Zygote启动流程（AndroidV）

一：背景

众所周知，Android应用及system_server基本都是由zygote fork出来的，那么zygote是如何启动的、又是如何接收fork进程的请求，接下来一步步揭秘。

二：启动流程

init进程是Android系统启动时，启动的第一个进程，其他所有进程基本都是由init进程来启动，其中也包括zygote，下面看下zygote的启动。

2.1 init进程启动zygote

init.rc里，在late-init阶段会触发zygote-start，zygote-start会启动zygote服务。在zygote服务中会启动app_process64（即zygote）并传入必要参数。

//system/core/rootdir/init.rc
on late-init
    ...
    # Now we can start zygote.
    trigger zygote-start
    ...

//system/core/rootdir/init.rc
on zygote-start
    ...
    # 启动zygote服务
    start zygote
    start zygote_secondary

//system/core/rootdir/init.zygote64.rc
#启动app_process64时传参：-Xzygote /system/bin --zygote --start-system-server --socket-name=zygote
service zygote /system/bin/app_process64 -Xzygote /system/bin --zygote --start-system-server --socket-name=zygote
    class main
    priority -20
    ...

2.2 zygote初始化

2.2.1 AndroidRuntime.start

• 启动java虚拟机，根据"dalvik.vm.xxx"属性值进行初始化

• 注册jni函数

• 调用ZygoteInit的main函数

  //frameworks/base/cmds/app_main.cpp
  int main(int argc, char* const argv[])
  {
  ...
  bool zygote = false;
  bool startSystemServer = false;
  bool application = false;
  String8 niceName;
  String8 className;

    ++i;  // Skip unused "parent dir" argument.
    //获取启动参数并根据参数初始化zygote、startSystemServer等值
    while (i < argc) {
        const char* arg = argv[i++];
        if (strcmp(arg, "--zygote") == 0) {
            zygote = true;
            niceName = ZYGOTE_NICE_NAME;
        } else if (strcmp(arg, "--start-system-server") == 0) {
            startSystemServer = true;
        } else if (strcmp(arg, "--application") == 0) {
            application = true;
        } else if (strncmp(arg, "--nice-name=", 12) == 0) {
            niceName = (arg + 12);
        } else if (strncmp(arg, "--", 2) != 0) {
            className = arg;
            break;
        } else {
            --i;
            break;
        }
    }
    ...
    if (zygote) {
        runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
    ...

  }

  //frameworks/base/core/jni/AndroidRuntime.cpp
  void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
  {
  ...
  bool primary_zygote = false;
  for (size_t i = 0; i < options.size(); ++i) {
  if (options[i] == startSystemServer) {
  primary_zygote = true;
  /* track our progress through the boot sequence /
  const int LOG_BOOT_PROGRESS_START = 3000;
  LOG_EVENT_LONG(LOG_BOOT_PROGRESS_START, ns2ms(systemTime(SYSTEM_TIME_MONOTONIC)));
  addBootEvent("boot_progress_start");
  }
  }
  ...
  //启动java虚拟机，根据"dalvik.vm.xxx"属性值进行初始化
  if (startVm(&mJavaVM, &env, zygote, primary_zygote) != 0) {
  return;
  }
  ...
  //注册jni函数
  if (startReg(env) < 0) {
  ALOGE("Unable to register all android natives\n");
  return;
  }
  ...
  //将className中的.替换为/ ，转换之后slashClassName的值为"com/android/internal/os/ZygoteInit"
  char slashClassName = toSlashClassName(className != NULL ? className : "");
  jclass startClass = env->FindClass(slashClassName);
  if (startClass == NULL) {
  ...
  } else {
  //获取main函数
  jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
  "([Ljava/lang/String;)V");
  if (startMeth == NULL) {
  ...
  } else {
  //调用ZygoteInit的main函数
  env->CallStaticVoidMethod(startClass, startMeth, strArray);
  }
  }
  ...
  }

2.2.2 ZygoteInit.main

• 在fork前做一些初始化工作，主要是enable DDMS

• 提前加载框架通用类和系统资源

• fork进程之前进行一次gc

• 初始化seLinux

• 初始化storage

• 创建zygote的服务端对象

  //frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
  public static void main(String[] argv) {
  ZygoteServer zygoteServer = null;
  ...

