本文基於 Android 9.0 , 代碼倉庫地址 ： "android_9.0.0_r45" 系列文章目錄： "Java 世界的盤古和女媧 —— Zygote" "Zygote 家的大兒子 —— SystemServer" "Android 世界中，誰喊醒了 Zygote ？" 文中相關源碼鏈接： ...
本文基於 Android 9.0 , 代碼倉庫地址 ： android_9.0.0_r45
系列文章目錄：
文中相關源碼鏈接：
之前介紹 SystemServer 啟動流程 的時候說到，SystemServer 進程啟動了一系列的系統服務，ActivityManagerService 是其中最核心的服務之一。它和四大組件的啟動、切換、調度及應用進程的管理和調度息息相關，其重要性不言而喻。本文主要介紹其啟動流程，它是在 SystemServer 的 main() 中啟動的，整個啟動流程經歷了 startBootstrapServices 、startCoreService() 、startOtherService()。下麵就順著源碼來捋一捋 ActivityManagerService 的啟動流程，下文中簡稱 AMS。
private void startBootstrapServices() {
...
// 1. AMS 初始化
mActivityManagerService = mSystemServiceManager.startService(
ActivityManagerService.Lifecycle.class).getService();
// 設置 AMS 的系統服務管理器
mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
// 設置 AMS 的應用安裝器
mActivityManagerService.setInstaller(installer);
...
mActivityManagerService.initPowerManagement();
...
// 2. AMS.setSystemProcess()
mActivityManagerService.setSystemProcess();
...
}
private void startCoreServices{
...
mActivityManagerService.setUsageStatsManager(
LocalServices.getService(UsageStatsManagerInternal.class));
...
}
private void startherService{
...
// 3. 安裝系統 Provider
mActivityManagerService.installSystemProviders();
...
final Watchdog watchdog = Watchdog.getInstance();
watchdog.init(context, mActivityManagerService);
...
mActivityManagerService.setWindowManager(wm);
...
networkPolicy = new NetworkPolicyManagerService(context, mActivityManagerService,
networkManagement);
...
if (safeMode) {
traceBeginAndSlog("EnterSafeModeAndDisableJitCompilation");
mActivityManagerService.enterSafeMode();
// Disable the JIT for the system_server process
VMRuntime.getRuntime().disableJitCompilation();
traceEnd();
}
...
mPowerManagerService.systemReady(mActivityManagerService.getAppOpsService());
...
// 4. AMS.systemReady()
mActivityManagerService.systemReady(() -> {
...
mActivityManagerService.startObservingNativeCrashes();
}
}AMS 初始化
mActivityManagerService = mSystemServiceManager.startService(
ActivityManagerService.Lifecycle.class).getService();AMS 通過 SystemServiceManager.startService() 方法初始化，startService() 在之前的文章中已經分析過，其作用是根據參數傳入的類通過反射進行實例化，並回調其 onStart() 方法。註意這裡傳入的是 ActivityManagerService.Lifecycle.class，LifeCycle 是 AMS 的一個靜態內部類。
public static final class Lifecycle extends SystemService {
private final ActivityManagerService mService;
// 構造函數中新建 ActivityManagerService 對象
public Lifecycle(Context context) {
super(context);
mService = new ActivityManagerService(context);
}
@Override
public void onStart() {
mService.start();
}
@Override
public void onBootPhase(int phase) {
mService.mBootPhase = phase;
if (phase == PHASE_SYSTEM_SERVICES_READY) {
mService.mBatteryStatsService.systemServicesReady();
mService.mServices.systemServicesReady();
}
}
@Override
public void onCleanupUser(int userId) {
mService.mBatteryStatsService.onCleanupUser(userId);
}
public ActivityManagerService getService() {
return mService;
}
}Lifecycle 的構造函數中初始化了 AMS。再來看看 AMS 的構造函數。
public ActivityManagerService(Context systemContext) {
mInjector = new Injector();
// AMS 上下文
mContext = systemContext;
mFactoryTest = FactoryTest.getMode();
// ActivityThread 對象
mSystemThread = ActivityThread.currentActivityThread();
// ContextImpl 對象
mUiContext = mSystemThread.getSystemUiContext();
