Skytoby
Skytoby

Android四大组件与进程启动间关系

Posted on

Android四大组件与进程启动间关系

Posted on

基于Android10.0，分析四大组件与进程启动间的关系

一、概述

Android进程对于系统来说非常重要，而Android四大组件是Android应用的基础。在前面分析过Android进程创建的过程，那么对于四大组件来说和进程之间又有什么关联，这里主要看AMS.startProcessLocked方法。

二、四大组件与进程

2.1 四大组件

Activity、Service、ContentProvider、BroadcastReceiver这四大组件，在启动的过程中，当其承载的进程不存在时需要调用startProcessLocked先创建进程。

2.1.1 Activity

启动Activity，调用的是startActivity方法，经过层层调用ActivityStackSupervisor.java中的startSpecificActivityLocked。当activity所属的进程还没有启动时，则需要创建相应的进程。详细见startActivity启动过程

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
void startSpecificActivityLocked(ActivityRecord r,
            boolean andResume, boolean checkConfig) {
        ...
        if (app != null && app.thread != null) {
            try {
                if ((r.info.flags&ActivityInfo.FLAG_MULTIPROCESS) == 0
                        || !"android".equals(r.info.packageName)) {
                    // Don't add this if it is a platform component that is marked
                    // to run in multiple processes, because this is actually
                    // part of the framework so doesn't make sense to track as a
                    // separate apk in the process.
                    app.addPackage(r.info.packageName, r.info.applicationInfo.longVersionCode,
                            mService.mProcessStats);
                }
                //真正启动Activity，见2.18节
                realStartActivityLocked(r, app, andResume, checkConfig);
                return;
            } catch (RemoteException e) {
                Slog.w(TAG, "Exception when starting activity "
                        + r.intent.getComponent().flattenToShortString(), e);
            }

            // If a dead object exception was thrown -- fall through to
            // restart the application.
        }
        //当进程不存在，则创建进程
        mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0,
                "activity", r.intent.getComponent(), false, false, true);
         ...
    }

2.1.2 Service

启动Service，调用的是startService方法，经过层层调用ActiveServices.java中的bringUpServiceLocked。当Service所属的进程还没有启动时，则需要创建相应的进程。详细见startService启动过程

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
private String bringUpServiceLocked(ServiceRecord r, int intentFlags, boolean execInFg,
           boolean whileRestarting, boolean permissionsReviewRequired)
           throws TransactionTooLargeException {
       ....
       //对于服务进程没有启动的情况
       // Not running -- get it started, and enqueue this service record
       // to be executed when the app comes up.
       if (app == null && !permissionsReviewRequired) {
           //启动服务所需要的进程
           if ((app=mAm.startProcessLocked(procName, r.appInfo, true, intentFlags,
                   hostingType, r.name, false, isolated, false)) == null) {
               String msg = "Unable to launch app "
                       + r.appInfo.packageName + "/"
                       + r.appInfo.uid + " for service "
                       + r.intent.getIntent() + ": process is bad";
               Slog.w(TAG, msg);
               //进程启动失败
               bringDownServiceLocked(r);
               return msg;
           }
           if (isolated) {
               r.isolatedProc = app;
           }
       }
       ....
}

2.1.3 ContentProvider

ContentProvider.query经过层层调用，最终调用到ActivityManagerService.java中getContentProviderImpl，当ContentProvider所对应进程不存在，则需要创建新进程。详细见ContentProvider原理分析

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
  private ContentProviderHolder getContentProviderImpl(IApplicationThread caller,
            String name, IBinder token, boolean stable, int userId) {
            .....
                      if (proc != null && proc.thread != null && !proc.killed) {
                            if (DEBUG_PROVIDER) Slog.d(TAG_PROVIDER,
                                    "Installing in existing process " + proc);
                            if (!proc.pubProviders.containsKey(cpi.name)) {
                                checkTime(startTime, "getContentProviderImpl: scheduling install");
                                proc.pubProviders.put(cpi.name, cpr);
                                try {
                                     //发布provider，见2.2.1节
                                    proc.thread.scheduleInstallProvider(cpi);
                                } catch (RemoteException e) {
                                }
                            }
                        } else {
                            checkTime(startTime, "getContentProviderImpl: before start process");
                            //启动进程
                            proc = startProcessLocked(cpi.processName,
                                    cpr.appInfo, false, 0, "content provider",
                                    new ComponentName(cpi.applicationInfo.packageName,
                                            cpi.name), false, false, false);
                            checkTime(startTime, "getContentProviderImpl: after start process");
                            if (proc == null) {
                                Slog.w(TAG, "Unable to launch app "
                                        + cpi.applicationInfo.packageName + "/"
                                        + cpi.applicationInfo.uid + " for provider "
                                        + name + ": process is bad");
                                return null;
                            }
                        }
                 ......       

}

2.1.4 BroadcastReceiver

调用SendBroadcast方法，经过层层调用，最终调用BroadcastQueue.jav的processNextBroadcast方法。当BroadcastReceiver所在的进程没有启动，则创建相应进程。详细见BroadcastCast广播机制原理

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
final void processNextBroadcastLocked(boolean fromMsg, boolean skipOomAdj) {
    ......
    if ((r.curApp=mService.startProcessLocked(targetProcess,
                info.activityInfo.applicationInfo, true,
                r.intent.getFlags() | Intent.FLAG_FROM_BACKGROUND,
                "broadcast", r.curComponent,
                (r.intent.getFlags()&Intent.FLAG_RECEIVER_BOOT_UPGRADE) != 0, false, false))
                        == null) {
            // Ah, this recipient is unavailable.  Finish it if necessary,
            // and mark the broadcast record as ready for the next.
            Slog.w(TAG, "Unable to launch app "
                    + info.activityInfo.applicationInfo.packageName + "/"
                    + receiverUid + " for broadcast "
                    + r.intent + ": process is bad");
            //创建失败，直接结束该receiver        
            logBroadcastReceiverDiscardLocked(r);
            finishReceiverLocked(r, r.resultCode, r.resultData,
                    r.resultExtras, r.resultAbort, false);
            //开启下一个广播
            scheduleBroadcastsLocked();
            r.state = BroadcastRecord.IDLE;
            return;
        }
    ....
}

2.2 进程启动

ActivityManagerService.java有四个不同startProcessLocked的启动进程方法，详细见第三大节。对于进程启动的触发实际主要是四个组件所在的进程没有启动才会创建。大多数情况下app都是单进程架构，对于多进程的app一般都是通过AndroidManifest.xml中的android:process属性来实现的。

  • 当android:process属于值以”:”开头，则代表进程是私有进程，只有该app可以使用

  • 当android:process属于值不以”:”开头，则代表进程是全局进程，这种情况需要注意进程名至少包含“.”字符。

三、进程创建过程

3.1 AMS.startProcessLocked

[->ActivityManagerService.java]

1
2
3
4
5
6
7
8
9
10
final ProcessRecord startProcessLocked(String processName,
          ApplicationInfo info, boolean knownToBeDead, int intentFlags,
          String hostingType, ComponentName hostingName, boolean allowWhileBooting,
          boolean isolated, boolean keepIfLarge) {
      //见3.2节    
      return startProcessLocked(processName, info, knownToBeDead, intentFlags, hostingType,
              hostingName, allowWhileBooting, isolated, 0 /* isolatedUid */, keepIfLarge,
              null /* ABI override */, null /* entryPoint */, null /* entryPointArgs */,
              null /* crashHandler */);
  }

3.2 AMS.startProcessLocked

[->ActivityManagerService.java]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
@GuardedBy("this")
   final ProcessRecord startProcessLocked(String processName, ApplicationInfo info,
           boolean knownToBeDead, int intentFlags, String hostingType, ComponentName hostingName,
           boolean allowWhileBooting, boolean isolated, int isolatedUid, boolean keepIfLarge,
           String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) {
       long startTime = SystemClock.elapsedRealtime();
       ProcessRecord app;
       if (!isolated) {
           //如果不是孤立进程，根据进程名和uid检查相应的ProcessRecord
           app = getProcessRecordLocked(processName, info.uid, keepIfLarge);
           checkTime(startTime, "startProcess: after getProcessRecord");

           if ((intentFlags & Intent.FLAG_FROM_BACKGROUND) != 0) {
               // If we are in the background, then check to see if this process
               // is bad.  If so, we will just silently fail.
               //如果当前进程是后台进程，检查进程是否处于bad进程列表
               if (mAppErrors.isBadProcessLocked(info)) {
                   if (DEBUG_PROCESSES) Slog.v(TAG, "Bad process: " + info.uid
                           + "/" + info.processName);
                   return null;
               }
           } else {
               // When the user is explicitly starting a process, then clear its
               // crash count so that we won't make it bad until they see at
               // least one crash dialog again, and make the process good again
               // if it had been bad.
               //当用户明确的启动一个进程，则清空crash的次数。保证其不处于bad进程
               //直到下次再弹出crash对话框。如果之前是bad进程则改成good进程
               if (DEBUG_PROCESSES) Slog.v(TAG, "Clearing bad process: " + info.uid
                       + "/" + info.processName);
               mAppErrors.resetProcessCrashTimeLocked(info);
               if (mAppErrors.isBadProcessLocked(info)) {
                   EventLog.writeEvent(EventLogTags.AM_PROC_GOOD,
                           UserHandle.getUserId(info.uid), info.uid,
                           info.processName);
                   mAppErrors.clearBadProcessLocked(info);
                   if (app != null) {
                       app.bad = false;
                   }
               }
           }
       } else {
           // If this is an isolated process, it can't re-use an existing process.
           //如果是孤立进程则无法利用已存在的信息
           app = null;
       }

