Android之AMS原理分析

在学习android框架原理过程中，ams的原理非常重要，无论是在面试中还是在自己开发类库过程中都会接触到。

1 简述

ActivityManagerService是Android最核心的服务，负责管理四大组件的启动、切换、调度等工作。由于AMS的功能和重要性，它是运行在SystemServer进程，客户端不能直接访问。但是可以通过ActivityManager类的getService方法获取IActivityManager，然后与AMS通信。

2 AMS启动流程

init进程

Android系统总共分为4层，从上到下为，应用层、框架层、系统层、linux内核层。整个系统启动时，会先由各个厂商的引导程序拉起，加载一些资源，然后启动init进程，挂载分区，创建必要目录，初始化日志系统和安全策略。最后解析init.rc文件，去启动zygote进程。

zygote进程

通过init进程拉起zygote后，

service zygote /system/bin/app_process64 -Xzygote /system/bin --zygote --start-system-server --socket-name=zygoteclass mainpriority -20user root                                 # 用户为rootgroup root readproc reserved_disksocket zygote stream 660 root systemsocket usap_pool_primary stream 660 root systemonrestart exec_background - system system -- /system/bin/vdc volume abort_fuseonrestart write /sys/power/state ononrestart restart audioserveronrestart restart cameraserveronrestart restart mediaonrestart restart media.tuneronrestart restart netdonrestart restart wificondtask_profiles ProcessCapacityHigh MaxPerformancecritical window=${zygote.critical_window.minute:-off} target=zygote-fatalservice zygote_secondary /system/bin/app_process32 -Xzygote /system/bin --zygote --socket-name=zygote_secondary --enable-lazy-preloadclass mainpriority -20user rootgroup root readproc reserved_disksocket zygote_secondary stream 660 root systemsocket usap_pool_secondary stream 660 root systemonrestart restart zygotetask_profiles ProcessCapacityHigh MaxPerformance

会创建JavaVM，并注册JNI
通过JNI调用ZygoteInit的main函数进入Zygote的Java框架层，创建服务端Socket，预加载类和资源，并通过runSelectLoop函数等待如ActivityManagerService等的请求。
调用forkSystemServer 来启动SystemServer进程，这样系统的关键服务也会由SystemServer进程启动起来。

SystemServer进程

/*** 进程的入口点*/
public static void main(String[] args) {new SystemServer().run();
}private void run() {...// 启动 AMS PowerManagerService PackageManagerService 等服务startBootstrapServices(t);// 启动了BatteryService UsageStatsService WebViewUpdateServicestartCoreServices(t);// CameraService AlarmManagerService VrManagerServicestartOtherServices(t);    ...}

Zygote启动后fork的第一个进程为SystemServer，这个进程就会去启动一系列的服务，AMS服务也是由这个进程启动。

AMS 启动

private void startBootstrapServices(@NonNull TimingsTraceAndSlog t) {t.traceBegin("startBootstrapServices");// ...// Activity manager runs the show.// 创建并运行AMSt.traceBegin("StartActivityManager");// TODO: Might need to move after migration to WM.ActivityTaskManagerService atm = mSystemServiceManager.startService(ActivityTaskManagerService.Lifecycle.class).getService();mActivityManagerService = ActivityManagerService.Lifecycle.startService(mSystemServiceManager, atm);mActivityManagerService.setSystemServiceManager(mSystemServiceManager);mActivityManagerService.setInstaller(installer);mWindowManagerGlobalLock = atm.getGlobalLock();t.traceEnd();// ...t.traceEnd(); // startBootstrapServices
}public static final class Lifecycle extends SystemService {private final ActivityManagerService mService;private static ActivityTaskManagerService sAtm;public Lifecycle(Context context) {super(context);mService = new ActivityManagerService(context, sAtm);}public static ActivityManagerService startService(SystemServiceManager ssm, ActivityTaskManagerService atm) {sAtm = atm;return ssm.startService(ActivityManagerService.Lifecycle.class).getService();}@Overridepublic void onStart() {mService.start();}@Overridepublic void onBootPhase(int phase) {mService.mBootPhase = phase;if (phase == PHASE_SYSTEM_SERVICES_READY) {mService.mBatteryStatsService.systemServicesReady();mService.mServices.systemServicesReady();} else if (phase == PHASE_ACTIVITY_MANAGER_READY) {mService.startBroadcastObservers();} else if (phase == PHASE_THIRD_PARTY_APPS_CAN_START) {mService.mPackageWatchdog.onPackagesReady();}}@Overridepublic void onCleanupUser(int userId) {mService.mBatteryStatsService.onCleanupUser(userId);}public ActivityManagerService getService() {return mService;}
}public void startService(@NonNull final SystemService service) {// 注册服务mServices.add(service);// 开启服务long time = SystemClock.elapsedRealtime();try {service.onStart();} catch (RuntimeException ex) {throw new RuntimeException("Failed to start service " + service.getClass().getName()+ ": onStart threw an exception", ex);}warnIfTooLong(SystemClock.elapsedRealtime() - time, service, "onStart");
}private void start() {// ...
}

