ActivityManagerService 启动初探

小憩第56篇原创文章

Android init 启动

Android Linux Zygote启动

Android Java Zygote启动

Android SystemServer启动(一)

Android SystemServer启动(二)

在之前的 Android SystemServer启动(二) 中，分析到在 SystemServer 中会启动大量的 Service ，其中就有一个比较特殊的 Service ，它就是 ActivityManagerService 。

今天我们就来了解一下 ActivityManageerService 的启动，下面都将其简称为 AMS 。

启动AMS

AMS 的启动发生在 SystemServer 启动过程中的 BootPhase 0 阶段。

在三大分类服务的启动服务中，即 startBootstrapServices 方法中

private void startBootstrapServices() {
 ...

    ActivityTaskManagerService atm = mSystemServiceManager.startService(
            ActivityTaskManagerService.Lifecycle.class).getService();
    mActivityManagerService = ActivityManagerService.Lifecycle.startService(
            mSystemServiceManager, atm);
    mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
    mActivityManagerService.setInstaller(installer);
    mWindowManagerGlobalLock = atm.getGlobalLock();

    ...
}

AMS 的是通过 AMS 的内部类 Lifecycle 来创建的，同时调用 Lifecycle.onStart() 来启动 AMS 。

public static final class Lifecycle extends SystemService {
    private final ActivityManagerService mService;
    private static ActivityTaskManagerService sAtm;

    public Lifecycle(Context context) {
        super(context);
        mService = new ActivityManagerService(context, sAtm);
    }

    public static ActivityManagerService startService(
            SystemServiceManager ssm, ActivityTaskManagerService atm) {
        sAtm = atm;
        return ssm.startService(ActivityManagerService.Lifecycle.class).getService();
    }

    @Override
    public void onStart() {
        mService.start();
    }
    
    ...
}

Lifecycle 继承于 SystemService ，通过 ssm 即 SystemServiceManager 来启动这个 Service 。

内部是通过反射来创建 Lifecycle 实例，而在 Lifecycle 实例的过程中会创建 AMS 。

所以接下来我们来看下 AMS 实例化过程中做了什么

public ActivityManagerService(Context systemContext, ActivityTaskManagerService atm) {
 ...

 // 创建名为ActivityManager的线程，并创建MainHandler 
 // 处理各种状态信息的线程（GC、service_timeout、update_time_zone、kill_application、kill_zygote）
    mHandlerThread = new ServiceThread(TAG,
            THREAD_PRIORITY_FOREGROUND, false /*allowIo*/);
    mHandlerThread.start();
    mHandler = new MainHandler(mHandlerThread.getLooper());
    // 获取UiHandler
    mUiHandler = mInjector.getUiHandler(this);

    // 创建与启动proc线程
    mProcStartHandlerThread = new ServiceThread(TAG + ":procStart",
            THREAD_PRIORITY_FOREGROUND, false /* allowIo */);
    mProcStartHandlerThread.start();
    mProcStartHandler = new Handler(mProcStartHandlerThread.getLooper());

    // 定义一些常量，管理ActivityManager的行为
    mConstants = new ActivityManagerConstants(mContext, this, mHandler);
    // 追踪活跃的uid
    final ActiveUids activeUids = new ActiveUids(this, true /* postChangesToAtm */);
    mProcessList.init(this, activeUids);
    // 低内存探测器
    mLowMemDetector = new LowMemDetector(this);
    mOomAdjuster = new OomAdjuster(this, mProcessList, activeUids);

    // 前台广播接收器
    final BroadcastConstants foreConstants = new BroadcastConstants(
            Settings.Global.BROADCAST_FG_CONSTANTS);
    foreConstants.TIMEOUT = BROADCAST_FG_TIMEOUT;

    // 后台广播接收器
    final BroadcastConstants backConstants = new BroadcastConstants(
            Settings.Global.BROADCAST_BG_CONSTANTS);
    backConstants.TIMEOUT = BROADCAST_BG_TIMEOUT;

