[关闭]
@guhuizaifeiyang 2017-09-04T10:12:42.000000Z 字数 14400 阅读 1809

Android系统进程Zygote启动过程分析

开关机流程

我们知道，Android系统是基于Linux内核的，而在linux系统中，所有的进程都是init进程的子孙进程，也就是说，所有的进程都是直接或者间接地由init进程fork出来的。Zygote进程也不例外，它是在系统启动的过程，由init进程创建的。在系统启动脚本system/core/rootdir/init.rc文件中，我们可以看到启动Zygote进程的脚本命令（MSM8937平台启动Zygote进程的脚本命令放在system/core/rootdir/init.zygote64.rc）：

  1. service zygote /system/bin/app_process64 -Xzygote /system/bin --zygote --start-system-server
  2.     class main
  3.     socket zygote stream 660 root system
  4.     onrestart write /sys/android_power/request_state wake
  5.     onrestart write /sys/power/state on
  6.     onrestart restart audioserver
  7.     onrestart restart cameraserver
  8.     onrestart restart media
  9.     onrestart restart netd
  10.     writepid /dev/cpuset/foreground/tasks
  1. // 详见frameworks/base/cmds/app_process/app_main.cpp：
  2. // arguments :
  3. //
  4. // --zygote : Start in zygote mode
  5. // --start-system-server : Start the system server.
  6. // --application : Start in application (stand alone, non zygote) mode.
  7. // --nice-name : The nice name for this process.

最后的一系列onrestart关键字表示这个zygote进程重启时需要执行的命令。

关于init.rc文件的更多信息，请参考system/core/init/readme.txt文件。

了解了这个信息之后，我们就知道Zygote进程要执行的程序便是system/bin/app_process了，它的源代码位于frameworks/base/cmds/app_process/app_main.cpp文件中，入口函数是main。在继续分析Zygote进程启动的过程之前，我们先来看看它的启动序列图：

Zygote.bmp-2614.5kB

Step 1. app_main.cpp

这个函数定义在frameworks/base/cmds/app_process/app_main.cpp文件中：

  1. int main(int argc, char* const argv[])
  2. {
  3.     ...
  4.     // 1. 隐式创建一个AppRuntime对象：runtime
  5.     AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));
  6.     // Process command line arguments
  7.     // ignore argv[0]
  8.     argc--;
  9.     argv++;
  11.     int i;
  12.     for (i = 0; i < argc; i++) {
  13.         if (argv[i][0] != '-') {
  14.             break;
  15.         }
  16.         if (argv[i][1] == '-' && argv[i][2] == 0) {
  17.             ++i; // Skip --.
  18.             break;
  19.         }
  20.         runtime.addOption(strdup(argv[i]));
  21.     }
  23.     // Parse runtime arguments.  Stop at first unrecognized option.
  24.     bool zygote = false;
  25.     bool startSystemServer = false;
  26.     bool application = false;
  27.     String8 niceName;
  28.     String8 className;
  30.     // 2. 处理输入参数
  31.     ++i;  // Skip unused "parent dir" argument.
  32.     while (i < argc) {
  33.         const char* arg = argv[i++];
  34.         if (strcmp(arg, "--zygote") == 0) {
  35.             zygote = true;
  36.             niceName = ZYGOTE_NICE_NAME;
  37.         } else if (strcmp(arg, "--start-system-server") == 0) {
  38.             startSystemServer = true;
  39.         } else if (strcmp(arg, "--application") == 0) {
  40.             application = true;
  41.         } else if (strncmp(arg, "--nice-name=", 12) == 0) {
  42.             niceName.setTo(arg + 12);
  43.         } else if (strncmp(arg, "--", 2) != 0) {
  44.             className.setTo(arg);
  45.             break;
  46.         } else {
  47.             --i;
  48.             break;
  49.         }
  50.     }
  52.     ...
  54.     if (zygote) {
  55.         // 3. 最终走到这里
  56.         runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
  57.     } else if (className) {
  58.         runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
  59.     } else {
  60.         fprintf(stderr, "Error: no class name or --zygote supplied.\n");
  61.         app_usage();
  62.         LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");
  63.         return 10;
  64.     }
  65. }

AppRuntime
AppRuntime继承了AndroidRuntime

  1. class AppRuntime : public AndroidRuntime  
  2. {  
  3.     ......  
  4. };

