Android(安卓)Phone进程启动过程详解

之前解决一个开机搜网慢的问题时，发现由于Phone进程起来以后才会主动连接RILD,因而在一定程度上Phone进程启动的时间会影响网络状态注册的快慢。适当的将Phone进程提前，可以将网络注册时间提前一点，让状态栏中信号显示的时间提前。那么，Android中作为系统的核心进程之一，Phone进程是如何启动的了？

本文参考代码为Android NN7.0, RIL运行机制请参考: Android RIL概述

Telephony最开始创建的是PhoneFactory对象，直接搜索源码，可以看到在PhoneGlobals.java创建时，会调用PhoneFactory对Telephony进行初始化操作:

    /**     * Global state for the telephony subsystem when running in the primary     * phone process.     */    public class PhoneGlobals extends ContextWrapper {        public void onCreate() {            Log.v(LOG_TAG, "[email protected]_SVC : PhoneApp OnCrate");            // CallManager为空            if (mCM == null) {                // Initialize the telephony framework                PhoneFactory.makeDefaultPhones(this);                // 创建CallManager实例                mCM = CallManager.getInstance();                for (Phone phone : PhoneFactory.getPhones()) {                    mCM.registerPhone(phone);                }                ....            }    }

那么，PhoneGlobals又是在哪里创建的了？再次搜索代码，可以看到在同一文件目录下，有一个PhoneApp.java文件:

       @Override        public void onCreate() {            Log.d("PhoneApp", "onCreate");            if (UserHandle.myUserId() == 0) {                // 创建PhoneGlobals实例                mPhoneGlobals = new PhoneGlobals(this);                mPhoneGlobals.onCreate();                mTelephonyGlobals = new TelephonyGlobals(this);                mTelephonyGlobals.onCreate();            } else {                Log.d("PhoneApp", "Phone app is created as userid not 0, there's no PhoneApp() Instance");            }            ....        }

那么，PhoneApp这个类又是什么时候创建的？我们知道，每一个Android应用都有一个Application与之对应，它是在应用启动过程中创建的，但是在这里搜索所有的源码，也无法看到PhoneApp创建的地方。联想到应用的启动过程，APP的启动的入口是ActivityThread,那么对于任何PhoneApp这样的系统应用来说，启动的入口也应该是ActivityThread。不妨继续看看代码。

打开Phone进程所在的源码路径: /android/applications/sources/services/Telephony/,查看应用对应的AndroidManefest.xml文件:

    <manifest xmlns:android="http://schemas.android.com/apk/res/android"            xmlns:androidprv="http://schemas.android.com/apk/prv/res/android"            package="com.android.phone"            android:versionCode="1"            android:versionName="1.0.0"            coreApp="true"            android:sharedUserId="android.uid.phone"            android:sharedUserLabel="@string/phoneAppLabel" >            .....        <application android:name="PhoneApp"            android:persistent="true"            android:hardwareAccelerated="true"            android:label="@string/phoneAppLabel"            android:icon="@mipmap/ic_launcher_phone"            android:allowBackup="false"            android:supportsRtl="true"            android:usesCleartextTraffic="true"            android:defaultToDeviceProtectedStorage="true"            android:directBootAware="true">            ....        application>    manifest>

在application标签下面，可以看到android:persistent="true"这个属性值，看一看官方的文档怎么解释的：

android:persistent

Whether or not the application should remain running at all times — “true” if it should, and “false” if not. The default value is “false”. Applications should not normally set this flag; persistence mode is intended only for certain system applications.