    // 卸载广播接收器
    final BroadcastConstants offloadConstants = new BroadcastConstants(
            Settings.Global.BROADCAST_OFFLOAD_CONSTANTS);
    offloadConstants.TIMEOUT = BROADCAST_BG_TIMEOUT;

    offloadConstants.SLOW_TIME = Integer.MAX_VALUE;

    mEnableOffloadQueue = SystemProperties.getBoolean(
            "persist.device_config.activity_manager_native_boot.offload_queue_enabled", false);

    mFgBroadcastQueue = new BroadcastQueue(this, mHandler,
            "foreground", foreConstants, false);
    mBgBroadcastQueue = new BroadcastQueue(this, mHandler,
            "background", backConstants, true);
    mOffloadBroadcastQueue = new BroadcastQueue(this, mHandler,
            "offload", offloadConstants, true);
    mBroadcastQueues[0] = mFgBroadcastQueue;
    mBroadcastQueues[1] = mBgBroadcastQueue;
    mBroadcastQueues[2] = mOffloadBroadcastQueue;

    mServices = new ActiveServices(this);
    mProviderMap = new ProviderMap(this);
    mPackageWatchdog = PackageWatchdog.getInstance(mUiContext);
    mAppErrors = new AppErrors(mUiContext, this, mPackageWatchdog);

    final File systemDir = SystemServiceManager.ensureSystemDir();

    // 电池状态
    mBatteryStatsService = new BatteryStatsService(systemContext, systemDir,
            BackgroundThread.get().getHandler());
    mBatteryStatsService.getActiveStatistics().readLocked();
    mBatteryStatsService.scheduleWriteToDisk();
    mOnBattery = DEBUG_POWER ? true
            : mBatteryStatsService.getActiveStatistics().getIsOnBattery();
    mBatteryStatsService.getActiveStatistics().setCallback(this);
    mOomAdjProfiler.batteryPowerChanged(mOnBattery);

    // 进程状态
    mProcessStats = new ProcessStatsService(this, new File(systemDir, "procstats"));

    mAppOpsService = mInjector.getAppOpsService(new File(systemDir, "appops.xml"), mHandler);

    ... 

    mActivityTaskManager = atm;
    mActivityTaskManager.initialize(mIntentFirewall, mPendingIntentController,
            DisplayThread.get().getLooper());
    mAtmInternal = LocalServices.getService(ActivityTaskManagerInternal.class);

    // 进程cpu统计线程
    mProcessCpuThread = new Thread("CpuTracker") {
        @Override
        public void run() {
            synchronized (mProcessCpuTracker) {
                mProcessCpuInitLatch.countDown();
                mProcessCpuTracker.init();
            }
            while (true) {
                try {
                    try {
                        synchronized(this) {
                            final long now = SystemClock.uptimeMillis();
                            long nextCpuDelay = (mLastCpuTime.get()+MONITOR_CPU_MAX_TIME)-now;
                            long nextWriteDelay = (mLastWriteTime+BATTERY_STATS_TIME)-now;
                            //Slog.i(TAG, "Cpu delay=" + nextCpuDelay
                            //        + ", write delay=" + nextWriteDelay);
                            if (nextWriteDelay  0) {
                                mProcessCpuMutexFree.set(true);
                                this.wait(nextCpuDelay);
                            }
                        }
                    } catch (InterruptedException e) {
                    }
                    // 更新cpu的信息
                    updateCpuStatsNow();
                } catch (Exception e) {
                    Slog.e(TAG, "Unexpected exception collecting process stats", e);
                }
            }
        }
    };

    ...
}

所以这里主要做的事是创建 ActivityManager 、 proc 与 CpuTracker 线程；同时创建对应的广播接收器。

创建完 AMS 实例之后会调用 start() 方法来启动 AMS

private void start() {
 // 移除所有进程组
    removeAllProcessGroups();
    // 开启进程cpu统计线程
    mProcessCpuThread.start();

    // 启动电池统计服务
    mBatteryStatsService.publish();
    mAppOpsService.publish(mContext);

