一、Android系统启动过程
- 启动电源以及系统启动：当电源按下时引导芯片代码从预定义的地方（固化在ROM）开始执行。加载引导程序BootLoader到RAM中并执行
- 引导程序BootLoader：它是在Android操作系统开始运行前的一个小程序，其主要作用是把系统OS拉起来并运行
- Linux内核启动：当内核被引导程序拉起来启动时，设置缓存、被保护存储器、计划列表、加载驱动。在内核完成系统设置后，首先在系统文件中寻找init.rc文件并启动init进程
- init进程启动：它做的工作比较多，主要有初始化和启动属性服务，启动Zygote进程
1、init进程
init进程是Android系统中用户空间的第一个进程，进程号为1。作为第一个进程，被赋予了很多极其重要的工作职责，比如创建Zygote（孵化器）和属性服务等。init进程源码目录system/core/init中。
1）、init进程的入口函数main：
//system/core/init/init.cpp
int main(int argc, char** argv) {
if (!strcmp(basename(argv[0]), "ueventd")) return ueventd_main(argc, argv);
if (!strcmp(basename(argv[0]), "watchdogd")) return watchdogd_main(argc, argv);
if (REBOOT_BOOTLOADER_ON_PANIC) install_reboot_signal_handlers();
add_environment("PATH", _PATH_DEFPATH); //设置环境变量
bool is_first_stage = (getenv("INIT_SECOND_STAGE") == nullptr);
if (is_first_stage) {
boot_clock::time_point start_time = boot_clock::now();
umask(0);
//创建和挂在启动所需的文件目录
mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755");
mkdir("/dev/pts", 0755);
mkdir("/dev/socket", 0755);
mount("devpts", "/dev/pts", "devpts", 0, NULL);
#define MAKE_STR(x) __STRING(x)
mount("proc", "/proc", "proc", 0, "hidepid=2,gid=" MAKE_STR(AID_READPROC));
chmod("/proc/cmdline", 0440);
gid_t groups[] = { AID_READPROC };
setgroups(arraysize(groups), groups);
mount("sysfs", "/sys", "sysfs", 0, NULL);
mount("selinuxfs", "/sys/fs/selinux", "selinuxfs", 0, NULL);
mknod("/dev/kmsg", S_IFCHR | 0600, makedev(1, 11));
mknod("/dev/random", S_IFCHR | 0666, makedev(1, 8));
mknod("/dev/urandom", S_IFCHR | 0666, makedev(1, 9));
//初始化Kernel的日志
InitKernelLogging(argv);
//...省略代码...
}
//init进程的第二阶段
InitKernelLogging(argv);
LOG(INFO) << "init second stage started!";
keyctl(KEYCTL_GET_KEYRING_ID, KEY_SPEC_SESSION_KEYRING, 1);
close(open("/dev/.booting", O_WRONLY | O_CREAT | O_CLOEXEC, 0000));
//步骤一：对属性服务进程初始化
property_init();
process_kernel_dt();
process_kernel_cmdline();
//...省略代码...
//步骤二：设置子进程信号处理函数 如果子进程Zygote异常退出就会触发该函数进行信号处理
signal_handler_init();
property_load_boot_defaults(); //导入默认的环境变量
export_oem_lock_status();
//步骤三：启动属性服务
start_property_service();
set_usb_controller();
const BuiltinFunctionMap function_map;
Action::set_function_map(&function_map);
Parser& parser = Parser::GetInstance();
parser.AddSectionParser("service",std::make_unique<ServiceParser>());
parser.AddSectionParser("on", std::make_unique<ActionParser>());
parser.AddSectionParser("import", std::make_unique<ImportParser>());
std::string bootscript = GetProperty("ro.boot.init_rc", "");
if (bootscript.empty()) {
//步骤四：解析init.rc配置文件
parser.ParseConfig("/init.rc");
parser.set_is_system_etc_init_loaded(parser.ParseConfig("/system/etc/init"));
parser.set_is_vendor_etc_init_loaded(parser.ParseConfig("/vendor/etc/init"));
parser.set_is_odm_etc_init_loaded(parser.ParseConfig("/odm/etc/init"));
} else {
parser.ParseConfig(bootscript);
parser.set_is_system_etc_init_loaded(true);
parser.set_is_vendor_etc_init_loaded(true);
parser.set_is_odm_etc_init_loaded(true);
}
if (false) parser.DumpState();
ActionManager& am = ActionManager::GetInstance();
am.QueueEventTrigger("early-init");
//...省略代码...
while (true) {
int epoll_timeout_ms = -1;
//遍历init.rc文件中的每个action中携带的command对应的函数并执行
if (!(waiting_for_prop || ServiceManager::GetInstance().IsWaitingForExec())) {
am.ExecuteOneCommand();
}
//重启死去的进程
if (!(waiting_for_prop || ServiceManager::GetInstance().IsWaitingForExec())) {
restart_processes();
//...省略代码...
}
epoll_event ev;
int nr = TEMP_FAILURE_RETRY(epoll_wait(epoll_fd, &ev, 1, epoll_timeout_ms));
if (nr == -1) PLOG(ERROR) << "epoll_wait failed";
else if (nr == 1) ((void (*)()) ev.data.ptr)();
}
return 0;
}从上面源码分析可以得出init进程的流程如下：
- 创建和挂载启动所需的文件目录，其中挂载了tmpfs、devpts、proc、sysfs、selinuxfs共五种文件系统，这些都是系统运行时目录，系统运行时存在，停止的时候就会消失
- 通过调用property_init函数来对属性进行初始化
- 通过调用signal_handler_init函数来设置子进程信号处理函数，其被定义在system/core/init/signal_handler.cpp中，主要防止子进程成为僵尸进程
- 通过调用start_property_service函数来启动属性服务
- 解析init.rc文件
- 初始化完成后进入死循环，死循环里面主要做了两件事，遍历action中的命令并执行，检查并重启已经死去的子进程
2）、配置文件init.rc
init.rc是一个非常重要的配置文件，它是由Android初始化语言编写的脚本，主要包括两种类型的语句。
- Action类型语句：它是 commands 的命名序列，Actions 有一个 trigger，它用来决定这个 action 应该什么时候发生。当满足 action 的 trigger 的事件发生时，这个 action 会被加到执行队列的尾部，除非队列中已经有这个 action。其格式如下：
on <trigger> [&& <trigger>]* //设置触发器 触发器之间可以进行逻辑关系组合
<command> //动作触发后要执行的命令
<command>- Service类型语句：它是一些程序，init 会建立它们，或者当它们退出时选择性地重启它们。格式如下：
service <name> <pathname> [<argument>]* //service后面依次是service的名字、执行路径、参数
<option> //service的修饰词，影响什么时候如何启动service
<option>init进程中最后解析了init.rc文件。init.rc文件里面定义了一些action触发器执行的命令和一些service程序，init解析的同时并把各种action、service等填充到相应链表容器管理，有序将early-init、init等各种cmd加入到执行队列action_queue链表中，进入while()循环依次取出执行队列action_queue中的command执行，fork包括app_process在内的各种进程，epoll阻塞监听处理来自挂掉的子进程的消息，根据设定策略restart子进程。
//system/core/rootdir/init.rc
import /init.environ.rc
import /init.usb.rc
import /init.${ro.hardware}.rc
import /vendor/etc/init/hw/init.${ro.hardware}.rc
import /init.usb.configfs.rc
import /init.${ro.zygote}.rc
on early-init
#设置init进程及其子进程的oom_adj
write /proc/1/oom_score_adj -1000
# Disable sysrq from keyboard
write /proc/sys/kernel/sysrq 0
# Set the security context of /adb_keys if present.
restorecon /adb_keys
#挂载文件系统
mkdir /mnt 0775 root system
# Set the security context of /postinstall if present.
restorecon /postinstall
start ueventd
on init
sysclktz 0
# Mix device-specific information into the entropy pool
copy /proc/cmdline /dev/urandom
copy /default.prop /dev/urandom
# Backward compatibility.
symlink /system/etc /etc
symlink /sys/kernel/debug /d
# Link /vendor to /system/vendor for devices without a vendor partition.
symlink /system/vendor /vendor
# Mount cgroup mount point for cpu accounting
mount cgroup none /acct cpuacct
mkdir /acct/uid
//...省略代码...
on property:sys.boot_from_charger_mode=1
class_stop charger
trigger late-init
on load_persist_props_action
load_persist_props
start logd
start logd-reinit
on firmware_mounts_complete
rm /dev/.booting
#挂载文件系统并启动核心服务
on late-init
trigger early-fs
trigger fs
trigger post-fs
trigger late-fs
trigger post-fs-data
trigger zygote-start
trigger load_persist_props_action
trigger firmware_mounts_complete
trigger early-boot
trigger boot
on post-fs
load_system_props
#开启基本服务
start logd
start servicemanager
start hwservicemanager
start vndservicemanager
mount rootfs rootfs / ro remount
mount rootfs rootfs / shared rec
mount none /mnt/runtime/default /storage bind rec
mount none none /storage slave rec
restorecon --recursive --cross-filesystems /sys/kernel/debug
chmod 0755 /sys/kernel/debug/tracing
#修改cache目录访问权限
chown system cache /cache
chmod 0770 /cache
restorecon_recursive /cache
mkdir /cache/recovery 0770 system cache
mkdir /cache/backup_stage 0700 system system
mkdir /cache/backup 0700 system system
//...省略代码...
//在启动zygote进程的时候将post-fs的数据初始化到zygote进程里面
on zygote-start && property:ro.crypto.state=unencrypted
# A/B update verifier that marks a successful boot.
exec_start update_verifier_nonencrypted
start netd
start zygote
start zygote_secondary
on zygote-start && property:ro.crypto.state=unsupported
# A/B update verifier that marks a successful boot.
exec_start update_verifier_nonencrypted
start netd
start zygote
start zygote_secondary
on zygote-start && property:ro.crypto.state=encrypted && property:ro.crypto.type=file
# A/B update verifier that marks a successful boot.
exec_start update_verifier_nonencrypted
start netd
start zygote
start zygote_secondary
on boot
//...省略代码...
//启动zygote进程
on nonencrypted
class_start main //启动那些classname为main的Service
class_start late_start
on property:sys.init_log_level=*
loglevel ${sys.init_log_level}
on charger
class_start charger
on property:vold.decrypt=trigger_reset_main
class_reset main
on property:vold.decrypt=trigger_load_persist_props
load_persist_props
start logd
start logd-reinit
on property:vold.decrypt=trigger_post_fs_data
trigger post-fs-data
on property:vold.decrypt=trigger_restart_min_framework
# A/B update verifier that marks a successful boot.
exec_start update_verifier
class_start main
on property:vold.decrypt=trigger_restart_framework
# A/B update verifier that marks a successful boot.
exec_start update_verifier
class_start main
class_start late_start
on property:vold.decrypt=trigger_shutdown_framework
class_reset late_start
class_reset main
on property:sys.boot_completed=1
bootchart stop
service ueventd /sbin/ueventd
class core
critical
seclabel u:r:ueventd:s0
service healthd /system/bin/healthd
class core
critical
group root system wakelock
service console /system/bin/sh
class core
console
disabled
user shell
group shell log readproc
seclabel u:r:shell:s0
on property:ro.debuggable=1
# Give writes to anyone for the trace folder on debug builds.
# The folder is used to store method traces.
chmod 0773 /data/misc/trace
start console
service flash_recovery /system/bin/install-recovery.sh
class main
oneshot
由上面可以知道init.rc定义了有些事件触发执行的命令和一些service，并在on nonencrypted的地方启动了zygote进程。安卓8.0对init.rc文件进行了拆分，每个服务对应一个rc文件。我们要分析的Zygote启动脚本在init.zygoteXX.rc文件中定义，其源码如下：
//system/core/rootdir/init.zygote64.rc
service zygote /system/bin/app_process64 -Xzygote /system/bin --zygote --start-system server
class main //定义zygote进程的classname为main
priority -20
user root
group root readproc
socket zygote stream 660 root system
onrestart write /sys/android_power/request_state wake
onrestart write /sys/power/state on
onrestart restart audioserver //启动audioserver
onrestart restart cameraserver //启动cameraserver
onrestart restart media //启动media
onrestart restart netd //启动netd
onrestart restart wificond
writepid /dev/cpuset/foreground/tasks3）、init如何启动Service
init.rc中定义了一系列service，init进程除了解析init.rc文件中action语句和service语句。init进程通过ServiceParser（实现代码在system/core/init/service.cpp中）对Service进行解析，并将Service对象加入Service链表中。
Zygote也是一个Service，在Zygote的启动脚本中，我们可以知道Zygote的classname为main，在init.rc脚本中class_start main进行启动Zygote进程。class_start是一个COMMAND，对应函数为do_class_start（在system/core/init/builtins.cpp中），其实现的功能就是遍历Service链表，找到classname为main的Service，这里就找到了Zygote，首先判断Zygote是否运行，如果运行则直接返回flase，否则创建子进程并执行该Service。源码如下：
//system/core/init/builtins.cpp
//对应init.rc脚本中的class_start命令 实际上调用了StartIfNotDisabled函数
static int do_class_start(const std::vector<std::string>& args) {
ServiceManager::GetInstance().
ForEachServiceInClass(args[1], [] (Service* s) { s->StartIfNotDisabled(); });
return 0;
}
//对应init.rc脚本中的class_stop命令
static int do_class_stop(const std::vector<std::string>& args) {
ServiceManager::GetInstance().
ForEachServiceInClass(args[1], [] (Service* s) { s->Stop(); });
return 0;
}
//对应init.rc脚本中的class_reset命令
static int do_class_reset(const std::vector<std::string>& args) {
ServiceManager::GetInstance().
ForEachServiceInClass(args[1], [] (Service* s) { s->Reset(); });
return 0;
}//system/core/init/service.cpp
bool Service::StartIfNotDisabled() {
if (!(flags_ & SVC_DISABLED)) {
return Start();//如果没有在对应的rc文件中设置disabled选项则调用Start函数启动该Service
} else {
flags_ |= SVC_DISABLED_START;
}
return true;
}
bool Service::Start() {
flags_ &= (~(SVC_DISABLED|SVC_RESTARTING|SVC_RESET|SVC_RESTART|SVC_DISABLED_START));
//如果Service已经运行，则不启动
if (flags_ & SVC_RUNNING) return false;
bool needs_console = (flags_ & SVC_CONSOLE);
if (needs_console) {
if (console_.empty()) console_ = default_console;
int console_fd = open(console_.c_str(), O_RDWR | O_CLOEXEC);
if (console_fd < 0) {
flags_ |= SVC_DISABLED;
return false;
}
close(console_fd);
}
//判断需要启动的Service的对应的执行文件是否存在，不存在则不启动该Service
struct stat sb;
if (stat(args_[0].c_str(), &sb) == -1) {
flags_ |= SVC_DISABLED;
return false;
}
//...省略代码...
pid_t pid = -1;
if (namespace_flags_) {
pid = clone(nullptr, nullptr, namespace_flags_ | SIGCHLD, nullptr);
} else {
//创建子进程
pid = fork();
}
if (pid == 0) {
umask(077);
//...省略代码...
if (execve(strs[0], (char**) &strs[0], (char**) ENV) < 0){
//调用execve函数，Service的子进程就会被启动
//如果该Service是Zygote，因为init.zygote64.rc已经定义了执行程序路径为/system/bin/app_process64,对应文件为app_main.cpp
}
_exit(127);
}
if (pid < 0) {
pid_ = 0;
return false;
}
//...省略代码...
return true;
}4）、总结：
在android手机或平板电源开机后，从固定地址运行了bootloader，bootloader启动了linux内核，内核配置完成后开始了系统的第一个进程init，init主要做了下面三件事：
- 创建和挂载启动所需的文件目录
- 初始化和启动属性服务
- 解析init.rc配置文件，并根据init.rc文件里面的Service语句fork出了Zygote进程（孵化器进程）
2、Zygote进程
在android系统中，DVM、ART、应用程序进程、系统SystemServer进程都是由Zygote进程来创建的，我们也将它成为孵化器。Zygote进程是在init进程启动时创建的，起初它并不叫这个名字， 而是叫app_process，它启动后linux系统下的pctrl会调用app_process，Android.mk中将其名称换成了Zygote。
1）、Zygote启动脚本
从Android.5.0开始支持64位程序，Zygote也就有了下面四个不同的版本，通过ro.zygote属性来控制使用不同的启动脚本：
- init.zygote32.rc：表示支持纯32位程序，根据脚本说明会启动一个进程为zygote，执行程序为app_process，classmain为main，如果audioserver、cameraserver、media等进程终止了就需要进行重启
- init.zygote32_64.rc：表示支持32位程序也支持64位程序，脚本中有两个Service语句，说明会启动两个Zygote进程，第一个进程为zygote，执行程序为app_process32作为主模式，第二个进程为zygote_secondary，执行程序为app_process64作为辅模式
- init.zygote64.rc：表示支持纯64位程序
- init.zygote64_32.rc：跟init.zygote32_64.rc类似，执行程序为app_process64作为主模式，执行程序为app_process32作为辅模式
//system/core/rootdir/init.zygote32.rc
service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
class main
priority -20
user root
group root readproc
socket zygote stream 660 root system
onrestart write /sys/android_power/request_state wake
onrestart write /sys/power/state on
onrestart restart audioserver
onrestart restart cameraserver
onrestart restart media
onrestart restart netd
onrestart restart wificond
writepid /dev/cpuset/foreground/tasks
//system/core/rootdir/init.zygote32_64.rc
service zygote /system/bin/app_process32 -Xzygote /system/bin --zygote --start-system-server --socket-name=zygote
class main
priority -20
user root
group root readproc
socket zygote stream 660 root system
onrestart write /sys/android_power/request_state wake
onrestart write /sys/power/state on
onrestart restart audioserver
onrestart restart cameraserver
onrestart restart media
onrestart restart netd
onrestart restart wificond
writepid /dev/cpuset/foreground/tasks
service zygote_secondary /system/bin/app_process64 -Xzygote /system/bin --zygote --socket-name=zygote_secondary
class main
priority -20
user root
group root readproc
socket zygote_secondary stream 660 root system
onrestart restart zygote
writepid /dev/cpuset/foreground/tasks
2）、Zygote启动流程：
init启动Zygote时主要调用了app_main.cpp，由下面源码得知，最后还是调用了AppRuntime的start方法， 并将Zygote的路径“com.android.internal.os.ZygoteInit”作为参数传递进去进行启动
//framworks/base/cmds/app_process/app_main.cpp
int main(int argc, char* const argv[]){
AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));
//解析Service语句后面的那一系列参数
//...省略代码...
if (!niceName.isEmpty()) runtime.setArgv0(niceName.string(), true );
//runtime的start函数启动Zygote，自此Zygote就启动了
if (zygote)
runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
else if (className)
runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
else {
fprintf(stderr, "Error: no class name or --zygote supplied.\n");
app_usage();
}
}
//frameworks/base/core/jni/AndroidRuntime.cpp
void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote){
//...省略代码...
