\system\core\rootdir\
  - init.zygote32.rc
\frameworks\base\cmds\app_process\
  - app_main.cpp
\frameworks\base\core\jni\
  - AndroidRuntime.cpp
  - com_android_internal_os_Zygote.cpp
\frameworks\base\core\java\com\android\internal\os\
  - ZygoteInit.java
  - ZygoteConnection.java
  - Zygote.java

system_server是zygote进程创建的第一个进程，zygote进程又是如何启动？Android系统创建的第一个Java进程为zygote，zygote是所有Java进程的父进程，包括system_server、phone等进程。zygote进程启动过程如下：

1 init进程启动app_process程序，启动zygote进程

init进程通过解析init.zygote32.rc文件，启动/system/bin/app_process可执行程序.

\system\core\rootdir\init.zygote32.rc

service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
    class main
    socket zygote stream 660 root system
    onrestart write /sys/android_power/request_state wake
    onrestart write /sys/power/state on
    onrestart restart media
    onrestart restart netd

app_process的源码在app_main.cpp中，进入main.

\frameworks\base\cmds\app_process\app_main.cpp

int main(int argc, char* const argv[])
{
    //参数为-Xzygote /system/bin --zygote --start-system-server
    AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));
    ...
     if (strcmp(arg, "--zygote") == 0) {
            zygote = true;
            niceName = ZYGOTE_NICE_NAME;
    }
    ...
    if (zygote) {
        runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
    } 
}

AppRuntime为AndroidRuntime的子类，

class AppRuntime : public AndroidRuntime

2 开启虚拟机，并进入ZygoteInit.main方法

\frameworks\base\core\jni\AndroidRuntime.cpp
void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
{
    /* start the virtual machine */
    JniInvocation jni_invocation;
    jni_invocation.Init(NULL);
    JNIEnv* env;
    if (startVm(&mJavaVM, &env, zygote) != 0) {//创建虚拟机
        return;
    }
    ...
        /*
     * Start VM.  This thread becomes the main thread of the VM, and will
     * not return until the VM exits.
     */
    char* slashClassName = toSlashClassName(className);
    jclass startClass = env->FindClass(slashClassName);
    if (startClass == NULL) {
        ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);
        /* keep going */
    } else {
        jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
            "([Ljava/lang/String;)V");
        if (startMeth == NULL) {
            ALOGE("JavaVM unable to find main() in '%s'\n", className);
            /* keep going */
        } else {
            //进入ZygoteInit.main
            env->CallStaticVoidMethod(startClass, startMeth, strArray);
            if (env->ExceptionCheck())
                threadExitUncaughtException(env);
        }
    }
}

3 创建zygote服务端，启动system_server进程，并循环接收进程创建请求

\frameworks\base\core\java\com\android\internal\os\ZygoteInit.java

public static void main(String argv[]) {
    String socketName = "zygote";
    ...
    registerZygoteSocket(socketName);//创建名为zygote的LocalServerSocket
    ...
    if (startSystemServer) {
        startSystemServer(abiList, socketName);//启动system_server进程
    }
    ...
    Log.i(TAG, "Accepting command socket connections");
    runSelectLoop(abiList);//循环处理进程创建请求，等待接收进程参数等数据，创建非system_server进程，如phone进程
}

runSelectLoop会调用runOnce，解析进程参数，发起创建子进程。

\frameworks/base/core/java/com/android/internal/os/ZygoteConnection.java

pid = Zygote.forkAndSpecialize(parsedArgs.uid, parsedArgs.gid, parsedArgs.gids,
                    parsedArgs.debugFlags, rlimits, parsedArgs.mountExternal, parsedArgs.seInfo,
                    parsedArgs.niceName, fdsToClose, parsedArgs.instructionSet,
                    parsedArgs.appDataDir);

4 native fork非system_server进程。

\frameworks/base/core/java/com/android/internal/os/Zygote.java

public static int forkAndSpecialize(int uid, int gid, int[] gids, int debugFlags,
          int[][] rlimits, int mountExternal, String seInfo, String niceName, int[] fdsToClose,
          String instructionSet, String appDataDir) {
        VM_HOOKS.preFork();
        int pid = nativeForkAndSpecialize(
                  uid, gid, gids, debugFlags, rlimits, mountExternal, seInfo, niceName, fdsToClose,
                  instructionSet, appDataDir);
}

5 jni fork非system_server进程接口。

\frameworks/base/core/jni/com_android_internal_os_Zygote.cpp

static jint com_android_internal_os_Zygote_nativeForkAndSpecialize(
        JNIEnv* env, jclass, jint uid, jint gid, jintArray gids,
        jint debug_flags, jobjectArray rlimits,
        jint mount_external, jstring se_info, jstring se_name,
        jintArray fdsToClose, jstring instructionSet, jstring appDataDir) {
    return ForkAndSpecializeCommon(env, uid, gid, gids, debug_flags,
            rlimits, capabilities, capabilities, mount_external, se_info,
            se_name, false, fdsToClose, instructionSet, appDataDir);
}

6 fork子进程，包括system_server进程、非system_server进程。

static pid_t ForkAndSpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArray javaGids,
                                     jint debug_flags, jobjectArray javaRlimits,
                                     jlong permittedCapabilities, jlong effectiveCapabilities,
                                     jint mount_external,
                                     jstring java_se_info, jstring java_se_name,
                                     bool is_system_server, jintArray fdsToClose,
                                     jstring instructionSet, jstring dataDir) {
                                       pid_t pid = fork();//创建子进程
                                     }

zygote进程启动完毕。

ActivityManagerService启动过程