Zygote进程的启动过程

init.rc启动Zygote.main()。

SystemServer进程的启动过程

简化的SystemServer的启动流程：

Zogote.main()  
    new ZygoteServer()  
    forkSystemServer()  
        Zygote.forkSystemServer()  
            nativeForkSystemServer()  
        handleSystemServerProcess()  
            ZygoteInit.zygoteInit()  
                ZygoteInit.nativeZygoteInit(); // 启动binder线程池
                RuntimeInit.applicationInit()  
                    findStaticMain() // 执行SystemServer.main()
    zygoteServer.runSelectLoop()

ZygoteInit.java

main() {
    preload();  // class, resource等等 
    zygoteServer = new ZygoteServer(isPrimaryZygote); // 创建socket
    if (startSystemServer) {
        Runnable r = forkSystemServer(); // 得到线程，在此线程中反射执行SystemServer.main()。
        r.run(); // 真正执行SystemServer.main()
    }
    zygoteServer.runSelectLoop(); // 无限循环，等待客户端socket的连接，然后通过ZygoteConnection.processOneCommand()来处理
}

private static Runnable forkSystemServer(String abiList, String socketName,
        ZygoteServer zygoteServer) {
    ...
    /* SystemServer的启动参数 */
    /* Hardcoded command line to start the system server */
    String args[] = {
            "--setuid=1000",
            "--setgid=1000",
            "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1023,"
                    + "1024,1032,1065,3001,3002,3003,3006,3007,3009,3010,3011",
            "--capabilities=" + capabilities + "," + capabilities,
            "--nice-name=system_server", // SystemServer的进程名是system_server
            "--runtime-args",
            "--target-sdk-version=" + VMRuntime.SDK_VERSION_CUR_DEVELOPMENT,
            "com.android.server.SystemServer", // 启动的类名，后面根据这个反射执行main()
	};
    ZygoteArguments parsedArgs = null;
    int pid;
    parsedArgs = new ZygoteArguments(args);
    /* Request to fork the system server process */
    pid = Zygote.forkSystemServer(
            parsedArgs.mUid, parsedArgs.mGid,
            parsedArgs.mGids,
            parsedArgs.mRuntimeFlags,
            null,
            parsedArgs.mPermittedCapabilities,
            parsedArgs.mEffectiveCapabilities);

    /* For child process */
    if (pid == 0) { // fork进程成功
        if (hasSecondZygote(abiList)) {
            waitForSecondaryZygote(socketName);
        }
        zygoteServer.closeServerSocket();
        return handleSystemServerProcess(parsedArgs);	// SystemServer进程启动后的准备工作
    }
    return null;
}

private static Runnable handleSystemServerProcess(ZygoteArguments parsedArgs) {
    if (parsedArgs.mInvokeWith != null) {
        String[] args = parsedArgs.mRemainingArgs;
        WrapperInit.execApplication(parsedArgs.mInvokeWith,
                parsedArgs.mNiceName, parsedArgs.mTargetSdkVersion,
                VMRuntime.getCurrentInstructionSet(), null, args);
        throw new IllegalStateException("Unexpected return from WrapperInit.execApplication");
    } else {
        return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion,
                parsedArgs.mDisabledCompatChanges,
                parsedArgs.mRemainingArgs, cl);
    }
}

public static final Runnable zygoteInit(int targetSdkVersion, long[] disabledCompatChanges,
        String[] argv, ClassLoader classLoader) {
    RuntimeInit.commonInit(); // 初始化运行环境
    ZygoteInit.nativeZygoteInit(); // 启动Binder线程池，用于和其他进程通信
    return RuntimeInit.applicationInit(targetSdkVersion, disabledCompatChanges, argv,
            classLoader); // 反射执行SystemServer.main()
}

RuntimeInit.java

protected static Runnable applicationInit(...) {
    return findStaticMain(args.startClass, args.startArgs, classLoader);
}

protected static Runnable findStaticMain(String className, String[] argv,
        ClassLoader classLoader) {
    Class<?> cl;
    cl = Class.forName(className, true, classLoader);
    Method m;
    m = cl.getMethod("main", new Class[] { String[].class });
    return new MethodAndArgsCaller(m, argv); // 以线程方式封装执行main()，这个线程将是SystemServer进程的主线程
}

static class MethodAndArgsCaller implements Runnable { // 内部类
    public MethodAndArgsCaller(Method method, String[] args) {...}
    public void run() {
        mMethod.invoke(null, new Object[] { mArgs });
    }
}

AMS的启动过程

SystemServer.java

public static void main(String[] args) {
    new SystemServer().run();
}

private void run() {
    Looper.prepareMainLooper();	// Looper
    System.loadLibrary("android_servers");
    performPendingShutdown();
    createSystemContext(); // 创建Context
	
    // Create the system service manager.
    mSystemServiceManager = new SystemServiceManager(mSystemContext); // 创建SystemServiceManager，用来创建后面的服务
    mSystemServiceManager.setRuntimeRestarted(mRuntimeRestart);
    LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);

    startBootstrapServices(); // 启动Installer、AMS、PowerMS、PackageMS...，不熟悉的没列出
    startCoreServices(); // BatteryService
    startOtherServices();
}

private void createSystemContext() {
    ActivityThread activityThread = ActivityThread.systemMain();
    mSystemContext = activityThread.getSystemContext();
    mSystemContext.setTheme(DEFAULT_SYSTEM_THEME);
    final Context systemUiContext = activityThread.getSystemUiContext();
    systemUiContext.setTheme(DEFAULT_SYSTEM_THEME);
}

private void startBootstrapServices() {
    Installer installer = mSystemServiceManager.startService(Installer.class);

    // Activity manager runs the show.
    traceBeginAndSlog("StartActivityManager");
    mActivityManagerService = mSystemServiceManager.startService(
            ActivityManagerService.Lifecycle.class).getService();
    mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
    mActivityManagerService.setInstaller(installer);
    traceEnd();
}

1、Zygote fork时，不会fork binder吗？socket是被fork的，在子进程中关闭的。 2、通知Zygote启动，为什么用socket而不是binder。