    // 添加到本地LocalServices中
    LocalServices.addService(ActivityManagerInternal.class, new LocalService());
    mActivityTaskManager.onActivityManagerInternalAdded();
    mUgmInternal.onActivityManagerInternalAdded();
    mPendingIntentController.onActivityManagerInternalAdded();

    try {
     // 等待进程cpu统计线程运行
        mProcessCpuInitLatch.await();
    } catch (InterruptedException e) {
        Slog.wtf(TAG, "Interrupted wait during start", e);
        Thread.currentThread().interrupt();
        throw new IllegalStateException("Interrupted wait during start");
    }
}

这个时候 AMS 就已经启动完毕。

下面我们在来看下 AMS 在 SystemServer 中都干了什么

startBootstrapServices

private void startBootstrapServices() {
 ...

 mActivityManagerService.initPowerManagement();
 ...

 mActivityManagerService.setSystemProcess();
 ...
}

initPowerManagement

首先会初始化 PowerManagement

public void initPowerManagement() {
    mActivityTaskManager.onInitPowerManagement();
    mBatteryStatsService.initPowerManagement();
    mLocalPowerManager = LocalServices.getService(PowerManagerInternal.class);
}

最终会通过 BatterStateService 来初始化 PowerManagement 。

setSystemProcess

接下来是 setSystemProcess ，注册相关的服务。

public void setSystemProcess() {
    try {
     // 注册ActivityManagerService
        ServiceManager.addService(Context.ACTIVITY_SERVICE, this, /* allowIsolated= */ true,
                DUMP_FLAG_PRIORITY_CRITICAL | DUMP_FLAG_PRIORITY_NORMAL | DUMP_FLAG_PROTO);
        // 注册 ProcessStatsService
        ServiceManager.addService(ProcessStats.SERVICE_NAME, mProcessStats);
        // 注册MemBinder
        ServiceManager.addService("meminfo", new MemBinder(this), /* allowIsolated= */ false,
                DUMP_FLAG_PRIORITY_HIGH);
        // 注册GraphicsBinder
        ServiceManager.addService("gfxinfo", new GraphicsBinder(this));
        // 注册DbBinder
        ServiceManager.addService("dbinfo", new DbBinder(this));
        if (MONITOR_CPU_USAGE) {
         // 注册CpuBinder
            ServiceManager.addService("cpuinfo", new CpuBinder(this),
                    /* allowIsolated= */ false, DUMP_FLAG_PRIORITY_CRITICAL);
        }
        // 注册PermissionController
        ServiceManager.addService("permission", new PermissionController(this));
        // 注册ProcessInfoService
        ServiceManager.addService("processinfo", new ProcessInfoService(this));

        // 加载包名为android的包，最终通过LoadedApk来加载
        ApplicationInfo info = mContext.getPackageManager().getApplicationInfo(
                "android", STOCK_PM_FLAGS | MATCH_SYSTEM_ONLY);
        mSystemThread.installSystemApplicationInfo(info, getClass().getClassLoader());

        ...
}

需要注意的是，这里将 AMS 注册到 ServiceManager 中，后续通过 ActivityManager 来获取注册的 AMS 。

接下来就进入了 startCoreServices ，启动核心服务

startCoreServices

private void startCoreServices() {
 ...
 mActivityManagerService.setUsageStatsManager(
                LocalServices.getService(UsageStatsManagerInternal.class));
 ...
}

这里做的事情很简单，设置 UsageStateManager

startOtherServices

继续来到启动其它的服务模块

private void startOtherServices() {
 ...
 mActivityManagerService.installSystemProviders();

 mActivityManagerService.setWindowManager(wm);

 mActivityManagerService.systemReady(...)
 ...
}

在这里主要做的是安装系统的 Provider 、设置 WindowManagerService 与 systemReady 的准备工作。

installSystemProviders

public final void installSystemProviders() {
    List providers;
    synchronized (this) {
        ProcessRecord app = mProcessList.mProcessNames.get("system", SYSTEM_UID);
        // 获取Providers
        providers = generateApplicationProvidersLocked(app);
        if (providers != null) {
            for (int i=providers.size()-1; i>=0; i--) {
                ProviderInfo pi = (ProviderInfo)providers.get(i);
                // 清除非系统的Providers
                if ((pi.applicationInfo.flags&ApplicationInfo.FLAG_SYSTEM) == 0) {
                    providers.remove(i);
                }
            }
        }
    }
    // 通过ActivityThread来安装系统的Providers
    if (providers != null) {
        mSystemThread.installSystemProviders(providers);
    }