mPermissionReviewRequired = mContext.getResources().getBoolean(
com.android.internal.R.bool.config_permissionReviewRequired);
// 線程名為 ActivityManager 的前臺線程，ServiceThread 繼承於 HandlerThread
mHandlerThread = new ServiceThread(TAG,
THREAD_PRIORITY_FOREGROUND, false /*allowIo*/);
mHandlerThread.start();
// 獲取 mHandlerThread 的 Handler 對象
mHandler = new MainHandler(mHandlerThread.getLooper());
// 創建名為 android.ui 的線程
mUiHandler = mInjector.getUiHandler(this);
// 不知道什麼作用
mProcStartHandlerThread = new ServiceThread(TAG + ":procStart",
THREAD_PRIORITY_FOREGROUND, false /* allowIo */);
mProcStartHandlerThread.start();
mProcStartHandler = new Handler(mProcStartHandlerThread.getLooper());
mConstants = new ActivityManagerConstants(this, mHandler);
/* static; one-time init here */
// 根據優先順序 kill 後臺應用進程
if (sKillHandler == null) {
sKillThread = new ServiceThread(TAG + ":kill",
THREAD_PRIORITY_BACKGROUND, true /* allowIo */);
sKillThread.start();
sKillHandler = new KillHandler(sKillThread.getLooper());
}
// 前臺廣播隊列，超時時間為 10 秒
mFgBroadcastQueue = new BroadcastQueue(this, mHandler,
"foreground", BROADCAST_FG_TIMEOUT, false);
// 後臺廣播隊列，超時時間為 60 秒
mBgBroadcastQueue = new BroadcastQueue(this, mHandler,
"background", BROADCAST_BG_TIMEOUT, true);
mBroadcastQueues[0] = mFgBroadcastQueue;
mBroadcastQueues[1] = mBgBroadcastQueue;
// 創建 ActiveServices
mServices = new ActiveServices(this);
mProviderMap = new ProviderMap(this);
// 創建 AppErrors，用於處理應用中的錯誤
mAppErrors = new AppErrors(mUiContext, this);
// 創建 /data/system 目錄
File dataDir = Environment.getDataDirectory();
File systemDir = new File(dataDir, "system");
systemDir.mkdirs();
mAppWarnings = new AppWarnings(this, mUiContext, mHandler, mUiHandler, systemDir);
// TODO: Move creation of battery stats service outside of activity manager service.
// 創建 BatteryStatsService，其信息保存在 /data/system/procstats 中
// 這裡有個 TODO，打算把 BatteryStatsService 的創建移除 AMS
mBatteryStatsService = new BatteryStatsService(systemContext, systemDir, mHandler);
mBatteryStatsService.getActiveStatistics().readLocked();
mBatteryStatsService.scheduleWriteToDisk();
mOnBattery = DEBUG_POWER ? true
: mBatteryStatsService.getActiveStatistics().getIsOnBattery();
mBatteryStatsService.getActiveStatistics().setCallback(this);
// 創建 ProcessStatsService，並將其信息保存在 /data/system/procstats 中
mProcessStats = new ProcessStatsService(this, new File(systemDir, "procstats"));
mAppOpsService = mInjector.getAppOpsService(new File(systemDir, "appops.xml"), mHandler);
// 定義 ContentProvider 訪問指定 Uri 數據的許可權
mGrantFile = new AtomicFile(new File(systemDir, "urigrants.xml"), "uri-grants");
// 多用戶管理
mUserController = new UserController(this);
mVrController = new VrController(this);
// 獲取 OpenGL 版本
GL_ES_VERSION = SystemProperties.getInt("ro.opengles.version",
ConfigurationInfo.GL_ES_VERSION_UNDEFINED);
if (SystemProperties.getInt("sys.use_fifo_ui", 0) != 0) {
mUseFifoUiScheduling = true;
}
mTrackingAssociations = "1".equals(SystemProperties.get("debug.track-associations"));
mTempConfig.setToDefaults();
mTempConfig.setLocales(LocaleList.getDefault());
mConfigurationSeq = mTempConfig.seq = 1;
// 創建 ActivityStackSupervisor ，用於管理 Activity 任務棧
mStackSupervisor = createStackSupervisor();
mStackSupervisor.onConfigurationChanged(mTempConfig);