//启动JAVA虚拟机
JniInvocation jni_invocation;
jni_invocation.Init(NULL);
JNIEnv* env;
if (startVm(&mJavaVM, &env, zygote) != 0) {
return;
}
onVmCreated(env);
//为Java虚拟机注册JNI方法
if (startReg(env) < 0) {
ALOGE("Unable to register all android natives\n");
return;
}
//解析className 即解析com.android.internal.os.ZygoteInit类名
jclass stringClass;
jobjectArray strArray;
jstring classNameStr;
stringClass = env->FindClass("java/lang/String");
assert(stringClass != NULL);
strArray = env->NewObjectArray(options.size() + 1, stringClass, NULL);
assert(strArray != NULL);
classNameStr = env->NewStringUTF(className);
assert(classNameStr != NULL);
env->SetObjectArrayElement(strArray, 0, classNameStr);
for (size_t i = 0; i < options.size(); ++i) {
jstring optionsStr = env->NewStringUTF(options.itemAt(i).string());
assert(optionsStr != NULL);
env->SetObjectArrayElement(strArray, i + 1, optionsStr);
}
//将className的点替换成/ 即com/android/internal/os/ZygoteInit
char* slashClassName = toSlashClassName(className);
//根据上面的路径找到了ZygoteInit类
jclass startClass = env->FindClass(slashClassName);
if (startClass == NULL)
ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);
else {
//找到ZygoteInit类的main方法
jmethodID startMeth = env->GetStaticMethodID(startClass, "main", "([Ljava/lang/String;)V");
//调用ZygoteInit类的main方法
if (startMeth == NULL)
ALOGE("JavaVM unable to find main() in '%s'\n", className);
else
env->CallStaticVoidMethod(startClass, startMeth, strArray);
}
free(slashClassName);
}由上面源码可以知道，init进程解析了init.rc里面的配置文件，fork出了一个子进程，并执行了app_main.cpp文件的main方法，在这个main方法里面通过层层参数解析，最后调用了AppRuntime.start()方法，并把ZygoteInit这个对象的类路径传递了进去。这里首先启动了JAVA虚拟机（因为ZygoteInit是由java编写的，因此需要加载虚拟机），并通过jni的方式找到了ZygoteInit这个对象且调用了main方法，这样Zygote就从Native层进入了Java框架层。我们继续看看ZygoteInit的main方法：
//frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
public class ZygoteInit {
//...省略代码...
public static void main(String argv[]) {
//实例化ZygoteServer 孵化器进程的服务端套接字
ZygoteServer zygoteServer = new ZygoteServer();
ZygoteHooks.startZygoteNoThreadCreation();
//...省略代码...
try {
//...省略代码...
boolean startSystemServer = false;
String socketName = "zygote";
//通过ZygoteServer 注册了一个名叫zygote的服务端套接字
zygoteServer.registerServerSocket(socketName);
//预加载类和资源
if (!enableLazyPreload) {
bootTimingsTraceLog.traceBegin("ZygotePreload");
EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START, SystemClock.uptimeMillis());
preload(bootTimingsTraceLog);
EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END, SystemClock.uptimeMillis());
bootTimingsTraceLog.traceEnd();
} else {
Zygote.resetNicePriority();
}
//...省略代码...
//启动SystemServer进程
if (startSystemServer) {
startSystemServer(abiList, socketName, zygoteServer);
}
//通过ZygoteServer等待ams的一些命令
zygoteServer.runSelectLoop(abiList);
//关闭ZygoteServer的套接字
zygoteServer.closeServerSocket();
} catch (Zygote.MethodAndArgsCaller caller) {
//其实这里才是真正的调用SyetemServer的主方法
caller.run();
} catch (Throwable ex) {
zygoteServer.closeServerSocket();
throw ex;
}
}
}由上面源码可以知道，在ZygoteInit类的main方法中，主要做了下面四件事情：
- 实例化ZygoteServer，并通过registerServerSocket方法注册了一个叫做zygote的服务端套接字
- 通过preload方法预加载类和资源
- 启动了SystemServer进程
- 在ZygoteServer通过runSelectLoop方法等待AMS请求创建新的应用程序进程
3）、如何启动SystemServer进程
//frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
private static boolean startSystemServer(String abiList, String socketName, ZygoteServer zygoteServer)throws Zygote.MethodAndArgsCaller, RuntimeException {
long capabilities = posixCapabilitiesAsBits(
OsConstants.CAP_IPC_LOCK, OsConstants.CAP_KILL, OsConstants.CAP_NET_ADMIN, OsConstants.CAP_NET_BIND_SERVICE, OsConstants.CAP_NET_BROADCAST, OsConstants.CAP_NET_RAW, OsConstants.CAP_SYS_MODULE, OsConstants.CAP_SYS_NICE, OsConstants.CAP_SYS_PTRACE, OsConstants.CAP_SYS_TIME, OsConstants.CAP_SYS_TTY_CONFIG, OsConstants.CAP_WAKE_ALARM );
if (!SystemProperties.getBoolean(PROPERTY_RUNNING_IN_CONTAINER, false))
capabilities |= posixCapabilitiesAsBits(OsConstants.CAP_BLOCK_SUSPEND);
//创建args数组，用来保存启动SystemServer的启动参数
String args[] = {
"--setuid=1000",
"--setgid=1000",
"--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1023,1032,3001,3002,3003,3006,3007,3009,3010",
"--capabilities=" + capabilities + "," + capabilities,
"--nice-name=system_server",
"--runtime-args",
"com.android.server.SystemServer",
};
ZygoteConnection.Arguments parsedArgs = null;
int pid;
try {
//将args数组封装成Arguments对象，以便启动进程的时候调用
parsedArgs = new ZygoteConnection.Arguments(args);
ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);
//创建子进程SystemServer，其内部调用nativeForkSystemServer方法，最终fork子进程
pid = Zygote.forkSystemServer(
parsedArgs.uid, parsedArgs.gid,
parsedArgs.gids,
parsedArgs.debugFlags,
null,
parsedArgs.permittedCapabilities,
parsedArgs.effectiveCapabilities);
} catch (IllegalArgumentException ex) {
throw new RuntimeException(ex);
}
//判断当前进程为子进程
if (pid == 0) {
if (hasSecondZygote(abiList)) {
waitForSecondaryZygote(socketName);
}
//子进程关闭Server套接字，子进程不需要处理zygote套接字相关的命令
zygoteServer.closeServerSocket();
//进程处理SystemServer
handleSystemServerProcess(parsedArgs);
}
return true;
}
4）、ZygoteServer服务端
ZygoteServer其实是一个Zygote进程的一个套接字服务端，沿用Socket的模式来进行类似linux里面的命令处理，我们可以先看看源码：
//frameworks/base/core/java/com/android/internal/os/ZygoteServer.java
class ZygoteServer {
public static final String TAG = "ZygoteServer";
private static final String ANDROID_SOCKET_PREFIX = "ANDROID_SOCKET_";
private LocalServerSocket mServerSocket;
ZygoteServer() {
}
//为孵化器进程注册一个套接字 这里的参数传递的zygote
void registerServerSocket(String socketName) {
if (mServerSocket == null) {
int fileDesc;
final String fullSocketName = ANDROID_SOCKET_PREFIX + socketName;
try {
String env = System.getenv(fullSocketName);
fileDesc = Integer.parseInt(env);
} catch (RuntimeException ex) {
throw new RuntimeException(fullSocketName + " unset or invalid", ex);
}
try {
FileDescriptor fd = new FileDescriptor();
fd.setInt$(fileDesc);
mServerSocket = new LocalServerSocket(fd);
} catch (IOException ex) {
throw new RuntimeException( "Error binding to local socket '" + fileDesc + "'", ex);
}
}
}
//关闭孵化器进程的套接字 close后socket就不能接收到命令消息了
void closeServerSocket() {
try {
if (mServerSocket != null) {
FileDescriptor fd = mServerSocket.getFileDescriptor();
mServerSocket.close();
if (fd != null) Os.close(fd);
}
} catch (IOException ex) {
Log.e(TAG, "Zygote: error closing sockets", ex);
} catch (ErrnoException ex) {
Log.e(TAG, "Zygote: error closing descriptor", ex);
}
mServerSocket = null;
}
//轮训等待处理来自套接字的命令消息 这里其实就是等待AMS的请求
void runSelectLoop(String abiList) throws Zygote.MethodAndArgsCaller {
ArrayList<FileDescriptor> fds = new ArrayList<FileDescriptor>();
ArrayList<ZygoteConnection> peers = new ArrayList<ZygoteConnection>();
//获取该Socket的fd字段并添加到列表fds
fds.add(mServerSocket.getFileDescriptor());
peers.add(null);
//无限循环等待AMS请求
while (true) {
StructPollfd[] pollFds = new StructPollfd[fds.size()];
//遍历将fds村粗的信息转移到pollFds数组中
for (int i = 0; i < pollFds.length; ++i) {
pollFds[i] = new StructPollfd();
pollFds[i].fd = fds.get(i);
pollFds[i].events = (short) POLLIN;
}
try {
Os.poll(pollFds, -1);
} catch (ErrnoException ex) {
throw new RuntimeException("poll failed", ex);
}
for (int i = pollFds.length - 1; i >= 0; --i) {
if ((pollFds[i].revents & POLLIN) == 0) continue;
if (i == 0) {
//当前Zygote进程与AMS建立了连接
ZygoteConnection newPeer = acceptCommandPeer(abiList);
peers.add(newPeer);
fds.add(newPeer.getFileDesciptor());
} else {
//AMS向Zygote进程发送了一个创建应用进程的请求
boolean done = peers.get(i).runOnce(this);//创建应用进程
if (done) {
peers.remove(i);
fds.remove(i);
}
}
}
}
}
}5）、总结：
init进程解析init.rc配置文件中的Service语句，fork出了Zygote进程后并执行了app_main.cpp文件中的main方法，之后主要做了如下几件事：
- 在app_main.cpp文件的main方法中创建AppRuntime并调用start方法
- 在AppRuntime的start方法中创建了Java虚拟机并为虚拟机注册JNI方法
- AppRuntime在start方法中找到了ZygoteInit这个类，并通过JNI方式调用了ZygoteInit的main函数，进入了Java框架层
- ZygoteInit实例化了ZygoteServer服务端，并通过registerServerSocket方法创建服务端Socket，通过runSelectLoop方法等待AMS的请求来创建新的应用程序进程
- 启动SystemServer进程
3、SystemServer进程
SystemServer进程主要用于创建系统服务，我们熟知的AMS、WMS、PMS都是由它创建的。
1）、如何启动SystemServer进程
通过分析Zygote进程，我们知道ZygoteInit的main方法调用了startSystemServer方法，其中fork出了SystemServer进程。因为fork创建子进程，子进程会复制父进程的地址空间，因此SystemServer也会得到Zygote进程的套接字，所以通过判断pid来区别当前进程是否是子进程，因为SystemServer进程用不到这个套接字，所以调用了closeServerSocket关闭该套接字，接着调用了handleSystemServerProcess方法来启动SystemServer。
//frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
public class ZygoteInit {
//为系统服务进程SystemServer准备参数
private static boolean startSystemServer(String abiList, String socketName, ZygoteServer zygoteServer)throws Zygote.MethodAndArgsCaller, RuntimeException {
//...省略代码...
try {
//将args数组封装成Arguments对象，以便启动进程的时候调用
parsedArgs = new ZygoteConnection.Arguments(args);
ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);
//创建子进程SystemServer，其内部调用nativeForkSystemServer方法，最终fork子进程
pid = Zygote.forkSystemServer(
parsedArgs.uid, parsedArgs.gid,
parsedArgs.gids,
parsedArgs.debugFlags,
null,
parsedArgs.permittedCapabilities,
parsedArgs.effectiveCapabilities);
} catch (IllegalArgumentException ex) {
throw new RuntimeException(ex);
}
//判断当前进程为子进程
if (pid == 0) {
if (hasSecondZygote(abiList)) {
waitForSecondaryZygote(socketName);
}
//子进程关闭Server套接字，子进程不需要处理zygote套接字相关的命令
zygoteServer.closeServerSocket();
//进程处理SystemServer
handleSystemServerProcess(parsedArgs);
}
return true;
}
//完成系统服务进程SystemServer的剩余工作
private static void handleSystemServerProcess( ZygoteConnection.Arguments parsedArgs) throws Zygote.MethodAndArgsCaller {
final String systemServerClasspath = Os.getenv("SYSTEMSERVERCLASSPATH");
if (systemServerClasspath != null) {
//...省略代码...
}
if (parsedArgs.invokeWith != null) {
//...省略代码...
} else {
//创建了PathClassLoader类加载器
ClassLoader cl = null;
if (systemServerClasspath != null) {
cl = createPathClassLoader(systemServerClasspath,parsedArgs.targetSdkVersion);
Thread.currentThread().setContextClassLoader(cl);
}
//调用了zygoteInit方法，并将PathClassLoader传递进去
ZygoteInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs, cl);
}
}
public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader) throws Zygote.MethodAndArgsCaller {
if (RuntimeInit.DEBUG) Slog.d(RuntimeInit.TAG, "RuntimeInit: Starting application from zygote");
Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ZygoteInit");
RuntimeInit.redirectLogStreams();
RuntimeInit.commonInit();
//启动Binder线程池
ZygoteInit.nativeZygoteInit();
//进入SystemServer的主方法
RuntimeInit.applicationInit(targetSdkVersion, argv, classLoader);
}
private static final native void nativeZygoteInit();
//...省略代码...
}由上面源码可以知道，在handleSystemServerProcess方法中，创建了系统级的类加载器PathClassLoader，并调用了zygoteInit方法，最后主要做了两件事情，启动Binder线程池和进入SystemServer的主方法里面。
2）、启动Binder线程池
SystemServer进程在ZygoteInit.java文件里面通过调用nativeZygoteInit方法启动Binder线程池，该方法是一个native方法，我们需要先了解它对应的JNI文件，内容如下：
//frameworks/base/core/jni/AndroidRuntime.cpp
int register_com_android_internal_os_ZygoteInit(JNIEnv* env)
{
const JNINativeMethod methods[] = {
{ "nativeZygoteInit", "()V",
(void*) com_android_internal_os_ZygoteInit_nativeZygoteInit },
};
//实际上还是调用了com_android_internal_os_ZygoteInit_nativeZygoteInit方法
return jniRegisterNativeMethods(env, "com/android/internal/os/ZygoteInit", methods, NELEM(methods));
}
static void com_android_internal_os_ZygoteInit_nativeZygoteInit(JNIEnv* env, jobject clazz)
{
gCurRuntime->onZygoteInit();
}
//gCurRuntime就是一个AndroidRuntime指针
static AndroidRuntime* gCurRuntime = NULL;
//AndroidRuntime的构造函数
AndroidRuntime::AndroidRuntime(char* argBlockStart, const size_t argBlockLength) :
mExitWithoutCleanup(false),
mArgBlockStart(argBlockStart),
mArgBlockLength(argBlockLength){
SkGraphics::Init();
mOptions.setCapacity(20);
assert(gCurRuntime == NULL);
gCurRuntime = this; //构造函数发现，原来gCurRuntime指向自己
}
AndroidRuntime::~AndroidRuntime(){
SkGraphics::Term();
}最后可以发现nativeZygoteInit方法最后还是调用了gCurRuntime->onZygoteInit()，其中gCurRuntime是AndroidRuntime类型的指针，具体指向的是AndroidRuntime的子类AppRuntime，它在app_main.cpp文件中定义，代码如下：
//frameworks/base/cmds/app_process/app_main.cpp
class AppRuntime : public AndroidRuntime
{
public:
AppRuntime(char* argBlockStart, const size_t argBlockLength) : AndroidRuntime(argBlockStart, argBlockLength) , mClass(NULL){
}
virtual void onZygoteInit(){
sp<ProcessState> proc = ProcessState::self();
ALOGV("App process: starting thread pool.\n");
proc->startThreadPool(); //启动Binder线程池
}
}3）、启动SystemServer的主方法
我们已经知道了Zygote进程的main方法中调用了startSystemServer方法fork出了SystemServer进程，并通过两次方法的调用（handleSystemServerProcess/zygoteInit），先启动了Binder线程池，然后调用RuntimeInit.applicationInit方法隐式进入SystemServer的主方法，我们来看看RuntimeInit源码是如何进去的呢：
//frameworks/base/core/java/com/android/internal/os/RuntimeInit.java
public class RuntimeInit {
protected static void applicationInit(int targetSdkVersion, String[] argv, ClassLoader classLoader) throws Zygote.MethodAndArgsCaller {
nativeSetExitWithoutCleanup(true);
VMRuntime.getRuntime().setTargetHeapUtilization(0.75f);
VMRuntime.getRuntime().setTargetSdkVersion(targetSdkVersion);
final Arguments args;
args = new Arguments(argv);
Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
//最后还是调用了invokeStaticMain方法
invokeStaticMain(args.startClass, args.startArgs, classLoader);
}
private static void invokeStaticMain(String className, String[] argv, ClassLoader classLoader) throws Zygote.MethodAndArgsCaller {
//通过反射得到SystmeServer类 这里的className为com.android.server.SystemServer
Class<?> cl;
try {
cl = Class.forName(className, true, classLoader);
} catch (ClassNotFoundException ex) {
throw new RuntimeException( "Missing class when invoking static main " + className, ex);
}
//通过反射得到SystemServer的main方法
Method m;
try {
m = cl.getMethod("main", new Class[] { String[].class });
} catch (NoSuchMethodException ex) {
throw new RuntimeException( "Missing static main on " + className, ex);
} catch (SecurityException ex) {
throw new RuntimeException( "Problem getting static main on " + className, ex);
}
int modifiers = m.getModifiers();
if (! (Modifier.isStatic(modifiers) && Modifier.isPublic(modifiers))) { throw new RuntimeException( "Main method is not public and static on " + className);
}
//抛出MethodAndArgsCaller异常，并将SystemServer的main方法和其他参数传递了进去
throw new Zygote.MethodAndArgsCaller(m, argv);
}
}通过上面代码知道，RuntimeInit.applicationInit方法里面，先是通过反射找到SystemServer这个类的main方法，最后抛出了Zygote.MethodAndArgsCaller异常。其实在ZygoteInit.java的main方法中是捕获了该异常，并得到SystemServer的main方法直接调用以进入系统服务进程的主方法。为何不直接在invokeStaticMain方法直接调用SystemServer的main方法呢，是因为这种抛出异常的处理会清除所有的设置过程需要的堆栈帧，并让SystemServer的main方法看起来像是SystemServer进程的入口方法（在Zygote启动了SystemServer进程后，系统服务端进程其实做了很多准备工作，但是这些工作都是在SystemServer的main方法调用之前做的）。
//frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
public class ZygoteInit {
public static void main(String argv[]) {
//...省略代码...
try {
//第一步：注册套接字
//第二步：预加载类和资源
//第三步：启动SystemServer进程
if (startSystemServer) {
startSystemServer(abiList, socketName, zygoteServer);
}
//第四步：等待ams的一些命令
} catch (Zygote.MethodAndArgsCaller caller) {
//其实这里才是真正的调用SyetemServer的主方法
caller.run(); //内部通过反射的方式调用了SystemServer类的main方法
} catch (Throwable ex) {
zygoteServer.closeServerSocket();
throw ex;
}
}
}4）、解析SystemServer进程
SystemServer进程被启动后，经过了很多准备工作，最后通过捕获异常和反射的方式进入到了SystemServer的main方法，其源码如下：
//frameworks/base/services/java/com/android/server/SystemServer.java
public final class SystemServer {
//通过静态方法main进行实例化对象，并调用了run方法
public static void main(String[] args) {
new SystemServer().run();
}
public SystemServer() {
mFactoryTestMode = FactoryTest.getMode();
mRuntimeRestart = "1".equals(SystemProperties.get("sys.boot_completed"));
}
private void run() {
try {
//...省略代码...
