Android APP启动过程初探

App启动这一块主要是由Zygote发起，通过新建子进程SystemServer来实现的。Zygote本身也是一个进程。
SystemServer是一个比较重要的进程，很多重要的APP服务：ActivityManagerService、PackageManagerService、WindowManagerService等等都是在这个进程中被创建起来的。它是在ZygoteInit里面的main方法中被fork出来的。
查看com.android.internal.os.ZygoteInit.java中的main方法:

  public static void main(String argv[]) {
      ZygoteServer zygoteServer = new ZygoteServer(); 
     
     ...ignore some code...
     
      if (startSystemServer) {
            Runnable r = forkSystemServer(abiList, socketName, zygoteServer);

            // {@code r == null} in the parent (zygote) process, and {@code r != null} in the
            // child (system_server) process.
            if (r != null) {
                r.run();
                return;
            }
        }
       ...ignore some code...

我们看一下 forkSystemServer做了啥：

    private static Runnable forkSystemServer(String abiList, String socketName,
        ZygoteServer zygoteServer) {
    
    ...ignore some code...
    
     /* 进程初始化参数： ZygoteInit.main()中的argv参数也是通过这种方式传递进来的*/
    /* Hardcoded command line to start the system server */
    String args[] = {
        "--setuid=1000",
        "--setgid=1000",
        "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1023,1024,1032,1065,3001,3002,3003,3006,3007,3009,3010",
        "--capabilities=" + capabilities + "," + capabilities,
        "--nice-name=system_server",
        "--runtime-args",
        "--target-sdk-version=" + VMRuntime.SDK_VERSION_CUR_DEVELOPMENT,
        "com.android.server.SystemServer",  //进程名称
    };
    ZygoteConnection.Arguments parsedArgs = null;

    int pid;

    try {
        parsedArgs = new ZygoteConnection.Arguments(args);
        ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
        ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);

        boolean profileSystemServer = SystemProperties.getBoolean(
                "dalvik.vm.profilesystemserver", false);
        if (profileSystemServer) {
            parsedArgs.runtimeFlags |= Zygote.PROFILE_SYSTEM_SERVER;
        }

        /* Request to fork the system server process */
        pid = Zygote.forkSystemServer(
                parsedArgs.uid, parsedArgs.gid,
                parsedArgs.gids,
                parsedArgs.runtimeFlags,
                null,
                parsedArgs.permittedCapabilities,
                parsedArgs.effectiveCapabilities);
    } catch (IllegalArgumentException ex) {
        throw new RuntimeException(ex);
    }

    /* For child process */
    if (pid == 0) {
        if (hasSecondZygote(abiList)) {
            waitForSecondaryZygote(socketName);
        }

        zygoteServer.closeServerSocket();
        return handleSystemServerProcess(parsedArgs);
    }

    return null;
}

进程创建成功后，我们也就走进了SystemServer的main方法。看一下services/java/com/android/server/SystemServer.java这个文件。

/**
*  The main entry point from zygote.
*/
public static void main(String[] args) {
    new SystemServer().run();
}

//进入run方法
private void run() {
    try {
    ...ignore some code...
    
        // 初始化本地服务包
        System.loadLibrary("android_servers");

        // 检查上次是否正常关闭
        performPendingShutdown();

        // 初始化系统上下文context.
        createSystemContext();

        //初始化SystemServiceManager对象，下面的系统服务开启都需要调用SystemServiceManager.startService(Class<T>)，这个方法通过反射来启动对应的服务
        mSystemServiceManager = new SystemServiceManager(mSystemContext);
        mSystemServiceManager.setStartInfo(mRuntimeRestart,
                mRuntimeStartElapsedTime, mRuntimeStartUptime);
        LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
        // Prepare the thread pool for init tasks that can be parallelized
        SystemServerInitThreadPool.get();} 
finally {
        traceEnd();  // InitBeforeStartServices
    }

