本次源码基于Android11分析
相干源码：
/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java/frameworks/base/services/core/java/com/android/server/am/ProcessList.java/frameworks/base/core/java/android/os/Process.java/frameworks/base/core/java/android/os/ZygoteProcess.java/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java/frameworks/base/core/java/com/android/internal/os/ZygoteServer.java/frameworks/base/core/java/com/android/internal/os/ZygoteConnection.java/frameworks/base/core/java/com/android/internal/os/Zygote.java/frameworks/base/core/java/android/app/ActivityThread.java/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java/frameworks/base/core/java/android/app/Instrumentation.java/frameworks/base/core/java/android/app/LoadedApk.java历程的启动过程
在四大组件：Activity、Service、ContentProvider、BroadcastReceiver，启动过程中，假如其承载的历程不存在，则会调用AMS.startProcessLocked方法创建历程。
1. AMS向Zygote哀求创建历程
AMS.startProcessLocked
调用startProcessLocked()方法开始启动历程
final ProcessList mProcessList; final ProcessRecord startProcessLocked(String processName, ApplicationInfo info, boolean knownToBeDead, int intentFlags, HostingRecord hostingRecord, int zygotePolicyFlags, boolean allowWhileBooting, boolean isolated, boolean keepIfLarge) { // 将其哀求创建历程逻辑交给ProcessList类处理惩罚 return mProcessList.startProcessLocked(processName, info, knownToBeDead, intentFlags, hostingRecord, zygotePolicyFlags, allowWhileBooting, isolated, 0 /* isolatedUid */, keepIfLarge, null /* ABI override */, null /* entryPoint */, null /* entryPointArgs */, null /* crashHandler */); }ActivityManagerService服务的startProcessLocked方法通过调用ProcessList.startProcessLocked方法，接下来看看ProcessList怎样处理惩罚：
ProcessList.startProcessLocked
public final class ProcessList { @GuardedBy("mService") final ProcessRecord startProcessLocked(String processName, ApplicationInfo info, boolean knownToBeDead, int intentFlags, HostingRecord hostingRecord, int zygotePolicyFlags, boolean allowWhileBooting, boolean isolated, int isolatedUid, boolean keepIfLarge, String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) { long startTime = SystemClock.uptimeMillis(); ProcessRecord app; if (!isolated) { //根据历程名和uid查抄相应的ProcessRecord app = getProcessRecordLocked(processName, info.uid, keepIfLarge); if ((intentFlags & Intent.FLAG_FROM_BACKGROUND) != 0) { //假如当前处于背景历程，查抄当进步程是否处于bad历程列表，假如处于返回null if (mService.mAppErrors.isBadProcessLocked(info)) { if (DEBUG_PROCESSES) Slog.v(TAG, "Bad process: " + info.uid + "/" + info.processName); return null; } } else { //当用户明白地启动历程，则清空crash次数，以包管其不处于bad历程直到下次再弹出crash对话框。 mService.mAppErrors.resetProcessCrashTimeLocked(info); if (mService.mAppErrors.isBadProcessLocked(info)) { EventLog.writeEvent(EventLogTags.AM_PROC_GOOD, UserHandle.getUserId(info.uid), info.uid, info.processName); mService.mAppErrors.clearBadProcessLocked(info); if (app != null) { app.bad = false; } } } } else { //对于孤立历程，无法再使用已存在的历程 app = null; } ProcessRecord precedence = null; //当存在ProcessRecord,且已分配pid(正在启动大概已经启动) if (app != null && app.pid > 0) { // 且caller并不以为该历程已殒命大概没有thread对象attached到该历程.则不应该清算该历程 if ((!knownToBeDead && !app.killed) || app.thread == null) { //假如这是历程中新package，则添加到列表 app.addPackage(info.packageName, info.longVersionCode, mService.mProcessStats); // 返回该ProcessRecord return app; } // 当ProcessRecord已经被attached到先前的一个历程，则杀死并清算该历程，并将app = null ProcessList.killProcessGroup(app.uid, app.pid); precedence = app; app = null; } if (app == null) { // 创建新的Process Record对象 app = newProcessRecordLocked(info, processName, isolated, isolatedUid, hostingRecord); if (app == null) { return null; } app.crashHandler = crashHandler; app.isolatedEntryPoint = entryPoint; app.isolatedEntryPointArgs = entryPointArgs; if (precedence != null) { app.mPrecedence = precedence; precedence.mSuccessor = app; } checkSlow(startTime, "startProcess: done creating new process record"); } else { // 假如这是历程中新package，则添加到列表 app.addPackage(info.packageName, info.longVersionCode, mService.mProcessStats); } //当体系未准备完毕，则将当进步程参加到mProcessesOnHold if (!mService.mProcessesReady && !mService.isAllowedWhileBooting(info) && !allowWhileBooting) { if (!mService.mProcessesOnHold.contains(app)) { mService.mProcessesOnHold.add(app); } return app; } // 启动历程 final boolean success = startProcessLocked(app, hostingRecord, zygotePolicyFlags, abiOverride); return success ? app : null; } @GuardedBy("mService") final boolean startProcessLocked(ProcessRecord app, HostingRecord hostingRecord, int zygotePolicyFlags, String abiOverride) { return startProcessLocked(app, hostingRecord, zygotePolicyFlags, false /* disableHiddenApiChecks */, false /* disableTestApiChecks */, false /* mountExtStorageFull */, abiOverride); } @GuardedBy("mService") boolean startProcessLocked(ProcessRecord app, HostingRecord hostingRecord, int zygotePolicyFlags, boolean disableHiddenApiChecks, boolean disableTestApiChecks, boolean mountExtStorageFull, String