SystemServer 启动service
Zygote启动之后，调用SystemServer的main方法（调用run方法）启动系统服务；
代码路径：
./frameworks/base/services/java/com/android/server/SystemServer.java
SystemServer类中提供的run 方法中，在启动service之前，会加载本地动态库System.loadLibrary("android_servers")初始化本地 Native service，过程如下：
/**
* The main entry point from zygote.
*/
public static void main(String[] args) {
new SystemServer().run();
}
public final class SystemServer {
private static final String TAG = "SystemServer";
private void run() {
// Initialize native services.
System.loadLibrary("android_servers");
// Start services.
try {
Trace.traceBegin(Trace.TRACE_TAG_SYSTEM_SERVER, "StartServices");
startBootstrapServices();
startCoreServices();
startOtherServices();
}
...
}
在 startBootstrapServices(); 的过程的最后 会调用startSensorService(); 如下：
private void startBootstrapServices() {
......
// The sensor service needs access to package manager service, app ops
// service, and permissions service, therefore we start it after them.
startSensorService();
}
在SystemServer类定义中，定义了本地方法startSensorService 如下：
public final class SystemServer {
private static final String TAG = "SystemServer";
//......
private static native void startSensorService();
//......
}
当SystemServer调用run 方法，会通过JNI调用到本地方法；
JNI 访问native 方法
通过对JNI的了解 System.loadLibrary("android_servers"); 会去查找libandroid_servers.so 这个库文件；
yujixuan@yujixuan:~/prj/SC20_R06_master_0526/code/frameworks$ grep -rn libandroid_servers ./
./base/services/Android.mk:54:LOCAL_MODULE:= libandroid_servers
通过检索可知，加载该本地库，会调用在 base/services/ 下编译库文件的onload函数；即：
代码路径： ./base/services/core/jni/onload.cpp
extern "C" jint JNI_OnLoad(JavaVM* vm, void* /* reserved */)
{
JNIEnv* env = NULL;
jint result = -1;
if (vm->GetEnv((void**) &env, JNI_VERSION_1_4) != JNI_OK) {
ALOGE("GetEnv failed!");
return result;
}
ALOG_ASSERT(env, "Could not retrieve the env!");
register_android_server_ActivityManagerService(env);
register_android_server_PowerManagerService(env);
register_android_server_SerialService(env);
register_android_server_InputApplicationHandle(env);
register_android_server_InputWindowHandle(env);
register_android_server_InputManager(env);
register_android_server_LightsService(env);
register_android_server_AlarmManagerService(env);
register_android_server_UsbDeviceManager(env);
register_android_server_UsbMidiDevice(env);
register_android_server_UsbHostManager(env);
register_android_server_vr_VrManagerService(env);
register_android_server_VibratorService(env);
register_android_server_SystemServer(env);
//......
return JNI_VERSION_1_4;
}
由上可知，在JNI_OnLoad 中会调用添加若干个 server，没有发现sensor相关的server；
实则它是 SystemServer中,下面是register_android_server_SystemServer内容：
代码路径：./base/services/core/jni/com_android_server_SystemServer.cpp
/*
* JNI registration.
*/
static const JNINativeMethod gMethods[] = {
/* name, signature, funcPtr */
{ "startSensorService", "()V", (void*) android_server_SystemServer_startSensorService },
};
int register_android_server_SystemServer(JNIEnv* env)
{
return jniRegisterNativeMethods(env, "com/android/server/SystemServer",
gMethods, NELEM(gMethods));
}
可以看到 register_android_server_SystemServer 实际上是注册绑定了 sensor相关的 service启动方法（为啥不直接命名为sensor server，目前还不清楚）；
通过method可知，systemServer调用run方法启动 startSensorService，会调用到android_server_SystemServer_startSensorService ； 以下是它的实现：
static void android_server_SystemServer_startSensorService(JNIEnv* /* env */, jobject /* clazz */) {
char propBuf[PROPERTY_VALUE_MAX];
property_get("system_init.startsensorservice", propBuf, "1");
if (strcmp(propBuf, "1") == 0) {
// Start the sensor service in a new thread
createThreadEtc(start_sensor_service, nullptr,
"StartSensorThread", PRIORITY_FOREGROUND);
}
}
判断属性 "system_init.startsensorservice" 是否存在，如果存在 创建线程"StartSensorThread"（默认被配置了，还找到哪里配置的）
