从点击屏幕上的应用icon，到该应用展示第一个可视界面，这个过程中，Android系统究竟做了什么操作？又涉及到哪些进程？
1.根Activity启动过程
手机的桌面是一个叫做Launcher的Activity，它罗列了手机中的应用图标，图标中包含安装apk时解析的应用默认启动页等信息。在点击应用图标时，即将要启动的App和Launcher、AMS、Zygote所属进程不同，所以涉及到Launcher与AMS，AMS与Zygote，AMS与新App这四者多次通信，才会启动一个App，然后再启动Activity，整体的时序图如下：
①从Launcher到AMS
当点击屏幕上的应用icon时，Laucher发送启动应用的请求给AMS，因为Launcher是在Launcher进程，而AMS是在SystemServer进程。因此，实现这个请求，本质上是在实现一个跨进程通信的功能。在安卓领域实现跨进程通信的技术有多种，像是Broadcast、ContentProvider等。在系统领域，大部分的进程间通信技术都采用AIDL技术。Launcher发送请求成功后，启动应用的重担，就落到AMS头上了。
②从AMS到ApplicationThread
收到Launcher创建应用的请求后，AMS会做以下几件事：
1)检查调用者，是否有资格来创建应用。 比如，调用者的进程是否被隔离、是否有权限，是否有配置启动应用的理由说明。
2)封装创建应用所需的相关信息。 比如包名、apk的描述信息和启动的flag等。
3)通过上面所封装的信息，来判断应用所在的任务栈、进程是否存在，如果不存在，就创建新的。
4)创建应用进程。 AMS并不直接创建应用进程，而是交给Zygote进程来创建。Zygote进程通过fork自身进程，来创建新的应用进程，这样可以让新的应用进程继承自己的相关权限。
5)将启动Activity的信息，转发给ApplicationThread。 这又是一个跨进程的操作，从SystemServer进程到应用进程。
③从ApplicationThread到Activity
ApplicationThread收到消息后，再通过H类(Handler，指向UI线程)，将消息发送到UI线程，再在UI线程启动应用，接着调用onCreated方法，实现应用的启动。
整个过程涉及到的进程：
①启动应用的请求，转接流程：
Launcher->AMS->Zygote->AMS->Application。
②上面流程，对应的进程：
Launcher进程->SystemServer进程->Zygote进程->SystemServer进程->应用进程。
总结：
①Launcher在Launcher进程负责将启动应用的请求转发给AMS。
②AMS在SystemSever进程负责安全检查、启动应用的参数封装、通知Zygote进程创建应用进程、转发启动应用请求(并携带启动应用所需的参数)给应用进程。
③ActivityThread在应用进程，用AMS传过来的参数，启动根Activity，此时应用已被启动，对用户可见。
2.源码角度
①Launcher向AMS发送启动Activity
Launcher本身是一个Activity，在用户点击应用图标时，调用startActivitySafely方法，最后调用到Activity.startActivity()，函数调用如下：
Launcher.java：
public boolean startActivitySafely(View v, Intent intent, ItemInfo item) {
...
intent.addFlags(Intent.FLAG_ACTIVITY_NE W_TASK);//标记在新的栈启动
...
startActivity(intent, optsBundle);
...
}
Activity.java：
@Override
public void startActivity(Intent intent) {
this.startActivity(intent, null);
}
@Override
public void startActivity(Intent intent, Bundle options) {
...
if (options != null) {
//-1为requestCode表明不需要知道是否启动成功
startActivityForResult(intent, -1, options);
} else {
startActivityForResult(intent, -1);
}
}
public void startActivityForResult(Intent intent, int requestCode, Bundle options) {
...
Instrumentation.ActivityResult ar = mInstrumentation.execStartActivity(this, mMainThread.getApplicationThread(), mToken,this,intent, requestCode, options);
...
