简介

基于Android 11.0的源码剖析， 分析Android进程是如何一步步创建的

一、概述

1.1 system_server进程和Zygote进程

system_server进程：用于管理整个Java framework层，包含ActivityManager，PowerManager等各种系统服务;

Zygote进程：是Android系统的首个Java进程，Zygote是所有Java进程的父进程，包括 system_server进程以及所有的App进程都是Zygote的子进程，注意这里说的是子进程，而非子线程。

1.2 进程创建简图

(1) App发起进程：当从桌面启动应用，则发起进程便是Launcher所在进程；当从某App内启动远程进程，则发送进程便是该App所在进程。发起进程先通过binder发送消息给system_server进程

(2) system_server进程：调用Process.start()方法，通过socket向zygote进程发送创建新进程请求

(3) zygote进程：在执行ZygoteInit.main()后便进入runSelectLoop()循环体内，当有客户端连接时便会执行ZygoteConnection.runOnce()方法，再经过层层调用后fork出新的应用进程

(4) 新进程：执行handleChildProc方法，最后调用ActivityThread.main()方法。 

接下来，依次从system_server进程发起请求到Zygote创建进程，再到新进程的运行这展开讲解。

二、system_server 发起请求

2.1 Process.start

public class Process {/*** State associated with the zygote process.* @hide*/public static final ZygoteProcess ZYGOTE_PROCESS = new ZygoteProcess();public static ProcessStartResult start(@NonNull final String processClass,@Nullable final String niceName,int uid, int gid, @Nullable int[] gids,int runtimeFlags,int mountExternal,int targetSdkVersion,@Nullable String seInfo,@NonNull String abi,@Nullable String instructionSet,@Nullable String appDataDir,@Nullable String invokeWith,@Nullable String packageName,int zygotePolicyFlags,boolean isTopApp,@Nullable long[] disabledCompatChanges,@Nullable Map<String, Pair<String, Long>>pkgDataInfoMap,@Nullable Map<String, Pair<String, Long>>whitelistedDataInfoMap,boolean bindMountAppsData,boolean bindMountAppStorageDirs,@Nullable String[] zygoteArgs) {return ZYGOTE_PROCESS.start(processClass, niceName, uid, gid, gids,runtimeFlags, mountExternal, targetSdkVersion, seInfo,abi, instructionSet, appDataDir, invokeWith, packageName,zygotePolicyFlags, isTopApp, disabledCompatChanges,pkgDataInfoMap, whitelistedDataInfoMap, bindMountAppsData,bindMountAppStorageDirs, zygoteArgs);}
}