        //zygote运行在单独的进程组中
        try {
            Os.setpgid(0, 0);
        }
        ...
  
        Runnable caller;
        try {
            ...
            bootTimingsTraceLog.traceBegin("ZygoteInit");
            //做fork前的一些初始化工作，主要是enable DDMS
            RuntimeInit.preForkInit();
  
            boolean startSystemServer = false;
            String zygoteSocketName = "zygote";
            String abiList = null;
            boolean enableLazyPreload = false;
            //根据传参做初始化
            for (int i = 1; i < argv.length; i++) {
                if ("start-system-server".equals(argv[i])) {
                    startSystemServer = true;
                } else if ("--enable-lazy-preload".equals(argv[i])) {
                    enableLazyPreload = true;
                } else if (argv[i].startsWith(ABI_LIST_ARG)) {
                    abiList = argv[i].substring(ABI_LIST_ARG.length());
                } else if (argv[i].startsWith(SOCKET_NAME_ARG)) {
                    zygoteSocketName = argv[i].substring(SOCKET_NAME_ARG.length());
                } else {
                    throw new RuntimeException("Unknown command line argument: " + argv[i]);
                }
            }
  
            final boolean isPrimaryZygote = zygoteSocketName.equals(Zygote.PRIMARY_SOCKET_NAME);
            ...
            if (!enableLazyPreload) {
                bootTimingsTraceLog.traceBegin("ZygotePreload");
                EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
                        SystemClock.uptimeMillis());
                //提前加载框架通用类和系统资源
                preload(bootTimingsTraceLog);
                EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
                        SystemClock.uptimeMillis());
                bootTimingsTraceLog.traceEnd(); // ZygotePreload
            }
  
            bootTimingsTraceLog.traceBegin("PostZygoteInitGC");
            //fork进程之前进行一次gc
            gcAndFinalize();
            bootTimingsTraceLog.traceEnd(); // PostZygoteInitGC
  
            bootTimingsTraceLog.traceEnd(); // ZygoteInit
  
            ...
            //native初始化
            Zygote.initNativeState(isPrimaryZygote);
            ...
            //创建zygote的服务端对象
            zygoteServer = new ZygoteServer(isPrimaryZygote);
  
  
            if (startSystemServer) {
                //fork system_server进程
                Runnable r = forkSystemServer(abiList, zygoteSocketName, zygoteServer);
                if (r != null) {
                    r.run();
                    return;
                }
            }
  
            ...
            caller = zygoteServer.runSelectLoop(abiList);
        }
        ...
  
        //在单独的线程中接收来自应用的zygote请求
        if (caller != null) {
            caller.run();
        }
    }

  //frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
  static void preload(TimingsTraceLog bootTimingsTraceLog) {
  ...
  //加载/system/etc/preloaded-classes定义的所有的类
  preloadClasses();
  ...
  //加载frameworks/base/core/res/res/values/arrays.xml中preloaded_drawables和preloaded_color_state_lists定义的所有资源
  Resources.preloadResources();
  ...
  //加载graphic的hal
  nativePreloadAppProcessHALs();
  ...
  //加载graphic
  maybePreloadGraphicsDriver();
  ...
  //加载android、jnigraphics、compiler_rt这三个共享库
  preloadSharedLibraries();
  //加载字体资源
  preloadTextResources();
  ...
  }

  //frameworks/base/core/java/com/android/internal/os/Zygote.java
  static void initNativeState(boolean isPrimary) {
  nativeInitNativeState(isPrimary);
  }

