---
title: 'ActivityManagerService'
disqus: kyleAlien
---
ActivityManagerService
===
## OverView of Content
ActivityManagerService 簡稱是 AMS，它是由 Zygote 進程中的 SystemServer 啟動 (可參考另外一篇文章 - [**Android 啟動過程**](https://hackmd.io/pJpAeKAeRea0VIW3oI-mXw?view#Bootstrap-Services---%E5%95%9F%E5%8B%95%E5%A4%9A%E5%80%8B%E6%9C%8D%E5%8B%99))
參考文章: [**AMS**](https://juejin.cn/post/6916039838470766606#heading-1)
[TOC]
## AMS - 請求 Zygote
當 [**AMS**](https://android.googlesource.com/platform/frameworks/base/+/master/services/core/java/com/android/server/am/ActivityManagerService.java#3164) 向 Zygote 發起一個創建新進程 (App Process) 的請求時，會使用到 **==startProcessLocked 函數==**，並透過 Socket 向 Zygote 進程發送通知
> Zygote 作為 SocketServer 端，接收到 AMS 通知後，會 `fork` Zygote 進程自身
```java=
// ActivityManagerService.java
final ProcessList mProcessList;
final ProcessRecord startProcessLocked(String processName,
ApplicationInfo info, boolean knownToBeDead, int intentFlags,
HostingRecord hostingRecord, int zygotePolicyFlags, boolean allowWhileBooting,
boolean isolated, boolean keepIfLarge) {
// @ 追蹤 startProcessLocked
return mProcessList.startProcessLocked(processName, info, knownToBeDead,
intentFlags, /*... 省略部分參數*/);
}
```
### Process.start - 啟動 ActivityThread
* [**ProcessList**](https://cs.android.com/android/platform/superproject/+/master:frameworks/base/services/core/java/com/android/server/am/ProcessList.java) 經過一連串的呼叫後會透過 **++Process.start++ 啟動一個新進程**，並且開起的 Class 就是 **ActivityThread** (很孰悉吧? 就是應用 APP 的主線程)
```java=
// ProcessList.java
ProcessRecord startProcessLocked(String processName, ApplicationInfo info,
boolean knownToBeDead, int intentFlags, HostingRecord hostingRecord,
int zygotePolicyFlags, boolean allowWhileBooting, boolean isolated, int isolatedUid,
String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) {
// 啟動時間
long startTime = SystemClock.uptimeMillis();
ProcessRecord app;
// 目前創建的是非隔離 Process
if (!isolated) {
app = getProcessRecordLocked(processName, info.uid);
... 省略部分
} else {
...
// 如果是隔離 Process 就不能重複使用 (每次都要重新創建)
app = null;
}
...
// 啟動進程
// @ 分析 startProcessLocked 方法
final boolean success =
startProcessLocked(app, hostingRecord, zygotePolicyFlags, abiOverride);
return success ? app : null;
}
boolean startProcessLocked(ProcessRecord app, HostingRecord hostingRecord,
int zygotePolicyFlags, boolean disableHiddenApiChecks, boolean disableTestApiChecks,
String abiOverride) {
// 正在等待啟動
if (app.isPendingStart()) {
return true;
}
... 省略部分
try {
... 省略部分
// Class 入口
final String entryPoint = "android.app.ActivityThread";
// @ 分析 startProcessLocked
return startProcessLocked(hostingRecord, entryPoint, app, uid, gids,
runtimeFlags, zygotePolicyFlags, mountExternal, seInfo, requiredAbi,
instructionSet, invokeWith, startTime);
} /* 省略 catch */
}
ActivityManagerService mService = null;
boolean startProcessLocked(HostingRecord hostingRecord, String entryPoint, ProcessRecord app,
int uid, int[] gids, int runtimeFlags, int zygotePolicyFlags, int mountExternal,
String seInfo, String requiredAbi, String instructionSet, String invokeWith,
long startTime) {
... 省略部分
if (mService.mConstants.FLAG_PROCESS_START_ASYNC) {
// 異步啟動
mService.mProcStartHandler.post(() -> handleProcessStart(
app, entryPoint, gids, runtimeFlags, zygotePolicyFlags, mountExternal,
requiredAbi, instructionSet, invokeWith, startSeq));
return true;
} else {
try {
final Process.ProcessStartResult startResult =
// @ 分析 startProcess 方法
startProcess(hostingRecord,
entryPoint, app,
uid, gids, runtimeFlags, zygotePolicyFlags, mountExternal, seInfo,
requiredAbi, instructionSet, invokeWith, startTime);
handleProcessStartedLocked(app, startResult.pid, startResult.usingWrapper,
startSeq, false);
} /* 省略 catch */
return app.getPid() > 0;
}
}
private Process.ProcessStartResult startProcess(HostingRecord hostingRecord, String entryPoint,
ProcessRecord app, int uid, int[] gids, int runtimeFlags, int zygotePolicyFlags,
int mountExternal, String seInfo, String requiredAbi, String instructionSet,
String invokeWith, long startTime) {
try {
... 省略部分
final Process.ProcessStartResult startResult;
boolean regularZygote = false;
if (hostingRecord.usesWebviewZygote()) {
...
} else if (hostingRecord.usesAppZygote()) {
...
} else {
regularZygote = true;
// @ 分析 Process#start
startResult = Process.start(entryPoint,
app.processName, uid, uid, gids, runtimeFlags, mountExternal,
app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
app.info.dataDir, invokeWith, app.info.packageName, zygotePolicyFlags,
isTopApp, app.getDisabledCompatChanges(), pkgDataInfoMap,
allowlistedAppDataInfoMap, bindMountAppsData, bindMountAppStorageDirs,
new String[]{PROC_START_SEQ_IDENT + app.getStartSeq()});
}
}
}
```
> 
* [**Process**](https://cs.android.com/android/platform/superproject/+/master:frameworks/base/core/java/android/os/Process.java)#start：呼叫 ZygoteProcess#start 方法，最終會透過 Socket 通知 Zygote 要創建新 Process
```java=
// Process.java
public static final ZygoteProcess ZYGOTE_PROCESS = new ZygoteProcess();
/**
* State associated with the zygote process.
* @hide
*/
public static final ZygoteProcess ZYGOTE_PROCESS = new ZygoteProcess();
public static ProcessStartResult start(.../*省略參數*/) {
// 接下來在別的小節在說 ~ 重點就是通過 Socket 通知
return ZYGOTE_PROCESS.start(processClass, niceName, uid, gid, gids,
runtimeFlags, mountExternal, targetSdkVersion, seInfo,
abi, .../*省略參數*/);
}
```
* 最終會啟動 ActivityThread#main 函數
```java=
public static void main(String[] args) {
...
Looper.prepareMainLooper(); // 準備 Looper ~
...
ActivityThread thread = new ActivityThread();
thread.attach(false, startSeq);
if (sMainThreadHandler == null) {
sMainThreadHandler = thread.getHandler();
}
...
Looper.loop(); // 啟動 Looper ~
throw new RuntimeException("Main thread loop unexpectedly exited");
}
```
> 
### ZygoteProcess 與 Zygote 進程通訊
1. 在上面 [**Process#start**](https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/os/Process.java#642) 會呼叫靜態變數 `ZYGOTE_PROCESS`#start 方法
| 參數 | 實際數值 |
| -------- | -------- |
| processClass | **"android.app.ActivityThread"** |
```java=
// Process.java
/**
* State associated with the zygote process.
