Zygote进程源码分析之二

3, Java层

Zygoteinit的main方法如下,

public static void main(String argv[]) {
        try {
            RuntimeInit.enableDdms();
            // Start profiling the zygote initialization.
            SamplingProfilerIntegration.start();

            boolean startSystemServer = false;
            String socketName = "zygote";
            String abiList = null;
            for (int i = 1; i < argv.length; i++) {
                if ("start-system-server".equals(argv[i])) {
                    startSystemServer = true;
                } else if (argv[i].startsWith(ABI_LIST_ARG)) {
                    abiList = argv[i].substring(ABI_LIST_ARG.length());
                } else if (argv[i].startsWith(SOCKET_NAME_ARG)) {
                    socketName = argv[i].substring(SOCKET_NAME_ARG.length());
                } else {
                    throw new RuntimeException("Unknown command line argument: " + argv[i]);
                }
            }

            if (abiList == null) {
                throw new RuntimeException("No ABI list supplied.");
            }

            registerZygoteSocket(socketName); //注册socket
            EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
                SystemClock.uptimeMillis());
            preload(); // 加载资源
            EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
                SystemClock.uptimeMillis());

            // Finish profiling the zygote initialization.
            SamplingProfilerIntegration.writeZygoteSnapshot();

            // Do an initial gc to clean up after startup
            gcAndFinalize();

            // Disable tracing so that forked processes do not inherit stale tracing tags from
            // Zygote.
            Trace.setTracingEnabled(false);

            if (startSystemServer) {
                startSystemServer(abiList, socketName);// 启动SystemServer
            }

            Log.i(TAG, "Accepting command socket connections");
            runSelectLoop(abiList); // 进入监听和接受消息的循环

            closeServerSocket();
        } catch (MethodAndArgsCaller caller) {
            caller.run();
        } catch (RuntimeException ex) {
            Log.e(TAG, "Zygote died with exception", ex);
            closeServerSocket();
            throw ex;
        }
    }

3.1注册socket

private static void registerZygoteSocket(String socketName) {
        if (sServerSocket == null) {
            int fileDesc;
            final String fullSocketName = ANDROID_SOCKET_PREFIX + socketName;
            try {
                String env = System.getenv(fullSocketName);
                fileDesc = Integer.parseInt(env);
            } catch (RuntimeException ex) {
                throw new RuntimeException(fullSocketName + " unset or invalid", ex);
            }

            try {
                FileDescriptor fd = new FileDescriptor();
                fd.setInt$(fileDesc);
                sServerSocket = new LocalServerSocket(fd);
            } catch (IOException ex) {
                throw new RuntimeException(
                        "Error binding to local socket '" + fileDesc + "'", ex);
            }
        }
    }

创建一个名为” zygote”的socket.

创建完之后,就监听客户端的请求,一旦接收到请求就处理。

3.2加载资源

将常用的java类和部分framework资源在zygote进程中进行加载,这些资源在所有经zygote进程创建的子进程中都是共享的,主要是为了加快应用程序的启动。

static void preload() {
        Log.d(TAG, "begin preload");
        preloadClasses(); // 预加载java类
        preloadResources();// 预加载系统资源
        preloadOpenGL(); // 预加载opengl库
        preloadSharedLibraries();// 预加载共享库
        preloadTextResources(); // 预加载text资源
        // Ask the WebViewFactory to do any initialization that must run in the zygote process,
        // for memory sharing purposes.
        WebViewFactory.prepareWebViewInZygote();
        Log.d(TAG, "end preload");
    }

zygoteSendArgsAndGetResult函数的参数函数openZygoteSocketIfNeeded首先创建一个socket,并且和ZygoteInit创建的本地socket进行连接。

然后zygoteSendArgsAndGetResult将消息通过socket发送出去。

3.3 启动SystemServer

总体流程图如下,

startSystemServer方法如下,

private static boolean startSystemServer(String abiList, String socketName)
            throws MethodAndArgsCaller, RuntimeException {
        long capabilities = posixCapabilitiesAsBits(
            OsConstants.CAP_BLOCK_SUSPEND,
            OsConstants.CAP_KILL,
            OsConstants.CAP_NET_ADMIN,
            OsConstants.CAP_NET_BIND_SERVICE,
            OsConstants.CAP_NET_BROADCAST,
            OsConstants.CAP_NET_RAW,
            OsConstants.CAP_SYS_MODULE,
            OsConstants.CAP_SYS_NICE,
            OsConstants.CAP_SYS_RESOURCE,
            OsConstants.CAP_SYS_TIME,
            OsConstants.CAP_SYS_TTY_CONFIG
        );
        /* Hardcoded command line to start the system server */
        String args[] = { // SystemServer服务的信息
            "--setuid=1000",
            "--setgid=1000",
            "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1032,3001,3002,3003,3006,3007",
            "--capabilities=" + capabilities + "," + capabilities,
            "--nice-name=system_server",
            "--runtime-args",
            "com.android.server.SystemServer",
        };
        ZygoteConnection.Arguments parsedArgs = null;

        int pid;

        try {
            parsedArgs = new ZygoteConnection.Arguments(args);
            ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
            ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);

