Android6.0的应用进程启动过程部分分析

本文主要参考：http://blog.csdn.net/threepigs/article/details/50779056 深入理解Dalvik虚拟机- Android应用进程启动过程分析 一文，改成Android6.0的对应代码和启动过程。

Android的应用进程启动是apk在manifest里申明的Activity，Service，BroadcastReceiver等组件被调起时而触发的。我们以Activity为例，当点击桌面上的应用图标时，桌面会调用startActivity，启动manifest里申明的相应Launcher的Activity，而Activity的startActivity会通过Binder调用来到ActivityManagerService(AMS)里。AMS是system_server的一个服务，负责管理Android系统的所有Activity的栈，逻辑比较复杂。AMS里startActivity的时候，如果发现这个应用进程没有启动，那么就会通过Zygote创建出这个进程。

//frameworks/base/services/Java/com/android/server/am/ActivityManagerService.java
3253     private final void startProcessLocked(ProcessRecord app, String hostingType,
3254             String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs) {
...
3376             // Start the process.  It will either succeed and return a result containing
3377             // the PID of the new process, or else throw a RuntimeException.
3378             boolean isActivityProcess = (entryPoint == null);
3379             if (entryPoint == null) entryPoint = "android.app.ActivityThread";
3380             Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "Start proc: " +
3381                     app.processName);
3382             checkTime(startTime, "startProcess: asking zygote to start proc");
3383             Process.ProcessStartResult startResult = Process.start(entryPoint,
3384                     app.processName, uid, uid, gids, debugFlags, mountExternal,
3385                     app.info.targetSdkVersion, app.info.seinfo, requiredAbi, instructionSet,
3386                     app.info.dataDir, entryPointArgs);
...
3451     }

通过调用Process.start来启动进程，”android.app.ActivityThread” 这个参数是整个进程启动的入口类，后续的分析可以看到，进程被fork出来之后，就会调用android.app.ActivityThread的main函数。

//~/android-6.0.1_r62/frameworks/base/core/java/android/os/Process.java
447     /**
448      * Start a new process.
449      *
450      * <p>If processes are enabled, a new process is created and the
451      * static main() function of a <var>processClass</var> is executed there.
452      * The process will continue running after this function returns.
453      *
454      * <p>If processes are not enabled, a new thread in the caller's
455      * process is created and main() of <var>processClass</var> called there.
456      *
457      * <p>The niceName parameter, if not an empty string, is a custom name to
458      * give to the process instead of using processClass.  This allows you to
459      * make easily identifyable processes even if you are using the same base
460      * <var>processClass</var> to start them.
461      *
462      * @param processClass The class to use as the process's main entry
463      *                     point.
464      * @param niceName A more readable name to use for the process.
465      * @param uid The user-id under which the process will run.
466      * @param gid The group-id under which the process will run.
467      * @param gids Additional group-ids associated with the process.
468      * @param debugFlags Additional flags.
469      * @param targetSdkVersion The target SDK version for the app.
470      * @param seInfo null-ok SELinux information for the new process.
471      * @param abi non-null the ABI this app should be started with.
472      * @param instructionSet null-ok the instruction set to use.
473      * @param appDataDir null-ok the data directory of the app.
474      * @param zygoteArgs Additional arguments to supply to the zygote process.
475      *
476      * @return An object that describes the result of the attempt to start the process.
477      * @throws RuntimeException on fatal start failure
478      *
479      * {@hide}
480      */
481     public static final ProcessStartResult start(final String processClass,
482                                   final String niceName,
483                                   int uid, int gid, int[] gids,
484                                   int debugFlags, int mountExternal,
485                                   int targetSdkVersion,
486                                   String seInfo,
487                                   String abi,
488                                   String instructionSet,
489                                   String appDataDir,
490                                   String[] zygoteArgs) {
...
491         try {
492             return startViaZygote(processClass, niceName, uid, gid, gids,
493                     debugFlags, mountExternal, targetSdkVersion, seInfo,
494                     abi, instructionSet, appDataDir, zygoteArgs);
495         } catch (ZygoteStartFailedEx ex) {
496             Log.e(LOG_TAG,
497                     "Starting VM process through Zygote failed");
498             throw new RuntimeException(
499                     "Starting VM process through Zygote failed", ex);
500         }
501     }

584     /**
585      * Starts a new process via the zygote mechanism.
586      *
587      * @param processClass Class name whose static main() to run
588      * @param niceName 'nice' process name to appear in ps
589      * @param uid a POSIX uid that the new process should setuid() to
590      * @param gid a POSIX gid that the new process shuold setgid() to
591      * @param gids null-ok; a list of supplementary group IDs that the
592      * new
4000
process should setgroup() to.
593      * @param debugFlags Additional flags.
594      * @param targetSdkVersion The target SDK version for the app.
595      * @param seInfo null-ok SELinux information for the new process.
596      * @param abi the ABI the process should use.
597      * @param instructionSet null-ok the instruction set to use.
598      * @param appDataDir null-ok the data directory of the app.
599      * @param extraArgs Additional arguments to supply to the zygote process.
600      * @return An object that describes the result of the attempt to start the process.
601      * @throws ZygoteStartFailedEx if process start failed for any reason
602      */
603     private static ProcessStartResult startViaZygote(final String processClass,
604                                   final String niceName,
605                                   final int uid, final int gid,
606                                   final int[] gids,
607                                   int debugFlags, int mountExternal,
608                                   int targetSdkVersion,
609                                   String seInfo,
610                                   String abi,
611                                   String instructionSet,
612                                   String appDataDir,
613                                   String[] extraArgs)
614                                   throws ZygoteStartFailedEx {
...
696             return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), argsForZygote);
697         }
698     }