由于AppRuntime没有实现自己的start函数，它继承了父类AndroidRuntime的start函数，因此，最终会执行AndroidRuntime类的start函数

Step 2. AndroidRuntime.start

这个函数定义在frameworks/base/core/jni/AndroidRuntime.cpp文件中：

  1. void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
  2. {
  3.     ALOGD(">>>>>> START %s uid %d <<<<<<\n",
  4.             className != NULL ? className : "(unknown)", getuid());
  6.     // 1. 启动SystemServer
  7.     static const String8 startSystemServer("start-system-server");
  9.     // 2. 调用函数startReg注册JNI方法
  10.     /*
  11.      * Register android functions.
  12.      */
  13.     if (startReg(env) < 0) {
  14.         ALOGE("Unable to register all android natives\n");
  15.         return;
  16.     }
  18.     /*
  19.      * We want to call main() with a String array with arguments in it.
  20.      * At present we have two arguments, the class name and an option string.
  21.      * Create an array to hold them.
  22.      */
  23.     jclass stringClass;
  24.     jobjectArray strArray;
  25.     jstring classNameStr;
  27.     stringClass = env->FindClass("java/lang/String");
  28.     assert(stringClass != NULL);
  29.     strArray = env->NewObjectArray(options.size() + 1, stringClass, NULL);
  30.     assert(strArray != NULL);
  31.     classNameStr = env->NewStringUTF(className);
  32.     assert(classNameStr != NULL);
  33.     env->SetObjectArrayElement(strArray, 0, classNameStr);
  35.     for (size_t i = 0; i < options.size(); ++i) {
  36.         jstring optionsStr = env->NewStringUTF(options.itemAt(i).string());
  37.         assert(optionsStr != NULL);
  38.         env->SetObjectArrayElement(strArray, i + 1, optionsStr);
  39.     }
  41.     /*
  42.      * Start VM.  This thread becomes the main thread of the VM, and will
  43.      * not return until the VM exits.
  44.      */
  45.     char* slashClassName = toSlashClassName(className);
  46.     jclass startClass = env->FindClass(slashClassName);
  47.     if (startClass == NULL) {
  48.         ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);
  49.         /* keep going */
  50.     } else {
  51.         jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
  52.             "([Ljava/lang/String;)V");
  53.         if (startMeth == NULL) {
  54.             ALOGE("JavaVM unable to find main() in '%s'\n", className);
  55.             /* keep going */
  56.         } else {
  57.             env->CallStaticVoidMethod(startClass, startMeth, strArray);
  59.     ...
  61. }

这个函数的作用是启动Android系统运行时库，它主要做了三件事情，一是调用函数startVM启动虚拟机，二是调用函数startReg注册JNI方法，三是调用了com.android.internal.os.ZygoteInit类的main函数。

Step 3. ZygoteInit.main

这个函数定义在frameworks/base/core/Java/com/android/internal/os/ZygoteInit.java文件中：

  1. public static void main(String argv[]) {
  2.      ...
  4.     // 1. 调用registerZygoteSocket函数创建了一个socket接口，用来和ActivityManagerService通讯
  5.     registerZygoteSocket(socketName);
  7.    // 2. 调用startSystemServer函数来启动SystemServer组件
  8.     if (startSystemServer) {
  9.         startSystemServer(abiList, socketName);
  10.     }
  12.     // 3. 调用runSelectLoopMode函数
  13.     runSelectLoop(abiList);
  15. }

它主要作了三件事情，一个调用registerZygoteSocket函数创建了一个socket接口，用来和ActivityManagerService通讯，二是调用startSystemServer函数来启动SystemServer组件，三是调用runSelectLoopMode函数进入一个无限循环在前面创建的socket接口上等待ActivityManagerService请求创建新的应用程序进程。

Step 4. ZygoteInit.registerZygoteSocket

这个函数定义在frameworks/base/core/java/com/android/internal/os/ZygoteInit.java文件中：

  1. public class ZygoteInit {  
  2. ......  
  4. /** 
  5. * Registers a server socket for zygote command connections 
  6. * 
  7. * @throws RuntimeException when open fails 
  8. */  
  9. private static void registerZygoteSocket() {  
  10.     if (sServerSocket == null) {  
  11.         int fileDesc;  
  12.         try {  
  13.             String env = System.getenv(ANDROID_SOCKET_ENV);  
  14.             fileDesc = Integer.parseInt(env);  
  15.         } catch (RuntimeException ex) {  
  16.             ......  
  17.         }  
  19.         try {  
  20.             sServerSocket = new LocalServerSocket(  
  21.                 createFileDescriptor(fileDesc));  
  22.         } catch (IOException ex) {  
  23.             .......  
  24.         }  
  25.     }  
  26. }  
  28. ......  
  29. }

