zygote启动过程中涉及到以下模块：

• app_process
• zygote
  • USAP
  • socket
  • FileDescriptor (FD)
• AndroidRuntime
• AppRuntime （定义于app_process模块，继承自AndroidRuntime。）

init进程启动zygote进程：

#init.zygote32_64.rc
service zygote /system/bin/app_process32 -Xzygote /system/bin --zygote --start-system-server --socket-name=zygote
    class main
    priority -20
    user root
    group root readproc reserved_disk
    socket zygote stream 660 root system
    socket usap_pool_primary stream 660 root system
    onrestart exec_background - system system -- /system/bin/vdc volume abort_fuse
    onrestart write /sys/power/state on
    onrestart restart audioserver
    onrestart restart cameraserver
    onrestart restart media
    onrestart restart netd
    onrestart restart wificond
    writepid /dev/cpuset/foreground/tasks

service zygote_secondary /system/bin/app_process64 -Xzygote /system/bin --zygote --socket-name=zygote_secondary
    class main
    priority -20
    user root
    group root readproc reserved_disk
    socket zygote_secondary stream 660 root system
    socket usap_pool_secondary stream 660 root system
    onrestart restart zygote
    writepid /dev/cpuset/foreground/tasks

一、绑定socket

init.zygote32_64.rc脚本中分别定义了32位（primary）和64位（secondary）zygote进程的启动参数，在/dev/socket/下创建UNIX域的socket，并把socket的fd传给对应的进程。

“ANDROID_SOCKET_zygote”，"ANDROID_SOCKET_zygote_secondary"分别为两个zygote的socket在环境变量中对应的key值，通过key获取对应的value，创建FileDescriptor对象。通过 “ls -l /proc/${pid}/fd” 命令可查看对应进程的所有fd指向的符号链接。

    static LocalServerSocket createManagedSocketFromInitSocket(String socketName) {
        int fileDesc;
        final String fullSocketName = ANDROID_SOCKET_PREFIX + socketName;	// ANDROID_SOCKET_zygote

        try {
            String env = System.getenv(fullSocketName);
            fileDesc = Integer.parseInt(env);			// env="20"
        } catch (RuntimeException ex) {
            throw new RuntimeException("Socket unset or invalid: " + fullSocketName, ex);
        }

        try {
            FileDescriptor fd = new FileDescriptor();
            fd.setInt$(fileDesc);
            return new LocalServerSocket(fd);
        } catch (IOException ex) {
            throw new RuntimeException(
                "Error building socket from file descriptor: " + fileDesc, ex);
        }
    }

二、zygote启动

app_process进程：

//app_main.cpp
int main(int argc, char* const argv[])
{
  //...
    if (zygote) {
        runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
    } else if (className) {
        runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
    } 
}

变量runtime是AppRuntime对象，调用AndoridRuntime对象start()方法：

//AndroidRuntime.cpp
/*
 * Start the Android runtime.  This involves starting the virtual machine
 * and calling the "static void main(String[] args)" method in the class
 * named by "className".
 *
 * Passes the main function two arguments, the class name and the specified
 * options string.
 */
void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
{
  //...
  
    /* start the virtual machine 
    * 1.启动Java虚拟机。
    */
    JniInvocation jni_invocation;
    jni_invocation.Init(NULL);
    JNIEnv* env;
    if (startVm(&mJavaVM, &env, zygote, primary_zygote) != 0) {
        return;
    }
    onVmCreated(env);
  
  	 /*
     * Register android functions.
     * 2.注册JNI方法。
     */
    if (startReg(env) < 0) {
        ALOGE("Unable to register all android natives\n");
        return;
    }
      
     /*
     * Start VM.  This thread becomes the main thread of the VM, and will
     * not return until the VM exits.
     * 3.启动对应类的静态 main()。
     */
    jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
            "([Ljava/lang/String;)V");
    env->CallStaticVoidMethod(startClass, startMeth, strArray);
}

启动zygote时className变量是"com.android.internal.os.ZygoteInit"，查看其main()方法：

//ZygoteInit.java
public static void main(String[] argv) {
  //...
  