由此可见，Phone应用是系统常驻进程，一旦起来后就会一直运行，不会被杀死（除非Phone进程自己发生了的运行时错误而崩溃）。对于这类常驻进程，ActivityManagerService(以下简称AMS)会在初始化完成后，主动启动。在SystemServer初始化完系统的核心服务后，会调用AMS的systemReady(Runnable r)函数。

ActivityManagerService.java

    public void systemReady(final Runnable goingCallback) {        synchronized (this) {                 // Only start up encryption-aware persistent apps; once user is                // unlocked we'll come back around and start unaware apps                // 正是在这里，phone进程被创建                startPersistentApps(PackageManager.MATCH_DIRECT_BOOT_AWARE);                // Start up initial activity.                mBooting = true;                // Enable home activity for system user, so that the system can always boot                if (UserManager.isSplitSystemUser()) {                    ComponentName cName = new ComponentName(mContext, SystemUserHomeActivity.class);                    try {                        AppGlobals.getPackageManager().setComponentEnabledSetting(cName,                                PackageManager.COMPONENT_ENABLED_STATE_ENABLED, 0,                                UserHandle.USER_SYSTEM);                    } catch (RemoteException e) {                        throw e.rethrowAsRuntimeException();                    }                }                startHomeActivityLocked(currentUserId, "systemReady");        }    }

启动所有PackageManager.MATCH_DIRECT_BOOT_AWARE标志为true的应用:

    private void startPersistentApps(int matchFlags) {        synchronized (this) {            try {                //获取系统所有常驻应用程序信息                final List apps = AppGlobals.getPackageManager()                        .getPersistentApplications(STOCK_PM_FLAGS | matchFlags).getList();                for (ApplicationInfo app : apps) {                    if (!"android".equals(app.packageName)) {                        //加载应用                        addAppLocked(app, false, null /* ABI override */);                    }                }            } catch (RemoteException ex) {            }        }    }    //添加应用程序进程到LRU列表中，并创建进程    final ProcessRecord addAppLocked(ApplicationInfo info, boolean isolated,            String abiOverride) {        ProcessRecord app;        if (!isolated) {            app = getProcessRecordLocked(info.processName, info.uid, true);        } else {            app = null;        }        // 没有进程记录，因此创建一个进程记录        if (app == null) {            app = newProcessRecordLocked(info, null, isolated, 0);            updateLruProcessLocked(app, false, null);            updateOomAdjLocked();        }        ....        if ((info.flags & PERSISTENT_MASK) == PERSISTENT_MASK) {            app.persistent = true;            app.maxAdj = ProcessList.PERSISTENT_PROC_ADJ;        }        // Start the process.  It will either succeed and return a result containing        // the PID of the new process, or else throw a RuntimeException.        boolean isActivityProcess = (entryPoint == null);        // 进程入口为ActivityThread        if (entryPoint == null) entryPoint = "android.app.ActivityThread";                //启动应用进程        if (app.thread == null && mPersistentStartingProcesses.indexOf(app) < 0) {            mPersistentStartingProcesses.add(app);            startProcessLocked(app, "added application", app.processName, abiOverride,                    null /* entryPoint */, null /* entryPointArgs */);        }        return app;    }

准备创建应用进程:

    private final void startProcessLocked(ProcessRecord app, String hostingType,            String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs) {            Process.ProcessStartResult startResult = null;            ....            startResult = Process.start(entryPoint,            app.processName, uid, uid, gids, debugFlags, mountExternal,            app.info.targetSdkVersion, aasaSeInfo != null ? new String(aasaSeInfo) : app.info.seinfo, //AASA--4 : changed orginal : only "app.info.seinfo"            app.info.category, app.info.accessInfo,            requiredAbi, instructionSet,            app.info.dataDir, mountKnoxPoint, entryPointArgs);            ....    }

