基于Android 6.0的源码剖析， 分析Android系统服务ActivityManagerService，简称AMS

frameworks/base/core/java/android/app/
  - ActivityThread.java
  - LoadedApk.java
  - ContextImpl.java

frameworks/base/services/java/com/android/server/
  - SystemServer.java

frameworks/base/services/core/java/com/android/server/
  - SystemServiceManager.java
  - ServiceThread.java
  - pm/Installer.java
  - am/ActivityManagerService.java

一、概述

Android系统启动-SystemServer篇(二)中有讲到AMS，本文以AMS为主线，讲述system_server进程中AMS服务的启动过程，以startBootstrapServices()方法为起点，紧跟着startCoreServices(), startOtherServices()共3个方法。

二. AMS启动过程

2.1 startBootstrapServices

[-> SystemServer.java]

private void startBootstrapServices() {
    ...
    //启动AMS服务【见小节2.2】
    mActivityManagerService = mSystemServiceManager.startService(
            ActivityManagerService.Lifecycle.class).getService();

    //设置AMS的系统服务管理器
    mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
    //设置AMS的APP安装器
    mActivityManagerService.setInstaller(installer);
    //初始化AMS相关的PMS
    mActivityManagerService.initPowerManagement();
    ...

    //设置SystemServer【见小节2.3】
    mActivityManagerService.setSystemProcess();
}

2.2 启动AMS服务

SystemServiceManager.startService(ActivityManagerService.Lifecycle.class) 功能主要：

1. 创建ActivityManagerService.Lifecycle对象；
2. 调用Lifecycle.onStart()方法。

2.1.1 AMS.Lifecycle

[-> ActivityManagerService.java]

public static final class Lifecycle extends SystemService {
    private final ActivityManagerService mService;

    public Lifecycle(Context context) {
        super(context);
        //创建ActivityManagerService【见小节2.1.2】
        mService = new ActivityManagerService(context);
    }

    @Override
    public void onStart() {
        mService.start();  //【见小节2.1.3】
    }

    public ActivityManagerService getService() {
        return mService;
    }
}

该过程：创建AMS内部类的Lifecycle，已经创建AMS对象，并调用AMS.start();

2.1.2 AMS创建

public ActivityManagerService(Context systemContext) {
    mContext = systemContext;
    mFactoryTest = FactoryTest.getMode();//默认为FACTORY_TEST_OFF
    mSystemThread = ActivityThread.currentActivityThread();

    //创建名为"ActivityManager"的前台线程，并获取mHandler
    mHandlerThread = new ServiceThread(TAG, android.os.Process.THREAD_PRIORITY_FOREGROUND, false);
    mHandlerThread.start();

    mHandler = new MainHandler(mHandlerThread.getLooper());

    //通过UiThread类，创建名为"android.ui"的线程
    mUiHandler = new UiHandler();

    //前台广播接收器，在运行超过10s将放弃执行
    mFgBroadcastQueue = new BroadcastQueue(this, mHandler,
            "foreground", BROADCAST_FG_TIMEOUT, false);
    //后台广播接收器，在运行超过60s将放弃执行
    mBgBroadcastQueue = new BroadcastQueue(this, mHandler,
            "background", BROADCAST_BG_TIMEOUT, true);
    mBroadcastQueues[0] = mFgBroadcastQueue;
    mBroadcastQueues[1] = mBgBroadcastQueue;

    //创建ActiveServices，其中非低内存手机mMaxStartingBackground为8
    mServices = new ActiveServices(this);
    mProviderMap = new ProviderMap(this);

    //创建目录/data/system
    File dataDir = Environment.getDataDirectory();
    File systemDir = new File(dataDir, "system");
    systemDir.mkdirs();

    //创建服务BatteryStatsService
    mBatteryStatsService = new BatteryStatsService(systemDir, mHandler);
    mBatteryStatsService.getActiveStatistics().readLocked();
    ...

