Android O系统启动流程--zygote篇

public static void main(String argv[]) {
    //创建ZygoteServer对象
    ZygoteServer zygoteServer = new ZygoteServer();

    // Mark zygote start. This ensures that thread creation will throw
    // an error.
    // 调用native函数，确保当前没有其它线程在运行
    ZygoteHooks.startZygoteNoThreadCreation(); 

    // Zygote goes into its own process group.
    try {
        Os.setpgid(0, 0);
    } catch (ErrnoException ex) {
        throw new RuntimeException("Failed to setpgid(0,0)", ex);
    }

    try {
        ...
        // enable DDMS
        RuntimeInit.enableDdms();
        // Start profiling the zygote initialization.
        // 开始性能统计
        SamplingProfilerIntegration.start();

        boolean startSystemServer = false;
        String socketName = "zygote";
        String abiList = null;
        boolean enableLazyPreload = false;
        //解析参数，得到上述变量的值
        for (int i = 1; i < argv.length; i++) {
            ...
        }

        if (abiList == null) {
            throw new RuntimeException("No ABI list supplied.");
        }

        //注册server socket
        zygoteServer.registerZygoteSocket(socketName);

        // In some configurations, we avoid preloading resources and classes eagerly.
        // In such cases, we will preload things prior to our first fork.
        if (!enableLazyPreload) {
            ...
            //默认情况，预加载信息
            preload(bootTimingsTraceLog);
        ...
        } else {
            //如注释，延迟预加载
            //变更Zygote进程优先级为NORMAL级别
            //第一次fork时才会preload
            Zygote.resetNicePriority();
        }

        // Finish profiling the zygote initialization.
        // 结束对zygote的性能统计
        // 实际上是想统计预加载的性能
        SamplingProfilerIntegration.writeZygoteSnapshot();

        // Do an initial gc to clean up after startup
        ...
        //如果预加载了，很有必要GC一波
        gcAndFinalize();
        ...

        //以下均是安全相关的内容

        // Zygote process unmounts root storage spaces.
        // unmount root storage spaces，
        // 那么其它进程就无法访问了
        Zygote.nativeUnmountStorageOnInit();

        // Set seccomp policy
        // 加载seccomp的过滤规则
        // 所有 Android 软件都使用系统调用（简称为 syscall）与 Linux 内核进行通信
        // 内核提供许多特定于设备和SOC的系统调用，让用户空间进程（包括应用）可以直接与内核进行交互
        // 不过，其中许多系统调用Android未予使用或未予正式支持
        // 通过seccomp，Android可使应用软件无法访问未使用的内核系统调用
        // 由于应用无法访问这些系统调用，因此，它们不会被潜在的有害应用利用
        // 该过滤器安装到zygote进程中，由于所有Android应用均衍生自该进程
        // 因而会影响到所有应用
        Seccomp.setPolicy();

        //允许有其它线程了
        ZygoteHooks.stopZygoteNoThreadCreation();

        if (startSystemServer) {
            Runnable r = forkSystemServer(abiList, socketName, zygoteServer);

            // {@code r == null} in the parent (zygote) process, and {@code r != null} in the
            // child (system_server) process.
            if (r != null) {
                r.run();
                return;
            }
        }
        ...
        //zygote进程进入无限循环，处理请求
        zygoteServer.runSelectLoop(abiList);

        zygoteServer.closeServerSocket();
    } catch (Zygote.MethodAndArgsCaller caller) {
        //通过反射调用新进程函数的地方
        //后续介绍新进程启动时，再介绍
        caller.run();
    } catch (Throwable ex) {
        ...
        zygoteServer.closeServerSocket();
        throw ex;
    }
}

