ActivityThread.main方法了，还真是有点绕。

| 有关zygote进程可以参考http://sniffer.site/2017/05/27/Zygote%E8%BF%9B%E7%A8%8B%E5%90%AF%E5%8A%A8%E8%BF%87%E7%A8%8B%E5%88%86%E6%9E%90/


private static void invokeStaticMain(String className, String[] argv, ClassLoader classLoader)
            throws Zygote.MethodAndArgsCaller {
        Class<?> cl;

        try {
            cl = Class.forName(className, true, classLoader);
        } catch (ClassNotFoundException ex) {
            throw new RuntimeException(
                    "Missing class when invoking static main " + className,
                    ex);
        }

        Method m;
        try {
            m = cl.getMethod("main", new Class[] { String[].class });
        } catch (NoSuchMethodException ex) {
            throw new RuntimeException(
                    "Missing static main on " + className, ex);
        } catch (SecurityException ex) {
            throw new RuntimeException(
                    "Problem getting static main on " + className, ex);
        }

        int modifiers = m.getModifiers();
        if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {
            throw new RuntimeException(
                    "Main method is not public and static on " + className);
        }

        /*
        * This throw gets caught in ZygoteInit.main(), which responds
        * by invoking the exception's run() method. This arrangement
        * clears up all the stack frames that were required in setting
        * up the process.
        */
        throw new Zygote.MethodAndArgsCaller(m, argv);
    }

MethodAndArgsCaller异常的作用是清除父进程中的一些调用堆栈，这样子进程就从ActivityThread.main开始了自己的堆栈调用。



    public static class MethodAndArgsCaller extends Exception
        implements Runnable {
        /** method to call */
        private final Method mMethod;

        /** argument array */
        private final String[] mArgs;

        public MethodAndArgsCaller(Method method, String[] args) {
            mMethod = method;
            mArgs = args;
        }

        public void run() {
            try {
                mMethod.invoke(null, new Object[] { mArgs });
            } catch (IllegalAccessException ex) {
                throw new RuntimeException(ex);
            } catch (InvocationTargetException ex) {
                Throwable cause = ex.getCause();
                if (cause instanceof RuntimeException) {
                    throw (RuntimeException) cause;
                } else if (cause instanceof Error) {
                    throw (Error) cause;
                }
                throw new RuntimeException(ex);
            }
        }
}

ActivityThread.java

到这里，ActivityThread.main会启动一个主线程，接着创建一个ActivityThread用于Phone APP与AMS进行交互。最重要的是，接着在thread.attach(false);这个函数里，ActivityThread会去创建Phone进程入口类PhoneApp。后续就是Phone整个框架代码的加载与初始化了。


public static void main(String[] args) {
    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ActivityThreadMain");
    SamplingProfilerIntegration.start();

    // CloseGuard defaults to true and can be quite spammy.  We
    // disable it here, but selectively enable it later (via
    // StrictMode) on debug builds, but using DropBox, not logs.
    CloseGuard.setEnabled(false);

    Environment.initForCurrentUser();

    // Set the reporter for event logging in libcore
    EventLogger.setReporter(new EventLoggingReporter());

    // Make sure TrustedCertificateStore looks in the right place for CA certificates
    final File configDir = Environment.getUserConfigDirectory(UserHandle.myUserId());
    TrustedCertificateStore.setDefaultUserDirectory(configDir);

    Process.setArgV0("<pre-initialized>");
    // 启动主线程Looper
    Looper.prepareMainLooper();

    ActivityThread thread = new ActivityThread();
    thread.attach(false);

    if (sMainThreadHandler == null) {
        sMainThreadHandler = thread.getHandler();
    }

    if (false) {
        Looper.myLooper().setMessageLogging(new
                LogPrinter(Log.DEBUG, "ActivityThread"));
    }

    // End of event ActivityThreadMain.
    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
    Looper.loop();

    throw new RuntimeException("Main thread loop unexpectedly exited");
}

这样Phone进程就创建启动完成了。整个流程看下来，研究Android系统，源码是王道，但要深入理解系统背后的设计，还是需要从把基本的概念梳理清楚，才能更好的理解系统背后设计的逻辑。

原文作者：Jason Wang

更新日期：2021-09-14, 14:04:20

Next Post

《Effective Java》摘记
Previous Post

Android Launcher工作原理

CATALOG

1. ActivityManagerService.java
2. Process.java
3. ZygoteConnection.java
4. ZygoteInit.java
5. RuntimeInit.java
6. ActivityThread.java