android java fork,Android系统启动分析(二)

本节是本系列文章的第二篇,将分析Zygote进程的启动过程。

二、Zygote进程启动

上节分析了Init进程的启动流程。本节将进入到framework层,分析Zygote进程的启动流程。

本节涉及到的文件有:文件

路径

app_main.cpp

framework/cmds/app_process/app_main.cpp

AndroidRuntime.cpp

frameworks/base/core/jni/AndroidRuntime.cpp

ZygoteInit.java

frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

ZygoteServer.java

frameworks/base/core/java/com/android/internal/os/ZygoteServer.java

2.1 app_main.main()

大家都知道Zygote进程相当于是Android的根进程,后面所有进程都是该进程fork出来的,而Zygote进程则是由Init进程fork而来。先看看Zygote进程是如何启动的。

进入到app_main的main()函数

framework/cmds/app_process/app_main.cpp

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37int main(int argc, char* const argv[])

{

……

AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));

……

//注释1:解析传进来的参数

while (i < argc) {

const char* arg = argv[i++];

if (strcmp(arg, "--zygote") == 0) {

zygote = true;

niceName = ZYGOTE_NICE_NAME;

} else if (strcmp(arg, "--start-system-server") == 0) {

startSystemServer = true;

} else if (strcmp(arg, "--application") == 0) {

application = true;

} else if (strncmp(arg, "--nice-name=", 12) == 0) {

niceName.setTo(arg + 12);

} else if (strncmp(arg, "--", 2) != 0) {

className.setTo(arg);

break;

} else {

--i;

break;

}

}

……

//注释2

if (zygote) {

runtime.start("com.android.internal.os.ZygoteInit", args, zygote);

} else if (className) {

runtime.start("com.android.internal.os.RuntimeInit", args, zygote);

} else {

fprintf(stderr, "Error: no class name or --zygote supplied.\n");

app_usage();

……

}

}

注释1处:将解析传进来的参数,由init.zygote64_32.rc文件可知,传进来的参数为:“-Xzygote /system/bin –zygote –start-system-server –socket-name=zygote”,因此argv[]数组大小为4,执行过注释1处的while循环后,zygote = true,startSystemServer = true

注释2处:将执行runtime.start(“com.android.internal.os.ZygoteInit”, args, zygote)

2.2 AppRuntime.startframework/cmds/app_process/app_main.cpp

AppRuntime定义在app_main.cpp中

1

2

3

4class AppRuntime : public AndroidRuntime

{

……

}

其父类为AndroidRuntime类,AppRuntime并没有实现start方法,因此前面的调用将会进入到AndroidRuntime的start()函数。

frameworks/base/core/jni/AndroidRuntime.cpp

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55void AndroidRuntime::start(const char* className, const Vector& options, bool zygote)

{

……

//获取根目录

const char* rootDir = getenv("ANDROID_ROOT");

if (rootDir == NULL) {

rootDir = "/system";

if (!hasDir("/system")) {

LOG_FATAL("No root directory specified, and /android does not exist.");

return;

}

setenv("ANDROID_ROOT", rootDir, 1);

}

//注释1:创建虚拟机

JniInvocation jni_invocation;

jni_invocation.Init(NULL);

JNIEnv* env;

if (startVm(&mJavaVM, &env, zygote) != 0) {

return;

}

//回调AppRuntime的onVmCreate函数

onVmCreated(env);

//注释2:注册JNI函数

if (startReg(env) < 0) {

ALOGE("Unable to register all android natives\n");

return;

}

……

//注释3:将classname的"."替换为"/"

//如: "com.android.internal.os.ZygoteInit"替换为"com/android/internal/os/ZygoteInit"

char* slashClassName = toSlashClassName(className != NULL ? className : "");

//根据路径找到class文件

jclass startClass = env->FindClass(slashClassName);

if (startClass == NULL) {

……

} else {

//注释4:通过反射找到ZygoteInit.main()函数

jmethodID startMeth = env->GetStaticMethodID(startClass, "main",

"([Ljava/lang/String;)V");

if (startMeth == NULL) {

……

} else {

//注释5:调用ZygoteInit.main()函数

env->CallStaticVoidMethod(startClass, startMeth, strArray);

}

}

free(slashClassName);

if (mJavaVM->DetachCurrentThread() != JNI_OK)

ALOGW("Warning: unable to detach main thread\n");

if (mJavaVM->DestroyJavaVM() != 0)

ALOGW("Warning: VM did not shut down cleanly\n");

