1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

public static void main(String argv[]) {    try {        // Start profiling the zygote initialization.
        SamplingProfilerIntegration.start();

        boolean startSystemServer = false;
        String socketName = "zygote";//-----------------------------------
        .................................................
        registerZygoteSocket(socketName);//-----------------------注册zygote套接字
        EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
            SystemClock.uptimeMillis());
        preload();//------------------------------------------------预加载资源
        EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
            SystemClock.uptimeMillis());
        .................................................
        if (startSystemServer) {//-------------------------------- 启动 system server 服务
            startSystemServer(abiList, socketName);
        }

        Log.i(TAG, "Accepting command socket connections");
        runSelectLoop(abiList);//------------------------------------

        closeServerSocket();
    } catch (MethodAndArgsCaller caller) {        caller.run();
    } catch (RuntimeException ex) {        Log.e(TAG, "Zygote died with exception", ex);
        closeServerSocket();
        throw ex;
    }
}

1

private static final String ANDROID_SOCKET_PREFIX = "ANDROID_SOCKET_";

1

socket zygote stream 660 root system

1
2

String env = System.getenv(ANDROID_SOCKET_ENV);
fileDesc = Integer.parseInt(env);

1
2
3
4
5
6
7
8
9
10
11
12
13

# Classes which are preloaded by com.android.internal.os.ZygoteInit.
# Automatically generated by frameworks/base/tools/preload/WritePreloadedClassFile.java.
# MIN_LOAD_TIME_MICROS=1250
# MIN_PROCESSES=10
........................................
[Landroid.accounts.Account;
[Landroid.animation.Animator;
[Landroid.animation.Keyframe$FloatKeyframe;
[Landroid.animation.Keyframe$IntKeyframe;
[Landroid.animation.PropertyValuesHolder;
[Landroid.app.FragmentState;
[Landroid.app.LoaderManagerImpl;
........................................

1
2
3
4
5
6
7
8
9
10
11
12

private static void preloadSharedLibraries() {    Log.i(TAG, "Preloading shared libraries...");
    System.loadLibrary("android");
    System.loadLibrary("compiler_rt");
    System.loadLibrary("jnigraphics");
}

private static void preloadOpenGL() {    if (!SystemProperties.getBoolean(PROPERTY_DISABLE_OPENGL_PRELOADING, false)) {        EGL14.eglGetDisplay(EGL14.EGL_DEFAULT_DISPLAY);
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

private static boolean startSystemServer()
        throws MethodAndArgsCaller, RuntimeException
{    ...................
    /* Hardcoded command line to start the system server */
    String args[] = {        "--setuid=1000",
        "--setgid=1000",
        "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1032,
                        3001,3002,3003,3006,3007",
        "--capabilities=" + capabilities + "," + capabilities,
        "--runtime-init",
        "--nice-name=system_server",
        "com.android.server.SystemServer",
    };
    ZygoteConnection.Arguments parsedArgs = null;
    int pid;
    try {        parsedArgs = new ZygoteConnection.Arguments(args);
        ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
        ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);

        // fork出系统服务对应的进程
        pid = Zygote.forkSystemServer(parsedArgs.uid, parsedArgs.gid,
                                            parsedArgs.gids, parsedArgs.debugFlags, null,
                                            parsedArgs.permittedCapabilities,
                                            parsedArgs.effectiveCapabilities);
    } catch (IllegalArgumentException ex) {        throw new RuntimeException(ex);
    }

    // 对新fork出的系统进程，执行handleSystemServerProcess()
    if (pid == 0) {            if (hasSecondZygote(abiList)) {                waitForSecondaryZygote(socketName);
            }

            handleSystemServerProcess(parsedArgs);
        }
    return true;

}

1
2
3
4
5
6
7
8

public static int forkSystemServer(int uid, int gid, int[] gids, int debugFlags,
        int[][] rlimits, long permittedCapabilities, long effectiveCapabilities) {    VM_HOOKS.preFork();
    int pid = nativeForkSystemServer(
            uid, gid, gids, debugFlags, rlimits, permittedCapabilities, effectiveCapabilities);
    VM_HOOKS.postForkCommon();
    return pid;
}