/*** Maintains communication state with the zygote processes. This class is responsible* for the sockets opened to the zygotes and for starting processes on behalf of the* {@link android.os.Process} class.** {@hide}*/
public class ZygoteProcess {...public final Process.ProcessStartResult start(@NonNull final String processClass,final String niceName,int uid, int gid, @Nullable int[] gids,int runtimeFlags, int mountExternal,int targetSdkVersion,@Nullable String seInfo,@NonNull String abi,@Nullable String instructionSet,@Nullable String appDataDir,@Nullable String invokeWith,@Nullable String packageName,int zygotePolicyFlags,boolean isTopApp,@Nullable long[] disabledCompatChanges,@Nullable Map<String, Pair<String, Long>>pkgDataInfoMap,@Nullable Map<String, Pair<String, Long>>allowlistedDataInfoList,boolean bindMountAppsData,boolean bindMountAppStorageDirs,@Nullable String[] zygoteArgs) {...try {return startViaZygote(processClass, niceName, uid, gid, gids,runtimeFlags, mountExternal, targetSdkVersion, seInfo,abi, instructionSet, appDataDir, invokeWith, /*startChildZygote=*/ false,packageName, zygotePolicyFlags, isTopApp, disabledCompatChanges,pkgDataInfoMap, allowlistedDataInfoList, bindMountAppsData,bindMountAppStorageDirs, zygoteArgs);} catch (ZygoteStartFailedEx ex) {...}}private Process.ProcessStartResult startViaZygote(@NonNull final String processClass,@Nullable final String niceName,final int uid, final int gid,@Nullable final int[] gids,int runtimeFlags, int mountExternal,int targetSdkVersion,@Nullable String seInfo,@NonNull String abi,@Nullable String instructionSet,@Nullable String appDataDir,@Nullable String invokeWith,boolean startChildZygote,@Nullable String packageName,int zygotePolicyFlags,boolean isTopApp,@Nullable long[] disabledCompatChanges,@Nullable Map<String, Pair<String, Long>>pkgDataInfoMap,@Nullable Map<String, Pair<String, Long>>allowlistedDataInfoList,boolean bindMountAppsData,boolean bindMountAppStorageDirs,@Nullable String[] extraArgs)throws ZygoteStartFailedEx {ArrayList<String> argsForZygote = new ArrayList<>();// --runtime-args, --setuid=, --setgid=,// and --setgroups= must go firstargsForZygote.add("--runtime-args");argsForZygote.add("--setuid=" + uid);argsForZygote.add("--setgid=" + gid);argsForZygote.add("--runtime-flags=" + runtimeFlags);if (mountExternal == Zygote.MOUNT_EXTERNAL_DEFAULT) {argsForZygote.add("--mount-external-default");} else if (mountExternal == Zygote.MOUNT_EXTERNAL_INSTALLER) {argsForZygote.add("--mount-external-installer");} else if (mountExternal == Zygote.MOUNT_EXTERNAL_PASS_THROUGH) {argsForZygote.add("--mount-external-pass-through");} else if (mountExternal == Zygote.MOUNT_EXTERNAL_ANDROID_WRITABLE) {argsForZygote.add("--mount-external-android-writable");}argsForZygote.add("--target-sdk-version=" + targetSdkVersion);// --setgroups is a comma-separated listif (gids != null && gids.length > 0) {final StringBuilder sb = new StringBuilder();sb.append("--setgroups=");final int sz = gids.length;for (int i = 0; i < sz; i++) {if (i != 0) {sb.append(',');}sb.append(gids[i]);}argsForZygote.add(sb.toString());}if (niceName != null) {argsForZygote.add("--nice-name=" + niceName);}if (seInfo != null) {argsForZygote.add("--seinfo=" + seInfo);}if (instructionSet != null) {argsForZygote.add("--instruction-set=" + instructionSet);}if (appDataDir != null) {argsForZygote.add("--app-data-dir=" + appDataDir);}if (invokeWith != null) {argsForZygote.add("--invoke-with");argsForZygote.add(invokeWith);}if (startChildZygote) {argsForZygote.add("--start-child-zygote");}if (packageName != null) {argsForZygote.add("--package-name=" + packageName);}if (isTopApp) {argsForZygote.add(Zygote.START_AS_TOP_APP_ARG);}if (pkgDataInfoMap != null && pkgDataInfoMap.size() > 0) {StringBuilder sb = new StringBuilder();sb.append(Zygote.PKG_DATA_INFO_MAP);sb.append("=");boolean started = false;for (Map.Entry<String, Pair<String, Long>> entry : pkgDataInfoMap.entrySet()) {if (started) {sb.append(',');}started = true;sb.append(entry.getKey());sb.append(',');sb.append(entry.getValue().first);sb.append(',');sb.append(entry.getValue().second);}argsForZygote.add(sb.toString());}if (allowlistedDataInfoList != null && allowlistedDataInfoList.size() > 0) {StringBuilder sb = new StringBuilder();sb.append(Zygote.ALLOWLISTED_DATA_INFO_MAP);sb.append("=");boolean started = false;for (Map.Entry<String, Pair<String, Long>> entry : allowlistedDataInfoList.entrySet()) {if (started) {sb.append(',');}started = true;sb.append(entry.getKey());sb.append(',');sb.append(entry.getValue().first);sb.append(',');sb.append(entry.getValue().second);}argsForZygote.add(sb.toString());}if (bindMountAppStorageDirs) {argsForZygote.add(Zygote.BIND_MOUNT_APP_STORAGE_DIRS);}if (bindMountAppsData) {argsForZygote.add(Zygote.BIND_MOUNT_APP_DATA_DIRS);}if (disabledCompatChanges != null && disabledCompatChanges.length > 0) {StringBuilder sb = new StringBuilder();sb.append("--disabled-compat-changes=");int sz = disabledCompatChanges.length;for (int i = 0; i < sz; i++) {if (i != 0) {sb.append(',');}sb.append(disabledCompatChanges[i]);}argsForZygote.add(sb.toString());}argsForZygote.add(processClass);if (extraArgs != null) {Collections.addAll(argsForZygote, extraArgs);}synchronized(mLock) {// The USAP pool can not be used if the application will not use the systems graphics// driver.  If that driver is requested use the Zygote application start path.return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi),zygotePolicyFlags,argsForZygote);}}/*** Sends an argument list to the zygote process, which starts a new child* and returns the child's pid. Please note: the present implementation* replaces newlines in the argument list with spaces.** @throws ZygoteStartFailedEx if process start failed for any reason*/@GuardedBy("mLock")private Process.ProcessStartResult zygoteSendArgsAndGetResult(ZygoteState zygoteState, int zygotePolicyFlags, @NonNull ArrayList<String> args)throws ZygoteStartFailedEx {...return attemptZygoteSendArgsAndGetResult(zygoteState, msgStr);}private Process.ProcessStartResult attemptZygoteSendArgsAndGetResult(ZygoteState zygoteState, String msgStr) throws ZygoteStartFailedEx {try {final BufferedWriter zygoteWriter = zygoteState.mZygoteOutputWriter;final DataInputStream zygoteInputStream = zygoteState.mZygoteInputStream;zygoteWriter.write(msgStr);zygoteWriter.flush();// Always read the entire result from the input stream to avoid leaving// bytes in the stream for future process starts to accidentally stumble// upon.Process.ProcessStartResult result = new Process.ProcessStartResult();//等待socket服务端（即zygote）返回新创建的进程pid;result.pid = zygoteInputStream.readInt();result.usingWrapper = zygoteInputStream.readBoolean();if (result.pid < 0) {throw new ZygoteStartFailedEx("fork() failed");}return result;} catch (IOException ex) {...}}
}