//创建主线程消息轮训器Looper
android.os.Process.setThreadPriority(android.os.Process.THREAD_PRIORITY_FOREGROUND);
android.os.Process.setCanSelfBackground(false);
Looper.prepareMainLooper();
//加载了动态库libandroid_servers.so
System.loadLibrary("android_servers");
// Check whether we failed to shut down last time we tried.
performPendingShutdown();
//创建系统的Context
createSystemContext();
//创建系统服务管理器
mSystemServiceManager = new SystemServiceManager(mSystemContext);
mSystemServiceManager.setRuntimeRestarted(mRuntimeRestart);
LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
SystemServerInitThreadPool.get();
} finally {
traceEnd(); // InitBeforeStartServices
}
//启动一些Service
try {
traceBeginAndSlog("StartServices");
//启动引导服务
startBootstrapServices();
//启动核心服务
startCoreServices();
//启动其他服务
startOtherServices();
SystemServerInitThreadPool.shutdown();
} catch (Throwable ex) {
throw ex;
} finally {
traceEnd();
}
//轮询器开始轮询
Looper.loop();
throw new RuntimeException("Main thread loop unexpectedly exited");
}
}由上面源码可以知道，在SystemServer的主方法中，先创建了消息轮训器Looper.prepareMainLooper，再加载了动态库libandroid_servers.so，接下来实例化了SystemServiceManager（它会对系统服务进行创建、启动和生命周期管理）。之后依次启动了所有的系统服务，这些服务的父类均为SystemService，官方将这些服务分成了三大类：
这些系统服务启动逻辑都是相似的，通过SystemServer通过调用SystemServiceManager.startService方法启动不同的服务：
//framewoeks/base/services/core/java/com/android/server/SystemServiceManager.java
public class SystemServiceManager {
private final ArrayList<SystemService> mServices = new ArrayList<SystemService>();
public void startService(@NonNull final SystemService service) {
//注册服务 将服务添加到列表里面
mServices.add(service);
long time = System.currentTimeMillis();
try {
service.onStart(); //回调服务的生命周期方法
} catch (RuntimeException ex) {
throw new RuntimeException("Failed to start service " + service.getClass().getName()+ ": onStart threw an exception", ex);
}
warnIfTooLong(System.currentTimeMillis() - time, service, "onStart");
}
}除此之外还可以直接调用该服务的main方法，例如PackageManagerService：
//frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java
public static PackageManagerService main(Context context, Installer installer, boolean factoryTest, boolean onlyCore) {
PackageManagerServiceCompilerMapping.checkProperties();
PackageManagerService m = new PackageManagerService(context, installer,factoryTest, onlyCore);
m.enableSystemUserPackages();
ServiceManager.addService("package", m);//注册服务
return m;
}根据上面两种启动Service的方式，可以发现都通过了ServiceManager这个类，添加到它维护的一个列表中进行注册，ServiceManager用来管理系统中的各种Service，用于系统C/S架构中的Binder通信：如果某个客户端进程需要使用到某个Service，则需要先到ServiceManager查询Service的相关信息，然后根据Service的相关信息与Service所在的Service进程建立通信通路，这样客户端进程就可以使用Service了。
5）、总结：
SystemServer系统服务进程是在ZygoteInit进程的main方法调用了startSystemServer方法进行了fork创建的新进程，之后主要做了如下几件事：
- 先调用handleSystemServerProcess方法中，创建了PathClassLoader
- 在调用zygoteInit方法中，启动了Binder线程池，以便后面能够进行进程之间的通信
- 在zygoteInit方法中，通过调用RuntimeInit类的invokeStaticMain方法中，通过反射抛出异常的方式让程序跳转到SystemServer的main方法中执行
- 在SystemServer的main方法中，进行一些初始化后，创建了SystemServiceManager类，并通过它启动了所有的Service
4、Launcher进程
系统启动的最后一步就是启动一个应用程序来显示系统中已经安装的应用程序，这个应用程序叫做Launcher。Launcher在启动过程中会请求PackageManagerService返回系统中已经安装的应用程序的信息，并将这些信息封装成一个快捷图标列表显示在系统屏幕上，这样用户可以通过点击这些快捷图标来启动相应的应用程序。通俗的来将Launcher就是Android系统的桌面程序。
1）、Launcher启动流程
SystemServer进程在启动的过程中会启动PackageManagerService，PackageManagerService启动后会将系统中的应用程序安装完成。再此已经启动的AMS会将Launcher启动起来。其时序图如下：
启动Launcher的入口为AMS的systemReady方法，它在SystemServer的startOtherService中被调用，我们来看看源码：
//frameworks/base/services/java/com/android/server/SystemServer.java
public final class SystemServer {
private ActivityManagerService mActivityManagerService;
//...省略代码...
private void startOtherServices() {
//...省略代码...
mActivityManagerService.systemReady(() -> {//ActivityManagerService的systemReady方法
//...省略代码...
}, BOOT_TIMINGS_TRACE_LOG);
}
}//frameworks/base/service/core/java/com/android/server/am/ActivityManagerService.java
public class ActivityManagerService extends IActivityManager.Stub implements Watchdog.Monitor, BatteryStatsImpl.BatteryCallback {
//...省略代码...
public void systemReady(final Runnable goingCallback, BootTimingsTraceLog traceLog) {
//...省略代码...
mStackSupervisor.resumeFocusedStackTopActivityLocked();
mUserController.sendUserSwitchBroadcastsLocked(-1, currentUserId);
traceLog.traceEnd(); // ActivityManagerStartApps
traceLog.traceEnd(); // PhaseActivityManagerReady
}
//创建Launcher的Intent
Intent getHomeIntent() {
Intent intent = new Intent(mTopAction, mTopData != null ? Uri.parse(mTopData) : null);
intent.setComponent(mTopComponent);
intent.addFlags(Intent.FLAG_DEBUG_TRIAGED_MISSING);
if (mFactoryTest != FactoryTest.FACTORY_TEST_LOW_LEVEL) intent.addCategory(Intent.CATEGORY_HOME);
return intent;
}
boolean startHomeActivityLocked(int userId, String reason) {
if (mFactoryTest == FactoryTest.FACTORY_TEST_LOW_LEVEL && mTopAction == null) {
return false; //系统运行模式为低工厂模式且mTopAction 为null直接返回
}
//获取Launcher的Intent
Intent intent = getHomeIntent();
ActivityInfo aInfo = resolveActivityInfo(intent, STOCK_PM_FLAGS, userId);
if (aInfo != null) {
intent.setComponent(new ComponentName(aInfo.applicationInfo.packageName,aInfo.name));
aInfo = new ActivityInfo(aInfo);
aInfo.applicationInfo = getAppInfoForUser(aInfo.applicationInfo, userId);
ProcessRecord app = getProcessRecordLocked(aInfo.processName, aInfo.applicationInfo.uid, true);
//判断是否启用了该应用
if (app == null || app.instr == null) {
intent.setFlags(intent.getFlags() | Intent.FLAG_ACTIVITY_NEW_TASK);
final int resolvedUserId = UserHandle.getUserId(aInfo.applicationInfo.uid);
final String myReason = reason + ":" + userId + ":" + resolvedUserId;
//启动Launcher程序
mActivityStarter.startHomeActivityLocked(intent, aInfo, myReason);
}
} else {
Slog.wtf(TAG, "No home screen found for " + intent, new Throwable());
}
return true;
}
}在systemReady方法中调用了resumeFocusedStackTopActivityLocked方法，经过层层调用，最后还是调用了startHomeActivityLocked方法，在该方法中，先创建了Launcher应用的Intent，并传入了mTopAction和mTopData，最后判断是否启动了该应用，没有则调用了startHomeActivityLocked方法启动了Launcher应用，Launcher应用的配置文件如下：
//packages/apps/Launcher3/AndroidManifest.xml
<manifest
xmlns:android="http://schemas.android.com/apk/res/android"
package="com.android.launcher3">
<uses-sdk android:targetSdkVersion="23" android:minSdkVersion="21"/>
<permission
android:name="com.android.launcher3.permission.READ_SETTINGS"
android:permissionGroup="android.permission-group.SYSTEM_TOOLS"
android:protectionLevel="normal"
android:label="@string/permlab_read_settings"
android:description="@string/permdesc_read_settings"/>
<permission
android:name="com.android.launcher3.permission.WRITE_SETTINGS"
android:permissionGroup="android.permission-group.SYSTEM_TOOLS"
android:protectionLevel="signatureOrSystem"
android:label="@string/permlab_write_settings"
android:description="@string/permdesc_write_settings"/>
<uses-permission android:name="com.android.launcher.permission.READ_SETTINGS" />
<uses-permission android:name="com.android.launcher.permission.WRITE_SETTINGS" />
<uses-permission android:name="com.android.launcher3.permission.READ_SETTINGS" />
<uses-permission android:name="com.android.launcher3.permission.WRITE_SETTINGS" />
<application
android:backupAgent="com.android.launcher3.LauncherBackupAgent"
android:fullBackupOnly="true"
android:fullBackupContent="@xml/backupscheme"
android:hardwareAccelerated="true"
android:icon="@drawable/ic_launcher_home"
android:label="@string/derived_app_name"
android:theme="@style/LauncherTheme"
android:largeHeap="@bool/config_largeHeap"
android:restoreAnyVersion="true"
android:supportsRtl="true" >
<activity
android:name="com.android.launcher3.Launcher"
android:launchMode="singleTask"
android:clearTaskOnLaunch="true"
android:stateNotNeeded="true"
android:windowSoftInputMode="adjustPan|stateUnchanged"
android:screenOrientation="nosensor"
android:configChanges="keyboard|keyboardHidden|navigation"
android:resizeableActivity="true"
android:resumeWhilePausing="true"
android:taskAffinity=""
android:enabled="true">
<intent-filter>
<action android:name="android.intent.action.MAIN" />
<category android:name="android.intent.category.HOME" />
<category android:name="android.intent.category.DEFAULT" />
<category android:name="android.intent.category.MONKEY"/>
</intent-filter>
</activity>
<activity
android:name="com.android.launcher3.SettingsActivity"
android:label="@string/settings_button_text"
android:theme="@android:style/Theme.DeviceDefault.Settings"
android:autoRemoveFromRecents="true">
<intent-filter>
<action android:name="android.intent.action.APPLICATION_PREFERENCES" />
<category android:name="android.intent.category.DEFAULT" />
</intent-filter>
</activity>
<provider
android:name="com.android.launcher3.LauncherProvider"
android:authorities="com.android.launcher3.settings"
android:exported="true"
android:writePermission="com.android.launcher3.permission.WRITE_SETTINGS"
android:readPermission="com.android.launcher3.permission.READ_SETTINGS" />
</application>
</manifest>
可以发现Launcher的intent-filter设置了android.intent.category.HOME属性，这样该Activity就成为了主Activity，从前面的AMS的startHomeActivityLocked方法中知道，如果Launcher没有启动就会调用ActivityStarter的StartHomeActivityLocked方法来启动Launcher。
2)、启动Launcher的主Activity
在分析Launcher的启动流程的时候，我们知道最后AMS通过ActivityStarter来启动了Launcher的主activity，即安卓系统的桌面Activity。ActivityStarter封装了一个activity启动的过程（包括上下文环境)，其实无论是Launcher的主Activity或者是普通app的Activity，不论是那种启动方式都是通过ActivityStarter进行启动的，其源码如下：
//frameworks/base/services/core/java/com/android/server/am/ActivityStarter.java
class ActivityStarter {
private final ActivityManagerService mService;
private final ActivityStackSupervisor mSupervisor;
private ActivityStartInterceptor mInterceptor;
private WindowManagerService mWindowManager;
//构造方法中传入了AMS
ActivityStarter(ActivityManagerService service, ActivityStackSupervisor supervisor) {
mService = service;
mSupervisor = supervisor;
mInterceptor = new ActivityStartInterceptor(mService, mSupervisor);
mUsingVr2dDisplay = false;
}
//Launcher在启动的最后过程调用了该方法
void startHomeActivityLocked(Intent intent, ActivityInfo aInfo, String reason) {
//将Launcher的主Activity放入HomStack中
mSupervisor.moveHomeStackTaskToTop(reason);
//启动Launcher的主Activity
mLastHomeActivityStartResult = startActivityLocked(null /*caller*/, intent,
null /*ephemeralIntent*/, null /*resolvedType*/, aInfo, null /*rInfo*/,
null /*voiceSession*/, null /*voiceInteractor*/, null /*resultTo*/,
null /*resultWho*/, 0 /*requestCode*/, 0 /*callingPid*/, 0/*callingUid*/,
null /*callingPackage*/, 0 /*realCallingPid*/, 0 /*realCallingUid*/,
0 /*startFlags*/, null /*options*/, false /*ignoreTargetSecurity*/,
false /*componentSpecified*/, mLastHomeActivityStartRecord/*outActivity*/,
null /*container*/, null /*inTask*/, "startHomeActivity: " + reason);
if (mSupervisor.inResumeTopActivity) {
//如果Launcher的主Activity不在栈顶就恢复成栈顶
mSupervisor.scheduleResumeTopActivities();
}
}
//启动一个Activity
int startActivityLocked(IApplicationThread caller, Intent intent, Intent ephemeralIntent,/**参数省略**/) {
if (TextUtils.isEmpty(reason)) throw new IllegalArgumentException("Need to specify a reason.");
mLastStartReason = reason;
mLastStartActivityTimeMs = System.currentTimeMillis();
mLastStartActivityRecord[0] = null;
//启动一个Activity
mLastStartActivityResult = startActivity(/*参数省略**/);
if (outActivity != null) outActivity[0] = mLastStartActivityRecord[0];
return mLastStartActivityResult;
}
}ActivityStarter在调用StartHomeActivityLocked方法来启动Launcher的主Activity的时候，首先通过mSupervisor.moveHomeStackTaskToTop(reason)方法将器放入HomeStack，接着调用startActivityLocked方法启动Activity，这里其实跟普通启动一个Activity流程一样，最后判断Launcher的Activity是否在栈顶，否则将其恢复到栈顶。
3）、显示应用图标
Launcher进程最后启动了主Activity，由上面可以知道这个主Activity的名字也叫Launcher，该Activity作为桌面会显示所有已经安装的应用程序图标，这些应用程序图标是用户进入应用程序的入口，因此我们有必要来了解Launcher是如何显示应用程序图标的。Launcher的源码如下：
//packages/apps/Launcher3/src/com/android/launcher3/Launcher.java
public class Launcher extends BaseActivity implements LauncherExterns, View.OnClickListener, OnLongClickListener, LauncherModel.Callbacks, View.OnTouchListener, LauncherProviderChangeListener, AccessibilityManager.AccessibilityStateChangeListener {
@Override
protected void onCreate(Bundle savedInstanceState) {
if (LauncherAppState.PROFILE_STARTUP)Trace.beginSection("Launcher-onCreate");
if (mLauncherCallbacks != null) mLauncherCallbacks.preOnCreate();
super.onCreate(savedInstanceState);
//获取LauncherAppState的实例
LauncherAppState app = LauncherAppState.getInstance(this);
mDeviceProfile = app.getInvariantDeviceProfile().getDeviceProfile(this);
//...省略代码...
mSharedPrefs = Utilities.getPrefs(this);
mIsSafeModeEnabled = getPackageManager().isSafeMode();
//将上面获取的LauncherAppState的实例 并设置近LauncherModel里面
//其实最后是LauncherModel回调了该类的bindAllApplications方法来进行更新桌面所有的应用图标
mModel = app.setLauncher(this);
mModelWriter = mModel.getWriter(mDeviceProfile.isVerticalBarLayout());
mIconCache = app.getIconCache();
mAccessibilityDelegate = new LauncherAccessibilityDelegate(this);
//...省略代码...
//通过LauncherMoldel的startLoader方法进行加载桌面应用图标
if (!mRestoring) {
if (DISABLE_SYNCHRONOUS_BINDING_CURRENT_PAGE)
mModel.startLoader(PagedView.INVALID_RESTORE_PAGE);
else
mModel.startLoader(mWorkspace.getRestorePage());
}
}
}//packages/apps/Launcher3/src/com/android/launcher3/LauncherModel.java
public class LauncherModel extends BroadcastReceiver implements LauncherAppsCompat.OnAppsChangedCallbackCompat {
//创建了具有消息循环的线程HandlerThread对象
@Thunk static final HandlerThread sWorkerThread = new HandlerThread("launcher-loader");
static {
sWorkerThread.start();
}
@Thunk static final Handler sWorker = new Handler(sWorkerThread.getLooper());
//构造方法 初始化了所有的app的图标和信息
LauncherModel(LauncherAppState app, IconCache iconCache, AppFilter appFilter) {
Context context = app.getContext();
mApp = app;
mBgAllAppsList = new AllAppsList(iconCache, appFilter);
mBgWidgetsModel = new WidgetsModel(iconCache, appFilter);
mIconCache = iconCache;
mLauncherApps = LauncherAppsCompat.getInstance(context);
mUserManager = UserManagerCompat.getInstance(context);
}
//开始加载 所有应用
public boolean startLoader(int synchronousBindPage) {
InstallShortcutReceiver.enableInstallQueue();
synchronized (mLock) {
if (mCallbacks != null && mCallbacks.get() != null) {
final Callbacks oldCallbacks = mCallbacks.get();
runOnMainThread(new Runnable() {/*省略代码*/});
stopLoaderLocked();
//创建LoaderTask加载桌面应用的任务
mLoaderTask = new LoaderTask(mApp.getContext(), synchronousBindPage);
if (synchronousBindPage != PagedView.INVALID_RESTORE_PAGE && mModelLoaded && !mIsLoaderTaskRunning) {
mLoaderTask.runBindSynchronousPage(synchronousBindPage);
return true;
} else {
sWorkerThread.setPriority(Thread.NORM_PRIORITY);
//将LoaderTask任务作为消息发送到HandlerThread里面进行处理
sWorker.post(mLoaderTask);
}
}
}
return false;
}
public void stopLoader() {
synchronized (mLock) {
if (mLoaderTask != null) mLoaderTask.stopLocked();
}
}
//加载应用到工作区（指的手机或平板桌面）
private class LoaderTask implements Runnable {
public void run() {
synchronized (mLock) {
if (mStopped) return;
mIsLoaderTaskRunning = true;
}
try {
//加载工作区信息
mIsLoadingAndBindingWorkspace = true;
loadWorkspace();
//绑定工作区信息
verifyNotStopped();
bindWorkspace(mPageToBindFirst);
waitForIdle();
verifyNotStopped();
//加载系统已经安装的应用程序信息
loadAllApps();
//...省略代码...
} catch (CancellationException e) {
} finally {
mContext = null;
synchronized (mLock) {
if (mLoaderTask == this) mLoaderTask = null;
mIsLoaderTaskRunning = false;
}
}
}
}
private void loadAllApps() {
//...省略代码...
mHandler.post(new Runnable() {
public void run() {
final long bindTime = SystemClock.uptimeMillis();
final Callbacks callbacks = tryGetCallbacks(oldCallbacks);
if (callbacks != null)
callbacks.bindAllApplications(added);
else
Log.i(TAG, "not binding apps: no Launcher activity");
}
});
//...省略代码...
