进程创建流程
- 不管从桌面启动应用还是应用内启动其它应用，如果这个应用所在进程不存在的话，都需要发起进程通过Binder机制告诉system server进程的AMS
- system server进程的AMS调用Process.start()方法，通过socket向zygote进程发送创建新进程的请求
- 在zygote进程的ZygoteInit.main方法中，有一个runSelectLoop循环体，通过acceptCommandPeer方法获取链接过来的客户端，再通过runOnce方法去创建进程
- 新的进程执行handleChildProc方法，最后通过反射调用ActivityThread.main()方法，这样一个新的APP进程就创建完成了
APP启动第三方应用
startActivity
当你在桌面启动一个应用或者在一个APP内启动一个应用，本质都是一样的，因为Android手机桌面其实就是一个APP（这点可参考Android之Activity启动流程源码深入解析），两种方式经过层层调用之后都会走到ActivityStackSupervisor.startSpecificActivityLocked方法，判断如果对方进程不存在，就需要去创建一个进程
startService
调用startService启动一个服务，该方法经过层层调用最终会走到ActiveServices.bringUpServiceLocked方法，如果判断对方进程不存在也会去创建一个新进程
sendBroadcast
调用sendBroadcast方法去发送一个广播，经过层层调用后走到BroadcastQueue.processNextBroadcast方法，也会判断BroadcastReceiver所在进程不存在就需要去创建进程
query
在ContentProvider的处理过程中，ContentResolver.query方法经过层层调用会走到ActivityManagerService.getContentProviderImpl方法，判断ContentProvider所在的进程不存在就会创建新进程
System Server请求创建进程
以下叙述中ActivityManagerService同意简称为AMS
以下源码基于API 24
上述四种途径最终都会走到如下方法
AMS.startProcessLocked
先来看ActivityManagerService的startProcessLocked方法，这是最开始入口
private final void startProcessLocked(ProcessRecord app, String hostingType,
String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs) {
//......省略代码
Process.ProcessStartResult startResult = Process.start(entryPoint,
app.processName, uid, uid, gids, debugFlags, mountExternal,
app.info.targetSdkVersion, app.info.seinfo, requiredAbi, instructionSet,
app.info.dataDir, entryPointArgs);
//......省略代码
}
代码是在太长，我们只看关键的地方，Process.start这个方法开始进行fork，ok那来看看它的内容,代码很长，可以直接看下面关于本段代码总结
public static final ProcessStartResult start(final String processClass,
final String niceName,
int uid, int gid, int[] gids,
int debugFlags, int mountExternal,
int targetSdkVersion,
String seInfo,
String abi,
String instructionSet,
String appDataDir,
String[] zygoteArgs) {
try {
return startViaZygote(processClass, niceName, uid, gid, gids,
debugFlags, mountExternal, targetSdkVersion, seInfo,
abi, instructionSet, appDataDir, zygoteArgs);
} catch (ZygoteStartFailedEx ex) {
Log.e(LOG_TAG,
"Starting VM process through Zygote failed");
throw new RuntimeException(
"Starting VM process through Zygote failed", ex);
}
} private static ProcessStartResult startViaZygote(final String processClass,
final String niceName,
final int uid, final int gid,
final int[] gids,
int debugFlags, int mountExternal,
int targetSdkVersion,
String seInfo,
String abi,
String instructionSet,
String appDataDir,
String[] extraArgs)
throws ZygoteStartFailedEx {
synchronized(Process.class) {
ArrayList<String> argsForZygote = new ArrayList<String>(); // --runtime-init, --setuid=, --setgid=,
// and --setgroups= must go first
argsForZygote.add("--runtime-init");
argsForZygote.add("--setuid=" + uid);
argsForZygote.add("--setgid=" + gid);
if ((debugFlags & Zygote.DEBUG_ENABLE_JNI_LOGGING) != 0) {
argsForZygote.add("--enable-jni-logging");
}
if ((debugFlags & Zygote.DEBUG_ENABLE_SAFEMODE) != 0) {
argsForZygote.add("--enable-safemode");
}
if ((debugFlags & Zygote.DEBUG_ENABLE_DEBUGGER) != 0) {
argsForZygote.add("--enable-debugger");
}
if ((debugFlags & Zygote.DEBUG_ENABLE_CHECKJNI) != 0) {
argsForZygote.add("--enable-checkjni");
}
if ((debugFlags & Zygote.DEBUG_ENABLE_ASSERT) != 0) {
argsForZygote.add("--enable-assert");
}
if (mountExternal == Zygote.MOUNT_EXTERNAL_MULTIUSER) {
argsForZygote.add("--mount-external-multiuser");
} else if (mountExternal == Zygote.MOUNT_EXTERNAL_MULTIUSER_ALL) {
argsForZygote.add("--mount-external-multiuser-all");
}
argsForZygote.add("--target-sdk-version=" + targetSdkVersion); //TODO optionally enable debuger
//argsForZygote.add("--enable-debugger"); // --setgroups is a comma-separated list
if (gids != null && gids.length > 0) {
StringBuilder sb = new StringBuilder();
sb.append("--setgroups="); int sz = gids.length;
for (int i = 0; i < sz; i++) {
if (i != 0) {
sb.append(',');
}
sb.append(gids[i]);
} argsForZygote.add(sb.toString());
} if (niceName != null) {
argsForZygote.add("--nice-name=" + niceName);
} if (seInfo != null) {
argsForZygote.add("--seinfo=" + seInfo);
} if (instructionSet != null) {