    // 开启服务
    try {
        traceBeginAndSlog("StartServices");
        startBootstrapServices();
        startCoreServices();
        startOtherServices();
        SystemServerInitThreadPool.shutdown();
    } catch (Throwable ex) {
        Slog.e("System", "******************************************");
        Slog.e("System", "************ Failure starting system services", ex);
        throw ex;
    } finally {
        traceEnd();
    }

   //初始化系统上下文对象mSystemContext，并设置默认的主题,mSystemContext实际上是一个ContextImpl对象。调用ActivityThread.systemMain()的时候，会调用ActivityThread.attach(true)，而在attach()里面，则创建了Application对象，并调用了Application.onCreate()。
   private void createSystemContext() {
    ActivityThread activityThread = ActivityThread.systemMain();
    mSystemContext = activityThread.getSystemContext();
    mSystemContext.setTheme(DEFAULT_SYSTEM_THEME);

    final Context systemUiContext = activityThread.getSystemUiContext();
    systemUiContext.setTheme(DEFAULT_SYSTEM_THEME);
}

//在这里开启了几个核心的服务，因为这些服务之间相互依赖，所以都放在了这个方法里面。
private void startBootstrapServices() {

    ...ignore some code...

    //通过Lifecycle这个类来创建ActivityManagerService
    mActivityManagerService = mSystemServiceManager.startService(
            ActivityManagerService.Lifecycle.class).getService();
    mActivityManagerService.setSystemServiceManager(mSystemServiceManager);

    //初始化PowerManagerService，因为其他服务需要依赖这个Service，因此需要尽快的初始化
    mPowerManagerService = mSystemServiceManager.startService(PowerManagerService.class);

    // 现在电源管理已经开启，ActivityManagerService负责电源管理功能
    mActivityManagerService.initPowerManagement();

    // 初始化DisplayManagerService
    mDisplayManagerService = mSystemServiceManager.startService(DisplayManagerService.class);

    //初始化PackageManagerService
   mPackageManagerService = PackageManagerService.main(mSystemContext, mInstaller,
   mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore);
   
   ...ignore some code...
}

经过上面这些步骤，我们的ActivityManagerService对象已经创建好了，并且完成了成员变量初始化。而且在这之前，调用createSystemContext()创建系统上下文的时候，也已经完成了mSystemContext和ActivityThread的创建。注意，这是系统进程开启时的流程，在这之后，会开启系统的Launcher程序，完成系统界面的加载与显示。
ActivityManagerService（AMS）这个服务，和ActivityThread合作，掌控了Android中最重要的Activity(实例)的全部生命周期：创建，销毁，状态切换。这个通过AMS的初始化就能看到端倪：
public static final class Lifecycle extends SystemService {
private final ActivityManagerService mService;

    public Lifecycle(Context context) {
        super(context);
        mService = new ActivityManagerService(context);
    }

    @Override
    public void onStart() {
        mService.start();
    }

    @Override
    public void onBootPhase(int phase) {
        mService.mBootPhase = phase;
        if (phase == PHASE_SYSTEM_SERVICES_READY) {
            mService.mBatteryStatsService.systemServicesReady();
            mService.mServices.systemServicesReady();
        }
    }

    @Override
    public void onCleanupUser(int userId) {
        mService.mBatteryStatsService.onCleanupUser(userId);
    }

    public ActivityManagerService getService() {
        return mService;
    }
}

Lifecycle.java这个类启动了AMS，再看AMS的初始化，我简单摘要一下：

public ActivityManagerService(Context systemContext) {
    LockGuard.installLock(this, LockGuard.INDEX_ACTIVITY);
    mInjector = new Injector();
    mContext = systemContext;

    mFactoryTest = FactoryTest.getMode();
    //获取当前ActivityThread句柄
    mSystemThread = ActivityThread.currentActivityThread();
    mUiContext = mSystemThread.getSystemUiContext();

    Slog.i(TAG, "Memory class: " + ActivityManager.staticGetMemoryClass());
    
    //检查预授权限列表
    mPermissionReviewRequired = mContext.getResources().getBoolean(
            com.android.internal.R.bool.config_permissionReviewRequired);