       // We don't have to do anything more if:
       // (1) There is an existing application record; and
       // (2) The caller doesn't think it is dead, OR there is no thread
       //     object attached to it so we know it couldn't have crashed; and
       // (3) There is a pid assigned to it, so it is either starting or
       //     already running.
       if (DEBUG_PROCESSES) Slog.v(TAG_PROCESSES, "startProcess: name=" + processName
               + " app=" + app + " knownToBeDead=" + knownToBeDead
               + " thread=" + (app != null ? app.thread : null)
               + " pid=" + (app != null ? app.pid : -1));
       //(1)存在ProcessRecord
       //(2)caller不认为该进程已经死亡或者没有thread attached到该进程
       //(3)分配了pid，那么改进程要么在启动要么在运行
       if (app != null && app.pid > 0) {
           if ((!knownToBeDead && !app.killed) || app.thread == null) {
               // We already have the app running, or are waiting for it to
               // come up (we have a pid but not yet its thread), so keep it.
               if (DEBUG_PROCESSES) Slog.v(TAG_PROCESSES, "App already running: " + app);
               // If this is a new package in the process, add the package to the list
               //如果是进程中新package，则package添加到列表
               app.addPackage(info.packageName, info.versionCode, mProcessStats);
               checkTime(startTime, "startProcess: done, added package to proc");
               return app;
           }

           // An application record is attached to a previous process,
           // clean it up now.
           //ProcessRecord已经attached到先前的一个进程，则杀死并清理该进程
           if (DEBUG_PROCESSES || DEBUG_CLEANUP) Slog.v(TAG_PROCESSES, "App died: " + app);
           checkTime(startTime, "startProcess: bad proc running, killing");
           killProcessGroup(app.uid, app.pid);
           handleAppDiedLocked(app, true, true);
           checkTime(startTime, "startProcess: done killing old proc");
       }

       String hostingNameStr = hostingName != null
               ? hostingName.flattenToShortString() : null;

       if (app == null) {
           checkTime(startTime, "startProcess: creating new process record");
           //创建newProcessRecordLocked对象
           app = newProcessRecordLocked(info, processName, isolated, isolatedUid);
           if (app == null) {
               Slog.w(TAG, "Failed making new process record for "
                       + processName + "/" + info.uid + " isolated=" + isolated);
               return null;
           }
           app.crashHandler = crashHandler;
           app.isolatedEntryPoint = entryPoint;
           app.isolatedEntryPointArgs = entryPointArgs;
           checkTime(startTime, "startProcess: done creating new process record");
       } else {
           // If this is a new package in the process, add the package to the list
           // 如果是进程中新package，则package添加到列表
           app.addPackage(info.packageName, info.versionCode, mProcessStats);
           checkTime(startTime, "startProcess: added package to existing proc");
       }

       // If the system is not ready yet, then hold off on starting this
       // process until it is.
       //如果系统未准备完毕，则将其添加到mProcessesOnHold
       if (!mProcessesReady
               && !isAllowedWhileBooting(info)
               && !allowWhileBooting) {
           if (!mProcessesOnHold.contains(app)) {
               mProcessesOnHold.add(app);
           }
           if (DEBUG_PROCESSES) Slog.v(TAG_PROCESSES,
                   "System not ready, putting on hold: " + app);
           checkTime(startTime, "startProcess: returning with proc on hold");
           return app;
       }

       checkTime(startTime, "startProcess: stepping in to startProcess");
       //启动进程
       final boolean success = startProcessLocked(app, hostingType, hostingNameStr, abiOverride);
       checkTime(startTime, "startProcess: done starting proc!");
       return success ? app : null;
   }

主要功能：

1.对于非isolated进程，则根据进程名和uid检查相应的ProcessRecord，如果当前进程处于后台且当前进程处于bad列表则直接返回，否则清空crash次数，以保证其不处于bad进程知道下次再次弹出crash对话框

2.当存在ProcessRecord，且已分配pid（正在启动或者已经启动）的情况

  • 当caller不认为该进程已死亡或者thread对象attached到该进程，则不应该清理该进程，则直接返回；

  • 否则杀死并清理该进程

3.当ProcessRecord为空则新建一个，当创建失败则直接返回

4.当以下3个值为false，则将当前进程加入到mProcessesOnHold，并直接返回，当进程真正创建则从mProcessesOnHold中移除。

  • 当AMS.systemReady执行完成，则mProcessesReady = true；

  • 当进程为persistent，则isAllowedWhileBooting=true;

  • 一般地创建进程时参数allowWhileBooting = flase，只有AMS.startIsolatedProcess该值才为true；

5.最后启动新进程，其参数含义：

hostingType取值为“activity”,”service”,”broadcast”，”contentprovider”

hostingNameStr取值为具体相对应的组件名，类型为ComponentName

3.3 AMS.startProcessLocked

[->ActivityManagerService.java]

1
2
3
4
5
private final boolean startProcessLocked(ProcessRecord app,
        String hostingType, String hostingNameStr, String abiOverride) {
    return startProcessLocked(app, hostingType, hostingNameStr,
            false /* disableHiddenApiChecks */, abiOverride);
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
/**
   * @return {@code true} if process start is successful, false otherwise.
   */
  @GuardedBy("this")
  private final boolean startProcessLocked(ProcessRecord app, String hostingType,
          String hostingNameStr, boolean disableHiddenApiChecks, String abiOverride) {
      if (app.pendingStart) {
          return true;
      }
      long startTime = SystemClock.elapsedRealtime();
      //app的pid大于0且pid不等于当前进程的pid,则从mPidsSelfLocked中移除该app的pid
      if (app.pid > 0 && app.pid != MY_PID) {
          checkTime(startTime, "startProcess: removing from pids map");
          synchronized (mPidsSelfLocked) {
              mPidsSelfLocked.remove(app.pid);
              mHandler.removeMessages(PROC_START_TIMEOUT_MSG, app);
          }
          checkTime(startTime, "startProcess: done removing from pids map");
          app.setPid(0);
      }

      if (DEBUG_PROCESSES && mProcessesOnHold.contains(app)) Slog.v(TAG_PROCESSES,
              "startProcessLocked removing on hold: " + app);
      //从mProcessesOnHold进程中移除该app
      mProcessesOnHold.remove(app);

      checkTime(startTime, "startProcess: starting to update cpu stats");
      //更新cpu统计信息
      updateCpuStats();
      checkTime(startTime, "startProcess: done updating cpu stats");

      try {
          try {
              final int userId = UserHandle.getUserId(app.uid);
              //检查package是否可启动
              AppGlobals.getPackageManager().checkPackageStartable(app.info.packageName, userId);
          } catch (RemoteException e) {
              throw e.rethrowAsRuntimeException();
          }

          int uid = app.uid;
          int[] gids = null;
          int mountExternal = Zygote.MOUNT_EXTERNAL_NONE;
          if (!app.isolated) {
              int[] permGids = null;
              try {
                  //获取gid
                  checkTime(startTime, "startProcess: getting gids from package manager");
                  final IPackageManager pm = AppGlobals.getPackageManager();
                  permGids = pm.getPackageGids(app.info.packageName,
                          MATCH_DEBUG_TRIAGED_MISSING, app.userId);
                  StorageManagerInternal storageManagerInternal = LocalServices.getService(
                          StorageManagerInternal.class);
                  mountExternal = storageManagerInternal.getExternalStorageMountMode(uid,
                          app.info.packageName);
              } catch (RemoteException e) {
                  throw e.rethrowAsRuntimeException();
              }

              /*
               * Add shared application and profile GIDs so applications can share some
               * resources like shared libraries and access user-wide resources
               */
               //添加共享app和gids，用于app直接共享资源
              if (ArrayUtils.isEmpty(permGids)) {
                  gids = new int[3];
              } else {
                  gids = new int[permGids.length + 3];
                  System.arraycopy(permGids, 0, gids, 3, permGids.length);
              }
              gids[0] = UserHandle.getSharedAppGid(UserHandle.getAppId(uid));
              gids[1] = UserHandle.getCacheAppGid(UserHandle.getAppId(uid));
              gids[2] = UserHandle.getUserGid(UserHandle.getUserId(uid));

              // Replace any invalid GIDs
              if (gids[0] == UserHandle.ERR_GID) gids[0] = gids[2];
              if (gids[1] == UserHandle.ERR_GID) gids[1] = gids[2];
          }
          checkTime(startTime, "startProcess: building args");
          if (mFactoryTest != FactoryTest.FACTORY_TEST_OFF) {
              if (mFactoryTest == FactoryTest.FACTORY_TEST_LOW_LEVEL
                      && mTopComponent != null
                      && app.processName.equals(mTopComponent.getPackageName())) {
                  uid = 0;
              }
              if (mFactoryTest == FactoryTest.FACTORY_TEST_HIGH_LEVEL
                      && (app.info.flags&ApplicationInfo.FLAG_FACTORY_TEST) != 0) {
                  uid = 0;
              }
          }
          