            /* Request to fork the system server process */
            pid = Zygote.forkSystemServer(// fork出系统服务对应的进程
                    parsedArgs.uid, parsedArgs.gid,
                    parsedArgs.gids,
                    parsedArgs.debugFlags,
                    null,
                    parsedArgs.permittedCapabilities,
                    parsedArgs.effectiveCapabilities);
        } catch (IllegalArgumentException ex) {
            throw new RuntimeException(ex);
        }

        /* For child process */
        if (pid == 0) {
            if (hasSecondZygote(abiList)) {
                waitForSecondaryZygote(socketName);
            }

            handleSystemServerProcess(parsedArgs); // 新进程成为真正的系统进程
        }

        return true;
    }

handleSystemServerProcess方法中调用了zygoteInit方法,

RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs, cl);

zygoteInit方法如下,

public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
            throws ZygoteInit.MethodAndArgsCaller {
        if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting application from zygote");

        Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "RuntimeInit");
        redirectLogStreams(); //新fork出的系统进程里，需要重新定向系统输出流。

        commonInit(); // 执行简单的初始化,比如设置时区
        nativeZygoteInit();
        applicationInit(targetSdkVersion, argv, classLoader);
    }

app_main.cpp的onZygoteInit方法构造了进程的ProcessState全局对象，而且启动了线程池。ProcessState对于Binder通信机制而言非常重要，现在system server进程的PrecessState算是初始化完毕了。

virtual void onZygoteInit()
    {
        sp<ProcessState> proc = ProcessState::self();
        ALOGV("App process: starting thread pool.\n");
        proc->startThreadPool();
    }

流程图中第20到24步骤。在创建完socket监听时,

invokeStaticMain方法在构造SystemServer之后,会抛出异常,

private static void invokeStaticMain(String className, String[] argv, ClassLoader classLoader)
            throws ZygoteInit.MethodAndArgsCaller {
        Class<?> cl;

        try {
            cl = Class.forName(className, true, classLoader);
        } catch (ClassNotFoundException ex) {
            throw new RuntimeException(
                    "Missing class when invoking static main " + className,
                    ex);
        }

        Method m;
        try {
            m = cl.getMethod("main", new Class[] { String[].class });
        } catch (NoSuchMethodException ex) {
            throw new RuntimeException(
                    "Missing static main on " + className, ex);
        } catch (SecurityException ex) {
            throw new RuntimeException(
                    "Problem getting static main on " + className, ex);
        }

        int modifiers = m.getModifiers();
        if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {
            throw new RuntimeException(
                    "Main method is not public and static on " + className);
        }

        /*
         * This throw gets caught in ZygoteInit.main(), which responds
         * by invoking the exception's run() method. This arrangement
         * clears up all the stack frames that were required in setting
         * up the process.
         */
        throw new ZygoteInit.MethodAndArgsCaller(m, argv);
    }

那么这个异常在哪儿执行呢?回看ZygoteInit 的main方法,

if (startSystemServer) {
                startSystemServer(abiList, socketName); // SystemServer进程
            }

            Log.i(TAG, "Accepting command socket connections");
            runSelectLoop(abiList);

            closeServerSocket();
        } catch (MethodAndArgsCaller caller) { // 检测异常
            caller.run();  // 执行
        }

异常在这里实际上相当于一个goto语句。Run方法如下,

public void run() {
            try {
                mMethod.invoke(null, new Object[] { mArgs });
            } catch (IllegalAccessException ex) {
                throw new RuntimeException(ex);
            } catch (InvocationTargetException ex) {
                Throwable cause = ex.getCause();
                if (cause instanceof RuntimeException) {
                    throw (RuntimeException) cause;
                } else if (cause instanceof Error) {
                    throw (Error) cause;
                }
                throw new RuntimeException(ex);
            }
        }

fork出的SystemServer进程在跳转到catch语句后，会执行SystemServer类的main()函数，而其他情况下，fork出的应用进程在跳转的catch语句后，则会执行ActivityThread类的main()函数。这个ActivityThread对于应用程序而言非常重要.