    //创建进程统计服务，信息保存在目录/data/system/procstats，
    mProcessStats = new ProcessStatsService(this, new File(systemDir, "procstats"));

    mAppOpsService = new AppOpsService(new File(systemDir, "appops.xml"), mHandler);
    mGrantFile = new AtomicFile(new File(systemDir, "urigrants.xml"));

    // User 0是第一个，也是唯一的一个开机过程中运行的用户
    mStartedUsers.put(UserHandle.USER_OWNER, new UserState(UserHandle.OWNER, true));
    mUserLru.add(UserHandle.USER_OWNER);
    updateStartedUserArrayLocked();
    ...

    //CPU使用情况的追踪器执行初始化
    mProcessCpuTracker.init();
    ...
    mRecentTasks = new RecentTasks(this);
    // 创建ActivityStackSupervisor对象
    mStackSupervisor = new ActivityStackSupervisor(this, mRecentTasks);
    mTaskPersister = new TaskPersister(systemDir, mStackSupervisor, mRecentTasks);

    //创建名为"CpuTracker"的线程
    mProcessCpuThread = new Thread("CpuTracker") {
        public void run() {
          while (true) {
              synchronized(this) {
                final long now = SystemClock.uptimeMillis();
                long nextCpuDelay = (mLastCpuTime.get()+MONITOR_CPU_MAX_TIME)-now;
                long nextWriteDelay = (mLastWriteTime+BATTERY_STATS_TIME)-now;
                if (nextWriteDelay < nextCpuDelay) {
                    nextCpuDelay = nextWriteDelay;
                }
                if (nextCpuDelay > 0) {
                    mProcessCpuMutexFree.set(true);
                    this.wait(nextCpuDelay);
                }
              }
              updateCpuStatsNow(); //更新CPU状态
          }
        }
    };
    ...
}

该过程共创建了3个线程，分别为”ActivityManager”，”android.ui”，”CpuTracker”。

2.1.3 AMS.start

private void start() {
    Process.removeAllProcessGroups(); //移除所有的进程组
    mProcessCpuThread.start(); //启动CpuTracker线程

    mBatteryStatsService.publish(mContext); //启动电池统计服务
    mAppOpsService.publish(mContext);
    //创建LocalService，并添加到LocalServices
    LocalServices.addService(ActivityManagerInternal.class, new LocalService());
}

2.3 AMS.setSystemProcess

public void setSystemProcess() {
    try {
        ServiceManager.addService(Context.ACTIVITY_SERVICE, this, true);
        ServiceManager.addService(ProcessStats.SERVICE_NAME, mProcessStats);
        ServiceManager.addService("meminfo", new MemBinder(this));
        ServiceManager.addService("gfxinfo", new GraphicsBinder(this));
        ServiceManager.addService("dbinfo", new DbBinder(this));
        if (MONITOR_CPU_USAGE) {
            ServiceManager.addService("cpuinfo", new CpuBinder(this));
        }
        ServiceManager.addService("permission", new PermissionController(this));
        ServiceManager.addService("processinfo", new ProcessInfoService(this));
        ApplicationInfo info = mContext.getPackageManager().getApplicationInfo(
                "android", STOCK_PM_FLAGS);

        //【见小节2.3.1】
        mSystemThread.installSystemApplicationInfo(info, getClass().getClassLoader());
        synchronized (this) {
            //创建ProcessRecord对象
            ProcessRecord app = newProcessRecordLocked(info, info.processName, false, 0);
            app.persistent = true; //设置为persistent进程
            app.pid = MY_PID;
            app.maxAdj = ProcessList.SYSTEM_ADJ;
            app.makeActive(mSystemThread.getApplicationThread(), mProcessStats);
            synchronized (mPidsSelfLocked) {
                mPidsSelfLocked.put(app.pid, app);
            }
            updateLruProcessLocked(app, false, null);//维护进程lru
            updateOomAdjLocked(); //更新adj
        }
    } catch (PackageManager.NameNotFoundException e) {
        throw new RuntimeException("", e);
    }
}