}
每个Activity都持有Instrumentation对象，通过它的execStartActivity函数来继续完成启动Activity的流程，这个函数中传入了mMainThread.getApplicationThread()，它获取到的是ActivityThread的内部类ApplicationThread，这是一个Binder对象，之后AMS通过此对象与App的通信。
Instrumentation.java：
public ActivityResult execStartActivity(Context who, IBinder contextThread, IBinder token, Activity target, Intent intent, int requestCode, Bundle options) {
...
int result = ActivityTaskManager.getService() .startActivity(whoThread,who.getBasePackageName(),who.getAttributionTag(),intent,intent.resolveTypeIfNeeded(who.getContentResolver()),token,target != null ? target.mEmbeddedID : null, requestCode, 0, null, options);
...
}
ActivityTaskManager.java：
public static IActivityTaskManager getService() {
return IActivityTaskManagerSingleton.get();
}
private static final Singleton
@Override
protected IActivityTaskManager create() {
final IBinder b = ServiceManager.getService( Context.ACTIVITY_TASK_SERVICE);
return IActivityTaskManager.Stub.asInterface( b);
}
};
这一步Launcher开始向AMS通信，由于在不同的进程，所以需要通过Binder来通信，IActivityTaskManager是一个代理AMS端Binder的对象，之后AMS开始startActivity。 到这里Launcher向AMS请求启动一个Activity的流程就结束了。
②AMS启动Activity并通知Launcher进入Paused状态
现在的流程是在AMS中，也就是另一个进程中，上一步通过代理调用到AMS的startActivity方法，接下来的调用如下：
ActivityTaskManagerService.java：
@Override
public final int startActivity(IApplicationThread caller, String callingPackage, String callingFeatureId, Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo, Bundle bOptions) {
return startActivityAsUser(caller, callingPackage, callingFeatureId, intent, resolvedType, resultTo, resultWho, requestCode, startFlags, profilerInfo, bOptions,
UserHandle.getCallingUserId());
}
@Override
public int startActivityAsUser(IApplicationThread caller, String callingPackage, String callingFeatureId, Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId) {
return startActivityAsUser(caller, callingPackage, callingFeatureId, intent, resolvedType, resultTo, resultWho, requestCode, startFlags, profilerInfo, bOptions, userId, true);
}
private int startActivityAsUser( IApplicationThread caller, String callingPackage, String callingFeatureId, Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId, boolean validateIncomingUser) {
...
userId = getActivityStartController().checkTa rgetUser(userId, validateIncomingUser, Binder.getCallingPid(), Binder.getCallingUid(), "startActivityAsUser");
return getActivityStartController().obtainSta rter(intent, "startActivityAsUser")
.setCaller(caller)
.setCallingPackage(callingPackage)
.setCallingFeatureId(callingFeatureId)
.setResolvedType(resolvedType)
.setResultTo(resultTo)
.setResultWho(resultWho)
.setRequestCode(requestCode)
.setStartFlags(startFlags)
.setProfilerInfo(profilerInfo)
.setActivityOptions(bOptions)
.setUserId(userId)
.execute();
}
ActivityStarter obtainStarter(Intent intent, String reason) {
return mFactory.obtain().setIntent( intent).setReason(reason);
}
上面几步主要是做权限检查
ActivityStarter.java：
int execute() {
...
res = executeRequest(mRequest);
...
}
//层层调用会到下面这个方法
ActivityStack.java：
private boolean resumeTopActivityInnerLocked( ActivityRecord prev, ActivityOptions options) {
...
if (mResumedActivity != null) {
pausing |= startPausingLocked(userLeaving, false , next);
}
...
mStackSupervisor.startSpecificActivity(next, true, false);
...
