3, Java层
Zygoteinit的main方法如下,
public static void main(String argv[]) {
try {
RuntimeInit.enableDdms();
// Start profiling the zygote initialization.
SamplingProfilerIntegration.start();
boolean startSystemServer = false;
String socketName = "zygote";
String abiList = null;
for (int i = 1; i < argv.length; i++) {
if ("start-system-server".equals(argv[i])) {
startSystemServer = true;
} else if (argv[i].startsWith(ABI_LIST_ARG)) {
abiList = argv[i].substring(ABI_LIST_ARG.length());
} else if (argv[i].startsWith(SOCKET_NAME_ARG)) {
socketName = argv[i].substring(SOCKET_NAME_ARG.length());
} else {
throw new RuntimeException("Unknown command line argument: " + argv[i]);
}
}
if (abiList == null) {
throw new RuntimeException("No ABI list supplied.");
}
registerZygoteSocket(socketName); //注册socket
EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
SystemClock.uptimeMillis());
preload(); // 加载资源
EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
SystemClock.uptimeMillis());
// Finish profiling the zygote initialization.
SamplingProfilerIntegration.writeZygoteSnapshot();
// Do an initial gc to clean up after startup
gcAndFinalize();
// Disable tracing so that forked processes do not inherit stale tracing tags from
// Zygote.
Trace.setTracingEnabled(false);
if (startSystemServer) {
startSystemServer(abiList, socketName);// 启动SystemServer
}
Log.i(TAG, "Accepting command socket connections");
runSelectLoop(abiList); // 进入监听和接受消息的循环
closeServerSocket();
} catch (MethodAndArgsCaller caller) {
caller.run();
} catch (RuntimeException ex) {
Log.e(TAG, "Zygote died with exception", ex);
closeServerSocket();
throw ex;
}
}
3.1注册socket
private static void registerZygoteSocket(String socketName) {
if (sServerSocket == null) {
int fileDesc;
final String fullSocketName = ANDROID_SOCKET_PREFIX + socketName;
try {
String env = System.getenv(fullSocketName);
fileDesc = Integer.parseInt(env);
} catch (RuntimeException ex) {
throw new RuntimeException(fullSocketName + " unset or invalid", ex);
}
try {
FileDescriptor fd = new FileDescriptor();
fd.setInt$(fileDesc);
sServerSocket = new LocalServerSocket(fd);
} catch (IOException ex) {
throw new RuntimeException(
"Error binding to local socket '" + fileDesc + "'", ex);
}
}
}
创建一个名为” zygote”的socket.
创建完之后,就监听客户端的请求,一旦接收到请求就处理。
3.2加载资源
将常用的java类和部分framework资源在zygote进程中进行加载,这些资源在所有经zygote进程创建的子进程中都是共享的,主要是为了加快应用程序的启动。
static void preload() {
Log.d(TAG, "begin preload");
preloadClasses(); // 预加载java类
preloadResources();// 预加载系统资源
preloadOpenGL(); // 预加载opengl库
preloadSharedLibraries();// 预加载共享库
preloadTextResources(); // 预加载text资源
// Ask the WebViewFactory to do any initialization that must run in the zygote process,
// for memory sharing purposes.