}
}由上可以知道Launcher还是通过LauncherModel来加载应用图标，在Launcher的onCreate方法中通过app.setLauncher(this)方法将自己设置到LauncherModel中，最后调用了LauncherModel的startLoader方法，该方法中将LoaderTask的任务消息传递到了该HandlerThread的循环中并执行，LoaderTask的任务最终回调了Launcher的bindAllApplications方法来实现加载更新所有的应用程序图标，我们再来看看Launcher的该方法：
//packages/apps/Launcher3/src/com/android/launcher3/Launcher.java
public class Launcher extends BaseActivity implements LauncherModel.Callbacks /*省略代码*/ {
public void bindAllApplications(final ArrayList<AppInfo> apps) {
if (waitUntilResume(mBindAllApplicationsRunnable, true)) {
mTmpAppsList = apps;
return;
}
//将app列表传递到AllAppsContainerView类里面并进行更新
if (mAppsView != null) {
mAppsView.setApps(apps);
}
if (mLauncherCallbacks != null) {
mLauncherCallbacks.bindAllApplications(apps);
}
}
}
//packages/apps/Launcher3/src/com/android/launcher3/allapps/AllAppsContainerView.java
public class AllAppsContainerView extends BaseContainerView implements DragSource, View.OnLongClickListener, AllAppsSearchBarController.Callbacks, Insettable {
private final Launcher mLauncher;
private final AlphabeticalAppsList mApps; //所有APP的数据源
private final AllAppsGridAdapter mAdapter; //所有APP的适配器
private final RecyclerView.LayoutManager mLayoutManager;
private AllAppsRecyclerView mAppsRecyclerView;
private AllAppsSearchBarController mSearchBarController;
//初始化桌面应用图标View
public AllAppsContainerView(Context context, AttributeSet attrs, int defStyleAttr) {
super(context, attrs, defStyleAttr);
mLauncher = Launcher.getLauncher(context);
mApps = new AlphabeticalAppsList(context);
mAdapter = new AllAppsGridAdapter(mLauncher, mApps, mLauncher, this);
mApps.setAdapter(mAdapter);
mLayoutManager = mAdapter.getLayoutManager();
mSearchQueryBuilder = new SpannableStringBuilder();
mSearchContainerMinHeight = getResources().getDimensionPixelSize(R.dimen.all_apps_search_bar_height);
Selection.setSelection(mSearchQueryBuilder, 0);
}
//设置数据源
public void setApps(List<AppInfo> apps) {
mApps.setApps(apps);
}
//布局文件xml加载完的时候触发调用
@Override
protected void onFinishInflate() {
super.onFinishInflate();
//...省略代码...
mSearchContainer = findViewById(R.id.search_container);
mSearchInput = (ExtendedEditText) findViewById(R.id.search_box_input);
SpannableString spanned = new SpannableString(" " + mSearchInput.getHint());
spanned.setSpan(new TintedDrawableSpan(getContext(), R.drawable.ic_allapps_search), 0, 1, Spannable.SPAN_EXCLUSIVE_INCLUSIVE);
mSearchInput.setHint(spanned);
mElevationController = new HeaderElevationController(mSearchContainer);
//在RecyclerView中加载所有的app
mAppsRecyclerView = (AllAppsRecyclerView) findViewById(R.id.apps_list_view);
mAppsRecyclerView.setApps(mApps);
mAppsRecyclerView.setLayoutManager(mLayoutManager);
mAppsRecyclerView.setAdapter(mAdapter);
mAppsRecyclerView.setHasFixedSize(true);
mAppsRecyclerView.addOnScrollListener(mElevationController);
mAppsRecyclerView.setElevationController(mElevationController);
FocusedItemDecorator focusedItemDecorator = new FocusedItemDecorator(mAppsRecyclerView);
mAppsRecyclerView.addItemDecoration(focusedItemDecorator);
mAppsRecyclerView.preMeasureViews(mAdapter);
mAdapter.setIconFocusListener(focusedItemDecorator.getFocusListener());
if (FeatureFlags.LAUNCHER3_ALL_APPS_PULL_UP) {
getRevealView().setVisibility(View.VISIBLE);
getContentView().setVisibility(View.VISIBLE);
getContentView().setBackground(null);
}
}
}由上代码，我们可以很清晰的看出，Launcher的bindAllApplications方法中把已安装的应用列表设置到了AllAppsContainerView这个控件，该控件内部封装了一个RecyclerView并显示了应用列表的快捷图标，这就是我们看到的手机系统桌面。
4）、总结：
Launcher进程作为Android系统的启动器，用于启动应用程序，作为Android系统的桌面，用于显示和管理应用程序的快捷图标或者其他桌面组件。
- SystemServer进程启动AMS进程，在SystemServer中调用了AMS的systemReady方法，从此开启了Launcher的启动之路
- AMS的systemReady方法中经过层层调用（经过resumeFocusedStackTopActivityLocked----> ActivityStackSupervisor.resumeTopActivityUncheckedLocked---->ActivityStack.resumeTopActivityInnerLocked---->ActivityStackSupervisor.resumeHomeStackTask），最终调用了AMS的startHomeActivityLocked方法
- AMS的startHomeActivityLocked方法获取了Launcher进程的Intent，并根据AndroidManifest.xml文件设置参数，通过ActivcityStarter类进行启动主Activity
- Launcher（该进程的主Activity）的onCreate方法通过LauncherModel类回调了Launcher的bindAllApplications方法
- Launcher的bindAllApplications方法对AllAppsContainerView控件设置数据源apps
- AllAppsContainerView加载完xml后调用onFinishInflate方法，对AllAppsRecyclerView设置数据源并显示
5、Android系统启动流程
我们可以清晰的总结出Android系统启动流程，这个流程主要有以下几个部分：
- 启动电源以及系统启动：当电源按下时引导芯片代码从预定义的地方（固化在ROM）开始执行，加载引导程序BootLoader到RAM，然后执行
- 引导程序BootLoader：引导程序是在Android操作系统开始运行前的一个小程序，它的主要作用是把系统OS拉起来并运行
- Linux内核启动：当内核启动时，设置缓存、被保护存储器、计划列表、加载驱动。党内核完成系统设置时，它首先在系统文件中寻找init.rc文件，并启动init进程
- init进程启动：初始化和启动属性服务，并启动Zygote进程
- Zygote进程启动：创建Java虚拟机病危Java虚拟机注册JNI方法，创建服务端Socket，启动SystemServer进程
- SystemServer进程启动：启动Binder线程池和SystemServiceManager，并且启动各种系统服务
- Launcher进程启动：被SystemServer进程启动的AMS会启动Launcher进程，Launcher启动后会将已经安装应用的快捷图标显示到界面上
二、应用程序进程启动过程
Android系统启动后，我们比较关心应用程序是如何启动的，启动一个应用程序首先要保证该应用程序的进程以及被启动了。AMS在启动应用程序时会检查这个应用程序需要的应用程序进程是否存在，不存在就会请求Zygote进程启动需要的应用程序进程。我们知道Zygote的Java框架层中会创建一个Server端的Socket，这个Socket其实就是用来等待AMS请求Zygote来创建新的应用程序进程，Zygote进程通过fock自身创建应用程序进程，这样应用程序进程就会获得Zygote进程在启动时创建的虚拟机实例。当然在应用程序进程创建过程中出了获取虚拟机实例外还创建了Binder线程池和消息循环，这样运行在应用程序中的应用就可以方便的使用Binder进行进程间通信和消息处理。应用程序进程创建过程中主要分为下面步骤：
- AMS发送启动应用程序进程请求
- Zygote接收请求并创建应用程序进程
- 应用程序进程启动Binder线程池
- 应用程序进程开启消息循环
1、应用程序进程的启动入口：
启动一个应用程序（理解为启动一个应用程序的根Activity），都是从Launcher向AMS请求启动该应用程序的根Activity，在AMS中将这件事情交给了ActivityStarter来处理，ActivityStarter经过层层调用，最后在ActivityStackSupervisor类的startSpecificActivityLocked方法中判断该应用程序所在的进程是否被启动，没有被启动则会调用AMS的startProcessLocked来创建该应用程序进程，源码如下：
//framworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
public class ActivityManagerService extends IActivityManager.Stub implements Watchdog.Monitor, BatteryStatsImpl.BatteryCallback {
@Override
public final int startActivity(IApplicationThread caller, String callingPackage, Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo, Bundle bOptions) {
//调用了startActivityAsUser方法
return startActivityAsUser(caller, callingPackage, intent, resolvedType, resultTo, resultWho, requestCode, startFlags, profilerInfo, bOptions, UserHandle.getCallingUserId());
}
@Override
public final int startActivityAsUser(IApplicationThread caller, String callingPackage, Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId) {
enforceNotIsolatedCaller("startActivity");
userId = mUserController.handleIncomingUser(Binder.getCallingPid(), Binder.getCallingUid(), userId, false, ALLOW_FULL_ONLY, "startActivity", null);
//调用了ActivityStarter的startActivityMayWait方法
return mActivityStarter.startActivityMayWait(caller, -1, callingPackage, intent, resolvedType, null, null, resultTo, resultWho, requestCode, startFlags, profilerInfo, null, null, bOptions, false, userId, null, null, "startActivityAsUser");
}
}//frameworks/base/services/core/java/com/android/server/am/ActivityStarter.java
class ActivityStarter {
private final ActivityManagerService mService;
private final ActivityStackSupervisor mSupervisor;
ActivityStarter(ActivityManagerService service, ActivityStackSupervisor supervisor) {
mService = service;
mSupervisor = supervisor;
mInterceptor = new ActivityStartInterceptor(mService, mSupervisor);
mUsingVr2dDisplay = false;
}
final int startActivityMayWait(IApplicationThread caller, int callingUid, String callingPackage, Intent intent, String resolvedType, IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor, IBinder resultTo, String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo, WaitResult outResult, Configuration globalConfig, Bundle bOptions, boolean ignoreTargetSecurity, int userId, IActivityContainer iContainer, TaskRecord inTask, String reason) {
//...省略代码...
int res = startActivityLocked(caller, intent, ephemeralIntent, resolvedType, aInfo, rInfo, voiceSession, voiceInteractor, resultTo, resultWho, requestCode, callingPid, callingUid, callingPackage, realCallingPid, realCallingUid, startFlags, options, ignoreTargetSecurity, componentSpecified, outRecord, container, inTask, reason);
//...省略代码...
return res;
}
int startActivityLocked(IApplicationThread caller, Intent intent, Intent ephemeralIntent, String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo, IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor, IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid, String callingPackage, int realCallingPid, int realCallingUid, int startFlags, ActivityOptions options, boolean ignoreTargetSecurity, boolean componentSpecified, ActivityRecord[] outActivity, ActivityStackSupervisor.ActivityContainer container, TaskRecord inTask, String reason) {
//判断启动理由不为空
if (TextUtils.isEmpty(reason)) throw new IllegalArgumentException("Need to specify a reason.");
mLastStartReason = reason;
mLastStartActivityTimeMs = System.currentTimeMillis();
mLastStartActivityRecord[0] = null;
//启动activity
mLastStartActivityResult = startActivity(caller, intent, ephemeralIntent, resolvedType, aInfo, rInfo, voiceSession, voiceInteractor, resultTo, resultWho, requestCode, callingPid, callingUid, callingPackage, realCallingPid, realCallingUid, startFlags, options, ignoreTargetSecurity, componentSpecified, mLastStartActivityRecord, container, inTask);
if (outActivity != null) outActivity[0] = mLastStartActivityRecord[0];
return mLastStartActivityResult;
}
private int startActivity(final ActivityRecord r, ActivityRecord sourceRecord, IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor, int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask, ActivityRecord[] outActivity) {
int result = START_CANCELED;
try {
mService.mWindowManager.deferSurfaceLayout();
//最终还是调用startActivityUnchecked方法
result = startActivityUnchecked(r, sourceRecord, voiceSession, voiceInteractor, startFlags, doResume, options, inTask, outActivity);
} finally {
if (!ActivityManager.isStartResultSuccessful(result) && mStartActivity.getTask() != null) mStartActivity.getTask().removeActivity(mStartActivity);
mService.mWindowManager.continueSurfaceLayout();
}
postStartActivityProcessing(r, result, mSupervisor.getLastStack().mStackId, mSourceRecord, mTargetStack);
return result;
}
//处理与栈管理相关的逻辑
private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord, IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor, int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask, ActivityRecord[] outActivity) {
//...省略代码...
//最终还是调用了ActivityStackSupervisor的方法
mSupervisor.resumeFocusedStackTopActivityLocked(mTargetStack, mStartActivity, mOptions);
//...省略代码...
}
}//frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java
public class ActivityStackSupervisor extends ConfigurationContainer implements DisplayListener {
boolean resumeFocusedStackTopActivityLocked(ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) {
if (targetStack != null && isFocusedStack(targetStack))
return targetStack.resumeTopActivityUncheckedLocked(target, targetOptions);
final ActivityRecord r = mFocusedStack.topRunningActivityLocked();
//mFocusedStack是ActivityStack类型，改方法中最后回调了startSpecificActivityLocked方法
if (r == null || r.state != RESUMED)
mFocusedStack.resumeTopActivityUncheckedLocked(null, null);
else if (r.state == RESUMED)
mFocusedStack.executeAppTransition(targetOptions);
return false;
}
void startSpecificActivityLocked(ActivityRecord r, boolean andResume, boolean checkConfig) {
//获取即将启动的Activity的所在的应用程序进程
ProcessRecord app = mService.getProcessRecordLocked(r.processName, r.info.applicationInfo.uid, true);
r.getStack().setLaunchTime(r);
//如果即将启动的Activity的所在的应用程序进程不为null 则启动该activity
if (app != null && app.thread != null) {
try {
if ((r.info.flags&ActivityInfo.FLAG_MULTIPROCESS) == 0 || !"android".equals(r.info.packageName))
app.addPackage(r.info.packageName, r.info.applicationInfo.versionCode, mService.mProcessStats);
realStartActivityLocked(r, app, andResume, checkConfig);
return;
} catch (RemoteException e) {
}
}
//如果积极启动的Activity所在的应用程序进程为null，则创建该应用程序进程 调用了AMS的startProcessLocked方法
mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0, "activity", r.intent.getComponent(), false, false, true);
}
}2、AMS发送启动应用程序进程请求到Zygote：
由上面的分析可以知道，在启动一个根Activity的时候，在AMS中会判断该Activity所在的应用程序进程是否被启动，如果没有被启动，则会调用AMS中的startProcessLocked方法进行创建该应用程序进程，该方法源码如下：
//启动创建一个应用程序进程
private final void startProcessLocked(ProcessRecord app, String hostingType, String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs) {
long startTime = SystemClock.elapsedRealtime();
//...省略代码...
try {
try {
final int userId = UserHandle.getUserId(app.uid);
AppGlobals.getPackageManager().checkPackageStartable(app.info.packageName, userId);
} catch (RemoteException e) {
throw e.rethrowAsRuntimeException();
}
//获取要创建的应用程序进程的用户ID
int uid = app.uid;
int[] gids = null;
int mountExternal = Zygote.MOUNT_EXTERNAL_NONE;
if (!app.isolated) {
int[] permGids = null;
//...省略代码...
//对gids进程创建和赋值
if (ArrayUtils.isEmpty(permGids)) {
gids = new int[3];
} else {
gids = new int[permGids.length + 3];
System.arraycopy(permGids, 0, gids, 3, permGids.length);
}
gids[0] = UserHandle.getSharedAppGid(UserHandle.getAppId(uid));
gids[1] = UserHandle.getCacheAppGid(UserHandle.getAppId(uid));
gids[2] = UserHandle.getUserGid(UserHandle.getUserId(uid));
}
//...省略代码...
//开始启动应用程序进程 调用Process.start启动进程
boolean isActivityProcess = (entryPoint == null);
//指定应用程序进程的主类ActivityThread
if (entryPoint == null) entryPoint = "android.app.ActivityThread";
ProcessStartResult startResult;
if (hostingType.equals("webview_service")) {
startResult = startWebView(entryPoint, app.processName, uid, uid, gids, debugFlags, mountExternal, app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet, app.info.dataDir, null, entryPointArgs);
}else{}
startResult = Process.start(entryPoint, app.processName, uid, uid, gids, debugFlags, mountExternal, app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet, app.info.dataDir, invokeWith, entryPointArgs);
}
//...省略代码...
