创建Socket建立连接
ActivityTaskManagerService.startProcessAsync()
void startProcessAsync(ActivityRecord activity, boolean knownToBeDead, boolean isTop, String hostingType) { try { if (Trace.isTagEnabled(TRACE_TAG_WINDOW_MANAGER)) { Trace.traceBegin(TRACE_TAG_WINDOW_MANAGER, "dispatchingStartProcess:" + activity.processName); } // Post message to start process to avoid possible deadlock of calling into AMS with the // ATMS lock held. final Message m = PooledLambda.obtainMessage(ActivityManagerInternal::startProcess, mAmInternal, activity.processName, activity.info.applicationInfo, knownToBeDead, isTop, hostingType, activity.intent.getComponent()); mH.sendMessage(m); } finally { Trace.traceEnd(TRACE_TAG_WINDOW_MANAGER); } }
通过handler发消息执行ActivityManagerInternal.startProcess() ，内部又转调用ActivityManagerService.startProcessLocked() :
@GuardedBy("this") final ProcessRecord startProcessLocked(String processName, ApplicationInfo info, boolean knownToBeDead, int intentFlags, HostingRecord hostingRecord, int zygotePolicyFlags, boolean allowWhileBooting, boolean isolated, boolean keepIfLarge) { return mProcessList.startProcessLocked(processName, info, knownToBeDead, intentFlags, hostingRecord, zygotePolicyFlags, allowWhileBooting, isolated, 0 /* isolatedUid */, keepIfLarge, null /* ABI override */, null /* entryPoint */, null /* entryPointArgs */, null /* crashHandler */); }
mProcessList类型是ProcessList，这是一个进程管理类，描述了进程的adj值，当系统资源吃紧时，就会根据这里描述的adj去判断杀死哪个应用来释放资源，可以通过adb shell dumpsys meminfo来查看当前所有进程的分类情况，接着来看下ProcessList.startProcessLocked():
// ProcessList.java final ProcessRecord startProcessLocked(String processName, ApplicationInfo info, boolean knownToBeDead, int intentFlags, HostingRecord hostingRecord, boolean allowWhileBooting, boolean isolated, int isolatedUid, boolean keepIfLarge, String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) { ProcessRecord app; ... ... checkSlow(startTime, "startProcess: stepping in to startProcess"); final boolean success = startProcessLocked(app, hostingRecord, abiOverride); checkSlow(startTime, "startProcess: done starting proc!"); return success ? app : null; } boolean startProcessLocked(ProcessRecord app, HostingRecord hostingRecord, boolean disableHiddenApiChecks, boolean mountExtStorageFull, String abiOverride) { ... ... try { ... ... // Start the process. It will either succeed and return a result containing // the PID of the new process, or else throw a RuntimeException. final String entryPoint = "android.app.ActivityThread"; return startProcessLocked(hostingRecord, entryPoint, app, uid, gids, runtimeFlags, mountExternal, seInfo, requiredAbi, instructionSet, invokeWith, startTime); } catch (RuntimeException e) { Slog.e(ActivityManagerService.TAG, "Failure starting process " + app.processName, e); // Something went very wrong while trying to start this process; one // common case is when the package is frozen due to an active // upgrade. To recover, clean up any active bookkeeping related to // starting this process. (We already invoked this method once when // the package was initially frozen through KILL_APPLICATION_MSG, so // it doesn't hurt to use it again.) mService.forceStopPackageLocked(app.info.packageName, UserHandle.getAppId(app.uid), false, false, true, false, false, app.userId, "start failure"); return false; } } boolean startProcessLocked(HostingRecord hostingRecord,String entryPoint, ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal, String seInfo, String requiredAbi, String instructionSet, String invokeWith,long startTime) { ... ... final Process.ProcessStartResult startResult = startProcess(app.hostingRecord,entryPoint, app, app.startUid, gids, runtimeFlags, mountExternal,app.seInfo, requiredAbi, instructionSet, invokeWith, app.startTime); ... ... } private Process.ProcessStartResult startProcess(HostingRecord hostingRecord, String entryPoint, ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal, String seInfo, String requiredAbi, String instructionSet, String invokeWith, long startTime) { try { Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "Start proc: " + app.processName); checkSlow(startTime, "startProcess: asking zygote to start proc"); final Process.ProcessStartResult startResult; if (hostingRecord.usesWebviewZygote()) { ... ... } else if (hostingRecord.usesAppZygote()) { final AppZygote appZygote = createAppZygoteForProcessIfNeeded(app); startResult = appZygote.getProcess().start(entryPoint, app.processName, uid, uid, gids, runtimeFlags, mountExternal, app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet, app.info.dataDir, null, app.info.packageName, /*useUsapPool=*/ false, new String[] {PROC_START_SEQ_IDENT + app.startSeq}); } else { ... ... } checkSlow(startTime, "startProcess: returned from zygote!"); return startResult; } finally { Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER); } }