argsForZygote.add("--instruction-set=" + instructionSet);
} if (appDataDir != null) {
argsForZygote.add("--app-data-dir=" + appDataDir);
} argsForZygote.add(processClass); if (extraArgs != null) {
for (String arg : extraArgs) {
argsForZygote.add(arg);
}
} return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), argsForZygote);
}
}
上面的startViaZygote方法，所做的事情是：把参数最终放到一个列表中，接着调用zygoteSendArgsAndGetResult方法，该方法中的第一个参数是调用了openZygoteSocketIfNeeded(abi)方法，那我们先来看下这方法的内容
rivate static ZygoteState openZygoteSocketIfNeeded(String abi) throws ZygoteStartFailedEx {
if (primaryZygoteState == null || primaryZygoteState.isClosed()) {
try {
primaryZygoteState = ZygoteState.connect(ZYGOTE_SOCKET);
} catch (IOException ioe) {
throw new ZygoteStartFailedEx("Error connecting to primary zygote", ioe);
}
}
//......省略代码
}
ZygoteState.connect(ZYGOTE_SOCKET)接着看下这方法
/*与ZygoteInit的server socket建立链接通信*/
public static ZygoteState connect(String socketAddress) throws IOException {
DataInputStream zygoteInputStream = null;
BufferedWriter zygoteWriter = null;
final LocalSocket zygoteSocket = new LocalSocket(); try {
zygoteSocket.connect(new LocalSocketAddress(socketAddress,
LocalSocketAddress.Namespace.RESERVED)); zygoteInputStream = new DataInputStream(zygoteSocket.getInputStream()); zygoteWriter = new BufferedWriter(new OutputStreamWriter(
zygoteSocket.getOutputStream()), 256);
} catch (IOException ex) {
try {
zygoteSocket.close();
} catch (IOException ignore) {
} throw ex;
} String abiListString = getAbiList(zygoteWriter, zygoteInputStream);
Log.i("Zygote", "Process: zygote socket opened, supported ABIS: " + abiListString); return new ZygoteState(zygoteSocket, zygoteInputStream, zygoteWriter,
Arrays.asList(abiListString.split(",")));
}
上面的代码其实就是与ZygoteInit类中的ServerSocket建立连接，socket连接起来了，那就可以进行通信了。现在我们在返回到zygoteSendArgsAndGetResult方法
private static ProcessStartResult zygoteSendArgsAndGetResult(
ZygoteState zygoteState, ArrayList<String> args)
throws ZygoteStartFailedEx {
try {
/**
* See com.android.internal.os.ZygoteInit.readArgumentList()
* Presently the wire format to the zygote process is:
* a) a count of arguments (argc, in essence)
* b) a number of newline-separated argument strings equal to count
*
* After the zygote process reads these it will write the pid of
* the child or -1 on failure, followed by boolean to
* indicate whether a wrapper process was used.
*/
final BufferedWriter writer = zygoteState.writer;
final DataInputStream inputStream = zygoteState.inputStream; writer.write(Integer.toString(args.size()));
writer.newLine(); int sz = args.size();
for (int i = 0; i < sz; i++) {
String arg = args.get(i);
if (arg.indexOf('\n') >= 0) {
throw new ZygoteStartFailedEx(
"embedded newlines not allowed");
}
writer.write(arg);
writer.newLine();
} writer.flush(); // Should there be a timeout on this?
ProcessStartResult result = new ProcessStartResult();
result.pid = inputStream.readInt();
/*pid小于0代表有问题，＝＝0代表是子进程，》0代表是父进程*/
if (result.pid < 0) {
throw new ZygoteStartFailedEx("fork() failed");
}
result.usingWrapper = inputStream.readBoolean();
return result;
} catch (IOException ex) {
zygoteState.close();
throw new ZygoteStartFailedEx(ex);
}
}
代码也很简单，上面提到过client与server已经建立了socket连接，那这个方法，会把所有的参数通过socket发送到ZygoteInit的ServerSocket，发送完毕后，就等待ServerSocket把结果返回
Zygote进程处理fork请求
上一节提到过，client发送的建立socket连接最终会在ZygoteInit中创建一个ZygoteConnection对象，收到client发送的fork请求，会调用ZygoteConnection对象的runOnce方法，因此来看这方法
boolean runOnce() throws ZygoteInit.MethodAndArgsCaller {
//.......省略代码
pid = Zygote.forkAndSpecialize(parsedArgs.uid, parsedArgs.gid, parsedArgs.gids,
parsedArgs.debugFlags, rlimits, parsedArgs.mountExternal, parsedArgs.seInfo,
parsedArgs.niceName, fdsToClose, parsedArgs.instructionSet,
parsedArgs.appDataDir);
//......省略代码
try {
/*子进程执行pid＝＝0情况，父进程执行else情况*/
if (pid == 0) {
/*子进程*/
// in child
IoUtils.closeQuietly(serverPipeFd);
serverPipeFd = null;
handleChildProc(parsedArgs, descriptors, childPipeFd, newStderr);
// should never get here, the child is expected to either
// throw ZygoteInit.MethodAndArgsCaller or exec().
