System Server 是什么System Server是 Android 系统中一个极其关键的系统级进程它负责启动并运行 Android 框架层Framework中绝大多数核心系统服务。它由 Zygote 进程孵化而来在系统启动阶段被拉起随后开始逐一初始化各类系统服务。可以把它理解为 Android 系统的中央服务总控台——你的应用能正常联网、显示界面、接收广播、使用相机等背后都依赖 System Server 中运行的各种服务。一、整体启动链路二、Zygote 孵化 SystemServer2.1 启动参数在 init.zygote32.rc 中Zygote 启动参数包含 --start-system-server// ZygoteInit.java — 硬编码参数String[]args{--setuid1000,--setgid1000,--setgroups1001,1002,1003,...,--capabilitiescapabilities,capabilities,--nice-namesystem_server,// 进程名--runtime-args,--target-sdk-versionVMRuntime.SDK_VERSION_CUR_DEVELOPMENT,com.android.server.SystemServer,// 入口类};ZygoteInit 解析到 --start-system-server 后设置 startSystemServer true触发 forkSystemServer()。2.2 fork 后的初始化// ZygoteInit.javaprivatestaticRunnableforkSystemServer(...){pidZygote.forkSystemServer(...);// fork 创建子进程if(pid0){// 子进程SystemServerreturnhandleSystemServerProcess(parsedArgs);}}// handleSystemServerProcess → zygoteInit()privatestaticRunnablezygoteInit(inttargetSdkVersion,...){// 1. 启动 Binder 线程池ZygoteInit.nativeZygoteInit();// 2. 反射获取 SystemServer.main()returnfindStaticMain(args.startClass,args.startArgs,classLoader);}关键点nativeZygoteInit() 在 Native 层启动 Binder 线程池这是 SystemServer 能接收 Binder 调用的前提。三、SystemServer.run() — 初始化阶段3.1 入口// SystemServer.javapublicstaticvoidmain(String[]args){newSystemServer().run();// 构造 运行}3.2 run() 方法核心初始化privatevoidrun(){// 1. 系统属性 日志 SystemProperties.set(SYSPROP_START_COUNT,String.valueOf(mStartCount));EventLog.writeEvent(EventLogTags.SYSTEM_SERVER_START,...);// 2. Binder 配置 Binder.setWarnOnBlocking(true);// 非 oneway 调用警告BinderInternal.disableBackgroundScheduling(true);// 禁用后台调度BinderInternal.setMaxThreads(sMaxBinderThreads);// 最大 31 个 Binder 线程// 3. Looper 准备 Looper.prepareMainLooper();Looper.getMainLooper().setSlowLogThresholdMs(...);// 4. Native 库加载 System.loadLibrary(android_servers);// libandroid_servers.so// 5. 系统上下文创建 createSystemContext();// mSystemContext (ContextImpl)// 6. SystemServiceManager 创建 mSystemServiceManagernewSystemServiceManager(mSystemContext);LocalServices.addService(SystemServiceManager.class,mSystemServiceManager);// 7. 启动服务三阶段 startBootstrapServices(t);startCoreServices(t);startOtherServices(t);startApexServices(t);// 8. 进入主循环 Looper.loop();thrownewRuntimeException(Main thread loop unexpectedly exited);}四、服务启动三阶段4.1 startBootstrapServices() — 引导服务这些服务相互依赖必须在一个方法中按顺序初始化privatevoidstartBootstrapServices(NonNullTimingsTraceAndSlogt){// 1. 看门狗防止启动死锁Watchdog.getInstance().start();// 2. InstallerAPK 安装底层支持InstallerinstallermSystemServiceManager.startService(Installer.class);// 3. ActivityTaskManagerService (ATMS)ActivityTaskManagerServiceatmmSystemServiceManager.startService(ActivityTaskManagerService.Lifecycle.class).getService();// 4. ActivityManagerService (AMS)mActivityManagerServiceActivityManagerService.Lifecycle.startService(mSystemServiceManager,atm);mActivityManagerService.setSystemServiceManager(mSystemServiceManager);mActivityManagerService.setInstaller(installer);// 5. PowerManagerServicemPowerManagerServicemSystemServiceManager.startService(PowerManagerService.class);mActivityManagerService.initPowerManagement();// 6. DisplayManagerServicemDisplayManagerServicemSystemServiceManager.startService(DisplayManagerService.class);// 7. 