abiOverride) { if (app.pendingStart) { return true; } long startTime = SystemClock.uptimeMillis(); //当app的pid大于0且不是当进步程的pid，则从mPidsSelfLocked中移除该app.pid if (app.pid > 0 && app.pid != ActivityManagerService.MY_PID) { mService.removePidLocked(app); app.bindMountPending = false; mService.mHandler.removeMessages(PROC_START_TIMEOUT_MSG, app); app.setPid(0); app.startSeq = 0; } //从mProcessesOnHold移除该app mService.mProcessesOnHold.remove(app); //更新cpu统计信息 mService.updateCpuStats(); //当前package已被冻结,则抛出非常 try { try { final int userId = UserHandle.getUserId(app.uid); AppGlobals.getPackageManager().checkPackageStartable(app.info.packageName, userId); } catch (RemoteException e) { throw e.rethrowAsRuntimeException(); } int uid = app.uid; int[] gids = null; int mountExternal = Zygote.MOUNT_EXTERNAL_NONE; if (!app.isolated) { int[] permGids = null; try { //通过Package Manager获取gids final IPackageManager pm = AppGlobals.getPackageManager(); permGids = pm.getPackageGids(app.info.packageName, MATCH_DIRECT_BOOT_AUTO, app.userId); if (StorageManager.hasIsolatedStorage() && mountExtStorageFull) { mountExternal = Zygote.MOUNT_EXTERNAL_FULL; } else { StorageManagerInternal storageManagerInternal = LocalServices.getService( StorageManagerInternal.class); mountExternal = storageManagerInternal.getExternalStorageMountMode(uid, app.info.packageName); } } catch (RemoteException e) { throw e.rethrowAsRuntimeException(); } //添加共享app和gids，用于app直接共享资源 if (app.processInfo != null && app.processInfo.deniedPermissions != null) { for (int i = app.processInfo.deniedPermissions.size() - 1; i >= 0; i--) { int[] denyGids = mService.mPackageManagerInt.getPermissionGids( app.processInfo.deniedPermissions.valueAt(i), app.userId); if (denyGids != null) { for (int gid : denyGids) { permGids = ArrayUtils.removeInt(permGids, gid); } } } } gids = computeGidsForProcess(mountExternal, uid, permGids); } //.... // 设置app ProcessRecord的参数 app.gids = gids; app.setRequiredAbi(requiredAbi); app.instructionSet = instructionSet; // entryPoint 为 android.app.ActivityThread final String entryPoint = "android.app.ActivityThread"; // 调用startProcessLocked方法，继续哀求Zygote创建新历程 return startProcessLocked(hostingRecord, entryPoint, app, uid, gids, runtimeFlags, zygotePolicyFlags, mountExternal, seInfo, requiredAbi, instructionSet, invokeWith, startTime); } catch (RuntimeException e) { //... return false; } } @GuardedBy("mService") boolean startProcessLocked(HostingRecord hostingRecord, String entryPoint, ProcessRecord app, int uid, int[] gids, int runtimeFlags, int zygotePolicyFlags, int mountExternal, String seInfo, String requiredAbi, String instructionSet, String invokeWith, long startTime) { // 终极都会调用startProcess()方法,调用Zygote历程创建历程 final Process.ProcessStartResult startResult = startProcess(hostingRecord, entryPoint, app, uid, gids, runtimeFlags, zygotePolicyFlags, mountExternal, seInfo, requiredAbi, instructionSet, invokeWith, startTime); } private Process.ProcessStartResult startProcess(HostingRecord hostingRecord, String entryPoint, ProcessRecord app, int uid, int[] gids, int runtimeFlags, int zygotePolicyFlags, int mountExternal, String seInfo, String requiredAbi, String instructionSet, String invokeWith, long startTime) { try { //... // 通过Process.start关照Zygote历程创建历程 startResult = Process.start(entryPoint, app.processName, uid, uid, gids, runtimeFlags, mountExternal, app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet, app.info.dataDir, invokeWith, app.info.packageName, zygotePolicyFlags, isTopApp, app.mDisabledCompatChanges, pkgDataInfoMap, whitelistedAppDataInfoMap, bindMountAppsData, bindMountAppStorageDirs, new String[]{PROC_START_SEQ_IDENT + app.startSeq}); return startResult; } finally { Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER); } }}对于非独立App，会根据历程名和uid查找到历程的信息，假如存在历程而且不在bad历程列表而且没有thread对象attached到该历程则直接返回该历程信息。否则创建新的历程，而且通过ProcessList. startProcessLocked层层调用终极调用Process.start向Zygote历程发起哀求。
Process.start
public class Process { public static final ZygoteProcess ZYGOTE_PROCESS = new ZygoteProcess(); public static ProcessStartResult start(@NonNull final String processClass, @Nullable final String niceName, int uid, int gid, @Nullable int[] gids, int runtimeFlags, int mountExternal, int targetSdkVersion, @Nullable String seInfo, @NonNull String abi, @Nullable String instructionSet, @Nullable String appDataDir, @Nullable String invokeWith, @Nullable String packageName, int zygotePolicyFlags, boolean isTopApp, @Nullable long[] disabledCompatChanges, @Nullable Map<String, Pair<String, Long>> pkgDataInfoMap, @Nullable Map<String, Pair<String, Long>> whitelistedDataInfoMap, boolean bindMountAppsData, boolean bindMountAppStorageDirs, @Nullable String[] zygoteArgs) { // 调用ZygoteProcess.start return ZYGOTE_PROCESS.start(processClass, niceName, uid, gid, gids, runtimeFlags, mountExternal, targetSdkVersion, seInfo, abi, instructionSet, appDataDir, invokeWith, packageName, zygotePolicyFlags, isTopApp, disabledCompatChanges, pkgDataInfoMap, whitelistedDataInfoMap, bindMountAppsData, bindMountAppStorageDirs, zygoteArgs); }}第一个参数processClass为：ActivityThread。