* @hide
*/
public static final ZygoteProcess ZYGOTE_PROCESS = new ZygoteProcess(); // 靜態單例
public static ProcessStartResult start(.../*省略參數*/) {
return ZYGOTE_PROCESS.start(processClass, niceName, uid, gid, gids,
runtimeFlags, mountExternal, targetSdkVersion, seInfo,
abi, ... /* 省略部份參數 */);
}
```
2. **[ZygoteProcess](https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/os/ZygoteProcess.java#345) 類就是用來++與 Zygote 進程進行通訊++**，這裡有一個靜態內部類 ZygoteState，它表示與 Zygote 通訊的狀態
:::info
* **ZygoteState 類**
這裡會透過 `openZygoteSocketIfNeeded` 方法獲得 ZygoteState 對象，它主要是負責 Socket 的連接、操作
:::
```java=
// ZygoteProcess.java
public final Process.ProcessStartResult start(.../*省略引數*/) {
...
try {
// @ 查看 startViaZygote
return startViaZygote(processClass, niceName, uid, gid, gids,
runtimeFlags, mountExternal, targetSdkVersion, seInfo,
abi, instructionSet, appDataDir, invokeWith, /*startChildZygote=*/ false,
packageName, zygotePolicyFlags, isTopApp, disabledCompatChanges,
pkgDataInfoMap, allowlistedDataInfoList, bindMountAppsData,
bindMountAppStorageDirs, zygoteArgs);
} catch (ZygoteStartFailedEx ex) {
... 省略 log
throw new RuntimeException(
"Starting VM process through Zygote failed", ex);
}
}
private Process.ProcessStartResult startViaZygote(.../*省略引數*/)
throws ZygoteStartFailedEx {
// 將 APP 進程啟動參數保存在 argsForZygote 列表中
ArrayList<String> argsForZygote = new ArrayList<>();
argsForZygote.add("--runtime-args");
argsForZygote.add("--setuid=" + uid);
argsForZygote.add("--setgid=" + gid);
argsForZygote.add("--runtime-flags=" + runtimeFlags);
if (mountExternal == Zygote.MOUNT_EXTERNAL_DEFAULT) {
argsForZygote.add("--mount-external-default");
} else if (mountExternal == Zygote.MOUNT_EXTERNAL_INSTALLER) {
argsForZygote.add("--mount-external-installer");
} else if (mountExternal == Zygote.MOUNT_EXTERNAL_PASS_THROUGH) {
argsForZygote.add("--mount-external-pass-through");
} else if (mountExternal == Zygote.MOUNT_EXTERNAL_ANDROID_WRITABLE) {
argsForZygote.add("--mount-external-android-writable");
}
argsForZygote.add("--target-sdk-version=" + targetSdkVersion);
... 省略部分
synchronized(mLock) {
// 注意: openZygoteSocketIfNeeded 方法 ～
// 它啟動一個 Socket 來連接 Zygote 進程 (相同 ABI)，可能堵塞
// @ 分析 zygoteSendArgsAndGetResult 方法
return zygoteSendArgsAndGetResult(
openZygoteSocketIfNeeded(abi),
zygotePolicyFlags,
argsForZygote // 將 argsForZygote 參數傳入
);
}
}
private Process.ProcessStartResult zygoteSendArgsAndGetResult(
ZygoteState zygoteState, int zygotePolicyFlags, @NonNull ArrayList<String> args)
throws ZygoteStartFailedEx {
// 檢查參數
for (String arg : args) {
// 輸入參數不能有換行 \n
if (arg.indexOf('\n') >= 0) {
throw new ZygoteStartFailedEx("Embedded newlines not allowed");
} else if (arg.indexOf('\r') >= 0) {
throw new ZygoteStartFailedEx("Embedded carriage returns not allowed");
}
}
String msgStr = args.size() + "\n" + String.join("\n", args) + "\n";
... 省略部份
// @ 分析 attemptZygoteSendArgsAndGetResult 方法
return attemptZygoteSendArgsAndGetResult(zygoteState, msgStr);
}
private Process.ProcessStartResult attemptZygoteSendArgsAndGetResult(
ZygoteState zygoteState, // Socket
String msgStr) // msgStr 就是 option 指令
throws ZygoteStartFailedEx {
try {
// ZygoteState 是與 Zygote 進程通訊的狀態
final BufferedWriter zygoteWriter = zygoteState.mZygoteOutputWriter;
final DataInputStream zygoteInputStream = zygoteState.mZygoteInputStream;
// 也就是通過對 zygoteState 的寫入，通知 ZygoteInit.java
zygoteWriter.write(msgStr); // 透過 Socket 對 Zygote 進程傳遞參數
zygoteWriter.flush();
// 處理 Zygote 通訊結果
Process.ProcessStartResult result = new Process.ProcessStartResult();
result.pid = zygoteInputStream.readInt();
result.usingWrapper = zygoteInputStream.readBoolean();
// 判斷啟動的 PID... 小於 0 代表 Zygote fork 失敗
if (result.pid < 0) {
throw new ZygoteStartFailedEx("fork() failed");
}
return result;
} catch (IOException ex) {
zygoteState.close();
Log.e(LOG_TAG, "IO Exception while communicating with Zygote - "
+ ex.toString());
throw new ZygoteStartFailedEx(ex);
}
}
```
3. 接著關注 [**ZygoteState 類**](https://cs.android.com/android/platform/superproject/+/master:frameworks/base/core/java/android/os/ZygoteProcess.java)：ZygoteState 從程式上看是從 **openZygoteSocketIfNeeded 函數** 取得，而這裡有分為兩種取得方式 !
* 主 Zygote 進程
* 輔助 Zygote 進程
:::success
* 在 [**Zygote 服務 - 啟動**](https://hackmd.io/pJpAeKAeRea0VIW3oI-mXw?view#Zygote-%E6%9C%8D%E5%8B%99---%E5%95%9F%E5%8B%95) 中有提到不同 Zygote 腳本啟動會有所差異，假設是在 [**zygote64_32.rc**](https://android.googlesource.com/platform/system/core/+/master/rootdir/init.zygote64_32.rc) 中，就會有主、輔助兩種 Zygote 服務
:::
```java=
// ZygoteProcess.java
// 取得 ZygoteState
private ZygoteState openZygoteSocketIfNeeded(String abi) throws ZygoteStartFailedEx {
try {
attemptConnectionToPrimaryZygote(); // 主
if (primaryZygoteState.matches(abi)) { // 比對取出的 ABI
return primaryZygoteState;
}
if (mZygoteSecondarySocketAddress != null) {
// The primary zygote didn't match. Try the secondary.
attemptConnectionToSecondaryZygote(); // 輔助
if (secondaryZygoteState.matches(abi)) { // 比對取出的 ABI
return secondaryZygoteState;
}
}
} catch (IOException ioe) {
throw new ZygoteStartFailedEx("Error connecting to zygote", ioe);
}
throw new ZygoteStartFailedEx("Unsupported zygote ABI: " + abi);
}
```
* 大略整理一下目前情況
1. 透過 `openZygoteSocketIfNeeded` 取得 Client 端的 Socket 並通過 (這個 **Socket 就是 ZygoteState**)
```java=
// ZygoteProcess.java
private final LocalSocketAddress mZygoteSocketAddress;
private final LocalSocketAddress mZygoteSecondarySocketAddress;
// 在建構函數時初始化
public ZygoteProcess() {
mZygoteSocketAddress = // "zygote"
new LocalSocketAddress(Zygote.PRIMARY_SOCKET_NAME,
LocalSocketAddress.Namespace.RESERVED);
mZygoteSecondarySocketAddress = // "zygote_secondary"
new LocalSocketAddress(Zygote.SECONDARY_SOCKET_NAME,
LocalSocketAddress.Namespace.RESERVED);
...
