Android4.4 framework分析——Zygote進程的啟動過程

Android啟動過程中的第一個進程init，在啟動過程中會啟動兩個關鍵的系統服務進程ServiceManager和Zygote。本文要介紹的就是Zygote進程的啟動，Zygote俗稱孵化器，專門用於生產(啟動)新的進程。Zygote是在Init.rc(aosp/system/core/rootdir)裡描述並由init進程啟動的。相關代碼如下:

service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
    class main
    socket zygote stream 660 root system
    onrestart write /sys/android_power/request_state wake
    onrestart write /sys/power/state on
    onrestart restart media
    onrestart restart netd

init.rc文件的語法描述可以參考aosp/system/core/init/readme.txt。

zygote的path路徑為/system/bin/app_process，-Xzygote /system/bin --zygote --start-system-server是它的參數，所屬class是main，同屬同一個class的進程會同時啟動或者停止，會啟動一個socket名為zygote，重啟時將做四個操作。

下面是Zygote進程啟動的大致時序圖:

Android啟動過程中，init進程使用aZ喎?/kf/ware/vc/" target="_blank" class="keylink">vc3Avc3lzdGVtL2NvcmUvaW5pdC9Jbml0X3BhcnNlci5jveLO9mluaXQucmO9xbG+zsS8/qGjPC9wPgo8cD4gICAgIHN0ZXAxo6zRrbu3xvS2r2luaXQucmPOxLz+w+jK9rXEy/nT0Ne0zKyyu86qU1ZDX0RJU0FCTEVEtcRzZXJ2aWNlo6xmb3JrKCnQwr34s8yhozwvcD4KPHA+ICAgICBzdGVwMqOsxvS2r1p5Z290ZaOs1rTQ0GFwcF9tYWluLmNwcLXEbWFpbigpt723qKOsPC9wPgo8cD48cHJlIGNsYXNzPQ=="brush:java;"> // Parse runtime arguments. Stop at first unrecognized option. bool zygote = false; bool startSystemServer = false; bool application = false; const char* parentDir = NULL; const char* niceName = NULL; const char* className = NULL; while (i < argc) {//main的參數匹配 const char* arg = argv[i++]; if (!parentDir) { parentDir = arg; } else if (strcmp(arg, "--zygote") == 0) { zygote = true; niceName = "zygote"; } else if (strcmp(arg, "--start-system-server") == 0) { startSystemServer = true; } else if (strcmp(arg, "--application") == 0) { application = true; } else if (strncmp(arg, "--nice-name=", 12) == 0) { niceName = arg + 12; } else { className = arg; break; } } if (niceName && *niceName) { setArgv0(argv0, niceName); set_process_name(niceName); } runtime.mParentDir = parentDir; if (zygote) { runtime.start("com.android.internal.os.ZygoteInit", startSystemServer ? "start-system-server" : ""); } else if (className) { ...... } else { ...... }step3，啟動AppRuntime，AppRuntime繼承自AndroidRuntime，這裡需要做的事情有:

    /* start the virtual machine */
    JniInvocation jni_invocation;
    jni_invocation.Init(NULL);
    JNIEnv* env;
    if (startVm(&mJavaVM, &env) != 0) {//step4，創建JVM
        return;
    }
    onVmCreated(env);

    /*
     * Register android functions.
     */
    if (startReg(env) < 0) {//step6，在JVM中注冊android本地方法
        ALOGE("Unable to register all android natives\n");
        return;
    }

step7～step8，啟動ZygoteInit的main()方法，傳入一個字符串數組，strArray[0]="com.android.internal.os.ZygoteInit"，strArray[1] = "start-system-server"。

step9，registerZygoteSocket()注冊服務端socket，這個socket就是前面提到的zygote，在init進程解析init.rc時創建。

   public static void main(String argv[]) {
        try {
            // Start profiling the zygote initialization.
            SamplingProfilerIntegration.start();

            registerZygoteSocket();
            .......
            preload();
            .......

            // Do an initial gc to clean up after startup
            gc();
            ......

            if (argv[1].equals("start-system-server")) {
                startSystemServer();//step11
            } else if (!argv[1].equals("")) {
                throw new RuntimeException(argv[0] + USAGE_STRING);
            }

            runSelectLoop();

            closeServerSocket();
        } catch (MethodAndArgsCaller caller) {
            caller.run();
        } catch (RuntimeException ex) {
            Log.e(TAG, "Zygote died with exception", ex);
            closeServerSocket();
            throw ex;
        }

step11，開始啟動SystemServer進程，系統啟動的關鍵進程。

  private static boolean startSystemServer()
            throws MethodAndArgsCaller, RuntimeException {
         ......
        /* Hardcoded command line to start the system server */
        String args[] = {
            "--setuid=1000",
            "--setgid=1000",
            "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1032,3001,3002,3003,3006,3007",
            "--capabilities=" + capabilities + "," + capabilities,
            "--runtime-init",
            "--nice-name=system_server",
            "com.android.server.SystemServer",
        };
        ZygoteConnection.Arguments parsedArgs = null;

        int pid;

        try {
            .......

            /* Request to fork the system server process */
            pid = Zygote.forkSystemServer(
                    parsedArgs.uid, parsedArgs.gid,
                    parsedArgs.gids,
                    parsedArgs.debugFlags,
                    null,
                    parsedArgs.permittedCapabilities,
                    parsedArgs.effectiveCapabilities);
        } catch (IllegalArgumentException ex) {
            throw new RuntimeException(ex);
        }

        /* For child process */
        if (pid == 0) {
            handleSystemServerProcess(parsedArgs);//step12
        }

        return true;
    }

Zygote.forkSystemServer()中會fork出一個新進程，是即將啟動的SystemServer進程，是Zygote的子進程。如果成功fork出新的子進程，這裡將會返回兩次，一次返回Zygote的pid，值大於0，這裡返回執行step29，進入loop，等待ActivityManagerService調用startProcessLocked()啟動新的進程，這個過程參考Android4.4 framework分析——startService的創建過程 的step12~step35;另一次返回SystemServer的進程id，等於0，將執行step12~step28。

參考：

http://blog.csdn.net/luoshengyang/article/details/6768304

www.cnblogs.com/bastard/archive/2012/08/28/2660389.html

右鍵復制圖片地址，在浏覽器中打開即可查看大圖。

未完待續，有不對的地方，請指正。