mKeyguardController = mStackSupervisor.getKeyguardController();
mCompatModePackages = new CompatModePackages(this, systemDir, mHandler);
mIntentFirewall = new IntentFirewall(new IntentFirewallInterface(), mHandler);
mTaskChangeNotificationController =
new TaskChangeNotificationController(this, mStackSupervisor, mHandler);
// 創建 ActivityStartController 對象，用於管理 Activity 的啟動
mActivityStartController = new ActivityStartController(this);
// 創建最近任務棧 RecentTask 對象
mRecentTasks = createRecentTasks();
mStackSupervisor.setRecentTasks(mRecentTasks);
mLockTaskController = new LockTaskController(mContext, mStackSupervisor, mHandler);
mLifecycleManager = new ClientLifecycleManager();
// 創建 CpuTracker 線程，追蹤 CPU 狀態
mProcessCpuThread = new Thread("CpuTracker") {
@Override
public void run() {
synchronized (mProcessCpuTracker) {
mProcessCpuInitLatch.countDown();
mProcessCpuTracker.init(); // 初始化 ProcessCpuTracker。註意同步問題
}
while (true) {
try {
try {
synchronized(this) {
final long now = SystemClock.uptimeMillis();
long nextCpuDelay = (mLastCpuTime.get()+MONITOR_CPU_MAX_TIME)-now;
long nextWriteDelay = (mLastWriteTime+BATTERY_STATS_TIME)-now;
//Slog.i(TAG, "Cpu delay=" + nextCpuDelay
// + ", write delay=" + nextWriteDelay);
if (nextWriteDelay < nextCpuDelay) {
nextCpuDelay = nextWriteDelay;
}
if (nextCpuDelay > 0) {
mProcessCpuMutexFree.set(true);
this.wait(nextCpuDelay);
}
}
} catch (InterruptedException e) {
}
// 更新 Cpu 統計信息
updateCpuStatsNow();
} catch (Exception e) {
Slog.e(TAG, "Unexpected exception collecting process stats", e);
}
}
}
};
// hidden api 設置
mHiddenApiBlacklist = new HiddenApiSettings(mHandler, mContext);
// 設置 Watchdog 監控
Watchdog.getInstance().addMonitor(this);
Watchdog.getInstance().addThread(mHandler);
// bind background thread to little cores
// this is expected to fail inside of framework tests because apps can't touch cpusets directly
// make sure we've already adjusted system_server's internal view of itself first
// 更新進程的 oom_adj 值
updateOomAdjLocked();
try {
Process.setThreadGroupAndCpuset(BackgroundThread.get().getThreadId(),
Process.THREAD_GROUP_BG_NONINTERACTIVE);
} catch (Exception e) {
Slog.w(TAG, "Setting background thread cpuset failed");
}
}AMS 的構造函數中做了很多事情，代碼中作了很多註釋，這裡就不再展開細說了。
LifeCycle 的構造函數中初始化了 AMS，然後會調用 LifeCycle.onStart()，最終調用的是 AMS.start() 方法。
private void start() {
// 移除所有進程組
removeAllProcessGroups();
// 啟動構造函數中創建的 CpuTracker 線程，監控 cpu 使用情況
mProcessCpuThread.start();
// 啟動 BatteryStatsService，統計電池信息
mBatteryStatsService.publish();
mAppOpsService.publish(mContext);
// 啟動 LocalService ，將 ActivityManagerInternal 加入服務列表
LocalServices.addService(ActivityManagerInternal.class, new LocalService());
// 等待 mProcessCpuThread 線程中的同步代碼塊執行完畢。
// 在執行 mProcessCpuTracker.init() 方法時訪問 mProcessCpuTracker 將阻塞
try {
mProcessCpuInitLatch.await();
} catch (InterruptedException e) {
Thread.currentThread().interrupt();
throw new IllegalStateException("Interrupted wait during start");
}
}AMS 的初始化工作到這裡就基本結束了，我們再回到 startBootstrapServices() 中，看看 AMS 的下一步動作 setSystemProcess() 。
AMS.setSystemProcess()
public void setSystemProcess() {
try {
// 註冊各種服務
// 註冊 AMS
ServiceManager.addService(Context.ACTIVITY_SERVICE, this, /* allowIsolated= */ true,
DUMP_FLAG_PRIORITY_CRITICAL | DUMP_FLAG_PRIORITY_NORMAL | DUMP_FLAG_PROTO);
// 註冊進程統計服務