}
startPausingLocked方法主要是通知Launcher进入Paused状态，在它进入这个状态后，在ActivityStackSupervisor.startSpecificActivity方法判断新的App进程状态做出不同响应，如下：
ActivityStackSupervisor.java：
void startSpecificActivity(ActivityRecord r, boolean andResume, boolean checkConfig) {
// 获取要启动的Activity进程信息
final WindowProcessController wpc = mService.getProcessController(r.processName, r.info.applicationInfo.uid);
boolean knownToBeDead = false;
//如果进程存在且进程中有线程存在，就是启动一个同应用的Activity（普通Activity就在此执行）
if (wpc != null && wpc.hasThread()) {
try {
realStartActivityLocked(r, wpc, andResume, checkConfig);
return;
} catch (RemoteException e) {
Slog.w(TAG, "Exception when starting activity " + r.intent.getComponent().flattenToSh ortString(), e);
}
// If a dead object exception was thrown -- fall through to restart the application.
knownToBeDead = true;
}
//否则通过AMS向Zygote进程请求创建新的进程
r.notifyUnknownVisibilityLaunchedForK eyguardTransition();
final boolean isTop = andResume && r.isTopRunningActivity();
mService.startProcessAsync(r, knownToBeDead, isTop, isTop ? "top-activity" : "activity");
}
截止到这里完成了Launcher和AMS的通信，以及AMS和Zygote进程的通信，接下来要创建要启动的App的线程，即ActivityThread。
③新的进程启动，ActivityThread的main函数入口
上一部分Zygote启动新的进程时标记ActivityThread.main函数，在Zygote创建好新进程后通过反射调用此方法，现在处于新App的进程中。
ActivityThread.java：
public static void main(String[] args) {
...
Looper.prepareMainLooper();
...
ActivityThread thread = new ActivityThread();
thread.attach(false, startSeq);
...
Looper.loop();
...
}
private void attach(boolean system, long startSeq) {
final IActivityManager mgr = ActivityManager.getService();
try {
mgr.attachApplication(mAppThread, startSeq);
} catch (RemoteException ex) {
throw ex.rethrowFromSystemServer();
}
...
}
ActivityManagerService.java：
private boolean attachApplicationLocked( IApplicationThread thread, int pid, int callingUid, long startSeq) {
...
thread.bindApplication(processName, appInfo, providerList, instr2.mClass, profilerInfo, instr2.mArguments, instr2.mWatcher, instr2.mUiAutomationConnection, testMode, mBinderTransactionTrackingEnabled, enableTrackAllocation, isRestrictedBackupMode || !normalMode, app.isPersistent(), new Configuration(app.getWindowProcessController().getConfiguration()), app.compat, getCommonServicesLocked(app.isolated),mCoreSettingsObserver.getCoreSettingsLocked(),buildSerial, autofillOptions, contentCaptureOptions, app.mDisabledCompatChanges);
...
didSomething = mAtmInternal.attachApplication(app.getWindowProcessController());
...
}
这里主要是创建了Looper和ActivityThread对象，然后将当前应用ApplicationThread注册到AMS中，ApplicationThread是ActivityThread的内部类实现了IApplicationThread.Stub用此对象可跨进程通信，上面的代码逻辑分两步，第一步，在AMS绑定ApplicationThread时，发送了一个H.BIND_APPLICATION的Message，在Handler中处理该消息时调用了Application的onCreate方法，第二步，在mAtmInternal的attachApplication层层调用到ActivityStackSupervisor.realStartActivityLocked方法，整体如下：
public final void bindApplication(String processName, ApplicationInfo appInfo, ProviderInfoList providerList, ComponentName instrumentationName, ProfilerInfo profilerInfo, Bundle instrumentationArgs, IInstrumentationWatcher instrumentationWatcher,IUiAutomationConnection instrumentationUiConnection, int debugMode, boolean enableBinderTracking, boolean trackAllocation, boolean isRestrictedBackupMode, boolean persistent, Configuration config, CompatibilityInfo compatInfo, Map services, Bundle coreSettings, String buildSerial, AutofillOptions autofillOptions, ContentCaptureOptions contentCaptureOptions, long[] disabledCompatChanges) {
...
sendMessage(H.BIND_APPLICATION, data);
}
public void handleMessage(Message msg) {
switch (msg.what) {
case BIND_APPLICATION:
AppBindData data = (AppBindData)msg.obj;
handleBindApplication(data);
Trace.traceEnd(Trace.TRACE_TAG_ACT IVITY_MANAGER);
break;
...
