Zygote进程启动

Zygote被称为孵化器，因为在Android中DVM、ART、应用程序进程以及系统服务进程（SystemServer）都是有它来创建的，而且是通过是通过fork的形式来创建应用程序进程和SystemServer，所以这些进程的内部会获取一个DVM或者ART的实例副本。下面我们重点看一下它的启动过程。
Zygote启动时主要调用app_main.cpp的main函数中的AndroidRuntime的start方法来启动Zygote进程。
其中app_main中的Runtime的start方法如下
runtime.start(“com.android.internal.os.ZygoteInit”,args,zygote)
接着看AndroidRuntime.cpp（frameworks/base/core/jni/AndroidRuntime.cpp）中的这个方法
void AndroidRuntime::start(const char*className,const Vector&options, bool zygote) {
…
JniInvocation jni_invocation;
//加载DVM或ART
jni_invocation.Init(NULL);
JNIEnv * env;
//启动Java虚拟机
if (startVm( & mJavaVM,&env, zygote)!=0){
return;
}
onVmCreated(env);

/*
 * 为Java虚拟机注册JNI方法.
 */
if (startReg(env) < 0) {
    ALOGE("Unable to register all android natives\n");
    return;
}

...
//传入的className为com.android.internal.os.ZygoteInit
classNameStr = env -> NewStringUTF(className);
...
//将路径中的.替换为/
char*slashClassName = toSlashClassName(className);
//找到ZygoteInit
jclass startClass = env -> FindClass(slashClassName);
if (startClass == NULL) {
    ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);
    /* keep going */
} else {
    //找到ZygoteInit的main方法
    jmethodID startMeth = env -> GetStaticMethodID(startClass, "main",
            "([Ljava/lang/String;)V");
    if (startMeth == NULL) {
        ALOGE("JavaVM unable to find main() in '%s'\n", className);
        /* keep going */
    } else {
        //通过JNI调用ZygoteInit的main方法
        env -> CallStaticVoidMethod(startClass, startMeth, strArray);

#if 0
        if (env -> ExceptionCheck())
            threadExitUncaughtException(env);
#endif
    }
}
...

}
复制代码其中这个方法中主要做了这么几件事，1启动Java虚拟机，2为Java虚拟机注册JNI方法处理传过来的className并找到该类（ZygoteInit），找到该类中的main方法并通过jni调用，至此Zygote就从Native层进入了Java层。具体看一下main方法中做了什么
public static void main(String argv[]) {
ZygoteServer zygoteServer = new ZygoteServer();

…
// 注册一个服务端的Socket.
zygoteServer.registerServerSocketFromEnv(socketName);
// In some configurations, we avoid preloading resources and classes eagerly.
// In such cases, we will preload things prior to our first fork.
if (!enableLazyPreload) {
bootTimingsTraceLog.traceBegin(“ZygotePreload”);
EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
SystemClock.uptimeMillis());
// 预加载类和资源
preload(bootTimingsTraceLog);
EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
SystemClock.uptimeMillis());
bootTimingsTraceLog.traceEnd(); // ZygotePreload
} else {
Zygote.resetNicePriority();
}

    // Do an initial gc to clean up after startup
    bootTimingsTraceLog.traceBegin("PostZygoteInitGC");
    gcAndFinalize();
    bootTimingsTraceLog.traceEnd(); // PostZygoteInitGC

    bootTimingsTraceLog.traceEnd(); // ZygoteInit
    // Disable tracing so that forked processes do not inherit stale tracing tags from
    // Zygote.
    Trace.setTracingEnabled(false, 0);

    Zygote.nativeSecurityInit();

    // Zygote process unmounts root storage spaces.
    Zygote.nativeUnmountStorageOnInit();

    ZygoteHooks.stopZygoteNoThreadCreation();

    if (startSystemServer) {
    // 启动SystemServer
        Runnable r = forkSystemServer(abiList, socketName, zygoteServer);

        // {@code r == null} in the parent (zygote) process, and {@code r != null} in the
        // child (system_server) process.
        if (r != null) {
            r.run();
            return;
        }
    }

    Log.i(TAG, "Accepting command socket connections");


    // l等待AMS请求.
    caller = zygoteServer.runSelectLoop(abiList);
} catch (Throwable ex) {
    Log.e(TAG, "System zygote died with exception", ex);
    throw ex;
} finally {
    zygoteServer.closeServerSocket();
}

…
}
复制代码这里的ZygoteServer提供了等待UNIX系统的socket功能，并且派生继承VM初始状态的子进程。在启动Zygote的时候传递的参数有（service zygote /system/bin/app_process64 -Xzygote /system/bin --zygote --start-system-server
class main，其中service是init.rc中的AndroidInitLanguage中的Service类型语句，后面的“…64”则是执行程序路径，在后面的则是参数），可以看到传递的参数有“zygote”和“start-system_server”，所以会执行preload以及forkSystemServer。整个main方法其实就做了四件事创建一个serverSocket，预加载类和资源，启动SystemServer，等待AMS请求创建新的应用程序进程。这里重点看一下启动SystemServer。
forkSystemServer（ZygoteInit.java）
private static Runnable forkSystemServer(String abiList, String socketName,
ZygoteServer zygoteServer) {
…

