Phone Application对象的创建-CSDN博客

在Android Phone进程启动过程中，AMS通过socket将"android.app.ActivityThread"类名等参数发给zygote进程，由ZygoteInit反射调用ActivityThread的main()方法创建Phone Application对象，相关源码：

frameworks/base/core/java/android/os/
  - Process.java
frameworks/base/core/java/com/android/internal/os/
  - ZygoteInit.java
  - ZygoteConnection.java
  - Zygote.java
  - RuntimeInit.java
  - ZygoteConnection.java
frameworks/base/services/core/java/com/android/server/am/
  - ActivityManagerService.java
frameworks/base/core/java/android/app/
  - ActivityThread.java
  - Instrumentation.java
复制代码

具体过程如图：

1、建立socket客户端

Process中创建了LocalSocket类型的zygoteSocket，可以连接到名为String ZYGOTE_SOCKET = "zygote"的进程的Socket，这个Socket对应/dev/socket/zygote。

frameworks/base/core/java/android/os/Process.java

    private static ZygoteState openZygoteSocketIfNeeded(String abi) throws ZygoteStartFailedEx {
        ...
        primaryZygoteState = ZygoteState.connect(ZYGOTE_SOCKET);
        ...
    }
复制代码

 public static ZygoteState connect(String socketAddress) throws IOException {
    ...
            final LocalSocket zygoteSocket = new LocalSocket();
                zygoteSocket.connect(new LocalSocketAddress(socketAddress,
                        LocalSocketAddress.Namespace.RESERVED));
    ...
}
复制代码

2、建立服务端

ZygoteInit中的main函数会创建一个命名为String socketName = "zygote";的LocalServerSocket，在runSelectLoop中建立好每个新的socket连接，并从ZygoteConnection的runOnce方法中读取创建进程所需要的参数。

frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

public static void main(String argv[]) {
    try{
        ...
        String socketName = "zygote";
        ...
        registerZygoteSocket(socketName);
        ...
        Log.i(TAG, "Accepting command socket connections");
        runSelectLoop(abiList);
        ...
    } catch (MethodAndArgsCaller caller) {
        caller.run();//重点，invokeStaticMain抛出异常后在这里处理
    }
}

private static void registerZygoteSocket(String socketName) {
    ...
    sServerSocket = new LocalServerSocket(fd);
    ...
}

private static void runSelectLoop(String abiList) throws MethodAndArgsCaller {
     if (i == 0) {
                    ZygoteConnection newPeer = acceptCommandPeer(abiList);
                    peers.add(newPeer);
                    fds.add(newPeer.getFileDesciptor());
                } else {
                    boolean done = peers.get(i).runOnce();
                }
}
复制代码

3 发送进程参数

客户端与服务端建立好连接后，ActivityManagerService中的startProcessLocked方法会将“android.app.ActivityThread”等类名参数发往服务端 frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

private final void startProcessLocked(ProcessRecord app, String hostingType,
            String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs) {
               ...
            if (entryPoint == null) entryPoint = "android.app.ActivityThread";
复制代码

4 读取进程参数，fork phone进程

在ZygoteConnection的runOnce()中读取创建应用进程所需要的参数，本文中会读到“android.app.ActivityThread”等参数。通过forkAndSpecialize调用native方法fork phone进程。 frameworks/base/core/java/com/android/internal/os/ZygoteConnection.java

 boolean runOnce() throws ZygoteInit.MethodAndArgsCaller {
     args = readArgumentList();
     ...
     parsedArgs = new Arguments(args);
    ...
    pid = Zygote.forkAndSpecialize(parsedArgs.uid, parsedArgs.gid, parsedArgs.gids,
                    parsedArgs.debugFlags, rlimits, parsedArgs.mountExternal, parsedArgs.seInfo,
                    parsedArgs.niceName, fdsToClose, parsedArgs.instructionSet,
                    parsedArgs.appDataDir);//native方式创建phone进程
    ...
     if (pid == 0) {
                handleChildProc(parsedArgs, descriptors, childPipeFd, newStderr);
                return true;
            } else {
                return handleParentProc(pid, descriptors, serverPipeFd, parsedArgs);
            }
    ...
 }
复制代码

