概述

我们讲完了SystemServer的启动过程，本节主要来讲解ActivityManagerService的启动过程。ActivityManagerService简称AMS，管理Activity行为，控制Activity的生命周期，派发消息事件，内存管理等功能。

ActivityManagerService启动由SystemServer中startBootstrapService启动

源码分析

private void startBootstrapServices() {
  .......

  // Activity manager runs the show.
        traceBeginAndSlog("StartActivityManager");
        // TODO: Might need to move after migration to WM.
      //启动ActivityTaskManagerService服务，简称ATM，Android10新引入功能，用来管理Activity的启动，调度等功能。
        ActivityTaskManagerService atm = mSystemServiceManager.startService(
                ActivityTaskManagerService.Lifecycle.class).getService();

      //启动服务ActivityManagerService
        mActivityManagerService = ActivityManagerService.Lifecycle.startService(
                mSystemServiceManager, atm);
        mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
        mActivityManagerService.setInstaller(installer);
        mWindowManagerGlobalLock = atm.getGlobalLock();
        traceEnd();
}

ATM服务启动过程

ATM启动最终调用的是ActivityTaskManagerService.Lifecycle.onStart()来启动ATM服务的
源码：ActivityTaskManagerService.java#Lifecycle.class

 public static final class Lifecycle extends SystemService {
        private final ActivityTaskManagerService mService;

        public Lifecycle(Context context) {
            super(context);
            mService = new ActivityTaskManagerService(context);
        }

        @Override
        public void onStart() {
            publishBinderService(Context.ACTIVITY_TASK_SERVICE, mService);
            mService.start();
        }

        @Override
        public void onUnlockUser(int userId) {
            synchronized (mService.getGlobalLock()) {
                mService.mStackSupervisor.onUserUnlocked(userId);
            }
        }

        @Override
        public void onCleanupUser(int userId) {
            synchronized (mService.getGlobalLock()) {
                mService.mStackSupervisor.mLaunchParamsPersister.onCleanupUser(userId);
            }
        }

        public ActivityTaskManagerService getService() {
            return mService;
        }
    }

ActivityTaskManagerService对象创建

/**
 * System service for managing activities and their containers (task, stacks, displays,... ).
 *
 * {@hide}
 */
public class ActivityTaskManagerService extends IActivityTaskManager.Stub {

    final Context mUiContext;
    final ActivityThread mSystemThread;
    final ActivityTaskManagerInternal mInternal;
 
    //ActivityStackSupervisor 是ATM中用来管理Activity启动和调度的核心类
    public ActivityStackSupervisor mStackSupervisor;
    //Activity 容器的根节点
    RootActivityContainer mRootActivityContainer;
    //WMS 负责窗口的管理
    WindowManagerService mWindowManager;
    
    //这是我们目前认为是"Home" Activity的过程
    WindowProcessController mHomeProcess;
    
    public ActivityTaskManagerService(Context context) {
        //拿到System Context
        mContext = context;  
        mFactoryTest = FactoryTest.getMode();
 
        //取出的是ActivityThread的静态变量sCurrentActivityThread
        //这意味着mSystemThread与SystemServer中的ActivityThread一致
        mSystemThread = ActivityThread.currentActivityThread();
        
        //拿到System UI Context
        mUiContext = mSystemThread.getSystemUiContext();
        mLifecycleManager = new ClientLifecycleManager();
        //拿到LocalService的对象
        mInternal = new LocalService();
        GL_ES_VERSION = SystemProperties.getInt("ro.opengles.version", GL_ES_VERSION_UNDEFINED);
    }
}

ActivityTaskManagerService.java#start()

将ActivityTaskManagerInternal添加到本地服务的全局注册表中。
ActivityTaskManagerInternal为抽象类，其实现类为ActivityTaskManagerService#LocalService.class

private void start() {
        LocalServices.addService(ActivityTaskManagerInternal.class, mInternal);
    }

ActivityManagerService服务启动

public static final class Lifecycle extends SystemService {
    private final ActivityManagerService mService;
    private static ActivityTaskManagerService sAtm;
 
    public Lifecycle(Context context) {
        super(context);
        //1.创建ActivityManagerService，得到对象，传入ATM的对象
        mService = new ActivityManagerService(context, sAtm);
    }
 