}
private ZygoteState primaryZygoteState;
private ZygoteState secondaryZygoteState;
// 連接主 Socket
private void attemptConnectionToPrimaryZygote() throws IOException {
if (primaryZygoteState == null || primaryZygoteState.isClosed()) {
primaryZygoteState =
ZygoteState.connect(mZygoteSocketAddress, mUsapPoolSocketAddress);
maybeSetApiDenylistExemptions(primaryZygoteState, false);
maybeSetHiddenApiAccessLogSampleRate(primaryZygoteState);
}
}
// 省略連接備用 Socket
```
2. 再通過 **對 Socket 寫入資料來達到通知 ZygoteInit 中的 ServerSocket**
### AMS Process & Socket 關係
| 類 | 功能 |
| -------- | -------- |
| ActivityManagerService | 管理四大組件，其中就包括該裝置的所有進程管理 |
| ProcessList | 所有管理所有進程，**似一種橋接模式，隔離 AMS 與 Prcoess 的直接關係，不讓 AMS 責任過重** |
| ProcessRecord | Fork 成功後，應用進程的代表 |
| Process | 用來呼叫 Socket 通知 Zygote 進程 fork 自己 |
| LocalSocket | 管理 Java 的 Socket 操作 |
| LocalSocketImpl | 實際與 Native Socket 通訊 |
> 
* 複習一下 Zygote 建立的 SocketServer：Zygote 在創建 SocketServer 後會與虛擬裝置 `/dev/socket/zygote` 鏈結
> 
接著 AMS 會創建一個 LocalSocket，它會負責與名為 `zygote` 的 Socket 連結，**LocalSocket 會找到 `/dev/socket/zygote` 裝置與其連結**
間接變成 AMS 與 Zygote 連接，如下圖
> 
:::success
* 接下來 Zygote 進程 fork App 的流程請參考 [**Zygote Fork APP 進程**](https://hackmd.io/Yw1s2x32QoqawvOsW039ZA?view#Zygote-Fork-APP-%E9%80%B2%E7%A8%8B) 篇
:::
## AMS
AMS 就是 ActivityManagerService，它也負責管理 Android 的四大零組件 Activity、Service、BroadcastReceiver、ContentProvider
### AMS 創建 & 啟動
* AMS 是透過 SystemServiceManager 來啟動 (啟動方式上面有說明)，這裡先來查看 [**SysytemServer**](https://cs.android.com/android/platform/superproject/+/master:frameworks/base/services/java/com/android/server/SystemServer.java) 是在何時啟動 ActivityManagerService 服務的
```java=
// SystemServer.java
public final class SystemServer implements Dumpable {
public static void main(String[] args) {
new SystemServer().run();
}
private void run() {
... 省略部分
try {
t.traceBegin("StartServices");
// AMS 是引導服務
startBootstrapServices(t); // 啟動引導服務
startCoreServices(t); // 啟動核心服務
startOtherServices(t); // 啟動其他服務
} /*省略 catch*/
... 省略部分
}
// 啟動 AMS 的函數
private void startBootstrapServices(@NonNull TimingsTraceAndSlog t) {
... 省略部分
// Activity manager runs the show.
// 相當於創建了一個 ActivityTaskManagerService 類
ActivityTaskManagerService atm = mSystemServiceManager.startService(
ActivityTaskManagerService.Lifecycle.class).getService();
// 1. @ 分析 ActivityManagerService.Lifecycle.startService
mActivityManagerService = ActivityManagerService
.Lifecycle.startService( // startService 會呼叫 onStart 方法
mSystemServiceManager,
atm
);
... 省略部分
// 之後分析
mActivityManagerService.setSystemProcess();
... 省略部分
}
}
```
1. [**AMS**](https://cs.android.com/android/platform/superproject/+/master:frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java) 的創建是透過 AMS#Lifecycle 內部類來創建，而 Lifecycle 內部類又是由反射調用 ( **Lifecycle 類因為繼承 `SystemService` 讓 AMS 有 `生命週期`** )
```java=
// ActivityManagerService.java
// 繼承於 SystemService (抽象類)
public static final class Lifecycle extends SystemService {
private final ActivityManagerService mService;
private static ActivityTaskManagerService sAtm;
public Lifecycle(Context context) {
super(context);
// 創建 AMS
mService = new ActivityManagerService(context, sAtm);
}
// SystemService#startService 會呼叫到 onStart 方法
@Override
public void onStart() {
// AMS 私有函數 start()
// @ 分析 start 方法
mService.start();
}
... 省略部分
}
```
2. **SystemService#startService** 會呼叫到 onStart 方法 (服務的生命週期)，onStart 方法會呼叫 AMS 私有的 start 函數
```java=
// ActivityManagerService.java
private void start() {
// 移除所有的進程組
removeAllProcessGroups();
// 啟動電池統計服務
mBatteryStatsService.publish();
mAppOpsService.publish();
Slog.d("AppOps", "AppOpsService published");
// 添加到本地 LocalServices 中 ( 該行程
LocalServices.addService(ActivityManagerInternal.class, mInternal);
LocalManagerRegistry.addManager(ActivityManagerLocal.class,
(ActivityManagerLocal) mInternal);
mActivityTaskManager.onActivityManagerInternalAdded();
mPendingIntentController.onActivityManagerInternalAdded();
mAppProfiler.onActivityManagerInternalAdded();
}
```
* **到這一步 AMS 就啟動完成了**，下圖是 AMS 創建 & 啟動流程
:::info
AMS 註冊到 binder 驅動，我們在另外一個小節講
:::
> 
### AMS 初始化 - Provider & WMS
* 在 AMS 啟動後，[**SystemServer**](https://android.googlesource.com/platform/frameworks/base/+/master/services/java/com/android/server/SystemServer.java) 會在 `startOtherServices` 帶起其他服務 (包括 WMS、PMS 等等服務...)，並在最後 **`AMS#systemReady` 方法中會設定 SystemServiceManager 的啟動狀態**
```java=
// /android/server/SystemServer.java
public final class SystemServer implements Dumpable {
public static void main(String[] args) {
new SystemServer().run();
}
private void run() {
... 省略部分
try {
t.traceBegin("StartServices");
// AMS 是引導服務
startBootstrapServices(t); // 啟動引導服務
startCoreServices(t); // 啟動核心服務
startOtherServices(t); // 啟動其他服務
} /*省略 catch*/
... 省略部分
}
private void startBootstrapServices(@NonNull TimingsTraceAndSlog t) {
... 省略部分
// 上面 AMS 已啟動
// 初始化 PMS
mActivityManagerService.initPowerManagement();
... 省略部分
}
private void startCoreServices(@NonNull TimingsTraceAndSlog t) {
... 省略部分
// 啟動 使用者狀態管理 服務
mActivityManagerService.setUsageStatsManager(
LocalServices.getService(UsageStatsManagerInternal.class));
...省略部分
}
private void startOtherServices(@NonNull TimingsTraceAndSlog t) {
// 1. 初始化 Providers
mActivityManagerService.getContentProviderHelper().installSystemProviders();
// 2. 設定 ++WMS++ 服務
mActivityManagerService.setWindowManager(wm);
// 3. 啟動準備工作 (下一小節說明)
// 調整 SystemServiceManager 的啟動階段
mActivityManagerService.systemReady(() -> { // Runnable
... 省略部分
}, t);
}
```
> 
1. **`startOtherServices` 函數**：會透過 [**AMS**](https://android.googlesource.com/platform/frameworks/base/+/refs/heads/froyo-release/services/java/com/android/server/am/ActivityManagerService.java) 中的 [**ContentProviderHelper**](https://android.googlesource.com/platform/frameworks/base/+/refs/heads/master/services/core/java/com/android/server/am/ContentProviderHelper.java) **來初始化系統 Provider (清除 ++非系統 Provider++)**