714     /**
715      * Tries to open socket to Zygote process if not already open. If
716      * already open, does nothing.  May block and retry.
717      */
718     private static ZygoteState openZygoteSocketIfNeeded(String abi) throws ZygoteStartFailedEx {
719         if (primaryZygoteState == null || primaryZygoteState.isClosed()) {
720             try {
721                 primaryZygoteState = ZygoteState.connect(ZYGOTE_SOCKET);
722             } catch (IOException ioe) {
723                 throw new ZygoteStartFailedEx("Error connecting to primary zygote", ioe);
724             }
725         }
726
727         if (primaryZygoteState.matches(abi)) {
728             return primaryZygoteState;
729         }
730
731         // The primary zygote didn't match. Try the secondary.
732         if (secondaryZygoteState == null || secondaryZygoteState.isClosed()) {
733             try {
734             secondaryZygoteState = ZygoteState.connect(SECONDARY_ZYGOTE_SOCKET);
735             } catch (IOException ioe) {
736                 throw new ZygoteStartFailedEx("Error connecting to secondary zygote", ioe);
737             }
738         }
739
740         if (secondaryZygoteState.matches(abi)) {
741             return secondaryZygoteState;
742         }
743
744         throw new ZygoteStartFailedEx("Unsupported zygote ABI: " + abi);
745     }

437     /**
438      * The state of the connection to the primary zygote.
439      */
440     static ZygoteState primaryZygoteState;
441
442     /**
443      * The state of the connection to the secondary zygote.
444      */
445     static ZygoteState secondaryZygoteState;

调用startViaZygote函数，从代码可以看到，Zygote创建进程是socket跨进程的调用。通过LocalSocket通信，来完成进程的创建，所以这里的Process.start只是一个Client端的调用，实际是由Server端的接收到消息后处理的。

Server端是app_process这个进程里，这是个常驻的系统服务。

frameworks/base/cmds/app_process/app_main.cpp

34 class AppRuntime : public AndroidRuntime
35 {
...
112 };

AppRuntime继承自AndroidRuntime，AndroidRuntime类是libandroid_runtime.so里导出的，frameworks/base/core/jni/AndroidRuntime.cpp。

app_ process这个进程在init.rc里会创建,app_process以zygote作为进程名。

//~/android-6.0.1_r62/frameworks/base/cmds/app_process/app_main.cpp
186 int main(int argc, char* const argv[])
187 {
...
197     AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));
198     // Process command line arguments
199     // ignore argv[0]
200     argc--;
201     argv++;
...
306     if (zygote) {
307         runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
308     } else if (className) {
309         runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
310     } else {
311         fprintf(stderr, "Error: no class name or --zygote supplied.\n");
312         app_usage();
313         LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");
314         return 10;
315     }
316 }

第一个if是正常的Zygote进程启动，执行AndroidRuntime::start，会调用ZygoteInit的类main函数。app_process的初始化就在ZygoteInit里，监听本地的socket，接收ZygoteClient的请求，当有请求来的时候，调用ZygoteConnection::runOnce，从而调用Zygote.forkAndSpecialize来创建新的进程，并且调用RuntimeInit.zygoteInit做进程的初始化，初始化过程就会调用ActivityThread.main。

//~/android-6.0.1_r62/frameworks/base/core/jni/AndroidRuntime.cpp
999 /*
1000  * Start the Android runtime.  This involves starting the virtual machine
1001  * and calling the "static void main(String[] args)" method in the class
1002  * named by "className".
1003  *
1004  * Passes the main function two arguments, the class name and the specified
1005  * options string.
1006  */
1007 void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
1008 {
...
1036     //const char* kernelHack = getenv("LD_ASSUME_KERNEL");
1037     //ALOGD("Found LD_ASSUME_KERNEL='%s'\n", kernelHack);
1038
1039     /* start the virtual machine */
1040     JniInvocation jni_invocation;
1041     jni_invocation.Init(NULL);
1042     JNIEnv* env;
1043     if (startVm(&mJavaVM, &env, zygote) != 0) {
1044         return;
1045     }
1046     onVmCreated(env);
...
1079     /*
1080      * Start VM.  This thread becomes the main thread of the VM, and will
1081      * not return until the VM exits.
1082      */
1083     char* slashClassName = toSlashClassName(className);
1084     jclass startClass = env->FindClass(slashClassName);
1085     if (startClass == NULL) {
1086         ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);
1087         /* keep going */
1088     } else {
1089         jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
1090             "([Ljava/lang/String;)V");
1091         if (startMeth == NULL) {
1092             ALOGE("JavaVM unable to find main() in '%s'\n", className);
1093             /* keep going */
1094         } else {
1095             env->CallStaticVoidMethod(startClass, startMeth, strArray);//执行类方法
1096
1097 #if 0
1098             if (env->ExceptionCheck())
1099                 threadExitUncaughtException(env);
1100 #endif
1101         }
1102     }
1103     free(slashClassName);
...
1110 }

第二个当指定了className的时候，则用com.android.internal.os.RuntimeInit作为入口。

而我们正常的Zygote进程则走的是ZygoteInit。

AndroidRuntime.start函数会调用startVm，frameworks/base/core/jni/AndroidRuntime.cpp。

而start函数中的CallStaticVoidMethod函数开始执行找到的类方法。