/**
 * Registers a server socket for zygote command connections
 *
 * @throws RuntimeException when open fails
 */
void registerServerSocket(String socketName) {
        if (mServerSocket == null) {
            int fileDesc;
            //此处的socket name，就是zygote
            final String fullSocketName = ANDROID_SOCKET_PREFIX + socketName;
            try {
                //在init.zygote.rc被加载时，指定了名为zygote的socket
                //在进程被创建时，就会创建对应的文件描述符，并加入到环境变量中
                //因此，此时可以取出对应的环境变量
                String env = System.getenv(fullSocketName);
                fileDesc = Integer.parseInt(env);
            } catch (RuntimeException ex) {
                throw new RuntimeException(fullSocketName + " unset or invalid", ex);
            }

            try {
                FileDescriptor fd = new FileDescriptor();
                //获取zygote socket的文件描述符
                fd.setInt$(fileDesc);
                //将socket包装成一个server socket
                mServerSocket = new LocalServerSocket(fd);
            } catch (IOException ex) {
                throw new RuntimeException(
                        "Error binding to local socket '" + fileDesc + "'", ex);
            }
        }
}

static void preload(TimingsTraceLog bootTimingsTraceLog) {
        Log.d(TAG, "begin preload");
        bootTimingsTraceLog.traceBegin("BeginIcuCachePinning");
        //Pin ICU Data, 获取字符集转换资源等
        beginIcuCachePinning();
        bootTimingsTraceLog.traceEnd(); // BeginIcuCachePinning
        bootTimingsTraceLog.traceBegin("PreloadClasses");
        //读取文件system/etc/preloaded-classes，然后通过反射加载对应的类
        //一般由厂商来定义，有时需要加载数千个类，启动慢的原因之一
        preloadClasses();
        bootTimingsTraceLog.traceEnd(); // PreloadClasses
        bootTimingsTraceLog.traceBegin("PreloadResources");
        //负责加载一些常用的系统资源
        preloadResources();
        bootTimingsTraceLog.traceEnd(); // PreloadResources
        Trace.traceBegin(Trace.TRACE_TAG_DALVIK, "PreloadAppProcessHALs");
        nativePreloadAppProcessHALs();
        Trace.traceEnd(Trace.TRACE_TAG_DALVIK);
        Trace.traceBegin(Trace.TRACE_TAG_DALVIK, "PreloadOpenGL");
        //图形相关的
        preloadOpenGL();
        Trace.traceEnd(Trace.TRACE_TAG_DALVIK);
        //一些必要库
        preloadSharedLibraries();
        //语言相关的字符信息
        preloadTextResources();
        // Ask the WebViewFactory to do any initialization that must run in the zygote process,
        // for memory sharing purposes.
        WebViewFactory.prepareWebViewInZygote();
        endIcuCachePinning();
        //安全相关的
        warmUpJcaProviders();
        Log.d(TAG, "end preload");

        sPreloadComplete = true;
    }

private static Runnable forkSystemServer(String abiList, String socketName,
            ZygoteServer zygoteServer) {
        //准备capabilities参数
        long capabilities = posixCapabilitiesAsBits(
            OsConstants.CAP_IPC_LOCK,
            OsConstants.CAP_KILL,
            OsConstants.CAP_NET_ADMIN,
            OsConstants.CAP_NET_BIND_SERVICE,
            OsConstants.CAP_NET_BROADCAST,
            OsConstants.CAP_NET_RAW,
            OsConstants.CAP_SYS_MODULE,
            OsConstants.CAP_SYS_NICE,
            OsConstants.CAP_SYS_PTRACE,
            OsConstants.CAP_SYS_TIME,
            OsConstants.CAP_SYS_TTY_CONFIG,
            OsConstants.CAP_WAKE_ALARM
        );
        /* Containers run without this capability, so avoid setting it in that case */
        if (!SystemProperties.getBoolean(PROPERTY_RUNNING_IN_CONTAINER, false)) {
            capabilities |= posixCapabilitiesAsBits(OsConstants.CAP_BLOCK_SUSPEND);
        }
        /* Hardcoded command line to start the system server */
        String args[] = {
            "--setuid=1000",
            "--setgid=1000",
            "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1023,1032,3001,3002,3003,3006,3007,3009,3010",
            "--capabilities=" + capabilities + "," + capabilities,
            "--nice-name=system_server",
            "--runtime-args",
            "com.android.server.SystemServer",
        };
        ZygoteConnection.Arguments parsedArgs = null;

        int pid;

        try {
            //将上面准备的参数，按照ZygoteConnection的风格进行封装
            parsedArgs = new ZygoteConnection.Arguments(args);
            ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
            ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);