}

注释1处:jni_invocation.Init(NULL)初始化JNI,调用startVm() 创建Java虚拟机

注释2处:通过startReg()注册JNI函数,定义Android创建线程的函数:javaCreateThreadEtc

注释3处:toSlashClassName()将classname的”.”替换为”/“

注释4、5:通过JNI调用ZygoteInit.main()函数,至此,Zygote进程来到了Java代码。

2.3 ZygoteInit.main()frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59public static void main(String argv[]){

ZygoteServer zygoteServer = new ZygoteServer();

……

final Runnable caller;

//注释1:设置DDMS可用

RuntimeInit.enableDdms();

boolean startSystemServer = false;

String socketName = "zygote";

String abiList = null;

boolean enableLazyPreload = false;

//根据参数处理一些标志

for (int i = 1; i < argv.length; i++) {

if ("start-system-server".equals(argv[i])) {

startSystemServer = true;

} else if ("--enable-lazy-preload".equals(argv[i])) {

enableLazyPreload = true;

} else if (argv[i].startsWith(ABI_LIST_ARG)) {

abiList = argv[i].substring(ABI_LIST_ARG.length());

} else if (argv[i].startsWith(SOCKET_NAME_ARG)) {

socketName = argv[i].substring(SOCKET_NAME_ARG.length());

} else {

throw new RuntimeException("Unknown command line argument: " + argv[i]);

}

}

……

//注释2:创建一个Server端的值为"zygote"的Socket

zygoteServer.registerServerSocket(socketName);

if (!enableLazyPreload) {

//注释3

preload(bootTimingsTraceLog);

} else {

Zygote.resetNicePriority();

}

// Zygote process unmounts root storage spaces.

Zygote.nativeUnmountStorageOnInit();

ZygoteHooks.stopZygoteNoThreadCreation();

if (startSystemServer) {

//注释4:启动SystemServer进程

Runnable r = forkSystemServer(abiList, socketName, zygoteServer);

//在Zygote进程中,r == null;在子进程中,r != null

if (r != null) {

r.run();

return;

}

}

//注释5:死循环,等待客户端请求

caller = zygoteServer.runSelectLoop(abiList);

} catch (Throwable ex) {

Log.e(TAG, "System zygote died with exception", ex);

throw ex;

} finally {

zygoteServer.closeServerSocket();

}

if (caller != null) {

caller.run();

}

}

注释1处:设置DDMS可用,DDMS在Zygote进程刚刚开始启动时便已设置

注释2处:创建一个值为”zygote”的Socket服务端,可以看到这里Zygote作为Server端,处理客户端的请求

注释3处:初始化Zygote中需要的Class类,初始化各类系统资源和库

注释4处:fork一个SystemServer进程

注释5处:调用ZygoteServer的runSelectLoop方法等待客户端(AMS)的创建新进程的请求点我跳转

2.3.1 registerServerSocketframeworks/base/core/java/com/android/internal/os/ZygoteServer.java

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24void registerServerSocket(String socketName){

if (mServerSocket == null) {

int fileDesc;

//拼接SocketName,"ANDROID_SOCKET_"+socketName

final String fullSocketName = ANDROID_SOCKET_PREFIX + socketName;

try {

String env = System.getenv(fullSocketName);

fileDesc = Integer.parseInt(env);

} catch (RuntimeException ex) {

throw new RuntimeException(fullSocketName + " unset or invalid", ex);

}

try {

FileDescriptor fd = new FileDescriptor();

//设置文件描述符

fd.setInt$(fileDesc);

//创建Socket的本地服务端,将文件描述符赋值给LocalServerSocket

mServerSocket = new LocalServerSocket(fd);

} catch (IOException ex) {

throw new RuntimeException(

"Error binding to local socket '" + fileDesc + "'", ex);

}

}

}

2.3.2 预加载类和资源 preload()frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16static void preload(TimingsTraceLog bootTimingsTraceLog){

//预加载Zygote需要用到的Class类

//class文件的地址为:"/system/etc/preloaded-classes"

preloadClasses();

//加载drawable和color等资源

preloadResources();

nativePreloadAppProcessHALs();

//预加载OpenGL

preloadOpenGL();

//调用System.loadLibrary()预加载"android"、"compiler_rt"、"jnigraphics"三个共享库

preloadSharedLibraries();

//初始化字体资源

preloadTextResources();

WebViewFactory.prepareWebViewInZygote();

warmUpJcaProviders();

}

2.3.3 forkSystemServer()

frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44private static Runnable forkSystemServer(String abiList, String socketName,

ZygoteServer zygoteServer){

……

//注释1:准备一些启动参数

String args[] = {

"--setuid=1000",

"--setgid=1000",

"--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1023,1032,3001,3002,3003,3006,3007,3009,3010",