zygoteSendArgsAndGetResult方法的主要功能是通过socket通道向Zygote进程发送一个参数列表，然后进入阻塞等待状态，直到远端的socket服务端发送回来新创建的进程pid才返回。

2.2 ZygoteProcess.openZygoteSocketIfNeeded

public class ZygoteProcess {.../*** Tries to open a session socket to a Zygote process with a compatible ABI if one is not* already open. If a compatible session socket is already open that session socket is returned.* This function may block and may have to try connecting to multiple Zygotes to find the* appropriate one.  Requires that mLock be held.*/@GuardedBy("mLock")private ZygoteState openZygoteSocketIfNeeded(String abi) throws ZygoteStartFailedEx {try {attemptConnectionToPrimaryZygote();if (primaryZygoteState.matches(abi)) {return primaryZygoteState;}if (mZygoteSecondarySocketAddress != null) {// The primary zygote didn't match. Try the secondary.attemptConnectionToSecondaryZygote();if (secondaryZygoteState.matches(abi)) {return secondaryZygoteState;}}} catch (IOException ioe) {throw new ZygoteStartFailedEx("Error connecting to zygote", ioe);}throw new ZygoteStartFailedEx("Unsupported zygote ABI: " + abi);}/*** Creates a ZygoteState for the primary zygote if it doesn't exist or has been disconnected.*/@GuardedBy("mLock")private void attemptConnectionToPrimaryZygote() throws IOException {if (primaryZygoteState == null || primaryZygoteState.isClosed()) {//向主zygote发起connect()操作primaryZygoteState =ZygoteState.connect(mZygoteSocketAddress, mUsapPoolSocketAddress);maybeSetApiDenylistExemptions(primaryZygoteState, false);maybeSetHiddenApiAccessLogSampleRate(primaryZygoteState);}}/*** Creates a ZygoteState for the secondary zygote if it doesn't exist or has been disconnected.*/@GuardedBy("mLock")private void attemptConnectionToSecondaryZygote() throws IOException {if (secondaryZygoteState == null || secondaryZygoteState.isClosed()) {//当主zygote没能匹配成功，则采用第二个zygote，发起connect()操作secondaryZygoteState =ZygoteState.connect(mZygoteSecondarySocketAddress,mUsapPoolSecondarySocketAddress);maybeSetApiDenylistExemptions(secondaryZygoteState, false);maybeSetHiddenApiAccessLogSampleRate(secondaryZygoteState);}}
}

openZygoteSocketIfNeeded(abi)方法是根据当前的abi来选择与zygote还是zygote64来进行通信。

既然system_server进程的zygoteSendArgsAndGetResult()方法通过socket向Zygote进程发送消息，这时便会唤醒Zygote进程，来响应socket客户端的请求（即system_server端），接下来的操作便是在Zygote来创建进程。

三、Zygote 创建进程

Zygote进程是由init进程而创建的，进程启动之后调用ZygoteInit.main()方法，经过创建socket管道，预加载资源后，便进程runSelectLoop()方法。