ServiceManager.addService(ProcessStats.SERVICE_NAME, mProcessStats);
// 註冊記憶體信息服務
ServiceManager.addService("meminfo", new MemBinder(this), /* allowIsolated= */ false,
DUMP_FLAG_PRIORITY_HIGH);
// 註冊 GraphicsBinder
ServiceManager.addService("gfxinfo", new GraphicsBinder(this));
// 註冊 DbBinder
ServiceManager.addService("dbinfo", new DbBinder(this));
if (MONITOR_CPU_USAGE) {
// 註冊 DbBinder
ServiceManager.addService("cpuinfo", new CpuBinder(this),
/* allowIsolated= */ false, DUMP_FLAG_PRIORITY_CRITICAL);
}
// 註冊許可權管理者 PermissionController
ServiceManager.addService("permission", new PermissionController(this
// 註冊進程信息服務 ProcessInfoService
ServiceManager.addService("processinfo", new ProcessInfoService(this));
// 獲取包名為 android 的應用信息，framework-res.apk
ApplicationInfo info = mContext.getPackageManager().getApplicationInfo(
"android", STOCK_PM_FLAGS | MATCH_SYSTEM_ONLY);
mSystemThread.installSystemApplicationInfo(info, getClass().getClassLoader());
synchronized (this) {
// 創建 ProcessRecord
ProcessRecord app = newProcessRecordLocked(info, info.processName, false, 0);
app.persistent = true;
app.pid = MY_PID;
app.maxAdj = ProcessList.SYSTEM_ADJ;
app.makeActive(mSystemThread.getApplicationThread(), mProcessStats);
synchronized (mPidsSelfLocked) {
mPidsSelfLocked.put(app.pid, app);
}
// 更新 mLruProcesses
updateLruProcessLocked(app, false, null);
// 更新進程對應的 oom_adj 值
updateOomAdjLocked();
}
} catch (PackageManager.NameNotFoundException e) {
throw new RuntimeException(
"Unable to find android system package", e);
}
// Start watching app ops after we and the package manager are up and running.
// 當 packager manager 啟動並運行時開始監聽 app ops
mAppOpsService.startWatchingMode(AppOpsManager.OP_RUN_IN_BACKGROUND, null,
new IAppOpsCallback.Stub() {
@Override public void opChanged(int op, int uid, String packageName) {
if (op == AppOpsManager.OP_RUN_IN_BACKGROUND && packageName != null) {
if (mAppOpsService.checkOperation(op, uid, packageName)
!= AppOpsManager.MODE_ALLOWED) {
runInBackgroundDisabled(uid);
}
}
}
});
}setSystemProcess() 的主要工作就是向 ServiceManager 註冊關聯的系統服務。
AMS.installSystemProviders()
public final void installSystemProviders() {
List<ProviderInfo> providers;
synchronized (this) {
ProcessRecord app = mProcessNames.get("system", SYSTEM_UID);
providers = generateApplicationProvidersLocked(app);
if (providers != null) {
for (int i=providers.size()-1; i>=0; i--) {
ProviderInfo pi = (ProviderInfo)providers.get(i);
if ((pi.applicationInfo.flags&ApplicationInfo.FLAG_SYSTEM) == 0) {
Slog.w(TAG, "Not installing system proc provider " + pi.name
+ ": not system .apk");
// 移除非系統 Provier
providers.remove(i);
}
}
}
}
// 安裝系統 Provider
if (providers != null) {
mSystemThread.installSystemProviders(providers);
}
synchronized (this) {
mSystemProvidersInstalled = true;
}
mConstants.start(mContext.getContentResolver());
// 創建 CoreSettingsObserver ，監控核心設置的變化
mCoreSettingsObserver = new CoreSettingsObserver(this);
// 創建 FontScaleSettingObserver，監控字體的變化
mFontScaleSettingObserver = new FontScaleSettingObserver();
// 創建 DevelopmentSettingsObserver
mDevelopmentSettingsObserver = new DevelopmentSettingsObserver();
GlobalSettingsToPropertiesMapper.start(mContext.getContentResolver());
// Now that the settings provider is published we can consider sending
// in a rescue party.