Process.java

调用Process.start()，创建一个新的进程, Telephony服务以及RIL相关代码都运行在此进程中：

    public static final ProcessStartResult start(final String processClass,                                  final String niceName,                                  int uid, int gid, int[] gids,                                  int debugFlags, int mountExternal,                                  int targetSdkVersion,                                  String seInfo,                                  int category,                                  int accessInfo,                                  String abi,                                  String instructionSet,                                  String appDataDir,                                  boolean mountKnoxPoint,                                  String[] zygoteArgs) {        try {            return startViaZygote(processClass, niceName, uid, gid, gids,                    debugFlags, mountExternal, targetSdkVersion, seInfo, category, accessInfo,                    abi, instructionSet, appDataDir, mountKnoxPoint, zygoteArgs);        } catch (ZygoteStartFailedEx ex) {            Log.e(LOG_TAG,                    "Starting VM process through Zygote failed");            throw new RuntimeException(                    "Starting VM process through Zygote failed", ex);        }    }

发送消息到zygote服务进程的socket端口，请求创建新的进程:

 private static ProcessStartResult startViaZygote(final String processClass,                                  final String niceName,                                  final int uid, final int gid,                                  final int[] gids,                                  int debugFlags, int mountExternal,                                  int targetSdkVersion,                                  String seInfo,                                  int category,                                  int accessInfo,                                  String abi,                                  String instructionSet,                                  String appDataDir,                                  boolean mountKnoxPoint,                                  String[] extraArgs)                                  throws ZygoteStartFailedEx {        synchronized(Process.class) {            ArrayList argsForZygote = new ArrayList();            // --runtime-args, --setuid=, --setgid=,            // and --setgroups= must go first            argsForZygote.add("--runtime-args");            argsForZygote.add("--setuid=" + uid);            argsForZygote.add("--setgid=" + gid);            ....            if (appDataDir != null) {                argsForZygote.add("--app-data-dir=" + appDataDir);            }            ....            argsForZygote.add(processClass);            if (extraArgs != null) {                for (String arg : extraArgs) {                    argsForZygote.add(arg);                }            }            //发送消息到zygote的socket端口，请求创建新的进程            if (Zygote.isEnhancedZygoteASLREnabled) {                ....                return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), argsForZygote);                // End of isEnhancedZygoteASLREnabled case            } else {                // Original case                return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), argsForZygote);            }        }    }

ZygoteConnection.java

zygote进程接收到AMS的请求后，由ZygoteConnection负责处理请求：

    boolean runOnce() throws ZygoteInit.MethodAndArgsCaller {        String args[];        Arguments parsedArgs = null;        FileDescriptor[] descriptors;        try {            // 从socket中读取参数            args = readArgumentList();            descriptors = mSocket.getAncillaryFileDescriptors();        } catch (IOException ex) {            Log.w(TAG, "IOException on command socket " + ex.getMessage());            closeSocket();            return true;        }        if (args == null) {            // EOF reached.            closeSocket();            return true;        }        int pid = -1;        FileDescriptor childPipeFd = null;        FileDescriptor serverPipeFd = null;        ...        try {            parsedArgs = new Arguments(args);            //Zygote调用本地方法创建进程            pid = Zygote.forkAndSpecialize(parsedArgs.uid, parsedArgs.gid, parsedArgs.gids,                    parsedArgs.debugFlags, rlimits, parsedArgs.mountExternal, parsedArgs.seInfo, parsedArgs.category, parsedArgs.accessInfo,                    parsedArgs.niceName, fdsToClose, parsedArgs.instructionSet,                    parsedArgs.appDataDir, parsedArgs.mountKnoxPoint);        } catch (ErrnoException ex) {            logAndPrintError(newStderr, "Exception creating pipe", ex);        } catch (IllegalArgumentException ex) {            logAndPrintError(newStderr, "Invalid zygote arguments", ex);        } catch (ZygoteSecurityException ex) {            logAndPrintError(newStderr,                    "Zygote security policy prevents request: ", ex);        }        try {            if (pid == 0) {                // in child                IoUtils.closeQuietly(serverPipeFd);                serverPipeFd = null;                handleChildProc(parsedArgs, descriptors, childPipeFd, newStderr);                // should never get here, the child is expected to either                // throw ZygoteInit.MethodAndArgsCaller or exec().                return true;            } else {                // in parent...pid of < 0 means failure                IoUtils.closeQuietly(childPipeFd);                childPipeFd = null;                return handleParentProc(pid, descriptors, serverPipeFd, parsedArgs);            }        } finally {            IoUtils.closeQuietly(childPipeFd);            IoUtils.closeQuietly(serverPipeFd);        }    }