    //起一个主线程，获取当前服务状态，调用对应处理
    mHandlerThread = new ServiceThread(TAG,
            THREAD_PRIORITY_FOREGROUND, false /*allowIo*/);
    mHandlerThread.start();
    mHandler = new MainHandler(mHandlerThread.getLooper());
    mUiHandler = mInjector.getUiHandler(this);

    //过程监控，比如我们如果需要跳转Activity，就要用到这个handle去通知zygote进程来fork一个新进程(通过socket的方式执行IPC)
    mProcStartHandlerThread = new ServiceThread(TAG + ":procStart",
            THREAD_PRIORITY_FOREGROUND, false /* allowIo */);
    mProcStartHandlerThread.start();
    mProcStartHandler = new Handler(mProcStartHandlerThread.getLooper());

    mConstants = new ActivityManagerConstants(this, mHandler);

    /* static; one-time init here */
    if (sKillHandler == null) {
        sKillThread = new ServiceThread(TAG + ":kill",
                THREAD_PRIORITY_BACKGROUND, true /* allowIo */);
        sKillThread.start();
        sKillHandler = new KillHandler(sKillThread.getLooper());
    }

   //广播管理
    mFgBroadcastQueue = new BroadcastQueue(this, mHandler,
            "foreground", BROADCAST_FG_TIMEOUT, false);
    mBgBroadcastQueue = new BroadcastQueue(this, mHandler,
            "background", BROADCAST_BG_TIMEOUT, true);
    mBroadcastQueues[0] = mFgBroadcastQueue;
    mBroadcastQueues[1] = mBgBroadcastQueue;

    //记录服务
    mServices = new ActiveServices(this);

     //记录Provider，数据存储
    mProviderMap = new ProviderMap(this);
    mAppErrors = new AppErrors(mUiContext, this);

    File dataDir = Environment.getDataDirectory();
    File systemDir = new File(dataDir, "system");
    systemDir.mkdirs();

    //记录警告信息
    mAppWarnings = new AppWarnings(this, mUiContext, mHandler, mUiHandler, systemDir);

    // TODO: Move creation of battery stats service outside of activity manager service.
    mBatteryStatsService = new BatteryStatsService(systemContext, systemDir, mHandler);
    mBatteryStatsService.getActiveStatistics().readLocked();
    mBatteryStatsService.scheduleWriteToDisk();
    mOnBattery = DEBUG_POWER ? true
            : mBatteryStatsService.getActiveStatistics().getIsOnBattery();
    mBatteryStatsService.getActiveStatistics().setCallback(this);

    //内存管理
    mProcessStats = new ProcessStatsService(this, new File(systemDir, "procstats"));

   //原生权限管理
    mAppOpsService = mInjector.getAppOpsService(new File(systemDir, "appops.xml"), mHandler);

    //权限持久化保存至该文件中
    mGrantFile = new AtomicFile(new File(systemDir, "urigrants.xml"), "uri-grants");

    ...ignore some code...

    //看门狗，异常监控，防止多个Service运行时死锁。如果发生就需要通过init重启SystemServer
    Watchdog.getInstance().addMonitor(this);
    Watchdog.getInstance().addThread(mHandler);

    ...ignore some code...

}

我们回过头来再来看看如何加载一个app，注意看activityThread是通过systemMain方法创建成功的，我们看看这段实现：

public static ActivityThread systemMain() {
    // The system process on low-memory devices do not get to use hardware
    // accelerated drawing, since this can add too much overhead to the
    // process.
    if (!ActivityManager.isHighEndGfx()) {
        ThreadedRenderer.disable(true);
    } else {
        ThreadedRenderer.enableForegroundTrimming();
    }
    ActivityThread thread = new ActivityThread();
    thread.attach(true, 0);  //这是重点
    return thread;
}