该方法主要工作是注册各种服务。

2.3.1 AT.installSystemApplicationInfo

[-> ActivityThread.java]

public void installSystemApplicationInfo(ApplicationInfo info, ClassLoader classLoader) {
    synchronized (this) {
        getSystemContext().installSystemApplicationInfo(info, classLoader);
        mProfiler = new Profiler();    //创建用于性能统计的Profiler对象
    }
}

该方法调用ContextImpl的nstallSystemApplicationInfo()方法，最终调用LoadedApk的installSystemApplicationInfo，加载名为“android”的package

2.3.2 installSystemApplicationInfo

[-> LoadedApk.java]

void installSystemApplicationInfo(ApplicationInfo info, ClassLoader classLoader) {
    assert info.packageName.equals("android");
    mApplicationInfo = info; //将包名为"android"的应用信息保存到mApplicationInfo
    mClassLoader = classLoader;
}

2.4 startOtherServices

private void startOtherServices() {
  ...
  //安装系统Provider 【见小节2.4.1】
  mActivityManagerService.installSystemProviders();
  ...

  //phase480 && 500
  mSystemServiceManager.startBootPhase(SystemService.PHASE_LOCK_SETTINGS_READY);
  mSystemServiceManager.startBootPhase(SystemService.PHASE_SYSTEM_SERVICES_READY);
  ...

  //【见小节3.1】
  mActivityManagerService.systemReady(new Runnable() {
     public void run() {
         //phase550
         mSystemServiceManager.startBootPhase(
                 SystemService.PHASE_ACTIVITY_MANAGER_READY);
         ...
         //phase600
         mSystemServiceManager.startBootPhase(
                 SystemService.PHASE_THIRD_PARTY_APPS_CAN_START);
         ...
      }
  }
}

2.4.1 AMS.installSystemProviders

public final void installSystemProviders() {
    List<ProviderInfo> providers;
    synchronized (this) {
        ProcessRecord app = mProcessNames.get("system", Process.SYSTEM_UID);
        providers = generateApplicationProvidersLocked(app);
        if (providers != null) {
            for (int i=providers.size()-1; i>=0; i--) {
                ProviderInfo pi = (ProviderInfo)providers.get(i);
                //移除非系统的provider
                if ((pi.applicationInfo.flags&ApplicationInfo.FLAG_SYSTEM) == 0) {
                    providers.remove(i);
                }
            }
        }
    }
    if (providers != null) {
        //安装所有的系统provider
        mSystemThread.installSystemProviders(providers);
    }

    // 创建核心Settings Observer，用于监控Settings的改变。
    mCoreSettingsObserver = new CoreSettingsObserver(this);
}

三. AMS.systemReady

AMS.systemReady()方法的参数为Runable类型的goingCallback， 该方法执行简单划分以下几部分：

public void systemReady(final Runnable goingCallback) {
    before goingCallback; // 见小节[3.1]
    goingCallback.run(); // 见小节[3.2]
    after goingCallback; // 见小节[3.3]
}

3.1 before goingCallback

synchronized(this) {
    if (mSystemReady) { //首次为flase，则不进入该分支
        if (goingCallback != null) {
                goingCallback.run();
            }
        return;
    }

    mRecentTasks.clear();
    //恢复最近任务栏的task
    mRecentTasks.addAll(mTaskPersister.restoreTasksLocked());
    mRecentTasks.cleanupLocked(UserHandle.USER_ALL);
    mTaskPersister.startPersisting();

    if (!mDidUpdate) {
        if (mWaitingUpdate) {
            return;
        }
        final ArrayList<ComponentName> doneReceivers = new ArrayList<ComponentName>();
        //处于升级过程【见小节3.1.1】
        mWaitingUpdate = deliverPreBootCompleted(new Runnable() {
            public void run() {
                synchronized (ActivityManagerService.this) {
                    mDidUpdate = true;
                }
                showBootMessage(mContext.getText(
                        R.string.android_upgrading_complete),
                        false);
                writeLastDonePreBootReceivers(doneReceivers);
                systemReady(goingCallback);
            }
        }, doneReceivers, UserHandle.USER_OWNER);