    synchronized (this) {
        mSystemProvidersInstalled = true;
    }
    mConstants.start(mContext.getContentResolver());
    mCoreSettingsObserver = new CoreSettingsObserver(this);
    mActivityTaskManager.installSystemProviders();
    mDevelopmentSettingsObserver = new DevelopmentSettingsObserver();
    SettingsToPropertiesMapper.start(mContext.getContentResolver());
    mOomAdjuster.initSettings();
}

这里主要做的就是安装系统的 Providers

WindowManagerService

public void setWindowManager(WindowManagerService wm) {
    synchronized (this) {
        mWindowManager = wm;
        mActivityTaskManager.setWindowManager(wm);
    }
}

设置 WindowManagerService 服务

systemReady

systemReady 的逻辑比较多，我们拆开来说

public void systemReady(final Runnable goingCallback, TimingsTraceLog traceLog) {
 goingCallback before

 if (goingCallback != null) goingCallback.run();

 goingCallback after
}

在调用 goingCallback.run 之前

public void systemReady(final Runnable goingCallback, TimingsTraceLog traceLog) {
  synchronized(this) {
        // 第一次进来为false，跳过
        if (mSystemReady) {
            if (goingCallback != null) {
                goingCallback.run();
            }
            return;
        }

        ...

        mSystemReady = true;
    }

    ...

    ArrayList procsToKill = null;
    synchronized(mPidsSelfLocked) {
        for (int i=mPidsSelfLocked.size()-1; i>=0; i--) {
            ProcessRecord proc = mPidsSelfLocked.valueAt(i);
            // 非president进程
            if (!isAllowedWhileBooting(proc.info)){
                if (procsToKill == null) {
                    procsToKill = new ArrayList();
                }
                // 加入到procsTokill中
                procsToKill.add(proc);
            }
        }
    }

    synchronized(this) {
        if (procsToKill != null) {
         // kill procsToKill中的进程
            for (int i=procsToKill.size()-1; i>=0; i--) {
                ProcessRecord proc = procsToKill.get(i);
                mProcessList.removeProcessLocked(proc, true, false, "system update done");
            }
        }

        mProcessesReady = true;
    }

    ...

    if (goingCallback != null) goingCallback.run();

    ...
}

主要做的事情杀掉 procsToKill 中的进程，此时系统与进程都已经准备就绪

之后再调用 goingCallback.run

mActivityManagerService.systemReady(() -> {
    
    // BootPhase 550
    mSystemServiceManager.startBootPhase(
            SystemService.PHASE_ACTIVITY_MANAGER_READY);

    try {
        mActivityManagerService.startObservingNativeCrashes();
    } catch (Throwable e) {
        reportWtf("observing native crashes", e);
    }

    traceBeginAndSlog("MakeConnectivityServiceReady");
    try {
        if (connectivityF != null) {
            connectivityF.systemReady();
        }
    } catch (Throwable e) {
        reportWtf("making Connectivity Service ready", e);
    }

    ...
    
    // BootPhase 600
    mSystemServiceManager.startBootPhase(
            SystemService.PHASE_THIRD_PARTY_APPS_CAN_START);

    try {
        if (locationF != null) {
            locationF.systemRunning();
        }
    } catch (Throwable e) {
        reportWtf("Notifying Location Service running", e);
    }

    try {
        if (countryDetectorF != null) {
            countryDetectorF.systemRunning();
        }
    } catch (Throwable e) {
        reportWtf("Notifying CountryDetectorService running", e);
    }

    ...