3.1 ZygoteInit.main

/**
* Startup class for the zygote process.
*
* Pre-initializes some classes, and then waits for commands on a UNIX domain socket. Based on these
* commands, forks off child processes that inherit the initial state of the VM.
*
* Please see {@link ZygoteArguments} for documentation on the client protocol.
*
* @hide
*/
public class ZygoteInit {.../*** This is the entry point for a Zygote process.  It creates the Zygote server, loads resources,* and handles other tasks related to preparing the process for forking into applications.** This process is started with a nice value of -20 (highest priority).  All paths that flow* into new processes are required to either set the priority to the default value or terminate* before executing any non-system code.  The native side of this occurs in SpecializeCommon,* while the Java Language priority is changed in ZygoteInit.handleSystemServerProcess,* ZygoteConnection.handleChildProc, and Zygote.usapMain.** @param argv  Command line arguments used to specify the Zygote's configuration.*/@UnsupportedAppUsagepublic static void main(String argv[]) {ZygoteServer zygoteServer = null;// Mark zygote start. This ensures that thread creation will throw// an error.ZygoteHooks.startZygoteNoThreadCreation();// Zygote goes into its own process group.try {Os.setpgid(0, 0);} catch (ErrnoException ex) {throw new RuntimeException("Failed to setpgid(0,0)", ex);}Runnable caller;try {// Store now for StatsLogging later.final long startTime = SystemClock.elapsedRealtime();final boolean isRuntimeRestarted = "1".equals(SystemProperties.get("sys.boot_completed"));String bootTimeTag = Process.is64Bit() ? "Zygote64Timing" : "Zygote32Timing";TimingsTraceLog bootTimingsTraceLog = new TimingsTraceLog(bootTimeTag,Trace.TRACE_TAG_DALVIK);bootTimingsTraceLog.traceBegin("ZygoteInit");RuntimeInit.preForkInit();boolean startSystemServer = false;String zygoteSocketName = "zygote";String abiList = null;boolean enableLazyPreload = false;for (int i = 1; i < argv.length; i++) {if ("start-system-server".equals(argv[i])) {startSystemServer = true;} else if ("--enable-lazy-preload".equals(argv[i])) {enableLazyPreload = true;} else if (argv[i].startsWith(ABI_LIST_ARG)) {abiList = argv[i].substring(ABI_LIST_ARG.length());} else if (argv[i].startsWith(SOCKET_NAME_ARG)) {zygoteSocketName = argv[i].substring(SOCKET_NAME_ARG.length());} else {throw new RuntimeException("Unknown command line argument: " + argv[i]);}}final boolean isPrimaryZygote = zygoteSocketName.equals(Zygote.PRIMARY_SOCKET_NAME);if (!isRuntimeRestarted) {if (isPrimaryZygote) {FrameworkStatsLog.write(FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME_REPORTED,BOOT_TIME_EVENT_ELAPSED_TIME__EVENT__ZYGOTE_INIT_START,startTime);} else if (zygoteSocketName.equals(Zygote.SECONDARY_SOCKET_NAME)) {FrameworkStatsLog.write(FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME_REPORTED,BOOT_TIME_EVENT_ELAPSED_TIME__EVENT__SECONDARY_ZYGOTE_INIT_START,startTime);}}if (abiList == null) {throw new RuntimeException("No ABI list supplied.");}// In some configurations, we avoid preloading resources and classes eagerly.// In such cases, we will preload things prior to our first fork.if (!enableLazyPreload) {bootTimingsTraceLog.traceBegin("ZygotePreload");EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,SystemClock.uptimeMillis());preload(bootTimingsTraceLog);EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,SystemClock.uptimeMillis());bootTimingsTraceLog.traceEnd(); // ZygotePreload}// Do an initial gc to clean up after startupbootTimingsTraceLog.traceBegin("PostZygoteInitGC");gcAndFinalize();bootTimingsTraceLog.traceEnd(); // PostZygoteInitGCbootTimingsTraceLog.traceEnd(); // ZygoteInitZygote.initNativeState(isPrimaryZygote);ZygoteHooks.stopZygoteNoThreadCreation();zygoteServer = new ZygoteServer(isPrimaryZygote);if (startSystemServer) {Runnable r = forkSystemServer(abiList, zygoteSocketName, zygoteServer);// {@code r == null} in the parent (zygote) process, and {@code r != null} in the// child (system_server) process.if (r != null) {r.run();return;}}Log.i(TAG, "Accepting command socket connections");// The select loop returns early in the child process after a fork and// loops forever in the zygote.caller = zygoteServer.runSelectLoop(abiList);} catch (Throwable ex) {Log.e(TAG, "System zygote died with exception", ex);throw ex;} finally {if (zygoteServer != null) {zygoteServer.closeServerSocket();}}// We're in the child process and have exited the select loop. Proceed to execute the// command.if (caller != null) {caller.run();}}
}

