基于Android U

Zygote 是由 Init 进程通过解析 init.zygote.rc 文件而创建的，Zygote 所对应的可执行程序是 app_process，所对应的源文件是 app_main.cpp，进程名为 zygote。Zygote 启动过程的时序图如下：

app_main

/frameworks/base/cmds/app_process/app_main.cpp
int main(int argc, char* const argv[])
{
    // 参数解析
    ...
        
    // 根据参数，设置对应标志位
    while (i < argc) {
        const char* arg = argv[i++];
        if (strcmp(arg, "--zygote") == 0) {
            zygote = true;
            niceName = ZYGOTE_NICE_NAME;
        } else if (strcmp(arg, "--start-system-server") == 0) {
            startSystemServer = true;
        } else if (strcmp(arg, "--application") == 0) {
            application = true;
        } else if (strncmp(arg, "--nice-name=", 12) == 0) {
            niceName.setTo(arg + 12);
        } else if (strncmp(arg, "--", 2) != 0) {
            className.setTo(arg);
            break;
        } else {
            --i;
            break;
        }
    }

    ...
        
    if (!niceName.isEmpty()) {
        runtime.setArgv0(niceName.string(), true /* setProcName */);
    }

    if (zygote) {  // 如果运行在Zygote进程中
        runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
    } else if (className) {
        runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
    } else {
        fprintf(stderr, "Error: no class name or --zygote supplied.\n");
        app_usage();
        LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");
    }
}

• Zygote 进程都是通过 fork 自身来创建子进程的，这样 Zygote 进程以及它的子进程都可以进入 app_main.cpp 的 main 函数，因此 main 函数中为了区分当前运行在哪个进程，会判断参数 arg 中是否包含了 "--zygote"，如果包含了则说明 main 函数是运行在 Zygote 进程中的；如果包含了 "--start-system-server"，则说明 main 函数是运行在 SystemServer 进程中。
• runtime 是 AppRuntime 对象，AppRuntime 中没有对应函数，而 AppRuntime 继承自 AndroidRuntime，所以 runtime.start() 调用的是 AndroidRuntime 类中的 start 函数。

AndroidRuntime

/frameworks/base/core/jni/AndroidRuntime.cpp
void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
{
    ...

    static const String8 startSystemServer("start-system-server");
    // Whether this is the primary zygote, meaning the zygote which will fork system server.
    bool primary_zygote = false;

    for (size_t i = 0; i < options.size(); ++i) {
        // 传入的参数有start-system-server, primary_zygote设置为true
        if (options[i] == startSystemServer) {
            primary_zygote = true;
           /* track our progress through the boot sequence */
           const int LOG_BOOT_PROGRESS_START = 3000;
           LOG_EVENT_LONG(LOG_BOOT_PROGRESS_START,  ns2ms(systemTime(SYSTEM_TIME_MONOTONIC)));
        }
    }

    ... // 设置环境变量，只列举ANDROID_ROOT，其他的省略
    const char* rootDir = getenv("ANDROID_ROOT");
    if (rootDir == NULL) {
        rootDir = "/system";
        if (!hasDir("/system")) {
            LOG_FATAL("No root directory specified, and /system does not exist.");
            return;
        }
        setenv("ANDROID_ROOT", rootDir, 1);
    }
    ...
        
    JniInvocation jni_invocation;
    jni_invocation.Init(NULL);
    JNIEnv* env;
    // 启动Java虚拟机
    if (startVm(&mJavaVM, &env, zygote, primary_zygote) != 0) {
        return;
    }
    onVmCreated(env);

    // 为Java虚拟机注册JNI方法
    if (startReg(env) < 0) {
        ALOGE("Unable to register all android natives\n");
        return;
    }

    /*
     * We want to call main() with a String array with arguments in it.
     * At present we have two arguments, the class name and an option string.
     * Create an array to hold them.
     */
    jclass stringClass;
    jobjectArray strArray;
    jstring classNameStr;

    stringClass = env->FindClass("java/lang/String");
    assert(stringClass != NULL);
    strArray = env->NewObjectArray(options.size() + 1, stringClass, NULL);
    assert(strArray != NULL);
    // 从app_main的main函数得知className为com.android.internal.os.ZygoteInit
    classNameStr = env->NewStringUTF(className);
    assert(classNameStr != NULL);
    env->SetObjectArrayElement(strArray, 0, classNameStr);

    for (size_t i = 0; i < options.size(); ++i) {
        jstring optionsStr = env->NewStringUTF(options.itemAt(i).string());
        assert(optionsStr != NULL);
        env->SetObjectArrayElement(strArray, i + 1, optionsStr);
    }