    @Override
    public void onStart() {
        mService.start();
    }
    ...
    public ActivityManagerService getService() {
        return mService;
    }
}

AMS对象创建

构造函数初始化主要工作就是初始化一些变量，供之后的service，broadcast，provider的管理和调度

public class ActivityManagerService extends IActivityManager.Stub
        implements Watchdog.Monitor, BatteryStatsImpl.BatteryCallback {
    public ActivityManagerService(Context systemContext, ActivityTaskManagerService atm) {
        ...
        //AMS的运行上下文与SystemServer一致
        mContext = systemContext;
        ...
        //取出的是ActivityThread的静态变量sCurrentActivityThread
        //这意味着mSystemThread与SystemServer中的ActivityThread一致
        mSystemThread = ActivityThread.currentActivityThread();
        mUiContext = mSystemThread.getSystemUiContext();
 
        mHandlerThread = new ServiceThread(TAG,
                THREAD_PRIORITY_FOREGROUND, false /*allowIo*/);
        mHandlerThread.start();
        
        //处理AMS中消息的主力
        mHandler = new MainHandler(mHandlerThread.getLooper());
        
        //UiHandler对应于Android中的UiThread
        mUiHandler = mInjector.getUiHandler(this);
 
        //创建 BroadcastQueue 前台广播对象，处理超时时长是 10s
        mFgBroadcastQueue = new BroadcastQueue(this, mHandler,
                "foreground", foreConstants, false);
        //创建 BroadcastQueue 后台广播对象，处理超时时长是 60s
        mBgBroadcastQueue = new BroadcastQueue(this, mHandler,
                "background", backConstants, true);
        //创建 BroadcastQueue 分流广播对象，处理超时时长是 60s
        mOffloadBroadcastQueue = new BroadcastQueue(this, mHandler,
                "offload", offloadConstants, true);
        mBroadcastQueues[0] = mFgBroadcastQueue;
        mBroadcastQueues[1] = mBgBroadcastQueue;
        mBroadcastQueues[2] = mOffloadBroadcastQueue;
 
        // 创建 ActiveServices 对象，用于管理 ServiceRecord 对象
        mServices = new ActiveServices(this);
        // 创建 ProviderMap 对象，用于管理 ContentProviderRecord 对象
        mProviderMap = new ProviderMap(this);
        
        //得到ATM的对象，调用ATM.initialize
        mActivityTaskManager = atm;
        mActivityTaskManager.initialize(mIntentFirewall, mPendingIntentController,
                DisplayThread.get().getLooper());
        //得到ATM的服务信息
        mAtmInternal = LocalServices.getService(
ActivityTaskManagerInternal.class);
 
        //加入Watchdog的监控
        Watchdog.getInstance().addMonitor(this);
        Watchdog.getInstance().addThread(mHandler);
    }
}

ActivityManagerService.java#start()

start中做了两件事

• 启动CPU监控线程，在启动CPU监控线程之前，首先将进程复位
• 注册电池状态服务和权限管理服务。

private void start() {
    //1.移除所有的进程组
    removeAllProcessGroups();
    //启动 CPU 监控线程
    mProcessCpuThread.start();
 
    //2.注册电池状态和权限管理服务
    mBatteryStatsService.publish();
    mAppOpsService.publish(mContext);
    Slog.d("AppOps", "AppOpsService published");
    LocalServices.addService(ActivityManagerInternal.class, new LocalService());
    mActivityTaskManager.onActivityManagerInternalAdded();
    mUgmInternal.onActivityManagerInternalAdded();
    mPendingIntentController.onActivityManagerInternalAdded();
    // Wait for the synchronized block started in mProcessCpuThread,
    // so that any other access to mProcessCpuTracker from main thread
    // will be blocked during mProcessCpuTracker initialization.
    try {
        mProcessCpuInitLatch.await();
    } catch (InterruptedException e) {
        Slog.wtf(TAG, "Interrupted wait during start", e);
        Thread.currentThread().interrupt();
        throw new IllegalStateException("Interrupted wait during start");
    }
}

ActivityManagerService最后工作，systemReady()

