理解Android进程启动之全过程
yatd1288
7年前
<h2><strong>一. 概述</strong></h2> <p>Android系统将进程做得很友好的封装,对于上层app开发者来说进程几乎是透明的. 了解Android的朋友,一定知道Android四大组件,但对于进程可能会相对较陌生. 一个进程里面可以跑多个app(通过share uid的方式), 一个app也可以跑在多个进程里(通过配置Android:process属性).</p> <p>再进一步进程是如何创建的, 可能很多人不知道fork的存在. 在我的文章 <a href="/misc/goto?guid=4959720056802377481" rel="nofollow,noindex">理解Android进程创建流程</a> 集中一点详细介绍了 Process.start 的过程是如何一步步创建进程.本文则是从另个角度来全局性讲解android进程启动全过程所涉及的根脉, 先来看看AMS.startProcessLocked方法.</p> <h2><strong>二. 四大组件与进程</strong></h2> <h3><strong>2.1 startProcessLocked</strong></h3> <p>在 ActivityManagerService.java 关于启动进程有4个同名不同参数的重载方法, 为了便于说明,以下4个方法依次记为 1(a) , 1(b) , 2(a) , 2(b) :</p> <pre> <code class="language-java">//方法 1(a) final ProcessRecord startProcessLocked( String processName, ApplicationInfo info, boolean knownToBeDead, int intentFlags, String hostingType, ComponentName hostingName, boolean allowWhileBooting, boolean isolated, boolean keepIfLarge) //方法 1(b) final ProcessRecord startProcessLocked( String processName, ApplicationInfo info, boolean knownToBeDead, int intentFlags, String hostingType, ComponentName hostingName, boolean allowWhileBooting, boolean isolated, int isolatedUid, boolean keepIfLarge, String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) //方法 2(a) private final void startProcessLocked( ProcessRecord app, String hostingType, String hostingNameStr) //方法 2(b) private final void startProcessLocked( ProcessRecord app, String hostingType, String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs)</code></pre> <p>1(a) ==> 1(b):方法1(a)将isolatedUid=0,其他参数赋值为null,再调用给1(b)</p> <pre> <code class="language-java">final ProcessRecord startProcessLocked(String processName, ApplicationInfo info, boolean knownToBeDead, int intentFlags, String hostingType, ComponentName hostingName, boolean allowWhileBooting, boolean isolated, boolean keepIfLarge) { return startProcessLocked(processName, info, knownToBeDead, intentFlags, hostingType, hostingName, allowWhileBooting, isolated, 0 /* isolatedUid */, keepIfLarge, null /* ABI override */, null /* entryPoint */, null /* entryPointArgs */, null /* crashHandler */); }</code></pre> <p>2(a) ==> 2(b):方法2(a)将其他3个参数abiOverride,entryPoint, entryPointArgs赋值为null,再调用给2(b)</p> <pre> <code class="language-java">private final void startProcessLocked(ProcessRecord app, String hostingType, String hostingNameStr) { startProcessLocked(app, hostingType, hostingNameStr, null /* abiOverride */, null /* entryPoint */, null /* entryPointArgs */); }</code></pre> <p>小结:</p> <ul> <li>1(a),1(b)的第一个参数为String类型的进程名processName,</li> <li>2(a), 2(b)的第一个参数为ProcessRecord类型进程记录信息ProcessRecord;</li> <li>1系列的方法最终调用到2系列的方法;</li> </ul> <h3><strong>2.2 四大组件与进程</strong></h3> <p>Activity, Service, ContentProvider, BroadcastReceiver这四大组件,在启动的过程,当其所承载的进程不存在时需要先创建进程. 这个创建进程的过程是调用前面讲到的startProcessLocked方法1(a) . 调用流程: 1(a) => 1(b) ==> 2(b). 下面再简单说说这4大组件与进程创建是在何时需要创建的.</p> <p>2.2.1 Activity</p> <p>启动Activity过程: 调用startActivity,该方法经过层层调用,最终会调用ActivityStackSupervisor.java中的 startSpecificActivityLocked ,当activity所属进程还没启动的情况下,则需要创建相应的进程.</p> <p>[-> ActivityStackSupervisor.java]</p> <pre> <code class="language-java">void startSpecificActivityLocked(...) { ProcessRecord app = mService.getProcessRecordLocked(r.processName, r.info.applicationInfo.uid, true); if (app != null && app.thread != null) { ... //进程已创建的case return } mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0, "activity", r.intent.getComponent(), false, false, true); }</code></pre> <p>2.2.2 Service</p> <p>启动服务过程: 调用startService,该方法经过层层调用,最终会调用ActiveServices.java中的 bringUpServiceLocked ,当Service进程没有启动的情况(app==null), 则需要创建相应的进程. 