客户端的参数解析后传递给handleChildProc frameworks/base/core/java/com/android/internal/os/ZygoteConnection.java

private void handleChildProc(Arguments parsedArgs,
            FileDescriptor[] descriptors, FileDescriptor pipeFd, PrintStream newStderr)
            throws ZygoteInit.MethodAndArgsCaller {
             pipeFd, parsedArgs.remainingArgs);
        ...
            RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion,
                    parsedArgs.remainingArgs, null /* classLoader */);
        }
}
复制代码

frameworks/base/core/java/com/android/internal/os/RuntimeInit.java

public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
            throws ZygoteInit.MethodAndArgsCaller {
                applicationInit(targetSdkVersion, argv, classLoader);
            }

private static void applicationInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
            throws ZygoteInit.MethodAndArgsCaller {
                 args = new Arguments(argv);
             // Remaining arguments are passed to the start class's static main
                 invokeStaticMain(args.startClass, args.startArgs, classLoader);
            }
复制代码

5 抛出MethodAndArgsCaller异常

几经辗转，调用到RuntimeInit的invokeStaticMain，这个方法会抛出MethodAndArgsCaller异常

frameworks/base/core/java/com/android/internal/os/RuntimeInit.java

 private static void invokeStaticMain(String className, String[] argv, ClassLoader classLoader)
            throws ZygoteInit.MethodAndArgsCaller {
            cl = Class.forName(className, true, classLoader);//类名android.app.ActivityThread
            m = cl.getMethod("main", new Class[] { String[].class });//注意main方法
             throw new ZygoteInit.MethodAndArgsCaller(m, argv);//抛出，由ZygoteInit的main方法捕获
}
复制代码

ZygoteInit中的MethodAndArgsCaller类 frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

public static class MethodAndArgsCaller extends Exception
            implements Runnable {

        public void run() {
            try {
                mMethod.invoke(null, new Object[] { mArgs });
            }
        }
    }

复制代码

6 捕获MethodAndArgsCaller，进入ActivityThread的main方法

这个异常会被ZygoteInit的main方法捕获，进入run中，反射调用ActivityThread的main方法了mMethod.invoke(null, new Object[] { mArgs });， frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

public static void main(String argv[]) {
    try{
        ...
    } catch (MethodAndArgsCaller caller) {
        caller.run();//重点，invokeStaticMain抛出异常后在这里处理
    }
}
复制代码

ZygoteInit反射进入ActivityThread的main方法，访问attach方法 frameworks/base/core/java/android/app/ActivityThread.java

public static void main(String[] args) {
    ActivityThread thread = new ActivityThread();
    thread.attach(false);
}
复制代码

private void attach(boolean system) {
     mgr.attachApplication(mAppThread);
}
复制代码

通过AMS访问attachApplication，再访问ActivityThread的bindApplication frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

public final void attachApplication(IApplicationThread thread) {
    attachApplicationLocked(thread, callingPid);
}

private final boolean attachApplicationLocked(IApplicationThread thread,
            int pid) {
                thread.bindApplication(processName, appInfo, providers, app.instrumentationClass,
                    profilerInfo, app.instrumentationArguments, app.instrumentationWatcher,
                    app.instrumentationUiAutomationConnection, testMode, enableOpenGlTrace,
                    isRestrictedBackupMode || !normalMode, app.persistent,
                    new Configuration(mConfiguration), app.compat,
                    getCommonServicesLocked(app.isolated),
                    mCoreSettingsObserver.getCoreSettingsLocked());
            }
复制代码

7 创建Application对象

又回到ActivityThread,发送BIND_APPLICATION消息，在handleBindApplication中处理BIND_APPLICATION，创建Application对象，回调Application的onCreate(); frameworks/base/core/java/android/app/ActivityThread.java

public final void bindApplication(String processName, ApplicationInfo appInfo,
                List<ProviderInfo> providers, ComponentName instrumentationName,
                ProfilerInfo profilerInfo, Bundle instrumentationArgs,
                IInstrumentationWatcher instrumentationWatcher,
                IUiAutomationConnection instrumentationUiConnection, int debugMode,
                boolean enableOpenGlTrace, boolean isRestrictedBackupMode, boolean persistent,
                Configuration config, CompatibilityInfo compatInfo, Map<String, IBinder> services,
                Bundle coreSettings) {
                sendMessage(H.BIND_APPLICATION, data);
                }
                
private void handleBindApplication(AppBindData data) {
    Application app = data.info.makeApplication(data.restrictedBackupMode, null);//创建Application对象
    mInitialApplication = app;
    ...
    mInstrumentation.callApplicationOnCreate(app);
}
复制代码

调用Instrumentation的callApplicationOnCreate回调Application的onCreate方法。

frameworks/base/core/java/android/app/Instrumentation.java

public void callApplicationOnCreate(Application app) {
        app.onCreate();
    }
复制代码

至此Phone Application就创建好了。

system_server进程启动过程