AMS的systemReady处理分为三个阶段

• 主要是调用一些关键服务的初始化函数， 然后杀死那些没有FLAG_PERSISTENT却在AMS启动完成前已经存在的进程，

同时获取一些配置参数。 需要注意的是，由于只有Java进程才会向AMS注册，而一般的Native进程不会向AMS注册，因此此处杀死的进程是Java进程。

• 执行goingCallback的处理，主要的工作就是通知一些服务可以进行systemReady、systemRunning相关的工作，并进行启动服务或应用进程的工作

• 启动Home Activity，当启动结束，并发送ACTION_BOOT_COMPLETED广播时，AMS的启动过程告一段落。

private void startOtherServices() {
    ...
    //安装SettingsProvider.apk
    mActivityManagerService.installSystemProviders();
    mActivityManagerService.setWindowManager(wm);
 
    //AMS启动完成，完成后续的工作，例如启动桌面等

    mActivityManagerService.systemReady(() -> {

        阶段1：关键服务的初始化
        阶段2：goingCallback处理
        阶段3：启动Home Activity，完成AMS启动

        ...
    }, BOOT_TIMINGS_TRACE_LOG);
    ...
}

阶段1

主要是调用一些关键服务的初始化函数，然后杀死那些没有FLAG_PERSISTENT 却在AMS启动完成前已经存在的进程，同时获取一些配置参数。需要注意的是，由于只有Java进程才会向AMS注册，而一般的Native进程不会向AMS注册，因此此处杀手的进程是Java进程。

//ActivityManagerService.java#systemReady()

   public void systemReady(final Runnable goingCallback, TimingsTraceLog traceLog) {
        traceLog.traceBegin("PhaseActivityManagerReady");
        synchronized(this) {
            //第一次进入mSystemReady为false，不走该流程
            if (mSystemReady) {
                // If we're done calling all the receivers, run the next "boot phase" passed in
                // by the SystemServer
                if (goingCallback != null) {
                    goingCallback.run();
                }
                return;
            }

            mLocalDeviceIdleController
                    = LocalServices.getService(DeviceIdleController.LocalService.class);
            mActivityTaskManager.onSystemReady();

            //这一部分主要是调用一些关键服务SystemReady相关的函数
            //进行一些等待AMS初始完，才能进行的工作
            // Make sure we have the current profile info, since it is needed for security checks.
            mUserController.onSystemReady();
            mAppOpsService.systemReady();
            mSystemReady = true;
        }

        try {
            sTheRealBuildSerial = IDeviceIdentifiersPolicyService.Stub.asInterface(
                    ServiceManager.getService(Context.DEVICE_IDENTIFIERS_SERVICE))
                    .getSerial();
        } catch (RemoteException e) {}

        ArrayList<ProcessRecord> procsToKill = null;
        synchronized(mPidsSelfLocked) {
            for (int i=mPidsSelfLocked.size()-1; i>=0; i--) {
                ProcessRecord proc = mPidsSelfLocked.valueAt(i);
                //在AMS启动完成前，如果没有FLAG_PERSISTENT标志的进程已经启动了 就将这个进程加入到procsToKill中
                if (!isAllowedWhileBooting(proc.info)){
                    if (procsToKill == null) {
                        procsToKill = new ArrayList<ProcessRecord>();
                    }
                    procsToKill.add(proc);
                }
            }
        }
          //收集已经启动的进程并杀死，排除persistent常驻进程
        synchronized(this) {
            //利用removeProcessLocked关闭procsToKill中的进程
            if (procsToKill != null) {
                for (int i=procsToKill.size()-1; i>=0; i--) {
                    ProcessRecord proc = procsToKill.get(i);
                    Slog.i(TAG, "Removing system update proc: " + proc);
                    mProcessList.removeProcessLocked(proc, true, false, "system update done");
                }
            }
              
              //至此系统准备完毕
            // Now that we have cleaned up any update processes, we
            // are ready to start launching real processes and know that
            // we won't trample on them any more.
            mProcessesReady = true;
        }

