Android启动流程浅谈

一、开机启动流程：

Android系统启动是由BootLoader引导开机，然后依次进入kernel、Native、Framework、App。

二、冷起进程创建流程：

进程的创建，主要涉及到两个进程的通信
system_server进程和Zygote进程：

• system_server进程：是用于管理整个Java framework层，包含ActivityManager，PowerManager等各种系统服务;
• Zygote进程：是Android系统的首个Java进程，Zygote是所有Java进程的父进程，包括 system_server进程以及所有的App进程都是Zygote的子进程，注意这里说的是子进程。

1、AMS发送请求启动进程

//文件位置：/Users/XXX/Library/Android/sdk/sources/android-30/com/android/server/am/ActivityManagerService.java
@GuardedBy("this")
final ProcessRecord startProcessLocked(。。。) {
    return mProcessList.startProcessLocked(。。。);
}

//文件位置：/Users/duanshoucheng/Library/Android/sdk/sources/android-30/com/android/server/am/ProcessList.java
private Process.ProcessStartResult startProcess(HostingRecord hostingRecord, String entryPoint,
        ProcessRecord app, int uid, int[] gids, int runtimeFlags, int zygotePolicyFlags,
        int mountExternal, String seInfo, String requiredAbi, String instructionSet,
        String invokeWith, long startTime) {
    try {
        final Process.ProcessStartResult startResult;
        if (hostingRecord.usesWebviewZygote()) {
            startResult = startWebView(。。。); //Process.startWebView，是静态方法
        } else {
            startResult = Process.start(。。。);
        }
        checkSlow(startTime, "startProcess: returned from zygote!");
        return startResult;
    } finally {
        Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
    }
}

//文件位置：/Users/duanshoucheng/Library/Android/sdk/sources/android-30/android/os/Process.java
Process.start(...) ->ZYGOTE_PROCESS.start(...) -> ... -> zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi),...);  //会有两次机会和Zygote进程match。这里是LocalSocket

HostRecord构造参数HostingType，可取值：“activity”,“service”, “broadcast”, “contentProvider”
Java层进程的创建都是通过Process.start()方法，告知Zygote进程创建fork子进程，创建新进程后将ActivityThread类加载到新进程，并调用ActivityThread.main()方法。

2、Zygote处理请求

zygote进程在系统开机时就创建了。

//文件位置：/Users/xxx/Library/Android/sdk/sources/android-30/com/android/internal/os/ZygoteInit.java
@UnsupportedAppUsage
public static void main(String[] argv) {
        ZygoteServer zygoteServer = null;
         ...
        try {
            ...
            // 跟进该方法内，可以看到都是提前加载框架通用类和系统资源等
            if(!enableLazypreload){
                preload(bootTimingsTraceLog);
            }
            ...
            // 创建zygote进程的socket server服务端对象
            zygoteServer = new ZygoteServer(isPrimaryZygote);
            
            if (startSystemServer) {
                Runnable r = forkSystemServer(abiList, zygoteSocketName, zygoteServer);
                if (r != null) {
                    r.run();
                    return;
                }
            }
            ...
            // 等待AMS发请求过来
            caller = zygoteServer.runSelectLoop(abiList);
            ...
        }
        ...
    }
    
    //文件位置：/Users/xxx/Library/Android/sdk/sources/android-30/com/android/internal/os/ZygoteServer.java
 ZygoteServer.runSelectLoop(...) ->
 ZygoteConnection.processCommand -> handleChildProc(...);
 private Runnable handleChildProc(ZygoteArguments parsedArgs,
            FileDescriptor pipeFd, boolean isZygote) {
       ...
        if (parsedArgs.mInvokeWith != null) {
           ...
        } else {
            if (!isZygote) {
                // 继续进入ZygoteInit#zygoteInit继续完成子应用进程的相关初始化工作
                return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion,
                        parsedArgs.mDisabledCompatChanges,
                        parsedArgs.mRemainingArgs, null /* classLoader */);
            }
        }
    }

3、应用进程初始化

public static final Runnable zygoteInit(int targetSdkVersion, long[] disabledCompatChanges,
        String[] argv, ClassLoader classLoader) {
   
    RuntimeInit.redirectLogStreams();

    RuntimeInit.commonInit();
    ZygoteInit.nativeZygoteInit(); //native方法，jni调用启动进程的binder线程池
    return RuntimeInit.applicationInit(targetSdkVersion, disabledCompatChanges, argv,
            classLoader);
}