这个socket接口是通过文件描述符来创建的，这个文件描符代表的就是我们前面说的/dev/socket/zygote文件了。这个文件描述符是通过环境变量ANDROID_SOCKET_ENV得到的。

Step 5. ZygoteInit.startSystemServer

这个函数定义在frameworks/base/core/java/com/android/internal/os/ZygoteInit.java文件中：

  1. private static boolean startSystemServer(String abiList, String socketName)
  2.         throws MethodAndArgsCaller, RuntimeException {
  3.     ...
  4.     /* Hardcoded command line to start the system server */
  5.     String args[] = {
  6.         "--setuid=1000",
  7.         "--setgid=1000",
  8.         "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1032,3001,3002,3003,3006,3007,3009,3010",
  9.         "--capabilities=" + capabilities + "," + capabilities,
  10.         "--nice-name=system_server",
  11.         "--runtime-args",
  12.         "com.android.server.SystemServer",
  13.     };
  14.     ZygoteConnection.Arguments parsedArgs = null;
  16.     int pid;
  18.     try {
  19.         parsedArgs = new ZygoteConnection.Arguments(args);
  20.         ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
  21.         ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);
  23.         /* Request to fork the system server process */
  24.         pid = Zygote.forkSystemServer(
  25.                 parsedArgs.uid, parsedArgs.gid,
  26.                 parsedArgs.gids,
  27.                 parsedArgs.debugFlags,
  28.                 null,
  29.                 parsedArgs.permittedCapabilities,
  30.                 parsedArgs.effectiveCapabilities);
  31.     } catch (IllegalArgumentException ex) {
  32.         throw new RuntimeException(ex);
  33.     }
  35.     /* For child process */
  36.     if (pid == 0) {
  37.         if (hasSecondZygote(abiList)) {
  38.             waitForSecondaryZygote(socketName);
  39.         }
  41.         handleSystemServerProcess(parsedArgs);
  42.     }
  44.     return true;
  45. }

这里我们可以看到，Zygote进程通过Zygote.forkSystemServer函数来创建一个新的进程来启动SystemServer组件，返回值pid等0的地方就是新的进程要执行的路径，即新创建的进程会执行handleSystemServerProcess函数。

Step 6. ZygoteInit.handleSystemServerProcess

这个函数定义在frameworks/base/core/java/com/android/internal/os/ZygoteInit.java文件中：

  1. public class ZygoteInit {  
  2.     ......  
  4.     private static void handleSystemServerProcess(  
  5.             ZygoteConnection.Arguments parsedArgs)  
  6.             throws ZygoteInit.MethodAndArgsCaller {  
  7.         closeServerSocket();  
  9.         /* 
  10.         * Pass the remaining arguments to SystemServer. 
  11.         * "--nice-name=system_server com.android.server.SystemServer" 
  12.         */  
  13.         RuntimeInit.zygoteInit(parsedArgs.remainingArgs);  
  14.         /* should never reach here */  
  15.     }  
  17.     ......  
  18. }

由于由Zygote进程创建的子进程会继承Zygote进程在前面Step 4中创建的Socket文件描述符，而这里的子进程又不会用到它，因此，这里就调用closeServerSocket函数来关闭它。这个函数接着调用RuntimeInit.zygoteInit函数来进一步执行启动SystemServer组件的操作。