等待默认显示就绪mSystemServiceManager.startBootPhase(t,SystemService.PHASE_WAIT_FOR_DEFAULT_DISPLAY);// 8. PackageManagerServicemPackageManagerServicePackageManagerService.main(mSystemContext,installer,domainVerificationService,...);// 9. UserManagerServicemSystemServiceManager.startService(UserManagerService.LifeCycle.class);// 10. 设置系统进程 ApplicationmActivityManagerService.setSystemProcess();// 11. SensorServicemSystemServiceManager.startService(SensorService.class);}4.2 startCoreServices() — 核心服务privatevoidstartCoreServices(NonNullTimingsTraceAndSlogt){mSystemServiceManager.startService(SystemConfigService.class);mSystemServiceManager.startService(BatteryService.class);// 电池mSystemServiceManager.startService(UsageStatsService.class);// 使用统计mSystemServiceManager.startService(WebViewUpdateService.class);// WebViewmSystemServiceManager.startService(CachedDeviceStateService.class);mSystemServiceManager.startService(BinderCallsStatsService.class);mSystemServiceManager.startService(LooperStatsService.class);mSystemServiceManager.startService(RollbackManagerService.class);mSystemServiceManager.startService(NativeTombstoneManagerService.class);mSystemServiceManager.startService(BugreportManagerService.class);mSystemServiceManager.startService(GpuService.class);mSystemServiceManager.startService(RemoteProvisioningService.class);}4.3 startOtherServices() — 其他服务100 个这是最大的一组包括 WMS、InputManager、Connectivity、Notification 等privatevoidstartOtherServices(NonNullTimingsTraceAndSlogt){// WindowManagerServicemWindowManagerServiceWindowManagerService.main(...);// InputManagerServicemInputManagerServicenewInputManagerService(context);// AlarmManagerServicemSystemServiceManager.startService(AlarmManagerService.class);// ConnectivityServicemSystemServiceManager.startService(ConnectivityService.class);// NotificationManagerServicemSystemServiceManager.startService(NotificationManagerService.class);// LocationManagerServicemSystemServiceManager.startService(LocationManagerService.class);// CameraServicemSystemServiceManager.startService(CameraService.class);// ... 100 其他服务// 启动 SystemUIstartSystemUi(context,windowManagerF);}五、SystemServiceManager 启动原理5.1 反射创建服务// SystemServiceManager.javapublicTextendsSystemServiceTstartService(ClassTserviceClass){finalStringnameserviceClass.getName();Slog.i(TAG,Starting name);// 1. 反射创建必须有无参构造函数或 Context 构造函数finalTservice;try{ConstructorTconstructorserviceClass.getConstructor(Context.class);serviceconstructor.newInstance(mContext);}catch(...){...}// 2. 注册到服务列表mServices.add(service);// 3. 