应用进程至此就启动了，启动之后需要main方法的入口：

//文件位置：/Users/xxx/Library/Android/sdk/sources/android-30/com/android/internal/os/RuntimeInit.java

protected static Runnable applicationInit(int targetSdkVersion, long[] disabledCompatChanges,
        String[] argv, ClassLoader classLoader) {
    ...
    final Arguments args = new Arguments(argv);
    // Remaining arguments are passed to the start class's static main
    return findStaticMain(args.startClass, args.startArgs, classLoader);
}

protected static Runnable findStaticMain(String className, String[] argv,
        ClassLoader classLoader) {
    Class<?> cl;

    try {
        //反射加载创建ActivityThread类对象
        cl = Class.forName(className, true, classLoader);
    } catch (ClassNotFoundException ex) {
        throw new RuntimeException(
                "Missing class when invoking static main " + className, ex);
    }

    Method m;
    try {
        //反射调用main方法
        m = cl.getMethod("main", new Class[] { String[].class });
    } catch (NoSuchMethodException ex) {
        throw new RuntimeException(
                "Missing static main on " + className, ex);
    } catch (SecurityException ex) {
        throw new RuntimeException(
                "Problem getting static main on " + className, ex);
    }

    int modifiers = m.getModifiers();
    if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) {
        throw new RuntimeException(
                "Main method is not public and static on " + className);
    }
    /*
     * This throw gets caught in ZygoteInit.main(), which responds
     * by invoking the exception's run() method. This arrangement
     * clears up all the stack frames that were required in setting
     * up the process.
     */
    return new MethodAndArgsCaller(m, argv);
}

//内部静态类
static class MethodAndArgsCaller implements Runnable {
    /** method to call */
    private final Method mMethod;

    /** argument array */
    private final String[] mArgs;

    public MethodAndArgsCaller(Method method, String[] args) {
        mMethod = method;
        mArgs = args;
    }

    public void run() {
        try {
            mMethod.invoke(null, new Object[] { mArgs });
        } ...
    }
}

4、新进程app

//文件位置：/Users/xxx/Library/Android/sdk/sources/android-30/android/app/ActivityThread.java
public static void main(String[] args) {
    Looper.prepareMainLooper();
    ActivityThread thread = new ActivityThread();
    thread.attach(false, startSeq);

    if (sMainThreadHandler == null) {
        sMainThreadHandler = thread.getHandler();
    }
    Looper.loop();
}

@UnsupportedAppUsage
final ApplicationThread mAppThread = new ApplicationThread(); //内部类，继承IApplicationThread.Stub

@UnsupportedAppUsage
private void attach(boolean system, long startSeq) {
    
    RuntimeInit.setApplicationObject(mAppThread.asBinder());
    final IActivityManager mgr = ActivityManager.getService();
    mgr.attachApplication(mAppThread, startSeq);
}

简单总结下：
初始化完，主线程就有了完整的 Looper、MessageQueue、Handler，此时 ActivityThread 的 Handler 就可以开始处理 Message，包括 Application、Activity、ContentProvider、Service、Broadcast 等组件的生命周期函数，都会以 Message 的形式，在主线程按照顺序处理。

5、总结

应用进程的启动是被动式的，在桌面点击图标启动一个组件如Activity实，如果该进程不存在，就会创建并启动进程。应用进程是由Zygote进程fork创建的，AMS在需要创建应用进程时，会通过socket并通知到Zygote进程进程在开机阶段就创建好的socket服务端，然后由Zygote进程fork创建出应用进程。

三、Service启动流程

1、startService调用链

启动方式：startService()和binderService()。也是由ActivityManagerService来完成。
Launcher#startService()–> ContextWrapper#startService()–>ContextImpl#startService() -->

//文件位置：/Users/xxx/Library/Android/sdk/sources/android-30/android/app/ContextImpl.java
private ComponentName startServiceCommon(Intent service, boolean requireForeground,
        UserHandle user) {
    try {
        validateServiceIntent(service);
        service.prepareToLeaveProcess(this); //ActivityManagerService
        ComponentName cn = ActivityManager.getService().startService(
                mMainThread.getApplicationThread(), service,
                service.resolveTypeIfNeeded(getContentResolver()), requireForeground,
                getOpPackageName(), getAttributionTag(), user.getIdentifier());
        ...
        return cn;
    } catch (RemoteException e) {
        throw e.rethrowFromSystemServer();
    }
}

获取AMS：

//文件位置：/Users/xxx/Library/Android/sdk/sources/android-30/android/app/ActivityManager.java
@UnsupportedAppUsage
public static IActivityManager getService() {
    return IActivityManagerSingleton.get(); //其实就是ActivityManagerService,AMS也是继承该类
}

private static IActivityTaskManager getTaskService() {
    return ActivityTaskManager.getService();
}