第二个参数niceName为：历程名 。
Process.start方法继续调用ZygoteProcess. start方法。
ZygoteProcess. start
public class ZygoteProcess { public final Process.ProcessStartResult start(@NonNull final String processClass, final String niceName, int uid, int gid, @Nullable int[] gids, int runtimeFlags, int mountExternal, int targetSdkVersion, @Nullable String seInfo, @NonNull String abi, @Nullable String instructionSet, @Nullable String appDataDir, @Nullable String invokeWith, @Nullable String packageName, int zygotePolicyFlags, boolean isTopApp, @Nullable long[] disabledCompatChanges, @Nullable Map<String, Pair<String, Long>> pkgDataInfoMap, @Nullable Map<String, Pair<String, Long>> whitelistedDataInfoMap, boolean bindMountAppsData, boolean bindMountAppStorageDirs, @Nullable String[] zygoteArgs) { // TODO (chriswailes): Is there a better place to check this value? if (fetchUsapPoolEnabledPropWithMinInterval()) { informZygotesOfUsapPoolStatus(); } try { // 调用startViaZygote return startViaZygote(processClass, niceName, uid, gid, gids, runtimeFlags, mountExternal, targetSdkVersion, seInfo, abi, instructionSet, appDataDir, invokeWith, /*startChildZygote=*/ false, packageName, zygotePolicyFlags, isTopApp, disabledCompatChanges, pkgDataInfoMap, whitelistedDataInfoMap, bindMountAppsData, bindMountAppStorageDirs, zygoteArgs); } catch (ZygoteStartFailedEx ex) { Log.e(LOG_TAG, "Starting VM process through Zygote failed"); throw new RuntimeException( "Starting VM process through Zygote failed", ex); } } private Process.ProcessStartResult startViaZygote(@NonNull final String processClass, @Nullable final String niceName, final int uid, final int gid, @Nullable final int[] gids, int runtimeFlags, int mountExternal, int targetSdkVersion, @Nullable String seInfo, @NonNull String abi, @Nullable String instructionSet, @Nullable String appDataDir, @Nullable String invokeWith, boolean startChildZygote, @Nullable String packageName, int zygotePolicyFlags, boolean isTopApp, @Nullable long[] disabledCompatChanges, @Nullable Map<String, Pair<String, Long>> pkgDataInfoMap, @Nullable Map<String, Pair<String, Long>> whitelistedDataInfoMap, boolean bindMountAppsData, boolean bindMountAppStorageDirs, @Nullable String[] extraArgs) throws ZygoteStartFailedEx { // 往argsForZygote数组填写历程信息 ArrayList<String> argsForZygote = new ArrayList<>(); // --runtime-args, --setuid=, --setgid=, // and --setgroups= must go first argsForZygote.add("--runtime-args"); argsForZygote.add("--setuid=" + uid); argsForZygote.add("--setgid=" + gid); argsForZygote.add("--runtime-flags=" + runtimeFlags); if (mountExternal == Zygote.MOUNT_EXTERNAL_DEFAULT) { argsForZygote.add("--mount-external-default"); } else if (mountExternal == Zygote.MOUNT_EXTERNAL_READ) { argsForZygote.add("--mount-external-read"); } else if (mountExternal == Zygote.MOUNT_EXTERNAL_WRITE) { argsForZygote.add("--mount-external-write"); } else if (mountExternal == Zygote.MOUNT_EXTERNAL_FULL) { argsForZygote.add("--mount-external-full"); } else if (mountExternal == Zygote.MOUNT_EXTERNAL_INSTALLER) { argsForZygote.add("--mount-external-installer"); } else if (mountExternal == Zygote.MOUNT_EXTERNAL_LEGACY) { argsForZygote.add("--mount-external-legacy"); } else if (mountExternal == Zygote.MOUNT_EXTERNAL_PASS_THROUGH) { argsForZygote.add("--mount-external-pass-through"); } else if (mountExternal == Zygote.MOUNT_EXTERNAL_ANDROID_WRITABLE) { argsForZygote.add("--mount-external-android-writable"); } argsForZygote.add("--target-sdk-version=" + targetSdkVersion); // --setgroups is a comma-separated list if (gids != null && gids.length > 0) { final StringBuilder sb = new StringBuilder(); sb.append("--setgroups="); final int sz = gids.length; for (int i = 0; i < sz; i++) { if (i != 0) { sb.append(','); } sb.append(gids); } argsForZygote.add(sb.toString()); } if (niceName != null) { argsForZygote.add("--nice-name=" + niceName); } if (seInfo != null) { argsForZygote.add("--seinfo=" + seInfo); } if (instructionSet != null) { argsForZygote.add("--instruction-set=" + instructionSet); } if (appDataDir != null) { argsForZygote.add("--app-data-dir=" + appDataDir); } // ... synchronized (mLock) { //先跟Zygote创建socket通讯，然后通过socket向Zygote历程发送消息并返回结果 return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), zygotePolicyFlags, argsForZygote); } }调用startViaZygote方法将吸收的历程的参数，写入到argsForZygote数组中。末了分别调用了openZygoteSocketIfNeeded方法创建与zygote历程的通讯，和调用zygoteSendArgsAndGetResult方法给zygote历程发送并返回消息。
openZygoteSocketIfNeeded与Zygote创建通讯