          //根据不同的参数，设置runtimeFlags
          int runtimeFlags = 0;
          if ((app.info.flags & ApplicationInfo.FLAG_DEBUGGABLE) != 0) {
              runtimeFlags |= Zygote.DEBUG_ENABLE_JDWP;
              runtimeFlags |= Zygote.DEBUG_JAVA_DEBUGGABLE;
              // Also turn on CheckJNI for debuggable apps. It's quite
              // awkward to turn on otherwise.
              runtimeFlags |= Zygote.DEBUG_ENABLE_CHECKJNI;
          }
          // Run the app in safe mode if its manifest requests so or the
          // system is booted in safe mode.
          if ((app.info.flags & ApplicationInfo.FLAG_VM_SAFE_MODE) != 0 ||
              mSafeMode == true) {
              runtimeFlags |= Zygote.DEBUG_ENABLE_SAFEMODE;
          }
          if ("1".equals(SystemProperties.get("debug.checkjni"))) {
              runtimeFlags |= Zygote.DEBUG_ENABLE_CHECKJNI;
          }
          String genDebugInfoProperty = SystemProperties.get("debug.generate-debug-info");
          if ("1".equals(genDebugInfoProperty) || "true".equals(genDebugInfoProperty)) {
              runtimeFlags |= Zygote.DEBUG_GENERATE_DEBUG_INFO;
          }
          String genMiniDebugInfoProperty = SystemProperties.get("dalvik.vm.minidebuginfo");
          if ("1".equals(genMiniDebugInfoProperty) || "true".equals(genMiniDebugInfoProperty)) {
              runtimeFlags |= Zygote.DEBUG_GENERATE_MINI_DEBUG_INFO;
          }
          if ("1".equals(SystemProperties.get("debug.jni.logging"))) {
              runtimeFlags |= Zygote.DEBUG_ENABLE_JNI_LOGGING;
          }
          if ("1".equals(SystemProperties.get("debug.assert"))) {
              runtimeFlags |= Zygote.DEBUG_ENABLE_ASSERT;
          }
          if (mNativeDebuggingApp != null && mNativeDebuggingApp.equals(app.processName)) {
              // Enable all debug flags required by the native debugger.
              runtimeFlags |= Zygote.DEBUG_ALWAYS_JIT;          // Don't interpret anything
              runtimeFlags |= Zygote.DEBUG_GENERATE_DEBUG_INFO; // Generate debug info
              runtimeFlags |= Zygote.DEBUG_NATIVE_DEBUGGABLE;   // Disbale optimizations
              mNativeDebuggingApp = null;
          }

          if (app.info.isPrivilegedApp() &&
                  DexManager.isPackageSelectedToRunOob(app.pkgList.keySet())) {
              runtimeFlags |= Zygote.ONLY_USE_SYSTEM_OAT_FILES;
          }

          if (!disableHiddenApiChecks && !mHiddenApiBlacklist.isDisabled()) {
              app.info.maybeUpdateHiddenApiEnforcementPolicy(mHiddenApiBlacklist.getPolicy());
              @HiddenApiEnforcementPolicy int policy =
                      app.info.getHiddenApiEnforcementPolicy();
              int policyBits = (policy << Zygote.API_ENFORCEMENT_POLICY_SHIFT);
              if ((policyBits & Zygote.API_ENFORCEMENT_POLICY_MASK) != policyBits) {
                  throw new IllegalStateException("Invalid API policy: " + policy);
              }
              runtimeFlags |= policyBits;
          }

          String invokeWith = null;
          if ((app.info.flags & ApplicationInfo.FLAG_DEBUGGABLE) != 0) {
              // Debuggable apps may include a wrapper script with their library directory.
              String wrapperFileName = app.info.nativeLibraryDir + "/wrap.sh";
              StrictMode.ThreadPolicy oldPolicy = StrictMode.allowThreadDiskReads();
              try {
                  if (new File(wrapperFileName).exists()) {
                      invokeWith = "/system/bin/logwrapper " + wrapperFileName;
                  }
              } finally {
                  StrictMode.setThreadPolicy(oldPolicy);
              }
          }

          String requiredAbi = (abiOverride != null) ? abiOverride : app.info.primaryCpuAbi;
          if (requiredAbi == null) {
              requiredAbi = Build.SUPPORTED_ABIS[0];
          }

          String instructionSet = null;
          if (app.info.primaryCpuAbi != null) {
              instructionSet = VMRuntime.getInstructionSet(app.info.primaryCpuAbi);
          }

          app.gids = gids;
          app.requiredAbi = requiredAbi;
          app.instructionSet = instructionSet;

          // the per-user SELinux context must be set
          if (TextUtils.isEmpty(app.info.seInfoUser)) {
              Slog.wtf(TAG, "SELinux tag not defined",
                      new IllegalStateException("SELinux tag not defined for "
                      + app.info.packageName + " (uid " + app.uid + ")"));
          }
          final String seInfo = app.info.seInfo
                  + (TextUtils.isEmpty(app.info.seInfoUser) ? "" : app.info.seInfoUser);
          // Start the process.  It will either succeed and return a result containing
          // the PID of the new process, or else throw a RuntimeException.
          final String entryPoint = "android.app.ActivityThread";
          //见3.4节
          return startProcessLocked(hostingType, hostingNameStr, entryPoint, app, uid, gids,
                  runtimeFlags, mountExternal, seInfo, requiredAbi, instructionSet, invokeWith,
                  startTime);
      } catch (RuntimeException e) {
          Slog.e(TAG, "Failure starting process " + app.processName, e);

          // Something went very wrong while trying to start this process; one
          // common case is when the package is frozen due to an active
          // upgrade. To recover, clean up any active bookkeeping related to
          // starting this process. (We already invoked this method once when
          // the package was initially frozen through KILL_APPLICATION_MSG, so
          // it doesn't hurt to use it again.)
          //启动该进程失败，一个可能的原因是package被冻结。为了恢复，清除该进程
          forceStopPackageLocked(app.info.packageName, UserHandle.getAppId(app.uid), false,
                  false, true, false, false, app.userId, "start failure");
          return false;
      }
  }

根据不同参数设置相应的runtimeFlags

3.4 AMS.startProcessLocked

[->ActivityManagerService.java]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
@GuardedBy("this")
 private boolean startProcessLocked(String hostingType, String hostingNameStr, String entryPoint,
         ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal,
         String seInfo, String requiredAbi, String instructionSet, String invokeWith,
         long startTime) {
     //重置成员变量    
     app.pendingStart = true;
     app.killedByAm = false;
     app.removed = false;
     app.killed = false;
     final long startSeq = app.startSeq = ++mProcStartSeqCounter;
     app.setStartParams(uid, hostingType, hostingNameStr, seInfo, startTime);
     //如果是异步
     if (mConstants.FLAG_PROCESS_START_ASYNC) {
         if (DEBUG_PROCESSES) Slog.i(TAG_PROCESSES,
                 "Posting procStart msg for " + app.toShortString());
         //post到mProcStartHandlerThread线程
         mProcStartHandler.post(() -> {
             try {
                 synchronized (ActivityManagerService.this) {
                     final String reason = isProcStartValidLocked(app, startSeq);
                     if (reason != null) {
                         Slog.w(TAG_PROCESSES, app + " not valid anymore,"
                                 + " don't start process, " + reason);
                         app.pendingStart = false;
                         return;
                     }
                     app.usingWrapper = invokeWith != null
                             || SystemProperties.get("wrap." + app.processName) != null;
                     mPendingStarts.put(startSeq, app);
                 }
                 //见3.4.1节
                 final ProcessStartResult startResult = startProcess(app.hostingType, entryPoint,
                         app, app.startUid, gids, runtimeFlags, mountExternal, app.seInfo,
                         requiredAbi, instructionSet, invokeWith, app.startTime);
                 synchronized (ActivityManagerService.this) {
                     //见3.4.2节
                     handleProcessStartedLocked(app, startResult, startSeq);
                 }
             } catch (RuntimeException e) {
                 synchronized (ActivityManagerService.this) {
                     Slog.e(TAG, "Failure starting process " + app.processName, e);
                     mPendingStarts.remove(startSeq);
                     app.pendingStart = false;
                     forceStopPackageLocked(app.info.packageName, UserHandle.getAppId(app.uid),
                             false, false, true, false, false,
                             UserHandle.getUserId(app.userId), "start failure");
                 }
             }
         });
         return true;
     } else {
         //同步
         try {
             final ProcessStartResult startResult = startProcess(hostingType, entryPoint, app,
                     uid, gids, runtimeFlags, mountExternal, seInfo, requiredAbi, instructionSet,
                     invokeWith, startTime);
             handleProcessStartedLocked(app, startResult.pid, startResult.usingWrapper,
                     startSeq, false);
         } catch (RuntimeException e) {
             Slog.e(TAG, "Failure starting process " + app.processName, e);
             app.pendingStart = false;
             forceStopPackageLocked(app.info.packageName, UserHandle.getAppId(app.uid),
                     false, false, true, false, false,
                     UserHandle.getUserId(app.userId), "start failure");
         }
         return app.pid > 0;
     }
 }

3.4.1 AMS.startProcess

[->ActivityManagerService.java]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
private ProcessStartResult startProcess(String hostingType, String entryPoint,
          ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal,
          String seInfo, String requiredAbi, String instructionSet, String invokeWith,
          long startTime) {
      try {
          Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "Start proc: " +
                  app.processName);
          checkTime(startTime, "startProcess: asking zygote to start proc");
          final ProcessStartResult startResult;
          if (hostingType.equals("webview_service")) {
              //webview进程启动
              startResult = startWebView(entryPoint,
                      app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                      app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                      app.info.dataDir, null,
                      new String[] {PROC_START_SEQ_IDENT + app.startSeq});
          } else {
              //启动进程，见3.5节
              startResult = Process.start(entryPoint,
                      app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                      app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                      app.info.dataDir, invokeWith,
                      new String[] {PROC_START_SEQ_IDENT + app.startSeq});
          }
          checkTime(startTime, "startProcess: returned from zygote!");
          return startResult;
      } finally {
          Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
      }
  }

3.4.2 AMS.handleProcessStartedLocked

[->ActivityManagerService.java]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
private boolean handleProcessStartedLocked(ProcessRecord app, int pid, boolean usingWrapper,
           long expectedStartSeq, boolean procAttached) {
       mPendingStarts.remove(expectedStartSeq);
       //检查进程启动是否合法，不合法则杀掉进程
       final String reason = isProcStartValidLocked(app, expectedStartSeq);
       if (reason != null) {
           Slog.w(TAG_PROCESSES, app + " start not valid, killing pid=" + pid
                   + ", " + reason);
           app.pendingStart = false;
           Process.killProcessQuiet(pid);
           Process.killProcessGroup(app.uid, app.pid);
           return false;
       }
       //通知电池统计服务该进程启动
       mBatteryStatsService.noteProcessStart(app.processName, app.info.uid);
       checkTime(app.startTime, "startProcess: done updating battery stats");