```java=
// ContentProviderHelper.java
private final ActivityManagerService mService;
public static final void installSystemProviders() {
List<ProviderInfo> providers;
synchronized (mService) {
ProcessRecord app = mService.mProcessList
.getProcessNamesLOSP().get("system", SYSTEM_UID);
providers = generateApplicationProvidersLocked(app);
if (providers != null) {
for (int i = providers.size() - 1; i >= 0; i--) {
ProviderInfo pi = providers.get(i);
// 移除非系統 Provider
if ((pi.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM) == 0) {
Slog.w(TAG, "Not installing system proc provider " + pi.name
+ ": not system .apk");
providers.remove(i);
}
}
}
}
if (providers != null) {
// 初始化系統 Provider
mService.mSystemThread.installSystemProviders(providers);
}
synchronized (this) {
mSystemProvidersInstalled = true;
}
... 省略部份
}
```
2. **AMS 透過 `setWindowManager` 設定 AMS 的 WMS 對象**：這樣 AMS、ATMS 就會與 WMS 產生關係
```java=
// ActivityManagerService.java
public WindowManagerService mWindowManager;
public ActivityTaskManagerService mActivityTaskManager;
public void setWindowManager(WindowManagerService wm) {
synchronized (this) {
mWindowManager = wm;
mWmInternal = LocalServices.getService(WindowManagerInternal.class);
// 同時設定給 ActivityTaskManager
mActivityTaskManager.setWindowManager(wm);
}
}
```
> 
### AMS 系統啟動準備 - systemReady
* 在 SystemServer 啟動完畢後會呼叫 AMS#systemReady 函數
```java=
// /android/server/SystemServer.java
public final class SystemServer implements Dumpable {
private void startOtherServices(@NonNull TimingsTraceAndSlog t) {
// 1. 初始化 Providers
// 2. 設定 ++WMS++ 服務
// 3. 啟動準備工作
// 調整 SystemServiceManager 的啟動階段
mActivityManagerService.systemReady(() -> { // Runnable
... 先分析 systemReady，之後再下面分析這個 Runnable
}, t);
}
```
* 分析 AMS#systemReady 函數
1. 系統尚未準備好，在這時主要會做
* 呼叫 AMS 下服務的 `onSystemReady` 生命週期
* **殺掉所有運行非啟動 (非 AMS Booting 須啟動) 的進程**
```java=
// ActivityManagerService.java
// 系統若已經啟動會把 mSystemReady 設定為 true
volatile boolean mSystemReady = false;
// 所有進程紀錄
final PidMap mPidsSelfLocked = new PidMap();
public void systemReady(final Runnable goingCallback, @NonNull TimingsTraceAndSlog t) {
mSystemServiceManager.preSystemReady();
// 同步鎖
synchronized(this) {
// 初次近來為 false
if (mSystemReady) {
// ... 暫時省略
return;
}
t.traceBegin("controllersReady");
mLocalDeviceIdleController =
LocalServices.getService(DeviceIdleInternal.class);
// 1. 呼叫其他服務的 onSystemReady 生命週期
mActivityTaskManager.onSystemReady();
// Make sure we have the current profile info, since it is needed for security checks.
mUserController.onSystemReady();
mAppOpsService.systemReady();
mProcessList.onSystemReady();
// 系統啟動
mSystemReady = true;
t.traceEnd();
}
... 省略部分
// 查看進程紀錄
ArrayList<ProcessRecord> procsToKill = null;
synchronized(mPidsSelfLocked) {
for (int i=mPidsSelfLocked.size()-1; i>=0; i--) {
ProcessRecord proc = mPidsSelfLocked.valueAt(i);
// 判斷是否是非啟動 (Booting) 進程
if (!isAllowedWhileBooting(proc.info)){
if (procsToKill == null) {
procsToKill = new ArrayList<ProcessRecord>();
}
procsToKill.add(proc);
}
}
}
synchronized(this) {
if (procsToKill != null) {
// 1. 殺掉所有運行非啟動 (Booting) 的進程
for (int i = procsToKill.size() - 1; i >= 0; i--) {
ProcessRecord proc = procsToKill.get(i);
Slog.i(TAG, "Removing system update proc: " + proc);
mProcessList.removeProcessLocked(proc, true, false,
ApplicationExitInfo.REASON_OTHER,
ApplicationExitInfo.SUBREASON_SYSTEM_UPDATE_DONE,
"system update done");
}
}
// 進程準備好
mProcessesReady = true;
}
... 省略部分
// 呼叫傳入的 Runnable
if (goingCallback != null) goingCallback.run();
... 下面做分析
}
```
2. 系統已準備，呼叫 Callback (Runnable)，調整 AMS SystemServiceManager 的啟動狀態
```java=
// SystemServer.java
public final class SystemServer implements Dumpable {
private void startOtherServices(@NonNull TimingsTraceAndSlog t) {
// 1. 初始化 Providers
// 2. 設定 ++WMS++ 服務
// 3. 啟動準備工作
// 調整 SystemServiceManager 的啟動階段
mActivityManagerService.systemReady(() -> { // Runnable
// 調整啟動階段 500 (AMS 已準備好)
mSystemServiceManager.startBootPhase(t, SystemService.PHASE_ACTIVITY_MANAGER_READY);
// 觀察 Native 的 Crashes
try {
mActivityManagerService.startObservingNativeCrashes();
} catch (Throwable e) {
reportWtf("observing native crashes", e);
}
// 應用 APP 能將 Binder 調用到服務中 600
mSystemServiceManager.startBootPhase(t, SystemService.PHASE_THIRD_PARTY_APPS_CAN_START);
... 省略部分
// 啟動輸入服務
try {
// TODO(BT) Pass parameter to input manager
if (inputManagerF != null) {
inputManagerF.systemRunning();
}
} catch (Throwable e) {
reportWtf("Notifying InputManagerService running", e);
}
... 省略部分
}, t);
}
```
3. SystemReady 最後階段，啟動 桌面應用 Launcher App
```java=
// ActivityManagerService.java
// 系統若已經啟動會把 mSystemReady 設定為 true
volatile boolean mSystemReady = false;
public ActivityTaskManagerInternal mAtmInternal;
// 所有進程紀錄
final PidMap mPidsSelfLocked = new PidMap();
public void systemReady(final Runnable goingCallback, @NonNull TimingsTraceAndSlog t) {
// 殺掉非啟動進程
... 省略部分
// 呼叫傳入的 Runnable
if (goingCallback != null) goingCallback.run();
// 系統才能呼叫 systemReady 方法
final int currentUserId = mUserController.getCurrentUserId();
if (currentUserId != UserHandle.USER_SYSTEM && !mUserController.isSystemUserStarted()) {
// User other than system user has started. Make sure that system user is already
// started before switching user.
throw new RuntimeException("System user not started while current user is:"
+ currentUserId);
}
// 電池服務
mBatteryStatsService.onSystemReady();
... 省略部分
final boolean bootingSystemUser = currentUserId == UserHandle.USER_SYSTEM;
if (bootingSystemUser) {
// 呼叫 SystemService 的 onUserStarting 方法
// 以下會針對 onUserStarting 函數在往下分析
mSystemServiceManager.onUserStarting(t, currentUserId);
}
synchronized (this) {
startPersistentApps(PackageManager.MATCH_DIRECT_BOOT_AWARE);
// Start up initial activity.