public class ZygoteProcess { // 根据当前的abi,选择对应的zygote通讯 @GuardedBy("mLock") private ZygoteState openZygoteSocketIfNeeded(String abi) throws ZygoteStartFailedEx { try { //向主zygote发起connect()使用 attemptConnectionToPrimaryZygote(); // 跟abi匹配乐成 if (primaryZygoteState.matches(abi)) { return primaryZygoteState; } if (mZygoteSecondarySocketAddress != null) { //当主zygote没能匹配乐成，则采取第二个zygote，发起connect()使用 attemptConnectionToSecondaryZygote(); if (secondaryZygoteState.matches(abi)) { return secondaryZygoteState; } } } catch (IOException ioe) { throw new ZygoteStartFailedEx("Error connecting to zygote", ioe); } throw new ZygoteStartFailedEx("Unsupported zygote ABI: " + abi); } // 向主zygote创建通讯 @GuardedBy("mLock") private void attemptConnectionToPrimaryZygote() throws IOException { if (primaryZygoteState == null || primaryZygoteState.isClosed()) { //向主zygote发起connect()使用 primaryZygoteState = ZygoteState.connect(mZygoteSocketAddress, mUsapPoolSocketAddress); maybeSetApiBlacklistExemptions(primaryZygoteState, false); maybeSetHiddenApiAccessLogSampleRate(primaryZygoteState); } } // 向次Zygote创建通讯 @GuardedBy("mLock") private void attemptConnectionToSecondaryZygote() throws IOException { if (secondaryZygoteState == null || secondaryZygoteState.isClosed()) { //向第二zygote发起connect()使用 secondaryZygoteState = ZygoteState.connect(mZygoteSecondarySocketAddress, mUsapPoolSecondarySocketAddress); maybeSetApiBlacklistExemptions(secondaryZygoteState, false); maybeSetHiddenApiAccessLogSampleRate(secondaryZygoteState); } } private static class ZygoteState implements AutoCloseable { // ZygoteState.connect创建通讯的方法 static ZygoteState connect(@NonNull LocalSocketAddress zygoteSocketAddress, @Nullable LocalSocketAddress usapSocketAddress) throws IOException { DataInputStream zygoteInputStream; BufferedWriter zygoteOutputWriter; final LocalSocket zygoteSessionSocket = new LocalSocket(); if (zygoteSocketAddress == null) { throw new IllegalArgumentException("zygoteSocketAddress can't be null"); } try { // 毗连socket服务器 zygoteSessionSocket.connect(zygoteSocketAddress); zygoteInputStream = new DataInputStream(zygoteSessionSocket.getInputStream()); // 写入和通报socket数据 zygoteOutputWriter = new BufferedWriter( new OutputStreamWriter(zygoteSessionSocket.getOutputStream()), Zygote.SOCKET_BUFFER_SIZE); } catch (IOException ex) { try { zygoteSessionSocket.close(); } catch (IOException ignore) { } throw ex; } // 初始化ZygoteState对象 return new ZygoteState(zygoteSocketAddress, usapSocketAddress, zygoteSessionSocket, zygoteInputStream, zygoteOutputWriter, getAbiList(zygoteOutputWriter, zygoteInputStream)); } }openZygoteSocketIfNeeded方法通过abi匹配是和zygote通讯还是和zygote64通讯，通过ZygoteState.connect方法通过socket与Zygote创建通讯毗连。
zygoteSendArgsAndGetResult给Zygote发送吸收消息
public class ZygoteProcess { @GuardedBy("mLock") private Process.ProcessStartResult zygoteSendArgsAndGetResult( ZygoteState zygoteState, int zygotePolicyFlags, @NonNull ArrayList<String> args) throws ZygoteStartFailedEx { // 数组重界说为String String msgStr = args.size() + "\n" + String.join("\n", args) + "\n"; // ... // 将参数 return attemptZygoteSendArgsAndGetResult(zygoteState, msgStr); } private Process.ProcessStartResult attemptZygoteSendArgsAndGetResult( ZygoteState zygoteState, String msgStr) throws ZygoteStartFailedEx { try { final BufferedWriter zygoteWriter = zygoteState.mZygoteOutputWriter; final DataInputStream zygoteInputStream = zygoteState.mZygoteInputStream; // 写入对应的参数 zygoteWriter.write(msgStr); zygoteWriter.flush(); // 获取Zygote历程运行竣事对应的返回结果 Process.ProcessStartResult result = new Process.ProcessStartResult(); //期待socket服务端（即zygote）返回新创建的历程pid; result.pid = zygoteInputStream.readInt(); result.usingWrapper = zygoteInputStream.readBoolean(); if (result.pid < 0) { throw new ZygoteStartFailedEx("fork() failed"); } return result; } catch (IOException ex) { zygoteState.close(); Log.e(LOG_TAG, "IO Exception while communicating with Zygote - " + ex.toString()); throw new ZygoteStartFailedEx(ex); } }}zygoteSendArgsAndGetResult方法通过调用attemptZygoteSendArgsAndGetResult方法去发送消息，attemptZygoteSendArgsAndGetResult通过ZygoteState拿到BufferedWriter和DataInputStream，通过BufferedWriter去写入数据发送，通过DataInputStream去期待Zygote创建历程的pid。
2. Zygote历程fork新历程
runSelectLoop 死循环卵化历程
public class ZygoteInit { public static void main(String argv[]) { //... preload(bootTimingsTraceLog); Runnable r = forkSystemServer(abiList, zygoteSocketName, zygoteServer); //循环期待创建历程监听 caller = zygoteServer.runSelectLoop(abiList); if (caller != null) { caller.run(); } }}class ZygoteServer { Runnable runSelectLoop(String abiList) { ArrayList<FileDescriptor> socketFDs = new ArrayList<>(); ArrayList<ZygoteConnection> peers = new ArrayList<>(); //sServerSocket是socket通讯中的服务端，即zygote历程。