}
}由上面流程可以知道AMS启动一个应用程序进程，先得到该应用程序进程的用户ID，最后将用户ID和用户组ID以及android.app.ActivityThread作为参数传递到Process的start方法，其代码如下：
//frameworks/base/core/java/android/os/Process.java
public class Process {
public static final ZygoteProcess zygoteProcess = new ZygoteProcess(ZYGOTE_SOCKET, SECONDARY_ZYGOTE_SOCKET);
public static final ProcessStartResult start(final String processClass, final String niceName, int uid, int gid, int[] gids, int debugFlags, int mountExternal, int targetSdkVersion, String seInfo, String abi, String instructionSet, String appDataDir, String invokeWith, String[] zygoteArgs) {
return zygoteProcess.start(processClass, niceName, uid, gid, gids, debugFlags, mountExternal, targetSdkVersion, seInfo, abi, instructionSet, appDataDir, invokeWith, zygoteArgs);
}
}
//frameworks/base/core/java/android/os/ZygoteProcess.java
public class ZygoteProcess {
private final String mSocket; //用于与Zygote进程通信的主Socket
private final String mSecondarySocket; //用于与Zygote进程通信的从Socket
public ZygoteProcess(String primarySocket, String secondarySocket) {
mSocket = primarySocket;
mSecondarySocket = secondarySocket;
}
//开启一个应用进程
public final Process.ProcessStartResult start(final String processClass, final String niceName, int uid, int gid, int[] gids, int debugFlags, int mountExternal, int targetSdkVersion, String seInfo, String abi, String instructionSet, String appDataDir, String invokeWith, String[] zygoteArgs) {
try {
return startViaZygote(processClass, niceName, uid, gid, gids, debugFlags, mountExternal, targetSdkVersion, seInfo, abi, instructionSet, appDataDir, invokeWith, zygoteArgs);
} catch (ZygoteStartFailedEx ex) {
throw new RuntimeException( "Starting VM process through Zygote failed", ex);
}
}
private Process.ProcessStartResult startViaZygote(final String processClass, final String niceName, final int uid, final int gid, final int[] gids, int debugFlags, int mountExternal, int targetSdkVersion, String seInfo, String abi, String instructionSet, String appDataDir, String invokeWith, String[] extraArgs) throws ZygoteStartFailedEx {
//创建字符串列表 并将应用进程的启动参数保存在这列表中
ArrayList<String> argsForZygote = new ArrayList<String>();
argsForZygote.add("--runtime-args");
argsForZygote.add("--setuid=" + uid);
argsForZygote.add("--setgid=" + gid);
//...省略代码（将启动参数保存到argsForZygote中）...
argsForZygote.add(processClass);
if (extraArgs != null) for (String arg : extraArgs) argsForZygote.add(arg);
synchronized(mLock) {
//参数ZygoreState通过openZygoteSocketIfNeeded方法获取
return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), argsForZygote);
}
}
//给zygote进程发送应用进程启动参数并获取结果，其实是通过向参数ZygoreState写入被启动应用程序进程的参数并从中读取结果出来
@GuardedBy("mLock")
private static Process.ProcessStartResult zygoteSendArgsAndGetResult( ZygoteState zygoteState, ArrayList<String> args) throws ZygoteStartFailedEx {
try {
int sz = args.size();
for (int i = 0; i < sz; i++) if (args.get(i).indexOf('\n') >= 0) throw new ZygoteStartFailedEx("embedded newlines not allowed");
final BufferedWriter writer = zygoteState.writer;
final DataInputStream inputStream = zygoteState.inputStream;
writer.write(Integer.toString(args.size()));
writer.newLine();
for (int i = 0; i < sz; i++) {
String arg = args.get(i);
writer.write(arg);
writer.newLine();
}
writer.flush();
Process.ProcessStartResult result = new Process.ProcessStartResult();
result.pid = inputStream.readInt();
result.usingWrapper = inputStream.readBoolean();
if (result.pid < 0) throw new ZygoteStartFailedEx("fork() failed");
return result;
} catch (IOException ex) {
zygoteState.close();
throw new ZygoteStartFailedEx(ex);
}
}
//获取与Zygote进程通信的静态内部类ZygoteState
@GuardedBy("mLock")
private ZygoteState openZygoteSocketIfNeeded(String abi) throws ZygoteStartFailedEx {
Preconditions.checkState(Thread.holdsLock(mLock), "ZygoteProcess lock not held");
//通过静态内部类ZygoteState与Zygote进程建立Socket连接
if (primaryZygoteState == null || primaryZygoteState.isClosed())
primaryZygoteState = ZygoteState.connect(mSocket);
//连接Zygote主模式返回的ZygoteState是否与启动应用程序进程所需要的ABI匹配
if (primaryZygoteState.matches(abi))
return primaryZygoteState;
//如果不匹配，则尝试连接Zygote辅模式
if (secondaryZygoteState == null || secondaryZygoteState.isClosed())
secondaryZygoteState = ZygoteState.connect(mSecondarySocket);
//连接Zygote辅模式返回的ZygoteState是否与启动应用程序进程所需要的ABI匹配
if (secondaryZygoteState.matches(abi))
return secondaryZygoteState;
throw new ZygoteStartFailedEx("Unsupported zygote ABI: " + abi);
}
//ZygoteState类拥有LocalSocket和输入输出流用于与Zygote进程的Socket进行通信
public static class ZygoteState {
final LocalSocket socket; //Zygote进程的本地Soxcket
final DataInputStream inputStream;
final BufferedWriter writer;
final List<String> abiList;
boolean mClosed;
private ZygoteState(LocalSocket socket, DataInputStream inputStream,BufferedWriter writer, List<String> abiList) {
this.socket = socket;
this.inputStream = inputStream;
this.writer = writer;
this.abiList = abiList;
}
//连接Zygote进程的Socket，并返回结果
public static ZygoteState connect(String socketAddress) throws IOException {
DataInputStream zygoteInputStream = null;
BufferedWriter zygoteWriter = null;
final LocalSocket zygoteSocket = new LocalSocket();
try {
zygoteSocket.connect(new LocalSocketAddress(socketAddress, LocalSocketAddress.Namespace.RESERVED));
zygoteInputStream = new DataInputStream(zygoteSocket.getInputStream());
zygoteWriter = new BufferedWriter(new OutputStreamWriter(zygoteSocket.getOutputStream()), 256);
} catch (IOException ex) {
zygoteSocket.close();
throw ex;
}
String abiListString = getAbiList(zygoteWriter, zygoteInputStream);
return new ZygoteState(zygoteSocket, zygoteInputStream, zygoteWriter, Arrays.asList(abiListString.split(",")));
}
boolean matches(String abi) {
return abiList.contains(abi); //匹配参数
}
public void close() {
try {socket.close();} catch (IOException ex) {}
mClosed = true;
}
}
}由上面代码流程可以知道，AMS在启动一个应用程序进程的时候，经过层层调用，最后通过openZygoteSocketIfNeeded方法连接Zygote进程的服务端Socket，并返回ZygoteState对象，在zygoteSendArgsAndGetResult方法里面将应用程序进程的启动参数写入到ZygoteState的流中（该流是连接到Zygote进程的服务端Socket），并从该流中获取结果。这样完成了AMS发送启动应用程序进程请求过程的命令到Zygote进程的过程。
3、Zygote进程接收AMS的请求并创建应用程序进程：
Socket连接成功并匹配ABI后会返回ZygoteState对象，我们知道AMS会将应用程序进程的启动参数argsForZygote写入到ZygoteState中，这样Zygote进程就会收到一个创建新的应用程序进程的请求，我们回归一下ZygoteInit的main方法：
//frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
public static void main(String argv[]) {
ZygoteServer zygoteServer = new ZygoteServer();
//...省略代码...
//创建一个服务端的Socket，SockeName的值为“zygote”
zygoteServer.registerServerSocket(socketName);
//预加载类和资源
if (!enableLazyPreload)
preload(bootTimingsTraceLog);
else
Zygote.resetNicePriority();
//...省略代码...
//启动SystemServer进程
if (startSystemServer)
startSystemServer(abiList, socketName, zygoteServer);
//等待AMS请求
zygoteServer.runSelectLoop(abiList);
zygoteServer.closeServerSocket();
} catch (Zygote.MethodAndArgsCaller caller) {
caller.run();
} catch (Throwable ex) {
zygoteServer.closeServerSocket();
throw ex;
}
}以前分析过，先通过registerZygoteSocket方法创建了一个服务端的Socket，该Socket用来等待AMS请求Zygote以创建新的应用程序进程，最后通过ZygoteServer.runSelectLoop方法来等待AMS请求并创建新的应用程序进程，该方法如下：
//frameworks/base/core/java/com/android/internal/os/ZygoteServer.java
class ZygoteServer {
private LocalServerSocket mServerSocket; //本地服务端Socket
ZygoteServer() {}
void registerServerSocket(String socketName) {
if (mServerSocket == null) {
int fileDesc;
final String fullSocketName = ANDROID_SOCKET_PREFIX + socketName;
String env = System.getenv(fullSocketName);
fileDesc = Integer.parseInt(env);
FileDescriptor fd = new FileDescriptor();
fd.setInt$(fileDesc);
mServerSocket = new LocalServerSocket(fd);
}
}
void runSelectLoop(String abiList) throws Zygote.MethodAndArgsCaller {
ArrayList<FileDescriptor> fds = new ArrayList<FileDescriptor>();
ArrayList<ZygoteConnection> peers = new ArrayList<ZygoteConnection>();
fds.add(mServerSocket.getFileDescriptor());
peers.add(null);
while (true) {
StructPollfd[] pollFds = new StructPollfd[fds.size()];
for (int i = 0; i < pollFds.length; ++i) {
pollFds[i] = new StructPollfd();
pollFds[i].fd = fds.get(i);
pollFds[i].events = (short) POLLIN;
}
Os.poll(pollFds, -1);
for (int i = pollFds.length - 1; i >= 0; --i) {
if ((pollFds[i].revents & POLLIN) == 0) continue;
if (i == 0) {
ZygoteConnection newPeer = acceptCommandPeer(abiList);
peers.add(newPeer);
fds.add(newPeer.getFileDesciptor());
} else {
//处理请求数据
boolean done = peers.get(i).runOnce(this);
if (done) {
peers.remove(i);
fds.remove(i);
}
}
}
}
}
}//frameworks/base/core/java/com/android/internal/os/ZygoteConnection.java
class ZygoteConnection {
boolean runOnce(ZygoteServer zygoteServer) throws Zygote.MethodAndArgsCaller {
String args[];
Arguments parsedArgs = null;
FileDescriptor[] descriptors;
//获取应用程序进程的启动参数
args = readArgumentList();
descriptors = mSocket.getAncillaryFileDescriptors();
//...省略代码...
int pid = -1;
FileDescriptor childPipeFd = null;
FileDescriptor serverPipeFd = null;
try {
//将应用程序进程的启动参数封装成Arguments
parsedArgs = new Arguments(args);
//...省略代码...
//创建应用程序进程 内部通过fork当前进程来创建子进程
pid = Zygote.forkAndSpecialize(parsedArgs.uid, parsedArgs.gid, parsedArgs.gids, parsedArgs.debugFlags, rlimits, parsedArgs.mountExternal, parsedArgs.seInfo, parsedArgs.niceName, fdsToClose, fdsToIgnore, parsedArgs.instructionSet, parsedArgs.appDataDir);
} catch (ErrnoException ex) {}
try {
if (pid == 0) {
//子进程处理 即应用程序进程
zygoteServer.closeServerSocket();
IoUtils.closeQuietly(serverPipeFd);
serverPipeFd = null;
//应用程序进程处理
handleChildProc(parsedArgs, descriptors, childPipeFd, newStderr);
return true;
} else {
//父进程处理 这里是Zygote进程
IoUtils.closeQuietly(childPipeFd);
childPipeFd = null;
return handleParentProc(pid, descriptors, serverPipeFd, parsedArgs);
}
} finally {
IoUtils.closeQuietly(childPipeFd);
IoUtils.closeQuietly(serverPipeFd);
}
}
private void handleChildProc(Arguments parsedArgs, FileDescriptor[] descriptors, FileDescriptor pipeFd, PrintStream newStderr) throws Zygote.MethodAndArgsCaller {
closeSocket();
//...省略代码...
if (parsedArgs.invokeWith != null) {
WrapperInit.execApplication(parsedArgs.invokeWith, parsedArgs.niceName, parsedArgs.targetSdkVersion, VMRuntime.getCurrentInstructionSet(), pipeFd, parsedArgs.remainingArgs);
} else { //通过ZygoteInit.zygoteInit方法对应用程序进程初始化（Zygote孵化所有进程都是这种方式，例如SystemServer）
ZygoteInit.zygoteInit(parsedArgs.targetSdkVersion,parsedArgs.remainingArgs, null );
}
}
}
//frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
public class ZygoteInit {
//这里是Zygote的子进程 即应用程序进程启动并进行初始化
public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader) throws Zygote.MethodAndArgsCaller {
RuntimeInit.redirectLogStreams();
RuntimeInit.commonInit();
//前面分析过，该方法调用了C++并创建Binder线程池
ZygoteInit.nativeZygoteInit();
RuntimeInit.applicationInit(targetSdkVersion, argv, classLoader);
}
}
//frameworks/base/core/java/com/android/internal/os/RuntimeInit.java
public class RuntimeInit {
protected static void applicationInit(int targetSdkVersion, String[] argv, ClassLoader classLoader) throws Zygote.MethodAndArgsCaller {
VMRuntime.getRuntime().setTargetHeapUtilization(0.75f);
VMRuntime.getRuntime().setTargetSdkVersion(targetSdkVersion);
final Arguments args;
args = new Arguments(argv);
Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
invokeStaticMain(args.startClass, args.startArgs, classLoader);
}
private static void invokeStaticMain(String className, String[] argv, ClassLoader classLoader) throws Zygote.MethodAndArgsCaller {
//通过反射获取android.app.ActivityThread类
Class<?> cl = Class.forName(className, true, classLoader);
//通过反射获取ActivityThread类的main方法
Method m = cl.getMethod("main", new Class[] { String[].class });
//抛出可执行回调方法的异常给Zygote进程
throw new Zygote.MethodAndArgsCaller(m, argv);
}
}其实这里跟前面的SystemServer进程的启动过程一模一样了，最后都是通过RuntimeInit.applicationInit方法，在调用invokeStaticMain方法，在该方法中通过反射的方式获取了android.app.ActivityThread类的main方法，最后跟SystemServer进程一样，通过抛出异常的方式调用了main方法。
唯一需要注意的是，在启动SystemServer进程的时候是在ZygoteInit.startSystemServer方法中，该方法中指定的进程启动参数"com.android.server.SystemServer"，而应用程序进程是在ZygoteServer.runSelectLoop循环中获取AMS发送过来的参数“com.android.app.ActivityThread”，因此在invokeStaticMain方法中进行发射的时候是调用的不同类的main方法。
4、ActivityThread主线程的创建：
现在我们终于知道了ActivityThread为什么被用于管理当前应用程序进程的主线程了，由此可以知道ActivityThread的main方法是一个应用程序进程的入口，在main方法中先创建了主线程Looper，并创建了主线程H(Handler)，最后调用了Looper.loop进行消息轮询,该方法如下：
public final class ActivityThread {
final ApplicationThread mAppThread = new ApplicationThread();
final Looper mLooper = Looper.myLooper();
final H mH = new H();
public static void main(String[] args) {
//...省略代码...
//创建主线程Looper
Looper.prepareMainLooper();
//创建ActivityThread
ActivityThread thread = new ActivityThread();
//调用attach方法
thread.attach(false);
//创建主线H类 其继承了Handler
if (sMainThreadHandler == null) sMainThreadHandler = thread.getHandler();
if (false) Looper.myLooper().setMessageLogging(new LogPrinter(Log.DEBUG, "ActivityThread"));
//主线程Looper开始轮询
Looper.loop();
throw new RuntimeException("Main thread loop unexpectedly exited");
}
private void attach(boolean system) {
//...省略代码(参数为flase，因此执行下面代码)...
if (!system) {
//获取AMS的本地代理，并将ApplicationThread传递进去
final IActivityManager mgr = ActivityManager.getService();
try {
mgr.attachApplication(mAppThread);
} catch (RemoteException ex) {
throw ex.rethrowFromSystemServer();
}else{
//...省略代码...
}
}
}
}因此，上面的静态方法ActivityThread.main由此可以被认为是一个应用程序的入口，在main方法中先创建了一个主线程的Looper，然后实例化了ActivityThread，并调用了attach方法，最后开启上面主线程的Looper进行轮询。在attach方法里面，获取了AMS的代理或者binder实例，并将mAppThread 传递了进去，我们来看看AMS的attachApplication方法如下：
public class ActivityManagerService extends IActivityManager.Stub{
@Override
public final void attachApplication(IApplicationThread thread) {
synchronized (this) {
int callingPid = Binder.getCallingPid();
final long origId = Binder.clearCallingIdentity();
attachApplicationLocked(thread, callingPid);
Binder.restoreCallingIdentity(origId);
}
}
private final boolean attachApplicationLocked(IApplicationThread thread, int pid) {
//...省略代码(调用mAppThread的bindApplication方法，其中回调了Applicaition的onCreat的方法)...
if (app.instr != null) {
thread.bindApplication(processName, appInfo, providers, app.instr.mClass, profilerInfo, app.instr.mArguments, app.instr.mWatcher, app.instr.mUiAutomationConnection, testMode, mBinderTransactionTrackingEnabled, enableTrackAllocation, isRestrictedBackupMode || !normalMode, app.persistent, new Configuration(getGlobalConfiguration()), app.compat, getCommonServicesLocked(app.isolated), mCoreSettingsObserver.getCoreSettingsLocked(), buildSerial);
} else {
thread.bindApplication(processName, appInfo, providers, null, profilerInfo, null, null, null, testMode, mBinderTransactionTrackingEnabled, enableTrackAllocation, isRestrictedBackupMode || !normalMode, app.persistent, new Configuration(getGlobalConfiguration()), app.compat, getCommonServicesLocked(app.isolated), mCoreSettingsObserver.getCoreSettingsLocked(), buildSerial);
}
//...省略代码(通过mStackSupervisor创建Activity)...
if (normalMode) {
try {
if (mStackSupervisor.attachApplicationLocked(app)) didSomething = true;
} catch (Exception e) {
badApp = true;
}
}
//...省略代码...
}
}ApplicationThread被传入到AMS中，主要干了两件事情：
- 第一件事情回调了ApplicationThread的bindApplication方法：
//ActivityThread中的bindApplication方法
public final void bindApplication(...) {
//...省略代码(主要发送了消息BIND_APPLICATION)...
sendMessage(H.BIND_APPLICATION, data);
}
//ActivityThread中的handleBindApplication方法
private void handleBindApplication(AppBindData data) {
//...省略代码...
Application app = data.info.makeApplication(data.restrictedBackupMode, null);
mInitialApplication = app;
mInstrumentation.callApplicationOnCreate(app);
}
//LoadedApk中的方法，用于创建Application
public Application makeApplication(boolean forceDefaultAppClass, Instrumentation instrumentation) {
//如果存在Application的实例，则直接返回，这也说明Application是个单例
if (mApplication != null)return mApplication;
Application app = null;
//...省略代码(这里通过反射初始化Application)...
if (instrumentation != null) {
//调用Application的onCreate方法
instrumentation.callApplicationOnCreate(app);
}
return app;
}
- 第二件事情创建了Activity：
//ApplicationThread的scheduleLaunchActivity方法会向ActivityThread发送LAUNCH_ACTIVITY信息，用于启动一个Activity，该消息的处理会调用ActivityThread的handleLaunchActivity方法，最终启动一个Activity
boolean attachApplicationLocked(ProcessRecord app) throws RemoteException {
if (realStartActivityLocked(hr, app, true, true)) {/*省略代码*/}
}
//调用ApplicationThread的scheduleLaunchActivity用于启动一个Activity
final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app, boolean andResume, boolean checkConfig) throws RemoteException {
//...省略代码...
app.thread.scheduleLaunchActivity(...);
}
三、四大组件的工作过程
前面已经知道了系统的启动流程和应用程序进程的启动流程，现在我们来看看四大组件的启动流程。其实四大组件的启动过程，都离不开下面三个步骤：获取到IActivtyManager并调用AMS的过程、AMS调用ActivityThread的过程、ActivityThread通过内部H启动四大组件。
1、到AMS过程：
1）、Activity：
activity的启动过程分为两种，一种是根Activity（应用程序启动的第一个Activity）的启动过程，另一种是普通Activity的启动过程。Launcher启动后会将已安装应用程序的快捷图标显示到做面上，当我们点击某个应用程序的快捷图标时，就会通过Launcher请求AMS来启动该应用程序，如果该应用程序的应用程序进程没有启动就会先去启动该进程，否则就会执行下面流程去启动该应用的根Activity。其流程如下：
//packages/apps/Launcher3/src/com/android/launcher3/Launcher.java
public class Launcher extends BaseActivity{
public boolean startActivitySafely(View v, Intent intent, ItemInfo item) {
//...省略代码...
intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);//设置重新开启一个栈
if (v != null) intent.setSourceBounds(getViewBounds(v));
try {
if (Utilities.ATLEAST_MARSHMALLOW && (item instanceof ShortcutInfo) && (item.itemType == Favorites.ITEM_TYPE_SHORTCUT || item.itemType == Favorites.ITEM_TYPE_DEEP_SHORTCUT) && !((ShortcutInfo) item).isPromise())
startShortcutIntentSafely(intent, optsBundle, item);
else if (user == null || user.equals(Process.myUserHandle()))
startActivity(intent, optsBundle);//2
else
LauncherAppsCompat.getInstance(this).startActivityForProfile( intent.getComponent(), user, intent.getSourceBounds(), optsBundle);
return true;
} catch (ActivityNotFoundException|SecurityException e) {
Toast.makeText(this, R.string.activity_not_found, Toast.LENGTH_SHORT).show();
}
return false;
}
}
//frameworks/base/core/java/android/app/Activity.java
public class Activity extends ContextThemeWrapper{
@Override
public void startActivity(Intent intent, @Nullable Bundle options) {
if (options != null) {
startActivityForResult(intent, -1, options);
} else {
startActivityForResult(intent, -1);
}
}
public void startActivityForResult(@RequiresPermission Intent intent, int requestCode, @Nullable Bundle options) {
if (mParent == null) {
options = transferSpringboardActivityOptions(options);
//通过Instrumentation启动Activity
Instrumentation.ActivityResult ar =
mInstrumentation.execStartActivity( this, mMainThread.getApplicationThread(), mToken, this, intent, requestCode, options);
//...省略代码...