ZygoteInit.java

至此phone进程已经创建完成了，但实际上PhoneApp的代码还没有加载。继续看，在启动的进程里，调用ZygoteInit.zygoteInit来加载phoneApp的代码:

private void handleChildProc(Arguments parsedArgs,            FileDescriptor[] descriptors, FileDescriptor pipeFd, PrintStream newStderr)            throws Zygote.MethodAndArgsCaller {        /**         * By the time we get here, the native code has closed the two actual Zygote         * socket connections, and substituted /dev/null in their place.  The LocalSocket         * objects still need to be closed properly.         */        closeSocket();        if (descriptors != null) {            try {                Os.dup2(descriptors[0], STDIN_FILENO);                Os.dup2(descriptors[1], STDOUT_FILENO);                Os.dup2(descriptors[2], STDERR_FILENO);                for (FileDescriptor fd: descriptors) {                    IoUtils.closeQuietly(fd);                }                newStderr = System.err;            } catch (ErrnoException ex) {                Log.e(TAG, "Error reopening stdio", ex);            }        }        if (parsedArgs.niceName != null) {            Process.setArgV0(parsedArgs.niceName);        }        // End of the postFork event.        Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);        // 这里没有指定invokewith参数        if (parsedArgs.invokeWith != null) {            WrapperInit.execApplication(parsedArgs.invokeWith,                    parsedArgs.niceName, parsedArgs.targetSdkVersion,                    VMRuntime.getCurrentInstructionSet(),                    pipeFd, parsedArgs.remainingArgs);        } else {            // 这里remaingArgs的第一参数是android.app.ActivityThread, 就是之前的entrypoint            RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion,                    parsedArgs.remainingArgs, null /* classLoader */);        }    }

RuntimeInit.java

通过RuntimeInit来加载phone APP的代码, zygoteInit函数主要做三件事：

做一些通用的初始化，比如设置虚拟机中线程的exception handler;设置默认时区；
完成VM本地的初始化操作；
加载APP代码，也就是调用ActivityThread.main函数来加载整个phone APP；

    public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)            throws ZygoteInit.MethodAndArgsCaller {        if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting application from zygote");        Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "RuntimeInit");        redirectLogStreams();        commonInit();        nativeZygoteInit();        // 初始化应用代码        applicationInit(targetSdkVersion, argv, classLoader);    }

函数applicationInit通过方法invokeStaticMain反射调用ActivityThread.main:

    protected static void applicationInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)                throws Zygote.MethodAndArgsCaller {            // If the application calls System.exit(), terminate the process            // immediately without running any shutdown hooks.  It is not possible to            // shutdown an Android application gracefully.  Among other things, the            // Android runtime shutdown hooks close the Binder driver, which can cause            // leftover running threads to crash before the process actually exits.            nativeSetExitWithoutCleanup(true);            // We want to be fairly aggressive about heap utilization, to avoid            // holding on to a lot of memory that isn't needed.            VMRuntime.getRuntime().setTargetHeapUtilization(0.75f);            VMRuntime.getRuntime().setTargetSdkVersion(targetSdkVersion);            final Arguments args;            try {                args = new Arguments(argv);            } catch (IllegalArgumentException ex) {                Slog.e(TAG, ex.getMessage());                // let the process exit                return;            }            // Remaining arguments are passed to the start class's static main            invokeStaticMain(args.startClass, args.startArgs, classLoader);        }

invokeStaticMain通过抛出一个MethodAndArgsCaller的异常，被ZygoteInit.main方法捕获后，调用MethodAndArgsCaller.run，至此就调用了ActivityThread.main方法了，还真是有点绕。