Step 7. RuntimeInit.zygoteInit

这个函数定义在frameworks/base/core/java/com/android/internal/os/RuntimeInit.java文件中：

  1. public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
  2.         throws ZygoteInit.MethodAndArgsCaller {
  3.     if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting application from zygote");
  5.     Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "RuntimeInit");
  6.     redirectLogStreams();
  8.     commonInit();
  9.     nativeZygoteInit();
  10.     applicationInit(targetSdkVersion, argv, classLoader);
  11. }

nativeZygoteInit()是一个Native函数，实现在frameworks/base/core/jni/AndroidRuntime.cpp文件中。

Step 8. AndroidRuntime.com_android_internal_os_RuntimeInit_nativeZygoteInit

Step 9. SystemServer.main

这个函数定义在frameworks/base/services/java/com/android/server/SystemServer.java文件中：

  1. /**
  2.  * The main entry point from zygote.
  3.  */
  4. public static void main(String[] args) {
  5.     new SystemServer().run();
  6. }
  1. private void run() {
  2.     try {
  3.         ...
  5.         // Here we go!
  6.         Slog.i(TAG, "Entered the Android system server!");
  8.         ...
  10.         // Initialize the system context.
  11.         createSystemContext();
  13.         // Create the system service manager.
  14.         mSystemServiceManager = new SystemServiceManager(mSystemContext);
  15.         mSystemServiceManager.setRuntimeRestarted(mRuntimeRestart);
  16.         LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
  17.     } finally {
  18.         Trace.traceEnd(Trace.TRACE_TAG_SYSTEM_SERVER);
  19.     }
  21.     // Start services.
  22.     try {
  23.         Trace.traceBegin(Trace.TRACE_TAG_SYSTEM_SERVER, "StartServices");
  24.         startBootstrapServices();
  25.         startCoreServices();
  26.         startOtherServices();
  27.     } catch (Throwable ex) {
  28.         Slog.e("System", "******************************************");
  29.         Slog.e("System", "************ Failure starting system services", ex);
  30.         throw ex;
  31.     } finally {
  32.         Trace.traceEnd(Trace.TRACE_TAG_SYSTEM_SERVER);
  33.     }
  35.     ...
  37.     // Loop forever.
  38.     Looper.loop();
  39.     throw new RuntimeException("Main thread loop unexpectedly exited");
  40. }

里面主要涉及了是三个方法：
startBootstrapServices() 主要用于启动系统Boot级服务
startCoreServices() 主要用于启动系统核心的服务
startOtherServices() 主要用于启动一些非紧要或者是非需要及时启动的服务

Step 10. SystemServer.startBootstrapServices

  1. private void startBootstrapServices() {
  2.     // 1. start Installer
  3.     Installer installer = mSystemServiceManager.startService(Installer.class);
  5.     // 2. start ActivityManagerService
  6.     // Activity manager runs the show.
  7.     mActivityManagerService = mSystemServiceManager.startService(
  8.             ActivityManagerService.Lifecycle.class).getService();
  9.     mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
  10.     mActivityManagerService.setInstaller(installer);
  12.     // 3. start PowerManagerService
  13.     mPowerManagerService = mSystemServiceManager.startService(PowerManagerService.class);
  15.     // 4. initialize power management features.
  16.     mActivityManagerService.initPowerManagement();
  18.     // 5. start LightsService
  19.     mSystemServiceManager.startService(LightsService.class);
  21.     // 6. start DisplayManagerService
  22.     // starts up.
  23.     mDisplayManagerService = mSystemServiceManager.startService(DisplayManagerService.class);
  25.     // 7. Start the package manager.
  26.     mPackageManagerService = PackageManagerService.main(mSystemContext, installer,
  27.             mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore);
  28.     mFirstBoot = mPackageManagerService.isFirstBoot();
  29.     mPackageManager = mSystemContext.getPackageManager();
  31.     ...
  33.     // 8. start UserManagerService
  34.     mSystemServiceManager.startService(UserManagerService.LifeCycle.class);
  36.     // 9. Initialize attribute cache used to cache resources from packages.
  37.     AttributeCache.init(mSystemContext);
  39.     // 10. Set up the Application instance for the system process and get started.
  40.     mActivityManagerService.setSystemProcess();
  42.     // 11. start SensorService
  43.     startSensorService();
  44. }

可见，BootstrapServices中启动了：
1. ActivityManagerService
2. PowerManagerService
3. LightsService
4. DisplayManagerService
5. UserManagerService
6. SensorService

Step 11. startCoreServices

  1. /**
  2.  * Starts some essential services that are not tangled up in the bootstrap process.
  3.  */
  4. private void startCoreServices() {
  5.     // Tracks the battery level.  Requires LightService.
  6.     mSystemServiceManager.startService(BatteryService.class);
  8.     // Tracks application usage stats.
  9.     mSystemServiceManager.startService(UsageStatsService.class);
  10.     mActivityManagerService.setUsageStatsManager(
  11.             LocalServices.getService(UsageStatsManagerInternal.class));
  13.     // Tracks whether the updatable WebView is in a ready state and watches for update installs.
  14.     mWebViewUpdateService = mSystemServiceManager.startService(WebViewUpdateService.class);
  15. }