生存到fds[0] socketFDs.add(mZygoteSocket.getFileDescriptor()); peers.add(null); // 死循环监听消息 while (true) { //... StructPollfd[] pollFDs; if (mUsapPoolEnabled) { usapPipeFDs = Zygote.getUsapPipeFDs(); pollFDs = new StructPollfd[socketFDs.size() + 1 + usapPipeFDs.length]; } else { pollFDs = new StructPollfd[socketFDs.size()]; } int pollIndex = 0; for (FileDescriptor socketFD : socketFDs) { pollFDs[pollIndex] = new StructPollfd(); pollFDs[pollIndex].fd = socketFD; pollFDs[pollIndex].events = (short) POLLIN; ++pollIndex; } //.... int pollReturnValue; try { //处理惩罚轮询状态，当pollFds有变乱到来则往下实行，否则壅闭在这里 pollReturnValue = Os.poll(pollFDs, pollTimeoutMs); } catch (ErrnoException ex) { throw new RuntimeException("poll failed", ex); } if (pollReturnValue == 0) { // The poll timeout has been exceeded. This only occurs when we have finished the // USAP pool refill delay period. mUsapPoolRefillTriggerTimestamp = INVALID_TIMESTAMP; mUsapPoolRefillAction = UsapPoolRefillAction.DELAYED; } else { boolean usapPoolFDRead = false; while (--pollIndex >= 0) { if ((pollFDs[pollIndex].revents & POLLIN) == 0) { continue; } // 当此时的pollIndex为0的时间，表明ZygoteServer启动后，有一个客户端来毗连 if (pollIndex == 0) { // 收到客户端毗连哀求，调用acceptCommandPeer函数初始化一个ZygoteConnection对象 ZygoteConnection newPeer = acceptCommandPeer(abiList); peers.add(newPeer); socketFDs.add(newPeer.getFileDescriptor()); } else if (pollIndex < usapPoolEventFDIndex) { // 当前已经至少有一个ZygoteConnection毗连创建完成 try { // 获取对应的ZygoteConnection对象，并调用其processOneCommand函数 ZygoteConnection connection = peers.get(pollIndex); final Runnable command = connection.processOneCommand(this); //.... } } } } } } // 创建ZygoteConnection链接 private ZygoteConnection acceptCommandPeer(String abiList) { try { return createNewConnection(mZygoteSocket.accept(), abiList); } catch (IOException ex) { throw new RuntimeException( "IOException during accept()", ex); } } protected ZygoteConnection createNewConnection(LocalSocket socket, String abiList) throws IOException { return new ZygoteConnection(socket, abiList); }}在runSelectLoop方法中死循环调用Os.poll处理惩罚轮询状态，假如有新历程必要创建则激活继续实行，没有常见新历程变乱则不绝壅闭。当收到客户端毗连时，会调用acceptCommandPeer创建一个ZygoteConnection。末了调用ZygoteConnection.processOneCommand创建新历程。
ZygoteConnection.processOneCommand 创建新历程
class ZygoteConnection { Runnable processOneCommand(ZygoteServer zygoteServer) { String[] args; try { // 读取zygote socket通报过来的参数数据 args = Zygote.readArgumentList(mSocketReader); } catch (IOException ex) { throw new IllegalStateException("IOException on command socket", ex); } //... //将binder客户端通报过来的参数，分析成Arguments对象格式 ZygoteArguments parsedArgs = new ZygoteArguments(args); //... // 调用Zygote的forkAndSpecialize函数，fork创建新历程 pid = Zygote.forkAndSpecialize(parsedArgs.mUid, parsedArgs.mGid, parsedArgs.mGids, parsedArgs.mRuntimeFlags, rlimits, parsedArgs.mMountExternal, parsedArgs.mSeInfo, parsedArgs.mNiceName, fdsToClose, fdsToIgnore, parsedArgs.mStartChildZygote, parsedArgs.mInstructionSet, parsedArgs.mAppDataDir, parsedArgs.mIsTopApp, parsedArgs.mPkgDataInfoList, parsedArgs.mWhitelistedDataInfoList, parsedArgs.mBindMountAppDataDirs, parsedArgs.mBindMountAppStorageDirs); try { if (pid == 0) { // 子历程 // 调用并返回handleChildProc方法 return handleChildProc(parsedArgs, childPipeFd, parsedArgs.mStartChildZygote); } else { // 父历程.... return null; } } //... }}processOneCommand方法重要做了两件事：
- 实行Zygote.forkAndSpecialize方法通过fork()方法去创建新历程。
- 对于新创建的新历程，实行handleChildProc行止理惩罚子历程的使用
Zygote.forkAndSpecialize 创建子历程
public final class Zygote { static int forkAndSpecialize(int uid, int gid, int[] gids, int runtimeFlags, int[][] rlimits, int mountExternal, String seInfo, String niceName, int[] fdsToClose, int[] fdsToIgnore, boolean startChildZygote, String instructionSet, String appDataDir, boolean isTopApp, String[] pkgDataInfoList, String[] whitelistedDataInfoList, boolean bindMountAppDataDirs, boolean bindMountAppStorageDirs) { // Zygote历程的4个Daemon子线程stop ZygoteHooks.preFork(); // 调用JNI方法fork新历程，调用[com_android_internal_os_Zygote.cpp]com_android_internal_os_Zygote_nativeForkAndSpecialize方法 int pid = nativeForkAndSpecialize( uid, gid, gids, runtimeFlags, rlimits, mountExternal, seInfo, niceName, fdsToClose, fdsToIgnore, startChildZygote, instructionSet, appDataDir, isTopApp, pkgDataInfoList, whitelistedDataInfoList, bindMountAppDataDirs, bindMountAppStorageDirs); // Zygote历程的4个Daemon子线程start ZygoteHooks.postForkCommon(); return pid; } // JNI方法，调用[com_android_internal_os_Zygote.cpp]com_android_internal_os_Zygote_nativeForkAndSpecialize方法 private static native int nativeForkAndSpecialize(int uid, int gid, int[] gids, int runtimeFlags, int[][] rlimits, int mountExternal, String seInfo, String niceName, int[] fdsToClose, int[] fdsToIgnore, boolean startChildZygote, String instructionSet, String appDataDir, boolean isTopApp, String[] pkgDataInfoList, String[] whitelistedDataInfoList, boolean bindMountAppDataDirs, boolean bindMountAppStorageDirs);}在创建子历程前，会把Zygote历程的4个Daemon子线程stop，在创建完子历程后，重新对Zygote历程的4个Daemon子线程start。
通过调用nativeForkAndSpecializeJNI方法去创建子历程，对应实行[com_android_internal_os_Zygote.cpp]com_android_internal_os_Zygote_nativeForkAndSpecialize方法