从代码中可以看出在startBootstrapServices方法中，创建了ActivityManagerService服务对象，然后在startService方法中调用service.onStart()，也就是走Lifecycle中实现的方法，然后最终走到start()，启动服务。

3 AMS在启动App过程中的体现

fock新进程

我们手机上的App都是在Launcher（就是个Actviity）中显示的，点击图标会触发onClick收到点击事件，然后走startActivitySafely方法，继续往下走，会发现就是startActivity方法往后走的调用。

LauncherAppsService -> startActivityAsUser
ActivityTaskManagerService -> startActivityAsUser
ActivityStarter -> execute
ActivityStarter -> startActivityUnchecked
ActivityStarter -> startActivityInner
ActivityStack -> startActivityLocked
ActivityStack -> ensureActivitiesVisible
EnsureActivitiesVisibleHelper -> process
EnsureActivitiesVisibleHelper -> setActivityVisibilityState
ActivityRecord -> makeActiveIfNeeded
ActivityStack -> resumeTopActivityUncheckedLocked
ActivityStack -> resumeTopActivityInnerLocked
ActivityTaskManagerService -> startProcessAsync
ActivityManagerService -> startProcess
ActivityManagerService -> startProcessLocked
ProcessList -> startProcessLocked (指定启动进程后，走android.app.ActivityThread main方法 : final String entryPoint = "android.app.ActivityThread";)
ProcessList -> startProcess
ZygoteProcess -> start
ZygoteProcess -> startViaZygote
zygoteSendArgsAndGetResult
attemptZygoteSendArgsAndGetResultprivate Process.ProcessStartResult attemptZygoteSendArgsAndGetResult(ZygoteState zygoteState, String msgStr) throws ZygoteStartFailedEx {try {final BufferedWriter zygoteWriter = zygoteState.mZygoteOutputWriter;final DataInputStream zygoteInputStream = zygoteState.mZygoteInputStream;zygoteWriter.write(msgStr);zygoteWriter.flush();// Always read the entire result from the input stream to avoid leaving// bytes in the stream for future process starts to accidentally stumble// upon.Process.ProcessStartResult result = new Process.ProcessStartResult();result.pid = zygoteInputStream.readInt();result.usingWrapper = zygoteInputStream.readBoolean();if (result.pid < 0) {throw new ZygoteStartFailedEx("fork() failed");}return result;} catch (IOException ex) {zygoteState.close();Log.e(LOG_TAG, "IO Exception while communicating with Zygote - "+ ex.toString());throw new ZygoteStartFailedEx(ex);}
}

Launcher通知AMS启动APP的MainActivity，也就是清单文件设置启动的Activity
AMS记录要启动的Activity信息，并且通知Launcher进入pause状态
Launcher进入pause状态后，通知AMS已经paused了，可以启动app了
app未开启过，所以会通过socket发送消息给AMS
AMS在SystemServer进程，该进程在启动时，执行ZygoteInit.main()后便进入runSelectLoop()循环体内，当有客户端连接时便会执行ZygoteConnection.runOnce()方法，再经过层层调用后fork出新的应用进程（handleChildProc）
并且在新进程中创建ActivityThread对象，执行其中的main函数方法