    /*
     * Start VM.  This thread becomes the main thread of the VM, and will
     * not return until the VM exits.
     */
    // 将className的"."替换为"/"
    char* slashClassName = toSlashClassName(className != NULL ? className : "");
    // 找到ZygoteInit
    jclass startClass = env->FindClass(slashClassName);
    if (startClass == NULL) {
        ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);
        /* keep going */
    } else {
        // 找到ZygoteInit的main方法
        jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
            "([Ljava/lang/String;)V");
        if (startMeth == NULL) {
            ALOGE("JavaVM unable to find main() in '%s'\n", className);
            /* keep going */
        } else {
            // 通过JNI调用ZygoteInit的main方法
            env->CallStaticVoidMethod(startClass, startMeth, strArray);

#if 0
            if (env->ExceptionCheck())
                threadExitUncaughtException(env);
#endif
        }
    }
    
    ...
}

• 主要做了三件事：

  1. 启动 Java 虚拟机
  2. 注册 JNI 函数
  3. 通过 JNI 调用 ZygoteInit 类的 main 方法

• 最后通过 JNI 调用 ZygoteInit 的 main 方法，是因为 ZygoteInit 的 main 方法是 Java 语言编写的，当前的运行逻辑是在 Native 中，这就需要通过 JNI 来调用 Java，这样 Zygote 就从 Native 层进入了 Java 框架层。此前是没有任何代码进入 Java 框架层的，是 Zygote 开创了 Java 框架层。

ZygoteInit

/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
public static void main(String[] argv) {
    ZygoteServer zygoteServer = null;

    // 标记Zygote开始
    ZygoteHooks.startZygoteNoThreadCreation();

    // 设置Zygote自己的用户组pid
    try {
        Os.setpgid(0, 0);
    } catch (ErrnoException ex) {
        throw new RuntimeException("Failed to setpgid(0,0)", ex);
    }

    Runnable caller;
    try {
        // 读取系统是否已经启动完成
        final long startTime = SystemClock.elapsedRealtime();
        final boolean isRuntimeRestarted = "1".equals(
                SystemProperties.get("sys.boot_completed"));

        // 将行为写入trace log，标记目前处于ZygoteInit阶段
        String bootTimeTag = Process.is64Bit() ? "Zygote64Timing" : "Zygote32Timing";
        TimingsTraceLog bootTimingsTraceLog = new TimingsTraceLog(bootTimeTag,
                Trace.TRACE_TAG_DALVIK);
        bootTimingsTraceLog.traceBegin("ZygoteInit");
        RuntimeInit.preForkInit();

        boolean startSystemServer = false;
        // zygote进程就是一个socket，名称就叫zygote
        String zygoteSocketName = "zygote";
        String abiList = null;
        boolean enableLazyPreload = false;
        // 解析参数设置对应标志位
        for (int i = 1; i < argv.length; i++) {
            if ("start-system-server".equals(argv[i])) {
                startSystemServer = true;
            } else if ("--enable-lazy-preload".equals(argv[i])) {
                enableLazyPreload = true;
            } else if (argv[i].startsWith(ABI_LIST_ARG)) {
                abiList = argv[i].substring(ABI_LIST_ARG.length());
            } else if (argv[i].startsWith(SOCKET_NAME_ARG)) {
                zygoteSocketName = argv[i].substring(SOCKET_NAME_ARG.length());
            } else {
                throw new RuntimeException("Unknown command line argument: " + argv[i]);
            }
        }

        final boolean isPrimaryZygote = zygoteSocketName.equals(Zygote.PRIMARY_SOCKET_NAME);
        if (!isRuntimeRestarted) {
            if (isPrimaryZygote) {
                FrameworkStatsLog.write(FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME_REPORTED,
                        BOOT_TIME_EVENT_ELAPSED_TIME__EVENT__ZYGOTE_INIT_START,
                        startTime);
            } else if (zygoteSocketName.equals(Zygote.SECONDARY_SOCKET_NAME)) {
                FrameworkStatsLog.write(FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME_REPORTED,
                        BOOT_TIME_EVENT_ELAPSED_TIME__EVENT__SECONDARY_ZYGOTE_INIT_START,
                        startTime);
            }
        }

        if (abiList == null) {
            throw new RuntimeException("No ABI list supplied.");
        }