mBooting = true;
... 省略部分
if (bootingSystemUser) {
// 啟動系統桌面 Activity
// startHomeOnAllDisplays 之後分析
mAtmInternal.startHomeOnAllDisplays(currentUserId, "systemReady");
}
t.traceBegin("showSystemReadyErrorDialogs");
mAtmInternal.showSystemReadyErrorDialogsIfNeeded();
t.traceEnd();
if (bootingSystemUser) {
t.traceBegin("sendUserStartBroadcast");
final int callingUid = Binder.getCallingUid();
final int callingPid = Binder.getCallingPid();
final long ident = Binder.clearCallingIdentity();
try {
// 啟動 intent#ACTION_USER_STARTED
Intent intent = new Intent(Intent.ACTION_USER_STARTED);
intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY
| Intent.FLAG_RECEIVER_FOREGROUND);
intent.putExtra(Intent.EXTRA_USER_HANDLE, currentUserId);
broadcastIntentLocked(null, null, null, intent,
null, null, 0, null, null, null, null, OP_NONE,
null, false, false, MY_PID, SYSTEM_UID, callingUid, callingPid,
currentUserId);
// 發送 ACTION_USER_STARTING 廣播
intent = new Intent(Intent.ACTION_USER_STARTING);
intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY);
intent.putExtra(Intent.EXTRA_USER_HANDLE, currentUserId);
broadcastIntentLocked(null, null, null, intent, null,
new IIntentReceiver.Stub() {
@Override
public void performReceive(Intent intent, int resultCode,
String data, Bundle extras, boolean ordered, boolean sticky,
int sendingUser) {}
}, 0, null, null, new String[] {INTERACT_ACROSS_USERS}, null, OP_NONE,
null, true, false, MY_PID, SYSTEM_UID, callingUid, callingPid,
UserHandle.USER_ALL);
} catch (Throwable e) {
Slog.wtf(TAG, "Failed sending first user broadcasts", e);
} finally {
Binder.restoreCallingIdentity(ident);
}
t.traceEnd();
} else {
... 省略部分
}
// 恢復棧頂 Activity
mAtmInternal.resumeTopActivities(false /* scheduleIdle */);
if (bootingSystemUser) {
// 發送廣播
mUserController.sendUserSwitchBroadcasts(-1, currentUserId);
}
... 省略部分
}
}
```
> 
4. [**SystemServiceManager**](https://android.googlesource.com/platform/frameworks/base/+/refs/heads/master/services/core/java/com/android/server/SystemServiceManager.java) 的 **onUserStarting** 函數最終會走到 **++抽象類 [SystemService](https://android.googlesource.com/platform/frameworks/base/+/refs/heads/master/services/core/java/com/android/server/SystemService.java)++ 的 onUserStarting 方法**
```java=
// /server/SystemServiceManager.java
public void onUserStarting(@NonNull TimingsTraceAndSlog t, @UserIdInt int userId) {
EventLog.writeEvent(EventLogTags.SSM_USER_STARTING, userId);
final TargetUser targetUser = newTargetUser(userId);
synchronized (mTargetUsers) {
mTargetUsers.put(userId, targetUser);
}
// onWhat => USER_STARTING
onUser(t, USER_STARTING, /* prevUser= */ null, targetUser);
}
private void onUser(@NonNull String onWhat, @UserIdInt int userId) {
onUser(TimingsTraceAndSlog.newAsyncLog(), onWhat, /* prevUser= */ null,
getTargetUser(userId));
}
private void onUser(@NonNull TimingsTraceAndSlog t, @NonNull String onWhat,
@Nullable TargetUser prevUser, @NonNull TargetUser curUser) {
final int curUserId = curUser.getUserIdentifier();
final int serviceLen = mServices.size();
for (int i = 0; i < serviceLen; i++) {
final SystemService service = mServices.get(i);
final String serviceName = service.getClass().getName();
// Service 必須支援
boolean supported = service.isUserSupported(curUser);
... 省略部分
if (!supported) {
continue;
}
try {
switch (onWhat) {
case USER_SWITCHING:
service.onUserSwitching(prevUser, curUser);
break;
// 呼叫 ++抽象類 SystemService++ 的 onUserStarting 方法
case USER_STARTING: // 走到這
service.onUserStarting(curUser);
break;
case USER_UNLOCKING:
service.onUserUnlocking(curUser);
break;
case USER_UNLOCKED:
service.onUserUnlocked(curUser);
break;
case USER_STOPPING:
service.onUserStopping(curUser);
break;
case USER_STOPPED:
service.onUserStopped(curUser);
break;
default:
throw new IllegalArgumentException(onWhat + " what?");
}
} /* 省略 catch */
}
}
// ---------------------------------------------------------
// SystemService.java (服務生命週期)
public void onUserStarting(@NonNull TargetUser user) {
// 讓有興趣的服務自己 Override
}
```
### AMS 建構函數
* [**AMS 建構函數**](https://android.googlesource.com/platform/frameworks/base/+/refs/heads/master/services/core/java/com/android/server/am/ActivityManagerService.java#2176) 會初始化系統使用的相關類，可以看到系統 Handler 被創建、其他零組件被創建(Boradcast、ContentProvider)... 等等
```java=
// /services/core/java/com/android/server/am/ActivityManagerService.java
// AMS 建構函數
public ActivityManagerService(Context systemContext, ActivityTaskManagerService atm) {
LockGuard.installLock(this, LockGuard.INDEX_ACTIVITY);
mInjector = new Injector(systemContext);
// 系統級 Context
mContext = systemContext;
mFactoryTest = FactoryTest.getMode();
// 獲取當前的 ActiivtyThread
mSystemThread = ActivityThread.currentActivityThread();
// 取得 系統 UiContext
mUiContext = mSystemThread.getSystemUiContext();
Slog.i(TAG, "Memory class: " + ActivityManager.staticGetMemoryClass());
// 創建 Handler Thread 處理 Handler 消息
mHandlerThread = new ServiceThread(TAG,
THREAD_PRIORITY_FOREGROUND, false /*allowIo*/);
mHandlerThread.start();
mHandler = new MainHandler(mHandlerThread.getLooper());
// 處理 UI 相關訊息的 Handler
mUiHandler = mInjector.getUiHandler(this);
mProcStartHandlerThread = new ServiceThread(TAG + ":procStart",
THREAD_PRIORITY_FOREGROUND, false /* allowIo */);
mProcStartHandlerThread.start();
// 進程啟動的 Handler
mProcStartHandler = new Handler(mProcStartHandlerThread.getLooper());
// 管理 AMS 的常量，廠商制定系統就有可能修該此處
mConstants = new ActivityManagerConstants(mContext, this, mHandler);
final ActiveUids activeUids = new ActiveUids(this, true /* postChangesToAtm */);
mPlatformCompat = (PlatformCompat) ServiceManager.getService(
Context.PLATFORM_COMPAT_SERVICE);
mProcessList = mInjector.getProcessList(this);
mProcessList.init(this, activeUids, mPlatformCompat);
mAppProfiler = new AppProfiler(this, BackgroundThread.getHandler().getLooper(),
new LowMemDetector(this));
mPhantomProcessList = new PhantomProcessList(this);
mOomAdjuster = new OomAdjuster(this, mProcessList, activeUids);
// Broadcast policy parameters
// 初始化前、後台、卸載廣播列隊
// 系統會優先便利發送前台廣播
final BroadcastConstants foreConstants = new BroadcastConstants(
Settings.Global.BROADCAST_FG_CONSTANTS); // 前台
foreConstants.TIMEOUT = BROADCAST_FG_TIMEOUT;
final BroadcastConstants backConstants = new BroadcastConstants(
Settings.Global.BROADCAST_BG_CONSTANTS); // 後台
backConstants.TIMEOUT = BROADCAST_BG_TIMEOUT;
final BroadcastConstants offloadConstants = new BroadcastConstants(
Settings.Global.BROADCAST_OFFLOAD_CONSTANTS); // 卸載
offloadConstants.TIMEOUT = BROADCAST_BG_TIMEOUT;
// by default, no "slow" policy in this queue
offloadConstants.SLOW_TIME = Integer.MAX_VALUE;
mEnableOffloadQueue = SystemProperties.getBoolean(
"persist.device_config.activity_manager_native_boot.offload_queue_enabled", false);
mFgBroadcastQueue = new BroadcastQueue(this, mHandler,
"foreground", foreConstants, false);
mBgBroadcastQueue = new BroadcastQueue(this, mHandler,
"background", backConstants, true);
mOffloadBroadcastQueue = new BroadcastQueue(this, mHandler,
"offload", offloadConstants, true);
mBroadcastQueues[0] = mFgBroadcastQueue;
mBroadcastQueues[1] = mBgBroadcastQueue;
mBroadcastQueues[2] = mOffloadBroadcastQueue;
// 初始化管理 Services 的 ActiveServices 物件
mServices = new ActiveServices(this);
// 初始化 ContentProvider
mCpHelper = new ContentProviderHelper(this, true);
// 包 WatchDog
mPackageWatchdog = PackageWatchdog.getInstance(mUiContext);
// 初始化 APP 錯誤日誌紀錄物件
mAppErrors = new AppErrors(mUiContext, this, mPackageWatchdog);
mUidObserverController = new UidObserverController(mUiHandler);
// 取得系統資料夾
final File systemDir = SystemServiceManager.ensureSystemDir();
// TODO: Move creation of battery stats service outside of activity manager service.