  /*
  * 1. 执行预加载。
  */
  if (!enableLazyPreload) {
  	preload(bootTimingsTraceLog);
  }
  
  /*
  * 2. 实例化ZygoteServer()对象，
  *   1）.初始化 Zygote server socket。
  *   2）.初始化 USAP pool server socket。
  *   3）.初始化 USAP pool event FD。
  */
  zygoteServer = new ZygoteServer(isPrimaryZygote);
  
  /*
  * 3. 启动 system_server进程，
  */
  if (startSystemServer) {
      Runnable r = forkSystemServer(abiList, zygoteSocketName, zygoteServer);

      // {@code r == null} in the parent (zygote) process, and {@code r != null} in the
      // child (system_server) process.
      if (r != null) {
           r.run();
           return;
      }
   }
  
  /*
  *	4. 循环接受处理 socket 事件。
  */
  // The select loop returns early in the child process after a fork and
  // loops forever in the zygote.
  caller = zygoteServer.runSelectLoop(abiList);
}

三、处理socket消息

ZygoteServer接收到socket消息后，调用processOneCommand方法解析消息参数。

//ZygoteServer.java
                            ZygoteConnection connection = peers.get(pollIndex);
                            final Runnable command = connection.processOneCommand(this);

最终在Zygote类的forkAndSpecialize方法中调用nativeForkAndSpecialize()方法fork新进程：

//Zygote.java
static int forkAndSpecialize(int uid, int gid, int[] gids, int runtimeFlags,
            int[][] rlimits, int mountExternal, String seInfo, String niceName, int[] fdsToClose,
            int[] fdsToIgnore, boolean startChildZygote, String instructionSet, String appDataDir,
            boolean isTopApp, String[] pkgDataInfoList, String[] whitelistedDataInfoList,
            boolean bindMountAppDataDirs, boolean bindMountAppStorageDirs) {
        ZygoteHooks.preFork();
        int pid = nativeForkAndSpecialize(
                uid, gid, gids, runtimeFlags, rlimits, mountExternal, seInfo, niceName, fdsToClose,
                fdsToIgnore, startChildZygote, instructionSet, appDataDir, isTopApp,
                pkgDataInfoList, whitelistedDataInfoList, bindMountAppDataDirs,
                bindMountAppStorageDirs);
                ZygoteHooks.postForkCommon();
        return pid;
    }

重点查看ZygoteConnection类的processOneCommand()方法：

在nativeForkAndSpecialize()方法fork新进程后，通过判断返回的pid是否大于0区分母子进程。

​ fork是类Unix操作系统上创建进程的主要方法。fork用于创建子进程(等同于当前进程的副本)，新的进程要通过老的进程复制自身得到，这就是fork！

​ fork作为一个函数被调用。这个函数会有两次返回，将子进程的PID返回给父进程，0返回给子进程。(如果小于0，则说明创建子进程失败)。

//ZygoteConnection.java
Runnable processOneCommand(ZygoteServer zygoteServer) {
    //...
    	pid = Zygote.forkAndSpecialize(parsedArgs.mUid, parsedArgs.mGid, parsedArgs.mGids,
                parsedArgs.mRuntimeFlags, rlimits, parsedArgs.mMountExternal, parsedArgs.mSeInfo,
                parsedArgs.mNiceName, fdsToClose, fdsToIgnore, parsedArgs.mStartChildZygote,
                parsedArgs.mInstructionSet, parsedArgs.mAppDataDir, parsedArgs.mIsTopApp,
                parsedArgs.mPkgDataInfoList, parsedArgs.mWhitelistedDataInfoList,
                parsedArgs.mBindMountAppDataDirs, parsedArgs.mBindMountAppStorageDirs);

        try {
            if (pid == 0) {
                // in child
                zygoteServer.setForkChild();

                zygoteServer.closeServerSocket();
                IoUtils.closeQuietly(serverPipeFd);
                serverPipeFd = null;

                return handleChildProc(parsedArgs, childPipeFd, parsedArgs.mStartChildZygote);
            } else {
                // In the parent. A pid < 0 indicates a failure and will be handled in
                // handleParentProc.
                IoUtils.closeQuietly(childPipeFd);
                childPipeFd = null;
                handleParentProc(pid, serverPipeFd);
                return null;
            }
        } finally {
            IoUtils.closeQuietly(childPipeFd);
            IoUtils.closeQuietly(serverPipeFd);
        }
}

所以可以看到handleChildProc()和handleParentProc()分别处理的是子进程，母进程的逻辑。

最终子进程执行zygoteInit()方法完成一个Android 应用程序的启动（初始化）：

    public static final Runnable zygoteInit(int targetSdkVersion, long[] disabledCompatChanges,
            String[] argv, ClassLoader classLoader) {
        if (RuntimeInit.DEBUG) {
            Slog.d(RuntimeInit.TAG, "RuntimeInit: Starting application from zygote");
        }

        Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ZygoteInit");
        RuntimeInit.redirectLogStreams();

        RuntimeInit.commonInit();
        ZygoteInit.nativeZygoteInit();
        return RuntimeInit.applicationInit(targetSdkVersion, disabledCompatChanges, argv,
                classLoader);
    }

ZygoteInit.nativeZygoteInit(); 使支持Binder进程间通信机制。

RuntimeInit.applicationInit(); 调用ActivityThread.main()方法，启动UI线程。