// com_android_internal_os_Zygote.cpp static jint com_android_internal_os_Zygote_nativeForkAndSpecialize( JNIEnv*env, jclass, jint uid, jint gid, jintArray gids, jint runtime_flags, jobjectArray rlimits, jint mount_external, jstring se_info, jstring nice_name, jintArray managed_fds_to_close, jintArray managed_fds_to_ignore, jboolean is_child_zygote, jstring instruction_set, jstring app_data_dir, jboolean is_top_app, jobjectArray pkg_data_info_list, jobjectArray whitelisted_data_info_list, jboolean mount_data_dirs, jboolean mount_storage_dirs) { //... 创建新历程 pid_t pid = ForkCommon(env, false, fds_to_close, fds_to_ignore, true); if (pid == 0) { SpecializeCommon(env, uid, gid, gids, runtime_flags, rlimits, capabilities, capabilities, mount_external, se_info, nice_name, false, is_child_zygote == JNI_TRUE, instruction_set, app_data_dir, is_top_app == JNI_TRUE, pkg_data_info_list, whitelisted_data_info_list, mount_data_dirs == JNI_TRUE, mount_storage_dirs == JNI_TRUE); } return pid; } static pid_t ForkCommon(JNIEnv*env, bool is_system_server, const std::vector<int>&fds_to_close, const std::vector<int>&fds_to_ignore, bool is_priority_fork) { //... //从Zygote历程中复制一个新历程 pid_t pid = fork(); //... return pid; }fork()是Linux创建历程的尺度方法，采取copy on write技能，这里要留意的两点是：
- 创建的子历程跟父历程共用资源，比如新创建子历程跟Zygote历程共用资源，它们共用同一个物理空间，只有在写时要发生改变的时间才会指向两个物理空间
- 调用一次fork()会返回两次：
父历程：返回新创建子历程的pid
子历程：返回0
非常： 返回负数
自此已经完成新子历程的创建，下面开始调用``处理惩罚关于子历程的使用。
handleChildProc 子历程处理惩罚
class ZygoteConnection { private Runnable handleChildProc(ZygoteArguments parsedArgs, FileDescriptor pipeFd, boolean isZygote) { //关闭当前的socket毗连 closeSocket(); //设置历程名称 Zygote.setAppProcessName(parsedArgs, TAG); if (parsedArgs.mInvokeWith != null) { //... } else { if (!isZygote) { // 非Zygote历程，实行此方法 return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion, parsedArgs.mDisabledCompatChanges, parsedArgs.mRemainingArgs, null /* classLoader */); } else { // Zygote历程 return ZygoteInit.childZygoteInit(parsedArgs.mTargetSdkVersion, parsedArgs.mRemainingArgs, null /* classLoader */); } } }}public class ZygoteInit { public static final Runnable zygoteInit(int targetSdkVersion, long[] disabledCompatChanges, String[] argv, ClassLoader classLoader) { RuntimeInit.redirectLogStreams(); //重定向log输出 RuntimeInit.commonInit(); // 通用的一些初始化 ZygoteInit.nativeZygoteInit(); // zygote初始化 // 终极实行ActivityThread.main()方法 return RuntimeInit.applicationInit(targetSdkVersion, disabledCompatChanges, argv, classLoader); }}对于新创建的子历程会复制Zygote历程的Socket，以是会关闭此socket毗连，接着调用ZygoteInit.zygoteInit方法返回一个Runnable。ZygoteInit.zygoteInit方法会做三件事：
- RuntimeInit.commonInit() 做一些通用的设置如设置时区
- ZygoteInit.nativeZygoteInit() 创建启动Binder
- RuntimeInit.applicationInit 调用ActivityThread.main()方法
RuntimeInit.commonInit() 通用设置
public class RuntimeInit { @UnsupportedAppUsage protected static final void commonInit() { // 设置默认的未捕获非常处理惩罚方法 Thread.setDefaultUncaughtExceptionHandler(new KillApplicationHandler(loggingHandler)); // 设置市区，中国时区为"Asia/Shanghai" RuntimeHooks.setTimeZoneIdSupplier(() -> SystemProperties.get("persist.sys.timezone")); //重置log设置 LogManager.getLogManager().reset(); new AndroidConfig(); // 设置默认的HTTP User-agent格式,用于 HttpURLConnection。 String userAgent = getDefaultUserAgent(); System.setProperty("http.agent", userAgent); // 设置socket的tag，用于网络流量统计 NetworkManagementSocketTagger.install(); }}做些通用的设置，比如设置默认的未捕获非常处理惩罚方法、设置时区，设置log,设置Hppt等。
ZygoteInit.nativeZygoteInit() 开启Binder设置
// JNI方法，对应调用此方法class AppRuntime :public AndroidRuntime{ virtual void onZygoteInit() { sp< rocessState> proc=ProcessState::self(); // open打开驱动和mmap映射所在 proc->startThreadPool();//启动新binder线程 } }ProcessState::self()会调用open()方法打开Binder装备，实行mmap()方法举行映射。
startThreadPool()启动新Binder线程，循环监听变乱。
RuntimeInit.applicationInit 实行startClass.main方法
public class RuntimeInit { protected static Runnable applicationInit(int targetSdkVersion, long[] disabledCompatChanges, String[] argv, ClassLoader classLoader) { //true代表应用步调退出时不调用AppRuntime.onExit()，否则会在退出前调用 nativeSetExitWithoutCleanup(true); // 设置假造机 VMRuntime.getRuntime().setTargetSdkVersion(targetSdkVersion); VMRuntime.getRuntime().setDisabledCompatChanges(disabledCompatChanges); //分析参数 final Arguments args = new Arguments(argv); // 调用args.startClass类的static main()方法 return findStaticMain(args.startClass, args.startArgs, classLoader); } protected static Runnable findStaticMain(String className, String[] argv, ClassLoader classLoader) { // ... Class<?> cl; cl = Class.forName(className, true, classLoader); // ... Method m; m = cl.getMethod("main", new Class[]{String[].class}); // ... int modifiers = m.getModifiers(); // ... // 返回此Runnable,此run()方法就是实行此main()方法 return new MethodAndArgsCaller(m, argv); }}static class MethodAndArgsCaller implements Runnable { private final Method mMethod; private final String[] mArgs; public MethodAndArgsCaller(Method method, String[] args) { mMethod = method; mArgs = args; } public void run() { try { // 反射实行方法 mMethod.invoke(null, new Object[]{mArgs}); } catch (IllegalAccessException ex) { throw new RuntimeException(ex); } catch (InvocationTargetException ex) { Throwable cause = ex.getCause(); if (cause instanceof RuntimeException) { throw (RuntimeException) cause; } else if (cause instanceof Error) { throw (Error) cause; } throw new RuntimeException(ex); } }}args.startClass就是ActivityThread类，通过反射调用ActivityThread.main()方法，MethodAndArgsCaller是一个Runnable类，终极在ZygoteInit.main实行Runnable.run方法。