3.4 runSelectLoop

总体流程图如下,

runSelectLoop方法如下,

private static void runSelectLoop(String abiList) throws MethodAndArgsCaller {
        ArrayList<FileDescriptor> fds = new ArrayList<FileDescriptor>();
        ArrayList<ZygoteConnection> peers = new ArrayList<ZygoteConnection>();

        fds.add(sServerSocket.getFileDescriptor());
        peers.add(null);

        while (true) {
            StructPollfd[] pollFds = new StructPollfd[fds.size()];
            for (int i = 0; i < pollFds.length; ++i) {
                pollFds[i] = new StructPollfd();
                pollFds[i].fd = fds.get(i);
                pollFds[i].events = (short) POLLIN;
            }
            try {
                Os.poll(pollFds, -1);
            } catch (ErrnoException ex) {
                throw new RuntimeException("poll failed", ex);
            }
            for (int i = pollFds.length - 1; i >= 0; --i) {
                if ((pollFds[i].revents & POLLIN) == 0) {
                    continue;
                }
                if (i == 0) {
                    ZygoteConnection newPeer = acceptCommandPeer(abiList);
                    peers.add(newPeer);
                    fds.add(newPeer.getFileDesciptor());
                } else {
                    boolean done = peers.get(i).runOnce();
                    if (done) {
                        peers.remove(i);
                        fds.remove(i);
                    }
                }
            }
        }
    }

在Linux的socket编程中，select()负责监视若干文件描述符的变化情况，我们常见的变化情况有：读、写、异常等等。在zygote中，

err = select(nfds, &fdset, NULL, NULL, NULL);一句的最后三个参数都为NULL，表示该select()操作只打算监视文件描述符的“读变化”，而且如果没有可读的文件，select()就维持阻塞状态。

 

在被监视的文件描述符数组（fds）中，第一个文件描述符对应着“zygote接收其他进程连接申请的那个socket（及sServerSocket）”，一旦它发生了变化，我们就尝试建立一个ZygoteConnection。

如果select动作发现文件描述符数组（fds）的其他文件描述符有东西可读了，说明有其他进程通过某个已建立好的ZygoteConnection发来了命令，此时我们需要调用runOnce()。

runOnce方法如下,

boolean runOnce() throws ZygoteInit.MethodAndArgsCaller {

        String args[];
        Arguments parsedArgs = null;
        FileDescriptor[] descriptors;

        try {
            args = readArgumentList(); // socket读取信息
            descriptors = mSocket.getAncillaryFileDescriptors();
        } catch (IOException ex) {
            Log.w(TAG, "IOException on command socket " + ex.getMessage());
            closeSocket();
            return true;
        }
•••
pid = Zygote.forkAndSpecialize(parsedArgs.uid, parsedArgs.gid, parsedArgs.gids,
                  parsedArgs.debugFlags, rlimits, parsedArgs.mountExternal, parsedArgs.seInfo,
                    parsedArgs.niceName, fdsToClose, parsedArgs.instructionSet,
                    parsedArgs.appDataDir);  // fork子进程
•••
handleChildProc(parsedArgs, descriptors, childPipeFd, newStderr); // 抛出异常,调用子进程的main方法

runOnce主要分为三个步骤,

1,调用readArgumentList方法从socket中读取参数数据。

当AMS需要启动一个新进程时,会调用startProcessLocked方法,最后调用Process的zygoteSendArgsAndGetResult方法通过socket向zygoteState进程发送创建进程的请求。

2,根据参数创建子进程。

3,调用handleChildProc方法抛出异常, 调用子进程的main方法.

4, 小结

作为一个最原始的“受精卵”，zygote必须在合适的时机进行必要的细胞分裂。分裂动作也没什么大的花样，不过就是fork()新进程而已。如果fork()出的新进程是system server，那么其最终执行的就是SystemServer类的main()函数，而如果fork()出的新进程是普通的用户进程的话，那么其最终执行的就是ActivityThread类的main()函数。

  为什么要抛出异常呢,这是因为从ZygoteInit调用开始到最后进入invokeStaticMain方法,系统栈里已经积累了不少调用帧,调用SystemServer或者ActivityThread方法并不会返回,采用抛出异常是为了清除前面调用的栈帧,给新运行的进程一个干净的环境。