SystemServer进程

android12-release
Android系统启动
 Zygote进程

Zygote进程fork而来

init进程 -> Zygote进程 -> system_server进程

frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
frameworks/base/core/java/com/android/internal/os/Zygote.java
frameworks/base/core/jni/com_android_internal_os_Zygote.cpp
art/runtime/native/dalvik_system_ZygoteHooks.cc

forkSystemServer().run() -> pid = Zygote.forkSystemServer() -> nativeForkSystemServer() -> com_android_internal_os_Zygote_nativeForkSystemServer -> pid = zygote::ForkCommon() -> pid = fork() -> SpecializeCommon()

/* Hardcoded command line to start the system server */
String[] args = {
        "--setuid=1000",
        "--setgid=1000",
        "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1023,"
                + "1024,1032,1065,3001,3002,3003,3006,3007,3009,3010,3011",
        "--capabilities=" + capabilities + "," + capabilities,
        "--nice-name=system_server",
        "--runtime-args",
        "--target-sdk-version=" + VMRuntime.SDK_VERSION_CUR_DEVELOPMENT,
        "com.android.server.SystemServer",
};
ZygoteArguments parsedArgs;

SystemServer进程参数信息为uid=1000,gid=1000,进程名为sytem_server
Zygote.forkSystemServer() fork出system_server进程
com_android_internal_os_Zygote_nativeForkSystemServer JNI zygote::ForkCommon()调用到fork()创建新进程，采用copy on write方式，这是linux创建进程的标准方法，会有两次return。返回值有3种类型：父进程中，fork返回新创建的子进程的pid；子进程中，fork返回0；当出现错误时，fork返回负数。

当system_server进程死亡后，重启zygote进程。
新创建system_server进程已完成,pid == 0便进入handleSystemServerProcess()方法

handleSystemServerProcess

fork()到此system_server进程已完成了创建的所有工作，接下来开始了system_server进程的真正工作

handleSystemServerProcess(parsedArgs)完成system_server进程剩余工作，运行在system_server进程
Process.setArgV0(parsedArgs.mNiceName) 当前进程名"system_server"
performSystemServerDexOpt()执行dex优化操作，由installd来完成
system_server执行ZygoteInit.zygoteInit()

/**
 * Finish remaining work for the newly forked system server process.
 */
private static Runnable handleSystemServerProcess(ZygoteArguments parsedArgs) {
    // set umask to 0077 so new files and directories will default to owner-only permissions.
    Os.umask(S_IRWXG | S_IRWXO);

    if (parsedArgs.mNiceName != null) {
        Process.setArgV0(parsedArgs.mNiceName);
    }

    final String systemServerClasspath = Os.getenv("SYSTEMSERVERCLASSPATH");
    if (systemServerClasspath != null) {
        performSystemServerDexOpt(systemServerClasspath);
        // Capturing profiles is only supported for debug or eng builds since selinux normally
        // prevents it.
        if (shouldProfileSystemServer() && (Build.IS_USERDEBUG || Build.IS_ENG)) {
            try {
                Log.d(TAG, "Preparing system server profile");
                prepareSystemServerProfile(systemServerClasspath);
            } catch (Exception e) {
                Log.wtf(TAG, "Failed to set up system server profile", e);
            }
        }
    }

    if (parsedArgs.mInvokeWith != null) {
        String[] args = parsedArgs.mRemainingArgs;
        // If we have a non-null system server class path, we'll have to duplicate the
        // existing arguments and append the classpath to it. ART will handle the classpath
        // correctly when we exec a new process.
        if (systemServerClasspath != null) {
            String[] amendedArgs = new String[args.length + 2];
            amendedArgs[0] = "-cp";
            amendedArgs[1] = systemServerClasspath;
            System.arraycopy(args, 0, amendedArgs, 2, args.length);
            args = amendedArgs;
        }

        WrapperInit.execApplication(parsedArgs.mInvokeWith,
                parsedArgs.mNiceName, parsedArgs.mTargetSdkVersion,
                VMRuntime.getCurrentInstructionSet(), null, args);

        throw new IllegalStateException("Unexpected return from WrapperInit.execApplication");
    } else {
        ClassLoader cl = getOrCreateSystemServerClassLoader();
        if (cl != null) {
            Thread.currentThread().setContextClassLoader(cl);
        }

        /*
         * Pass the remaining arguments to SystemServer.
         */
        return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion,
                parsedArgs.mDisabledCompatChanges,
                parsedArgs.mRemainingArgs, cl);
    }

    /* should never reach here */
}

ZygoteInit.zygoteInit()

ZygoteInit.nativeZygoteInit()在AndroidRuntime.cpp中，进行了jni映射
RuntimeInit.applicationInit()中内部类MethodAndArgsCaller.run运行mMethod.invoke()启动SystemServer.main()