/* Hardcoded command line to start the system server */
String args[] = {
“–setuid=1000”,
“–setgid=1000”,
“–setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1023,1024,1032,1065,3001,3002,3003,3006,3007,3009,3010”,
“–capabilities=” + capabilities + “,” + capabilities,
“–nice-name=system_server”,
“–runtime-args”,
“–target-sdk-version=” + VMRuntime.SDK_VERSION_CUR_DEVELOPMENT,
“com.android.server.SystemServer”,
};
ZygoteConnection.Arguments parsedArgs = null;

int pid;

try {
parsedArgs = new ZygoteConnection.Arguments(args);
ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);

boolean profileSystemServer = SystemProperties.getBoolean(
“dalvik.vm.profilesystemserver”, false);
if (profileSystemServer) {
parsedArgs.runtimeFlags |= Zygote.PROFILE_SYSTEM_SERVER;
}

/* Request to fork the system server process */
pid = Zygote.forkSystemServer(
parsedArgs.uid, parsedArgs.gid,
parsedArgs.gids,
parsedArgs.runtimeFlags,
null,
parsedArgs.permittedCapabilities,
parsedArgs.effectiveCapabilities);
} catch (IllegalArgumentException ex) {
throw new RuntimeException(ex);
}

/* For child process */
if (pid == 0) {
if (hasSecondZygote(abiList)) {
waitForSecondaryZygote(socketName);
}

zygoteServer.closeServerSocket();
return handleSystemServerProcess(parsedArgs);
}

return null;
}
复制代码这里首先构造了一些arg，主要用于fork子进程以及在子进程中运用这些参数，主要包括pid、uid等。然后利用 ZygoteConnection.Arguments来构造这些参数，而 ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);则是如果系统可调式的话就添加args.runtimeFlags |= Zygote.DEBUG_ENABLE_JDWP属性ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs)则是将args.invokeWith = null;重置为null。紧接着利用这些参数来创建一个子进程。成功后会返回0，进而执行handleSystemServerProcess（ZygoteInit.java）
private static Runnable handleSystemServerProcess(ZygoteConnection.Arguments parsedArgs) {
…

if (parsedArgs.invokeWith != null) {
   ...
} else {
    ClassLoader cl = null;
    if (systemServerClasspath != null) {
        cl = createPathClassLoader(systemServerClasspath, parsedArgs.targetSdkVersion);

        Thread.currentThread().setContextClassLoader(cl);
    }

    /*
     * Pass the remaining arguments to SystemServer.
     */
    return ZygoteInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs, cl);
}

/* should never reach here */

}
复制代码因为之前们的invokeWith属性为null，所以这里会执行else分支，重要的是创建了一个PathClassLoader，然后用这个调用zygoteInit（ZygoteInit.java）方法
public static final Runnable zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader) {
…
RuntimeInit.redirectLogStreams();

RuntimeInit.commonInit();
ZygoteInit.nativeZygoteInit();
return RuntimeInit.applicationInit(targetSdkVersion, argv, classLoader);

}
复制代码这里的nativeZygoteInit是用来启动Binder线程池的，而这个applicationInit则是进入SystemServer的main方法，这里是通过反射来调用方法的，所以需要classLoader等信息。我们直接看SystemServer中的这个main方法，他其实就是调用了该类的run方法
private void run() {
try {

 ...

//创建消息的looper.
Looper.prepareMainLooper();
Looper.getMainLooper().setSlowLogThresholdMs(
SLOW_DISPATCH_THRESHOLD_MS, SLOW_DELIVERY_THRESHOLD_MS);

    //加载动态链接库libandroid_servers.so.
    System.loadLibrary("android_servers");

    // Check whether we failed to shut down last time we tried.
    // This call may not return.
    performPendingShutdown();

    //初始化系统context.
    createSystemContext();

    // 创建SystemServiceManager
    mSystemServiceManager = new SystemServiceManager(mSystemContext);
    mSystemServiceManager.setStartInfo(mRuntimeRestart,
            mRuntimeStartElapsedTime, mRuntimeStartUptime);
    LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
    // Prepare the thread pool for init tasks that can be parallelized
    SystemServerInitThreadPool.get();
} finally {
    traceEnd();  // InitBeforeStartServices
}

// Start services.
try {
    traceBeginAndSlog("StartServices");

