Android页面启动过程
以 Android 13（API 33）为例，源码网址可参照：http://xrefandroid.com/android-13.0.0_r83/ ，无墙有广告，比如很核心的 ActivityThread 类，对应地址：http://xrefandroid.com/android-13.0.0_r83/xref/frameworks/base/core/java/android/app/ActivityThread.java 。
1. 手机启动过程
1.1. 启动流程总览
电源键 → Boot ROM → Bootloader → Kernel → init → Zygote → SystemServer → Launcher
查看pid为1的进程：
emulator64_arm64:/ # ps -p 1 -o pid,ppid,user,%cpu,%mem,command,name
PID PPID USER %CPU %MEM COMMAND NAME
1 0 root 0.0 0.5 /system/bin/init init
查看ppid为1的zygote进程：
emulator64_arm64:/ # ps -P 1 -o pid,ppid,user,%cpu,%mem,command,name | grep "zygote"
366 1 root 0.0 8.9 /system/bin/app_process64 zygote64
查看ppid为366的进程：
可见，init进程孵化出zygote进程，zygote进程孵化出system_server、launcher桌面、其他App等进程。
1.2. init进程
init是第一个用户进程，进程号：1
源码：system/core/rootdir/init.rc
import /system/etc/init/hw/init.${ro.zygote}.rc
在模拟器上可以看到这个文件（源码位置：system/core/rootdir/init.zygote64.rc）：
手机目录：/system/etc/init/hw/init.zygote64.rc
service zygote /system/bin/app_process64 -Xzygote /system/bin --zygote --start-system-server
class main
priority -20
user root
group root readproc reserved_disk
socket zygote stream 660 root system
socket usap_pool_primary stream 660 root system
onrestart exec_background - system system -- /system/bin/vdc volume abort_fuse
onrestart write /sys/power/state on
onrestart restart audioserver
onrestart restart cameraserver
onrestart restart media
onrestart restart media.tuner
onrestart restart netd
onrestart restart wificond
task_profiles ProcessCapacityHigh
critical window=$æzygote.critical_window.minute:-offå target=zygote-fatal
会执行 /system/bin/app_process64 命令，有一堆参数。
1.3. Zygote进程
源码：frameworks/base/cmds/app_process/app_main.cpp
int main(int argc, char* const argv[])
{
...
AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv)); // Android 5 开始，Android Runtime替代了Dalvik虚拟机
...
if (zygote) {
runtime.start("com.android.internal.os.ZygoteInit", args, zygote); // 启动虚拟机，反射执行 ZygoteInit
} else if (className) {
runtime.start("com.android.internal.os.RuntimeInit", args, zygote); // 没有 --zygote 参数走这里，比如：adb shell am start ...
} else {
...
}
}
执行 runtime.start(...)，源码：frameworks/base/core/jni/AndroidRuntime.cpp
void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
{
if (startVm(&mJavaVM, &env, zygote) != 0) { // 启动虚拟机
return;
}
onVmCreated(env);
...
char* slashClassName = toSlashClassName(className);
jclass startClass = env->FindClass(slashClassName);
if (startClass == NULL) {
...
} else {
jmethodID startMeth = env->GetStaticMethodID(startClass, "main", "([Ljava/lang/String;)V");
if (startMeth == NULL) {
...
else {
env->CallStaticVoidMethod(startClass, startMeth, strArray); // 反射调用Java类的 main() 方法。
}
...
}
...
}
反射执行 ZygoteInit.main()，源码：frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
public static void main(String[] argv) {
ZygoteServer zygoteServer = null;
...
Runnable caller;
try {
....
String zygoteSocketName = "zygote";
....
zygoteServer = new ZygoteServer(isPrimaryZygote);
....
if (startSystemServer) {
Runnable r = forkSystemServer(abiList, zygoteSocketName, zygoteServer);
...