看看attach实现：

private void attach(boolean system, long startSeq) {
    sCurrentActivityThread = this;
    mSystemThread = system;
    if (!system) {
        ViewRootImpl.addFirstDrawHandler(new Runnable() {
            @Override
            public void run() {
                ensureJitEnabled();
            }
        });
        android.ddm.DdmHandleAppName.setAppName("<pre-initialized>",
                                                UserHandle.myUserId());
        RuntimeInit.setApplicationObject(mAppThread.asBinder());'
        
        //通过binder机制调用ActivityManagerService的attachApplication方法
        final IActivityManager mgr = ActivityManager.getService();
        try {
            mgr.attachApplication(mAppThread, startSeq);
        } catch (RemoteException ex) {
            throw ex.rethrowFromSystemServer();
        }
        ...ignore some code...
    } else {
        // Don't set application object here -- if the system crashes,
        // we can't display an alert, we just want to die die die.
        android.ddm.DdmHandleAppName.setAppName("system_process",
                UserHandle.myUserId());
        try {
            mInstrumentation = new Instrumentation();
            mInstrumentation.basicInit(this);
            ContextImpl context = ContextImpl.createAppContext(
                    this, getSystemContext().mPackageInfo);
            mInitialApplication = context.mPackageInfo.makeApplication(true, null);
            mInitialApplication.onCreate();
        } catch (Exception e) {
            throw new RuntimeException(
                    "Unable to instantiate Application():" + e.toString(), e);
        }
    }

    ...ignore some code...
}

ActivityManagerService的attachApplication方法

@Override
public final void attachApplication(IApplicationThread thread, long startSeq) {
    synchronized (this) {
        int callingPid = Binder.getCallingPid();
        final int callingUid = Binder.getCallingUid();
        final long origId = Binder.clearCallingIdentity();
        attachApplicationLocked(thread, callingPid, callingUid, startSeq);
        Binder.restoreCallingIdentity(origId);
    }
}

//加载Application和Activity
private final boolean attachApplicationLocked(IApplicationThread thread,
        int pid, int callingUid, long startSeq) {
        
  ...ignore some code...
  
   //1.绑定Application
   thread.bindApplication(processName, appInfo, providers, null, profilerInfo,
                    null, null, null, testMode,
                    mBinderTransactionTrackingEnabled, enableTrackAllocation,
                    isRestrictedBackupMode || !normalMode, app.persistent,
                    new Configuration(getGlobalConfiguration()), app.compat,
                    getCommonServicesLocked(app.isolated),
                    mCoreSettingsObserver.getCoreSettingsLocked(),
                    buildSerial, isAutofillCompatEnabled);
                    
        ...ignore some code...

    // See if the top visible activity is waiting to run in this process...
    if (normalMode) {
        try {
            //2.调用Activity的OnCreate方法
            if (mStackSupervisor.attachApplicationLocked(app)) {
                didSomething = true;
            }
        } catch (Exception e) {
            Slog.wtf(TAG, "Exception thrown launching activities in " + app, e);
            badApp = true;
   }

通过绑定ActivityThread的bindApplication来绑定应用。又回到了ActivityThread.java中，最终还是通过ActivityThread这个大管家来执行。我们只看一句话：

   public final void bindApplication(String processName, ApplicationInfo appInfo,
            List<ProviderInfo> providers, ComponentName instrumentationName,
            ProfilerInfo profilerInfo, Bundle instrumentationArgs,
            IInstrumentationWatcher instrumentationWatcher,
            IUiAutomationConnection instrumentationUiConnection, int debugMode,
            boolean enableBinderTracking, boolean trackAllocation,
            boolean isRestrictedBackupMode, boolean persistent, Configuration config,
            CompatibilityInfo compatInfo, Map services, Bundle coreSettings,
            String buildSerial, boolean autofillCompatibilityEnabled) {
            
            ...ignore some code...
            sendMessage(H.BIND_APPLICATION, data);
    }

以消息的方式处理绑定事件，在H这个Handle中处理：

 private void handleBindApplication(AppBindData data) {
    ...ignore some code...