}, BOOT_TIMINGS_TRACE_LOG);

这个在 Android SystemServer启动(二) 中已经分析了，这里就不多介绍了。

主要是对一些服务进行 systemReady 与 systemRuning 操作。

最后来到 systemReady 的最后一个步骤

public void systemReady(final Runnable goingCallback, TimingsTraceLog traceLog) {
 ...

 if (goingCallback != null) goingCallback.run();

    final int currentUserId = mUserController.getCurrentUserId();
    if (currentUserId != UserHandle.USER_SYSTEM && !mUserController.isSystemUserStarted()) {
        throw new RuntimeException("System user not started while current user is:"
                + currentUserId);
    }
    mBatteryStatsService.noteEvent(BatteryStats.HistoryItem.EVENT_USER_RUNNING_START,
            Integer.toString(currentUserId), currentUserId);
    mBatteryStatsService.noteEvent(BatteryStats.HistoryItem.EVENT_USER_FOREGROUND_START,
            Integer.toString(currentUserId), currentUserId);

    // 调用所有SystemService的onStartUser方法
    mSystemServiceManager.startUser(currentUserId);

    synchronized (this) {
        // 开启Persistent app
        startPersistentApps(PackageManager.MATCH_DIRECT_BOOT_AWARE);

        mBooting = true;
        if (UserManager.isSplitSystemUser() &&
                Settings.Secure.getInt(mContext.getContentResolver(),
                     Settings.Secure.USER_SETUP_COMPLETE, 0) != 0) {
            ComponentName cName = new ComponentName(mContext, SystemUserHomeActivity.class);
            try {
                AppGlobals.getPackageManager().setComponentEnabledSetting(cName,
                        PackageManager.COMPONENT_ENABLED_STATE_ENABLED, 0,
                        UserHandle.USER_SYSTEM);
            } catch (RemoteException e) {
                throw e.rethrowAsRuntimeException();
            }
        }
        // 启动系统桌面Activity
        mAtmInternal.startHomeOnAllDisplays(currentUserId, "systemReady");

        mAtmInternal.showSystemReadyErrorDialogsIfNeeded();

        final int callingUid = Binder.getCallingUid();
        final int callingPid = Binder.getCallingPid();
        long ident = Binder.clearCallingIdentity();
        try {
         // 发送USER_STARTED广播
            Intent intent = new Intent(Intent.ACTION_USER_STARTED);
            intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY
                    | Intent.FLAG_RECEIVER_FOREGROUND);
            intent.putExtra(Intent.EXTRA_USER_HANDLE, currentUserId);
            broadcastIntentLocked(null, null, intent,
                    null, null, 0, null, null, null, OP_NONE,
                    null, false, false, MY_PID, SYSTEM_UID, callingUid, callingPid,
                    currentUserId);

            // 发送USER_STARTING广播
            intent = new Intent(Intent.ACTION_USER_STARTING);
            intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY);
            intent.putExtra(Intent.EXTRA_USER_HANDLE, currentUserId);
            broadcastIntentLocked(null, null, intent,
                    null, new IIntentReceiver.Stub() {
                        @Override
                        public void performReceive(Intent intent, int resultCode, String data,
                                Bundle extras, boolean ordered, boolean sticky, int sendingUser)
                                throws RemoteException {
                        }
                    }, 0, null, null,
                    new String[] {INTERACT_ACROSS_USERS}, OP_NONE,
                    null, true, false, MY_PID, SYSTEM_UID, callingUid, callingPid,
                    UserHandle.USER_ALL);
        } catch (Throwable t) {
            Slog.wtf(TAG, "Failed sending first user broadcasts", t);
        } finally {
            Binder.restoreCallingIdentity(ident);
        }
        mAtmInternal.resumeTopActivities(false /* scheduleIdle */);
        mUserController.sendUserSwitchBroadcasts(-1, currentUserId);