@UnsupportedAppUsage
private static final Singleton<IActivityManager> IActivityManagerSingleton =
        new Singleton<IActivityManager>() {
            @Override
            protected IActivityManager create() {
                final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE);
                final IActivityManager am = IActivityManager.Stub.asInterface(b);
                return am;
            }
        };

// AMS
@Override
public ComponentName startService(IApplicationThread caller, Intent service,
        String resolvedType, boolean requireForeground, String callingPackage,
        String callingFeatureId, int userId)
        throws TransactionTooLargeException {
           ...
        ComponentName res;
        try {
            res = mServices.startServiceLocked(caller, service,
                    resolvedType, callingPid, callingUid,
                    requireForeground, callingPackage, callingFeatureId, userId);
        } finally {
            Binder.restoreCallingIdentity(origId);
        }
        return res;
    }
}

参数：

• caller：类型是IApplicationThread，是ActivityThread.java内部类，IApplicationThread.Stub的子类
• service：Intent类型，包含需要运行的service信息
• callingPackage: String类型，调用该方法的package
  然后ActiveService#startServiceLocked -> ActiveService#startServiceInnerLocked->ActiveService#bringUpServiceLocked

//文件位置： /Users/xxx/Library/Android/sdk/sources/android-30/com/android/server/am/ActiveService.java

//2848行,bindService最后也会走这里
private String bringUpServiceLocked(ServiceRecord r, int intentFlags, boolean execInFg,
        boolean whileRestarting, boolean permissionsReviewRequired)
        throws TransactionTooLargeException {
    if (r.app != null && r.app.thread != null) {
        sendServiceArgsLocked(r, execInFg, false);
        return null;
    }
    ....
        if (app != null && app.thread != null) {
            try {
                app.addPackage(r.appInfo.packageName, r.appInfo.longVersionCode, mAm.mProcessStats);
                realStartServiceLocked(r, app, execInFg); //启动服务
                return null;
            ...
            }

            // If a dead object exception was thrown -- fall through to
            // restart the application.
        }
    }

    // 进程没启动，需要启动进程
    if (app == null && !permissionsReviewRequired) {
        if ((app=mAm.startProcessLocked(...) {
            ...
        }
    }
...
    return null;
}

总结下：该方法流程比较多，重要的是realStartServiceLocked和startProcessLocked两个启动方法，如果进程不存在，执行AMS#startProcessLocked–>AMS#attachApplicationLocked，然后执行realStartServiceLocked.

2、startProcessLocked创建进程

AMS#startProcessLocked -> ProcessList#startProcessLocked，之后的流程参考第二节，下面是第二节之后继续执行的流程：

//AMS.java
@Override
public final void attachApplication(IApplicationThread thread, long startSeq) {
    if (thread == null) {
        throw new SecurityException("Invalid application interface");
    }
    synchronized (this) {
        int callingPid = Binder.getCallingPid();
        final int callingUid = Binder.getCallingUid();
        final long origId = Binder.clearCallingIdentity();
        attachApplicationLocked(thread, callingPid, callingUid, startSeq);
        Binder.restoreCallingIdentity(origId);
    }
}

private boolean attachApplicationLocked(@NonNull IApplicationThread thread,
        int pid, int callingUid, long startSeq) {
        ...
        
        thread.bindApplication(processName, appInfo, providerList,
        instr2.mClass,
        profilerInfo, instr2.mArguments,
        instr2.mWatcher,
        instr2.mUiAutomationConnection, testMode,
        mBinderTransactionTrackingEnabled, enableTrackAllocation,
        isRestrictedBackupMode || !normalMode, app.isPersistent(),
        new Configuration(app.getWindowProcessController().getConfiguration()),
        app.compat, getCommonServicesLocked(app.isolated),
        mCoreSettingsObserver.getCoreSettingsLocked(),
        buildSerial, autofillOptions, contentCaptureOptions,
        app.mDisabledCompatChanges);
        ...
        
// Find any services that should be running in this process...
        if (!badApp) {
            try {
                didSomething |= mServices.attachApplicationLocked(app, processName);
        }    //mServices是ActiveService    
}

继续

boolean attachApplicationLocked(ProcessRecord proc, String processName)
        throws RemoteException {
    boolean didSomething = false;
    // Collect any services that are waiting for this process to come up.
    if (mPendingServices.size() > 0) {
                ...
                realStartServiceLocked(sr, proc, sr.createdFromFg);
                didSomething = true;
                ...
    }
    return didSomething;
}

看到了吧，第6行，创建了新的进程之后，会继续执行ActiveService#realStartServiceLocked。
忽略第2小节，继续第1小节的流程：realStartServiceLocked().