       EventLog.writeEvent(EventLogTags.AM_PROC_START,
               UserHandle.getUserId(app.startUid), pid, app.startUid,
               app.processName, app.hostingType,
               app.hostingNameStr != null ? app.hostingNameStr : "");

       try {
           AppGlobals.getPackageManager().logAppProcessStartIfNeeded(app.processName, app.uid,
                   app.seInfo, app.info.sourceDir, pid);
       } catch (RemoteException ex) {
           // Ignore
       }

       if (app.persistent) {
           Watchdog.getInstance().processStarted(app.processName, pid);
       }

       checkTime(app.startTime, "startProcess: building log message");
       StringBuilder buf = mStringBuilder;
       buf.setLength(0);
       buf.append("Start proc ");
       buf.append(pid);
       buf.append(':');
       buf.append(app.processName);
       buf.append('/');
       UserHandle.formatUid(buf, app.startUid);
       if (app.isolatedEntryPoint != null) {
           buf.append(" [");
           buf.append(app.isolatedEntryPoint);
           buf.append("]");
       }
       buf.append(" for ");
       buf.append(app.hostingType);
       if (app.hostingNameStr != null) {
           buf.append(" ");
           buf.append(app.hostingNameStr);
       }
       //重置ProcessRecord变量
       reportUidInfoMessageLocked(TAG, buf.toString(), app.startUid);
       app.setPid(pid);
       app.usingWrapper = usingWrapper;
       app.pendingStart = false;
       checkTime(app.startTime, "startProcess: starting to update pids map");
       ProcessRecord oldApp;
       synchronized (mPidsSelfLocked) {
           oldApp = mPidsSelfLocked.get(pid);
       }
       // If there is already an app occupying that pid that hasn't been cleaned up
       if (oldApp != null && !app.isolated) {
           // Clean up anything relating to this pid first
           Slog.w(TAG, "Reusing pid " + pid
                   + " while app is still mapped to it");
           cleanUpApplicationRecordLocked(oldApp, false, false, -1,
                   true /*replacingPid*/);
       }
       synchronized (mPidsSelfLocked) {
           //将创建的进程加入到mPidsSelfLocked
           this.mPidsSelfLocked.put(pid, app);
           if (!procAttached) {
               Message msg = mHandler.obtainMessage(PROC_START_TIMEOUT_MSG);
               msg.obj = app;
               //延迟发送PROC_START_TIMEOUT消息
               mHandler.sendMessageDelayed(msg, usingWrapper
                       ? PROC_START_TIMEOUT_WITH_WRAPPER : PROC_START_TIMEOUT);
           }
       }
       checkTime(app.startTime, "startProcess: done updating pids map");
       return true;
   }

Process.start是通过socket通信通知Zygote创建fork子进程，创建新进程后将ActivityThread类加入到新进程中，并调用ActivityThread.main方法，详细可以参考Android进程创建流程，接下来进入AT.main方法

3.5 AT.main

[->ActivityThread.java]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
public static void main(String[] args) {
       Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ActivityThreadMain");

       // CloseGuard defaults to true and can be quite spammy.  We
       // disable it here, but selectively enable it later (via
       // StrictMode) on debug builds, but using DropBox, not logs.
       //性能统计默认关闭
       CloseGuard.setEnabled(false);
       //将当前进程所在的userID赋值给sCurrentUser
       Environment.initForCurrentUser();

       // Make sure TrustedCertificateStore looks in the right place for CA certificates
       //确保可信任的CA证书放在正确的位置
       final File configDir = Environment.getUserConfigDirectory(UserHandle.myUserId());
       TrustedCertificateStore.setDefaultUserDirectory(configDir);

       Process.setArgV0("<pre-initialized>");
       //创建主线程looper
       Looper.prepareMainLooper();

       // Find the value for {@link #PROC_START_SEQ_IDENT} if provided on the command line.
       // It will be in the format "seq=114"
       long startSeq = 0;
       if (args != null) {
           for (int i = args.length - 1; i >= 0; --i) {
               if (args[i] != null && args[i].startsWith(PROC_START_SEQ_IDENT)) {
                   startSeq = Long.parseLong(
                           args[i].substring(PROC_START_SEQ_IDENT.length()));
               }
           }
       }
       //创建ActivityThread对象
       ActivityThread thread = new ActivityThread();
       //见3.6节
       thread.attach(false, startSeq);

       if (sMainThreadHandler == null) {
           sMainThreadHandler = thread.getHandler();
       }

       if (false) {
           Looper.myLooper().setMessageLogging(new
                   LogPrinter(Log.DEBUG, "ActivityThread"));
       }

       // End of event ActivityThreadMain.
       Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
       //主线程进入循环状态
       Looper.loop();

       throw new RuntimeException("Main thread loop unexpectedly exited");
   }

1.创建主线程的Looper对象，该主线程的Looper是在进程创建完成后自动创建完成的，如果子线程中要通过handler通信，那么需要手动创建Looper对象，并且每个线程只能创建一次。

2.创建ActivityThread thread = new ActivityThread();这个过程中汇初始化几个重要的变量：

1
2
3
ApplicationThread mAppThread = new ApplicationThread();
Looper mLooper = Looper.myLooper();
H mH = new H(); //其中H继承Handler，用于处理组件的生命周期

3.attach过程是当前主线程向systemserver进程通信的过程，将thread信息通知AMS

4.sMainThreadHandler通过getHandler获取的对象正是mH，这是主线程的handler对象。

5.之后主线程调用 Looper.loop()进入消息循环状态，当没有消息时主线程进入休眠状态，一旦有消息来则唤醒主线程并执行相关的操作。

3.6 AT.attach

[->ActivityThread.java]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
private void attach(boolean system, long startSeq) {
      sCurrentActivityThread = this;
      mSystemThread = system;
      //非系统
      if (!system) {
          //开启虚拟机的jit即时编译功能
          android.ddm.DdmHandleAppName.setAppName("<pre-initialized>",
                                                  UserHandle.myUserId());
          RuntimeInit.setApplicationObject(mAppThread.asBinder());
          //获取AMS的代理对象
          final IActivityManager mgr = ActivityManager.getService();
          try {
              //见3.7，调用AMS的attachApplication方法
              mgr.attachApplication(mAppThread, startSeq);
          } catch (RemoteException ex) {
              throw ex.rethrowFromSystemServer();
          }
          // Watch for getting close to heap limit.
          //观察是否快接近heap的上限
          BinderInternal.addGcWatcher(new Runnable() {
              @Override public void run() {
                  if (!mSomeActivitiesChanged) {
                      return;
                  }
                  Runtime runtime = Runtime.getRuntime();
                  long dalvikMax = runtime.maxMemory();
                  long dalvikUsed = runtime.totalMemory() - runtime.freeMemory();
                  //当已用内存超过最大内存的3/4，则请求释放内存空间
                  if (dalvikUsed > ((3*dalvikMax)/4)) {
                      if (DEBUG_MEMORY_TRIM) Slog.d(TAG, "Dalvik max=" + (dalvikMax/1024)
                              + " total=" + (runtime.totalMemory()/1024)
                              + " used=" + (dalvikUsed/1024));
                      mSomeActivitiesChanged = false;
                      try {
                          mgr.releaseSomeActivities(mAppThread);
                      } catch (RemoteException e) {
                          throw e.rethrowFromSystemServer();
                      }
                  }
              }
          });
      } else {
          // Don't set application object here -- if the system crashes,
          // we can't display an alert, we just want to die die die.
          //系统走这里
          android.ddm.DdmHandleAppName.setAppName("system_process",
                  UserHandle.myUserId());
          try {
              mInstrumentation = new Instrumentation();
              mInstrumentation.basicInit(this);
              //创建context
              ContextImpl context = ContextImpl.createAppContext(
                      this, getSystemContext().mPackageInfo);
              mInitialApplication = context.mPackageInfo.makeApplication(true, null);
              mInitialApplication.onCreate();
          } catch (Exception e) {
              throw new RuntimeException(
                      "Unable to instantiate Application():" + e.toString(), e);
          }
      }

      //添加config回调接口
      ViewRootImpl.ConfigChangedCallback configChangedCallback
              = (Configuration globalConfig) -> {
          synchronized (mResourcesManager) {
              // We need to apply this change to the resources immediately, because upon returning
              // the view hierarchy will be informed about it.
              if (mResourcesManager.applyConfigurationToResourcesLocked(globalConfig,
                      null /* compat */)) {
                  updateLocaleListFromAppContext(mInitialApplication.getApplicationContext(),
                          mResourcesManager.getConfiguration().getLocales());

                  // This actually changed the resources! Tell everyone about it.
                  if (mPendingConfiguration == null
                          || mPendingConfiguration.isOtherSeqNewer(globalConfig)) {
                      mPendingConfiguration = globalConfig;
                      sendMessage(H.CONFIGURATION_CHANGED, globalConfig);
                  }
              }
          }
      };
      ViewRootImpl.addConfigCallback(configChangedCallback);
  }

对于非系统处理过程如下：

1.创建线程来开启虚拟机的jit即时编译功能

2.通过Binder机制，调用AMS.attachApplication方法

3.观察虚拟机内存是否快接近heap的上限，当已用内存超过最大内存3/4，则释放内存空间

4.添加config回调接口

3.7 AMS.attachApplication

[->ActivityManagerService.java]

1
2
3
4
5
6
7
8
9
10
11
@Override
   public final void attachApplication(IApplicationThread thread, long startSeq) {
       synchronized (this) {
           int callingPid = Binder.getCallingPid();
           final int callingUid = Binder.getCallingUid();
           final long origId = Binder.clearCallingIdentity();
           //见3.8节
           attachApplicationLocked(thread, callingPid, callingUid, startSeq);
           Binder.restoreCallingIdentity(origId);
       }
   }

3.8 AMS.attachApplicationLocked

[->ActivityManagerService.java]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
private final boolean attachApplicationLocked(IApplicationThread thread,
           int pid, int callingUid, long startSeq) {

       // Find the application record that is being attached...  either via
       // the pid if we are running in multiple processes, or just pull the
       // next app record if we are emulating process with anonymous threads.
       //通过pid获取ProcessRecord
       ProcessRecord app;
       long startTime = SystemClock.uptimeMillis();
       long bindApplicationTimeMillis;
       if (pid != MY_PID && pid >= 0) {
           synchronized (mPidsSelfLocked) {
               app = mPidsSelfLocked.get(pid);
           }
       } else {
           app = null;
       }