}
}
}
//frameworks/base/core/java/android/content/ContextWrapper.java
public class ContextWrapper extends Context{
@Override
public void startActivity(Intent intent) {
mBase.startActivity(intent);
}
}
class ContextImpl extends Context {
@Override
public void startActivity(Intent intent, Bundle options) {
warnIfCallingFromSystemProcess();
if ((intent.getFlags()&Intent.FLAG_ACTIVITY_NEW_TASK) == 0 && options != null && ActivityOptions.fromBundle(options).getLaunchTaskId() == -1)
throw new AndroidRuntimeException( "Calling startActivity() from outside of an Activity " + " context requires the FLAG_ACTIVITY_NEW_TASK flag." + " Is this really what you want?");
//获取主线程的Instrumentation启动Activity
mMainThread.getInstrumentation().execStartActivity(
getOuterContext(), mMainThread.getApplicationThread(), null,
(Activity) null, intent, -1, options);
}
}由上面代码可以知道，这里的Launcher其实就是一个Activity，无论Activity启动一个Activity，还是一个ContextImpl上下文启动一个Activity，最后都是获取了该主线程的Instrumentation（主要用来监控应用程序和系统的交互）并调用了execStartActivity方法完成的，该方法如下：
public class Instrumentation {
public ActivityResult execStartActivity( Context who, IBinder contextThread, IBinder token, Activity target, Intent intent, int requestCode, Bundle options) {
//...省略代码...
try {
intent.migrateExtraStreamToClipData();
intent.prepareToLeaveProcess(who);
//获取AMS的代理或者binder对象将启动Activity的任务转交给AMS
int result = ActivityManager.getService()
.startActivity(whoThread, who.getBasePackageName(), intent, intent.resolveTypeIfNeeded(who.getContentResolver()), token, target != null ? target.mEmbeddedID : null, requestCode, 0, null, options);
//获取启动Activity的结果
checkStartActivityResult(result, intent);
} catch (RemoteException e) {
throw new RuntimeException("Failure from system", e);
}
return null;
}
}由上代码的分析我们可以得出一个结论，无论何种方式启动Activity，最后都通过调用了Instrumentation.execStartActivity方法，该方法内部获取了AMS的Binder实例或者代理的方式，将启动Activity转交给了AMS。
2）、Service：
要启动Service，我们会调用上下文的startService方法或者bindService方法，上下文Context采用了装饰设计模式，具体的情况我们这里先不介绍了，先看看Context相关的一些源码：
//frameworks/base/core/java/android/content/ContextWrapper.java
public class ContextWrapper extends Context {
Context mBase;
public ContextWrapper(Context base) {
mBase = base;
}
@Override
public ComponentName startService(Intent service) {
return mBase.startService(service);
}
@Override
public boolean bindService(Intent service, ServiceConnection conn, int flags) {
return mBase.bindService(service, conn, flags);
}
}
//frameworks/base/core/java/android/app/ContextImpl.java
class ContextImpl extends Context {
@Override
public ComponentName startService(Intent service) {
warnIfCallingFromSystemProcess();
return startServiceCommon(service, false, mUser);
}
@Override
public ComponentName startForegroundService(Intent service) {
warnIfCallingFromSystemProcess();
return startServiceCommon(service, true, mUser);
}
@Override
public boolean stopService(Intent service) {
warnIfCallingFromSystemProcess();
return stopServiceCommon(service, mUser);
}
@Override
public boolean bindService(Intent service, ServiceConnection conn, int flags) {
warnIfCallingFromSystemProcess();
return bindServiceCommon(service, conn, flags, mMainThread.getHandler(), Process.myUserHandle());
}
//启动一个Service 也是通过获取AMS的代理或者binder实例来实现
private ComponentName startServiceCommon(Intent service, boolean requireForeground, UserHandle user) {
try {
validateServiceIntent(service);
service.prepareToLeaveProcess(this);
ComponentName cn = ActivityManager.getService().startService(
mMainThread.getApplicationThread(), service, service.resolveTypeIfNeeded( getContentResolver()), requireForeground, getOpPackageName(), user.getIdentifier());
//...省略代码...
return cn;
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
//停止一个Service 也是通过获取AMS的代理或者binder实例来实现
private boolean stopServiceCommon(Intent service, UserHandle user) {
try {
validateServiceIntent(service);
service.prepareToLeaveProcess(this);
int res = ActivityManager.getService().stopService(
mMainThread.getApplicationThread(), service, service.resolveTypeIfNeeded(getContentResolver()), user.getIdentifier());
if (res < 0) throw new SecurityException( "Not allowed to stop service " + service);
return res != 0;
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
//绑定一个Service 也是通过获取AMS的代理或者binder实例来实现
private boolean bindServiceCommon(Intent service, ServiceConnection conn, int flags, Handler handler, UserHandle user) {
IServiceConnection sd;
if (conn == null) throw new IllegalArgumentException("connection is null");
if (mPackageInfo != null) sd = mPackageInfo.getServiceDispatcher(conn, getOuterContext(), handler, flags);
validateServiceIntent(service);
try {
IBinder token = getActivityToken();
if (token == null && (flags&BIND_AUTO_CREATE) == 0 && mPackageInfo != null && mPackageInfo.getApplicationInfo().targetSdkVersion < android.os.Build.VERSION_CODES.ICE_CREAM_SANDWICH) flags |= BIND_WAIVE_PRIORITY;
service.prepareToLeaveProcess(this);
int res = ActivityManager.getService().bindService(
mMainThread.getApplicationThread(), getActivityToken(), service,
service.resolveTypeIfNeeded(getContentResolver()),
sd, flags, getOpPackageName(), user.getIdentifier());
if (res < 0) throw new SecurityException( "Not allowed to bind to service " + service);
return res != 0;
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
@Override //取消绑定一个Service 也是通过获取AMS的代理或者binder实例来实现
public void unbindService(ServiceConnection conn) {
if (conn == null) throw new IllegalArgumentException("connection is null");
if (mPackageInfo != null) {
IServiceConnection sd = mPackageInfo.forgetServiceDispatcher( getOuterContext(), conn);
ActivityManager.getService().unbindService(sd);
}
}
}由上代码的分析我们可以得出一个结论，无论是启动一个Service还是绑定一个Service，最后都通过上下文实现类ContextImpl获取了AMS的Binder实例或者代理的方式，转交给了AMS来进行处理。
3）、BroadcastReceiver：
广播的注册有静态注册和动态注册，静态注册在应用安装时由PackageManagerService来完成注册，动态注册广播还是需要通过上下文的registerReceiver方法，广播的发送也需要调用上下文的sendBroadcast方法，他们同样是在ContextImpl中实现的，代码如下
//frameworks/base/core/java/android/content/ContextWrapper.java
public class ContextWrapper extends Context {
@Override
public Intent registerReceiver(BroadcastReceiver receiver, IntentFilter filter) {
return mBase.registerReceiver(receiver, filter);
}
@Override
public void unregisterReceiver(BroadcastReceiver receiver) {
mBase.unregisterReceiver(receiver);
}
@Override
public void sendBroadcast(Intent intent) {
mBase.sendBroadcast(intent);
}
@Override
public void sendOrderedBroadcast(Intent intent, String receiverPermission) {
mBase.sendOrderedBroadcast(intent, receiverPermission);
}
@Override
@Deprecated
public void sendStickyBroadcast(Intent intent) {
mBase.sendStickyBroadcast(intent);
}
}
//frameworks/base/core/java/android/app/ContextImpl.java
class ContextImpl extends Context {
@Override //注册广播最后都调用了registerReceiverInternal方法
public Intent registerReceiver(BroadcastReceiver receiver, IntentFilter filter, String broadcastPermission, Handler scheduler) {
return registerReceiverInternal(receiver, getUserId(), filter, broadcastPermission, scheduler, getOuterContext(), 0);
}
@Override //取消注册广播最后通过AMS的binder实例或者代理的方式转交给了AMS来实现
public void unregisterReceiver(BroadcastReceiver receiver) {
if (mPackageInfo != null) {
IIntentReceiver rd = mPackageInfo.forgetReceiverDispatcher( getOuterContext(), receiver);
ActivityManager.getService().unregisterReceiver(rd);
} else {
throw new RuntimeException("Not supported in system context");
}
}
@Override //发送广播最后通过AMS的binder实例或者代理的方式转交给了AMS来实现
public void sendBroadcast(Intent intent) {
warnIfCallingFromSystemProcess();
String resolvedType = intent.resolveTypeIfNeeded(getContentResolver());
try {
intent.prepareToLeaveProcess(this);
ActivityManager.getService().broadcastIntent(
mMainThread.getApplicationThread(), intent, resolvedType, null, Activity.RESULT_OK, null, null, null, AppOpsManager.OP_NONE, null, false, false, getUserId());
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
//注册广播稍微浮渣一些，最后也是通过AMS的binder实例或者代理实现
private Intent registerReceiverInternal(BroadcastReceiver receiver, int userId, IntentFilter filter, String broadcastPermission, Handler scheduler, Context context, int flags) {
IIntentReceiver rd = null; //是一个Binder接口，用于广播的跨进程通信
if (receiver != null) {
if (mPackageInfo != null && context != null) {
if (scheduler == null) scheduler = mMainThread.getHandler();
//获取注册广播的Binder接口，通过主线程的Instrumentation获取
rd = mPackageInfo.getReceiverDispatcher(
receiver, context, scheduler,
mMainThread.getInstrumentation(), true);
} else {
if (scheduler == null) scheduler = mMainThread.getHandler();
//如果没有注册广播的Binder接口，通过该包和getIIntentReceiver获取
rd = new LoadedApk.ReceiverDispatcher( receiver, context, scheduler, null, true).getIIntentReceiver();
}
}
try {
final Intent intent = ActivityManager.getService().registerReceiver(
mMainThread.getApplicationThread(), mBasePackageName, rd, filter, broadcastPermission, userId, flags);
if (intent != null) {
intent.setExtrasClassLoader(getClassLoader());
intent.prepareToEnterProcess();
}
return intent;
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
}由上代码分析可以知道无论是注册广播还是发送广播，最终都是获取AMS的binder实例来实现。回到registerReceiverInternal方法，最后调用了IActivityManager的registerReceiver方法，并将IItentReceiver类型的rd传递进去，这里之所以不直接传入广播接收者BroadcastReceiver而是传入IIntentReceiver，是因为注册广播是一个跨进程的过程，所以需要具有跨进程的通信功能来实现。
2、到ActivityThread过程：
四大组件的启动，基本上都是通过上下文的实现类ContextImpl实现，最后都使用了进程间通信的方式将启动任务转交给了AMS。需要注意Android8.0之前并没有采用AIDL，而是采用了类似AIDL的形式，用AMS的代理对象ActivityManagerProxy来与AMS进程通信；Android8.0之后去除了ActivityManagerProxy，而是用IActivityManager代替了它，它是AMS在本地的代理。
1）、Activity：
Launcher请求AMS后，代码逻辑已经进入AMS中，接着是AMS到ActivityThread的调用流程，如下：
//frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
public class ActivityManagerService extends IActivityManager.Stub{
@Override
public final int startActivity(IApplicationThread caller, String callingPackage, Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo, Bundle bOptions) {
//通过startActivityAsUser方法实现，并传递参数UserHandle.getCallingUserId()
return startActivityAsUser(caller, callingPackage, intent, resolvedType, resultTo, resultWho, requestCode, startFlags, profilerInfo, bOptions, UserHandle.getCallingUserId());
}
@Override
public final int startActivityAsUser(IApplicationThread caller, String callingPackage, Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId) {
//判断调用者进程是否被隔离
enforceNotIsolatedCaller("startActivity");
//检查调用者权限 根据上面方法传递过来的userID来检查权限
userId = mUserController.handleIncomingUser(Binder.getCallingPid(), Binder.getCallingUid(), userId, false, ALLOW_FULL_ONLY, "startActivity", null);
//通过ActivityStarter来实现
return mActivityStarter.startActivityMayWait(caller, -1, callingPackage, intent, resolvedType, null, null, resultTo, resultWho, requestCode, startFlags, profilerInfo, null, null, bOptions, false, userId, null, null, "startActivityAsUser");
}
}
//frameworks/base/services/core/java/com/android/server/am/ActivityStarter.java
/*ActivityStarter是加载Activity的控制类，会收集所有的逻辑来决定如何将Intent和转换为Activity,
并将Activity和Task以及Stack相关联*/
class ActivityStarter {
final int startActivityMayWait(IApplicationThread caller, int callingUid, String callingPackage, Intent intent, String resolvedType, IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor, IBinder resultTo, String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo, WaitResult outResult, Configuration globalConfig, Bundle bOptions, boolean ignoreTargetSecurity, int userId, IActivityContainer iContainer, TaskRecord inTask, String reason) {
//...省略代码...
int res = startActivityLocked(caller, intent, ephemeralIntent, resolvedType, aInfo, rInfo, voiceSession, voiceInteractor, resultTo, resultWho, requestCode, callingPid, callingUid, callingPackage, realCallingPid, realCallingUid, startFlags, options, ignoreTargetSecurity, componentSpecified, outRecord, container, inTask, reason);
//...省略代码...
return res;
}
int startActivityLocked(IApplicationThread caller, Intent intent, Intent ephemeralIntent, String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo, IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor, IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid, String callingPackage, int realCallingPid, int realCallingUid, int startFlags, ActivityOptions options, boolean ignoreTargetSecurity, boolean componentSpecified, ActivityRecord[] outActivity, ActivityStackSupervisor.ActivityContainer container, TaskRecord inTask, String reason) {
//判断启动的理由不为空
if (TextUtils.isEmpty(reason)) throw new IllegalArgumentException("Need to specify a reason.");
mLastStartReason = reason;
mLastStartActivityTimeMs = System.currentTimeMillis();
mLastStartActivityRecord[0] = null;
mLastStartActivityResult = startActivity(caller, intent, ephemeralIntent, resolvedType, aInfo, rInfo, voiceSession, voiceInteractor, resultTo, resultWho, requestCode, callingPid, callingUid, callingPackage, realCallingPid, realCallingUid, startFlags, options, ignoreTargetSecurity, componentSpecified, mLastStartActivityRecord, container, inTask);
if (outActivity != null) outActivity[0] = mLastStartActivityRecord[0];
return mLastStartActivityResult;
}
private int startActivity(IApplicationThread caller, Intent intent, Intent ephemeralIntent, String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo, IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor, IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid, String callingPackage, int realCallingPid, int realCallingUid, int startFlags, ActivityOptions options, boolean ignoreTargetSecurity, boolean componentSpecified, ActivityRecord[] outActivity, ActivityStackSupervisor.ActivityContainer container, TaskRecord inTask) {
int err = ActivityManager.START_SUCCESS;
final Bundle verificationBundle = options != null ?options.popAppVerificationBundle() : null;
ProcessRecord callerApp = null;
if (caller != null) {
//获取Launcher进程
callerApp = mService.getRecordForAppLocked(caller);//2
if (callerApp != null) {
//获取Launcher进程的pid和uid并赋值
callingPid = callerApp.pid;
callingUid = callerApp.info.uid;
}
}
//...省略代码(创建即将要启动的Activity的描述类ActivityRecord)...
ActivityRecord r = new ActivityRecord(mService, callerApp, callingPid, callingUid, callingPackage, intent, resolvedType, aInfo,
mService.getGlobalConfiguration(), resultRecord, resultWho, requestCode, componentSpecified, voiceSession != null, mSupervisor, container, options, sourceRecord);
if (outActivity != null)outActivity[0] = r;
//...省略代码...
doPendingActivityLaunchesLocked(false);
return startActivity(r, sourceRecord, voiceSession, voiceInteractor, startFlags, true, options, inTask, outActivity);
}
private int startActivity(final ActivityRecord r, ActivityRecord sourceRecord, IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor, int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask, ActivityRecord[] outActivity) {
int result = START_CANCELED;
try {
mService.mWindowManager.deferSurfaceLayout();
result = startActivityUnchecked(r, sourceRecord, voiceSession, voiceInteractor, startFlags, doResume, options, inTask, outActivity);
}
//...省略代码...
return result;
}
private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord, IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor, int startFlags, boolean doResume, ActivityOptions options, TaskRecord inTask, ActivityRecord[] outActivity) {
//...省略代码(判断Activity的启动模式如果是开启新栈方式就通过setTaskFromReuseOrCreateNewTask创建一个任务栈)...
if (mStartActivity.resultTo == null && mInTask == null && !mAddingToTask && (mLaunchFlags & FLAG_ACTIVITY_NEW_TASK) != 0) {
newTask = true;
//创建新的TaskRecord
result = setTaskFromReuseOrCreateNewTask( taskToAffiliate, preferredLaunchStackId, topStack);
}
//...省略代码(调用ActivityStackSupervisor类的方法)...
mSupervisor.resumeFocusedStackTopActivityLocked(mTargetStack, mStartActivity, mOptions);
//...省略代码...