触发 onStart()这里是引用 service.onStart();returnservice;}5.2 启动阶段通知机制// SystemServiceManager.javapublicvoidstartBootPhase(NonNullTimingsTraceAndSlogt,intphase){mCurrentPhasephase;// 遍历所有已注册服务通知当前阶段for(SystemServiceservice:mServices){service.onBootPhase(mCurrentPhase);}}各服务根据 onBootPhase() 接收到的阶段号执行对应的初始化逻辑。5.3 Boot Phase 阶段定义阶段值常量含义触发位置100PHASE_WAIT_FOR_DEFAULT_DISPLAY等待默认显示器就绪startBootstrapServices200PHASE_WAIT_FOR_SENSOR_SERVICE等待传感器服务就绪startOtherServices480PHASE_LOCK_SETTINGS_READY锁屏设置就绪startOtherServices500PHASE_SYSTEM_SERVICES_READY核心系统服务就绪startOtherServices520PHASE_DEVICE_SPECIFIC_SERVICES_READY设备特定服务就绪startOtherServices550PHASE_ACTIVITY_MANAGER_READYAMS 就绪可广播 IntentAMS.systemReady()600PHASE_THIRD_PARTY_APPS_CAN_START第三方应用可启动AMS.systemReady()1000PHASE_BOOT_COMPLETED引导完成启动 LauncherAMS.finishBooting()六、AMS.systemReady() — 系统就绪当服务启动到 PHASE_THIRD_PARTY_APPS_CAN_START 阶段AMS 调用 systemReady()// ActivityManagerService.javapublicvoidsystemReady(finalRunnablegoingCallback,TimingsTraceAndSlogt){// ... 各种就绪检查 ...// 启动 Home ActivityLaunchermAtmInternal.startHomeOnAllDisplays(currentUserId,systemReady);// 发送 ACTION_BOOT_COMPLETED 广播// 通知所有应用系统已启动完成}同时SystemServer 启动 SystemUI// SystemServer.javaprivatestaticvoidstartSystemUi(Contextcontext,WindowManagerServicewindowManager){IntentintentnewIntent();intent.setComponent(pm.getSystemUiServiceComponent());// com.android.systemuicontext.startServiceAsUser(intent,UserHandle.SYSTEM);windowManager.onSystemUiStarted();}七、SystemServer 整体架构八、 主要作用1. 启动并持有核心系统服务System Server 的 main() 方法会调用 startBootstrapServices()、startCoreServices()、startOtherServices() 三个阶段依次创建并注册到 ServiceManager 中阶段典型服务BootstrapActivityManagerService (AMS)、PowerManagerService、LightsService、DisplayManagerServiceCoreBatteryService、UsageStatsService、WebViewUpdateServiceOtherWindowManagerService (WMS)、InputManagerService、PackageManagerService、TelephonyRegistry、NotificationManagerService、LocationManagerService、CameraService、AlarmManagerService、ConnectivityService 等2. 作为 Binder 服务端这些系统服务都运行在 System Server 进程中应用进程通过 Binder IPC 跨进程调用它们。例如启动 Activity → 调用 AMS 的 startActivity()创建窗口 → 调用 WMS 的 addWindow()注册广播 → 调用 AMS 的 registerReceiver()3. 协调系统资源与状态AMS管理四大组件生命周期、进程调度WMS管理窗口层级、焦点、动画PMS管理电源状态、唤醒锁PackageManagerService管理 APK 安装、权限、组件信息九、源码层面的入口System Server 的启动入口在 frameworks/base/services/java/com/android/server/SystemServer.javapublicstaticvoidmain(String[]args){newSystemServer().run();}privatevoidrun(){// 1. 创建系统上下文createSystemContext();// 2. 启动 Bootstrap 服务startBootstrapServices();// 3. 启动 Core 服务startCoreServices();// 4. 启动 Other 服务startOtherServices();// 5. 进入 Looper.loop()保持进程存活Looper.loop();}十、核心要点总结SystemServer 由Zygote fork 而来UID1000是 Framework 层的核心进程run() 分四阶段启动服务Bootstrap → Core → Other → Apex依赖关系决定启动顺序SystemServiceManager 通过反射创建服务管理生命周期onStart() → onBootPhase()Boot Phase 机制让服务按阶段初始化PHASE_THIRD_PARTY_APPS_CAN_START(600) 后应用可启动AMS.systemReady()启动 LauncherSystemServer 最后启动 SystemUI最终 Looper.loop() 阻塞主线程通过 Binder 线程池处理跨进程调用维度说明进程身份系统进程UID 为system核心职责启动并持有 Framework 层系统服务通信方式通过 Binder 向应用进程暴露接口生命周期从开机到关机一直运行崩溃会导致系统重启与 Zygote 区别Zygote 负责孵化应用进程System Server 负责运行系统服务