3. Application 的创建与绑定
新历程创建后会实行ActivityThread.main()方法：
public final class ActivityThread extends ClientTransactionHandler { public static void main(String[] args) { //... // 创建主线程Looper Looper.prepareMainLooper(); // 创建ActivityThread对象 ActivityThread thread = new ActivityThread(); // 创建Binder通道,向AMS(system_server历程)发送消息 thread.attach(false, startSeq); // 主线程的Handler，即mH if (sMainThreadHandler == null) { sMainThreadHandler = thread.getHandler(); } //消息循环运行 Looper.loop(); throw new RuntimeException("Main thread loop unexpectedly exited"); } final ApplicationThread mAppThread = new ApplicationThread(); private void attach(boolean system, long startSeq) { sCurrentActivityThread = this; mSystemThread = system; if (!system) { // .... final IActivityManager mgr = ActivityManager.getService(); try { //通过Binder通道跨历程调用AMS.attachApplication，mAppThread是ApplicationThread mgr.attachApplication(mAppThread, startSeq); } catch (RemoteException ex) { throw ex.rethrowFromSystemServer(); } //.. } else { //... } //... }创建完主线程的Looper，并通过调用attach()方法，调用Binder跨历程的方式调用AMS. attachApplication方法，并让其绑定ApplicationThread类。
public class ActivityManagerService extends IActivityManager.Stub implements Watchdog.Monitor, BatteryStatsImpl.BatteryCallback { // 这里的thread是ApplicationThread public final void attachApplication(IApplicationThread thread, long startSeq) { if (thread == null) { throw new SecurityException("Invalid application interface"); } synchronized (this) { int callingPid = Binder.getCallingPid(); final int callingUid = Binder.getCallingUid(); final long origId = Binder.clearCallingIdentity(); // 调用attachApplicationLocked方法 attachApplicationLocked(thread, callingPid, callingUid, startSeq); Binder.restoreCallingIdentity(origId); } } private boolean attachApplicationLocked(@NonNull IApplicationThread thread, int pid, int callingUid, long startSeq) { // 通过 pid 查询到历程信息，之前 fork 后有缓存 ProcessRecord app; if (pid != MY_PID && pid >= 0) { synchronized (mPidsSelfLocked) { // 根据pid获取ProcessRecord app = mPidsSelfLocked.get(pid); } //... } else { app = null; } //... 做一些历程信息的查抄管理，假如为空或不符合将杀死历程 final String processName = app.processName; try { // 绑定殒命关照，AMS就会知道历程的殒命 AppDeathRecipient adr = new AppDeathRecipient( app, pid, thread); thread.asBinder().linkToDeath(adr, 0); app.deathRecipient = adr; } catch (RemoteException e) { app.resetPackageList(mProcessStats); //重新启动历程 mProcessList.startProcessLocked(app, new HostingRecord("link fail", processName), ZYGOTE_POLICY_FLAG_EMPTY); return false; } //.. //获取应用信息 ApplicationInfo appInfo = instr != null ? instr.mTargetInfo : app.info; //... // 回调 bindApplication 方法 thread.bindApplication(processName, appInfo, providerList, null, profilerInfo, null, null, null, testMode, mBinderTransactionTrackingEnabled, enableTrackAllocation, isRestrictedBackupMode || !normalMode, app.isPersistent(), new Configuration(app.getWindowProcessController().getConfiguration()), app.compat, getCommonServicesLocked(app.isolated), mCoreSettingsObserver.getCoreSettingsLocked(), buildSerial, autofillOptions, contentCaptureOptions, app.mDisabledCompatChanges); // 绑定 thread app.makeActive(thread, mProcessStats); //... return true; }}通过pid去查询历程的信息，此pid在历程创建的时间缓存。对历程信息的一系列查抄过后，假如查抄历程信息不符合会杀死历程或重启历程。今后回调ApplicationThread.bindApplication方法，并将ApplicationThread绑定到ProcessRecord.thread中。
public final class ActivityThread extends ClientTransactionHandler { Application mInitialApplication; private class ApplicationThread extends IApplicationThread.Stub { @Override public final void bindApplication(String processName, ApplicationInfo appInfo, ProviderInfoList providerList, ComponentName instrumentationName, ProfilerInfo profilerInfo, Bundle instrumentationArgs, IInstrumentationWatcher instrumentationWatcher, IUiAutomationConnection instrumentationUiConnection, int debugMode, boolean enableBinderTracking, boolean trackAllocation, boolean isRestrictedBackupMode, boolean persistent, Configuration config, CompatibilityInfo compatInfo, Map services, Bundle coreSettings, String buildSerial, AutofillOptions autofillOptions, ContentCaptureOptions contentCaptureOptions, long[] disabledCompatChanges) { if (services != null) { //... //将services缓存起来, 淘汰binder检索服务的次数 ServiceManager.initServiceCache(services); } //发送消息H.SET_CORE_SETTINGS setCoreSettings(coreSettings); //初始化AppBindData AppBindData data = new AppBindData(); data.processName = processName; data.appInfo = appInfo; data.providers = providerList.getList(); data.instrumentationName = instrumentationName; data.instrumentationArgs = instrumentationArgs; data.instrumentationWatcher = instrumentationWatcher; data.instrumentationUiAutomationConnection = instrumentationUiConnection; data.debugMode = debugMode; data.enableBinderTracking = enableBinderTracking; data.trackAllocation = trackAllocation; data.restrictedBackupMode = isRestrictedBackupMode; data.persistent = persistent; data.config = config; data.compatInfo = compatInfo; data.initProfilerInfo = profilerInfo; data.buildSerial = buildSerial; data.autofillOptions = autofillOptions; data.contentCaptureOptions = contentCaptureOptions; data.disabledCompatChanges = disabledCompatChanges; //发送消息H.BIND_APPLICATION,对应实行handleBindApplication()方法 sendMessage(H.BIND_APPLICATION, data); } } @UnsupportedAppUsage private void handleBindApplication(AppBindData data) { //... //获取LoadedApk对象 data.info = getPackageInfoNoCheck(data.appInfo, data.compatInfo); //... Application app; try { // 此处data.info是指LoadedApk, 创建应用Application对象 app = data.info.makeApplication(data.restrictedBackupMode, null); mInitialApplication = app; } } public final LoadedApk getPackageInfoNoCheck(ApplicationInfo ai, CompatibilityInfo compatInfo) { return getPackageInfo(ai, compatInfo, null, false, true, false); } private LoadedApk getPackageInfo(ApplicationInfo aInfo, CompatibilityInfo compatInfo, ClassLoader baseLoader, boolean securityViolation, boolean includeCode, boolean registerPackage) { final boolean differentUser = (UserHandle.myUserId() != UserHandle.getUserId(aInfo.uid)); synchronized (mResourcesManager) { WeakReference<LoadedApk> ref; if (differentUser) { //不支持跨用户 ref = null; } else if (includeCode) { ref = mPackages.get(aInfo.packageName); } else { ref = mResourcePackages.get(aInfo.packageName); } LoadedApk packageInfo = ref != null ? ref.get() : null; if (packageInfo != null) { if (!isLoadedApkResourceDirsUpToDate(packageInfo, aInfo)) { List<String> oldPaths = new ArrayList<>(); LoadedApk.makePaths(this, aInfo, oldPaths); packageInfo.updateApplicationInfo(aInfo, oldPaths); } // 返回LoadedApk return packageInfo; } //创建LoadedApk对象 packageInfo = new LoadedApk(this, aInfo, compatInfo, baseLoader, securityViolation, includeCode && (aInfo.flags & ApplicationInfo.FLAG_HAS_CODE) != 0, registerPackage); // 返回 LoadedApk return packageInfo; } }}getPackageInfoNoCheck方法会创建一个LoadedApk类，这个类存储了App应用信息。今后调用LoadedApk. makeApplication创建Application。
public final class LoadedApk { public Application makeApplication(boolean forceDefaultAppClass, Instrumentation instrumentation) { if (mApplication != null) { return mApplication; } Application app = null; // 查找到 application 的 class String appClass = mApplicationInfo.className; if (forceDefaultAppClass || (appClass == null)) { // 默认是 android.app.Application appClass = "android.app.Application"; } try { final java.lang.ClassLoader cl = getClassLoader(); if (!mPackageName.equals("android")) { initializeJavaContextClassLoader(); } //... // 创建一个ContextImpl ContextImpl appContext = ContextImpl.createAppContext(mActivityThread, this); // 创建和绑定 Application ，并绑定ContextImpl app = mActivityThread.mInstrumentation.newApplication( cl, appClass, appContext); appContext.setOuterContext(app); } catch (Exception e) { } mActivityThread.mAllApplications.add(app); //设置mApplication对象值 mApplication = app; if (instrumentation != null) { try { // 调用 Application 的 onCreate 方法 instrumentation.callApplicationOnCreate(app); } catch (Exception e) { //... } } return app; }}public class Instrumentation { static public Application newApplication(Class<?> clazz, Context context) throws InstantiationException, IllegalAccessException, ClassNotFoundException { Application app = (Application) clazz.newInstance(); app.attach(context); return app; }}class ContextImpl extends Context { static ContextImpl createAppContext(ActivityThread mainThread, LoadedApk packageInfo) { return createAppContext(mainThread, packageInfo, null); } static ContextImpl createAppContext(ActivityThread mainThread, LoadedApk packageInfo, String opPackageName) { if (packageInfo == null) throw new IllegalArgumentException("packageInfo"); ContextImpl context = new ContextImpl(null, mainThread, packageInfo, null, null, null, null, 0, null, opPackageName); context.setResources(packageInfo.getResources()); context.mIsSystemOrSystemUiContext = isSystemOrSystemUI(context); return context; }}makeApplication方法先检察应用是否界说了Application，假如没有使用默认的android.app.Application。之后创建一个ContextImpl，它包罗了LoadedApk等应用信息。创建万之后调用Instrumentation.newApplication方法把ContextImpl设置给新创建的Application。末了调用Application.onCreate。
总结
- 四大组件启动前，会查抄是否创建新历程
- 调用AMS. startProcessLocked 通过socket发送历程创建消息
- Zygote历程收到AMS消息后，通过fork创建新历程
- 对用子历程，会调用其ActivityThread.main方法
- ActivityThread.attch向AMS发起ApplicationThread绑定，之后回调ApplicationThread。
- ApplicationThread创建Application类，并为其绑定ContextImpl和实行其onCreate方法。
|