        Slog.i(TAG, "System now ready");
        EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_AMS_READY, SystemClock.uptimeMillis());

        mAtmInternal.updateTopComponentForFactoryTest();
        mAtmInternal.getLaunchObserverRegistry().registerLaunchObserver(mActivityLaunchObserver);

        watchDeviceProvisioning(mContext);

        retrieveSettings();
        mUgmInternal.onSystemReady();

        final PowerManagerInternal pmi = LocalServices.getService(PowerManagerInternal.class);
        if (pmi != null) {
            pmi.registerLowPowerModeObserver(ServiceType.FORCE_BACKGROUND_CHECK,
                    state -> updateForceBackgroundCheck(state.batterySaverEnabled));
            updateForceBackgroundCheck(
                    pmi.getLowPowerState(ServiceType.FORCE_BACKGROUND_CHECK).batterySaverEnabled);
        } else {
            Slog.wtf(TAG, "PowerManagerInternal not found.");
        }

        if (goingCallback != null) goingCallback.run();
        // Check the current user here as a user can be started inside goingCallback.run() from
        // other system services.
        final int currentUserId = mUserController.getCurrentUserId();
        Slog.i(TAG, "Current user:" + currentUserId);
        if (currentUserId != UserHandle.USER_SYSTEM && !mUserController.isSystemUserStarted()) {
            // User other than system user has started. Make sure that system user is already
            // started before switching user.
            throw new RuntimeException("System user not started while current user is:"
                    + currentUserId);
        }
        traceLog.traceBegin("ActivityManagerStartApps");
        mBatteryStatsService.noteEvent(BatteryStats.HistoryItem.EVENT_USER_RUNNING_START,
                Integer.toString(currentUserId), currentUserId);
        mBatteryStatsService.noteEvent(BatteryStats.HistoryItem.EVENT_USER_FOREGROUND_START,
                Integer.toString(currentUserId), currentUserId);
        mSystemServiceManager.startUser(currentUserId);

        synchronized (this) {
            // Only start up encryption-aware persistent apps; once user is
            // unlocked we'll come back around and start unaware apps
            startPersistentApps(PackageManager.MATCH_DIRECT_BOOT_AWARE);

            // Start up initial activity.
            mBooting = true;
            // Enable home activity for system user, so that the system can always boot. We don't
            // do this when the system user is not setup since the setup wizard should be the one
            // to handle home activity in this case.
            if (UserManager.isSplitSystemUser() &&
                    Settings.Secure.getInt(mContext.getContentResolver(),
                         Settings.Secure.USER_SETUP_COMPLETE, 0) != 0) {
                ComponentName cName = new ComponentName(mContext, SystemUserHomeActivity.class);
                try {
                    AppGlobals.getPackageManager().setComponentEnabledSetting(cName,
                            PackageManager.COMPONENT_ENABLED_STATE_ENABLED, 0,
                            UserHandle.USER_SYSTEM);
                } catch (RemoteException e) {
                    throw e.rethrowAsRuntimeException();
                }
            }
            mAtmInternal.startHomeOnAllDisplays(currentUserId, "systemReady");

            mAtmInternal.showSystemReadyErrorDialogsIfNeeded();

            final int callingUid = Binder.getCallingUid();
            final int callingPid = Binder.getCallingPid();
            long ident = Binder.clearCallingIdentity();
            try {
                Intent intent = new Intent(Intent.ACTION_USER_STARTED);
                intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY
                        | Intent.FLAG_RECEIVER_FOREGROUND);
                intent.putExtra(Intent.EXTRA_USER_HANDLE, currentUserId);
                broadcastIntentLocked(null, null, intent,
                        null, null, 0, null, null, null, OP_NONE,
                        null, false, false, MY_PID, SYSTEM_UID, callingUid, callingPid,
                        currentUserId);
                intent = new Intent(Intent.ACTION_USER_STARTING);
                intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY);
                intent.putExtra(Intent.EXTRA_USER_HANDLE, currentUserId);
                broadcastIntentLocked(null, null, intent,
                        null, new IIntentReceiver.Stub() {
                            @Override
                            public void performReceive(Intent intent, int resultCode, String data,
                                    Bundle extras, boolean ordered, boolean sticky, int sendingUser)
                                    throws RemoteException {
                            }
                        }, 0, null, null,
                        new String[] {INTERACT_ACROSS_USERS}, OP_NONE,
                        null, true, false, MY_PID, SYSTEM_UID, callingUid, callingPid,
                        UserHandle.USER_ALL);
            } catch (Throwable t) {
                Slog.wtf(TAG, "Failed sending first user broadcasts", t);
            } finally {
                Binder.restoreCallingIdentity(ident);
            }
            mAtmInternal.resumeTopActivities(false /* scheduleIdle */);
            mUserController.sendUserSwitchBroadcasts(-1, currentUserId);