RescueParty.onSettingsProviderPublished(mContext);
//mUsageStatsService.monitorPackages();
}installSystemProviders() 的主要工作是安裝系統 Proviers。
AMS.systemReady()
AMS.systemReady() 是 AMS 啟動流程的最後一步了。
public void systemReady(final Runnable goingCallback, TimingsTraceLog traceLog) {
...
synchronized(this) {
if (mSystemReady) { // 首次調用 mSystemReady 為 false
// If we're done calling all the receivers, run the next "boot phase" passed in
// by the SystemServer
if (goingCallback != null) {
goingCallback.run();
}
return;
}
// 一系列 systemReady()
mHasHeavyWeightFeature = mContext.getPackageManager().hasSystemFeature(
PackageManager.FEATURE_CANT_SAVE_STATE);
mLocalDeviceIdleController
= LocalServices.getService(DeviceIdleController.LocalService.class);
mAssistUtils = new AssistUtils(mContext);
mVrController.onSystemReady();
// Make sure we have the current profile info, since it is needed for security checks.
mUserController.onSystemReady();
mRecentTasks.onSystemReadyLocked();
mAppOpsService.systemReady();
mSystemReady = true;
}
...
ArrayList<ProcessRecord> procsToKill = null;
synchronized(mPidsSelfLocked) {
for (int i=mPidsSelfLocked.size()-1; i>=0; i--) {
ProcessRecord proc = mPidsSelfLocked.valueAt(i);
if (!isAllowedWhileBooting(proc.info)){
if (procsToKill == null) {
procsToKill = new ArrayList<ProcessRecord>();
}
procsToKill.add(proc);
}
}
}
synchronized(this) {
if (procsToKill != null) {
for (int i=procsToKill.size()-1; i>=0; i--) {
ProcessRecord proc = procsToKill.get(i);
removeProcessLocked(proc, true, false, "system update done");
}
}
// Now that we have cleaned up any update processes, we
// are ready to start launching real processes and know that
// we won't trample on them any more.
mProcessesReady = true;
}
...
if (goingCallback != null) goingCallback.run();
mBatteryStatsService.noteEvent(BatteryStats.HistoryItem.EVENT_USER_RUNNING_START,
Integer.toString(currentUserId), currentUserId);
mBatteryStatsService.noteEvent(BatteryStats.HistoryItem.EVENT_USER_FOREGROUND_START,
Integer.toString(currentUserId), currentUserId);
// 回調所有 SystemService 的 onStartUser() 方法
mSystemServiceManager.startUser(currentUserId);
synchronized (this) {
// Only start up encryption-aware persistent apps; once user is
// unlocked we'll come back around and start unaware apps
startPersistentApps(PackageManager.MATCH_DIRECT_BOOT_AWARE);
// Start up initial activity.
mBooting = true;
// Enable home activity for system user, so that the system can always boot. We don't
// do this when the system user is not setup since the setup wizard should be the one
// to handle home activity in this case.
if (UserManager.isSplitSystemUser() &&
Settings.Secure.getInt(mContext.getContentResolver(),
Settings.Secure.USER_SETUP_COMPLETE, 0) != 0) {
ComponentName cName = new ComponentName(mContext, SystemUserHomeActivity.class);
try {
AppGlobals.getPackageManager().setComponentEnabledSetting(cName,
PackageManager.COMPONENT_ENABLED_STATE_ENABLED, 0,
UserHandle.USER_SYSTEM);
} catch (RemoteException e) {
throw e.rethrowAsRuntimeException();
}
}
// 啟動桌面 Home 應用
startHomeActivityLocked(currentUserId, "systemReady");
...