1
2
3
4
5
6
7
8
9
10

String args[] = {    "--setuid=1000",
    "--setgid=1000",
    "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1032,
                    3001,3002,3003,3006,3007",
    "--capabilities=" + capabilities + "," + capabilities,
    "--runtime-init",
    "--nice-name=system_server",
    "com.android.server.SystemServer",
};

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

static jint com_android_internal_os_Zygote_nativeForkSystemServer(
        JNIEnv* env, jclass, uid_t uid, gid_t gid, jintArray gids,
        jint debug_flags, jobjectArray rlimits, jlong permittedCapabilities,
        jlong effectiveCapabilities) {  pid_t pid = ForkAndSpecializeCommon(env, uid, gid, gids,
                                      debug_flags, rlimits,
                                      permittedCapabilities, effectiveCapabilities,
                                      MOUNT_EXTERNAL_NONE, NULL, NULL, true, NULL,
                                      NULL, NULL);
  if (pid > 0) {      // The zygote process checks whether the child process has died or not.
      ALOGI("System server process %d has been created", pid);
      gSystemServerPid = pid;
      // There is a slight window that the system server process has crashed
      // but it went unnoticed because we haven't published its pid yet. So
      // we recheck here just to make sure that all is well.
      int status;
      if (waitpid(pid, &status, WNOHANG) == pid) {          ALOGE("System server process %d has died. Restarting Zygote!", pid);
          RuntimeAbort(env);
      }
  }
  return pid;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

/**
    * Finish remaining work for the newly forked system server process.
    */
   private static void handleSystemServerProcess(
           ZygoteConnection.Arguments parsedArgs)
           throws ZygoteInit.MethodAndArgsCaller {
       closeServerSocket();//------------------因为子进程是system server 不是zygote,所以要关闭zygote socket

       // set umask to 0077 so new files and directories will default to owner-only permissions.
       Os.umask(S_IRWXG | S_IRWXO);

       if (parsedArgs.niceName != null) {           Process.setArgV0(parsedArgs.niceName);//----------------niceName 是 system_server
       }

       final String systemServerClasspath = Os.getenv("SYSTEMSERVERCLASSPATH");
       if (systemServerClasspath != null) {           performSystemServerDexOpt(systemServerClasspath);
       }

       if (parsedArgs.invokeWith != null) {           String[] args = parsedArgs.remainingArgs;
           // If we have a non-null system server class path, we'll have to duplicate the
           // existing arguments and append the classpath to it. ART will handle the classpath
           // correctly when we exec a new process.
           if (systemServerClasspath != null) {               String[] amendedArgs = new String[args.length + 2];
               amendedArgs[0] = "-cp";
               amendedArgs[1] = systemServerClasspath;
               System.arraycopy(parsedArgs.remainingArgs, 0, amendedArgs, 2, parsedArgs.remainingArgs.length);
           }

           WrapperInit.execApplication(parsedArgs.invokeWith,
                   parsedArgs.niceName, parsedArgs.targetSdkVersion,
                   null, args);
       } else {           ClassLoader cl = null;
           if (systemServerClasspath != null) {               cl = new PathClassLoader(systemServerClasspath, ClassLoader.getSystemClassLoader());
               Thread.currentThread().setContextClassLoader(cl);
           }

           /*
            * Pass the remaining arguments to SystemServer.
            */
           // 此时的remainingArgs就是”com.android.server.SystemServer”
           RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs, cl);
       }

       /* should never reach here */
   }

1
2
3
4
5
6
7
8
9
10
11

public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
           throws ZygoteInit.MethodAndArgsCaller {       if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting application from zygote");

       redirectLogStreams();//-------------在新fork出的系统进程里，需要重新定向系统输出流

       commonInit();
       nativeZygoteInit();

       applicationInit(targetSdkVersion, argv, classLoader);
   }

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

/*
 * JNI registration.
 */
static JNINativeMethod gMethods[] = {    { "nativeFinishInit", "()V",
        (void*) com_android_internal_os_RuntimeInit_nativeFinishInit },
    { "nativeZygoteInit", "()V",
        (void*) com_android_internal_os_RuntimeInit_nativeZygoteInit },
    { "nativeSetExitWithoutCleanup", "(Z)V",
        (void*) com_android_internal_os_RuntimeInit_nativeSetExitWithoutCleanup },
};

static void com_android_internal_os_RuntimeInit_nativeZygoteInit(JNIEnv* env, jobject clazz)
{    gCurRuntime->onZygoteInit();
}