ActivityThread

ActivityThread会做很多事，我们只分析和app启动与AMS相关的。

public static void main(String[] args) {// ...Looper.prepareMainLooper();ActivityThread thread = new ActivityThread();// 绑定Applicationthread.attach(false, startSeq);Looper.loop();// ...
}private void attach(boolean system) { sCurrentActivityThread = this;mSystemThread = system; // falseif (!system) { // true...// 获取 AMS，调用AMS的 attachApplicationfinal IActivityManager mgr = ActivityManager.getService();try {mgr.attachApplication(mAppThread);} catch (RemoteException ex) {throw ex.rethrowFromSystemServer();}// Watch for getting close to heap limit....} else { // 系统进程处理逻辑...}...
}

AMS 处理绑定Application

@Override
public final void attachApplication(IApplicationThread thread, long startSeq) {if (thread == null) {throw new SecurityException("Invalid application interface");}synchronized (this) {int callingPid = Binder.getCallingPid();final int callingUid = Binder.getCallingUid();final long origId = Binder.clearCallingIdentity();attachApplicationLocked(thread, callingPid, callingUid, startSeq);Binder.restoreCallingIdentity(origId);}
}private final boolean attachApplicationLocked(IApplicationThread thread,int pid) {ProcessRecord app;// 根据pid 获取 对应 ProcessRecord// 新进程的名字final String processName = app.processName;...thread.bindApplication(processName, appInfo, providerList, null, profilerInfo,null, null, null, testMode,mBinderTransactionTrackingEnabled, enableTrackAllocation,isRestrictedBackupMode || !normalMode, app.isPersistent(),new Configuration(app.getWindowProcessController().getConfiguration()),app.compat, getCommonServicesLocked(app.isolated),mCoreSettingsObserver.getCoreSettingsLocked(),buildSerial, autofillOptions, contentCaptureOptions,app.mDisabledCompatChanges);...//查找所有可运行在该进程中的服务//检查这个进程中是否有下一个广播接收者//检查这个进程中是否有下一个备份代理//上述操作如果出现异常就杀死进程...}

ActivityThread.bindApplication

@Override
public final void bindApplication(String processName, ApplicationInfo appInfo,ProviderInfoList providerList, ComponentName instrumentationName,ProfilerInfo profilerInfo, Bundle instrumentationArgs,IInstrumentationWatcher instrumentationWatcher,IUiAutomationConnection instrumentationUiConnection, int debugMode,boolean enableBinderTracking, boolean trackAllocation,boolean isRestrictedBackupMode, boolean persistent, Configuration config,CompatibilityInfo compatInfo, Map services, Bundle coreSettings,String buildSerial, AutofillOptions autofillOptions,ContentCaptureOptions contentCaptureOptions, long[] disabledCompatChanges) {...AppBindData data = new AppBindData();data.processName = processName;data.appInfo = appInfo;...sendMessage(H.BIND_APPLICATION, data);
}private void handleBindApplication(AppBindData data) {...// application oncreatemInstrumentation.callApplicationOnCreate(app);
}

启动MainActivity

App启动时我们通过fork Zygote进程，创建了app进程，并做了一些application的绑定等等操作。
这些处理好后，就可以继续启动MainActivity。

ActivityStack -> resumeTopActivityInnerLocked
ActivityStackSupervisor -> startSpecificActivity
ActivityStackSupervisor -> realStartActivityLockedprivate boolean resumeTopActivityInnerLocked(ActivityRecord prev, ActivityOptions options) {// ...// Since the start-process is asynchronous, if we already know the process of next// activity isn't running, we can start the process earlier to save the time to wait// for the current activity to be paused.final boolean isTop = this == taskDisplayArea.getFocusedStack();mAtmService.startProcessAsync(next, false /* knownToBeDead */, isTop,isTop ? "pre-top-activity" : "pre-activity");// ...mStackSupervisor.startSpecificActivity(next, true, true);}boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc,boolean andResume, boolean checkConfig) throws RemoteException {mService.getLifecycleManager().scheduleTransaction(clientTransaction);
}// 通过aidl进入app所在进程
// 启动MainActivityActivityThread -> scheduleTransaction
...
ActivityThread -> handleLaunchActivity
ActivityThread -> performLaunchActivity