Zygote进程启动流程

博客同步至github博客：Zygote进程启动流程

使用到的相关源码：https://github.com/JesusYoung/AndroidResourceCode9.0/tree/master

基于Android 9.0

1、Zygote进程

Zygote是在init进程启动时创建的，它又称为孵化器，它可以通过fork（复制进程）的形式来创建应用程序进程和SystemServer进程，并且，Zygote进程在启动的时候会创建DVM或者ART，因此通过fork而创建的应用程序进程和SystemServer进程可以在内部获取一个DVM或者ART的实例副本；

2、Zygote进程启动流程

2.1、Init进程调用

2.1.1、解析配置参数

Init进程启动之后，解析init.rc配置文件，执行其配置，其中有启动Zygote进程的参数配置，在app_main.cpp的main()方法中，先解析参数，例如在前面解析.rc文件时添加的参数“–zygote、----start-system-server”等，初始化各种标识位；

int main(int argc, char* const argv[]) {
	...
  ++i;  // Skip unused "parent dir" argument.
  while (i < argc) {
    const char* arg = argv[i++];
    if (strcmp(arg, "--zygote") == 0) {
      zygote = true;
      niceName = ZYGOTE_NICE_NAME;
    } else if (strcmp(arg, "--start-system-server") == 0) {
      startSystemServer = true;
    } else if (strcmp(arg, "--application") == 0) {
      application = true;
    } else if (strncmp(arg, "--nice-name=", 12) == 0) {
      niceName.setTo(arg + 12);
    } else if (strncmp(arg, "--", 2) != 0) {
      className.setTo(arg);
      break;
    } else {
      --i;
      break;
    }
  }
  ...
}

2.1.2、启动Dalvik虚拟机

接着判断className是否为空，在Zygote模式下，调用maybeCreateDalvikCache()函数创建Dalvik虚拟机缓存，添加启动systemServer的参数标识；

int main(int argc, char* const argv[]) {
	...
	if (!className.isEmpty()) {
    ...
  } else {
    // We're in zygote mode.
    maybeCreateDalvikCache();
    if (startSystemServer) {
      args.add(String8("start-system-server"));
    }
    char prop[PROP_VALUE_MAX];
    if (property_get(ABI_LIST_PROPERTY, prop, NULL) == 0) {
      LOG_ALWAYS_FATAL("app_process: Unable to determine ABI list from property %s.", ABI_LIST_PROPERTY);
      return 11;
    }
    String8 abiFlag("--abi-list=");
    abiFlag.append(prop);
    args.add(abiFlag);
    // In zygote mode, pass all remaining arguments to the zygote main() method.
    // 在Zygote模式下，将剩余的参数全部传递过去
    for (; i < argc; ++i) {
      args.add(String8(argv[i]));
    }
    ...
}

2.2、启动Zygote

2.2.1、创建AppRunTime对象

在main()函数中创建了AppRunTime对象，AppRunTime对象继承自AndroidRunTime类；

int main(int argc, char* const argv[]) {
  ...
  AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));
  ...
}

class AppRuntime : public AndroidRuntime {
  public:
  AppRuntime(char* argBlockStart, const size_t argBlockLength)
    : AndroidRuntime(argBlockStart, argBlockLength) , mClass(NULL) {
    }
  ...
}

2.2.2、AppRunTime启动Zygote

随后调用AppRunTime类的start()方法来启动Zygote进程，在前面判断中得知zygote参数为true；

if (zygote) {
  runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
} else if (className) {
  runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
} else {
  ...
}

AppRunTime类继承自AndroidRunTime类，AppRunTime类并没有重载start()方法，所以这里执行的是AndroidRunnTime类的start()方法；

2.2.3、注册JNI

首先会初始化一些环境rootDir等，然后会启动虚拟机，调用startReg()函数向虚拟机注册Android Native方法；

拿到前面传入的类名，即com.android.internal.os.ZygoteInit，通过JNI调用其main()方法，因为此处为C代码，而ZygoteInit为Java类，所以调用时需要使用JNI方式去调用，此时，正式从C层进入Java层；

class AppRuntime : public AndroidRuntime {}

void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote) {
  ...
  // 启动虚拟机
  if (startVm(&mJavaVM, &env, zygote) != 0) {
    return;
  }
  ...
  // 向虚拟机注册Android Native方法
  if (startReg(env) < 0) {
    ALOGE("Unable to register all android natives\n");
    return;
  }
  ...
  char* slashClassName = toSlashClassName(className != NULL ? className : "");
  jclass startClass = env->FindClass(slashClassName);
  if (startClass == NULL) {
    ...
  } else {
    // 找到main()方法
    jmethodID startMeth = env->GetStaticMethodID(startClass, "main", "([Ljava/lang/String;)V");
    if (startMeth == NULL) {
      ...
    } else {
      // 调用ZygoteInit类的main()方法
      env->CallStaticVoidMethod(startClass, startMeth, strArray);
      #if 0
      if (env->ExceptionCheck())
        threadExitUncaughtException(env);
      #endif
    }
  }
  ...
}

2.2.4、启动进入Java层Zygote

Zygote进程启动，在ZygoteInit的main()方法中，通过调用ZygoteHooks类的startZygoteNoThreadCreation()函数来抛出异常，标识Zygote进程已经启动；

public static void main(String argv[]) {
  ZygoteServer zygoteServer = new ZygoteServer();
  // Mark zygote start. This ensures that thread creation will throw
  // an error.
  ZygoteHooks.startZygoteNoThreadCreation();
  ...
}

