1.开机启动Zygote进程

在线源码查看：http://androidxref.com/6.0.0_r1/xref/

Zygote进程是由init进程通过解析init.zygote.rc文件创建的，Zygote所对应的可执行程序是app_process，所对应的源文件是app_main.cpp，进程名为zygote

//源码文件：/system/core/rootdir/init.zygote32.rc
service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
    class main
    socket zygote stream 660 root system
    onrestart write /sys/android_power/request_state wake
    onrestart write /sys/power/state on
    onrestart restart media
    onrestart restart netd

2.执行app_main.cpp中的main方法

//资源文件：/frameworks/base/cmds/app_process/app_main.cpp
//line186
int main(int argc, char* const argv[])
{
  //line197 AppRuntime继承AndroidRuntime
  AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));
  //line248 匹配上面rc中的"--zygote"，将zygote标志位设置为true
  if (strcmp(arg, "--zygote") == 0) {
    zygote = true;
    niceName = ZYGOTE_NICE_NAME;
  }
  //line306 运行AndroidRuntime.cpp的start方法
  if (zygote) {
    runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
  }
}

3.AndroidRuntime::start

//xref: /frameworks/base/core/jni/AndroidRuntime.cpp
//1007
void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
{
  //line1051    startReg：JNI方法注册，Java才能调到Native方法
  /*
   * Register android functions.
   */
  if (startReg(env) < 0) {
    ALOGE("Unable to register all android natives\n");
    return;
  }
}
//line1440
/*
 * Register android native functions with the VM.
 */
/*static*/ int AndroidRuntime::startReg(JNIEnv* env)
{
  //line1459  注册JNI方法
  if (register_jni_procs(gRegJNI, NELEM(gRegJNI), env) < 0) {
    env->PopLocalFrame(NULL);
    return -1;
  }
}
//line1283
static int register_jni_procs(const RegJNIRec array[], size_t count, JNIEnv* env)
{
  //循环注册JNI方法
  for (size_t i = 0; i < count; i++) {
    if (array[i].mProc(env) < 0) {
#ifndef NDEBUG
      ALOGD("----------!!! %s failed to load\n", array[i].mName);
#endif
      return -1;
    }
  }
  return 0;
}
//line1296 要注册JNI的数组
static const RegJNIRec gRegJNI[] = {
  //line1312 
  REG_JNI(register_android_os_Binder)
}

4.register_android_os_Binder

//xref: /frameworks/base/core/jni/android_util_Binder.cpp
//line1282
int register_android_os_Binder(JNIEnv* env)
{
  if (int_register_android_os_Binder(env) < 0)
    return -1;
  if (int_register_android_os_BinderInternal(env) < 0)
    return -1;
  if (int_register_android_os_BinderProxy(env) < 0)
    return -1;
}

三个方法都是完成Java层和Native层能够相互调用

int_register_android_os_Binder

//xref: /frameworks/base/core/jni/android_util_Binder.cpp
//line843
static const JNINativeMethod gBinderMethods[] = {
  /* name, signature, funcPtr */
  { "getCallingPid", "()I", (void*)android_os_Binder_getCallingPid },
  { "getCallingUid", "()I", (void*)android_os_Binder_getCallingUid },
  { "clearCallingIdentity", "()J", (void*)android_os_Binder_clearCallingIdentity },
  { "restoreCallingIdentity", "(J)V", (void*)android_os_Binder_restoreCallingIdentity },
  { "setThreadStrictModePolicy", "(I)V", (void*)android_os_Binder_setThreadStrictModePolicy },
  { "getThreadStrictModePolicy", "()I", (void*)android_os_Binder_getThreadStrictModePolicy },
  { "flushPendingCommands", "()V", (void*)android_os_Binder_flushPendingCommands },
  { "init", "()V", (void*)android_os_Binder_init },
  { "destroy", "()V", (void*)android_os_Binder_destroy },
  { "blockUntilThreadAvailable", "()V", (void*)android_os_Binder_blockUntilThreadAvailable }
};

const char* const kBinderPathName = "android/os/Binder";

static int int_register_android_os_Binder(JNIEnv* env)
{
  //查找文件"android/os/Binder"，拿到对应的class对象
  jclass clazz = FindClassOrDie(env, kBinderPathName);
    //通过gBinderOffsets结构体，保存Java层Binder类的信息，为JNI层访问Java层提供通道
  gBinderOffsets.mClass = MakeGlobalRefOrDie(env, clazz);
  gBinderOffsets.mExecTransact = GetMethodIDOrDie(env, clazz, "execTransact", "(IJJI)Z");
  gBinderOffsets.mObject = GetFieldIDOrDie(env, clazz, "mObject", "J");
    //通过RegisterMethodsOrDie将gBinderMethods数组完成映射关系，从而为Java层访问JNI层提供通道
  return RegisterMethodsOrDie(
    env, kBinderPathName,
    gBinderMethods, NELEM(gBinderMethods));
}