3、realStartServiceLocked继续启动服务

//文件位置： /Users/xxx/Library/Android/sdk/sources/android-30/com/android/server/am/ActiveService.java
private final void realStartServiceLocked(ServiceRecord r,
        ProcessRecord app, boolean execInFg) throws RemoteException {
  
    boolean created = false;
    try {
        ...
        //app:ProcessRecord:当前正在运行的进程信息
        //thread:IApplicationThread,跨进程，ActivityThread内部类。
        //onCreate方法，代码里见
        app.thread.scheduleCreateService(r, r.serviceInfo,
                mAm.compatibilityInfoForPackage(r.serviceInfo.applicationInfo),
                app.getReportedProcState());
        r.postNotification();
        created = true;
    } catch (DeadObjectException e) {
        Slog.w(TAG, "Application dead when creating service " + r);
        mAm.appDiedLocked(app, "Died when creating service");
        throw e;
    }

    ...

    服务 进入onStartCommand(),代码里见
    sendServiceArgsLocked(r, execInFg, true);

    if (r.delayed) {
        if (DEBUG_DELAYED_STARTS) Slog.v(TAG_SERVICE, "REM FR DELAY LIST (new proc): " + r);
        getServiceMapLocked(r.userId).mDelayedStartList.remove(r);
        r.delayed = false;
    }

   ...
   //停止服务
            stopServiceLocked(r);
       
}

总结：也可以看到Service的生命周期执行顺序。
内容中心开启是通过Service开启的，流程也是一样的。老版本源码中ApplicationThreadProxy，ActivityManagerNative等都被移除了。
至此Service的start启动方式流程走完了，有兴趣的可以自己看下bind方式。

四、Activity启动流程

ActivityThread：该类为应用程序APP所对应进程的主线程，即UI线程；
ApplicationThread：是ActivityThread内部类，是一个Binder类，可以跨进程通信，主要用于接收从AMS传递过来的消息，用来实现AMS和ActivityThread之间的交互。
IApplicationThread：作为系统进程请求应用进程的接口，代理类为IApplicationThread.Stub，实体类为ApplicationThread。
IActivityManager：作为应用进程请求系统进程的接口，接口代理类为IActivityManager.Stub，实体列为ActivityManagerService。
ApplicationThreadProxy：ApplicationThread在服务端的代理，AMS就是通过该代理和ActivityThread通信的。
ActivityManagerNative：和ActivityManagerProxy都继承IActivityManger，是抽象类，子类为AMS。
ActivityManagerProxy：是ActivityManagerService在普通应用程序的代理对象，应用进程通过该对象调用ActivityManagerService提供的功能。继承IActivityManager，是ActivityManagerNative内部类。

Android26版本以后ActivityManagerNative类被弃用，代理类ActivityManagerProxy、ApplicationThreadProxy被删除，改用AIDL方式。

大致流程：
Launcher -> AMS
AMS -> ApplicationThread
ActivityThread -> Activity

AMS调用ActivityThread是通过IApplicationThread
ActivityThread调用AMS是通过IActivityManager

其他相关类：ProcessRecord，ActivityRecord。

1、Application的创建

app进程初始化执行ActivityThread#main方法过程中，在开启主线程loop循环之前，会通过Binder调用系统核心服务AMS的attachApplication接口将自己注册到AMS中。

//文件位置：/Users/xxx/Library/Android/sdk/sources/android-30/android/app/ActivityThread.java
public static void main(String[] args) {
    Looper.prepareMainLooper();
    ActivityThread thread = new ActivityThread();
    thread.attach(false, startSeq);

    if (sMainThreadHandler == null) {
        sMainThreadHandler = thread.getHandler();
    }
    Looper.loop();
}

@UnsupportedAppUsage
final ApplicationThread mAppThread = new ApplicationThread(); //内部类，继承IApplicationThread.Stub

@UnsupportedAppUsage
private void attach(boolean system, long startSeq) {
    RuntimeInit.setApplicationObject(mAppThread.asBinder());
    final IActivityManager mgr = ActivityManager.getService();
    mgr.attachApplication(mAppThread, startSeq);
}