| 有关zygote进程可以参考http://sniffer.site/2017/05/27/Zygote%E8%BF%9B%E7%A8%8B%E5%90%AF%E5%8A%A8%E8%BF%87%E7%A8%8B%E5%88%86%E6%9E%90/

    private static void invokeStaticMain(String className, String[] argv, ClassLoader classLoader)                throws Zygote.MethodAndArgsCaller {            Class<?> cl;            try {                cl = Class.forName(className, true, classLoader);            } catch (ClassNotFoundException ex) {                throw new RuntimeException(                        "Missing class when invoking static main " + className,                        ex);            }            Method m;            try {                m = cl.getMethod("main", new Class[] { String[].class });            } catch (NoSuchMethodException ex) {                throw new RuntimeException(                        "Missing static main on " + className, ex);            } catch (SecurityException ex) {                throw new RuntimeException(                        "Problem getting static main on " + className, ex);            }            int modifiers = m.getModifiers();            if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {                throw new RuntimeException(                        "Main method is not public and static on " + className);            }            /*            * This throw gets caught in ZygoteInit.main(), which responds            * by invoking the exception's run() method. This arrangement            * clears up all the stack frames that were required in setting            * up the process.            */            throw new Zygote.MethodAndArgsCaller(m, argv);        }

MethodAndArgsCaller异常的作用是清除父进程中的一些调用堆栈，这样子进程就从ActivityThread.main开始了自己的堆栈调用。

        public static class MethodAndArgsCaller extends Exception            implements Runnable {            /** method to call */            private final Method mMethod;            /** argument array */            private final String[] mArgs;            public MethodAndArgsCaller(Method method, String[] args) {                mMethod = method;                mArgs = args;            }            public void run() {                try {                    mMethod.invoke(null, new Object[] { mArgs });                } catch (IllegalAccessException ex) {                    throw new RuntimeException(ex);                } catch (InvocationTargetException ex) {                    Throwable cause = ex.getCause();                    if (cause instanceof RuntimeException) {                        throw (RuntimeException) cause;                    } else if (cause instanceof Error) {                        throw (Error) cause;                    }                    throw new RuntimeException(ex);                }            }    }

ActivityThread.java

到这里，ActivityThread.main会启动一个主线程，接着创建一个ActivityThread用于Phone APP与AMS进行交互。最重要的是，接着在thread.attach(false);这个函数里，ActivityThread会去创建Phone进程入口类PhoneApp。后续就是Phone整个框架代码的加载与初始化了。

    public static void main(String[] args) {        Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ActivityThreadMain");        SamplingProfilerIntegration.start();        // CloseGuard defaults to true and can be quite spammy.  We        // disable it here, but selectively enable it later (via        // StrictMode) on debug builds, but using DropBox, not logs.        CloseGuard.setEnabled(false);        Environment.initForCurrentUser();        // Set the reporter for event logging in libcore        EventLogger.setReporter(new EventLoggingReporter());        // Make sure TrustedCertificateStore looks in the right place for CA certificates        final File configDir = Environment.getUserConfigDirectory(UserHandle.myUserId());        TrustedCertificateStore.setDefaultUserDirectory(configDir);        Process.setArgV0("");        // 启动主线程Looper        Looper.prepareMainLooper();        ActivityThread thread = new ActivityThread();        thread.attach(false);        if (sMainThreadHandler == null) {            sMainThreadHandler = thread.getHandler();        }        if (false) {            Looper.myLooper().setMessageLogging(new                    LogPrinter(Log.DEBUG, "ActivityThread"));        }        // End of event ActivityThreadMain.        Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);        Looper.loop();        throw new RuntimeException("Main thread loop unexpectedly exited");    }

这样Phone进程就创建启动完成了。整个流程看下来，研究Android系统，源码是王道，但要深入理解系统背后的设计，还是需要从把基本的概念梳理清楚，才能更好的理解系统背后设计的逻辑。