"--capabilities=" + capabilities + "," + capabilities,

"--nice-name=system_server",

"--runtime-args",

"com.android.server.SystemServer",

};

ZygoteConnection.Arguments parsedArgs = null;

int pid;

try {

//注释2:将启动参数封装到ZygoteConnection.Arguments中

parsedArgs = new ZygoteConnection.Arguments(args);

ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);

ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);

//注释3:调用Zygote.forkSystemServer()

pid = Zygote.forkSystemServer(

parsedArgs.uid, parsedArgs.gid,

parsedArgs.gids,

parsedArgs.debugFlags,

null,

parsedArgs.permittedCapabilities,

parsedArgs.effectiveCapabilities);

} catch (IllegalArgumentException ex) {

throw new RuntimeException(ex);

}

//如果pid == 0,当前代码逻辑运行在子进程中

if (pid == 0) {

//如果有第二个Zygote,则等待第二个Zygote连接

if (hasSecondZygote(abiList)) {

waitForSecondaryZygote(socketName);

}

zygoteServer.closeServerSocket();

//注释4:处理SystemServer进程

return handleSystemServerProcess(parsedArgs);

}

return null;

}

注释1处:准备一些SystemServer进程的启动参数,类名为:com.android.server.SystemServer

注释2处:将启动参数封装到ZygoteConnection.Arguments中,具体在ZygoteConnection#parseArgs(),这里不再详细分析。

注释3处:调用Zygote.forkSystemServer(),可以看到SystemServer进程是被Zygote进程fork而来。最后会通过native方法nativeForkSystemServer()创建新进程。关于nativeForkSystemServer()的实现,可见frameworks/base/core/jni/com_android_internal_os_Zygote.cpp

注释4处:如果注释3处返回的pid == 0,则此时代码逻辑运行在子进程中,这里会调用handleSystemServerProcess()来处理SystemServer进程。

关于SysetmServer进程,将在第三节分析。点我跳转

2.3.4 runSelectLoop()

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48Runnable runSelectLoop(String abiList){

ArrayList fds = new ArrayList();

ArrayList peers = new ArrayList();

//注释1:添加服务端的文件描述符到一个集合中

fds.add(mServerSocket.getFileDescriptor());

peers.add(null);

//死循环,等待AMS的请求

while (true) {

StructPollfd[] pollFds = new StructPollfd[fds.size()];

//将要观察的fd建立成数组

for (int i = 0; i < pollFds.length; ++i) {

pollFds[i] = new StructPollfd();

pollFds[i].fd = fds.get(i);

pollFds[i].events = (short) POLLIN;

}

try {

//注释2:阻塞等待fd的变化

Os.poll(pollFds, -1);

} catch (ErrnoException ex) {

throw new RuntimeException("poll failed", ex);

}

//注释3:当fd有变化时(客户端有连接时),会进入该for循环

for (int i = pollFds.length - 1; i >= 0; --i) {

if ((pollFds[i].revents & POLLIN) == 0) {

continue;

}

if (i == 0) {

//注释4:fds[0],即mServerSocket对象

ZygoteConnection newPeer = acceptCommandPeer(abiList);

peers.add(newPeer);

fds.add(newPeer.getFileDesciptor());

} else {

try {

//注释5:

ZygoteConnection connection = peers.get(i);

final Runnable command = connection.processOneCommand(this);

if (mIsForkChild) {

……

return command;

}

} catch (Exception e) {

……

}

}

}

}

}

注释1处:添加服务端的文件描述符到fds集合中,文件描述符是在ZygoteServer.registerServerSocket()中创建,并封装给LocalServerSocket

注释2处:该处语句会阻塞,若fd发生变化,则解除阻塞状态

注释3处:若注释2处的语句解除阻塞,则会执行该处的for循环

注释4处: i==0时,意味着有客户端连接请求,创建新连接并处理请求

注释5处: i>0,说明客户端(AMS)向Zygote发送了一个创建应用进程的请求,processOneCommand()方法会调用Zygote.forkAndSpecialize() fork一个新的VM实例,最终会进入到com_android_internal_os_Zygote.nativeForkAndSpecialize()函数。由于篇幅限制,这里不做过多介绍,感兴趣的读者可以自己去看。

2.4 Zygote进程启动总结

Zygote进程启动过程中主要做了以下几件事:

调用AppRuntime.start()方法创建Java虚拟机,注册JNI函数

通过JNI调用ZygoteInit.main()方法

创建一个值为”zygote”的Socket服务端

预加载类和资源

创建SystemServer进程,并通过runSelectLoop()进入死循环监听Socket消息

Zygote进程的启动分析到这里结束。下一节将介绍SystemServer进程的启动过程。

Android系统启动分析(三)