        if (mWaitingUpdate) {
            return;
        }
        mDidUpdate = true;
    }

    mAppOpsService.systemReady();
    mSystemReady = true;
}

ArrayList<ProcessRecord> procsToKill = null;
synchronized(mPidsSelfLocked) {
    for (int i=mPidsSelfLocked.size()-1; i>=0; i--) {
        ProcessRecord proc = mPidsSelfLocked.valueAt(i);
        //非persistent进程,加入procsToKill
        if (!isAllowedWhileBooting(proc.info)){
            if (procsToKill == null) {
                procsToKill = new ArrayList<ProcessRecord>();
            }
            procsToKill.add(proc);
        }
    }
}

synchronized(this) {
    if (procsToKill != null) {
        //杀掉procsToKill中的进程, 杀掉进程且不允许重启
        for (int i=procsToKill.size()-1; i>=0; i--) {
            ProcessRecord proc = procsToKill.get(i);
            removeProcessLocked(proc, true, false, "system update done");
        }
    }
    mProcessesReady = true; //process处于ready状态
}
Slog.i(TAG, "System now ready");
EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_AMS_READY,
     SystemClock.uptimeMillis());

该阶段的主要功能：

• 向PRE_BOOT_COMPLETED的接收者发送广播；
• 杀掉procsToKill中的进程, 杀掉进程且不允许重启；
• 此时，系统和进程都处于ready状态；

3.1.1 deliverPreBootCompleted

private boolean deliverPreBootCompleted(final Runnable onFinishCallback,
        ArrayList<ComponentName> doneReceivers, int userId) {
    Intent intent = new Intent(Intent.ACTION_PRE_BOOT_COMPLETED);
    List<ResolveInfo> ris = AppGlobals.getPackageManager().queryIntentReceivers(
                intent, null, 0, userId);

    //对于FLAG_SYSTEM=false的app直接过滤掉
    for (int i=ris.size()-1; i>=0; i--) {
        if ((ris.get(i).activityInfo.applicationInfo.flags
                &ApplicationInfo.FLAG_SYSTEM) == 0) {
            ris.remove(i);
        }
    }
    intent.addFlags(Intent.FLAG_RECEIVER_BOOT_UPGRADE);

    if (userId == UserHandle.USER_OWNER) {
        ArrayList<ComponentName> lastDoneReceivers = readLastDonePreBootReceivers();
        for (int i=0; i<ris.size(); i++) {
            ActivityInfo ai = ris.get(i).activityInfo;
            ComponentName comp = new ComponentName(ai.packageName, ai.name);
            if (lastDoneReceivers.contains(comp)) {
                ris.remove(i);
                i--;
                doneReceivers.add(comp);
            }
        }
    }
    ...

    PreBootContinuation cont = new PreBootContinuation(intent, onFinishCallback,
            doneReceivers, ris, users);  //【见小节3.1.2】
    cont.go(); //【见小节3.1.3】
    return true;
}

3.1.2 PreBootContinuation

[-> ActivityManagerService.java ::PreBootContinuation]

final class PreBootContinuation extends IIntentReceiver.Stub {

    PreBootContinuation(Intent _intent, Runnable _onFinishCallback,
            ArrayList<ComponentName> _doneReceivers, List<ResolveInfo> _ris, int[] _users) {
        intent = _intent;
        onFinishCallback = _onFinishCallback;
        doneReceivers = _doneReceivers;
        ris = _ris;
        users = _users;
    }
}

3.1.3 PreBootContinuation.go

void go() {
    if (lastRi != curRi) {
        ActivityInfo ai = ris.get(curRi).activityInfo;
        ComponentName comp = new ComponentName(ai.packageName, ai.name);
        intent.setComponent(comp);
        doneReceivers.add(comp);
        lastRi = curRi;
        CharSequence label = ai.loadLabel(mContext.getPackageManager());
        showBootMessage(mContext.getString(R.string.android_preparing_apk, label), false);
    }