3.2 ZygoteServer.runSelectLoop

/**
* Server socket class for zygote processes.
*
* Provides functions to wait for commands on a UNIX domain socket, and fork
* off child processes that inherit the initial state of the VM.%
*
* Please see {@link ZygoteArguments} for documentation on the
* client protocol.
*/
class ZygoteServer {.../*** Runs the zygote process's select loop. Accepts new connections as* they happen, and reads commands from connections one spawn-request's* worth at a time.*/Runnable runSelectLoop(String abiList) {ArrayList<FileDescriptor> socketFDs = new ArrayList<>();ArrayList<ZygoteConnection> peers = new ArrayList<>();//mZygoteSocket是socket通信中的服务端，即zygote进程，保存到socketFDs[0]socketFDs.add(mZygoteSocket.getFileDescriptor());peers.add(null);...while (true) {fetchUsapPoolPolicyPropsWithMinInterval();mUsapPoolRefillAction = UsapPoolRefillAction.NONE;int[] usapPipeFDs = null;StructPollfd[] pollFDs;// Allocate enough space for the poll structs, taking into account// the state of the USAP pool for this Zygote (could be a// regular Zygote, a WebView Zygote, or an AppZygote).if (mUsapPoolEnabled) {usapPipeFDs = Zygote.getUsapPipeFDs();pollFDs = new StructPollfd[socketFDs.size() + 1 + usapPipeFDs.length];} else {pollFDs = new StructPollfd[socketFDs.size()];}/** For reasons of correctness the USAP pool pipe and event FDs* must be processed before the session and server sockets.  This* is to ensure that the USAP pool accounting information is* accurate when handling other requests like API blacklist* exemptions.*/int pollIndex = 0;for (FileDescriptor socketFD : socketFDs) {pollFDs[pollIndex] = new StructPollfd();pollFDs[pollIndex].fd = socketFD;pollFDs[pollIndex].events = (short) POLLIN;++pollIndex;}...int pollReturnValue;try {//处理轮询状态，当pollFds有事件到来则往下执行，否则阻塞在这里pollReturnValue = Os.poll(pollFDs, pollTimeoutMs);} catch (ErrnoException ex) {throw new RuntimeException("poll failed", ex);}if (pollReturnValue == 0) {// The poll timeout has been exceeded.  This only occurs when we have finished the// USAP pool refill delay period.mUsapPoolRefillTriggerTimestamp = INVALID_TIMESTAMP;mUsapPoolRefillAction = UsapPoolRefillAction.DELAYED;} else {boolean usapPoolFDRead = false;while (--pollIndex >= 0) {if ((pollFDs[pollIndex].revents & POLLIN) == 0) {continue;}if (pollIndex == 0) {// Zygote server socket// 则创建ZygoteConnection对象,并添加到socketFDs。ZygoteConnection newPeer = acceptCommandPeer(abiList);peers.add(newPeer);socketFDs.add(newPeer.getFileDescriptor());} else if (pollIndex < usapPoolEventFDIndex) {// Session socket accepted from the Zygote server sockettry {//pollIndex>0，则代表通过socket接收来自对端的数据，并执行相应操作ZygoteConnection connection = peers.get(pollIndex);final Runnable command = connection.processOneCommand(this);// TODO (chriswailes): Is this extra check necessary?if (mIsForkChild) {// We're in the child. We should always have a command to run at// this stage if processOneCommand hasn't called "exec".if (command == null) {throw new IllegalStateException("command == null");}return command;} else {// We're in the server - we should never have any commands to run.if (command != null) {throw new IllegalStateException("command != null");}// We don't know whether the remote side of the socket was closed or// not until we attempt to read from it from processOneCommand. This// shows up as a regular POLLIN event in our regular processing// loop.if (connection.isClosedByPeer()) {connection.closeSocket();peers.remove(pollIndex);//处理完则从socketFDs中移除该文件描述符socketFDs.remove(pollIndex);}}} catch (Exception e) {...} finally {// Reset the child flag, in the event that the child process is a child-// zygote. The flag will not be consulted this loop pass after the// Runnable is returned.mIsForkChild = false;}} else {...}}...}}
}

没有连接请求时会进入休眠状态，当有创建新进程的连接请求时，唤醒Zygote进程，acceptCommandPeer方法创建Socket通道ZygoteConnection，然后执行ZygoteConnection的processOneCommand()方法。