1
2
3
4
5
6
7
8
9

virtual void onZygoteInit()
  {      // Re-enable tracing now that we're no longer in Zygote.
      atrace_set_tracing_enabled(true);

      sp<ProcessState> proc = ProcessState::self();
      ALOGV("App process: starting thread pool.\n");
      proc->startThreadPool();
  }

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

private static void applicationInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
        throws ZygoteInit.MethodAndArgsCaller {    nativeSetExitWithoutCleanup(true);

    VMRuntime.getRuntime().setTargetHeapUtilization(0.75f);
    VMRuntime.getRuntime().setTargetSdkVersion(targetSdkVersion);

    final Arguments args;
    try {        args = new Arguments(argv);
    } catch (IllegalArgumentException ex) {        Slog.e(TAG, ex.getMessage());
        // let the process exit
        return;
    }

    // Remaining arguments are passed to the start class's static main
  invokeStaticMain(args.startClass, args.startArgs, classLoader);

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

private static void invokeStaticMain(String className, String[] argv, ClassLoader classLoader)
         throws ZygoteInit.MethodAndArgsCaller {     Class<?> cl;

     try {         cl = Class.forName(className, true, classLoader);
     } catch (ClassNotFoundException ex) {         throw new RuntimeException(
                 "Missing class when invoking static main " + className,
                 ex);
     }
     Method m;
     try {         m = cl.getMethod("main", new Class[] { String[].class });//-----------------注意看这里的 main
     } catch (NoSuchMethodException ex) {         throw new RuntimeException(
                 "Missing static main on " + className, ex);
     } catch (SecurityException ex) {         throw new RuntimeException(
                 "Problem getting static main on " + className, ex);
     }

     int modifiers = m.getModifiers();
     if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {         throw new RuntimeException(
                 "Main method is not public and static on " + className);
     }
     /*
      * This throw gets caught in ZygoteInit.main(), which responds
      * by invoking the exception's run() method. This arrangement
      * clears up all the stack frames that were required in setting
      * up the process.
      */
     throw new ZygoteInit.MethodAndArgsCaller(m, argv);
 }

1
2
3
4
5
6

/**
 * The main entry point from zygote.
 */
public static void main(String[] args) {    new SystemServer().run();
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94

private void run() {        // If a device's clock is before 1970 (before 0), a lot of
        // APIs crash dealing with negative numbers, notably
        // java.io.File#setLastModified, so instead we fake it and
        // hope that time from cell towers or NTP fixes it shortly.
        if (System.currentTimeMillis() < EARLIEST_SUPPORTED_TIME) {            Slog.w(TAG, "System clock is before 1970; setting to 1970.");
            SystemClock.setCurrentTimeMillis(EARLIEST_SUPPORTED_TIME);
        }

        // Here we go!
        Slog.i(TAG, "Entered the Android system server!");
        EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_SYSTEM_RUN, SystemClock.uptimeMillis());

        // In case the runtime switched since last boot (such as when
        // the old runtime was removed in an OTA), set the system
        // property so that it is in sync. We can't do this in
        // libnativehelper's JniInvocation::Init code where we already
        // had to fallback to a different runtime because it is
        // running as root and we need to be the system user to set
        // the property. http://b/11463182
        SystemProperties.set("persist.sys.dalvik.vm.lib.2", VMRuntime.getRuntime().vmLibrary());

        // Enable the sampling profiler.
        if (SamplingProfilerIntegration.isEnabled()) {            SamplingProfilerIntegration.start();
            mProfilerSnapshotTimer = new Timer();
            mProfilerSnapshotTimer.schedule(new TimerTask() {                @Override
                public void run() {                    SamplingProfilerIntegration.writeSnapshot("system_server", null);
                }
            }, SNAPSHOT_INTERVAL, SNAPSHOT_INTERVAL);
        }

        // Mmmmmm... more memory!
        VMRuntime.getRuntime().clearGrowthLimit();

        // The system server has to run all of the time, so it needs to be
        // as efficient as possible with its memory usage.
        VMRuntime.getRuntime().setTargetHeapUtilization(0.8f);