}
}
//frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java
public class ActivityStackSupervisor extends ConfigurationContainer implements DisplayListener {
boolean resumeFocusedStackTopActivityLocked( ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) {
if (targetStack != null && isFocusedStack(targetStack))
return targetStack.resumeTopActivityUncheckedLocked(target, targetOptions);
final ActivityRecord r = mFocusedStack.topRunningActivityLocked();
if (r == null || r.state != RESUMED)
mFocusedStack.resumeTopActivityUncheckedLocked(null, null);
else if (r.state == RESUMED)
mFocusedStack.executeAppTransition(targetOptions);
return false;
}
//resumeTopActivityUncheckedLocked方法后面经过回调，最终还是调用了startSpecificActivityLocked来完成启动一个Activity的逻辑
void startSpecificActivityLocked(ActivityRecord r, boolean andResume, boolean checkConfig) {
//获取即将要启动的Activity的所在的应用程序进程
ProcessRecord app = mService.getProcessRecordLocked(r.processName, r.info.applicationInfo.uid, true);
r.getStack().setLaunchTime(r);
//如果应用程序进程不为NULL就直接启动该Activity
if (app != null && app.thread != null) {
realStartActivityLocked(r, app, andResume, checkConfig);
return;
}
//如果应用程序进程是NULL就启动该应用程序进程
mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0, "activity", r.intent.getComponent(), false, false, true);
}
final boolean realStartActivityLocked(ActivityRecord r, ProcessRecord app, boolean andResume, boolean checkConfig) throws RemoteException {
//...省略代码...
app.thread.scheduleLaunchActivity(new Intent(r.intent), r.appToken, System.identityHashCode(r), r.info, new Configuration(mService.mConfiguration), new Configuration(task.mOverrideConfig), r.compat, r.launchedFromPackage, task.voiceInteractor, app.repProcState, r.icicle, r.persistentState, results, newIntents, !andResume, mService.isNextTransitionForward(), profilerInfo);
//...省略代码...
return true;
}
}
由上代码可以知道，AMS经过一系列函数的调用，经过了ActivityStarter类来控制Activity的任务栈加载逻辑，最终封装了所启动的Activity对应的ActivityRecord（描述一个Activity的启动参数和状态）类，最终在ActivityStackSuppervisor的startSpecificActivityLocked里面获取了描述该应用程序进程的ProcessRecord类，如果该类不存在表示应用程序进程没有启动者通过startProcessLocked方法启动应用程序进程，如果存在最后通过该应用程序的ProcessRecord实例对象的内部成员ApplicationThread启动Activity。这里app.thread指的是IApplicationThread，它的实现是ActivityThread的内部类ApplicationThread，其中ApplicationThread继承了IApplicationThread.Stub。而ApplicationThread又是ActivityThread的内部类，所以到了这里AMS作了非常复杂的任务栈逻辑处理，最终将启动一个Activity的调用权交还给了ActivityThread类。
2）、Service：
AMS通过ActiveServices来管理控制Service的一些列启动逻辑，我们先看看AMS的一些代码：
//frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
public class ActivityManagerService extends IActivityManager.Stub{
Override
public ComponentName startService(IApplicationThread caller, Intent service, String resolvedType, String callingPackage, int userId) throws TransactionTooLargeException {
//...省略代码...
synchronized(this) {
//通过调用ActiveService的startServiceLocked来实现启动一个服务
ComponentName res = mServices.startServiceLocked(caller, service, resolvedType, callingPid, callingUid, callingPackage, userId);
Binder.restoreCallingIdentity(origId);
return res;
}
}
public int bindService(IApplicationThread caller, IBinder token, Intent service, String resolvedType, IServiceConnection connection, int flags, String callingPackage, int userId) throws TransactionTooLargeException {
enforceNotIsolatedCaller("bindService");
//...省略代码...
synchronized(this) {
//通过调用ActiveService的bindServiceLocked来实现绑定一个服务
return mServices.bindServiceLocked(caller, token, service, resolvedType, connection, flags, callingPackage, userId);
}
}
//如果是应用程序通过bindService首次绑定某个服务，最后会回调到这里
public void publishService(IBinder token, Intent intent, IBinder service) {
//...省略代码...
synchronized(this) {
if (!(token instanceof ServiceRecord)) throw new IllegalArgumentException("Invalid service token");
//通过调用ActiveService的publishServiceLocked（首次绑定一个服务，连接一个服务）
mServices.publishServiceLocked((ServiceRecord)token, intent, service);
}
}
}
上图为AMS的startService的时序图，我们会发现AMS最后也是通过ActiveServices来实现的，源码如下：
//frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
public final class ActiveServices {
ComponentName startServiceLocked(IApplicationThread caller, Intent service, String resolvedType, int callingPid, int callingUid, String callingPackage, final int userId) throws TransactionTooLargeException {
//...省略代码...
return startServiceInnerLocked(smap, service, r, callerFg, addToStarting);
}
ComponentName startServiceInnerLocked(ServiceMap smap, Intent service, ServiceRecord r, boolean callerFg, boolean addToStarting) throws TransactionTooLargeException {
//...省略代码...
String error = bringUpServiceLocked(r, service.getFlags(), callerFg, false, false);
//...省略代码...
return r.name;
}
private String bringUpServiceLocked(ServiceRecord r, int intentFlags, boolean execInFg, boolean whileRestarting, boolean permissionsReviewRequired) throws TransactionTooLargeException {
//...省略代码(获取Service想要在哪个进程中运行，默认是当前进程，也可以在xml文件中配置)...
final String procName = r.processName;
ProcessRecord app;
if (!isolated) {
//通过上面获取的进程名称和uid来获取这个进程描述类ProcessRecord
app = mAm.getProcessRecordLocked(procName, r.appInfo.uid, false);
//如果这个进程存在，则调用realStartServiceLocked并将ProcessRecord传递进去
if (app != null && app.thread != null) {
app.addPackage(r.appInfo.packageName, r.appInfo.versionCode, mAm.mProcessStats);
realStartServiceLocked(r, app, execInFg);
return null;
}
}else app = r.isolatedProc;
//如果这个进程不存在，则调用AMS的startProcessLocked方法创建这个进程
if (app == null && !permissionsReviewRequired) {
if ((app=mAm.startProcessLocked(procName, r.appInfo, true, intentFlags, "service", r.name, false, isolated, false)) == null) { }
if (isolated) r.isolatedProc = app;
}
}
//启动一个服务，注意参数app为想要启动服务的应用程序进程
private final void realStartServiceLocked(ServiceRecord r, ProcessRecord app, boolean execInFg) throws RemoteException {
//...省略代码...
app.thread.scheduleCreateService(r, r.serviceInfo, mAm.compatibilityInfoForPackageLocked(r.serviceInfo.applicationInfo), app.repProcState);
r.postNotification();
created = true;
}
}在ActiveServices里面，启动一个Activity经过两层调用，最后在bringUpServiceLocked方法获取了想要启动Service的进程，如果该进程不存在就调用了ASM的startProcessLocked方法创建进程，否则就调用了realStartServiceLocked方法并将该进程的描述类ProcessRecord 作为参数传递进去，如果存在最后通过该应用程序描述类内部成员ApplicationThread启动Service。
上图为AMS的bindService的时序图，我们会发现AMS最后也是通过ActiveServices来实现的，源码如下：
//frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
public final class ActiveServices {
int bindServiceLocked(IApplicationThread caller, IBinder token, Intent service, String resolvedType, final IServiceConnection connection, int flags, String callingPackage, final int userId) throws TransactionTooLargeException {
//...省略代码...
if ((flags&Context.BIND_AUTO_CREATE) != 0) {
s.lastActivity = SystemClock.uptimeMillis();
//通过bringUpServiceLocked方法启动Service，过程跟上面过程一样
if (bringUpServiceLocked(s, service.getFlags(), callerFg, false, permissionsReviewRequired) != null) return 0;
}
//...省略代码(当前Service正在运行，这里的s就表示该Service，b.intent.received表示Service的Binder对象)...
if (s.app != null && b.intent.received) {
//如果Service正在运行并且已经获取到它的Binder,就进行Binder的connect方法回调
c.conn.connected(s.name, b.intent.binder);
if (b.intent.apps.size() == 1 && b.intent.doRebind)
requestServiceBindingLocked(s, b.intent, callerFg, true);
} else if (!b.intent.requested) {
//如果Service正在运行但是没有获取到它的Binder，通过该方法绑定服务
requestServiceBindingLocked(s, b.intent, callerFg, false);
}
getServiceMap(s.userId).ensureNotStartingBackground(s);
} finally {
Binder.restoreCallingIdentity(origId);
}
return 1;
}
private final boolean requestServiceBindingLocked(ServiceRecord r, IntentBindRecord i, boolean execInFg, boolean rebind) throws TransactionTooLargeException {
//...省略代码...
if ((!i.requested || rebind) && i.apps.size() > 0) {
bumpServiceExecutingLocked(r, execInFg, "bind");
r.app.forceProcessStateUpTo(ActivityManager.PROCESS_STATE_SERVICE);
//绑定Service，通过获取想绑定该Service的进程的ApplicationThread来实现
r.app.thread.scheduleBindService(r, i.intent.getIntent(), rebind, r.app.repProcState);
}
//...省略代码...
return true;
}
}
由上面代码可以总结bindServiceLocked流程如下：如果该Service首次启动就调用了bringUpServiceLocked方法来创建该Service；如果该Service已经存在并且想要绑定服务的进程拥有了该服务的Binder，通过c.conn.connected(s.name, b.intent.binder)来实现应用程序进程与该Service的连接绑定；如果该Service已经存在但是并没有得到Binder，就调用requestServiceBindingLocked方法将控制权交给了ApplicationThread。
从上面的两张时序图我们可以知道，在绑定Service的过程中，AMS最终通过ActivityThread来实现服务的绑定，在ActivityThread完成服务的绑定（应用进程回调了onBind方法）后最终回调了AMS的publishService方法，其实我们可以理解为publishService就是来实现应用程序进程的binder对象连接Service并最终回调了onServiceConnected的过程。其代码如下：
//frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
public final class ActiveServices {
void publishServiceLocked(ServiceRecord r, Intent intent, IBinder service) {
final long origId = Binder.clearCallingIdentity();
try {
//...省略代码...
for (int conni=r.connections.size()-1; conni>=0; conni--) {
ArrayList<ConnectionRecord> clist = r.connections.valueAt(conni);
for (int i=0; i<clist.size(); i++) {
//...省略代码(c.conn就是IServiceConnection，用于解决应用程序进程和Service跨进程通信问题)...
c.conn.connected(r.name, service);
}
}
}
serviceDoneExecutingLocked(r, mDestroyingServices.contains(r), false);
}
} finally {
Binder.restoreCallingIdentity(origId);
}
}
}c.conn指的是IServiceConnection，它的具体实现为ServiceDispatcher.InnerConnection，其中ServiceDispatcher是LoadedApk的内部类，ServiceDispatcher.InnerConnectiond的connected方法的代码如下：
//frameworks/base/core/java/android/app/LoadedApk.java
public final class LoadedApk {
private final ActivityThread mActivityThread; //应用程序进程主线程
final String mPackageName;
private ApplicationInfo mApplicationInfo;
public LoadedApk(ActivityThread activityThread, ApplicationInfo aInfo, CompatibilityInfo compatInfo, ClassLoader baseLoader, boolean securityViolation, boolean includeCode, boolean registerPackage) {
mActivityThread = activityThread;
setApplicationInfo(aInfo);
mPackageName = aInfo.packageName;
mBaseClassLoader = baseLoader;
mSecurityViolation = securityViolation;
mIncludeCode = includeCode;
mRegisterPackage = registerPackage;
mDisplayAdjustments.setCompatibilityInfo(compatInfo);
}
//ServiceDispatcher静态内部类
static final class ServiceDispatcher {
ServiceDispatcher(ServiceConnection conn, Context context, Handler activityThread, int flags) {
mIServiceConnection = new InnerConnection(this);
mConnection = conn;
mContext = context;
mActivityThread = activityThread;
mLocation = new ServiceConnectionLeaked(null);
mLocation.fillInStackTrace();
mFlags = flags;
}
//InnerConnection 是ServiceConnection在本地的代理
private static class InnerConnection extends IServiceConnection.Stub {
final WeakReference<LoadedApk.ServiceDispatcher> mDispatcher;
InnerConnection(LoadedApk.ServiceDispatcher sd) {
mDispatcher = new WeakReference<LoadedApk.ServiceDispatcher>(sd);
}
public void connected(ComponentName name, IBinder service, boolean dead) throws RemoteException {
LoadedApk.ServiceDispatcher sd = mDispatcher.get();
//实现了应用程序进程本地代理方式连接Service
if (sd != null) sd.connected(name, service, dead);
}
}
//InnerConnection.connected中最后调用了该方法
public void connected(ComponentName name, IBinder service, boolean dead) {
//如果主线程不为null，则主线程发送任务执行doConnected方法，否则直接调用doConnected
if (mActivityThread != null)
mActivityThread.post(new RunConnection(name, service, 0, dead));
else
doConnected(name, service, dead);
}
//这里有一个集合，用来存放当前Service所连接的所有ServiceConnect）
private final ArrayMap<ComponentName, ServiceDispatcher.ConnectionInfo> mActiveConnections = new ArrayMap<ComponentName, ServiceDispatcher.ConnectionInfo>();
public void doConnected(ComponentName name, IBinder service, boolean dead) {
ServiceDispatcher.ConnectionInfo old;
ServiceDispatcher.ConnectionInfo info;
synchronized (this) {
if (mForgotten)return;
//从集合中获取当前应用程序的ServiceConnect
old = mActiveConnections.get(name);
//如果集合中已经有ServiceConnect并相等表示当前操作重复连接直接退出
if (old != null && old.binder == service) return;
//如果ServiceConnect为null则创建一个，并将其添加到集合完成连接过程
if (service != null) {
info = new ConnectionInfo();
info.binder = service;
info.deathMonitor = new DeathMonitor(name, service);
service.linkToDeath(info.deathMonitor, 0);
mActiveConnections.put(name, info);
} else mActiveConnections.remove(name);
if (old != null)old.binder.unlinkToDeath(old.deathMonitor, 0);
}
//如果集合中以及存在其他的ServiceConnect则回调onServiceDisconnected
if (old != null)mConnection.onServiceDisconnected(name);
if (dead)mConnection.onBindingDied(name);
//因为上面已经将service(应用程序进程的本地代理)添加到当前Service的集合中因此完成了连接操作，回调onServiceConnected
if (service != null)mConnection.onServiceConnected(name, service);
}
}
}从这里可以总结一下Service的绑定过程，AMS将Service所有相关操作都封装在ActiveServices中，如下逻辑：
- 在bindServiceLocked方法中，如果Service没有被创建，通过bringUpServiceLocked方法创建Service（该方法最后会通过ActivityThread来调用Service的onCreate回调方法）；
- 在bindServiceLocked方法中，如果Service被创建了，且应用程序进程发送过绑定请求，则通过c.conn.connected(s.name, b.intent.binder)方式来连接该Service，最后还回调了onServiceConnected和onServiceDisconnected方法；
- 在bindServiceLocked方法中，如果Service被创建了，且应用程序进程并没有发送过绑定请求，则通过requestServiceBindingLocked方法绑定Service(该方法最后会通过ActivityThread来调用Service的onBind回调方法)，Service绑定后ActivityThread会通过publishService方法回调AMS，在publishService经过多层调用最终c.conn.connected(r.name, service)方式来实现应用程序进程连接Service；
3）、BroadcastReceiver：
//frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
public class ActivityManagerService extends IActivityManager.Stub{
public Intent registerReceiver(IApplicationThread caller, String callerPackage, IIntentReceiver receiver, IntentFilter filter, String permission, int userId, int flags) {
enforceNotIsolatedCaller("registerReceiver");
ArrayList<Intent> stickyIntents = null;
ProcessRecord callerApp = null;
int callingUid;
int callingPid;
synchronized(this) {
if (caller != null) {
//得到ProcessRecord对象，用于描述请求AMS注册广播的应用程序进程
callerApp = getRecordForAppLocked(caller);
callingUid = callerApp.info.uid;
callingPid = callerApp.pid;
} else {
callerPackage = null;
callingUid = Binder.getCallingUid();
callingPid = Binder.getCallingPid();
}
//得到fulter的action列表
Iterator<String> actions = filter.actionsIterator();
int[] userIds = { UserHandle.USER_ALL, UserHandle.getUserId(callingUid) };
//遍历action列表
while (actions.hasNext()) {
String action = actions.next();
for (int id : userIds) {
ArrayMap<String, ArrayList<Intent>> stickies = mStickyBroadcasts.get(id);
if (stickies != null) {
ArrayList<Intent> intents = stickies.get(action);
if (intents != null) {
if (stickyIntents == null)stickyIntents = new ArrayList<Intent>();
stickyIntents.addAll(intents);
}
}
}
}
}
//遍历寻找匹配的粘性广播
ArrayList<Intent> allSticky = null;
if (stickyIntents != null) {
final ContentResolver resolver = mContext.getContentResolver();
for (int i = 0, N = stickyIntents.size(); i < N; i++) {
Intent intent = stickyIntents.get(i);
if (instantApp && (intent.getFlags() & Intent.FLAG_RECEIVER_VISIBLE_TO_INSTANT_APPS) == 0) continue;
if (filter.match(resolver, intent, true, TAG) >= 0) {
if (allSticky == null)allSticky = new ArrayList<Intent>();
allSticky.add(intent);
}
}
}
//...省略代码...
synchronized (this) {
//获取存储广播接收者的列表 如果列表为null则进行创建
ReceiverList rl = mRegisteredReceivers.get(receiver.asBinder());
if (rl == null) {
rl = new ReceiverList(this, callerApp, callingPid, callingUid, userId, receiver);
if (rl.app != null) rl.app.receivers.add(rl);
mRegisteredReceivers.put(receiver.asBinder(), rl);
}
//...省略代码...
//BroadcastFilter用来描述注册的广播接收者
BroadcastFilter bf = new BroadcastFilter(filter, rl, callerPackage, permission, callingUid, userId, instantApp, visibleToInstantApps);
//将广播接收者添加到ReceiverList 集合
rl.add(bf);
//当AMS接收到广播时就可以从mReceiverResolver中找到对应的广播接收者了，从而达到了注册广播的目的
mReceiverResolver.addFilter(bf);
//...省略代码...
return sticky;
}
}
public void unregisterReceiver(IIntentReceiver receiver) {
try {
boolean doTrim = false;
synchronized(this) {
//获取存储广播接收者的列表
ReceiverList rl = mRegisteredReceivers.get(receiver.asBinder());
if (rl != null) {
final BroadcastRecord r = rl.curBroadcast;
if (r != null && r == r.queue.getMatchingOrderedReceiver(r)) {
final boolean doNext = r.queue.finishReceiverLocked( r, r.resultCode, r.resultData, r.resultExtras, r.resultAbort, false);
}
//将广播接收者从列表中删除
if (rl.app != null) rl.app.receivers.remove(rl);
removeReceiverLocked(rl);
if (rl.linkedToDeath) {
rl.linkedToDeath = false;
rl.receiver.asBinder().unlinkToDeath(rl, 0);
}
}
}
} finally {
Binder.restoreCallingIdentity(origId);
}
}
}上面广播的注册与取消注册最终在AMS里面的实现写的乱七八糟，但是大概可以看出的轮廓就是AMS其实用了观察者的模式，内部维护了一个集合，注册的时候把广播接收者添加到列表，取消注册的从列表删除，党AMS接收到广播时就可以从mReceiverResolver中找到对应的广播接收者了，从而达到了注册广播的目的。
上面时序图可以知道AMS最终将所有的广播接收者封装在了receivers集合中，并通过这个集合生成了BroadcastQueue对象，在发送广播事件的时候，最终还是调用该对象的scheduleBroadcastsLocked方法，代码如下：
//frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
public class ActivityManagerService extends IActivityManager.Stub{
public final int broadcastIntent(IApplicationThread caller, Intent intent, String resolvedType, IIntentReceiver resultTo, int resultCode, String resultData, Bundle resultExtras, String[] requiredPermissions, int appOp, Bundle bOptions, boolean serialized, boolean sticky, int userId) {
synchronized(this) {
//验证广播的合法性
intent = verifyBroadcastLocked(intent);
final ProcessRecord callerApp = getRecordForAppLocked(caller);
final int callingPid = Binder.getCallingPid();
final int callingUid = Binder.getCallingUid();
final long origId = Binder.clearCallingIdentity();
//发送广播事件
int res = broadcastIntentLocked(callerApp, callerApp != null ? callerApp.info.packageName : null, intent, resolvedType, resultTo, resultCode, resultData, resultExtras, requiredPermissions, appOp, bOptions, serialized, sticky, callingPid, callingUid, userId);
Binder.restoreCallingIdentity(origId);
return res;
}
}
final int broadcastIntentLocked(ProcessRecord callerApp, String callerPackage, Intent intent, String resolvedType, IIntentReceiver resultTo, int resultCode, String resultData, Bundle resultExtras, String[] requiredPermissions, int appOp, Bundle bOptions, boolean ordered, boolean sticky, int callingPid, int callingUid, int userId) {
//...省略代码(主要是将动态注册和静态注册的广播接收者按照优先级高低存在不同列表然后合并到receivers中)...