       // It's possible that process called attachApplication before we got a chance to
       // update the internal state.
       //在得到机会更新之前，就调用了attachApplication方法
       if (app == null && startSeq > 0) {
           final ProcessRecord pending = mPendingStarts.get(startSeq);
           if (pending != null && pending.startUid == callingUid
                   && handleProcessStartedLocked(pending, pid, pending.usingWrapper,
                           startSeq, true)) {
               app = pending;
           }
       }

       if (app == null) {
           Slog.w(TAG, "No pending application record for pid " + pid
                   + " (IApplicationThread " + thread + "); dropping process");
           EventLog.writeEvent(EventLogTags.AM_DROP_PROCESS, pid);
           if (pid > 0 && pid != MY_PID) {
               //ProcessRecord为空，则杀掉该进程
               killProcessQuiet(pid);
               //TODO: killProcessGroup(app.info.uid, pid);
           } else {
               try {
                   //退出新建进程的looper
                   thread.scheduleExit();
               } catch (Exception e) {
                   // Ignore exceptions.
               }
           }
           return false;
       }

       // If this application record is still attached to a previous
       // process, clean it up now.
       //刚刚进入attach过程，thread应该为null,如果不为null,则表示app在上一个进程，则清空
       if (app.thread != null) {
           handleAppDiedLocked(app, true, true);
       }

       // Tell the process all about itself.

       if (DEBUG_ALL) Slog.v(
               TAG, "Binding process pid " + pid + " to record " + app);

       final String processName = app.processName;
       try {
           //绑定死亡通知
           AppDeathRecipient adr = new AppDeathRecipient(
                   app, pid, thread);
           thread.asBinder().linkToDeath(adr, 0);
           app.deathRecipient = adr;
       } catch (RemoteException e) {
           app.resetPackageList(mProcessStats);
           //重新启动进程
           startProcessLocked(app, "link fail", processName);
           return false;
       }

       EventLog.writeEvent(EventLogTags.AM_PROC_BOUND, app.userId, app.pid, app.processName);
        
       //重置进程信息，执行完后app.thread不再为空 
       app.makeActive(thread, mProcessStats);
       app.curAdj = app.setAdj = app.verifiedAdj = ProcessList.INVALID_ADJ;
       app.curSchedGroup = app.setSchedGroup = ProcessList.SCHED_GROUP_DEFAULT;
       app.forcingToImportant = null;
       updateProcessForegroundLocked(app, false, false);
       app.hasShownUi = false;
       app.debugging = false;
       app.cached = false;
       app.killedByAm = false;
       app.killed = false;


       // We carefully use the same state that PackageManager uses for
       // filtering, since we use this flag to decide if we need to install
       // providers when user is unlocked later
       //用户是否解锁
       app.unlocked = StorageManager.isUserKeyUnlocked(app.userId);
       
       //移除进程启动超时的通知
       mHandler.removeMessages(PROC_START_TIMEOUT_MSG, app);
       
       //系统处于ready状态或者app为FLAG_PERSISTENT进程，则为true
       boolean normalMode = mProcessesReady || isAllowedWhileBooting(app.info);
       //查询正在启动中的provider
       List<ProviderInfo> providers = normalMode ? generateApplicationProvidersLocked(app) : null;

       //app进程存在启动中的provider，超时10s后发送CONTENT_PROVIDER_PUBLISH_TIMEOUT消息
       if (providers != null && checkAppInLaunchingProvidersLocked(app)) {
           Message msg = mHandler.obtainMessage(CONTENT_PROVIDER_PUBLISH_TIMEOUT_MSG);
           msg.obj = app;
           mHandler.sendMessageDelayed(msg, CONTENT_PROVIDER_PUBLISH_TIMEOUT);
       }

       checkTime(startTime, "attachApplicationLocked: before bindApplication");

       if (!normalMode) {
           Slog.i(TAG, "Launching preboot mode app: " + app);
       }

       if (DEBUG_ALL) Slog.v(
           TAG, "New app record " + app
           + " thread=" + thread.asBinder() + " pid=" + pid);
       try {
           int testMode = ApplicationThreadConstants.DEBUG_OFF;
           if (mDebugApp != null && mDebugApp.equals(processName)) {
               testMode = mWaitForDebugger
                   ? ApplicationThreadConstants.DEBUG_WAIT
                   : ApplicationThreadConstants.DEBUG_ON;
               app.debugging = true;
               if (mDebugTransient) {
                   mDebugApp = mOrigDebugApp;
                   mWaitForDebugger = mOrigWaitForDebugger;
               }
           }

           boolean enableTrackAllocation = false;
           if (mTrackAllocationApp != null && mTrackAllocationApp.equals(processName)) {
               enableTrackAllocation = true;
               mTrackAllocationApp = null;
           }

           // If the app is being launched for restore or full backup, set it up specially
           //备份模式
           boolean isRestrictedBackupMode = false;
           if (mBackupTarget != null && mBackupAppName.equals(processName)) {
               isRestrictedBackupMode = mBackupTarget.appInfo.uid >= FIRST_APPLICATION_UID
                       && ((mBackupTarget.backupMode == BackupRecord.RESTORE)
                               || (mBackupTarget.backupMode == BackupRecord.RESTORE_FULL)
                               || (mBackupTarget.backupMode == BackupRecord.BACKUP_FULL));
           }

           if (app.instr != null) {
               notifyPackageUse(app.instr.mClass.getPackageName(),
                                PackageManager.NOTIFY_PACKAGE_USE_INSTRUMENTATION);
           }
           if (DEBUG_CONFIGURATION) Slog.v(TAG_CONFIGURATION, "Binding proc "
                   + processName + " with config " + getGlobalConfiguration());
           
           //获取应用的ApplicationInfo
           ApplicationInfo appInfo = app.instr != null ? app.instr.mTargetInfo : app.info;
           app.compat = compatibilityInfoForPackageLocked(appInfo);

           //统计信息
           ProfilerInfo profilerInfo = null;
           String preBindAgent = null;
           if (mProfileApp != null && mProfileApp.equals(processName)) {
               mProfileProc = app;
               if (mProfilerInfo != null) {
                   // Send a profiler info object to the app if either a file is given, or
                   // an agent should be loaded at bind-time.
                   boolean needsInfo = mProfilerInfo.profileFile != null
                           || mProfilerInfo.attachAgentDuringBind;
                   profilerInfo = needsInfo ? new ProfilerInfo(mProfilerInfo) : null;
                   if (mProfilerInfo.agent != null) {
                       preBindAgent = mProfilerInfo.agent;
                   }
               }
           } else if (app.instr != null && app.instr.mProfileFile != null) {
               profilerInfo = new ProfilerInfo(app.instr.mProfileFile, null, 0, false, false,
                       null, false);
           }
           if (mAppAgentMap != null && mAppAgentMap.containsKey(processName)) {
               // We need to do a debuggable check here. See setAgentApp for why the check is
               // postponed to here.
               if ((app.info.flags & ApplicationInfo.FLAG_DEBUGGABLE) != 0) {
                   String agent = mAppAgentMap.get(processName);
                   // Do not overwrite already requested agent.
                   if (profilerInfo == null) {
                       profilerInfo = new ProfilerInfo(null, null, 0, false, false,
                               mAppAgentMap.get(processName), true);
                   } else if (profilerInfo.agent == null) {
                       profilerInfo = profilerInfo.setAgent(mAppAgentMap.get(processName), true);
                   }
               }
           }

           if (profilerInfo != null && profilerInfo.profileFd != null) {
               profilerInfo.profileFd = profilerInfo.profileFd.dup();
               if (TextUtils.equals(mProfileApp, processName) && mProfilerInfo != null) {
                   clearProfilerLocked();
               }
           }

           // We deprecated Build.SERIAL and it is not accessible to
           // apps that target the v2 security sandbox and to apps that
           // target APIs higher than O MR1. Since access to the serial
           // is now behind a permission we push down the value.
           //buildSerial根据不同版本初始化
           final String buildSerial = (appInfo.targetSandboxVersion < 2
                   && appInfo.targetSdkVersion < Build.VERSION_CODES.P)
                           ? sTheRealBuildSerial : Build.UNKNOWN;

           // Check if this is a secondary process that should be incorporated into some
           // currently active instrumentation.  (Note we do this AFTER all of the profiling
           // stuff above because profiling can currently happen only in the primary
           // instrumentation process.)
           //检查是否第二个进程合并到最近的instrumentation
           if (mActiveInstrumentation.size() > 0 && app.instr == null) {
               for (int i = mActiveInstrumentation.size() - 1; i >= 0 && app.instr == null; i--) {
                   ActiveInstrumentation aInstr = mActiveInstrumentation.get(i);
                   if (!aInstr.mFinished && aInstr.mTargetInfo.uid == app.uid) {
                       if (aInstr.mTargetProcesses.length == 0) {
                           // This is the wildcard mode, where every process brought up for
                           // the target instrumentation should be included.
                           if (aInstr.mTargetInfo.packageName.equals(app.info.packageName)) {
                               app.instr = aInstr;
                               aInstr.mRunningProcesses.add(app);
                           }
                       } else {
                           for (String proc : aInstr.mTargetProcesses) {
                               if (proc.equals(app.processName)) {
                                   app.instr = aInstr;
                                   aInstr.mRunningProcesses.add(app);
                                   break;
                               }
                           }
                       }
                   }
               }
           }

           // If we were asked to attach an agent on startup, do so now, before we're binding
           // application code.
           //绑定代理
           if (preBindAgent != null) {
               thread.attachAgent(preBindAgent);
           }