又是一个Binder的进程通信：

//文件位置： /Users/xxx/Library/Android/sdk/sources/android-30/com/android/server/am/ActivityManagerService.java
@Override
public final void attachApplication(IApplicationThread thread, long startSeq) {
    synchronized (this) {
        ...
        attachApplicationLocked(thread, callingPid, callingUid, startSeq);
        ...
    }
}

@GuardedBy("this")
private boolean attachApplicationLocked(@NonNull IApplicationThread thread,
            int pid, int callingUid, long startSeq) {
     ...
     if (app.isolatedEntryPoint != null) {
           ...
     } else if (instr2 != null) {
           // 调用应用进程ActivityThread#IApplicationThread#bindApplication接口,ApplicationThread#bindApplication()
           thread.bindApplication(...);
     } else {
           thread.bindApplication(...);
     }
     ...
     // See if the top visible activity is waiting to run in this process...
     if (normalMode) {
          try {
            // 继续执行启动应用Activity的流程  
            didSomething = mAtmInternal.attachApplication(app.getWindowProcessController());
          }
      }
}
// ActivityThread.java
private class ApplicationThread extends IApplicationThread.Stub {
      @Override
      public final void bindApplication(...) { //参数巨多
            ...
            AppBindData data = new AppBindData();
            data.processName = processName;
            data.appInfo = appInfo;
            ...
            // 向应用进程主线程Handler发送BIND_APPLICATION消息，触发在应用主线程执行handleBindApplication初始化动作
            sendMessage(H.BIND_APPLICATION, data);
      }
      ...
}

class H extends Handler {
      ...  msg.what巨多
      public void handleMessage(Message msg) {
           switch (msg.what) {
                case BIND_APPLICATION:
                    AppBindData data = (AppBindData)msg.obj;
                    // 在应用主线程执行handleBindApplication初始化动作
                    handleBindApplication(data);
                    break;
                    ...
           }
      }
      ...
}
@UnsupportedAppUsage
private void handleBindApplication(AppBindData data) {
    // 创建应用的LoadedApk对象  data.inof类型LoadedApk
    data.info = getPackageInfoNoCheck(data.appInfo, data.compatInfo);
    ...
    // 创建应用Application的Context、触发Art虚拟机加载应用APK的Dex文件到内存中，并加载应用APK的Resource资源
    final ContextImpl appContext = ContextImpl.createAppContext(this, data.info);
    ...
    //调用LoadedApk的makeApplication函数，实现创建应用的Application对象
    Application app; //6677行
    try{
        app = data.info.makeApplication(data.restrictedBackupMode, null);
        ...
    }
    //执行应用Application#onCreate生命周期函数
    mInstrumentation.callApplicationOnCreate(app); //然后调用app.onCreate()方法
    ...
}

//文件位置：/Users/xxx/Library/Android/sdk/sources/android-30/android/app/ContextImpl.java
@Override
public Context createApplicationContext(ApplicationInfo application, int flags)
        throws NameNotFoundException {
    LoadedApk pi = mMainThread.getPackageInfo(...);
    if (pi != null) {
        ContextImpl c = new ContextImpl(...);
        ...
        c.setResources(createResources(mToken, pi, null, displayId, null,
                getDisplayAdjustments(displayId).getCompatibilityInfo(), null));
        if (c.mResources != null) {
            return c;
        }
    }
}

到这里总结下：
在ActivityThread#handleBindApplication初始化过程中干了很多事儿，创建Application的Context对象；加载应用的APK的Dex文件；加载APK的Resources资源；创建Application对象；执行Application#onCreate生命周期函数。
加载Dex和Resources也是在这个方法中执行的，感兴趣的可以一探究竟。

2、创建Activity并初始化

Activity#startActivity->Activity#startActivityForResult ->Instrumentation#execStartActivity

///Users/xxx/Library/Android/sdk/sources/android-30/android/app/Instrumentation.java
public ActivityResult execStartActivity(
        Context who, IBinder contextThread, IBinder token, Activity target,
        Intent intent, int requestCode, Bundle options) {
    IApplicationThread whoThread = (IApplicationThread) contextThread;
    ...
    try {
        intent.migrateExtraStreamToClipData(who);
        intent.prepareToLeaveProcess(who);
        int result = ActivityTaskManager.getService().startActivity(...);
    } catch (RemoteException e) {
        throw new RuntimeException("Failure from system", e);
    }
    return null;
}

Instrumentation负责Activity的启动和相关生命周期的调用。
客户端通过ActivityTaskManager.getService()获取Server端Binder代理对象，进行跨进程通信。IActivityTaskManager.startActivity，就调用了Server端的ActivityTaskManagerService.startActivity:

// /Users/xxx/Library/Android/sdk/sources/android-30/com/android/server/wm/ActivityTaskManagerService.java 

@Override
public final int startActivity(...) {
    return startActivityAsUser(...);
}
private int startActivityAsUser(IApplicationThread caller, String callingPackage,
        @Nullable String callingFeatureId, Intent intent, String resolvedType,
        IBinder resultTo, String resultWho, int requestCode, int startFlags,
        ProfilerInfo profilerInfo, Bundle bOptions, int userId, boolean validateIncomingUser) {
    ...
    return getActivityStartController().obtainStarter(intent, "startActivityAsUser")
            .setCaller(caller)
            .setCallingPackage(callingPackage)
            .setCallingFeatureId(callingFeatureId)
            .setResolvedType(resolvedType)
            .setResultTo(resultTo)
            .setResultWho(resultWho)
            .setRequestCode(requestCode)
            .setStartFlags(startFlags)
            .setProfilerInfo(profilerInfo)
            .setActivityOptions(bOptions)
            .setUserId(userId)
            .execute();

}

上一步会执行ActivityStarter#execute，然后调用ActivityStarter#executeRequest，然后调用ActivityStarter#startActivityUnchecked();

// /Users/xxx/Library/Android/sdk/sources/android-30/com/android/server/wm/ActivityStarter.java

private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            int startFlags, boolean doResume, ActivityOptions options, Task inTask,
            boolean restrictedBgActivity, NeededUriGrants intentGrants) {
    int result = START_CANCELED;
    try {
        mService.deferWindowLayout();
        result = startActivityInner(r, sourceRecord, voiceSession, voiceInteractor,
                startFlags, doResume, options, inTask, restrictedBgActivity, intentGrants);
    } finally {
        startedActivityStack = handleStartResult(r, result);
        mService.continueWindowLayout();
    }

    return result;
}

@VisibleForTesting
int startActivityInner(final ActivityRecord r, ActivityRecord sourceRecord,
        IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
        int startFlags, boolean doResume, ActivityOptions options, Task inTask,
        boolean restrictedBgActivity, NeededUriGrants intentGrants) {
    ...

    if (mDoResume) {
        final ActivityRecord topTaskActivity =
                mStartActivity.getTask().topRunningActivityLocked();
        if (!mTargetStack.isTopActivityFocusable()
                || (topTaskActivity != null && topTaskActivity.isTaskOverlay()
                && mStartActivity != topTaskActivity)) {
          
            mTargetStack.ensureActivitiesVisible(null /* starting */,
                    0 /* configChanges */, !PRESERVE_WINDOWS);
           
            mTargetStack.getDisplay().mDisplayContent.executeAppTransition();
        } else {
           //RootWindowContainer
            mRootWindowContainer.resumeFocusedStacksTopActivities(
                    mTargetStack, mStartActivity, mOptions);
        }
    }
    return START_SUCCESS;
}

// /Users/xxx/Library/Android/sdk/sources/android-30/com/android/server/wm/RootWindowContainer.java
boolean resumeFocusedStacksTopActivities(
        ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) {

    boolean result = false;
    if (targetStack != null && (targetStack.isTopStackInDisplayArea()
            || getTopDisplayFocusedStack() == targetStack)) {
        result = targetStack.resumeTopActivityUncheckedLocked(target, targetOptions);
     }
     ...
    return result;
}

// /Users/xxx/Library/Android/sdk/sources/android-30/com/android/server/wm/ActivityStack.java

@GuardedBy("mService")
private boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options) {
    if (mResumedActivity != null) { //当前Activity执行onPause
         pausing |= startPausingLocked(userLeaving, false /* uiSleeping */, next); 
    }
    //要启动的Activity的
    mStackSupervisor.startSpecificActivity(next, true, false);
} 

2.1 startPausingLocked

// /Users/xxx/Library/Android/sdk/sources/android-30/com/android/server/wm/ActivityStack.java
final boolean startPausingLocked(boolean userLeaving, boolean uiSleeping,
        ActivityRecord resuming) {
   if (prev.attachedToProcess()) {
       mAtmService.getLifecycleManager().scheduleTransaction(prev.app.getThread(),prev.appToken, PauseActivityItem.obtain(prev.finishing, userLeaving,
                prev.configChangeFlags, pauseImmediately));
    }
}

mAtmService类型是ActivityTaskManagerService，是Task的本地变量，ActivityStack继承与Task。

// /Users/xxx/Library/Android/sdk/sources/android-30/com/android/server/wm/ActivityTaskManagerService.java
ClientLifecycleManager getLifecycleManager() {
    return mLifecycleManager;
}