// 启动引导服务
startBootstrapServices();
// 启动核心服务.
startCoreServices();
//启动其他服务.
startOtherServices();
SystemServerInitThreadPool.shutdown();
} catch (Throwable ex) {
Slog.e(“System”, “******************************************”);
Slog.e(“System”, “************ Failure starting system services”, ex);
throw ex;
} finally {
traceEnd();
}

StrictMode.initVmDefaults(null);

if (!mRuntimeRestart && !isFirstBootOrUpgrade()) {
    int uptimeMillis = (int) SystemClock.elapsedRealtime();
    MetricsLogger.histogram(null, "boot_system_server_ready", uptimeMillis);
    final int MAX_UPTIME_MILLIS = 60 * 1000;
    if (uptimeMillis > MAX_UPTIME_MILLIS) {
        Slog.wtf(SYSTEM_SERVER_TIMING_TAG,
                "SystemServer init took too long. uptimeMillis=" + uptimeMillis);
    }
}

// Loop forever.
Looper.loop();
throw new RuntimeException("Main thread loop unexpectedly exited");

}
复制代码主要是创建了SystemServiceManager，它会对系统服务进行创建、启动和生命周期管理。接下来就开始启动各种服务，比如引导服务（包括ActivityManagerService、PackageMangerService、PowerManagerService等），核心服务（BatteryService等）、其他服务（CameraService、AlarmManagerService、windowManagerService等）,我们重点看一下这个引导服务，因为他启动了ActivityManagerService
private void startBootstrapServices() {
…
//首先会初始化安装，它可以创建一些重要的文件夹比如/data/user，等它完成之后才能初始化其他服务
…
Installer installer = mSystemServiceManager.startService(Installer.class);

…
//启动APP之后我们可能需要获取设备标识符，所以设备标识符策略服务会在ActivityManager之前创建
mSystemServiceManager.startService(DeviceIdentifiersPolicyService.class);
…
// 创建ActivityManagerService.
mActivityManagerService = mSystemServiceManager.startService(
ActivityManagerService.Lifecycle.class).getService();
mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
mActivityManagerService.setInstaller(installer);
…
//PowerManagerService需要尽早的初始化，因为一些其他的服务依赖于它
mPowerManagerService = mSystemServiceManager.startService(PowerManagerService.class);
…
PMS启动之后，利用AMS初始化它的管理特性
mActivityManagerService.initPowerManagement();

…
//启动RecoverySystemService
traceBeginAndSlog(“StartRecoverySystemService”);
mSystemServiceManager.startService(RecoverySystemService.class);
…

// 启动lightService，管理LED和显示屏背光，因此我们需要它来启动显示屏。
mSystemServiceManager.startService(LightsService.class);
…
//程序包管理器启动之前，需要显示管理器提供显示服务。所以这里启动DisplayManagerService
mDisplayManagerService = mSystemServiceManager.startService(DisplayManagerService.class);

…
//启动PMS
mPackageManagerService = PackageManagerService.main(mSystemContext, installer,
mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore);
mFirstBoot = mPackageManagerService.isFirstBoot();
mPackageManager = mSystemContext.getPackageManager();
…
}
复制代码这里我们重点看一下AMS的创建和启动
调用了SystemServiceManager中的startService方法
public T startService(Class serviceClass) {
try {
final String name = serviceClass.getName();
…
final T service;
try {
Constructor constructor = serviceClass.getConstructor(Context.class);
service = constructor.newInstance(mContext);
} …

    startService(service);
    return service;
} finally {
    Trace.traceEnd(Trace.TRACE_TAG_SYSTEM_SERVER);
}

}
复制代码可以看到这里利用反射创建了一个service的实例，并且调用了SystemServiceManager中的startService方法
public void startService(@NonNull final SystemService service) {
// Register it.
mServices.add(service);
// Start it.
long time = SystemClock.elapsedRealtime();
try {
service.onStart();
} …
}
复制代码这个startService方法其实就做了两件事，首先将当前的Service加入到mService这个数组中，这个数组保存了需要接收生命周期事件的SystemServer，其次则是调用当前service的onStart方法。而这个service其实就是我们传入的参数ActivityManagerService.Lifecycle.class
public static final class Lifecycle extends SystemService {
private final ActivityManagerService mService;

public Lifecycle(Context context) {
    super(context);
    mService = new ActivityManagerService(context);
}

@Override
public void onStart() {
    mService.start();
}

@Override
public void onBootPhase(int phase) {
    mService.mBootPhase = phase;
    if (phase == PHASE_SYSTEM_SERVICES_READY) {
        mService.mBatteryStatsService.systemServicesReady();
        mService.mServices.systemServicesReady();
    }
}

@Override
public void onCleanupUser(int userId) {
    mService.mBatteryStatsService.onCleanupUser(userId);
}

public ActivityManagerService getService() {
    return mService;
}

}
复制代码可以看到在它的构造方法中创建了一个ActivityManagerService对象，而它的onStart方法则是调用了AMS的start方法，至此AMS的启动流程就结束了。