            /* Request to fork the system server process */
            //fork子进程，该进程是system_server进程
            pid = Zygote.forkSystemServer(
                    parsedArgs.uid, parsedArgs.gid,
                    parsedArgs.gids,
                    parsedArgs.debugFlags,
                    null,
                    parsedArgs.permittedCapabilities,
                    parsedArgs.effectiveCapabilities);
        } catch (IllegalArgumentException ex) {
            throw new RuntimeException(ex);
        }

        /* For child process */
        //进入子进程system_server
        if (pid == 0) {
            //处理32_64和64_32的情况
            if (hasSecondZygote(abiList)) {
                waitForSecondaryZygote(socketName);
            }
            // fork时会copy socket，system server需要主动关闭
            zygoteServer.closeServerSocket();
            // 完成system_server进程剩余的工作
            return handleSystemServerProcess(parsedArgs);
        }

        return null;
}

Runnable runSelectLoop(String abiList) {
        ArrayList<FileDescriptor> fds = new ArrayList<FileDescriptor>();
        ArrayList<ZygoteConnection> peers = new ArrayList<ZygoteConnection>();
        //首先将server socket加入到fds
        fds.add(mServerSocket.getFileDescriptor());
        peers.add(null);
        //开启死循环，不断的等待AMS的请求
        while (true) {
             //每次循环，都重新创建需要监听的pollFds
            StructPollfd[] pollFds = new StructPollfd[fds.size()];
            for (int i = 0; i < pollFds.length; ++i) {
                pollFds[i] = new StructPollfd();
                pollFds[i].fd = fds.get(i);
                //关注事件到来
                pollFds[i].events = (short) POLLIN;
            }
            try {
                //等待事件到来
                Os.poll(pollFds, -1);
            } catch (ErrnoException ex) {
                throw new RuntimeException("poll failed", ex);
            }
            //采用I/O多路复用机制，当接收到客户端发出连接请求 或者数据处理请求到来，则往下执行；
            for (int i = pollFds.length - 1; i >= 0; --i) {
                if ((pollFds[i].revents & POLLIN) == 0) {
                    continue;
                }
                //server socket最先加入fds， 因此这里是server socket收到数据
                if (i == 0) {
                    //即fds[0]，代表的是sServerSocket，则意味着有客户端连接请求；
                    //则创建ZygoteConnection对象,并添加到fds。
                    ZygoteConnection newPeer = acceptCommandPeer(abiList);
                    //加入到peers和fds, 即下一次也开始监听
                    peers.add(newPeer);
                    fds.add(newPeer.getFileDesciptor());
                } else {
                    try {
                        ZygoteConnection connection = peers.get(i);
                        //其它通信连接收到数据，执行对应命令
                        final Runnable command = connection.processOneCommand(this);

                        if (mIsForkChild) {
                            // We're in the child. We should always have a command to run at this
                            // stage if processOneCommand hasn't called "exec".
                            if (command == null) {
                                throw new IllegalStateException("command == null");
                            }

                            return command;
                        } else {
                            // We're in the server - we should never have any commands to run.
                            if (command != null) {
                                throw new IllegalStateException("command != null");
                            }

                            // We don't know whether the remote side of the socket was closed or
                            // not until we attempt to read from it from processOneCommand. This shows up as
                            // a regular POLLIN event in our regular processing loop.
                            if (connection.isClosedByPeer()) {
                                connection.closeSocket();
                                //对应通信连接不再需要执行其它命令，关闭并移除，即下一次不再监听
                                peers.remove(i);
                                fds.remove(i);
                             }
                            ...
}