if ((receivers != null && receivers.size() > 0) || resultTo != null) {
BroadcastQueue queue = broadcastQueueForIntent(intent);
//创建BroadcastRecord ,并将上面的列表receivers传递了进去
BroadcastRecord r = new BroadcastRecord(queue, intent, callerApp, callerPackage, callingPid, callingUid, resolvedType, requiredPermissions, appOp, brOptions, receivers, resultTo, resultCode, resultData, resultExtras, ordered, sticky, false, userId);
//...省略代码...
boolean replaced = replacePending && queue.replaceOrderedBroadcastLocked(r);
if (!replaced) {
queue.enqueueOrderedBroadcastLocked(r);
//调用BroadcastQueue的方法进行发送事件
queue.scheduleBroadcastsLocked();
}
}
return ActivityManager.BROADCAST_SUCCESS;
}
}在BroadcastQueue中，有两个列表分别存储了需要发送的无序广播和有序广播，最后在收到BROADCAST_INTENT_MSG事件的时候遍历上面讲解的receivers里面的所有成员（所有注册过的广播接收者），并调用deliverToRegisteredReceiverLocked方法将每一个广播发送出去，在performReceiveLocked方法中获取到了广播接收者的app.thread，跟上面Service同样的方式将控制权交给了ApplicationThread。
//frameworks/base/services/core/java/com/android/server/am/BroadcastQueue.java
public final class BroadcastQueue {
//持有AMS的引用
final ActivityManagerService mService;
//无序广播列表
final ArrayList<BroadcastRecord> mParallelBroadcasts = new ArrayList<>();
//有序广播列表
final ArrayList<BroadcastRecord> mOrderedBroadcasts = new ArrayList<>();
//发送广播和取消广播用了handler机制来区分两种消息
final BroadcastHandler mHandler;
private final class BroadcastHandler extends Handler {
public BroadcastHandler(Looper looper) {
super(looper, null, true);
}
@Override
public void handleMessage(Message msg) {
switch (msg.what) {
//发送广播事件消息
case BROADCAST_INTENT_MSG: {
processNextBroadcast(true);
} break;
//广播事件超时或者取消发送广播事件消息
case BROADCAST_TIMEOUT_MSG: {
synchronized (mService) {
broadcastTimeoutLocked(true);
}
} break;
}
}
}
//AMS最后BroadcastQueue的这个方法，这个方法内部向Handler发送了BROADCAST_INTENT_MSG事件
public void scheduleBroadcastsLocked() {
if (mBroadcastsScheduled) return;
mHandler.sendMessage(mHandler.obtainMessage(BROADCAST_INTENT_MSG, this));
mBroadcastsScheduled = true;
}
//Handler的BROADCAST_INTENT_MSG事件直接调用了该方法
final void processNextBroadcast(boolean fromMsg) {
//...省略代码...
//遍历存储无序广播的集合mParallelBroadcasts
while (mParallelBroadcasts.size() > 0) {
//获取每一个mParallelBroadcasts的成员r，这些对象描述的广播发送给对应的广播接收者
r = mParallelBroadcasts.remove(0);
for (int i=0; i<N; i++) {
Object target = r.receivers.get(i);
//将每一个广播发送出去
deliverToRegisteredReceiverLocked(r, (BroadcastFilter)target, false, i);
}
}
//...省略代码...
}
//最后通过该方法将每一个广播发送出去
private void deliverToRegisteredReceiverLocked(BroadcastRecord r, BroadcastFilter filter, boolean ordered, int index) {
//...省略代码...
try {
//发送广播，参数1为注册过的广播接收者列表中的对应每个应用程序进程
performReceiveLocked(filter.receiverList.app, filter.receiverList.receiver, new Intent(r.intent), r.resultCode, r.resultData, r.resultExtras, r.ordered, r.initialSticky, r.userId);
if (ordered) r.state = BroadcastRecord.CALL_DONE_RECEIVE;
} catch (RemoteException e) {
}
//...省略代码...
}
//最终还是通过应用程序进程的app.thread来进行调用广播接收者
void performReceiveLocked(ProcessRecord app, IIntentReceiver receiver, Intent intent, int resultCode, String data, Bundle extras, boolean ordered, boolean sticky, int sendingUser) throws RemoteException {
if (app != null) {
if (app.thread != null) {
try {
app.thread.scheduleRegisteredReceiver(receiver, intent, resultCode, data, extras, ordered, sticky, sendingUser, app.repProcState);
}
}
//...省略代码...
} else {
receiver.performReceive(intent, resultCode, data, extras, ordered, sticky, sendingUser);
}
}
}3、ActivityThread进行事件分发：
在分析应用程序进程的启动过程中，我们知道Zygote进程在for出子进程后经过一系列的初始化操作，最后会通过反射的方式调用ActivityThread的main方法，因此ActivityThread的main被作为应用程序进程的入口，而ActivityThread也通常被作为应用程序进程的主线程，ActivityThread源码如下：
//frameworks/base/core/java/android/app/ActivityThread.java
public final class ActivityThread {
final ApplicationThread mAppThread = new ApplicationThread();
final Looper mLooper = Looper.myLooper();
final H mH = new H();
//ApplicationThread继承了IApplicationThread.Stub 因此被ActivityThread用来进行跨进程通信
private class ApplicationThread extends IApplicationThread.Stub {
//main方法中调用了AMS的attachApplication方法， AMS最终回调了该方法发送H.BIND_APPLICATION事件
public final void bindApplication(String processName, ApplicationInfo appInfo, List<ProviderInfo> providers, ComponentName instrumentationName, ProfilerInfo profilerInfo, Bundle instrumentationArgs, IInstrumentationWatcher instrumentationWatcher, IUiAutomationConnection instrumentationUiConnection, int debugMode, boolean enableBinderTracking, boolean trackAllocation, boolean isRestrictedBackupMode, boolean persistent, Configuration config, CompatibilityInfo compatInfo, Map services, Bundle coreSettings, String buildSerial) {
if (services != null)ServiceManager.initServiceCache(services);
setCoreSettings(coreSettings);
AppBindData data = new AppBindData();
data.processName = processName;
data.appInfo = appInfo;
//...省略代码...
data.buildSerial = buildSerial;
sendMessage(H.BIND_APPLICATION, data);
}
//启动根Activity 最终发送了H.LAUNCH_ACTIVITY事件
public final void scheduleLaunchActivity(Intent intent, IBinder token, int ident, ActivityInfo info, Configuration curConfig, Configuration overrideConfig, CompatibilityInfo compatInfo, String referrer, IVoiceInteractor voiceInteractor, int procState, Bundle state, PersistableBundle persistentState, List<ResultInfo> pendingResults, List<ReferrerIntent> pendingNewIntents, boolean notResumed, boolean isForward, ProfilerInfo profilerInfo) {
updateProcessState(procState, false);
ActivityClientRecord r = new ActivityClientRecord();
r.token = token;
r.ident = ident;
r.intent = intent;
//...省略代码...
r.overrideConfig = overrideConfig;
updatePendingConfiguration(curConfig);
sendMessage(H.LAUNCH_ACTIVITY, r);
}
//创建Service 最终发送了H.CREATE_SERVICE事件
public final void scheduleCreateService(IBinder token, ServiceInfo info, CompatibilityInfo compatInfo, int processState) {
updateProcessState(processState, false);
CreateServiceData s = new CreateServiceData();
s.token = token;
s.info = info;
s.compatInfo = compatInfo;
sendMessage(H.CREATE_SERVICE, s);
}
//绑定Service 最终发送了H.BIND_SERVICE事件
public final void scheduleBindService(IBinder token, Intent intent, boolean rebind, int processState) {
updateProcessState(processState, false);
BindServiceData s = new BindServiceData();
s.token = token;
s.intent = intent;
s.rebind = rebind;
sendMessage(H.BIND_SERVICE, s);
}
//取消绑定Service 最终发送了H.UNBIND_SERVICE事件
public final void scheduleUnbindService(IBinder token, Intent intent) {
BindServiceData s = new BindServiceData();
s.token = token;
s.intent = intent;
sendMessage(H.UNBIND_SERVICE, s);
}
//发送广播事件，AMS调用该方法
public void scheduleRegisteredReceiver(IIntentReceiver receiver, Intent intent, int resultCode, String dataStr, Bundle extras, boolean ordered, boolean sticky, int sendingUser, int processState) throws RemoteException {
updateProcessState(processState, false);
receiver.performReceive(intent, resultCode, dataStr, extras, ordered, sticky, sendingUser);
}
}
//发送事件，其实是通过mH发送
private void sendMessage(int what, Object obj, int arg1, int arg2, boolean async) {
Message msg = Message.obtain();
msg.what = what;
msg.obj = obj;
msg.arg1 = arg1;
msg.arg2 = arg2;
if (async)msg.setAsynchronous(true);
mH.sendMessage(msg);
}
private class H extends Handler {
public void handleMessage(Message msg) {
switch (msg.what) {
//AMS回调Application的创建
case BIND_APPLICATION:
AppBindData data = (AppBindData)msg.obj;
handleBindApplication(data);
break;
//Application的终止，直接停止了Looper循环
case EXIT_APPLICATION:
if (mInitialApplication != null) mInitialApplication.onTerminate();
Looper.myLooper().quit();
break;
//根Activity的创建 调用handleLaunchActivity
case LAUNCH_ACTIVITY: {
final ActivityClientRecord r = (ActivityClientRecord) msg.obj;
r.packageInfo = getPackageInfoNoCheck( r.activityInfo.applicationInfo, r.compatInfo);
handleLaunchActivity(r, null, "LAUNCH_ACTIVITY");
} break;
//Service的创建
case CREATE_SERVICE:
handleCreateService((CreateServiceData)msg.obj);
break;
//Service的绑定
case BIND_SERVICE:
handleBindService((BindServiceData)msg.obj);
break;
//Service的取消绑定
case UNBIND_SERVICE:
handleUnbindService((BindServiceData)msg.obj);
break;
}
}
}
}从上面的代码可以知道，AMS最终都调用了ApplicationThread 的方法，而ApplicationThread是ActivityThread用来作为进程间通信的内部类接口，在此内部类的方法中都是用了Handler模式进行事件处理。
//frameworks/base/core/java/android/app/ActivityThread.java
public final class ActivityThread {
//创建应用程序的Application和应用程序的初始化
private void handleBindApplication(AppBindData data) {
//...省略代码...
try {
//创建Application
Application app = data.info.makeApplication(data.restrictedBackupMode, null);
mInitialApplication = app;
//回调Application.onCreate方法
try {
mInstrumentation.onCreate(data.instrumentationArgs);
}catch (Exception e) {
throw new RuntimeException( "Exception thrown in onCreate() of " + data.instrumentationName + ": " + e.toString(), e);
}
try {
mInstrumentation.callApplicationOnCreate(app);
} catch (Exception e) {
if (!mInstrumentation.onException(app, e))throw new RuntimeException( "Unable to create application " + app.getClass().getName() + ": " + e.toString(), e);
}
} finally {
StrictMode.setThreadPolicy(savedPolicy);
}
}
}在应用程序进程被创建执行了ActivityThread.main方法后，先调用AMS在被回调handleBindApplication方法创建Application，并回调了onCreate方法，因此Application.onCreate的生命周期比其他的组件的生命周期都早。
//frameworks/base/core/java/android/app/ActivityThread.java
public final class ActivityThread {
private void handleLaunchActivity(ActivityClientRecord r, Intent customIntent, String reason) {
//...省略代码...
//初始化WM，WindowManagerGlobal中维护Window窗口的添加更新删除等操作
WindowManagerGlobal.initialize();
//启动Activity依次回调了onCreate/onStart方法
Activity a = performLaunchActivity(r, customIntent);
if (a != null) {
r.createdConfig = new Configuration(mConfiguration);
reportSizeConfigurations(r);
Bundle oldState = r.state;
//将Activity状态设置为可见 回调了onResume方法
handleResumeActivity(r.token, false, r.isForward, !r.activity.mFinished && !r.startsNotResumed, r.lastProcessedSeq, reason);
if (!r.activity.mFinished && r.startsNotResumed) {
performPauseActivityIfNeeded(r, reason);
if (r.isPreHoneycomb())r.state = oldState;
}
} else {
//如果Activity为null,通知AMS终止Activity
ActivityManager.getService().finishActivity(r.token, Activity.RESULT_CANCELED, null, Activity.DONT_FINISH_TASK_WITH_ACTIVITY);
}
}
//启动创建Activity
private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
//获取ActivityInfo类
ActivityInfo aInfo = r.activityInfo;
//获取APK文件的描述类LoadedApk
if (r.packageInfo == null) r.packageInfo = getPackageInfo(aInfo.applicationInfo, r.compatInfo, Context.CONTEXT_INCLUDE_CODE);
//获取要启动的Activity的ComponentName
ComponentName component = r.intent.getComponent();
if (component == null) {
component = r.intent.resolveActivity( mInitialApplication.getPackageManager());
r.intent.setComponent(component);
}
if (r.activityInfo.targetActivity != null) component = new ComponentName(r.activityInfo.packageName, r.activityInfo.targetActivity);
//创建要启动的Activity的上下文环境
ContextImpl appContext = createBaseContextForActivity(r);
Activity activity = null;
try {
//用类加载器来创建该Activity的实例
java.lang.ClassLoader cl = appContext.getClassLoader();
activity = mInstrumentation.newActivity( cl, component.getClassName(), r.intent);
StrictMode.incrementExpectedActivityCount(activity.getClass());
r.intent.setExtrasClassLoader(cl);
r.intent.prepareToEnterProcess();
if (r.state != null) r.state.setClassLoader(cl);
} catch (Exception e) { }
try {
Application app = r.packageInfo.makeApplication(false, mInstrumentation);
if (activity != null) {
Window window = null;
if (r.mPendingRemoveWindow != null && r.mPreserveWindow) {
window = r.mPendingRemoveWindow;
r.mPendingRemoveWindow = null;
r.mPendingRemoveWindowManager = null;
}
appContext.setOuterContext(activity);
//初始化Activity ，在该方法中会创建PhoneWindow对象并与Activity自身进行关联
activity.attach(appContext, this, getInstrumentation(), r.token, r.ident, app, r.intent, r.activityInfo, title, r.parent, r.embeddedID, r.lastNonConfigurationInstances, config, r.referrer, r.voiceInteractor, window, r.configCallback);
//给Activity设置主题
int theme = r.activityInfo.getThemeResource();
if (theme != 0) activity.setTheme(theme);
activity.mCalled = false;
//callActivityOnCreate方法中会回调Activity的onCreate方法
if (r.isPersistable()) mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
else mInstrumentation.callActivityOnCreate(activity, r.state);
//performStart该方法中会回调Activity的onStart方法
r.activity = activity;
r.stopped = true;
if (!r.activity.mFinished) {
activity.performStart();
r.stopped = false;
}
if (!r.activity.mFinished) {
if (r.isPersistable())
if (r.state != null || r.persistentState != null) mInstrumentation.callActivityOnRestoreInstanceState(activity, r.state, r.persistentState);
else if (r.state != null)
mInstrumentation.callActivityOnRestoreInstanceState(activity, r.state);
}
if (!r.activity.mFinished) {
activity.mCalled = false;
if (r.isPersistable())
mInstrumentation.callActivityOnPostCreate(activity, r.state, r.persistentState);
else
mInstrumentation.callActivityOnPostCreate(activity, r.state);
}
}
r.paused = true;
mActivities.put(r.token, r);
}catch (Exception e) { }
return activity;
}
}主线程ActivityThread在启动Activity的时候，先获取了ActivityInfo（存储设置的Activity的节点信息，如theme和launchMode），然后创建了该Activity的上下文，通过类加载器创建Activity的实例，先调用attach方法进行初始化（创建Window对象并与自身关联），后面依次回调了onCreate、onStart、onResume等方法。
//frameworks/base/core/java/android/app/ActivityThread.java
public final class ActivityThread {
//创建Service
private void handleCreateService(CreateServiceData data) {
unscheduleGcIdler();
//获取要启动Service的应用程序的LoadedApk
LoadedApk packageInfo = getPackageInfoNoCheck( data.info.applicationInfo, data.compatInfo);
Service service = null;
//获取类加载器
java.lang.ClassLoader cl = packageInfo.getClassLoader();
//创建Service实例
service = (Service) cl.loadClass(data.info.name).newInstance();
try {
//创建Service的上下文环境对象
ContextImpl context = ContextImpl.createAppContext(this, packageInfo);
context.setOuterContext(service);
Application app = packageInfo.makeApplication(false, mInstrumentation);
//初始化Service
service.attach(context, this, data.info.name, data.token, app, ActivityManager.getService());
//启动Service 回调onCreate方法
service.onCreate();
//将被创建的Service加载到ActivityThread的成员变量mServices中，进行统一管理
mServices.put(data.token, service);
//被启动的Service交给AMS进行一些逻辑处理
ActivityManager.getService().serviceDoneExecuting( data.token, SERVICE_DONE_EXECUTING_ANON, 0, 0);
} catch (Exception e) { }
}
//绑定Service
private void handleBindService(BindServiceData data) {
//获取要绑定的Service
Service s = mServices.get(data.token);
if (s != null) {
try {
data.intent.setExtrasClassLoader(s.getClassLoader());
data.intent.prepareToEnterProcess();
try {
if (!data.rebind) {
//第一次绑定该Service 回调onBind方法
IBinder binder = s.onBind(data.intent);
//Service未被绑定的情况 通过AMS的publishService方法连接该Service
ActivityManager.getService().publishService( data.token, data.intent, binder);
} else {
//已经绑定过该Service 回调onRebind方法
s.onRebind(data.intent);
//因为已经连接上了该Service，所以处理逻辑跟创建Service的一样
ActivityManager.getService().serviceDoneExecuting( data.token, SERVICE_DONE_EXECUTING_ANON, 0, 0);
}
ensureJitEnabled();
} catch (RemoteException ex) {
throw ex.rethrowFromSystemServer();
}
} catch (Exception e) {
}
}
}
//取消绑定Service
private void handleUnbindService(BindServiceData data) {
Service s = mServices.get(data.token);
if (s != null) {
try {
data.intent.setExtrasClassLoader(s.getClassLoader());
data.intent.prepareToEnterProcess();
boolean doRebind = s.onUnbind(data.intent);
try {
if (doRebind)
ActivityManager.getService().unbindFinished(data.token, data.intent, doRebind);
else
ActivityManager.getService().serviceDoneExecuting( data.token, SERVICE_DONE_EXECUTING_ANON, 0, 0);
} catch (RemoteException ex) {
throw ex.rethrowFromSystemServer();
}
} catch (Exception e) {
}
}
}
}4、总结：
当我们在安卓桌面点击了一个应用程序的图标后，就会启动该应用，其流程如下图：
4681
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