        // In some configurations, we avoid preloading resources and classes eagerly.
        // In such cases, we will preload things prior to our first fork.
        if (!enableLazyPreload) {
            bootTimingsTraceLog.traceBegin("ZygotePreload");
            EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
                    SystemClock.uptimeMillis());
            // 预加载资源
            preload(bootTimingsTraceLog);
            EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
                    SystemClock.uptimeMillis());
            bootTimingsTraceLog.traceEnd(); // ZygotePreload
        }

        // Do an initial gc to clean up after startup
        bootTimingsTraceLog.traceBegin("PostZygoteInitGC");
        gcAndFinalize();
        bootTimingsTraceLog.traceEnd(); // PostZygoteInitGC

        bootTimingsTraceLog.traceEnd(); // ZygoteInit

        // 创建一个用于和SystemServer通信的socket
        // 当SystemServer fork出来后，socket进程将关闭
        Zygote.initNativeState(isPrimaryZygote);

        ZygoteHooks.stopZygoteNoThreadCreation();

        // 创建ZygoteServer
        zygoteServer = new ZygoteServer(isPrimaryZygote);

        if (startSystemServer) {
            // 调用native函数fork server_server进程
            Runnable r = forkSystemServer(abiList, zygoteSocketName, zygoteServer);

            // {@code r == null} in the parent (zygote) process, and {@code r != null} in the
            // child (system_server) process.
            if (r != null) {
                r.run();
                return;
            }
        }

        Log.i(TAG, "Accepting command socket connections");

        // Zygote进入死循环
        caller = zygoteServer.runSelectLoop(abiList);
    } catch (Throwable ex) {
        Log.e(TAG, "System zygote died with fatal exception", ex);
        throw ex;
    } finally {
        if (zygoteServer != null) {
            zygoteServer.closeServerSocket();
        }
    }
    
    ...
    
    }
}

• 主要做了四件事：
  1. 预加载资源；
  2. 创建一个 server 端的 socket：ZygoteServer，接收应用进程 fork 请求；
  3. fork 出 SystemServer 进程；
  4. 进入死循环，poll 阻塞接收 fork 请求。
• 创建了2个 socket，一个是 systemServer socket，通过 Zygote.initNativeState(isPrimaryZygote) 来创建；一个是 zygote socket，通过 new ZygoteServer() 来创建。

ZygoteServer

/frameworks/base/core/java/com/android/internal/os/ZygoteServer.java
ZygoteServer(boolean isPrimaryZygote) {
    mUsapPoolEventFD = Zygote.getUsapPoolEventFD();

    // 创建socket，名称为zygote，路径：/dev/sockets/zygote
    if (isPrimaryZygote) {
        mZygoteSocket = 		Zygote.createManagedSocketFromInitSocket(Zygote.PRIMARY_SOCKET_NAME);
        ...
    }
    ...
}

/frameworks/base/core/java/com/android/internal/os/Zygote.java
static LocalServerSocket createManagedSocketFromInitSocket(String socketName) {
    int fileDesc;
    // 拼接socket的名称，fullSocketName = "ANDROID_SOCKET_zygote"
    final String fullSocketName = ANDROID_SOCKET_PREFIX + socketName;

    try {
        // 得到socket的环境变量的值
        String env = System.getenv(fullSocketName);
        // 将socket环境变量的值转换为文件描述符的参数
        fileDesc = Integer.parseInt(env);
    } catch (RuntimeException ex) {
        throw new RuntimeException("Socket unset or invalid: " + fullSocketName, ex);
    }

    try {
        // 创建文件描述符
        FileDescriptor fd = new FileDescriptor();
        fd.setInt$(fileDesc);
        return new LocalServerSocket(fd);
    } catch (IOException ex) {
        throw new RuntimeException(
            "Error building socket from file descriptor: " + fileDesc, ex);
    }
}

/frameworks/base/core/java/android/net/LocalServerSocket.java
public LocalServerSocket(FileDescriptor fd) throws IOException {
    // 创建服务端socket并持续监听
    impl = new LocalSocketImpl(fd);
    impl.listen(LISTEN_BACKLOG);
    localAddress = impl.getSockAddress();
}

总结

• Zygote 运行于单独的进程中，是所有应用程序进程的孵化器。
• Zygote 进程启动做了以下几件事：
  1. 创建 AppRuntime 并调用其 start 方法，启动 Zygote 进程；
  2. 创建 Java 虚拟机并为 Java 虚拟机注册 JNI 方法；
  3. 通过 JNI 调用 ZygoteInit 的 main 函数进入 Zygote 的 Java 框架层；
  4. 预加载资源；
  5. 创建服务端 socket，fork 出 SystemServer 进程；
  6. 进入死循环，poll 接收 fork 请求。