// {@code r == null} in the parent (zygote) process, and {@code r != null} in the
// child (system_server) process.
if (r != null) { // 此处很关键，看注释，fork子进程后，两个进程的逻辑会分叉，zygote进程r==null会走到后面的loop循环，system_server子进程 r!=null，run()后直接return了。
r.run();
return;
}
}
...
caller = zygoteServer.runSelectLoop(abiList); // zygote进程进入等待loop，直到新建App子进程
} catch (Throwable ex) {
Log.e(TAG, "System zygote died with fatal exception", ex);
throw ex;
} finally {
if (zygoteServer != null) {
zygoteServer.closeServerSocket();
}
}
// We're in the child process and have exited the select loop. Proceed to execute the
// command.
if (caller != null) // 新建的App子进程走这里
caller.run();
}
}
这里有个很精巧的设计：fork子进程后，并未直接执行，而是返回一个Runnable再执行，这样从父进程继承下来的调用栈就会被清空，节省内存。
ZygoteServer.java
ZygoteServer(boolean isPrimaryZygote) {
...
mUsapPoolSocket = Zygote.createManagedSocketFromInitSocket(Zygote.USAP_POOL_PRIMARY_SOCKET_NAME);
...
}
Zygote.java
static LocalServerSocket createManagedSocketFromInitSocket(String socketName) {
...
return new LocalServerSocket(fd);
}
LocalServerSocket.java
public LocalServerSocket(FileDescriptor fd) throws IOException {
impl = new LocalSocketImpl(fd);
impl.listen(LISTEN_BACKLOG); // 本地socket连接队列数上限50个
localAddress = impl.getSockAddress();
}
1.4. 启动SystemServer
ZygoteInit.forkSystemServer()
->Zygote.forkSystemServer()
->Zygote.nativeForkSystemServer()
->ZygoteInit.handleSystemServerProcess()
->ZygoteInit.zygoteInit()
->RuntimeInit.applicationInit()
->RuntimeInit.findStaticMain()
->m = cl.getMethod("main", new Class[] { String[].class });
->return new MethodAndArgsCaller(m, argv); // 这是个Runnable，会执行run()，最后执行"com.android.server.SystemServer.main()"
1.5. 启动Launcher
源码：frameworks/base/services/java/com/android/server/SystemServer.java
public static void main(String[] args) {
new SystemServer().run();
}
private void run() {
// Start services.
try {
...
startBootstrapServices(t); // 引导服务：ActivityManagerService、PackageManagerService、PowerManagerService等
startCoreServices(t); // 核心服务：DisplayManagerService、InputManagerService、WindowManagerService等
startOtherServices(t); // 其他服务
startApexServices(t);
} catch (Throwable ex) {
...
} finally {
t.traceEnd(); // StartServices
}
// Loop forever.
Looper.loop();
}
private void startOtherServices(@NonNull TimingsTraceAndSlog t) {
...
mActivityManagerService.systemReady( () -> {...} // 后面会启动桌面
}
源码：frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
public void systemReady(final Runnable goingCallback, @NonNull TimingsTraceAndSlog t) {
...
mAtmInternal.startHomeOnAllDisplays(currentUserId, "systemReady");
...
}
源码：frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
public class ActivityTaskManagerService extends IActivityTaskManager.Stub {
...
final class LocalService extends ActivityTaskManagerInternal {
...
public boolean startHomeOnAllDisplays(int userId, String reason) {
synchronized (mGlobalLock) {
return mRootWindowContainer.startHomeOnAllDisplays(userId, reason);
}
}
...
}
...
}
源码：frameworks/base/services/core/java/com/android/server/wm/RootWindowContainer.java
startHomeOnAllDisplays()
->startHomeOnDisplay()
->startHomeOnTaskDisplayArea()
->mService.getActivityStartController().startHomeActivity(homeIntent, aInfo, myReason, taskDisplayArea)
源码：frameworks/base/services/core/java/com/android/server/wm/ActivityStartController.java
void startHomeActivity(Intent intent, ActivityInfo aInfo, String reason,
TaskDisplayArea taskDisplayArea) {
...
mLastHomeActivityStartResult = obtainStarter(intent, "startHomeActivity: " + reason)
.setOutActivity(tmpOutRecord)
.setCallingUid(0)
.setActivityInfo(aInfo)
.setActivityOptions(options.toBundle())
.execute(); // 到启动App的流程了
...