  //frameworks/base/core/jni/com_android_internal_os_Zygote.cpp
  static void com_android_internal_os_Zygote_nativeInitNativeState(JNIEnv* env, jclass,
  jboolean is_primary) {
  //从环境中获取init创建的文件描述符。
  gZygoteSocketFD =
  android_get_control_socket(is_primary ? "zygote" : "zygote_secondary");
  ...
  //创建用于向system_server发送未经请求的消息的socket，在app申请zygote fork进程时被调用，fork完成后关闭
  initUnsolSocketToSystemServer();
  ...
  //初始化seLinux
  gIsSecurityEnforced = security_getenforce();
  selinux_android_seapp_context_init();

  //初始化storage
  UnmountStorageOnInit(env);
  
  //设置高优先级
  if (!SetTaskProfiles(0, {})) {
    zygote::ZygoteFailure(env, "zygote", nullptr, "Zygote SetTaskProfiles failed");
  }

  }

2.2.3 ZygoteInit.forkSystemServer

• 设置启动system_server的参数，例如uid、gid、进程名称等

• 调用Linux的fork函数来实现fork system_server进程

  //frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
  private static Runnable forkSystemServer(String abiList, String socketName,
  ZygoteServer zygoteServer) {
  ...
  //设置启动system_server的参数
  String[] args = {
  "--setuid=1000",
  "--setgid=1000",
  "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1023,"
  + "1024,1032,1065,3001,3002,3003,3005,3006,3007,3009,3010,3011,3012",
  "--capabilities=" + capabilities + "," + capabilities,
  "--nice-name=system_server",
  "--runtime-args",
  "--target-sdk-version=" + VMRuntime.SDK_VERSION_CUR_DEVELOPMENT,
  "com.android.server.SystemServer",
  };
  ...
  try {
  ...
  //fork system_server
  pid = Zygote.forkSystemServer(...);
  }
  ...

        //子进程
        if (pid == 0) {
            ...
            zygoteServer.closeServerSocket();
            return handleSystemServerProcess(parsedArgs);
        }
        ...
    }

  //frameworks/base/core/java/com/android/internal/os/Zygote.java
  static int forkSystemServer(int uid, int gid, int[] gids, int runtimeFlags,
  int[][] rlimits, long permittedCapabilities, long effectiveCapabilities) {
  ZygoteHooks.preFork();

        int pid = nativeForkSystemServer(
                uid, gid, gids, runtimeFlags, rlimits,
                permittedCapabilities, effectiveCapabilities);
  
        //设置线程优先级为NORM_PRIORITY
        Thread.currentThread().setPriority(Thread.NORM_PRIORITY);
        //ZygoteHooks.postForkCommon是Zygote进程中的一个钩子函数，它在Zygote进程fork出子进程后被调用。这个钩子函数的作用是在子进程中执行一些初始化操作，例如创建Binder线程池和消息循环等。
        ZygoteHooks.postForkCommon();
        return pid;
    }

  //frameworks/base/core/jni/com_android_internal_os_Zygote.cpp
  static jint com_android_internal_os_Zygote_nativeForkSystemServer(...) {
  ...
  pid_t pid = zygote::ForkCommon(env, true,
  fds_to_close,
  fds_to_ignore,
  true);
  ...
  return pid;
  }

  //frameworks/base/core/jni/com_android_internal_os_Zygote.cpp
  pid_t zygote::ForkCommon(JNIEnv* env, bool is_system_server,
  const std::vector<int>& fds_to_close,
  const std::vector<int>& fds_to_ignore,
  bool is_priority_fork,
  bool purge) {
  ATRACE_CALL();
  if (is_priority_fork) {//设置最大优先级
  setpriority(PRIO_PROCESS, 0, PROCESS_PRIORITY_MAX);
  }

  //设置信号处理程序
  SetSignalHandlers();
  ...
  //阻断信号
  BlockSignal(SIGCHLD, fail_fn);
  
  ...
  //真正fork进程的地方，在父进程中，fork()返回新创建子进程的PID，而在子进程中，fork()返回0。
  pid_t pid = fork();
  