           // Figure out whether the app needs to run in autofill compat mode.
           boolean isAutofillCompatEnabled = false;
           if (UserHandle.getAppId(app.info.uid) >= Process.FIRST_APPLICATION_UID) {
               final AutofillManagerInternal afm = LocalServices.getService(
                       AutofillManagerInternal.class);
               if (afm != null) {
                   isAutofillCompatEnabled = afm.isCompatibilityModeRequested(
                           app.info.packageName, app.info.versionCode, app.userId);
               }
           }

           checkTime(startTime, "attachApplicationLocked: immediately before bindApplication");
           bindApplicationTimeMillis = SystemClock.elapsedRealtime();
           mStackSupervisor.getActivityMetricsLogger().notifyBindApplication(app);
           if (app.isolatedEntryPoint != null) {
               // This is an isolated process which should just call an entry point instead of
               // being bound to an application.
               //孤立进程
               thread.runIsolatedEntryPoint(app.isolatedEntryPoint, app.isolatedEntryPointArgs);
           } else if (app.instr != null) { 
               //instr不为空，绑定应用
               thread.bindApplication(processName, appInfo, providers,
                       app.instr.mClass,
                       profilerInfo, app.instr.mArguments,
                       app.instr.mWatcher,
                       app.instr.mUiAutomationConnection, testMode,
                       mBinderTransactionTrackingEnabled, enableTrackAllocation,
                       isRestrictedBackupMode || !normalMode, app.persistent,
                       new Configuration(getGlobalConfiguration()), app.compat,
                       getCommonServicesLocked(app.isolated),
                       mCoreSettingsObserver.getCoreSettingsLocked(),
                       buildSerial, isAutofillCompatEnabled);
           } else {
               //绑定应用，见3.9节
               thread.bindApplication(processName, appInfo, providers, null, profilerInfo,
                       null, null, null, testMode,
                       mBinderTransactionTrackingEnabled, enableTrackAllocation,
                       isRestrictedBackupMode || !normalMode, app.persistent,
                       new Configuration(getGlobalConfiguration()), app.compat,
                       getCommonServicesLocked(app.isolated),
                       mCoreSettingsObserver.getCoreSettingsLocked(),
                       buildSerial, isAutofillCompatEnabled);
           }
           if (profilerInfo != null) {
               profilerInfo.closeFd();
               profilerInfo = null;
           }
           checkTime(startTime, "attachApplicationLocked: immediately after bindApplication");
           //更新LRU进程队列
           updateLruProcessLocked(app, false, null);
           checkTime(startTime, "attachApplicationLocked: after updateLruProcessLocked");
           app.lastRequestedGc = app.lastLowMemory = SystemClock.uptimeMillis();
       } catch (Exception e) {
           // todo: Yikes!  What should we do?  For now we will try to
           // start another process, but that could easily get us in
           // an infinite loop of restarting processes...
           Slog.wtf(TAG, "Exception thrown during bind of " + app, e);

           app.resetPackageList(mProcessStats);
           app.unlinkDeathRecipient();
           //失败，重新启动进程，可能导致无限制的重启
           startProcessLocked(app, "bind fail", processName);
           return false;
       }

       // Remove this record from the list of starting applications.
       mPersistentStartingProcesses.remove(app);
       if (DEBUG_PROCESSES && mProcessesOnHold.contains(app)) Slog.v(TAG_PROCESSES,
               "Attach application locked removing on hold: " + app);
       mProcessesOnHold.remove(app);

       boolean badApp = false;
       boolean didSomething = false;

       // See if the top visible activity is waiting to run in this process...
       //Activity 检查最顶层的activity是否等待在该进程中运行
       if (normalMode) {
           try {
               if (mStackSupervisor.attachApplicationLocked(app)) {
                   didSomething = true;
               }
           } catch (Exception e) {
               Slog.wtf(TAG, "Exception thrown launching activities in " + app, e);
               badApp = true;
           }
       }

       // Find any services that should be running in this process...
       //services ：找到所有需要在该进程中运行的服务
       if (!badApp) {
           try {
               didSomething |= mServices.attachApplicationLocked(app, processName);
               checkTime(startTime, "attachApplicationLocked: after mServices.attachApplicationLocked");
           } catch (Exception e) {
               Slog.wtf(TAG, "Exception thrown starting services in " + app, e);
               badApp = true;
           }
       }

       // Check if a next-broadcast receiver is in this process...
       //broadcast：检查是否在这个进程中有下一个广播接收者
       if (!badApp && isPendingBroadcastProcessLocked(pid)) {
           try {
               didSomething |= sendPendingBroadcastsLocked(app);
               checkTime(startTime, "attachApplicationLocked: after sendPendingBroadcastsLocked");
           } catch (Exception e) {
               // If the app died trying to launch the receiver we declare it 'bad'
               Slog.wtf(TAG, "Exception thrown dispatching broadcasts in " + app, e);
               badApp = true;
           }
       }

       // Check whether the next backup agent is in this process...
       //检查是否在这个进程中有下一个backup代理
       if (!badApp && mBackupTarget != null && mBackupTarget.app == app) {
           if (DEBUG_BACKUP) Slog.v(TAG_BACKUP,
                   "New app is backup target, launching agent for " + app);
           notifyPackageUse(mBackupTarget.appInfo.packageName,
                            PackageManager.NOTIFY_PACKAGE_USE_BACKUP);
           try {
               thread.scheduleCreateBackupAgent(mBackupTarget.appInfo,
                       compatibilityInfoForPackageLocked(mBackupTarget.appInfo),
                       mBackupTarget.backupMode);
           } catch (Exception e) {
               Slog.wtf(TAG, "Exception thrown creating backup agent in " + app, e);
               badApp = true;
           }
       }

       if (badApp) {  //杀掉bad应用
           app.kill("error during init", true);
           handleAppDiedLocked(app, false, true);
           return false;
       }

       if (!didSomething) {
           updateOomAdjLocked();  //更新adj
           checkTime(startTime, "attachApplicationLocked: after updateOomAdjLocked");
       }

       StatsLog.write(
               StatsLog.PROCESS_START_TIME,
               app.info.uid,
               app.pid,
               app.info.packageName,
               StatsLog.PROCESS_START_TIME__TYPE__COLD,
               app.startTime,
               (int) (bindApplicationTimeMillis - app.startTime),
               (int) (SystemClock.elapsedRealtime() - app.startTime),
               app.hostingType,
               (app.hostingNameStr != null ? app.hostingNameStr : ""));

       return true;
   }

1.根据pid查询相应的ProcessRecord对象中的app

2.当app==null,如果进程存在则杀掉进程或者停止looper后返回

3.还刚进入attach过程，app.thread不为null,若不为null,则表示该app在上一个进程，则调用handleAppDiedLocked清理

4.绑定死亡通知，如果进程pid死亡，则会通过binder死亡回调来通知systemserver进程死亡的消息

5.重置ProcessRecord的进程信息，此时app.thread赋值，不为空

6.app进程存在正在启动中的provider，则超时10s发送消息

7.调用thread.bindApplication绑定应用进程

8.处理Activity，Service，Broadcast相应流程

3.9 AT.bindApplication

[->ActivityThread.java]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
public final void bindApplication(String processName, ApplicationInfo appInfo,
              List<ProviderInfo> providers, ComponentName instrumentationName,
              ProfilerInfo profilerInfo, Bundle instrumentationArgs,
              IInstrumentationWatcher instrumentationWatcher,
              IUiAutomationConnection instrumentationUiConnection, int debugMode,
              boolean enableBinderTracking, boolean trackAllocation,
              boolean isRestrictedBackupMode, boolean persistent, Configuration config,
              CompatibilityInfo compatInfo, Map services, Bundle coreSettings,
              String buildSerial, boolean autofillCompatibilityEnabled) {

          if (services != null) {
              if (false) {
                  // Test code to make sure the app could see the passed-in services.
                  for (Object oname : services.keySet()) {
                      if (services.get(oname) == null) {
                          continue; // AM just passed in a null service.
                      }
                      String name = (String) oname;

                      // See b/79378449 about the following exemption.
                      switch (name) {
                          case "package":
                          case Context.WINDOW_SERVICE:
                              continue;
                      }

                      if (ServiceManager.getService(name) == null) {
                          Log.wtf(TAG, "Service " + name + " should be accessible by this app");
                      }
                  }
              }

              // Setup the service cache in the ServiceManager
              //将Service缓存，减少binder调用次数
              ServiceManager.initServiceCache(services);
          }
          //发送H.SET_CORE_SETTINGS消息
          setCoreSettings(coreSettings);

          AppBindData data = new AppBindData();
          data.processName = processName;
          data.appInfo = appInfo;
          data.providers = providers;
          data.instrumentationName = instrumentationName;
          data.instrumentationArgs = instrumentationArgs;
          data.instrumentationWatcher = instrumentationWatcher;
          data.instrumentationUiAutomationConnection = instrumentationUiConnection;
          data.debugMode = debugMode;
          data.enableBinderTracking = enableBinderTracking;
          data.trackAllocation = trackAllocation;
          data.restrictedBackupMode = isRestrictedBackupMode;
          data.persistent = persistent;
          data.config = config;
          data.compatInfo = compatInfo;
          data.initProfilerInfo = profilerInfo;
          data.buildSerial = buildSerial;
          data.autofillCompatibilityEnabled = autofillCompatibilityEnabled;
          sendMessage(H.BIND_APPLICATION, data);
      }

发送H.SET_CORE_SETTINGS、H.BIND_APPLICATION消息到主线程

3.10 H.handleMessage

[->ActivityThread.java]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
class H extends Handler {
...
     public void handleMessage(Message msg) {
           if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));
           switch (msg.what) {
               case SET_CORE_SETTINGS:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "setCoreSettings");
                   handleSetCoreSettings((Bundle) msg.obj);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
               case BIND_APPLICATION:
                   Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "bindApplication");
                   AppBindData data = (AppBindData)msg.obj;
                   handleBindApplication(data);
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   break;
                   ...
             }
      }

}

3.11 AT.handleSetCoreSettings

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
private void handleSetCoreSettings(Bundle coreSettings) {
     synchronized (mResourcesManager) {
         mCoreSettings = coreSettings;
     }
     onCoreSettingsChange();
 }
 
  private void onCoreSettingsChange() {
     boolean debugViewAttributes =
             mCoreSettings.getInt(Settings.Global.DEBUG_VIEW_ATTRIBUTES, 0) != 0;
     if (debugViewAttributes != View.mDebugViewAttributes) {
         View.mDebugViewAttributes = debugViewAttributes;
 