    //发送广播
    broadcastIntentLocked(null, null, intent, null, this,
            0, null, null, null, AppOpsManager.OP_NONE,
            null, true, false, MY_PID, Process.SYSTEM_UID, users[curUser]);
}

3.2 goingCallback.run()

此处的goingCallback,便是在startOtherServices()过程中传递进来的参数

private void startOtherServices() {
  ...
  mActivityManagerService.systemReady(new Runnable() {
    public void run() {
      //phase550
      mSystemServiceManager.startBootPhase(
              SystemService.PHASE_ACTIVITY_MANAGER_READY);

      mActivityManagerService.startObservingNativeCrashes();
      //启动WebView
      WebViewFactory.prepareWebViewInSystemServer();
      //启动系统UI【见小节3.2.1】
      startSystemUi(context);

      // 执行一系列服务的systemReady方法
      networkScoreF.systemReady();
      networkManagementF.systemReady();
      networkStatsF.systemReady();
      networkPolicyF.systemReady();
      connectivityF.systemReady();
      audioServiceF.systemReady();
      Watchdog.getInstance().start(); //Watchdog开始工作

      //phase600
      mSystemServiceManager.startBootPhase(
              SystemService.PHASE_THIRD_PARTY_APPS_CAN_START);

      //执行一系列服务的systemRunning方法
      wallpaper.systemRunning();
      inputMethodManager.systemRunning(statusBarF);
      location.systemRunning();
      countryDetector.systemRunning();
      networkTimeUpdater.systemRunning();
      commonTimeMgmtService.systemRunning();
      textServiceManagerService.systemRunning();
      assetAtlasService.systemRunning();
      inputManager.systemRunning();
      telephonyRegistry.systemRunning();
      mediaRouter.systemRunning();
      mmsService.systemRunning();
    }
  });
}

该过程启动各种进程：

• 启动阶段550，回调相应onBootPhase()方法；
• 启动WebView，并且会创建进程，这是zygote正式创建的第一个进程；
• 启动systemui服务；
• …

3.2.1 startSystemUi

static final void startSystemUi(Context context) {
    Intent intent = new Intent();
    intent.setComponent(new ComponentName("com.android.systemui",
                "com.android.systemui.SystemUIService"));
    context.startServiceAsUser(intent, UserHandle.OWNER);
}

启动服务”com.android.systemui/.SystemUIService”

3.3 after goingCallback

//启动【见小节3.3.1】
mSystemServiceManager.startUser(mCurrentUserId);
synchronized (this) {
    if (mFactoryTest != FactoryTest.FACTORY_TEST_LOW_LEVEL) {
        //通过pms获取所有的persistent进程
        List apps = AppGlobals.getPackageManager().
            getPersistentApplications(STOCK_PM_FLAGS);
        if (apps != null) {
            int N = apps.size();
            int i;
            for (i=0; i<N; i++) {
                ApplicationInfo info = (ApplicationInfo)apps.get(i);
                if (info != null && !info.packageName.equals("android")) {
                    //启动persistent进程
                    addAppLocked(info, false, null);
                }
            }
        }
    }

    mBooting = true;
    // 启动桌面Activity 【见小节3.3.2】
    startHomeActivityLocked(mCurrentUserId, "systemReady");

    ...
    long ident = Binder.clearCallingIdentity();
    try {
        //system发送广播USER_STARTED
        Intent intent = new Intent(Intent.ACTION_USER_STARTED);
        intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY
                | Intent.FLAG_RECEIVER_FOREGROUND);
        intent.putExtra(Intent.EXTRA_USER_HANDLE, mCurrentUserId);
        broadcastIntentLocked(...);  

        //system发送广播USER_STARTING
        intent = new Intent(Intent.ACTION_USER_STARTING);
        intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY);
        intent.putExtra(Intent.EXTRA_USER_HANDLE, mCurrentUserId);
        broadcastIntentLocked(...);
    } finally {
        Binder.restoreCallingIdentity(ident);
    }

    mStackSupervisor.resumeTopActivitiesLocked();
    sendUserSwitchBroadcastsLocked(-1, mCurrentUserId);
}