3.3 ZygoteConnection.processOneCommand

/*** A connection that can make spawn requests.*/
class ZygoteConnection {/*** Reads one start command from the command socket. If successful, a child is forked and a* {@code Runnable} that calls the childs main method (or equivalent) is returned in the child* process. {@code null} is always returned in the parent process (the zygote).** If the client closes the socket, an {@code EOF} condition is set, which callers can test* for by calling {@code ZygoteConnection.isClosedByPeer}.*/Runnable processOneCommand(ZygoteServer zygoteServer) {String[] args;try {//读取socket客户端发送过来的参数列表args = Zygote.readArgumentList(mSocketReader);} catch (IOException ex) {throw new IllegalStateException("IOException on command socket", ex);}...//将binder客户端传递过来的参数，解析成ZygoteArguments对象格式ZygoteArguments parsedArgs = new ZygoteArguments(args);...pid = Zygote.forkAndSpecialize(parsedArgs.mUid, parsedArgs.mGid, parsedArgs.mGids,parsedArgs.mRuntimeFlags, rlimits, parsedArgs.mMountExternal, parsedArgs.mSeInfo,parsedArgs.mNiceName, fdsToClose, fdsToIgnore, parsedArgs.mStartChildZygote,parsedArgs.mInstructionSet, parsedArgs.mAppDataDir, parsedArgs.mIsTopApp,parsedArgs.mPkgDataInfoList, parsedArgs.mWhitelistedDataInfoList,parsedArgs.mBindMountAppDataDirs, parsedArgs.mBindMountAppStorageDirs);try {if (pid == 0) {// in childzygoteServer.setForkChild();zygoteServer.closeServerSocket();IoUtils.closeQuietly(serverPipeFd);serverPipeFd = null;return handleChildProc(parsedArgs, childPipeFd, parsedArgs.mStartChildZygote);} else {// In the parent. A pid < 0 indicates a failure and will be handled in// handleParentProc.IoUtils.closeQuietly(childPipeFd);childPipeFd = null;handleParentProc(pid, serverPipeFd);return null;}} finally {IoUtils.closeQuietly(childPipeFd);IoUtils.closeQuietly(serverPipeFd);}}
}public final class Zygote {...static int forkAndSpecialize(int uid, int gid, int[] gids, int runtimeFlags,int[][] rlimits, int mountExternal, String seInfo, String niceName, int[] fdsToClose,int[] fdsToIgnore, boolean startChildZygote, String instructionSet, String appDataDir,boolean isTopApp, String[] pkgDataInfoList, String[] whitelistedDataInfoList,boolean bindMountAppDataDirs, boolean bindMountAppStorageDirs) {ZygoteHooks.preFork();int pid = nativeForkAndSpecialize(uid, gid, gids, runtimeFlags, rlimits, mountExternal, seInfo, niceName, fdsToClose,fdsToIgnore, startChildZygote, instructionSet, appDataDir, isTopApp,pkgDataInfoList, whitelistedDataInfoList, bindMountAppDataDirs,bindMountAppStorageDirs);if (pid == 0) {// Note that this event ends at the end of handleChildProc,Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "PostFork");// If no GIDs were specified, don't make any permissions changes based on groups.if (gids != null && gids.length > 0) {NetworkUtils.setAllowNetworkingForProcess(containsInetGid(gids));}}// Set the Java Language thread priority to the default value for new apps.Thread.currentThread().setPriority(Thread.NORM_PRIORITY);//在fork新进程后，启动Zygote的Daemon线程ZygoteHooks.postForkCommon();return pid;}
}

3.4 nativeForkAndSpecialize

nativeForkAndSpecialize()通过JNI最终调用fork方法

com_android_internal_os_Zygote.cppstatic jint com_android_internal_os_Zygote_nativeForkAndSpecialize(JNIEnv* env, jclass, jint uid, jint gid, jintArray gids,jint runtime_flags, jobjectArray rlimits,jint mount_external, jstring se_info, jstring nice_name,jintArray managed_fds_to_close, jintArray managed_fds_to_ignore, jboolean is_child_zygote,jstring instruction_set, jstring app_data_dir, jboolean is_top_app,jobjectArray pkg_data_info_list, jobjectArray whitelisted_data_info_list,jboolean mount_data_dirs, jboolean mount_storage_dirs) {...pid_t pid = ForkCommon(env, false, fds_to_close, fds_to_ignore, true);...return pid;
}// Utility routine to fork a process from the zygote.
static pid_t ForkCommon(JNIEnv* env, bool is_system_server,const std::vector<int>& fds_to_close,const std::vector<int>& fds_to_ignore,bool is_priority_fork) {SetSignalHandlers();// Curry a failure function.auto fail_fn = std::bind(ZygoteFailure, env, is_system_server ? "system_server" : "zygote",nullptr, _1);// Temporarily block SIGCHLD during forks. The SIGCHLD handler might// log, which would result in the logging FDs we close being reopened.// This would cause failures because the FDs are not whitelisted.//// Note that the zygote process is single threaded at this point.BlockSignal(SIGCHLD, fail_fn);// Close any logging related FDs before we start evaluating the list of// file descriptors.__android_log_close();AStatsSocket_close();// If this is the first fork for this zygote, create the open FD table.  If// it isn't, we just need to check whether the list of open files has changed// (and it shouldn't in the normal case).if (gOpenFdTable == nullptr) {gOpenFdTable = FileDescriptorTable::Create(fds_to_ignore, fail_fn);} else {gOpenFdTable->Restat(fds_to_ignore, fail_fn);}android_fdsan_error_level fdsan_error_level = android_fdsan_get_error_level();// Purge unused native memory in an attempt to reduce the amount of false// sharing with the child process.  By reducing the size of the libc_malloc// region shared with the child process we reduce the number of pages that// transition to the private-dirty state when malloc adjusts the meta-data// on each of the pages it is managing after the fork.mallopt(M_PURGE, 0);//fork子进程pid_t pid = fork();...return pid;
}

fork()的主要工作是寻找空闲的进程号pid，然后从父进程拷贝进程信息，例如数据段和代码段，fork()后子进程要执行的代码等。 Zygote进程是所有Android进程的母体，包括system_server和各个App进程。zygote利用fork()方法生成新进程，对于新进程A复用Zygote进程本身的资源，再加上新进程A相关的资源，构成新的应用进程A。

到此App进程已完成了创建的工作，接下来开始新创建的App进程的工作。在前面ZygoteConnection.processOneCommand方法中，zygote进程执行完forkAndSpecialize()后，新创建的App进程便进入handleChildProc()方法，下面的操作运行在App进程。

