Android6.0的应用进程启动过程部分分析

本文主要参考：http://blog.csdn.net/threepigs/article/details/50779056 深入理解Dalvik虚拟机- Android应用进程启动过程分析 一文，改成Android6.0的对应代码和启动过程。
Android的应用进程启动是apk在manifest里申明的Activity，Service，BroadcastReceiver等组件被调起时而触发的。我们以Activity为例，当点击桌面上的应用图标时，桌面会调用startActivity，启动manifest里申明的相应Launcher的Activity，而Activity的startActivity会通过Binder调用来到ActivityManagerService(AMS)里。AMS是system_server的一个服务，负责管理Android系统的所有Activity的栈，逻辑比较复杂。AMS里startActivity的时候，如果发现这个应用进程没有启动，那么就会通过Zygote创建出这个进程。

//frameworks/base/services/Java/com/android/server/am/ActivityManagerService.java 3253     private final void startProcessLocked(ProcessRecord app, String hostingType, 3254             String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs) {    ... 3376             // Start the process.  It will either succeed and return a result containing 3377             // the PID of the new process, or else throw a RuntimeException. 3378             boolean isActivityProcess = (entryPoint == null); 3379             if (entryPoint == null) entryPoint = "android.app.ActivityThread"; 3380             Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "Start proc: " + 3381                     app.processName); 3382             checkTime(startTime, "startProcess: asking zygote to start proc"); 3383             Process.ProcessStartResult startResult = Process.start(entryPoint, 3384                     app.processName, uid, uid, gids, debugFlags, mountExternal, 3385                     app.info.targetSdkVersion, app.info.seinfo, requiredAbi, instructionSet, 3386                     app.info.dataDir, entryPointArgs);    ... 3451     }

通过调用Process.start来启动进程，”android.app.ActivityThread” 这个参数是整个进程启动的入口类，后续的分析可以看到，进程被fork出来之后，就会调用android.app.ActivityThread的main函数。

//~/android-6.0.1_r62/frameworks/base/core/java/android/os/Process.java 447     /** 448      * Start a new process. 449      *  450      * <p>If processes are enabled, a new process is created and the 451      * static main() function of a <var>processClass</var> is executed there. 452      * The process will continue running after this function returns. 453      *  454      * <p>If processes are not enabled, a new thread in the caller's 455      * process is created and main() of <var>processClass</var> called there. 456      *  457      * <p>The niceName parameter, if not an empty string, is a custom name to 458      * give to the process instead of using processClass.  This allows you to 459      * make easily identifyable processes even if you are using the same base 460      * <var>processClass</var> to start them. 461      *                    462      * @param processClass The class to use as the process's main entry 463      *                     point. 464      * @param niceName A more readable name to use for the process. 465      * @param uid The user-id under which the process will run. 466      * @param gid The group-id under which the process will run. 467      * @param gids Additional group-ids associated with the process. 468      * @param debugFlags Additional flags. 469      * @param targetSdkVersion The target SDK version for the app. 470      * @param seInfo null-ok SELinux information for the new process. 471      * @param abi non-null the ABI this app should be started with. 472      * @param instructionSet null-ok the instruction set to use. 473      * @param appDataDir null-ok the data directory of the app. 474      * @param zygoteArgs Additional arguments to supply to the zygote process. 475      *  476      * @return An object that describes the result of the attempt to start the process. 477      * @throws RuntimeException on fatal start failure 478      *  479      * {@hide} 480      */ 481     public static final ProcessStartResult start(final String processClass, 482                                   final String niceName,          483                                   int uid, int gid, int[] gids,   484                                   int debugFlags, int mountExternal,  485                                   int targetSdkVersion,           486                                   String seInfo,                  487                                   String abi,                     488                                   String instructionSet,          489                                   String appDataDir,              490                                   String[] zygoteArgs) {     ... 491         try { 492             return startViaZygote(processClass, niceName, uid, gid, gids, 493                     debugFlags, mountExternal, targetSdkVersion, seInfo, 494                     abi, instructionSet, appDataDir, zygoteArgs); 495         } catch (ZygoteStartFailedEx ex) { 496             Log.e(LOG_TAG, 497                     "Starting VM process through Zygote failed"); 498             throw new RuntimeException( 499                     "Starting VM process through Zygote failed", ex); 500         } 501     } 584     /** 585      * Starts a new process via the zygote mechanism. 586      * 587      * @param processClass Class name whose static main() to run 588      * @param niceName 'nice' process name to appear in ps 589      * @param uid a POSIX uid that the new process should setuid() to 590      * @param gid a POSIX gid that the new process shuold setgid() to 591      * @param gids null-ok; a list of supplementary group IDs that the 592      * new process should setgroup() to. 593      * @param debugFlags Additional flags. 594      * @param targetSdkVersion The target SDK version for the app. 595      * @param seInfo null-ok SELinux information for the new process. 596      * @param abi the ABI the process should use. 597      * @param instructionSet null-ok the instruction set to use.  598      * @param appDataDir null-ok the data directory of the app.   599      * @param extraArgs Additional arguments to supply to the zygote process. 600      * @return An object that describes the result of the attempt to start the process. 601      * @throws ZygoteStartFailedEx if process start failed for any reason 602      */                            603     private static ProcessStartResult startViaZygote(final String processClass, 604                                   final String niceName,          605                                   final int uid, final int gid,   606                                   final int[] gids, 607                                   int debugFlags, int mountExternal, 608                                   int targetSdkVersion, 609                                   String seInfo, 610                                   String abi, 611                                   String instructionSet, 612                                   String appDataDir, 613                                   String[] extraArgs) 614                                   throws ZygoteStartFailedEx {     ... 696             return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), argsForZygote); 697         } 698     } 714     /** 715      * Tries to open socket to Zygote process if not already open. If 716      * already open, does nothing.  May block and retry. 717      */ 718     private static ZygoteState openZygoteSocketIfNeeded(String abi) throws ZygoteStartFailedEx { 719         if (primaryZygoteState == null || primaryZygoteState.isClosed()) { 720             try { 721                 primaryZygoteState = ZygoteState.connect(ZYGOTE_SOCKET); 722             } catch (IOException ioe) { 723                 throw new ZygoteStartFailedEx("Error connecting to primary zygote", ioe); 724             } 725         } 726  727         if (primaryZygoteState.matches(abi)) { 728             return primaryZygoteState; 729         } 730  731         // The primary zygote didn't match. Try the secondary. 732         if (secondaryZygoteState == null || secondaryZygoteState.isClosed()) { 733             try { 734             secondaryZygoteState = ZygoteState.connect(SECONDARY_ZYGOTE_SOCKET); 735             } catch (IOException ioe) { 736                 throw new ZygoteStartFailedEx("Error connecting to secondary zygote", ioe); 737             } 738         } 739  740         if (secondaryZygoteState.matches(abi)) { 741             return secondaryZygoteState; 742         } 743  744         throw new ZygoteStartFailedEx("Unsupported zygote ABI: " + abi); 745     } 437     /** 438      * The state of the connection to the primary zygote. 439      */ 440     static ZygoteState primaryZygoteState; 441  442     /** 443      * The state of the connection to the secondary zygote. 444      */ 445     static ZygoteState secondaryZygoteState;