该阶段主要功能：

• 回调所有SystemService的onStartUser()方法；
• 启动persistent进程；
• 启动home Activity;
• 发送广播USER_STARTED和USER_STARTING；
• 恢复栈顶Activity;
• 发送广播USER_SWITCHED；

3.3.1 SSM.startUser

[-> SystemServiceManager.java]

public void startUser(final int userHandle) {
    final int serviceLen = mServices.size();
    for (int i = 0; i < serviceLen; i++) {
        final SystemService service = mServices.get(i);
        try {
            //回调所有SystemService的onStartUser()方法
            service.onStartUser(userHandle);
        } catch (Exception ex) {
            ...
        }
    }
}

3.3.2 AMS.startHomeActivityLocked

boolean startHomeActivityLocked(int userId, String reason) {
    //home intent有CATEGORY_HOME
    Intent intent = getHomeIntent();
    ActivityInfo aInfo = resolveActivityInfo(intent, STOCK_PM_FLAGS, userId);
    if (aInfo != null) {
        intent.setComponent(new ComponentName(
                aInfo.applicationInfo.packageName, aInfo.name));
        aInfo = new ActivityInfo(aInfo);
        aInfo.applicationInfo = getAppInfoForUser(aInfo.applicationInfo, userId);
        ProcessRecord app = getProcessRecordLocked(aInfo.processName,
                aInfo.applicationInfo.uid, true);
        if (app == null || app.instrumentationClass == null) {
            intent.setFlags(intent.getFlags() | Intent.FLAG_ACTIVITY_NEW_TASK);
            //启动桌面Activity
            mStackSupervisor.startHomeActivity(intent, aInfo, reason);
        }
    }
    return true;
}

四. 总结

1. 创建AMS实例对象，创建Andoid Runtime，ActivityThread和Context对象；
2. setSystemProcess：注册AMS、meminfo、cpuinfo等服务到ServiceManager；
3. installSystemProviderss，加载SettingsProvider；
4. 启动SystemUIService，再调用一系列服务的systemReady()方法；

4.1 发布Binder服务

[小节2.3]的AMS.setSystemProcess()过程向servicemanager注册了如下这个binder服务

想要查看这些服务的信息，可通过dumpsys <服务名>命令。比如查看CPU信息命令dumpsys cpuinfo。

4.2 AMS.systemReady

另外，AMS.systemReady()的大致过程如下:

public final class ActivityManagerService{

    public void systemReady(final Runnable goingCallback) {
        ...//更新操作
        mSystemReady = true; //系统处于ready状态
        removeProcessLocked(proc, true, false, "system update done");//杀掉所有非persistent进程
        mProcessesReady = true;  //进程处于ready状态

        goingCallback.run(); //这里有可能启动进程

        addAppLocked(info, false, null); //启动所有的persistent进程
        mBooting = true;  //正在启动中
        startHomeActivityLocked(mCurrentUserId, "systemReady"); //启动桌面
        mStackSupervisor.resumeTopActivitiesLocked(); //恢复栈顶的Activity
    }
}

再说一说mProcessesReady：

startProcessLocked()过程对于非persistent进程必须等待mProcessesReady = true才会真正创建进程，否则进程放入mProcessesOnHold队列。 当然以下情况不会判断mProcessesReady：

• addAppLocked()启动persistent进程; //但此时已经mProcessesReady；
• finishBooting()启动on-hold进程; //但此时已经mProcessesReady；
• cleanUpApplicationRecordLock() //启动需要restart进程，前提是进程已创建；
• attachApplicationLocked() //绑定Bind死亡通告失败，前台同样是进程要已创建。

还有一个特殊情况，可以创建进程：processNextBroadcast()过程对于flag为FLAG_RECEIVER_BOOT_UPGRADE的广播拉进程 ，只在小节3.1.1的升级过程会出现。

由此可见，mProcessesReady在没有ready前，则基本没有应用进程。