         // request all activities to relaunch for the changes to take place
         //发生改变，请求所有的activity重新启动
         relaunchAllActivities();
     }
 }

3.12 AT.handleBindApplication

[->ActivityThread.java]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
private void handleBindApplication(AppBindData data) {
       // Register the UI Thread as a sensitive thread to the runtime.
       VMRuntime.registerSensitiveThread();
       // In the case the stack depth property exists, pass it down to the runtime.
       String property = SystemProperties.get("debug.allocTracker.stackDepth");
       if (property.length() != 0) {
           VMDebug.setAllocTrackerStackDepth(Integer.parseInt(property));
       }
       if (data.trackAllocation) {
           DdmVmInternal.enableRecentAllocations(true);
       }

       // Note when this process has started.
       //记录进程开始时间
       Process.setStartTimes(SystemClock.elapsedRealtime(), SystemClock.uptimeMillis());

       mBoundApplication = data;
       mConfiguration = new Configuration(data.config);
       mCompatConfiguration = new Configuration(data.config);

       mProfiler = new Profiler();
       String agent = null;
       if (data.initProfilerInfo != null) {
           mProfiler.profileFile = data.initProfilerInfo.profileFile;
           mProfiler.profileFd = data.initProfilerInfo.profileFd;
           mProfiler.samplingInterval = data.initProfilerInfo.samplingInterval;
           mProfiler.autoStopProfiler = data.initProfilerInfo.autoStopProfiler;
           mProfiler.streamingOutput = data.initProfilerInfo.streamingOutput;
           if (data.initProfilerInfo.attachAgentDuringBind) {
               agent = data.initProfilerInfo.agent;
           }
       }

       // send up app name; do this *before* waiting for debugger
       //设置进程名
       Process.setArgV0(data.processName);
       android.ddm.DdmHandleAppName.setAppName(data.processName,
                                               UserHandle.myUserId());
       VMRuntime.setProcessPackageName(data.appInfo.packageName);

       // Pass data directory path to ART. This is used for caching information and
       // should be set before any application code is loaded.
       VMRuntime.setProcessDataDirectory(data.appInfo.dataDir);
       
       //开启Profiler统计信息
       if (mProfiler.profileFd != null) {
           mProfiler.startProfiling();
       }

       // If the app is Honeycomb MR1 or earlier, switch its AsyncTask
       // implementation to use the pool executor.  Normally, we use the
       // serialized executor as the default. This has to happen in the
       // main thread so the main looper is set right.
       if (data.appInfo.targetSdkVersion <= android.os.Build.VERSION_CODES.HONEYCOMB_MR1) {
           AsyncTask.setDefaultExecutor(AsyncTask.THREAD_POOL_EXECUTOR);
       }

       Message.updateCheckRecycle(data.appInfo.targetSdkVersion);

       // Prior to P, internal calls to decode Bitmaps used BitmapFactory,
       // which may scale up to account for density. In P, we switched to
       // ImageDecoder, which skips the upscale to save memory. ImageDecoder
       // needs to still scale up in older apps, in case they rely on the
       // size of the Bitmap without considering its density.
       ImageDecoder.sApiLevel = data.appInfo.targetSdkVersion;

       /*
        * Before spawning a new process, reset the time zone to be the system time zone.
        * This needs to be done because the system time zone could have changed after the
        * the spawning of this process. Without doing this this process would have the incorrect
        * system time zone.
        */
        //重置时区
       TimeZone.setDefault(null);

       /*
        * Set the LocaleList. This may change once we create the App Context.
        */
       LocaleList.setDefault(data.config.getLocales());

       synchronized (mResourcesManager) {
           /*
            * Update the system configuration since its preloaded and might not
            * reflect configuration changes. The configuration object passed
            * in AppBindData can be safely assumed to be up to date
            */
           //更新系统配置
           mResourcesManager.applyConfigurationToResourcesLocked(data.config, data.compatInfo);
           mCurDefaultDisplayDpi = data.config.densityDpi;

           // This calls mResourcesManager so keep it within the synchronized block.
           applyCompatConfiguration(mCurDefaultDisplayDpi);
       }
       //获取LoadedApk对象
       data.info = getPackageInfoNoCheck(data.appInfo, data.compatInfo);

       if (agent != null) {
           handleAttachAgent(agent, data.info);
       }

       /**
        * Switch this process to density compatibility mode if needed.
        */
       if ((data.appInfo.flags&ApplicationInfo.FLAG_SUPPORTS_SCREEN_DENSITIES)
               == 0) {
           mDensityCompatMode = true;
           Bitmap.setDefaultDensity(DisplayMetrics.DENSITY_DEFAULT);
       }
       updateDefaultDensity();

       final String use24HourSetting = mCoreSettings.getString(Settings.System.TIME_12_24);
       Boolean is24Hr = null;
       if (use24HourSetting != null) {
           is24Hr = "24".equals(use24HourSetting) ? Boolean.TRUE : Boolean.FALSE;
       }
       // null : use locale default for 12/24 hour formatting,
       // false : use 12 hour format,
       // true : use 24 hour format.
       DateFormat.set24HourTimePref(is24Hr);

       View.mDebugViewAttributes =
               mCoreSettings.getInt(Settings.Global.DEBUG_VIEW_ATTRIBUTES, 0) != 0;

       StrictMode.initThreadDefaults(data.appInfo);
       StrictMode.initVmDefaults(data.appInfo);

       // We deprecated Build.SERIAL and only apps that target pre NMR1
       // SDK can see it. Since access to the serial is now behind a
       // permission we push down the value and here we fix it up
       // before any app code has been loaded.
       try {
           Field field = Build.class.getDeclaredField("SERIAL");
           field.setAccessible(true);
           field.set(Build.class, data.buildSerial);
       } catch (NoSuchFieldException | IllegalAccessException e) {
           /* ignore */
       }

       if (data.debugMode != ApplicationThreadConstants.DEBUG_OFF) {
           // XXX should have option to change the port.
           Debug.changeDebugPort(8100);
           if (data.debugMode == ApplicationThreadConstants.DEBUG_WAIT) {
               Slog.w(TAG, "Application " + data.info.getPackageName()
                     + " is waiting for the debugger on port 8100...");

               IActivityManager mgr = ActivityManager.getService();
               try {
                   mgr.showWaitingForDebugger(mAppThread, true);
               } catch (RemoteException ex) {
                   throw ex.rethrowFromSystemServer();
               }

               Debug.waitForDebugger();

               try {
                   mgr.showWaitingForDebugger(mAppThread, false);
               } catch (RemoteException ex) {
                   throw ex.rethrowFromSystemServer();
               }

           } else {
               Slog.w(TAG, "Application " + data.info.getPackageName()
                     + " can be debugged on port 8100...");
           }
       }

       // Allow application-generated systrace messages if we're debuggable.
       boolean isAppDebuggable = (data.appInfo.flags & ApplicationInfo.FLAG_DEBUGGABLE) != 0;
       Trace.setAppTracingAllowed(isAppDebuggable);
       ThreadedRenderer.setDebuggingEnabled(isAppDebuggable || Build.IS_DEBUGGABLE);
       if (isAppDebuggable && data.enableBinderTracking) {
           Binder.enableTracing();
       }

       /**
        * Initialize the default http proxy in this process for the reasons we set the time zone.
        */
       Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "Setup proxies");
       final IBinder b = ServiceManager.getService(Context.CONNECTIVITY_SERVICE);
       //初始化httpProxy
       if (b != null) {
           // In pre-boot mode (doing initial launch to collect password), not
           // all system is up.  This includes the connectivity service, so don't
           // crash if we can't get it.
           final IConnectivityManager service = IConnectivityManager.Stub.asInterface(b);
           try {
               Proxy.setHttpProxySystemProperty(service.getProxyForNetwork(null));
           } catch (RemoteException e) {
               Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
               throw e.rethrowFromSystemServer();
           }
       }
       Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);

       // Instrumentation info affects the class loader, so load it before
       // setting up the app context.
       final InstrumentationInfo ii;
       if (data.instrumentationName != null) {
           try {
               ii = new ApplicationPackageManager(null, getPackageManager())
                       .getInstrumentationInfo(data.instrumentationName, 0);
           } catch (PackageManager.NameNotFoundException e) {
               throw new RuntimeException(
                       "Unable to find instrumentation info for: " + data.instrumentationName);
           }

           // Warn of potential ABI mismatches.
           if (!Objects.equals(data.appInfo.primaryCpuAbi, ii.primaryCpuAbi)
                   || !Objects.equals(data.appInfo.secondaryCpuAbi, ii.secondaryCpuAbi)) {
               Slog.w(TAG, "Package uses different ABI(s) than its instrumentation: "
                       + "package[" + data.appInfo.packageName + "]: "
                       + data.appInfo.primaryCpuAbi + ", " + data.appInfo.secondaryCpuAbi
                       + " instrumentation[" + ii.packageName + "]: "
                       + ii.primaryCpuAbi + ", " + ii.secondaryCpuAbi);
           }

           mInstrumentationPackageName = ii.packageName;
           mInstrumentationAppDir = ii.sourceDir;
           mInstrumentationSplitAppDirs = ii.splitSourceDirs;
           mInstrumentationLibDir = getInstrumentationLibrary(data.appInfo, ii);
           mInstrumentedAppDir = data.info.getAppDir();
           mInstrumentedSplitAppDirs = data.info.getSplitAppDirs();
           mInstrumentedLibDir = data.info.getLibDir();
       } else {
           ii = null;
       }
       
       //创建ContextImpl上下文
       final ContextImpl appContext = ContextImpl.createAppContext(this, data.info);
       updateLocaleListFromAppContext(appContext,
               mResourcesManager.getConfiguration().getLocales());

       if (!Process.isIsolated()) {
           final int oldMask = StrictMode.allowThreadDiskWritesMask();
           try {
               setupGraphicsSupport(appContext);
           } finally {
               StrictMode.setThreadPolicyMask(oldMask);
           }
       } else {
           ThreadedRenderer.setIsolatedProcess(true);
       }