        // Some devices rely on runtime fingerprint generation, so make sure
        // we've defined it before booting further.
        Build.ensureFingerprintProperty();

        // Within the system server, it is an error to access Environment paths without
        // explicitly specifying a user.
        Environment.setUserRequired(true);

        // Ensure binder calls into the system always run at foreground priority.
        BinderInternal.disableBackgroundScheduling(true);

        // Prepare the main looper thread (this thread).
        android.os.Process.setThreadPriority(
                android.os.Process.THREAD_PRIORITY_FOREGROUND);
        android.os.Process.setCanSelfBackground(false);
        Looper.prepareMainLooper();

        // Initialize native services.
        System.loadLibrary("android_servers");
        nativeInit();

        // Check whether we failed to shut down last time we tried.
        // This call may not return.
        performPendingShutdown();

        // Initialize the system context.
        createSystemContext();

        // Create the system service manager.
        mSystemServiceManager = new SystemServiceManager(mSystemContext);
        LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);

        // Start services.
        try {            startBootstrapServices();
            startCoreServices();
            startOtherServices();
        } catch (Throwable ex) {            Slog.e("System", "******************************************");
            Slog.e("System", "************ Failure starting system services", ex);
            throw ex;
        }

        // For debug builds, log event loop stalls to dropbox for analysis.
        if (StrictMode.conditionallyEnableDebugLogging()) {            Slog.i(TAG, "Enabled StrictMode for system server main thread.");
        }

        // Loop forever.
        Looper.loop();
        throw new RuntimeException("Main thread loop unexpectedly exited");
    }

1
2

System.loadLibrary("android_servers");
nativeInit();

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

private static void runSelectLoop(String abiList) throws MethodAndArgsCaller {    ArrayList<FileDescriptor> fds = new ArrayList<FileDescriptor>();
    ArrayList<ZygoteConnection> peers = new ArrayList<ZygoteConnection>();
    FileDescriptor[] fdArray = new FileDescriptor[4];

    fds.add(sServerSocket.getFileDescriptor());//------------------------sServerSocket就是zygote socket文件描述符
    peers.add(null);

    int loopCount = GC_LOOP_COUNT;
    while (true) {        int index;

        /*
         * Call gc() before we block in select().
         * It's work that has to be done anyway, and it's better
         * to avoid making every child do it.  It will also
         * madvise() any free memory as a side-effect.
         *
         * Don't call it every time, because walking the entire
         * heap is a lot of overhead to free a few hundred bytes.
         */
        if (loopCount <= 0) {            gc();
            loopCount = GC_LOOP_COUNT;
        } else {            loopCount--;
        }

        try {            fdArray = fds.toArray(fdArray);//-----------------------------fdArry中就包含了zygote socket文件描述符了
            index = selectReadable(fdArray);
        } catch (IOException ex) {            throw new RuntimeException("Error in select()", ex);
        }

        if (index < 0) {            throw new RuntimeException("Error in select()");
        } else if (index == 0) {//-----------------------------------------对应的zygote socket有数据可读
            ZygoteConnection newPeer = acceptCommandPeer(abiList);
            peers.add(newPeer);
            fds.add(newPeer.getFileDescriptor());
        } else {//-------------------------------------------------对应其他文件描述符有数据可读
            boolean done;
            done = peers.get(index).runOnce();

            if (done) {                peers.remove(index);
                fds.remove(index);
            }
        }
    }
}

1
2
3
4
5
6
7

static JNINativeMethod gMethods[] = {.................................................................
    { "selectReadable", "([Ljava/io/FileDescriptor;)I",
        (void *) com_android_internal_os_ZygoteInit_selectReadable },
    { "createFileDescriptor", "(I)Ljava/io/FileDescriptor;",
        (void *) com_android_internal_os_ZygoteInit_createFileDescriptor }
};

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

static jint com_android_internal_os_ZygoteInit_selectReadable (JNIEnv *env, jobject clazz,
                                                                         jobjectArray fds)
{    . . . . . .
    int err;
    do {        err = select (nfds, &fdset, NULL, NULL, NULL);
    } while (err < 0 && errno == EINTR);
    . . . . . .
    for (jsize i = 0; i < length; i++) {        jobject fdObj = env->GetObjectArrayElement(fds, i);
        . . . . . .
        int fd = jniGetFDFromFileDescriptor(env, fdObj);
        . . . . . .
        if (FD_ISSET(fd, &fdset)) {            return (jint)i;
        }
    }
    return -1;
}