WebViewFactory.prepareWebViewInZygote();
Log.d(TAG, "end preload");
}
zygoteSendArgsAndGetResult函数的参数函数openZygoteSocketIfNeeded首先创建一个socket,并且和ZygoteInit创建的本地socket进行连接。
然后zygoteSendArgsAndGetResult将消息通过socket发送出去。
3.3 启动SystemServer
总体流程图如下,
startSystemServer方法如下,
private static boolean startSystemServer(String abiList, String socketName)
throws MethodAndArgsCaller, RuntimeException {
long capabilities = posixCapabilitiesAsBits(
OsConstants.CAP_BLOCK_SUSPEND,
OsConstants.CAP_KILL,
OsConstants.CAP_NET_ADMIN,
OsConstants.CAP_NET_BIND_SERVICE,
OsConstants.CAP_NET_BROADCAST,
OsConstants.CAP_NET_RAW,
OsConstants.CAP_SYS_MODULE,
OsConstants.CAP_SYS_NICE,
OsConstants.CAP_SYS_RESOURCE,
OsConstants.CAP_SYS_TIME,
OsConstants.CAP_SYS_TTY_CONFIG
);
/* Hardcoded command line to start the system server */
String args[] = { // SystemServer服务的信息
"--setuid=1000",
"--setgid=1000",
"--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1032,3001,3002,3003,3006,3007",
"--capabilities=" + capabilities + "," + capabilities,
"--nice-name=system_server",
"--runtime-args",
"com.android.server.SystemServer",
};
ZygoteConnection.Arguments parsedArgs = null;
int pid;
try {
parsedArgs = new ZygoteConnection.Arguments(args);
ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);
/* Request to fork the system server process */
pid = Zygote.forkSystemServer(// fork出系统服务对应的进程
parsedArgs.uid, parsedArgs.gid,
parsedArgs.gids,
parsedArgs.debugFlags,
null,
parsedArgs.permittedCapabilities,
parsedArgs.effectiveCapabilities);
} catch (IllegalArgumentException ex) {
throw new RuntimeException(ex);
}
/* For child process */
if (pid == 0) {
if (hasSecondZygote(abiList)) {
waitForSecondaryZygote(socketName);
}
handleSystemServerProcess(parsedArgs); // 新进程成为真正的系统进程
}
return true;
}
handleSystemServerProcess方法中调用了zygoteInit方法,
RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs, cl);
zygoteInit方法如下,
public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
throws ZygoteInit.MethodAndArgsCaller {
if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting application from zygote");
Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "RuntimeInit");
redirectLogStreams(); //新fork出的系统进程里，需要重新定向系统输出流。
commonInit(); // 执行简单的初始化,比如设置时区
nativeZygoteInit();
applicationInit(targetSdkVersion, argv, classLoader);
}
app_main.cpp的onZygoteInit方法构造了进程的ProcessState全局对象，而且启动了线程池。ProcessState对于Binder通信机制而言非常重要，现在system server进程的PrecessState算是初始化完毕了。
virtual void onZygoteInit()
{
sp<ProcessState> proc = ProcessState::self();
ALOGV("App process: starting thread pool.\n");
proc->startThreadPool();
}
流程图中第20到24步骤。在创建完socket监听时,
invokeStaticMain方法在构造SystemServer之后,会抛出异常,
private static void invokeStaticMain(String className, String[] argv, ClassLoader classLoader)
throws ZygoteInit.MethodAndArgsCaller {
Class<?> cl;
try {
cl = Class.forName(className, true, classLoader);
} catch (ClassNotFoundException ex) {
throw new RuntimeException(
"Missing class when invoking static main " + className,
ex);
}
Method m;
try {
m = cl.getMethod("main", new Class[] { String[].class });
} catch (NoSuchMethodException ex) {
throw new RuntimeException(
"Missing static main on " + className, ex);
} catch (SecurityException ex) {
throw new RuntimeException(
"Problem getting static main on " + className, ex);
}
int modifiers = m.getModifiers();
if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {
throw new RuntimeException(
"Main method is not public and static on " + className);
}
/*
* This throw gets caught in ZygoteInit.main(), which responds
* by invoking the exception's run() method. This arrangement
* clears up all the stack frames that were required in setting
* up the process.
*/
throw new ZygoteInit.MethodAndArgsCaller(m, argv);
}
那么这个异常在哪儿执行呢?回看ZygoteInit 的main方法,
if (startSystemServer) {
startSystemServer(abiList, socketName); // SystemServer进程
}
Log.i(TAG, "Accepting command socket connections");
runSelectLoop(abiList);
closeServerSocket();
} catch (MethodAndArgsCaller caller) { // 检测异常
caller.run(); // 执行
}
异常在这里实际上相当于一个goto语句。Run方法如下,
public void run() {
try {
mMethod.invoke(null, new Object[] { mArgs });
} catch (IllegalAccessException ex) {
throw new RuntimeException(ex);
} catch (InvocationTargetException ex) {
Throwable cause = ex.getCause();
if (cause instanceof RuntimeException) {
throw (RuntimeException) cause;
} else if (cause instanceof Error) {
throw (Error) cause;
}
throw new RuntimeException(ex);
}
}
fork出的SystemServer进程在跳转到catch语句后，会执行SystemServer类的main()函数，而其他情况下，fork出的应用进程在跳转的catch语句后，则会执行ActivityThread类的main()函数。这个ActivityThread对于应用程序而言非常重要.