            BinderInternal.nSetBinderProxyCountWatermarks(BINDER_PROXY_HIGH_WATERMARK,
                    BINDER_PROXY_LOW_WATERMARK);
            BinderInternal.nSetBinderProxyCountEnabled(true);
            BinderInternal.setBinderProxyCountCallback(
                    new BinderInternal.BinderProxyLimitListener() {
                        @Override
                        public void onLimitReached(int uid) {
                            Slog.wtf(TAG, "Uid " + uid + " sent too many Binders to uid "
                                    + Process.myUid());
                            BinderProxy.dumpProxyDebugInfo();
                            if (uid == Process.SYSTEM_UID) {
                                Slog.i(TAG, "Skipping kill (uid is SYSTEM)");
                            } else {
                                killUid(UserHandle.getAppId(uid), UserHandle.getUserId(uid),
                                        "Too many Binders sent to SYSTEM");
                            }
                        }
                    }, mHandler);

            traceLog.traceEnd(); // ActivityManagerStartApps
            traceLog.traceEnd(); // PhaseActivityManagerReady
        }
    }

阶段2

执行goingCallback的处理，主要的工作就是通知一些服务可以进行systemReady相关的工作，并进行启动服务或应用进程的工作

public void systemReady(final Runnable goingCallback, TimingsTraceLog traceLog) {
    ...
    //1.调用参数传入的runnable对象，SystemServer中有具体的定义
    if (goingCallback != null) goingCallback.run();
    ...
    //调用所有系统服务的onStartUser接口
    mSystemServiceManager.startUser(currentUserId);
    synchronized (this) {
        //启动persistent为1的application所在的进程
        startPersistentApps(PackageManager.MATCH_DIRECT_BOOT_AWARE);
        // Start up initial activity.
        mBooting = true;
        ...
}

goingCallBack.run()

监控Native的crash，启动WebView，执行一些服务的systemReady和systemRunning方法

private void startOtherServices() {
  mActivityManagerService.systemReady(() -> {
  //阶段 550
  mSystemServiceManager.startBootPhase(
              SystemService.PHASE_ACTIVITY_MANAGER_READY);
  ...
  //监控Native的crash
  mActivityManagerService.startObservingNativeCrashes();
  , BOOT_TIMINGS_TRACE_LOG);
  ...
  //启动WebView
  mWebViewUpdateService.prepareWebViewInSystemServer();
  //启动systemUI
  startSystemUi(context, windowManagerF);
  
  // 执行一系列服务的systemReady方法
  networkManagementF.systemReady();
  ipSecServiceF.systemReady();
  networkStatsF.systemReady();
  connectivityF.systemReady();
  networkPolicyF.systemReady(networkPolicyInitReadySignal);
  ...
  //阶段 600
  mSystemServiceManager.startBootPhase(
              SystemService.PHASE_THIRD_PARTY_APPS_CAN_START);
  
  //执行一系列服务的systemRunning方法
  locationF.systemRunning();
  countryDetectorF.systemRunning();
  networkTimeUpdaterF.systemRunning();
  inputManagerF.systemRunning();
  telephonyRegistryF.systemRunning();
  mediaRouterF.systemRunning();
  mmsServiceF.systemRunning();
  ...
}