// /Users/xxx/Library/Android/sdk/sources/android-30/com/android/server/wm/ClientLifecycleManager.java
void scheduleTransaction(@NonNull IApplicationThread client, @NonNull IBinder activityToken,
        @NonNull ActivityLifecycleItem stateRequest) throws RemoteException {
    final ClientTransaction clientTransaction = transactionWithState(client, activityToken,
            stateRequest);
    scheduleTransaction(clientTransaction);
}

void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
    final IApplicationThread client = transaction.getClient();
    transaction.schedule();
    if (!(client instanceof Binder)) {
        // If client is not an instance of Binder - it's a remote call and at this point it is
        // safe to recycle the object. All objects used for local calls will be recycled after
        // the transaction is executed on client in ActivityThread.
        transaction.recycle();
    }
}

// /Users/xxx/Library/Android/sdk/sources/android-29/android/app/servertransaction/ClientTransaction.java
public void schedule() throws RemoteException {
    mClient.scheduleTransaction(this); //mClient就是IApplicationThread
}

所以最终会调用ApplicationThread#scheduleTransaction方法

// /Users/xxx/Library/Android/sdk/sources/android-30/android/app/ActivityThread.java
@Override
public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
    ActivityThread.this.scheduleTransaction(transaction);
}

ActivityThread.this.scheduleTransaction(transaction);方法执行的是ActivityThread父类 ClientTransactionHandler 的方法：

// /Users/xxx/Library/Android/sdk/sources/android-30/android/app/ClientTransactionHandler.java
public abstract class ClientTransactionHandler {
    void scheduleTransaction(ClientTransaction transaction) {
        transaction.preExecute(this);
        sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);
    }
}    

//通过sendMessage最终执行到
case EXECUTE_TRANSACTION:
    final ClientTransaction transaction = (ClientTransaction) msg.obj;
    mTransactionExecutor.execute(transaction);  //mTransactionExecutor类型为TransactionExecutor
    if (isSystem()) {
        transaction.recycle();
    }
    break;
    
// /Users/xxx/Library/Android/sdk/sources/android-29/android/app/servertransaction/TransactionExecutor.java

public void execute(ClientTransaction transaction) {
    ...
    executeCallbacks(transaction);

    executeLifecycleState(transaction);
}


public void executeCallbacks(ClientTransaction transaction) {
    final List<ClientTransactionItem> callbacks = transaction.getCallbacks();
    if (callbacks == null || callbacks.isEmpty()) {
        // No callbacks to execute, return early.
        return;
    }
    if (DEBUG_RESOLVER) Slog.d(TAG, tId(transaction) + "Resolving callbacks in transaction");

    final IBinder token = transaction.getActivityToken();
    ActivityClientRecord r = mTransactionHandler.getActivityClient(token);

    final ActivityLifecycleItem finalStateRequest = transaction.getLifecycleStateRequest();
    final int finalState = finalStateRequest != null ? finalStateRequest.getTargetState()
            : UNDEFINED;
    // Index of the last callback that requests some post-execution state.
    final int lastCallbackRequestingState = lastCallbackRequestingState(transaction);

    final int size = callbacks.size();
    for (int i = 0; i < size; ++i) {
        final ClientTransactionItem item = callbacks.get(i);
        ...
        item.execute(mTransactionHandler, token, mPendingActions);
        ....
    }
}

// /Users/xxx/Library/Android/sdk/sources/android-30/android/app/servertransaction/PauseActivityItem.java
@Override
public void execute(ClientTransactionHandler client, IBinder token,
        PendingTransactionActions pendingActions) {
    Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityPause");
    client.handlePauseActivity(token, mFinished, mUserLeaving, mConfigChanges, pendingActions,
            "PAUSE_ACTIVITY_ITEM");
    Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
}

为什么是PauseActivityItem.java，原因是2.1章节，第一段代码，参数就是PauseActivityItem.