四、新进程运行

4.1 ZygoteConnection.handleChildProc

在processOneCommand()过程中，调用forkAndSpecialize()创建完新进程后，返回值pid=0(即运行在子进程)继续开始执行handleChildProc()方法。

ZygoteConnection.java/*** Handles post-fork setup of child proc, closing sockets as appropriate,* reopen stdio as appropriate, and ultimately throwing MethodAndArgsCaller* if successful or returning if failed.** @param parsedArgs non-null; zygote args* @param pipeFd null-ok; pipe for communication back to Zygote.* @param isZygote whether this new child process is itself a new Zygote.*/
private Runnable handleChildProc(ZygoteArguments parsedArgs,FileDescriptor pipeFd, boolean isZygote) {/** By the time we get here, the native code has closed the two actual Zygote* socket connections, and substituted /dev/null in their place.  The LocalSocket* objects still need to be closed properly.*///关闭Zygote的socket两端的连接closeSocket();//设置进程名Zygote.setAppProcessName(parsedArgs, TAG);// End of the postFork event.Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);if (parsedArgs.mInvokeWith != null) {WrapperInit.execApplication(parsedArgs.mInvokeWith,parsedArgs.mNiceName, parsedArgs.mTargetSdkVersion,VMRuntime.getCurrentInstructionSet(),pipeFd, parsedArgs.mRemainingArgs);// Should not get here.throw new IllegalStateException("WrapperInit.execApplication unexpectedly returned");} else {if (!isZygote) {//执行目标类的main()方法return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion,parsedArgs.mDisabledCompatChanges,parsedArgs.mRemainingArgs, null /* classLoader */);} else {return ZygoteInit.childZygoteInit(parsedArgs.mTargetSdkVersion,parsedArgs.mRemainingArgs, null /* classLoader */);}}
}

/**
* Startup class for the zygote process.
*
* Pre-initializes some classes, and then waits for commands on a UNIX domain socket. Based on these
* commands, forks off child processes that inherit the initial state of the VM.
*
* Please see {@link ZygoteArguments} for documentation on the client protocol.
*
* @hide
*/
public class ZygoteInit {/*** The main function called when started through the zygote process. This could be unified with* main(), if the native code in nativeFinishInit() were rationalized with Zygote startup.<p>** Current recognized args:* <ul>* <li> <code> [--] &lt;start class name&gt;  &lt;args&gt;* </ul>** @param targetSdkVersion target SDK version* @param disabledCompatChanges set of disabled compat changes for the process (all others*                              are enabled)* @param argv             arg strings*/ublic static final Runnable zygoteInit(int targetSdkVersion, long[] disabledCompatChanges,String[] argv, ClassLoader classLoader) {if (RuntimeInit.DEBUG) {Slog.d(RuntimeInit.TAG, "RuntimeInit: Starting application from zygote");}Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ZygoteInit");RuntimeInit.redirectLogStreams();// 通用的一些初始化RuntimeInit.commonInit();// zygote初始化ZygoteInit.nativeZygoteInit();// 应用初始化return RuntimeInit.applicationInit(targetSdkVersion, disabledCompatChanges, argv,classLoader);}
}

nativeZygoteInit()所对应的jni方法

AndroidRuntime.cppstatic AndroidRuntime* gCurRuntime = NULL;static void com_android_internal_os_ZygoteInit_nativeZygoteInit(JNIEnv* env, jobject clazz)
{gCurRuntime->onZygoteInit();
}app_main.cppvirtual void onZygoteInit()
{sp<ProcessState> proc = ProcessState::self();ALOGV("App process: starting thread pool.\n");//启动新binder线程proc->startThreadPool();
}

ProcessState::self():主要工作是调用open()打开/dev/binder驱动设备，再利用mmap()映射内核的地址空间，将Binder驱动的fd赋值ProcessState对象中的变量mDriverFD，用于交互操作。

