Android SystemServer创建和启动方式(基于Android13)

SystemServer 简介

Android System Server是Android框架的核心组件，运行在system_server进程中，拥有system权限。它在Android系统中扮演重要角色，提供服务管理和通信。

system          548    415 1 06:23:21 ?     00:11:21 system_server

SystemServer在Android系统中的位置如下

SystemServer服务提供者serviceManager

SystemServer利用ServiceManager来提供服务，类似于keystore，ServiceManager是一个native service，负责SystemServer中的service管理。SystemServer通过binder和ServiceManager进行通信。

ServiceManager由servicemanager.rc启动，并且相关实现在ServiceManager提供的aidl接口中。

//frameworks/native/cmds/servicemanager/
service servicemanager /system/bin/servicemanagerclass core animationuser systemgroup system readproccriticalonrestart restart healthdonrestart restart zygoteonrestart restart audioserveronrestart restart mediaonrestart restart surfaceflingeronrestart restart inputflingeronrestart restart drmonrestart restart cameraserveronrestart restart keystoreonrestart restart gatekeeperdonrestart restart thermalservicewritepid /dev/cpuset/system-background/tasksshutdown critical

这些接口位于frameworks/native/libs/binder/aidl/android/os/IServiceManager.aidl，主要包括addService、getService、checkService以及一些权限的检查。

//frameworks/native/libs/binder/aidl/android/os/IServiceManager.aidl
interface IServiceManager {/** Must update values in IServiceManager.h*//* Allows services to dump sections according to priorities. */const int DUMP_FLAG_PRIORITY_CRITICAL = 1 << 0;const int DUMP_FLAG_PRIORITY_HIGH = 1 << 1;const int DUMP_FLAG_PRIORITY_NORMAL = 1 << 2;/*** Services are by default registered with a DEFAULT dump priority. DEFAULT priority has the* same priority as NORMAL priority but the services are not called with dump priority* arguments.*/const int DUMP_FLAG_PRIORITY_DEFAULT = 1 << 3;const int DUMP_FLAG_PRIORITY_ALL = 15;// DUMP_FLAG_PRIORITY_CRITICAL | DUMP_FLAG_PRIORITY_HIGH// | DUMP_FLAG_PRIORITY_NORMAL | DUMP_FLAG_PRIORITY_DEFAULT;/* Allows services to dump sections in protobuf format. */const int DUMP_FLAG_PROTO = 1 << 4;/*** Retrieve an existing service called @a name from the* service manager.** This is the same as checkService (returns immediately) but* exists for legacy purposes.** Returns null if the service does not exist.*/@UnsupportedAppUsage@nullable IBinder getService(@utf8InCpp String name);/*** Retrieve an existing service called @a name from the service* manager. Non-blocking. Returns null if the service does not* exist.*/@UnsupportedAppUsage@nullable IBinder checkService(@utf8InCpp String name);/*** Place a new @a service called @a name into the service* manager.*/void addService(@utf8InCpp String name, IBinder service,boolean allowIsolated, int dumpPriority);/*** Return a list of all currently running services.*/@utf8InCpp String[] listServices(int dumpPriority);/*** Request a callback when a service is registered.*/void registerForNotifications(@utf8InCpp String name, IServiceCallback callback);/*** Unregisters all requests for notifications for a specific callback.*/void unregisterForNotifications(@utf8InCpp String name, IServiceCallback callback);/*** Returns whether a given interface is declared on the device, even if it* is not started yet. For instance, this could be a service declared in the VINTF* manifest.*/boolean isDeclared(@utf8InCpp String name);/*** Request a callback when the number of clients of the service changes.* Used by LazyServiceRegistrar to dynamically stop services that have no clients.*/void registerClientCallback(@utf8InCpp String name, IBinder service, IClientCallback callback);/*** Attempt to unregister and remove a service. Will fail if the service is still in use.*/void tryUnregisterService(@utf8InCpp String name, IBinder service);
}

在servicemanager启动后，它会注册一个特殊的service，服务名叫做"manager"，可以通过dumpsys -l命令找到名为"manager"的服务。

//frameworks/native/cmds/servicemanager/main.cppsp<ServiceManager> manager = new ServiceManager(std::make_unique<Access>());if (!manager->addService("manager", manager, false /*allowIsolated*/, IServiceManager::DUMP_FLAG_PRIORITY_DEFAULT).isOk()) {LOG(ERROR) << "Could not self register servicemanager";}

原生框架创建Service的几种方式

方式1 ServiceManager.addService

ServiceManager.addService是最早的一种service创建方式，函数原型为

    public static void addService(String name, IBinder service) {addService(name, service, false, IServiceManager.DUMP_FLAG_PRIORITY_DEFAULT);}

在早期的Android版本中，ServiceManager.addService是最早的一种创建service的方式。它的函数原型为ServiceManager.addService，由于存在于早期版本，因此使用起来没有太多限制，甚至在android_app中也可以使用。

方式2 SystemServiceManager.startService

SystemServiceManager.startService有多个override方法，接口定义如下：

    public void startService(@NonNull final SystemService service) {// Register it.mServices.add(service);// Start it.long time = SystemClock.elapsedRealtime();try {service.onStart();} catch (RuntimeException ex) {throw new RuntimeException("Failed to start service " + service.getClass().getName()+ ": onStart threw an exception", ex);}warnIfTooLong(SystemClock.elapsedRealtime() - time, service, "onStart");}

SystemService类位于frameworks/base/services/core/java/com/android/server/SystemService.java，最后打包到service.jar中。然而，由于SystemService添加了注解，直接依赖services.jar无法访问该类。

我们可以通过两种方式来使用SystemService：

• 在frameworks/base/services内部源码中，可以直接访问SystemService。
• 在Android.bp中将模块声明为sdk_version: "system_server_current"，也可以使用SystemService。

另外，还可以通过依赖静态库services.core来访问SystemService，例如Apex service就是使用这种方式。