// 創建電池統計服務
mBatteryStatsService = new BatteryStatsService(systemContext, systemDir,
BackgroundThread.get().getHandler());
mBatteryStatsService.getActiveStatistics().readLocked();
mBatteryStatsService.scheduleWriteToDisk();
mOnBattery = DEBUG_POWER ? true
: mBatteryStatsService.getActiveStatistics().getIsOnBattery();
// 創建進程統計分析服務，追蹤統計進程的濫用、不良行為
mBatteryStatsService.getActiveStatistics().setCallback(this);
mOomAdjProfiler.batteryPowerChanged(mOnBattery);
mProcessStats = new ProcessStatsService(this, new File(systemDir, "procstats"));
mAppOpsService = mInjector.getAppOpsService(new File(systemDir, "appops.xml"), mHandler);
mUgmInternal = LocalServices.getService(UriGrantsManagerInternal.class);
// 負責管理多用戶
mUserController = new UserController(this);
mPendingIntentController = new PendingIntentController(
mHandlerThread.getLooper(), mUserController, mConstants);
// 初始化系統屬性
mUseFifoUiScheduling = SystemProperties.getInt("sys.use_fifo_ui", 0) != 0;
mTrackingAssociations = "1".equals(SystemProperties.get("debug.track-associations"));
mIntentFirewall = new IntentFirewall(new IntentFirewallInterface(), mHandler);
// 賦予 ActivityTaskManager
mActivityTaskManager = atm;
// 初始化，內部會創建 ActivityStackSupervisor 類
// ActivityStackSupervisor 會記錄 Activity 狀態信息，是 AMS 的核心類
mActivityTaskManager.initialize(mIntentFirewall, mPendingIntentController,
DisplayThread.get().getLooper());
mAtmInternal = LocalServices.getService(ActivityTaskManagerInternal.class);
mHiddenApiBlacklist = new HiddenApiSettings(mHandler, mContext);
// Watchdog 監聽 (若進程不正常則會被 Kill)
Watchdog.getInstance().addMonitor(this);
Watchdog.getInstance().addThread(mHandler);
// bind background threads to little cores
// this is expected to fail inside of framework tests because apps can't touch cpusets directly
// make sure we've already adjusted system_server's internal view of itself first
updateOomAdjLocked(OomAdjuster.OOM_ADJ_REASON_NONE);
try {
Process.setThreadGroupAndCpuset(BackgroundThread.get().getThreadId(),
Process.THREAD_GROUP_SYSTEM);
Process.setThreadGroupAndCpuset(
mOomAdjuster.mCachedAppOptimizer.mCachedAppOptimizerThread.getThreadId(),
Process.THREAD_GROUP_SYSTEM);
} catch (Exception e) {
Slog.w(TAG, "Setting background thread cpuset failed");
}
mInternal = new LocalService();
mPendingStartActivityUids = new PendingStartActivityUids(mContext);
mTraceErrorLogger = new TraceErrorLogger();
}
```
### AMS - ServiceManager 添加服務到 Binder 驅動
* AMS#[**setSystemProcess**](https://android.googlesource.com/platform/frameworks/base/+/refs/heads/master/services/core/java/com/android/server/am/ActivityManagerService.java#2112) 方法不只註冊自己 (AMS) 的 Server 到 Binder 驅動中，而是一系列與進程相關的服務，下表會提及幾個常見的服務項目
:::success
* adb shell dump 資料來源
**setSystemProcess 添加的服務也是提供 adb 資料的來源**
:::
| 服務項目 | 簡介 |
| -------- | -------- |
| activity | AMS |
| procstats | 進程統計 |
| meminfo | 內存 |
| gfxinfo | 圖像訊息 |
| dbinfo | DataBase 數據庫 |
| cpuinfo | CPU 資訊 |
| permission | 權限 |
| processinfo | 進程服務 |
| usagestats | 應用使用情況 |
```java=
// /ActivityManagerService.java
public void setSystemProcess() {
try {
// 註冊 AMS
ServiceManager.addService(Context.ACTIVITY_SERVICE, this, /* allowIsolated= */ true,
DUMP_FLAG_PRIORITY_CRITICAL | DUMP_FLAG_PRIORITY_NORMAL | DUMP_FLAG_PROTO);
// 註冊 ProcessStatsService
ServiceManager.addService(ProcessStats.SERVICE_NAME, mProcessStats);
ServiceManager.addService("meminfo", new MemBinder(this), /* allowIsolated= */ false,
DUMP_FLAG_PRIORITY_HIGH);
// 以下這冊各種服務
ServiceManager.addService("gfxinfo", new GraphicsBinder(this));
ServiceManager.addService("dbinfo", new DbBinder(this));
if (MONITOR_CPU_USAGE) {
ServiceManager.addService("cpuinfo", new CpuBinder(this),
/* allowIsolated= */ false, DUMP_FLAG_PRIORITY_CRITICAL);
}
ServiceManager.addService("permission", new PermissionController(this));
ServiceManager.addService("processinfo", new ProcessInfoService(this));
ServiceManager.addService("cacheinfo", new CacheBinder(this));
// 調用 PackageManagerService 的接口，查詢包名為 android 的應用 App 的 ApplicationInfo 訊息
ApplicationInfo info = mContext.getPackageManager().getApplicationInfo(
"android", STOCK_PM_FLAGS | MATCH_SYSTEM_ONLY);
// 往下分析 Activity#installSystemApplicationInfo 函數
mSystemThread.installSystemApplicationInfo(info, getClass().getClassLoader());
// 創建 ProcessRecord 對象，並保存 AMS 對象訊息
synchronized (this) {
ProcessRecord app = mProcessList.newProcessRecordLocked(info, info.processName,
false,
0,
new HostingRecord("system"));
app.setPersistent(true);
app.setPid(MY_PID);
app.mState.setMaxAdj(ProcessList.SYSTEM_ADJ);
app.makeActive(mSystemThread.getApplicationThread(), mProcessStats);
addPidLocked(app);
updateLruProcessLocked(app, false, null);
updateOomAdjLocked(OomAdjuster.OOM_ADJ_REASON_NONE);
}
... 省略部分
} catch (PackageManager.NameNotFoundException e) {
throw new RuntimeException(
"Unable to find android system package", e);
}
... 省略部分
}
```
:::info
* **ServiceManager#addService 就是 ++Binder 服務++**
> ServiceManager(java) 是 ServiceManager(Native) 的一個封裝
:::
### [LoadedApk](https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/app/LoadedApk.java) - 加載 android package
* 在前面有說到 **LoadedApk 對象由 createSystemContext 方法創建**，到了 setSystemProcess 函數後，就會使用 LoadedApk 來加載系統資處資源 (andoid package)
```java=
// LoadedApk.java
/**
* Sets application info about the system package.