2.3、创建Zygote进程Socket

2.3.1、创建服务端socket

在ZygoteInit的main()函数中，创建了ZygoteServer对象，作为Zygote进程的socket通信的服务端，名为zygote，用来接收SystemServer进程向Zygote进程发来的请求，例如AMS向Zygote进程请求创建新应用等，接着调用runSelectLoop()来等待SystemServer进程发来的请求；

public static void main(String argv[]) {
  ZygoteServer zygoteServer = new ZygoteServer();
  ...
  try {
    ...
    zygoteServer.registerServerSocketFromEnv(socketName);
    ...
    caller = zygoteServer.runSelectLoop(abiList);
  }
  ...
  if (caller != null) {
    caller.run();
  }
}

// ZygoteServer 
void registerServerSocketFromEnv(String socketName) {
  if (mServerSocket == null) {
    int fileDesc;
    final String fullSocketName = ANDROID_SOCKET_PREFIX + socketName;
    try {
      String env = System.getenv(fullSocketName);
      fileDesc = Integer.parseInt(env);
    } catch (RuntimeException ex) {
      throw new RuntimeException(fullSocketName + " unset or invalid", ex);
    }
    try {
      FileDescriptor fd = new FileDescriptor();
      fd.setInt$(fileDesc);
      mServerSocket = new LocalServerSocket(fd);
      mCloseSocketFd = true;
    } catch (IOException ex) {
      throw new RuntimeException("Error binding to local socket '" + fileDesc + "'", ex);
    }
  }
}

2.3.2、执行客户端请求

轮询客户端Socket消息，当客户端有新消息到来时，创建一个新的连接去执行客户端发来的请求，例如AMS请求创建新的进程；

新建一个peers列表，用于存储每个客户端的连接，将fd数据转存到poolFds中，遍历，当i=0时表示有客户端与服务端连接成功，此时执行acceptCommandPeer()方法拿到新的连接，并将其存入到peers集合中，当i>0时，表示客户端在向服务端传输数据，从peers中拿出与客户端的连接，执行processOneCommand()函数得到一个Runnable对象，如果是fork子进程并且任务不为null则返回该Runnable对象，在main()函数中，如果该对象不为空，就去执行其run()方法；

Runnable runSelectLoop(String abiList) {
  ArrayList<FileDescriptor> fds = new ArrayList<FileDescriptor>();
  ArrayList<ZygoteConnection> peers = new ArrayList<ZygoteConnection>();
  fds.add(mServerSocket.getFileDescriptor());
  peers.add(null);
  while (true) {
    StructPollfd[] pollFds = new StructPollfd[fds.size()];
    for (int i = 0; i < pollFds.length; ++i) {
      pollFds[i] = new StructPollfd();
      pollFds[i].fd = fds.get(i);
      pollFds[i].events = (short) POLLIN;
    }
    ...
    for (int i = pollFds.length - 1; i >= 0; --i) {
      ...
      if (i == 0) {
        ZygoteConnection newPeer = acceptCommandPeer(abiList);
        peers.add(newPeer);
        fds.add(newPeer.getFileDesciptor());
      } else {
        try {
          ZygoteConnection connection = peers.get(i);
          final Runnable command = connection.processOneCommand(this);
          if (mIsForkChild) {
            // We're in the child. We should always have a command to run at this
            // stage if processOneCommand hasn't called "exec".
            if (command == null) {
              throw new IllegalStateException("command == null");
            }
            return command;
          } else {
            // We're in the server - we should never have any commands to run.
            if (command != null) {
              throw new IllegalStateException("command != null");
            }
            // We don't know whether the remote side of the socket was closed or
            // not until we attempt to read from it from processOneCommand. This shows up as
            // a regular POLLIN event in our regular processing loop.
            if (connection.isClosedByPeer()) {
              connection.closeSocket();
              peers.remove(i);
              fds.remove(i);
            }
          }
        }
        ...
      }
    }
  }
}

执行processOneCommand()方法时，创建fork子进程的Runnable对象，如果是在父进程中，则返回null，子进程中则会返回fork子进程的Runnable对象，去执行fork操作，并且清除掉fork过来的父进程中的socket信息；

Runnable processOneCommand(ZygoteServer zygoteServer) {
  ...
  pid = Zygote.forkAndSpecialize(parsedArgs.uid, parsedArgs.gid, parsedArgs.gids,
                                 parsedArgs.runtimeFlags, rlimits, parsedArgs.mountExternal, 
                                 parsedArgs.seInfo, parsedArgs.niceName, fdsToClose, 
                                 fdsToIgnore, parsedArgs.startChildZygote,
                                 parsedArgs.instructionSet, parsedArgs.appDataDir);
  try {
    if (pid == 0) {
      // in child
      zygoteServer.setForkChild();
      zygoteServer.closeServerSocket();
      IoUtils.closeQuietly(serverPipeFd);
      serverPipeFd = null;
      return handleChildProc(parsedArgs, descriptors, childPipeFd, parsedArgs.startChildZygote);
    } else {
      // In the parent. A pid < 0 indicates a failure and will be handled in
      // handleParentProc.
      IoUtils.closeQuietly(childPipeFd);
      childPipeFd = null;
      handleParentProc(pid, descriptors, serverPipeFd);
      return null;
    }
    ...
}

2.4、启动SystemServer

Zygote进程启动后，执行ZygoteInit类的main()方法，启动会调用forkSystemServer()方法去通过fork自身的方式去创建SystemServer进程；

public static void main(String argv[]) {
	...
  try {
  	...
    if (startSystemServer) {
      Runnable r = forkSystemServer(abiList, socketName, zygoteServer);
      // {@code r == null} in the parent (zygote) process, and {@code r != null} in the
      // child (system_server) process.
      if (r != null) {
        r.run();
        return;
      }
    }
    ...
  }
  ...
}