return true;
} else {
// in parent...pid of < 0 means failure
IoUtils.closeQuietly(childPipeFd);
childPipeFd = null;
/*Process中的io流监听的pid等信息都是通过下面的代码发出去的*/
return handleParentProc(pid, descriptors, serverPipeFd, parsedArgs);
}
} finally {
IoUtils.closeQuietly(childPipeFd);
IoUtils.closeQuietly(serverPipeFd);
}
}
Zygote.forkAndSpecialize这个方法会调用native方法来fork app进程，fork成功后，子进程就复制了基本上父进程所有的数据等，这在本节开始的时候科普过这个知识，子进程fork出的pid＝＝0，因此if(pid == 0){}else{}这段代码就特别有意思了，pid＝＝0是子进程执行，else是父进程执行，父进程执行的代码我就不贴了，它主要是把fork成功的pid返回给client端，这时候ActivityManagerService的startProcessLocked就可以继续执行。我们还是来看下子进程执行的代码，最终会执行
handleChildProc方法private void handleChildProc(Arguments parsedArgs,
FileDescriptor[] descriptors, FileDescriptor pipeFd, PrintStream newStderr)
throws ZygoteInit.MethodAndArgsCaller { //......省略代码 if (parsedArgs.runtimeInit) {
if (parsedArgs.invokeWith != null) {
WrapperInit.execApplication(parsedArgs.invokeWith,
parsedArgs.niceName, parsedArgs.targetSdkVersion,
pipeFd, parsedArgs.remainingArgs);
} else {
RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion,
parsedArgs.remainingArgs, null /* classLoader */);
}
} else {
// ......省略代码
}
}
从传递过来的参数可以定位最终调用了RuntimeInit.zygoteInit方法，那就来看下
public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
throws ZygoteInit.MethodAndArgsCaller {
if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting application from zygote"); redirectLogStreams(); commonInit();
nativeZygoteInit(); applicationInit(targetSdkVersion, argv, classLoader);
}
该方法我们只关注applicationInit(targetSdkVersion, argv, classLoader)这个方法
private static void applicationInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
throws ZygoteInit.MethodAndArgsCaller {
// If the application calls System.exit(), terminate the process
// immediately without running any shutdown hooks. It is not possible to
// shutdown an Android application gracefully. Among other things, the
// Android runtime shutdown hooks close the Binder driver, which can cause
// leftover running threads to crash before the process actually exits.
nativeSetExitWithoutCleanup(true); // We want to be fairly aggressive about heap utilization, to avoid
// holding on to a lot of memory that isn't needed.
VMRuntime.getRuntime().setTargetHeapUtilization(0.75f);
VMRuntime.getRuntime().setTargetSdkVersion(targetSdkVersion); final Arguments args;
try {
args = new Arguments(argv);
} catch (IllegalArgumentException ex) {
Slog.e(TAG, ex.getMessage());
// let the process exit
return;
} // Remaining arguments are passed to the start class's static main
invokeStaticMain(args.startClass, args.startArgs, classLoader);
} private static void invokeStaticMain(String className, String[] argv, ClassLoader classLoader)
throws ZygoteInit.MethodAndArgsCaller {
Class<?> cl; try {
cl = Class.forName(className, true, classLoader);
} catch (ClassNotFoundException ex) {
throw new RuntimeException(
"Missing class when invoking static main " + className,
ex);
} Method m;
try {
m = cl.getMethod("main", new Class[] { String[].class });
} catch (NoSuchMethodException ex) {
throw new RuntimeException(
"Missing static main on " + className, ex);
} catch (SecurityException ex) {
throw new RuntimeException(
"Problem getting static main on " + className, ex);
} int modifiers = m.getModifiers();
if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {
throw new RuntimeException(
"Main method is not public and static on " + className);
} /*
* This throw gets caught in ZygoteInit.main(), which responds
* by invoking the exception's run() method. This arrangement
* clears up all the stack frames that were required in setting
* up the process.
*/
throw new ZygoteInit.MethodAndArgsCaller(m, argv);
}
最终我们关注invokeStaticMain这个方法，该方法最终会抛出一个ZygoteInit.MethodAndArgsCaller(m, argv)异常，这个异常会把ActivityThread的main方法反射出来。
还记得上一节ZygoteInit的main方法吗
public static void main(String argv[]){
try{
//.....省略代码
} catch (MethodAndArgsCaller caller) {
caller.run();
} catch (RuntimeException ex) {
Log.e(TAG, "Zygote died with exception", ex);
closeServerSocket();
throw ex;
}
}
main方法最终会把MethodAndArgsCaller异常给捕获到，捕获到后其实最终就是调用ActivityThread的main方法
通过抛异常的方式来进行调用，主要目的是把当前线程的堆栈信息给置空