    //1 保证只有一个Instrumentation实例
    if (data.instrumentationName != null) {
       ...ignore some code...
     } else {
        //2.创建一个Instrumentation管理activity的生命周期
        mInstrumentation = new Instrumentation();
     }
     //3.创建一个Application实例，一个应用程序只有一个Application实例
        Application app = data.info.makeApplication(data.restrictedBackupMode, null);
        mInitialApplication = app;

     //4.调用Application的onCreate方法，执行APP的初始化超过
     mInstrumentation.callApplicationOnCreate(app);

android.app.Instrumentation.java:

public void callApplicationOnCreate(Application app) {
    app.onCreate();
}

接下来看一下Activity的onCreate,把之前的attach代码再贴一遍：

//加载Application和Activity
private final boolean attachApplicationLocked(IApplicationThread thread, int pid, int callingUid, long startSeq) {
        
  ...ignore some code...
  
   //1.绑定Application
   thread.bindApplication(processName, appInfo, providers, null, profilerInfo,
                    null, null, null, testMode,
                    mBinderTransactionTrackingEnabled, enableTrackAllocation,
                    isRestrictedBackupMode || !normalMode, app.persistent,
                    new Configuration(getGlobalConfiguration()), app.compat,
                    getCommonServicesLocked(app.isolated),
                    mCoreSettingsObserver.getCoreSettingsLocked(),
                    buildSerial, isAutofillCompatEnabled);
                    
        ...ignore some code...

    // See if the top visible activity is waiting to run in this process...
    if (normalMode) {
        try {
            //2.调用Activity的OnCreate方法
            if (mStackSupervisor.attachApplicationLocked(app)) {
                didSomething = true;
            }
        } catch (Exception e) {
            Slog.wtf(TAG, "Exception thrown launching activities in " + app, e);
            badApp = true;
   }

看第二个注释，会调用ActivityStackSupervisor的attachApplicationLocked方法启动activity：

boolean attachApplicationLocked(ProcessRecord app) throws RemoteException {
   ...ignore some code...

     //调用activity
     if (realStartActivityLocked(activity, app,
             top == activity /* andResume */, true /* checkConfig */)) {
         didSomething = true;
     }
     ...ignore some code...

}

走进realStartActivityLocked 方法看一下实现（Android P）：

final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app,
        boolean andResume, boolean checkConfig) throws RemoteException {  
         ...ignore some code...
         
        // 1.Create activity launch transaction.
            final ClientTransaction clientTransaction = ClientTransaction.obtain(app.thread,r.appToken);
            
            //2.LaunchActivityItem代表的是启动Activity，可以添加多个回调
            clientTransaction.addCallback(LaunchActivityItem.obtain(new Intent(r.intent),
                    System.identityHashCode(r), r.info,
                    // TODO: Have this take the merged configuration instead of separate global
                    // and override configs.
                    mergedConfiguration.getGlobalConfiguration(),
                    mergedConfiguration.getOverrideConfiguration(), r.compat,
                    r.launchedFromPackage, task.voiceInteractor, app.repProcState, r.icicle,
                    r.persistentState, results, newIntents, mService.isNextTransitionForward(),
                    profilerInfo));

            // 设置生命周期状态，每种状态对应不同的执行ClientTransactionItem
            final ActivityLifecycleItem lifecycleItem;
            if (andResume) {
                //3.执行onResume
                lifecycleItem =       
                ResumeActivityItem.obtain(mService.isNextTransitionForward());
            } else {
               //4.执行onPause
                lifecycleItem = PauseActivityItem.obtain();
            }
            //5.发起不同的生命周期请求
            clientTransaction.setLifecycleStateRequest(lifecycleItem);

            // 6.具体执行
            mService.getLifecycleManager().scheduleTransaction(clientTransaction);
            ...ignore some code...
}

从上面的代码我们可以看到，执行了onCreate和onResume两个生命周期。scheduleTransaction是具体执行，
ClientLifecycleManager.java#scheduleTransaction

    void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
    final IApplicationThread client = transaction.getClient();
    transaction.schedule();
}

ClientTransaction.java#schedule

public void schedule() throws RemoteException {
    mClient.scheduleTransaction(this);
}               