1

fds.add(newPeer.getFileDescriptor());

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

boolean runOnce() throws ZygoteInit.MethodAndArgsCaller {
    String args[];
    Arguments parsedArgs = null;
    FileDescriptor[] descriptors;

    . . . . . .
        args = readArgumentList();//----------------------------------------------------------------
        descriptors = mSocket.getAncillaryFileDescriptors();
    . . . . . .
    int pid = -1;
    FileDescriptor childPipeFd = null;
    FileDescriptor serverPipeFd = null;

    try {        parsedArgs = new Arguments(args);
        . . . . . .
        pid = Zygote.forkAndSpecialize(parsedArgs.uid, parsedArgs.gid, parsedArgs.gids,
                parsedArgs.debugFlags, rlimits, parsedArgs.mountExternal,
                parsedArgs.seInfo, parsedArgs.niceName);
    }
    . . . . . .
        if (pid == 0) {            // in child
            IoUtils.closeQuietly(serverPipeFd);
            serverPipeFd = null;
            handleChildProc(parsedArgs, descriptors, childPipeFd, newStderr);
            return true;
        } else {            // in parent...pid of < 0 means failure
            IoUtils.closeQuietly(childPipeFd);
            childPipeFd = null;
            return handleParentProc(pid, descriptors, serverPipeFd, parsedArgs);
        }
    . . . . . .
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

private String[] readArgumentList()
        throws IOException
{    int argc;
    . . . . . .
        String s = mSocketReader.readLine();
    . . . . . .
        argc = Integer.parseInt(s);
    . . . . . .
    String[] result = new String[argc];
    for (int i = 0; i < argc; i++) {        result[i] = mSocketReader.readLine();
        if (result[i] == null) {            // We got an unexpected EOF.
            throw new IOException("truncated request");
        }
    }
    return result;
}

1
2
3

Process.ProcessStartResult startResult = Process.start("android.app.ActivityThread",
                    app.processName, uid, uid, gids, debugFlags, mountExternal,
                    app.info.targetSdkVersion, app.info.seinfo, null);

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

private void handleChildProc(Arguments parsedArgs, FileDescriptor[] descriptors,
                             FileDescriptor pipeFd, PrintStream newStderr)
                             throws ZygoteInit.MethodAndArgsCaller
{    closeSocket();//--------------------------------------------因为不是zygote进程了，所以肯定要先关闭socket了
    ZygoteInit.closeServerSocket();
    . . . . . .
    if (parsedArgs.niceName != null) {        Process.setArgV0(parsedArgs.niceName);
    }

    if (parsedArgs.runtimeInit) {        if (parsedArgs.invokeWith != null) {            WrapperInit.execApplication(parsedArgs.invokeWith,
                    parsedArgs.niceName, parsedArgs.targetSdkVersion,
                    pipeFd, parsedArgs.remainingArgs);
        } else {            RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion,
                    parsedArgs.remainingArgs);
        }
    } else {        String className;
        . . . . . .
            className = parsedArgs.remainingArgs[0];
        . . . . . .
        String[] mainArgs = new String[parsedArgs.remainingArgs.length - 1];
        System.arraycopy(parsedArgs.remainingArgs, 1,
                mainArgs, 0, mainArgs.length);

        if (parsedArgs.invokeWith != null) {            WrapperInit.execStandalone(parsedArgs.invokeWith,
                    parsedArgs.classpath, className, mainArgs);
        } else {            ClassLoader cloader;
            if (parsedArgs.classpath != null) {                cloader = new PathClassLoader(parsedArgs.classpath,
                        ClassLoader.getSystemClassLoader());
            } else {                cloader = ClassLoader.getSystemClassLoader();
            }

            try {                ZygoteInit.invokeStaticMain(cloader, className, mainArgs);//-----------------------很熟悉吧,忘了的话，往上看
            } catch (RuntimeException ex) {                logAndPrintError(newStderr, "Error starting.", ex);
            }
        }
    }
}