        BinderInternal.nSetBinderProxyCountWatermarks(BINDER_PROXY_HIGH_WATERMARK,
                BINDER_PROXY_LOW_WATERMARK);
        BinderInternal.nSetBinderProxyCountEnabled(true);
        BinderInternal.setBinderProxyCountCallback(
                new BinderInternal.BinderProxyLimitListener() {
                    @Override
                    public void onLimitReached(int uid) {
                        Slog.wtf(TAG, "Uid " + uid + " sent too many Binders to uid "
                                + Process.myUid());
                        BinderProxy.dumpProxyDebugInfo();
                        if (uid == Process.SYSTEM_UID) {
                            Slog.i(TAG, "Skipping kill (uid is SYSTEM)");
                        } else {
                            killUid(UserHandle.getAppId(uid), UserHandle.getUserId(uid),
                                    "Too many Binders sent to SYSTEM");
                        }
                    }
                }, mHandler);

        // 恢复栈顶Activity
        mAtmInternal.resumeTopActivities(false /* scheduleIdle */);
        // 发送User_SWITCH 广播
        mUserController.sendUserSwitchBroadcasts(-1, currentUserId);

        ...
    }
}

其中 startUser 会回调之前的 SystemService 的 onStartUser 方法

public void startUser(final int userHandle) {
    final int serviceLen = mServices.size();
    // 遍历mServices
    for (int i = 0; i < serviceLen; i++) {
        final SystemService service = mServices.get(i);
        Trace.traceBegin(Trace.TRACE_TAG_SYSTEM_SERVER, "onStartUser "
                + service.getClass().getName());
        long time = SystemClock.elapsedRealtime();
        try {
         // 回调onStartUser
            service.onStartUser(userHandle);
        } catch (Exception ex) {
            Slog.wtf(TAG, "Failure reporting start of user " + userHandle
                    + " to service " + service.getClass().getName(), ex);
        }
    }
}

startHomeOnAllDisplays 最终会来到 RootActivityContainer 的 startHomeOnDisplay 方法

boolean startHomeOnDisplay(int userId, String reason, int displayId, boolean allowInstrumenting,
        boolean fromHomeKey) {
    if (displayId == INVALID_DISPLAY) {
        displayId = getTopDisplayFocusedStack().mDisplayId;
    }

    Intent homeIntent = null;
    ActivityInfo aInfo = null;
    if (displayId == DEFAULT_DISPLAY) {
        homeIntent = mService.getHomeIntent();
        aInfo = resolveHomeActivity(userId, homeIntent);
    } else if (shouldPlaceSecondaryHomeOnDisplay(displayId)) {
        Pair info = resolveSecondaryHomeActivity(userId, displayId);
        aInfo = info.first;
        homeIntent = info.second;
    }
    if (aInfo == null || homeIntent == null) {
        return false;
    }

    if (!canStartHomeOnDisplay(aInfo, displayId, allowInstrumenting)) {
        return false;
    }

    // 设置home Intent 的Component信息
    homeIntent.setComponent(new ComponentName(aInfo.applicationInfo.packageName, aInfo.name));
    homeIntent.setFlags(homeIntent.getFlags() | FLAG_ACTIVITY_NEW_TASK);

    // 设置extra
    if (fromHomeKey) {
        homeIntent.putExtra(WindowManagerPolicy.EXTRA_FROM_HOME_KEY, true);
    }

    final String myReason = reason + ":" + userId + ":" + UserHandle.getUserId(
            aInfo.applicationInfo.uid) + ":" + displayId;

    // 启动桌面Activity
    mService.getActivityStartController().startHomeActivity(homeIntent, aInfo, myReason,
            displayId);
    return true;
}

总结一下，在 goingCallback.run 之后，该阶段主要做的事情是：

1. 调用所有之前添加的
   SystemService 的
   onStartUser 方法
2. 启动
   Persistent 进程

3. 启动系统桌面Activity

4. 发送USER_STARTED广播

5. 发送USER_STARTING广播

6. 恢复栈顶Activity

7. 发送User_SWITCH广播

以上就是 AMS 在 SystemServer 中的全部过程, 也是 AMS 的启动过程。

整个过程主要做的事情是：

1. Lifecycle
   AMS
   onStart()
   AMS
   

2. setSystemProcess
   AMS
   meminfo
   gfxinfo
   dbinfo
   cpuinfo
   ServiceManager
   

3. 通过
   installSystemProviders 来加载系统的
   providers

4. systemReady
   ready
   running
   Activity