init => init.rc => app_process => zygote => ...

int main(int argc, char** argv) {

    ...

    if (bootscript.empty()) {            // 第一次开机

        parser.ParseConfig("/init.rc");  // 解析配置文件 init.rc

        parser.set_is_system_etc_init_loaded(

                parser.ParseConfig("/system/etc/init"));

        parser.set_is_vendor_etc_init_loaded(

                parser.ParseConfig("/vendor/etc/init"));

        parser.set_is_odm_etc_init_loaded(parser.ParseConfig("/odm/etc/init"));

    } else {

        parser.ParseConfig(bootscript);

        parser.set_is_system_etc_init_loaded(true);

        parser.set_is_vendor_etc_init_loaded(true);

        parser.set_is_odm_etc_init_loaded(true);

    }

    ...

    while (true) { ... }

    return 0;

}

service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server

    class main

    priority -20

    user root

    group root readproc

    socket zygote stream 660 root system

    onrestart write /sys/android_power/request_state wake

    onrestart write /sys/power/state on

    onrestart restart audioserver

    onrestart restart cameraserver

    onrestart restart media

    onrestart restart netd

    onrestart restart wificond

    writepid /dev/cpuset/foreground/tasks

void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)

{

    ...

    // 初始化 JNI 接口

    /* start the virtual machine */

    JniInvocation jni_invocation;

    jni_invocation.Init(NULL);

    // 创建 env 指针

    JNIEnv* env;

    //

    if (startVm(&mJavaVM, &env, zygote) != 0) {

        return;

    }

    onVmCreated(env);

    /*

     * Register android functions.

     */

    if (startReg(env) < 0) {

        ALOGE("Unable to register all android natives\n");

        return;

    }

    /*

     * We want to call main() with a String array with arguments in it.

     * At present we have two arguments, the class name and an option string.

     * Create an array to hold them.

     */

    jclass stringClass;

    jobjectArray strArray;

    jstring classNameStr;

    stringClass = env->FindClass("java/lang/String");

    assert(stringClass != NULL);

    strArray = env->NewObjectArray(options.size() + 1, stringClass, NULL);

    assert(strArray != NULL);

    classNameStr = env->NewStringUTF(className);

    assert(classNameStr != NULL);

    env->SetObjectArrayElement(strArray, 0, classNameStr);

    for (size_t i = 0; i < options.size(); ++i) {

        jstring optionsStr = env->NewStringUTF(options.itemAt(i).string());

        assert(optionsStr != NULL);

        env->SetObjectArrayElement(strArray, i + 1, optionsStr);

    }

    /*

      * Start VM.  This thread becomes the main thread of the VM, and will

      * not return until the VM exits.

      */

    // 开启 VM 虚拟机，这个线程变成 VM 主线程，直到 VM 退出才结束

    // className => com.android.internal.os.ZygoteInit

    char* slashClassName = toSlashClassName(className != NULL ? className : "");

    jclass startClass = env->FindClass(slashClassName);

    if (startClass == NULL) {

        ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);

        /* keep going */

    } else {  // 把 main 函数调起来

        jmethodID startMeth = env->GetStaticMethodID(startClass, "main",

            "([Ljava/lang/String;)V");

        if (startMeth == NULL) {

            ALOGE("JavaVM unable to find main() in '%s'\n", className);

            /* keep going */

        } else {

            env->CallStaticVoidMethod(startClass, startMeth, strArray);

            if (env->ExceptionCheck())

                threadExitUncaughtException(env);

        }

    }

    free(slashClassName);

    ...

}

public static void main(String argv[]) {

    try {

        ...

        // socket 通信注册

        registerZygoteSocket(socketName);

        // 预加载所需资源到VM中，如class、resource、OpenGL、公用Library等；

        // 所有fork的子进程共享这份空间而无需重新加载，减少了应用程序的启动时间，

        // 但也增加了系统的启动时间，Android启动最耗时的部分之一。

        preload();

        // 初始化gc，只是通知VM进行垃圾回收，具体回收时间、怎么回收，由VM内部算法决定。

        // gc()需在fork前完成，这样将来复制的子进程才能有尽可能少的垃圾内存没释放；

        gcAndFinalize();

        // 启动system_server，即fork一个Zygote子进程

        if (startSystemServer) {

            Runnable r = forkSystemServer(abiList, socketName, zygoteServer);

            // {@code r == null} in the parent (zygote) process, and {@code r != null} in the

            // child (system_server) process.

            if (r != null) {

                r.run();

                return;

            }

        }

        // 进入循环模式，获取客户端连接并处理

        runSelectLoop(abiList);

        // 关闭和清理zygote socket

        closeServerSocket();

    } catch (MethodAndArgsCaller caller) {

        caller.run();

    } catch (RuntimeException ex) {

        Log.e(TAG, "Zygote died with exception", ex);

        closeServerSocket();

        throw ex;

    }

}

private static Runnable forkSystemServer(String abiList, String socketName,

            ZygoteServer zygoteServer) {

    ...

    int pid;

    try {

        parsedArgs = new ZygoteConnection.Arguments(args);

        ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);

        ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);

        /* Request to fork the system server process */

        pid = Zygote.forkSystemServer(

                parsedArgs.uid, parsedArgs.gid,

                parsedArgs.gids,

                parsedArgs.debugFlags,

                null,

                parsedArgs.permittedCapabilities,

                parsedArgs.effectiveCapabilities);

    } catch (IllegalArgumentException ex) {

        throw new RuntimeException(ex);

    }

    /* For child process */

    if (pid == 0) {

        if (hasSecondZygote(abiList)) {

            waitForSecondaryZygote(socketName);

        }

        zygoteServer.closeServerSocket();

        return handleSystemServerProcess(parsedArgs);

    }

}

/** Initialize Xposed (unless it is disabled). */

bool initialize(bool zygote, bool startSystemServer, const char* className, int argc, char* const argv[]) {

    // 参数接管

    xposed->zygote = zygote;

    xposed->startSystemServer = startSystemServer;

    xposed->startClassName = className;

    xposed->xposedVersionInt = xposedVersionInt;

    // XposedBridge.jar 加载到 ClassPath 中

    return addJarToClasspath();

}

runtimeStart(runtime, isXposedLoaded ? XPOSED_CLASS_DOTS_ZYGOTE : "com.android.internal.os.ZygoteInit", args, zygote);

protected static void main(String[] args) {

    // Initialize the Xposed framework and modules

    try {

        if (!hadInitErrors()) {

            initXResources();

            SELinuxHelper.initOnce();

            SELinuxHelper.initForProcess(null);

            runtime = getRuntime();

            XPOSED_BRIDGE_VERSION = getXposedVersion();

            // 初始化

            if (isZygote) {

                XposedInit.hookResources();

                XposedInit.initForZygote();

            }

            XposedInit.loadModules();  // 加载 Xposed 模块

        } else {

            Log.e(TAG, "Not initializing Xposed because of previous errors");

        }

    } catch (Throwable t) {

        Log.e(TAG, "Errors during Xposed initialization", t);

        disableHooks = true;

    }

    // Call the original startup code  => 原始执行链

    if (isZygote) {

        ZygoteInit.main(args);

    } else {

        RuntimeInit.main(args);

    }

}