long ident = Binder.clearCallingIdentity();
try {
// 發送廣播 USER_STARTED
Intent intent = new Intent(Intent.ACTION_USER_STARTED);
intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY
| Intent.FLAG_RECEIVER_FOREGROUND);
intent.putExtra(Intent.EXTRA_USER_HANDLE, currentUserId);
broadcastIntentLocked(null, null, intent,
null, null, 0, null, null, null, OP_NONE,
null, false, false, MY_PID, SYSTEM_UID,
currentUserId);
// 發送廣播 USER_STARTING
intent = new Intent(Intent.ACTION_USER_STARTING);
intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY);
intent.putExtra(Intent.EXTRA_USER_HANDLE, currentUserId);
broadcastIntentLocked(null, null, intent,
null, new IIntentReceiver.Stub() {
@Override
public void performReceive(Intent intent, int resultCode, String data,
Bundle extras, boolean ordered, boolean sticky, int sendingUser)
throws RemoteException {
}
}, 0, null, null,
new String[] {INTERACT_ACROSS_USERS}, OP_NONE,
null, true, false, MY_PID, SYSTEM_UID, UserHandle.USER_ALL);
} catch (Throwable t) {
Slog.wtf(TAG, "Failed sending first user broadcasts", t);
} finally {
Binder.restoreCallingIdentity(ident);
}
mStackSupervisor.resumeFocusedStackTopActivityLocked();
mUserController.sendUserSwitchBroadcasts(-1, currentUserId);
BinderInternal.nSetBinderProxyCountWatermarks(6000,5500);
BinderInternal.nSetBinderProxyCountEnabled(true);
BinderInternal.setBinderProxyCountCallback(
new BinderInternal.BinderProxyLimitListener() {
@Override
public void onLimitReached(int uid) {
if (uid == Process.SYSTEM_UID) {
Slog.i(TAG, "Skipping kill (uid is SYSTEM)");
} else {
killUid(UserHandle.getAppId(uid), UserHandle.getUserId(uid),
"Too many Binders sent to SYSTEM");
}
}
}, mHandler);
}
}systemReady() 方法源碼很長，上面做了很多刪減。註意其中的 startHomeActivityLocked() 方法會啟動桌面 Activity 。
boolean startHomeActivityLocked(int userId, String reason) {
...
Intent intent = getHomeIntent();
ActivityInfo aInfo = resolveActivityInfo(intent, STOCK_PM_FLAGS, userId);
if (aInfo != null) {
intent.setComponent(new ComponentName(aInfo.applicationInfo.packageName, aInfo.name));
// Don't do this if the home app is currently being
// instrumented.
aInfo = new ActivityInfo(aInfo);
aInfo.applicationInfo = getAppInfoForUser(aInfo.applicationInfo, userId);
ProcessRecord app = getProcessRecordLocked(aInfo.processName,
aInfo.applicationInfo.uid, true);
if (app == null || app.instr == null) {
intent.setFlags(intent.getFlags() | FLAG_ACTIVITY_NEW_TASK);
final int resolvedUserId = UserHandle.getUserId(aInfo.applicationInfo.uid);
// For ANR debugging to verify if the user activity is the one that actually
// launched.
final String myReason = reason + ":" + userId + ":" + resolvedUserId;
// 啟動桌面 Activity
mActivityStartController.startHomeActivity(intent, aInfo, myReason);
}
} else {
Slog.wtf(TAG, "No home screen found for " + intent, new Throwable());
}
return true;
}ActivityStartController 負責啟動 Activity，至此，桌面應用就啟動了。
最後
整篇寫下來感覺就像小學生流水日記一樣，但是讀源碼，就像有錢人的生活一樣，往往是那麼朴實無華，且枯燥。我不經意間看了看我的勞力士，太晚了，時序圖後面再補上吧！
最後，下集預告，接著這篇，Activity 的啟動流程分析，敬請期待！
文章首發微信公眾號：
秉心說， 專註 Java 、 Android 原創知識分享，LeetCode 題解。更多最新原創文章，掃碼關註我吧！