}
}
private void handleBindApplication(AppBindData data) {
...
mInstrumentation.callApplicationOnCreate( app);
...
}
到这里为止，新的App线程已经启动并且绑定了Application。
④创建Activity
ActivityStackSupervisor.java：
boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc,boolean andResume, boolean checkConfig) throws RemoteException {
...
final ClientTransaction clientTransaction = ClientTransaction.obtain(proc.getThread(), r.appToken);
final DisplayContent dc = r.getDisplay().mDisplayContent;
clientTransaction.addCallback( LaunchActivityItem.obtain(new Intent(r.intent), System.identityHashCode(r), r.info, mergedConfiguration.getGlobalConfiguration(), mergedConfiguration.getOverrideConfiguration(), r.compat, r.launchedFromPackage, task.voiceInteractor,proc.getReportedProcState(),r.getSavedState(), r.getPersistentSavedState(), results, newIntents, dc.isNextTransitionForward(), proc.createProfilerInfoIfNeeded(),r.assistToken, r.createFixedRotationAdjustmentsIfNeeded()));
final ActivityLifecycleItem lifecycleItem;
if (andResume) {
lifecycleItem = ResumeActivityItem.obtain( dc.isNextTransitionForward());
} else {
lifecycleItem = PauseActivityItem.obtain();
}
clientTransaction.setLifecycleStateRequest( lifecycleItem);
//执行clientTransaction
mService.getLifecycleManager().scheduleTra nsaction(clientTransaction);
...
}
ClientTransaction管理了Activity的启动信息，由ClientLifecycleManager执行，scheduleTransaction方法中发送了EXECUTE_TRANSACTION的消息给ActivityThread的H类处理，然后执行TransactionExecutor.execute()，之后执行handleLaunchActivity方法，如下
void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
final IApplicationThread client = transaction.getClient();
transaction.schedule();
...
}
public void schedule() throws RemoteException {
mClient.scheduleTransaction(this);
}
void scheduleTransaction(ClientTransaction transaction) {
transaction.preExecute(this);
sendMessage(ActivityThread.H.EXECUTE_TR ANSACTION, transaction);
}
class H extends Handler {
...
public void handleMessage(Message msg) {
...
case EXECUTE_TRANSACTION:
final ClientTransaction transaction = (ClientTransaction) msg.obj;
mTransactionExecutor.execute( transaction);
if (isSystem()) {
transaction.recycle();
}
break;
...
}
...
}
public void execute(ClientTransactionHandler client, IBinder token, PendingTransactionActions pendingActions) {
...
client.handleLaunchActivity(r, pendingActions, null );
}
接下来由ActivityThread来处理后续操作
public Activity handleLaunchActivity( ActivityClientRecord r,PendingTransactionActions pendingActions, Intent customIntent) {
...
final Activity a = performLaunchActivity(r, customIntent);
...
return a;
}
private Activity performLaunchActivity( ActivityClientRecord r, Intent customIntent) {
ContextImpl appContext = createBaseContextForActivity(r);
...
java.lang.ClassLoader cl = appContext.getClassLoader();
activity = mInstrumentation.newActivity(cl, component.getClassName(), r.intent);
...
Application app = r.packageInfo.makeApplication(false, mInstrumentation);
...
activity.attach(appContext, this, getInstrumentation(), r.token, r.ident, app, r.intent, r.activityInfo, title, r.parent, r.embeddedID, r.lastNonConfigurationInstances, config, r.referrer, r.voiceInteractor, window, r.configCallback, r.assistToken);
...
activity.setTheme(theme);
...
mInstrumentation.callActivityOnCreate( activity, r.state, r.persistentState);
}
performLaunchActivity方法中主要做了以下几件事：
1)创建要启动activity的上下文环境
2)通过Instrumentation的newActivity方法，以反射形式创建activity实例
3)如果Application不存在的话会创建Application并调用Application的onCreate方法
4)初始化Activity，创建Window对象（PhoneWindow）并实现Activity和Window相关联
5)通过Instrumentation调用Activity的onCreate方法