这里有几个我们需要关注的点，一个是第二个方法定义的entryPoint="android.app.ActivityThread"，这个就是后面创建进程时会通过反射调用到的类，再来看最后一个方法，这里会执行else if语句，也就是执行ZygoteProcess的start（）方法。最终到 ZygoteProcess 的attemptUsapSendArgsAndGetResult 通过 Socket 通信，fork 一个新的 Launcher 进程，调用过程如图：
ZygoteProcess.attemptZygoteSendArgsAndGetResult()
// ZygoteProcess.java private Process.ProcessStartResult attemptZygoteSendArgsAndGetResult( ZygoteState zygoteState, String msgStr) throws ZygoteStartFailedEx { try { final BufferedWriter zygoteWriter = zygoteState.mZygoteOutputWriter; final DataInputStream zygoteInputStream = zygoteState.mZygoteInputStream; zygoteWriter.write(msgStr);把应用进程的一些参数写给前面连接的zygote进程 zygoteWriter.flush();//进入Zygote进程，处于阻塞状态 //从socket中得到zygote创建的应用pid，赋值给 ProcessStartResult的对象 Process.ProcessStartResult result = new Process.ProcessStartResult(); result.pid = zygoteInputStream.readInt(); result.usingWrapper = zygoteInputStream.readBoolean(); return result; } catch (IOException ex) { zygoteState.close(); } }
Zygote进程处理
ZygoteInit.main
public static void main(String argv[]) { Runnable caller; if (startSystemServer) { //Zygote Fork出的第一个进程 SystmeServer Runnable r = forkSystemServer(abiList, zygoteSocketName, zygoteServer); if (r != null) { r.run(); return; } } //循环等待fork出其他的应用进程，比如Launcher caller = zygoteServer.runSelectLoop(abiList); ... if (caller != null) { caller.run(); //执行runSelectLoop返回的Runnable对象，进入子进程 } }
ZygoteServer.runSelectLoop
Runnable runSelectLoop(String abiList) { while (true) { int pollReturnValue; try { //epoll机制 循环 pollReturnValue = Os.poll(pollFDs, pollTimeoutMs); } catch (ErrnoException ex) { throw new RuntimeException("poll failed", ex); } ... //来了消息后，调用processOneCommand()来进行进程的处理 final Runnable command = connection.processOneCommand(this); } }
ZygoteConnection.processOneCommand
Runnable processOneCommand(ZygoteServer zygoteServer) { //fork进程，得到新进程pid //pid=0 表示Zygote fork子进程成功 //pid > 0 表示子进程 的真正的PID pid = Zygote.forkAndSpecialize(parsedArgs.mUid, parsedArgs.mGid, parsedArgs.mGids, parsedArgs.mRuntimeFlags, rlimits, parsedArgs.mMountExternal, parsedArgs.mSeInfo, parsedArgs.mNiceName, fdsToClose, fdsToIgnore, parsedArgs.mStartChildZygote, parsedArgs.mInstructionSet, parsedArgs.mAppDataDir, parsedArgs.mIsTopApp, parsedArgs.mPkgDataInfoList, parsedArgs.mWhitelistedDataInfoList, parsedArgs.mBindMountAppDataDirs, parsedArgs.mBindMountAppStorageDirs); try { //fork成功，第一次返回的pid = 0 if (pid == 0) { return handleChildProc(parsedArgs, childPipeFd, parsedArgs.mStartChildZygote); } else { handleParentProc(pid, serverPipeFd); return null; } }
** ZygoteConnection.handleChildProc**
这里主要执行到 ZygoteInit.zygoteInit，zygoteInit 进行一些环境的初始化、启动Binder进程等操作，最终反射执行 ActivityThread.main
private Runnable handleChildProc(ZygoteArguments parsedArgs, FileDescriptor pipeFd, boolean isZygote) { closeSocket(); Zygote.setAppProcessName(parsedArgs, TAG); if (!isZygote) { //App进程将会调用到这里，最终反射执行ActivityThread.main return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion, parsedArgs.mDisabledCompatChanges, parsedArgs.mRemainingArgs, null /* classLoader */); } else { return ZygoteInit.childZygoteInit(parsedArgs.mTargetSdkVersion, parsedArgs.mRemainingArgs, null /* classLoader */); } }
Zygote进程调用栈:
ActivityThread中处理
Zygote fork出了 Launcher 的进程，并把接下来的 Launcher 启动任务交给了 ActivityThread 来进行，接下来我们就从 ActivityThread.main方法来分析 Launcher 的创建过程。
// ActivityThread.java public static void main(String[] args) { Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ActivityThreadMain"); ... ... //创建主线程Looper Looper.prepareMainLooper(); ... ... ActivityThread thread = new ActivityThread(); //执行attach ... ... thread.attach(false, startSeq); //开启循环 ... ... Looper.loop(); throw new RuntimeException("Main thread loop unexpectedly exited"); }
这里就是android层面划分为一个应用进程的开始，初始化一个looper，也就是android中说的主线程，并开始looper循环，这里调用到了ActivitThread.attach() :