*/
void installSystemApplicationInfo(ApplicationInfo info, ClassLoader classLoader) {
assert info.packageName.equals("android");
mApplicationInfo = info;
mClassLoader = classLoader;
mAppComponentFactory = createAppFactory(info, classLoader);
}
```
### Binder - AMS 功能
* 要知道所有的 AMS 功能最好是去查詢 [**IActivityManager**](https://github.com/baidu/GPT/blob/master/gpt-sdk/src/android/app/IActivityManager.java)，它裡面包含所有 AMS 所提供的功能，以下分為幾種分類描述
1. **組件狀態 - 管理**: 4 大零組件的管理，startActivity、startActivityAndWait、startService、stopService、removeContentProvider ... 等等
2. **組件狀態 - 查詢**: 查看當前組件的運行狀況 getCallingAcitivty、getServices... 等等
3. Task 相關: Task 相關的函數，removeSubTask、remove Task ... 等等
4. 其他: getMemoryInfo、setDebugApp... 等等
## AMS 重點類
* 在 AMS & App 中有用到許多的類別，這邊大致上介紹，方便之後了解
* AMS
| AMS 相關類 | 功能 |
| - | - |
| ActivityStackSupervisor | 管理 Activity Stack |
| ClientLifecycleManager | Android 28 之後才加入，用來控制管理 Activity 的生命週期 |
| ActivityStart | Activity 啟動器，也管理 Activity 的啟動細項 |
| ActivityStartController | 產生 ActivityStart 的實例，並復用 |
| ActivityTaskManagerService(簡稱 ATMS) | **Android 核心服務，負責啟動四大組件** |
| ActivityTaskManager | Activity 與 ATMS 跨進程通訊的接口，是 ATMS 的輔助類 |
| ProcessRecord | 描述身分的數據 |
| RecentTasks | 最近開啟的 Activity |
* App
| App 相關類 | 功能 |
| - | - |
| ActivityThread | App 應用的進入點，啟動主線程 |
| ActivityThread#ApplicationThread | ApplicationThread 是 ActivityThread 的內部類，繼承 IApplication.Sub，**它作為 APP 與 AMS 通訊的 Service 端** |
| Instrumentation | Hook Activity 的起動、結束... 等等操作，應用 APP 與 AMS 的互交都透過 Instrumentation |
| ActivityStack | 以 Stack 為單位 (AndroidManifest 的四種啟動方式有關)，負責管理多個 Activity |
> 
### [ProcessRecord](https://cs.android.com/android/platform/superproject/+/master:frameworks/base/services/core/java/com/android/server/am/ProcessRecord.java) 進程管理
* **ProcessRecord 類 - 進程相關訊息**
| 參數 | 說明 |
| - | - |
| info : ApplicationInfo | AndroidManifest.xml 中定義的 <\application> tag 相關信息 |
| isolated : Boolean | isolated 進程 |
| uid : int | user id |
| pid : int | 進程 process id |
| gids : int[] | 群組 id |
| userId : int | android 的多用戶系統 id (就像是 windows 的多位使用者功能) |
| processName : String | 進程名，**默認使用包名** |
| uidRecord : UidRecord | 紀錄以使用的 uid |
| thread : IApplicationThread | **==通過該物件 AMS 對 APP 發送訊息==，該對象不為空代表該 APK 可使用** |
| procStatFile：String | **proc 目錄下每一個進程都有一個 ++以 pid 命名的目錄文件++，該文件記錄進程的所有相關訊息，該目錄是 Linux Kernel 創建的** |
| compat : CompatibilityInfo | 兼容性信息 |
| requiredAbi : String | abi 訊息 |
| instructionSet : String | 指令集合 |
| mPkgList : PackageList | 包中運行的 APP | |
| mPkgDeps : ArraySet<String\> | 當前進程運行依賴的包 | |
> 
* **ProcessRecord 類 - 描述進程組件**
| 參數 | 說明 |
| - | - |
| maxAdj : int | 進程的 Adj 上限 (adjustment) |
| curRawAdj : int | 正在計算的 adj，這個值可能大於 maxAdj |
* **ProcessRecord 類 - 描述進程組件 (四大零組件相關)**
| 參數 | 說明 | 其他 |
| - | - | - |
| mWindowProcessController : WindowProcessController | 透過 WindowProcessController 管理所有 Activity | **Activity 用 `ActivityRecord` 來表示** |
| mServices : ProcessServiceRecord | 該進程內所有的 Service | **Service 用 `ServiceRecord` 來表示** |
| mProviders : ProcessProviderRecord | 該進程內所有的 Provider | **ContentProvider 用 `ContentProviderRecord` 來表示** |
| mReceivers : ProcessReceiverRecord | 該進程內所有的 Receiver | **ContentProvider 用 `BroadcastRecord` 來表示** |
> 
### [ActivityRecord](https://android.googlesource.com/platform/frameworks/base/+/master/services/core/java/com/android/server/wm/ActivityRecord.java) - Activity
* **ActivityRecord 在記錄一個 Activity 的所有訊息**，它是 **歷史棧中的一個 Activity**，內部紀錄 ActivityInfo (AndroidManifest 設定)、task 服務
```java=
final class ActivityRecord extends WindowToken implements WindowManagerService.AppFreezeListener {
// 所屬的 Task 服務
final ActivityTaskManagerService mAtmService;
// AndroidManifest 設定的數值
final ActivityInfo info;
// WindowsManager token
final ActivityRecord.Token appToken;
// 私有化建構函數
// 透過 builder 模式建構 ActivityRecord 對象
private ActivityRecord(ActivityTaskManagerService _service, WindowProcessController _caller,
int _launchedFromPid, int _launchedFromUid, String _launchedFromPackage,
@Nullable String _launchedFromFeature, Intent _intent, String _resolvedType,
ActivityInfo aInfo, ... /* 省略部份*/ ) {
... 省略部分
}
}
```
> 
* 那 ActivityRecord 是如何創建的呢 ? 是透過 [**ActivityStarter#executeRequest**](https://android.googlesource.com/platform/frameworks/base/+/master/services/core/java/com/android/server/wm/ActivityStarter.java) 創建 ActivityRecord 對象
```java=
// ActivityStarter.java
// Last activity record we attempted to start
private ActivityRecord mLastStartActivityRecord;
private int executeRequest(Request request) {
...省略 Request 分析
// 透過 Builder 創建 AcitiviyRecord
final ActivityRecord r = new ActivityRecord.Builder(mService)
.setCaller(callerApp) // 設定各種參數
.setLaunchedFromPid(callingPid)
.setLaunchedFromUid(callingUid)
.setLaunchedFromPackage(callingPackage)
.setLaunchedFromFeature(callingFeatureId)
.setIntent(intent)
.setResolvedType(resolvedType)
.setActivityInfo(aInfo)
.setConfiguration(mService.getGlobalConfiguration())
.setResultTo(resultRecord)
.setResultWho(resultWho)
.setRequestCode(requestCode)
.setComponentSpecified(request.componentSpecified)
.setRootVoiceInteraction(voiceSession != null)
.setActivityOptions(checkedOptions)
.setSourceRecord(sourceRecord)
.build();
// 當前 Activity
mLastStartActivityRecord = r;
... 省略部分
}
```
:::success
* Activity 啟動時就會使用到 ActivityStarter
:::
### 啟動 Activity - 調用 [ActivityTaskManagerService](https://cs.android.com/android/platform/superproject/+/master:frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java)
* ActivityTaskManagerService 它也是一個系統服務（註冊在 Binder 驅動中），**App 端如果要調用就必須透過代理，這個代理就是 ActivityTaskManager**
1. 首先從 [**Acitivty**](https://cs.android.com/android/platform/superproject/+/master:frameworks/base/core/java/android/app/Activity.java)#**`startActivity`** 開始分析: 最終都會導向 `startActivityForResult` 函數
```java=
// Activity.java
public class Activity extends ContextThemeWrapper
implements LayoutInflater.Factory2,
Window.Callback, KeyEvent.Callback,
...省略部分接口 {
/*package*/ ActivityThread mMainThread;
private Instrumentation mInstrumentation;
@Override
public void startActivity(Intent intent) {
// @ 追蹤 startActivity
this.startActivity(intent, null);
}
@Override
public void startActivity(Intent intent, @Nullable Bundle options) {
... 省略部分