startThreadPool()是创建一个新的binder线程，不断进行talkWithDriver()。

4.2 RuntimeInit.applicationInit

/*** Main entry point for runtime initialization.  Not for* public consumption.* @hide*/
public class RuntimeInit {protected static Runnable applicationInit(int targetSdkVersion, long[] disabledCompatChanges,String[] argv, ClassLoader classLoader) {// If the application calls System.exit(), terminate the process// immediately without running any shutdown hooks.  It is not possible to// shutdown an Android application gracefully.  Among other things, the// Android runtime shutdown hooks close the Binder driver, which can cause// leftover running threads to crash before the process actually exits.nativeSetExitWithoutCleanup(true);VMRuntime.getRuntime().setTargetSdkVersion(targetSdkVersion);VMRuntime.getRuntime().setDisabledCompatChanges(disabledCompatChanges);final Arguments args = new Arguments(argv);// The end of of the RuntimeInit event (see #zygoteInit).Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);// Remaining arguments are passed to the start class's static main//此处args.startClass为”android.app.ActivityThread”return findStaticMain(args.startClass, args.startArgs, classLoader);}*** Invokes a static "main(argv[]) method on class "className".* Converts various failing exceptions into RuntimeExceptions, with* the assumption that they will then cause the VM instance to exit.** @param className Fully-qualified class name* @param argv Argument vector for main()* @param classLoader the classLoader to load {@className} with*/protected static Runnable findStaticMain(String className, String[] argv,ClassLoader classLoader) {Class<?> cl;try {cl = Class.forName(className, true, classLoader);} catch (ClassNotFoundException ex) {throw new RuntimeException("Missing class when invoking static main " + className,ex);}Method m;try {m = cl.getMethod("main", new Class[] { String[].class });} catch (NoSuchMethodException ex) {throw new RuntimeException("Missing static main on " + className, ex);} catch (SecurityException ex) {throw new RuntimeException("Problem getting static main on " + className, ex);}int modifiers = m.getModifiers();if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {throw new RuntimeException("Main method is not public and static on " + className);}/** This throw gets caught in ZygoteInit.main(), which responds* by invoking the exception's run() method. This arrangement* clears up all the stack frames that were required in setting* up the process.*/return new MethodAndArgsCaller(m, argv);}/*** Helper class which holds a method and arguments and can call them. This is used as part of* a trampoline to get rid of the initial process setup stack frames.*/static class MethodAndArgsCaller implements Runnable {/** method to call */private final Method mMethod;/** argument array */private final String[] mArgs;public MethodAndArgsCaller(Method method, String[] args) {mMethod = method;mArgs = args;}public void run() {try {//根据传递过来的参数，此处反射调用ActivityThread.main()方法mMethod.invoke(null, new Object[] { mArgs });} catch (IllegalAccessException ex) {throw new RuntimeException(ex);} catch (InvocationTargetException ex) {Throwable cause = ex.getCause();if (cause instanceof RuntimeException) {throw (RuntimeException) cause;} else if (cause instanceof Error) {throw (Error) cause;}throw new RuntimeException(ex);}}}
}

下一步进入caller.run()方法，也就是MethodAndArgsCaller.run()。到此，总算是进入到了ActivityThread类的main()方法。

五、总结

Process.start()方法是阻塞操作，等待直到进程创建完成并返回相应的新进程pid，才完成该方法。当App第一次启动时或者启动远程Service，即AndroidManifest.xml文件中定义了process:remote属性时，都需要创建进程。比如当用户点击桌面的某个App图标，桌面本身是一个app（即Launcher App），那么Launcher所在进程便是这次创建新进程的发起进程，该通过binder发送消息给system_server进程，该进程承载着整个java framework的核心服务。system_server进程从Process.start开始，执行创建进程，流程图（以进程的视角）如下：

上图中，system_server进程通过socket IPC通道向zygote进程通信，zygote在fork出新进程后由于fork调用一次，返回两次，即在zygote进程中调用一次，在zygote进程和子进程中各返回一次，从而能进入子进程来执行代码。该调用流程图的过程：

(1) system_server进程：通过Process.start()方法发起创建新进程请求，会先收集各种新进程uid、gid、nice-name等相关的参数，然后通过socket通道发送给zygote进程；

(2) zygote进程：接收到system_server进程发送过来的参数后封装成Arguments对象，forkAndSpecialize()方法是进程创建过程中最为核心的一个环节，其具体工作是依次执行下面的3个方法：
preFork()：先停止Zygote的4个Daemon子线程（java堆内存整理线程、对线下引用队列线程、析构线程以及监控线程）的运行以及初始化gc堆；
nativeForkAndSpecialize()：调用linux的fork()出新进程，创建Java堆处理的线程池，重置gc性能数据，设置进程的信号处理函数，启动JDWP线程；
postForkCommon()：在启动之前被暂停的4个Daemon子线程。

(3) 新进程：进入handleChildProc()方法，设置进程名，打开binder驱动，启动新的binder线程；然后设置art虚拟机参数，再反射调用目标类的main()方法，即Activity.main()方法。

再之后的流程，如果是startActivity则将要进入Activity的onCreate/onStart/onResume等生命周期；如果是startService则将要进入Service的onCreate等生命周期。

system_server进程等待zygote返回进程创建完成(ZygoteConnection.handleParentProc), 一旦Zygote.forkAndSpecialize()方法执行完成, 那么分道扬镳, zygote告知system_server进程进程已创建, 而子进程继续执行后续的handleChildProc操作.

RuntimeInit.java的方法nativeZygoteInit()会调用到onZygoteInit()，这个过程中有startThreadPool()创建Binder线程池。也就是说每个进程无论是否包含任何activity等组件，一定至少会包含一个Binder线程。