}
2. 页面启动过程
2.1. 启动页面
源码：frameworks/base/core/java/android/app/Activity.java
startActivity()
->startActivityForResult()
->mInstrumentation.execStartActivity()
源码：frameworks/base/core/java/android/app/Instrumentation.java
execStartActivity()
->ActivityTaskManager.getService().startActivity()
2.2. 切到system_server进程调度
ActivityTaskManager.getService()会通过Binder机制，拿到ActivityTaskManagerService， 切到system_server进程。
源码：frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
startActivity()
->startActivityAsUser()
->return getActivityStartController().obtainStarter(intent, "startActivityAsUser")
.setCaller(caller)
.setCallingPackage(callingPackage)
.setCallingFeatureId(callingFeatureId)
.setResolvedType(resolvedType)
.setResultTo(resultTo)
.setResultWho(resultWho)
.setRequestCode(requestCode)
.setStartFlags(startFlags)
.setProfilerInfo(profilerInfo)
.setActivityOptions(bOptions)
.setUserId(userId)
.execute();
走到之前启动桌面的代码了。
2.3. 启动Activity
源码：frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java
execute()
->executeRequest(mRequest)
->startActivityUnchecked()
->startActivityInner()
->mTargetRootTask.startActivityLocked()
->mRootWindowContainer.resumeFocusedTasksTopActivities()
源码：frameworks/base/services/core/java/com/android/server/wm/RootWindowContainer.java
RootWindowContainer.resumeFocusedTasksTopActivities()
→ Task.resumeTopActivityUncheckedLocked()
→ Task.resumeTopActivityInnerLocked()
→ TaskFragment.resumeTopActivity()
→ mTaskSupervisor.startSpecificActivity()
源码：frameworks/base/services/core/java/com/android/server/wm/ActivityTaskSupervisor.java
mTaskSupervisor.startSpecificActivity(next, true, true) (ActivityTaskSupervisor.java:1034)
├─ 进程已存活 → realStartActivityLocked(r, wpc, ...) (763)
└─ 进程不存在 → mService.startProcessAsync(r, ..., HOSTING_TYPE_TOP_ACTIVITY) (1060)
→ AMS / ProcessList.startProcessLocked → Process.start()
→ ZygoteProcess 连 zygote socket → forkAndSpecialize → ActivityThread.main
进程起来后，attachApplication
ActivityManager.attachApplication(Binder)
→ AMS.attachApplication → mAtmInternal.attachApplication(wpc) (ATMS LocalService, ActivityTaskManagerService.java:6073)
→ RootWindowContainer.attachApplication(app) (1831)
→ 重新走 ActivityTaskSupervisor.realStartActivityLocked() (763)
startFreezingScreenLocked / r.setProcess(proc) / setVisibility(true)
构造 ClientTransaction:
addCallback(LaunchActivityItem.obtain(...)) (902) // 后面会执行
setLifecycleStateRequest(ResumeActivityItem) (917) // 后面会执行
→ ClientLifecycleManager.scheduleTransaction (924)
回调到（ActivityThread.ApplicationThread）， 切回App进程，源码：frameworks/base/core/java/android/app/ActivityThread.java
public final class ActivityThread {
....
private class ApplicationThread extends IApplicationThread.Stub {
...
public void scheduleTransaction(ClientTransaction transaction) throws RemoteException {
ActivityThread.this.scheduleTransaction(transaction); // 这块挺关键的，system_server进程通过IBinder回调ApplicationThread，再通过sendMessage(ActivityThread.H.EXECUTE_TRANSACTION, transaction)回调到ActivityThread (App进程)
}
...
}
...
}
2.4. 后续流程
2.5. 关键代码调用
【客户端侧】
ContextImpl.startActivity()
→ Instrumentation.execStartActivity()
→ ActivityManager.getService().startActivity() [Binder → AMS]
【AMS / system_server 侧】
ActivityTaskManagerService.startActivity()
→ ActivityStarter.execute() / startActivityMayWait()
→ 解析 Intent / 创建 TaskRecord / 确认进程
→ 进程不存在：Process.start(entryPoint="android.app.ActivityThread")
→ attachApplicationLocked()
【新 App 进程侧】
ActivityThread.main()
→ Looper.prepareMainLooper()
→ ActivityThread.attach()
→ mgr.attachApplication(mAppThread) [Binder → AMS]
AMS 回调：
→ app.thread.bindApplication(...) [AMS → App]
→ ActivityThread.handleBindApplication()
→ LoadedApk.makeApplication()
→ installContentProviders() (Provider 先于 Application)
→ mInstrumentation.callApplicationOnCreate()
→ app.thread.scheduleLaunchActivity(...) [AMS → App]
→ ActivityThread.handleLaunchActivity()
→ performLaunchActivity()
→ Activity.attach()
→ activity.performCreate() → onCreate()
→ handleStartActivity() → onStart()
→ handleResumeActivity() → onResume()
浙公网安备 33010602011771号