CoreServices中启动了：

  1. BatteryService
  2. UsageStatsService
  3. WebViewUpdateService

Step 12. startOtherServices

  1. try {
  2.     // 1. add SchedulingPolicyService
  3.     ServiceManager.addService("scheduling_policy", new SchedulingPolicyService());
  5.     // 2. start TelecomLoaderService
  6.     mSystemServiceManager.startService(TelecomLoaderService.class);
  8.     // 3. add telephonyRegistry  
  9.     telephonyRegistry = new TelephonyRegistry(context);
  10.     ServiceManager.addService("telephony.registry", telephonyRegistry);
  12.     if (!disableCameraService) {
  13.         // 4. start CameraService
  14.         mSystemServiceManager.startService(CameraService.class);
  15.     }
  17.     // The AccountManager must come before the ContentService
  18.     // 5. start AccountManager
  19.     mSystemServiceManager.startService(ACCOUNT_SERVICE_CLASS);
  21.     // 6. start ContentService
  22.     mSystemServiceManager.startService(CONTENT_SERVICE_CLASS);
  24.     // 7. InstallSystemProviders
  25.     mActivityManagerService.installSystemProviders();
  27.     // 8. start VibratorService
  28.     vibrator = new VibratorService(context);
  29.     ServiceManager.addService("vibrator", vibrator);
  31.     if (!disableConsumerIr) {
  32.         // 9. start ConsumerIrService
  33.         consumerIr = new ConsumerIrService(context);
  34.         ServiceManager.addService(Context.CONSUMER_IR_SERVICE, consumerIr);
  35.     }
  37.     // 10. start AlarmManagerService
  38.     mSystemServiceManager.startService(AlarmManagerService.class);
  40.     // 11. init InitWatchdog
  41.     final Watchdog watchdog = Watchdog.getInstance();
  42.     watchdog.init(context, mActivityManagerService);
  44.     // 12. start InputManagerService
  45.     inputManager = new InputManagerService(context);
  47.     // 13. start WindowManagerService
  48.     wm = WindowManagerService.main(context, inputManager,
  49.             mFactoryTestMode != FactoryTest.FACTORY_TEST_LOW_LEVEL,
  50.             !mFirstBoot, mOnlyCore);
  51.     ServiceManager.addService(Context.WINDOW_SERVICE, wm);
  52.     ServiceManager.addService(Context.INPUT_SERVICE, inputManager);
  54.     if (!disableVrManager) {
  55.         // 14. start VrManagerService
  56.         mSystemServiceManager.startService(VrManagerService.class);
  57.     }
  59.     mActivityManagerService.setWindowManager(wm);
  61.     inputManager.setWindowManagerCallbacks(wm.getInputMonitor());
  62.     inputManager.start();
  64.     // 15. start BluetoothService
  65.     mSystemServiceManager.startService(BluetoothService.class);
  67.     // 16. start MetricsLoggerService
  68.     mSystemServiceManager.startService(MetricsLoggerService.class);
  70.     // 17. start IpConnectivityMetrics
  71.     mSystemServiceManager.startService(IpConnectivityMetrics.class);
  73.     // 18. start PinnerService
  74.     mSystemServiceManager.startService(PinnerService.class);
  75. } catch (RuntimeException e) {
  76.     ...
  77. }

// TODO
可以看出，otherServices中启动了大量的Services，后续再详细分析。
1. CameraService
2. ContentService
3. AlarmManagerService
4. InputManagerService
5. WindowManagerService
6. BluetoothService
...

总结：

  1. SystemServer进程是android中一个很重要的进程由Zygote进程启动；

  2. SystemServer进程主要用于启动系统中的服务；

  3. SystemServer进程启动服务的启动函数为main函数；

  4. SystemServer进程将系统服务分为三类：boot服务，core服务和other服务，并逐步启动

  5. 当我们需要启动一个Android应用程序时，ActivityManagerService会通过Socket进程间通信机制，通知Zygote进程为这个应用程序创建一个新的进程。

添加新批注
在作者公开此批注前，只有你和作者可见。
回复批注