  ...
  //解除阻断信号
  UnblockSignal(SIGCHLD, fail_fn);
  
  if (is_priority_fork && pid != 0) {//设置优先级为PROCESS_PRIORITY_DEFAULT
    setpriority(PRIO_PROCESS, 0, PROCESS_PRIORITY_DEFAULT);
  }
  
  return pid;

  }

2.2.4 RuntimeInit.applicationInit

• 获取SystemServer.java类对应的ClassLoader
• 初始化时区、User-Agent等
• 开启线程池
• 调用SystemServer的main函数，开始启动系统服务等

这个时候system_server进程就启动了，开始启动系统服务等

//frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
    private static Runnable handleSystemServerProcess(ZygoteArguments parsedArgs) {
        ...
        if (parsedArgs.mInvokeWith != null) {
            ...
        } else {
            //获取SystemServer.java类对应的ClassLoader
            ClassLoader cl = getOrCreateSystemServerClassLoader();
            ...
            return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion,
                    parsedArgs.mDisabledCompatChanges,
                    parsedArgs.mRemainingArgs, cl);
        }
    }

//frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
    public static Runnable zygoteInit(int targetSdkVersion, long[] disabledCompatChanges,
            String[] argv, ClassLoader classLoader) {
        ...
        //初始化时区、User-Agent等
        RuntimeInit.commonInit();
        //开启线程池
        ZygoteInit.nativeZygoteInit();
        return RuntimeInit.applicationInit(targetSdkVersion, disabledCompatChanges, argv,
                classLoader);
    }

//frameworks/base/core/java/com/android/internal/os/RuntimeInit.java
    protected static Runnable applicationInit(int targetSdkVersion, long[] disabledCompatChanges,
            String[] argv, ClassLoader classLoader) {
        ...
        return findStaticMain(args.startClass, args.startArgs, classLoader);
    }

//frameworks/base/core/java/com/android/internal/os/RuntimeInit.java
    protected static Runnable findStaticMain(String className, String[] argv,
            ClassLoader classLoader) {
        Class<?> cl;

        try {
            //获取SystemServer类
            cl = Class.forName(className, true, classLoader);
        }
        ...

        Method m;
        try {
            //获取main函数
            m = cl.getMethod("main", new Class[] { String[].class });
        }
        ...
        //调用SystemServer的main函数，开始启动系统服务等
        return new MethodAndArgsCaller(m, argv);
    }

2.2.5 ZygoteServer.runSelectLoop

在线程里启动一个死循环，接收请求fork的socket请求

//frameworks/base/core/java/com/android/internal/os/ZygoteServer.java
    Runnable runSelectLoop(String abiList) {
        ...
        while (true) {
            ...
            if (pollReturnValue == 0) {
                ...
            } else {
                ...
                while (--pollIndex >= 0) {
                    if (pollIndex == 0) {
                        ...
                    } else if (pollIndex < usapPoolEventFDIndex) {
                        try {
                            //获取socket连接
                            ZygoteConnection connection = peers.get(pollIndex);
                            boolean multipleForksOK = !isUsapPoolEnabled()
                                    && ZygoteHooks.isIndefiniteThreadSuspensionSafe();
                            //处理来自应用请求fork的socket请求
                            final Runnable command =
                                    connection.processCommand(this, multipleForksOK);
                        }
                        ...
                    }
                }
                ...
            }
            ...
        }
    }

三：小结

3.1 zygote进程是否只有一个？

答：不是。

zygote进程一般都会有zygote和zygote64两个，分别用来fork32位和64位的应用，这两个进程都是在init.rc中启动的。

如果系统中有webview类应用，那么还会存在webview_zygote这个进程，用来fork webview类应用。webview_zygote进程的启动是在ProcessList的startProcess函数中判断是否是webview类型应用，如果是则会调用Process的startWebView函数，接着会判断webview_zygote进程是否存在，如果不存在则调用zygote fork出来。

3.2 是否每次应用冷启动时都要调用zygote的fork函数？

答：不是。

Android系统有usap机制，会在Android系统启动时，开启一个进程池。如果usap功能打开，当有fork请求到来时，会先从进程池中取出一个进程返回，节约启动时间。