这个client就是我们的AppThread句柄，继承ClientTransactionHandler，在这个类中执行scheduleTransaction方法：

void scheduleTransaction(ClientTransaction transaction) {
    transaction.preExecute(this);
    sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction);
}

回到AppThread的H handler中查看处理：

 case EXECUTE_TRANSACTION:
                final ClientTransaction transaction = (ClientTransaction) msg.obj;
                mTransactionExecutor.execute(transaction);
                break；

TransactionExecutor#execute实现：

  public void execute(ClientTransaction transaction) {
    final IBinder token = transaction.getActivityToken();
    log("Start resolving transaction for client: " + mTransactionHandler + ", token: " + token);

    executeCallbacks(transaction);

    executeLifecycleState(transaction);
    mPendingActions.clear();
    log("End resolving transaction");
}

TransactionExecutor#executeCallbacks实现：

public void executeCallbacks(ClientTransaction transaction) {
    final List<ClientTransactionItem> callbacks = transaction.getCallbacks();
    ...ignore some code...
    final int size = callbacks.size();
    for (int i = 0; i < size; ++i) {
        final ClientTransactionItem item = callbacks.get(i);
        log("Resolving callback: " + item);
        final int postExecutionState = item.getPostExecutionState();
        final int closestPreExecutionState = mHelper.getClosestPreExecutionState(r,
                item.getPostExecutionState());
        if (closestPreExecutionState != UNDEFINED) {
            cycleToPath(r, closestPreExecutionState);
        }

        //1.对应的ClientTransactionItem项目，我们这里执行的LaunchActivityItem
        item.execute(mTransactionHandler, token, mPendingActions);
        item.postExecute(mTransactionHandler, token, mPendingActions);
        if (r == null) {
            // Launch activity request will create an activity record.
            r = mTransactionHandler.getActivityClient(token);
        }

        if (postExecutionState != UNDEFINED && r != null) {
            // Skip the very last transition and perform it by explicit state request instead.
            final boolean shouldExcludeLastTransition =
                    i == lastCallbackRequestingState && finalState == postExecutionState;
            cycleToPath(r, postExecutionState, shouldExcludeLastTransition);
        }
    }

LaunchActivityItem#execute

public void execute(ClientTransactionHandler client, IBinder token,
        PendingTransactionActions pendingActions) {
    Trace.traceBegin(TRACE_TAG_ACTIVITY_MANAGER, "activityStart");
    ActivityClientRecord r = new ActivityClientRecord(token, mIntent, mIdent, mInfo,
            mOverrideConfig, mCompatInfo, mReferrer, mVoiceInteractor, mState, mPersistentState,
            mPendingResults, mPendingNewIntents, mIsForward,
            mProfilerInfo, client);
            
    //记住：client就是appThread,每个Activity信息存在ActivityClientRecord中
    client.handleLaunchActivity(r, pendingActions, null /* customIntent */);
    Trace.traceEnd(TRACE_TAG_ACTIVITY_MANAGER);
}

APPThread的handleLaunchActivity–>performLaunchActivity,最终还是通过mInstrumentation来创建Activity:

activity = mInstrumentation.newActivity(
                cl, component.getClassName(), r.intent);
if (r.isPersistable()) {
                mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
            } else {
                mInstrumentation.callActivityOnCreate(activity, r.state);
            }

Instrumentation.java#callActivityOnCreate：

public void callActivityOnCreate(Activity activity, Bundle icicle) {
    prePerformCreate(activity);
    activity.performCreate(icicle);
    postPerformCreate(activity);
}

其中performCreate执行Activity的onCreate方法：

final void performCreate(Bundle icicle, PersistableBundle persistentState) {
    mCanEnterPictureInPicture = true;
    restoreHasCurrentPermissionRequest(icicle);
    if (persistentState != null) {
        onCreate(icicle, persistentState);
    } else {
        onCreate(icicle);
    }
    ...ignore some code...
}

到此App启动全部流程执行完毕。