       // Install the Network Security Config Provider. This must happen before the application
       // code is loaded to prevent issues with instances of TLS objects being created before
       // the provider is installed.
       //网络安全配置初始化
       Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "NetworkSecurityConfigProvider.install");
       NetworkSecurityConfigProvider.install(appContext);
       Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);

       // Continue loading instrumentation.
       //获取mInstrumentation
       if (ii != null) {
           ApplicationInfo instrApp;
           try {
               instrApp = getPackageManager().getApplicationInfo(ii.packageName, 0,
                       UserHandle.myUserId());
           } catch (RemoteException e) {
               instrApp = null;
           }
           if (instrApp == null) {
               instrApp = new ApplicationInfo();
           }
           ii.copyTo(instrApp);
           instrApp.initForUser(UserHandle.myUserId());
           final LoadedApk pi = getPackageInfo(instrApp, data.compatInfo,
                   appContext.getClassLoader(), false, true, false);
           final ContextImpl instrContext = ContextImpl.createAppContext(this, pi);

           try {
               final ClassLoader cl = instrContext.getClassLoader();
               mInstrumentation = (Instrumentation)
                   cl.loadClass(data.instrumentationName.getClassName()).newInstance();
           } catch (Exception e) {
               throw new RuntimeException(
                   "Unable to instantiate instrumentation "
                   + data.instrumentationName + ": " + e.toString(), e);
           }

           final ComponentName component = new ComponentName(ii.packageName, ii.name);
           mInstrumentation.init(this, instrContext, appContext, component,
                   data.instrumentationWatcher, data.instrumentationUiAutomationConnection);

           if (mProfiler.profileFile != null && !ii.handleProfiling
                   && mProfiler.profileFd == null) {
               mProfiler.handlingProfiling = true;
               final File file = new File(mProfiler.profileFile);
               file.getParentFile().mkdirs();
               Debug.startMethodTracing(file.toString(), 8 * 1024 * 1024);
           }
       } else {
           mInstrumentation = new Instrumentation();
           mInstrumentation.basicInit(this);
       }
       //清除内存增长上限
       if ((data.appInfo.flags&ApplicationInfo.FLAG_LARGE_HEAP) != 0) {
           dalvik.system.VMRuntime.getRuntime().clearGrowthLimit();
       } else {
           // Small heap, clamp to the current growth limit and let the heap release
           // pages after the growth limit to the non growth limit capacity. b/18387825
           dalvik.system.VMRuntime.getRuntime().clampGrowthLimit();
       }

       // Allow disk access during application and provider setup. This could
       // block processing ordered broadcasts, but later processing would
       // probably end up doing the same disk access.
       Application app;
       final StrictMode.ThreadPolicy savedPolicy = StrictMode.allowThreadDiskWrites();
       final StrictMode.ThreadPolicy writesAllowedPolicy = StrictMode.getThreadPolicy();
       try {
           // If the app is being launched for full backup or restore, bring it up in
           // a restricted environment with the base application class.
           //LoadedApk通过反射创建目标应用的Application对象，见3.13节
           app = data.info.makeApplication(data.restrictedBackupMode, null);

           // Propagate autofill compat state
           app.setAutofillCompatibilityEnabled(data.autofillCompatibilityEnabled);

           mInitialApplication = app;

           // don't bring up providers in restricted mode; they may depend on the
           // app's custom Application class
           if (!data.restrictedBackupMode) {
               if (!ArrayUtils.isEmpty(data.providers)) {
                   installContentProviders(app, data.providers);
               }
           }

           // Do this after providers, since instrumentation tests generally start their
           // test thread at this point, and we don't want that racing.
           try { 
               mInstrumentation.onCreate(data.instrumentationArgs);
           }
           catch (Exception e) {
               throw new RuntimeException(
                   "Exception thrown in onCreate() of "
                   + data.instrumentationName + ": " + e.toString(), e);
           }
           try {
               //调用Application.onCreate方法
               mInstrumentation.callApplicationOnCreate(app);
           } catch (Exception e) {
               if (!mInstrumentation.onException(app, e)) {
                   throw new RuntimeException(
                     "Unable to create application " + app.getClass().getName()
                     + ": " + e.toString(), e);
               }
           }
       } finally {
           // If the app targets < O-MR1, or doesn't change the thread policy
           // during startup, clobber the policy to maintain behavior of b/36951662
           if (data.appInfo.targetSdkVersion < Build.VERSION_CODES.O_MR1
                   || StrictMode.getThreadPolicy().equals(writesAllowedPolicy)) {
               StrictMode.setThreadPolicy(savedPolicy);
           }
       }

       // Preload fonts resources
       // 加载字体资源
       FontsContract.setApplicationContextForResources(appContext);   
       if (!Process.isIsolated()) {
           try {
               final ApplicationInfo info =
                       getPackageManager().getApplicationInfo(
                               data.appInfo.packageName,
                               PackageManager.GET_META_DATA /*flags*/,
                               UserHandle.myUserId());
               if (info.metaData != null) {
                   final int preloadedFontsResource = info.metaData.getInt(
                           ApplicationInfo.METADATA_PRELOADED_FONTS, 0);
                   if (preloadedFontsResource != 0) {
                       data.info.getResources().preloadFonts(preloadedFontsResource);
                   }
               }
           } catch (RemoteException e) {
               throw e.rethrowFromSystemServer();
           }
       }
   }

3.13 LA.makeApplication

[->LoadedApk.java]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
public Application makeApplication(boolean forceDefaultAppClass,
           Instrumentation instrumentation) {
       if (mApplication != null) {
           return mApplication;
       }

       Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "makeApplication");

       Application app = null;

       String appClass = mApplicationInfo.className;
       if (forceDefaultAppClass || (appClass == null)) {
           appClass = "android.app.Application";
       }

       try {
           java.lang.ClassLoader cl = getClassLoader();
           if (!mPackageName.equals("android")) {
               Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER,
                       "initializeJavaContextClassLoader");
               initializeJavaContextClassLoader();
               Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
           }
           //见3.13.1节
           ContextImpl appContext = ContextImpl.createAppContext(mActivityThread, this);
           //见3.13.2节
           app = mActivityThread.mInstrumentation.newApplication(
                   cl, appClass, appContext);
           appContext.setOuterContext(app);
       } catch (Exception e) {
           if (!mActivityThread.mInstrumentation.onException(app, e)) {
               Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
               throw new RuntimeException(
                   "Unable to instantiate application " + appClass
                   + ": " + e.toString(), e);
           }
       }
       mActivityThread.mAllApplications.add(app);
       mApplication = app;

       if (instrumentation != null) {
           try {
               //调用app的OnCreate
               instrumentation.callApplicationOnCreate(app);
           } catch (Exception e) {
               if (!instrumentation.onException(app, e)) {
                   Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                   throw new RuntimeException(
                       "Unable to create application " + app.getClass().getName()
                       + ": " + e.toString(), e);
               }
           }
       }

       // Rewrite the R 'constants' for all library apks.
       SparseArray<String> packageIdentifiers = getAssets().getAssignedPackageIdentifiers();
       final int N = packageIdentifiers.size();
       for (int i = 0; i < N; i++) {
           final int id = packageIdentifiers.keyAt(i);
           if (id == 0x01 || id == 0x7f) {
               continue;
           }
           //重写所有apk库中的R常量 ，见3.13.3节
           rewriteRValues(getClassLoader(), packageIdentifiers.valueAt(i), id);
       }

       Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);

       return app;
   }

3.13.1 CI.createAppContext

[->ContextImpl.java]

1
2
3
4
5
6
7
static ContextImpl createAppContext(ActivityThread mainThread, LoadedApk packageInfo) {
       if (packageInfo == null) throw new IllegalArgumentException("packageInfo");
       ContextImpl context = new ContextImpl(null, mainThread, packageInfo, null, null, null, 0,
               null);
       context.setResources(packageInfo.getResources());
       return context;
   }

3.13.2 newApplication

[->Instrumentation.java]

1
2
3
4
5
6
7
8
9
10
public Application newApplication(ClassLoader cl, String className, Context context)
         throws InstantiationException, IllegalAccessException, 
         ClassNotFoundException {
     //通过反射方法创建Application
     Application app = getFactory(context.getPackageName())
             .instantiateApplication(cl, className);
     //调用attach方法
     app.attach(context);
     return app;
 }

3.13.3 LA.rewriteRValues

[->LoadedApk.java]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
private void rewriteRValues(ClassLoader cl, String packageName, int id) {
       final Class<?> rClazz;
       try {
           rClazz = cl.loadClass(packageName + ".R");
       } catch (ClassNotFoundException e) {
           // This is not necessarily an error, as some packages do not ship with resources
           // (or they do not need rewriting).
           Log.i(TAG, "No resource references to update in package " + packageName);
           return;
       }

       final Method callback;
       try {
           callback = rClazz.getMethod("onResourcesLoaded", int.class);
       } catch (NoSuchMethodException e) {
           // No rewriting to be done.
           return;
       }

       Throwable cause;
       try {
           callback.invoke(null, id);
           return;
       } catch (IllegalAccessException e) {
           cause = e;
       } catch (InvocationTargetException e) {
           cause = e.getCause();
       }

       throw new RuntimeException("Failed to rewrite resource references for " + packageName,
               cause);
   }

四、总结

介绍了四大组件和进程启动，并分析四大组件共用的启动进程方法startProcessLocked。在这个整个过程中有新创建的进程和systemserver进程之间的交互过程，通过binder进行通信。app的任何组件都需要一个承载其运行的容器即进程，进程的创建过程是由systemserver通过socket向zygote进程请求fork新进程。

附录

源码路径

1
2
3
4
5
6
frameworks/base/core\java\android\os\Process.java
frameworks/base/services\core\java\com\android\server\am\ActivityManagerService.java
frameworks/base/core\java\android\app\ActivityThread.java
frameworks/base/core\java\android\app\LoadedApk.java
frameworks/base/core\java\android\app\Instrumentation.java
frameworks/base/core\java\android\app\ContextImpl.java