2.2 startSpecifiActivity

待续。。。

//framework\base\services\core\java\com\android\server\wm\ActivityStackSupervisor.java

  void startSpecificActivity(ActivityRecord r, boolean andResume, boolean checkConfig) {
        // Is this activity's application already running?
        final WindowProcessController wpc =
                mService.getProcessController(r.processName, r.info.applicationInfo.uid);

        if (wpc != null && wpc.hasThread()) {
            try {
                realStartActivityLocked(r, wpc, andResume, checkConfig);
                return;
            ...
        }

    }
    
 boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc, boolean andResume, boolean checkConfig) throws RemoteException {
        final Task task = r.getTask();
        final ActivityStack stack = task.getStack();
            try {
                // Create activity launch transaction.
                final ClientTransaction clientTransaction = ClientTransaction.obtain(proc.getThread(), r.appToken);
                final DisplayContent dc = r.getDisplay().mDisplayContent;
                
                //添加LaunchActivityItem事务回调
                clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),,,,,));

                // Set desired final state.
                final ActivityLifecycleItem lifecycleItem;
                if (andResume) {
                //andResume = true
                    lifecycleItem = ResumeActivityItem.obtain(dc.isNextTransitionForward());
                } else {
                    lifecycleItem = PauseActivityItem.obtain();
                }
                clientTransaction.setLifecycleStateRequest(lifecycleItem); //注解1

                //调ApplicationThread 的scheduleTransaction方法
                //启动ActivityB 并执行相关生命周期方法
                mService.getLifecycleManager().scheduleTransaction(clientTransaction);

             }  

        return true;
    }

上面代码比较重要，相关重要的类：LaunchActivityItem、ResumeActivityItem、PauseActivityItem。
以LauncherActivityItem为例继续注解1的流程，由于逻辑比较多，只展示调用链：
Server端：ClientLifecycleManager#scheduleTransaction#45
Client端：ClientTransaction#schedule#136 -> ActivityThread#H#handleMessage#2064 EXECUTE_TRANSACTION -> TransactionExecutor#execute -> TransactionExecutor#executeCallbacks，for循环item.execute，就是LaunchActivityItem#execute，具体代码如下：

// /Users/xxx/Library/Android/sdk/sources/android-30/android/app/servertransaction/LaunchActivityItem.java
public void execute(ClientTransactionHandler client, IBinder token,
            PendingTransactionActions pendingActions) {
        ActivityClientRecord r = new ActivityClientRecord(token, mIntent, mIdent, mInfo,
                mOverrideConfig, mCompatInfo, mReferrer, mVoiceInteractor, mState, mPersistentState,
                mPendingResults, mPendingNewIntents, mIsForward,
                mProfilerInfo, client, mAssistToken, mFixedRotationAdjustments);
        client.handleLaunchActivity(r, pendingActions, null /* customIntent */);
    }

Server端调用Client端：ActivityThread#handleLaunchActivity 反射创建Activity并执行onCreate方法

public Activity handleLaunchActivity(ActivityClientRecord r,
            PendingTransactionActions pendingActions, Intent customIntent) {
   
        final Activity a = performLaunchActivity(r, customIntent);

        return a;
    }

五、相关类解释IActivityManager、ActivityTaskManagerService

public class ActivityManagerService extends IActivityManager.Stub
        implements Watchdog.Monitor, BatteryStatsImpl.BatteryCallback 
        
//文件位置：/Users/duanshoucheng/frameworks/platform_frameworks_base/core/java/android/app/IActivityManager.aidl

可以看到AMS继承了 IActivityManager.Stub 这类，在代码中是搜索不到这个类的定义的，搜索 IActivityManager可以看到其是在一个 IActivityManager.aidl 文件中声明的接口。所以需要编译Framework，才能在out目录下生成IActivityManager.java文件。

ActivityTaskManagerService是最近几版出来的，我的理解就是ActivityManagerService的一个辅助类，AMS一些功能放到了ATMS

六、其他

感兴趣的可以继续分析ContentProvider、BroadCast的启动流程。

1、AMS有什么作用

ActivityManagerService是Framework层的核心服务之一，AMS继承IActivityManager.Stub，Stub继承android.os.Binder，所以AMS是Binder的子类。
ActivityManagerService最主要的功能就是统一的管理者activity，service,broadcast,provider的创建，运行,关闭。我们在应用程序中启动acitivity，关闭acitiviy等操作最终都是要通过ams来统一管理的，这个过程非常的复杂。
另外，AMS可以调节进程的OOM值，OOM也是一个进程。

2、链接

官方源码下载：https://source.android.google.cn/
国内镜像下载：https://mirrors.tuna.tsinghua.edu.cn/
在线看源码：https://cs.android.com/android/platform/superproject

3、番外

SystemServer的启动，SS#run方法中的的ActivityThread
SS#startBootstrapServices:启动引导程序
SS#startCoreServices:启动核心服务
SS#startOtherServices:启动其他服务
AMS的创建：SystemServer,588行：
AMS的构建方法：四大组件的初始化

4、未完待续

WMS、PMS
生命周期的执行A->B，log