3.4 runSelectLoop
总体流程图如下,
runSelectLoop方法如下,
private static void runSelectLoop(String abiList) throws MethodAndArgsCaller {
ArrayList<FileDescriptor> fds = new ArrayList<FileDescriptor>();
ArrayList<ZygoteConnection> peers = new ArrayList<ZygoteConnection>();
fds.add(sServerSocket.getFileDescriptor());
peers.add(null);
while (true) {
StructPollfd[] pollFds = new StructPollfd[fds.size()];
for (int i = 0; i < pollFds.length; ++i) {
pollFds[i] = new StructPollfd();
pollFds[i].fd = fds.get(i);
pollFds[i].events = (short) POLLIN;
}
try {
Os.poll(pollFds, -1);
} catch (ErrnoException ex) {
throw new RuntimeException("poll failed", ex);
}
for (int i = pollFds.length - 1; i >= 0; --i) {
if ((pollFds[i].revents & POLLIN) == 0) {
continue;
}
if (i == 0) {
ZygoteConnection newPeer = acceptCommandPeer(abiList);
peers.add(newPeer);
fds.add(newPeer.getFileDesciptor());
} else {
boolean done = peers.get(i).runOnce();
if (done) {
peers.remove(i);
fds.remove(i);
}
}
}
}
}
在Linux的socket编程中，select()负责监视若干文件描述符的变化情况，我们常见的变化情况有：读、写、异常等等。在zygote中，
err = select(nfds, &fdset, NULL, NULL, NULL);一句的最后三个参数都为NULL，表示该select()操作只打算监视文件描述符的“读变化”，而且如果没有可读的文件，select()就维持阻塞状态。
在被监视的文件描述符数组（fds）中，第一个文件描述符对应着“zygote接收其他进程连接申请的那个socket（及sServerSocket）”，一旦它发生了变化，我们就尝试建立一个ZygoteConnection。
如果select动作发现文件描述符数组（fds）的其他文件描述符有东西可读了，说明有其他进程通过某个已建立好的ZygoteConnection发来了命令，此时我们需要调用runOnce()。
runOnce方法如下,
boolean runOnce() throws ZygoteInit.MethodAndArgsCaller {
String args[];
Arguments parsedArgs = null;
FileDescriptor[] descriptors;
try {
args = readArgumentList(); // socket读取信息
descriptors = mSocket.getAncillaryFileDescriptors();
} catch (IOException ex) {
Log.w(TAG, "IOException on command socket " + ex.getMessage());
closeSocket();
return true;
}
•••
pid = Zygote.forkAndSpecialize(parsedArgs.uid, parsedArgs.gid, parsedArgs.gids,
parsedArgs.debugFlags, rlimits, parsedArgs.mountExternal, parsedArgs.seInfo,
parsedArgs.niceName, fdsToClose, parsedArgs.instructionSet,
parsedArgs.appDataDir); // fork子进程
•••
handleChildProc(parsedArgs, descriptors, childPipeFd, newStderr); // 抛出异常,调用子进程的main方法
runOnce主要分为三个步骤,
1,调用readArgumentList方法从socket中读取参数数据。
当AMS需要启动一个新进程时,会调用startProcessLocked方法,最后调用Process的zygoteSendArgsAndGetResult方法通过socket向zygoteState进程发送创建进程的请求。
2,根据参数创建子进程。
3,调用handleChildProc方法抛出异常, 调用子进程的main方法.
4, 小结
作为一个最原始的“受精卵”，zygote必须在合适的时机进行必要的细胞分裂。分裂动作也没什么大的花样，不过就是fork()新进程而已。如果fork()出的新进程是system server，那么其最终执行的就是SystemServer类的main()函数，而如果fork()出的新进程是普通的用户进程的话，那么其最终执行的就是ActivityThread类的main()函数。
为什么要抛出异常呢,这是因为从ZygoteInit调用开始到最后进入invokeStaticMain方法,系统栈里已经积累了不少调用帧,调用SystemServer或者ActivityThread方法并不会返回,采用抛出异常是为了清除前面调用的栈帧,给新运行的进程一个干净的环境。