int_register_android_os_BinderInternal

static const JNINativeMethod gBinderInternalMethods[] = {
  /* name, signature, funcPtr */
  { "getContextObject", "()Landroid/os/IBinder;", (void*)android_os_BinderInternal_getContextObject },
  { "joinThreadPool", "()V", (void*)android_os_BinderInternal_joinThreadPool },
  { "disableBackgroundScheduling", "(Z)V", (void*)android_os_BinderInternal_disableBackgroundScheduling },
  { "handleGc", "()V", (void*)android_os_BinderInternal_handleGc }
};

const char* const kBinderInternalPathName = "com/android/internal/os/BinderInternal";

static int int_register_android_os_BinderInternal(JNIEnv* env)
{
  //查找文件"com/android/internal/os/BinderInternal"，拿到对应的class对象
  jclass clazz = FindClassOrDie(env, kBinderInternalPathName);
  //通过gBinderOffsets结构体，保存Java层BinderInternal类的信息，为JNI层访问Java层提供通道
  gBinderInternalOffsets.mClass = MakeGlobalRefOrDie(env, clazz);
  gBinderInternalOffsets.mForceGc = GetStaticMethodIDOrDie(env, clazz, "forceBinderGc", "()V");
//通过RegisterMethodsOrDie将gBinderInternalMethods数组完成映射关系，从而为Java层访问JNI层提供通道
  return RegisterMethodsOrDie(
    env, kBinderInternalPathName,
    gBinderInternalMethods, NELEM(gBinderInternalMethods));
}

int_register_android_os_BinderProxy

static const JNINativeMethod gBinderProxyMethods[] = {
  /* name, signature, funcPtr */
  {"pingBinder",          "()Z", (void*)android_os_BinderProxy_pingBinder},
  {"isBinderAlive",       "()Z", (void*)android_os_BinderProxy_isBinderAlive},
  {"getInterfaceDescriptor", "()Ljava/lang/String;", (void*)android_os_BinderProxy_getInterfaceDescriptor},
  {"transactNative",      "(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z", (void*)android_os_BinderProxy_transact},
  {"linkToDeath",         "(Landroid/os/IBinder$DeathRecipient;I)V", (void*)android_os_BinderProxy_linkToDeath},
  {"unlinkToDeath",       "(Landroid/os/IBinder$DeathRecipient;I)Z", (void*)android_os_BinderProxy_unlinkToDeath},
  {"destroy",             "()V", (void*)android_os_BinderProxy_destroy},
};

const char* const kBinderProxyPathName = "android/os/BinderProxy";

static int int_register_android_os_BinderProxy(JNIEnv* env)
{
  //查找文件"android/os/BinderProxy"，拿到对应的class对象
  jclass clazz = FindClassOrDie(env, "java/lang/Error");
  gErrorOffsets.mClass = MakeGlobalRefOrDie(env, clazz);

  clazz = FindClassOrDie(env, kBinderProxyPathName);
  //通过gBinderOffsets结构体，保存Java层BinderProxy类的信息，为JNI层访问Java层提供通道
  gBinderProxyOffsets.mClass = MakeGlobalRefOrDie(env, clazz);
  gBinderProxyOffsets.mConstructor = GetMethodIDOrDie(env, clazz, "<init>", "()V");
  gBinderProxyOffsets.mSendDeathNotice = GetStaticMethodIDOrDie(env, clazz, "sendDeathNotice",(Landroid/os/IBinder$DeathRecipient;)V");

  gBinderProxyOffsets.mObject = GetFieldIDOrDie(env, clazz, "mObject", "J");
  gBinderProxyOffsets.mSelf = GetFieldIDOrDie(env, clazz, "mSelf",
                                              "Ljava/lang/ref/WeakReference;");
  gBinderProxyOffsets.mOrgue = GetFieldIDOrDie(env, clazz, "mOrgue", "J");

  clazz = FindClassOrDie(env, "java/lang/Class");
  gClassOffsets.mGetName = GetMethodIDOrDie(env, clazz, "getName", "()Ljava/lang/String;");
//通过RegisterMethodsOrDie将gBinderProxyMethods数组完成映射关系，从而为Java层访问JNI层提供通道
  return RegisterMethodsOrDie(
    env, kBinderProxyPathName,
    gBinderProxyMethods, NELEM(gBinderProxyMethods));
}