// ActivityThread.java private void attach(boolean system, long startSeq) { sCurrentActivityThread = this; mSystemThread = system; if (!system) { ... ... // 这里会拿到ActivityManagerService的代理 final IActivityManager mgr = ActivityManager.getService(); try { //应用的句柄发给AMS，从而使AMS可以管理新进程 mgr.attachApplication(mAppThread, startSeq); } catch (RemoteException ex) { throw ex.rethrowFromSystemServer(); } ... ... } else { // 在前面讲Zygote进程的时候，里面创建ActivityThread就会执行到这里 } //当系统配置发生变更时会执行这个回调 ViewRootImpl.ConfigChangedCallback configChangedCallback = (Configuration globalConfig) -> { ... ... }; ViewRootImpl.addConfigCallback(configChangedCallback); }
这里会执行if语句里面的内容，mAppThread的类型是ApplicationThread，这个类的主要作用是在ActivityManagerService中回调回ActivityThread中来，mgr是ActivityManagerService的代理，在执行它的ActivityManagerService.attachApplication() 方法：
// ActivityManagerService.java public final void attachApplication(IApplicationThread thread, long startSeq) { synchronized (this) { int callingPid = Binder.getCallingPid(); final int callingUid = Binder.getCallingUid(); final long origId = Binder.clearCallingIdentity(); attachApplicationLocked(thread, callingPid, callingUid, startSeq); Binder.restoreCallingIdentity(origId); } }
ActivityManagerService.attachApplicationLocked()
调用AMS的 attachApplication()，最终层层调用到 ActivityStackSupervisor 的 realStartActivityLocked，真正准备去启动Activity。
private final boolean attachApplicationLocked(IApplicationThread thread,int pid, int callingUid, long startSeq) { ... ... //这里会去调用ActivityThrea的bindApplication(),也就是会去创建Application thread.bindApplication(... ...) ... ... //如果当前的Application记录仍然依附到之前的进程中，则清理掉 if (app.thread != null) { handleAppDiedLocked(app, true, true); } ... ... // See if the top visible activity is waiting to run in this process... if (normalMode) { try { //调用ActivityTaskManagerService的attachApplication()，最终层层调用到ActivityStackSupervisor.java的 realStartActivityLocked() didSomething = mAtmInternal.attachApplication(app.getWindowProcessController()); } catch (Exception e) { Slog.wtf(TAG, "Exception thrown launching activities in " + app, e); badApp = true; } } ... ... }
这里通过AMS最终会调用到ActivityStackSupervisor.realStartActivityLocked()：
// ActivityStackSupervisor.java boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc, boolean andResume, boolean checkConfig) throws RemoteException { //确保所有的Activity执行了onPause才会往下继续执行 if (!mRootActivityContainer.allPausedActivitiesComplete()) { // While there are activities pausing we skipping starting any new activities until // pauses are complete. NOTE: that we also do this for activities that are starting in // the paused state because they will first be resumed then paused on the client side. if (DEBUG_SWITCH || DEBUG_PAUSE || DEBUG_STATES) Slog.v(TAG_PAUSE, "realStartActivityLocked: Skipping start of r=" + r + " some activities pausing..."); return false; } ... ... try { ... ... try{ ... ... // Create activity launch transaction. final ClientTransaction clientTransaction = ClientTransaction.obtain( proc.getThread(), r.appToken); final DisplayContent dc = r.getDisplay().mDisplayContent; //在回调序列的末尾添加一条消息 clientTransaction.addCallback(LaunchActivityItem.obtain(... ...)); // Set desired final state. final ActivityLifecycleItem lifecycleItem; if (andResume) { lifecycleItem = ResumeActivityItem.obtain(dc.isNextTransitionForward()); } else { lifecycleItem = PauseActivityItem.obtain(); } //添加最后执行的生命周期状态 clientTransaction.setLifecycleStateRequest(lifecycleItem); // 这里其实就是执行ClientTransaction的schedule()方法 mService.getLifecycleManager().scheduleTransaction(clientTransaction); ... ... } catch (RemoteException e) { if (r.launchFailed) { // 第二次启动失败，finish activity并放弃启动 Slog.e(TAG, "Second failure launching " + r.intent.getComponent().flattenToShortString() + ", giving up", e); proc.appDied(); stack.requestFinishActivityLocked(r.appToken, Activity.RESULT_CANCELED, null, "2nd-crash", false); return false; } //第一次启动失败，尝试重启进程 r.launchFailed = true; proc.removeActivity(r); throw e; } } finally { endDeferResume(); } ... ... return true; }
ActivityThread调用栈:
小结
至此已经走到 realStartActivityLocked，接下来就是 Activity 的启动流程，Activity 启动下篇文章会单独分析。总结一下 Launcher 启动流程，Launcher的启动经过了三个阶段：
1、SystemServer 创建AMS和ATMS，通过 SystemReady 进入 LauncherActivity 的调用
2、Zygote 进程 fork 出 Launcher 进程，通过 Socket 进行通信
3、进入 ActivityThread 的处理，完成 Launcher 的 Acitivty 启动