// @ 分析 startActivityForResult 方法
if (options != null) {
startActivityForResult(intent, -1, options);
} else {
startActivityForResult(intent, -1);
}
}
public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
@Nullable Bundle options) {
if (mParent == null) {
options = transferSpringboardActivityOptions(options);
// @ 分析 execStartActivity 方法
Instrumentation.ActivityResult ar =
mInstrumentation.execStartActivity(
this,
// ApplicationThread
mMainThread.getApplicationThread(),
mToken, this,
intent, requestCode, options);
... 省略部分
} else {
... 省略部分
}
}
}
// ---------------------------------------------------------
// ActivityThread .java
public final class ActivityThread extends ClientTransactionHandler
implements ActivityThreadInternal {
// 一個應用行程只有一個
final ApplicationThread mAppThread = new ApplicationThread();
public ApplicationThread getApplicationThread()
{
return mAppThread;
}
private class ApplicationThread extends IApplicationThread.Stub {
... 省略細節
}
}
```
> 
2. Activity 呼叫了 [**Instrumentation**](https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/app/Instrumentation.java)#`execStartActivity`，最後在啟動了 [**ActivityTaskManager**](https://cs.android.com/android/platform/superproject/+/master:frameworks/base/core/java/android/app/ActivityTaskManager.java)#`startActivity` 方法 (透過 Binder 通訊呼叫到 ATMS 的進程)，對 Binder 使用有興趣可以參考 [**AIDL 文章**](https://hackmd.io/6KE-mXHdQ_ekm5eQ5Iv90g?view)
```java=
// Instrumentation.java
public class Instrumentation {
public ActivityResult execStartActivity(
Context who,
IBinder contextThread, // IApplicationThread
IBinder token, Activity target,
Intent intent, int requestCode, Bundle options) {
IApplicationThread whoThread = (IApplicationThread) contextThread;
... 省略部分
try {
...省略部分
// 啟動了 ActivityTaskManager#startActivity 函數
// whoThread 就是 IApplicationThread
int result = ActivityTaskManager.getService().startActivity(whoThread,
who.getBasePackageName(), who.getAttributionTag(), intent,
intent.resolveTypeIfNeeded(who.getContentResolver()), token,
target != null ? target.mEmbeddedID : null, requestCode, 0, null, options);
// 檢查 AMS 檢查結果
checkStartActivityResult(result, intent);
} catch (RemoteException e) {
throw new RuntimeException("Failure from system", e);
}
return null;
}
}
```
:::success
* **checkStartActivityResult 函數：** 檢查 AMS 回傳 startActivity 的結果
```java=
// Instrumentation.java
public static void checkStartActivityResult(int res, Object intent) {
if (!ActivityManager.isStartResultFatalError(res)) {
return;
}
switch (res) {
// 在 Android Manifest 沒有註冊
case ActivityManager.START_INTENT_NOT_RESOLVED:
case ActivityManager.START_CLASS_NOT_FOUND:
if (intent instanceof Intent && ((Intent)intent).getComponent() != null)
throw new ActivityNotFoundException(
"Unable to find explicit activity class "
+ ((Intent)intent).getComponent().toShortString()
+ "; have you declared this activity in your AndroidManifest.xml?");
throw new ActivityNotFoundException(
"No Activity found to handle " + intent);
// 權限禁止
case ActivityManager.START_PERMISSION_DENIED:
throw new SecurityException("Not allowed to start activity "
+ intent);
// 請求衝突
case ActivityManager.START_FORWARD_AND_REQUEST_CONFLICT:
throw new AndroidRuntimeException(
"FORWARD_RESULT_FLAG used while also requesting a result");
... 省略部分
default:
throw new AndroidRuntimeException("Unknown error code "
+ res + " when starting " + intent);
}
}
```
:::
:::danger
* 提醒
AIDL 部分由 ^1^ 共同接口 [**IActivityTaskManager.aidl**](https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/app/IActivityTaskManager.aidl)、^2^ Proxy 代理 (AIDL 自動生成)、^3^ Stub 實作 [**ActivityTaskManagerService**](https://android.googlesource.com/platform/frameworks/base/+/master/services/core/java/com/android/server/wm/ActivityTaskManagerService.java)
:::
> 
3. ActivityTaskManager（Client）透過 Binder 機制最終就會到達 **系統進程** 的 [**ActivityTaskManagerService**](https://android.googlesource.com/platform/frameworks/base/+/master/services/core/java/com/android/server/wm/ActivityTaskManagerService.java) (AIDL 的 Server 端)
```java=
// ActivityTaskManagerService.java
// SystemService 啟動的系統進程
// IActivityTaskManager.Stub 是 Service 端的實作
public class ActivityTaskManagerService extends IActivityTaskManager.Stub { // IActivityTaskManager 是 IDE 自動生成類
@Override
public final int startActivity(IApplicationThread caller, String callingPackage,
String callingFeatureId, Intent intent, String resolvedType, IBinder resultTo,
String resultWho, int requestCode, int startFlags, ProfilerInfo profilerInfo,
Bundle bOptions) {
return startActivityAsUser(caller, callingPackage, callingFeatureId, intent, resolvedType,
resultTo, resultWho, requestCode, startFlags, profilerInfo, bOptions,
UserHandle.getCallingUserId());
}
}
```
> 
### ActivityTaskManagerService 創建時機
* **ActivityTaskManagerService 創建**
1. AMS 啟動後，[**AMS**](https://android.googlesource.com/platform/frameworks/base/+/refs/heads/master/services/core/java/com/android/server/am/ActivityManagerService.java) 的建構函數內會呼叫 ActivityStackSupervisor#initialize 方法
```java=
// ActivityManagerService.java
public ActivityTaskManagerService mActivityTaskManager;
public ActivityManagerService(Context systemContext, ActivityTaskManagerService atm) {
... 省略部分
mActivityTaskManager = atm;
// 追尋 initialize 方法
mActivityTaskManager.initialize(mIntentFirewall, mPendingIntentController,
DisplayThread.get().getLooper());
}
```
2. 查看 [**ActivityTaskManagerService**](https://cs.android.com/android/platform/superproject/+/master:frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java)#initialize 函數：可以看到 ActivityTaskSupervisor 的創建
```java=
// ActivityTaskManagerService.java
ActivityTaskSupervisor mTaskSupervisor;
public void initialize(IntentFirewall intentFirewall, PendingIntentController intentController,
Looper looper) {
... 省略部分
// @ 查看 createStackSupervisor 方法
mTaskSupervisor = createStackSupervisor();
... 省略部分
}
protected ActivityTaskSupervisor createTaskSupervisor() {
final ActivityTaskSupervisor supervisor = new ActivityTaskSupervisor(this,
mH.getLooper());
supervisor.initialize();
return supervisor;
}
```
> 
## Appendix & FAQ
:::info
:::
###### tags: `Android Framework` `Android 系統`
Sign in with Wallet
Connect another wallet