调用startViaZygote函数，从代码可以看到，Zygote创建进程是socket跨进程的调用。通过LocalSocket通信，来完成进程的创建，所以这里的Process.start只是一个Client端的调用，实际是由Server端的接收到消息后处理的。
Server端是app_process这个进程里，这是个常驻的系统服务。

frameworks/base/cmds/app_process/app_main.cpp

 34 class AppRuntime : public AndroidRuntime 35 {     ... 112 };

AppRuntime继承自AndroidRuntime，AndroidRuntime类是libandroid_runtime.so里导出的，frameworks/base/core/jni/AndroidRuntime.cpp。
app_ process这个进程在init.rc里会创建,app_process以zygote作为进程名。

//~/android-6.0.1_r62/frameworks/base/cmds/app_process/app_main.cpp186 int main(int argc, char* const argv[])187 {    ...197     AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));198     // Process command line arguments199     // ignore argv[0]200     argc--;201     argv++;    ...306     if (zygote) {307         runtime.start("com.android.internal.os.ZygoteInit", args, zygote);308     } else if (className) {309         runtime.start("com.android.internal.os.RuntimeInit", args, zygote);310     } else {311         fprintf(stderr, "Error: no class name or --zygote supplied.\n");312         app_usage();313         LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");314         return 10;315     }316 }

第一个if是正常的Zygote进程启动，执行AndroidRuntime::start，会调用ZygoteInit的类main函数。app_process的初始化就在ZygoteInit里，监听本地的socket，接收ZygoteClient的请求，当有请求来的时候，调用ZygoteConnection::runOnce，从而调用Zygote.forkAndSpecialize来创建新的进程，并且调用RuntimeInit.zygoteInit做进程的初始化，初始化过程就会调用ActivityThread.main。

//~/android-6.0.1_r62/frameworks/base/core/jni/AndroidRuntime.cpp 999 /*1000  * Start the Android runtime.  This involves starting the virtual machine1001  * and calling the "static void main(String[] args)" method in the class1002  * named by "className".1003  *1004  * Passes the main function two arguments, the class name and the specified1005  * options string.1006  */1007 void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)1008 {    ...1036     //const char* kernelHack = getenv("LD_ASSUME_KERNEL");1037     //ALOGD("Found LD_ASSUME_KERNEL='%s'\n", kernelHack);1038 1039     /* start the virtual machine */1040     JniInvocation jni_invocation;1041     jni_invocation.Init(NULL);1042     JNIEnv* env;1043     if (startVm(&mJavaVM, &env, zygote) != 0) {1044         return;1045     }1046     onVmCreated(env);    ...1079     /*1080      * Start VM.  This thread becomes the main thread of the VM, and will1081      * not return until the VM exits.1082      */1083     char* slashClassName = toSlashClassName(className);1084     jclass startClass = env->FindClass(slashClassName);1085     if (startClass == NULL) {1086         ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);1087         /* keep going */1088     } else {1089         jmethodID startMeth = env->GetStaticMethodID(startClass, "main",1090             "([Ljava/lang/String;)V");1091         if (startMeth == NULL) {1092             ALOGE("JavaVM unable to find main() in '%s'\n", className);1093             /* keep going */1094         } else {1095             env->CallStaticVoidMethod(startClass, startMeth, strArray);//执行类方法1096 1097 #if 01098             if (env->ExceptionCheck())1099                 threadExitUncaughtException(env);1100 #endif1101         }1102     }1103     free(slashClassName);    ...1110 }

第二个当指定了className的时候，则用com.android.internal.os.RuntimeInit作为入口。
而我们正常的Zygote进程则走的是ZygoteInit。
AndroidRuntime.start函数会调用startVm，frameworks/base/core/jni/AndroidRuntime.cpp。
而start函数中的CallStaticVoidMethod函数开始执行找到的类方法。