阶段3

启动Home Activity，当启动结束，发送ACTION_BOOT_COMPLETED广播时，AMS的启动过程告一段落

public  void systemReady(final Runnable goingCallback, TimingsTraceLog traceLog) {
  ...
  //1.通过ATM，启动Home Activity
  mAtmInternal.startHomeOnAllDisplays(currentUserId, "systemReady");
  ...
  //2.发送一些广播消息
  try {
      //system发送广播 ACTION_USER_STARTED = "android.intent.action.USER_STARTED";
      Intent intent = new Intent(Intent.ACTION_USER_STARTED);
      intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY
              | Intent.FLAG_RECEIVER_FOREGROUND);
      intent.putExtra(Intent.EXTRA_USER_HANDLE, currentUserId);
      broadcastIntentLocked(null, null, intent,
              null, null, 0, null, null, null, OP_NONE,
              null, false, false, MY_PID, SYSTEM_UID, callingUid, callingPid,
              currentUserId);
      //system发送广播 ACTION_USER_STARTING= "android.intent.action.USER_STARTING";
      intent = new Intent(Intent.ACTION_USER_STARTING);
      intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY);
      intent.putExtra(Intent.EXTRA_USER_HANDLE, currentUserId);
      broadcastIntentLocked(null, null, intent,
              null, new IIntentReceiver.Stub() {
                  @Override
                  public void performReceive(Intent intent, int resultCode, String data,
                          Bundle extras, boolean ordered, boolean sticky, int sendingUser)
                          throws RemoteException {
                  }
              }, 0, null, null,
              new String[] {INTERACT_ACROSS_USERS}, OP_NONE,
              null, true, false, MY_PID, SYSTEM_UID, callingUid, callingPid,
              UserHandle.USER_ALL);
      } catch (Throwable t) {
          Slog.wtf(TAG, "Failed sending first user broadcasts", t);
      } finally {
          Binder.restoreCallingIdentity(ident);
  }
}

ActivityTaskManagerService.java#startHomeOnAllDisplays

启动Home Activity

public boolean startHomeOnAllDisplays(int userId, String reason) {
    synchronized (mGlobalLock) {
        //调用RootActivityContainer的startHomeOnAllDisplays()，最终到startHomeOnDisplay()
        return mRootActivityContainer.startHomeOnAllDisplays(userId, reason);
    }
}


#RootActivityContainer.java
boolean startHomeOnDisplay(int userId, String reason, int displayId, boolean allowInstrumenting,
        boolean fromHomeKey) {
    // Fallback to top focused display if the displayId is invalid.
    if (displayId == INVALID_DISPLAY) {
        displayId = getTopDisplayFocusedStack().mDisplayId;
    }
 
    Intent homeIntent = null;
    ActivityInfo aInfo = null;
    if (displayId == DEFAULT_DISPLAY) {
        //home intent有CATEGORY_HOME
        homeIntent = mService.getHomeIntent();
         //根据intent中携带的ComponentName，利用PKMS得到ActivityInfo
        aInfo = resolveHomeActivity(userId, homeIntent);
    } else if (shouldPlaceSecondaryHomeOnDisplay(displayId)) {
        Pair<ActivityInfo, Intent> info =
                RootActivityContainerMifavor.resolveSecondaryHomeActivityPcMode(this, userId, displayId);
        aInfo = info.first;
        homeIntent = info.second;
    }
    if (aInfo == null || homeIntent == null) {
        return false;
    }
 
    if (!canStartHomeOnDisplay(aInfo, displayId, allowInstrumenting)) {
        return false;
    }
 
    // Updates the home component of the intent.
    homeIntent.setComponent(new ComponentName(aInfo.applicationInfo.packageName, aInfo.name));
    homeIntent.setFlags(homeIntent.getFlags() | FLAG_ACTIVITY_NEW_TASK);
    // Updates the extra information of the intent.
    if (fromHomeKey) {
        homeIntent.putExtra(WindowManagerPolicy.EXTRA_FROM_HOME_KEY, true);
    }
    // Update the reason for ANR debugging to verify if the user activity is the one that
    // actually launched.
    final String myReason = reason + ":" + userId + ":" + UserHandle.getUserId(
            aInfo.applicationInfo.uid) + ":" + displayId;
    //启动Home Activity--Luncher
    mService.getActivityStartController().startHomeActivity(homeIntent, aInfo, myReason,
            displayId);
    return true;
}

总结

AMS的启动主要经历了如下几个阶段：

• 为SystemServer进程创建Android运行环境，例如System Context
  启动AMS，做一些初始化的工作
• 将SystemServer进程纳入到AMS的进程管理体系中
• AMS启动完成，通知服务或应用完成后续的工作，调用一些服务的systemReady()方法中，
• 启动Lanucher，完成AMS的启动工作