线程内容如下：
static int start_sensor_service(void* /*unused*/) {
SensorService::instantiate();
return 0;
}
该线程调用SensorService中的instantiate方法，创建了SensorService的实例；
SensorService实现
继续分析SensorService instantiate的创建，首先是看SensorService类的定义：
路径：./frameworks/native/services/sensorservice/SensorService.h
class SensorService :
public BinderService<SensorService>,
public BnSensorServer,
protected Thread
{
// nested class/struct for internal use
class SensorEventConnection;
public:
void cleanupConnection(SensorEventConnection* connection);
status_t enable(const sp<SensorEventConnection>& connection, int handle,
nsecs_t samplingPeriodNs, nsecs_t maxBatchReportLatencyNs, int reservedFlags,
const String16& opPackageName);
status_t disable(const sp<SensorEventConnection>& connection, int handle);
status_t setEventRate(const sp<SensorEventConnection>& connection, int handle, nsecs_t ns,
const String16& opPackageName);
status_t flushSensor(const sp<SensorEventConnection>& connection,
const String16& opPackageName);
private:
friend class BinderService<SensorService>;
// nested class/struct for internal use
class SensorRecord;
class SensorEventAckReceiver;
struct SensorRegistrationInfo
static char const* getServiceName() ANDROID_API { return "sensorservice"; }
SensorService() ANDROID_API;
virtual ~SensorService();
virtual void onFirstRef();
// Thread interface
virtual bool threadLoop();
// ISensorServer interface
virtual Vector<Sensor> getSensorList(const String16& opPackageName);
virtual status_t dump(int fd, const Vector<String16>& args);
String8 getSensorName(int handle) const;
bool isVirtualSensor(int handle) const;
sp<SensorInterface> getSensorInterfaceFromHandle(int handle) const;
bool isWakeUpSensor(int type) const;
void recordLastValueLocked(sensors_event_t const* buffer, size_t count);
static void sortEventBuffer(sensors_event_t* buffer, size_t count);
const Sensor& registerSensor(SensorInterface* sensor,
bool isDebug = false, bool isVirtual = false);
const Sensor& registerVirtualSensor(SensorInterface* sensor, bool isDebug = false);
};
删了一些相对无关的方法及属性后，还有如上内容，没有instantiate方法；
通过类的定义可以发现SensorService 继承了BinderService；BnSensorServer，Thread这三个class； instantiate 是被定义在它的父类BinderService中了；
以下是BinderService的实现：
代码路径：./frameworks/native/include/binder/BinderService.h
class BinderService
{
public:
static status_t publish(bool allowIsolated = false) {
sp<IServiceManager> sm(defaultServiceManager());
return sm->addService(
String16(SERVICE::getServiceName()),
new SERVICE(), allowIsolated);
}
static void publishAndJoinThreadPool(bool allowIsolated = false) {
publish(allowIsolated);
joinThreadPool();
}
static void instantiate() { publish(); }
......
};
publish()中
sp sm(defaultServiceManager());
可知SensorService::instantiate()在这一过程创建了SensorService并通过addService将自己新创建的SensorService服务添加到Android服务列表里了。
有关：Android系统智能指针的设计思路（轻量级指针、强指针、弱指针）
可知在Android引用计数系统里，当RefBase的子类对象被第一次强引用时自动调用其onFirstRef方法，所以当第一次使用SensorService，onFirstRef方法将被被自动回调，onFirstRef方法里内容的实现在后面内容做具体分析。
时序图：
根据以上过程，绘制了一个uml时序图，如下：
总结过程：
系统初始化进程加载，启动SystemServer，Zygote中会执行SystemServier main方法，导致其run方法被调用；加载本地库文件， System.loadLibrary("android_servers"); 获取本地方法；被加载到的JNI库文件导致JNI_Onload函数被调用；调用本地jni文件注册本地方法jniRegisterNativeMethods 数组；完成Java 到 C++ 函数绑定，使Java能否访问到C库中的函数；启动startBootstrapServices();最后调用native方法 native void startSensorService();-
JNI文件com_android_server_SystemServer.cpp，绑定的函数数组，由java的startSensorService方法绑定到android_server_SystemServer_startSensorService函数； C++函数中，start_sensor_service被调用；调用SensorService的inistantiate函数（继承父类BinderService得到的）；调用publish创建一个Serivces,通过sm->addService 来添加到android中去； sm->addService( String16(SERVICE::getServiceName()), new SERVICE(), allowIsolated); 其中sm是ServiceManager的引用：sp sm(defaultServiceManager());