更多关于Service, 见startService流程分析</p> <p>[-> ActiveServices.java]</p> <pre> <code class="language-java">private final String bringUpServiceLocked(...){ ... ProcessRecord app = mAm.getProcessRecordLocked(procName, r.appInfo.uid, false); if (app == null) { if ((app=mAm.startProcessLocked(procName, r.appInfo, true, intentFlags, "service", r.name, false, isolated, false)) == null) { ... } } ... }</code></pre> <p>2.2.3 ContentProvider</p> <p>ContentProvider处理过程: 调用ContentResolver.query该方法经过层层调用, 最终会调用到AMS.java中的 getContentProviderImpl ,当ContentProvider所对应进程不存在,则需要创建新进程. 更多关于ContentProvider,见 <a href="/misc/goto?guid=4959713441761390939" rel="nofollow,noindex">理解ContentProvider原理(一)</a></p> <p>[-> AMS.java]</p> <pre> <code class="language-java">private final ContentProviderHolder getContentProviderImpl(...) { ... ProcessRecord proc = getProcessRecordLocked(cpi.processName, cpr.appInfo.uid, false); if (proc != null && proc.thread != null) { ... //进程已创建的case } else { proc = startProcessLocked(cpi.processName, cpr.appInfo, false, 0, "content provider", new ComponentName(cpi.applicationInfo.packageName,cpi.name), false, false, false); } ... }</code></pre> <p>2.2.4 Broadcast</p> <p>广播处理过程: 调用sendBroadcast,该方法经过层层调用, 最终会调用到BroadcastQueue.java中的 processNextBroadcast ,当BroadcastReceiver所对应的进程尚未启动，则创建相应进程. 更多关于broadcast, 见 <a href="/misc/goto?guid=4959720056933178880" rel="nofollow,noindex">Android Broadcast广播机制分析</a> .</p> <p>[-> BroadcastQueue.java]</p> <pre> <code class="language-java">final void processNextBroadcast(boolean fromMsg) { ... ProcessRecord app = mService.getProcessRecordLocked(targetProcess, info.activityInfo.applicationInfo.uid, false); if (app != null && app.thread != null) { ... //进程已创建的case return } if ((r.curApp=mService.startProcessLocked(targetProcess, info.activityInfo.applicationInfo, true, r.intent.getFlags() | Intent.FLAG_FROM_BACKGROUND, "broadcast", r.curComponent, (r.intent.getFlags()&Intent.FLAG_RECEIVER_BOOT_UPGRADE) != 0, false, false)) == null) { ... } ... }</code></pre> <h3><strong>2.3 小节</strong></h3> <p>Activity, Service, ContentProvider, BroadcastReceiver这四大组件在启动时,当所承载的进程不存在时,都需要创建. 进程的创建过程交由系统进程system_server来完成的.</p> <p style="text-align:center"><img src="https://simg.open-open.com/show/1204e621a2a766e3cea67eba41f65865.jpg"></p> <p>简称:</p> <ul> <li>ATP: ApplicationThreadProxy</li> <li>AT: ApplicationThread (继承于ApplicationThreadNative)</li> <li>AMP: ActivityManagerProxy</li> <li>AMS: ActivityManagerService (继承于ActivityManagerNative)</li> </ul> <ol> <li>system_server进程中调用 startProcessLocked 方法,该方法最终通过socket方式,将需要创建新进程的消息告知Zygote进程,并阻塞等待Socket返回新创建进程的pid;</li> <li>Zygote进程接收到system_server发送过来的消息, 则通过fork的方法，将zygote自身进程复制生成新的进程，并将ActivityThread相关的资源加载到新进程app process,这个进程可能是用于承载activity等组件;</li> <li>创建完新进程后fork返回两次, 在新进程app process向servicemanager查询system_server进程中binder服务端AMS,获取相对应的Client端,也就是AMP. 有了这一对binder c/s对, 那么app process便可以通过binder向跨进程system_server发送请求,即attachApplication()</li> <li>system_server进程接收到相应binder操作后,经过多次调用,利用ATP向app process发送binder请求, 即bindApplication.</li> </ol> <p>system_server拥有ATP/AMS, 每一个新创建的进程都会有一个相应的AT/AMS,从而可以跨进程 进行相互通信. 这便是进程创建过程的完整生态链.</p> <h2><strong>三. 进程启动全过程</strong></h2> <p>前面刚已介绍四大组件的创建进程的过程是调用1(a) startProcessLocked 方法,该方法会再调用1(b)方法. 接下来从该方法开始往下讲述.</p> <h3><strong>3.1 AMS.startProcessLocked</strong></h3> <pre> <code class="language-java">final ProcessRecord startProcessLocked(String processName, ApplicationInfo info, boolean knownToBeDead, int intentFlags, String hostingType, ComponentName hostingName, boolean allowWhileBooting, boolean isolated, int isolatedUid, boolean keepIfLarge, String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) { long startTime = SystemClock.elapsedRealtime(); ProcessRecord app; if (!isolated) { //根据进程名和uid检查相应的ProcessRecord app = getProcessRecordLocked(processName, info.uid, keepIfLarge); if ((intentFlags & Intent.FLAG_FROM_BACKGROUND) != 0) { //如果当前处于后台进程，检查当前进程是否处于bad进程列表 if (mBadProcesses.get(info.processName, info.uid) != null) { return null; } } else { //当用户明确地启动进程，则清空crash次数，以保证其不处于bad进程直到下次再弹出crash对话框。 mProcessCrashTimes.remove(info.processName, info.uid); if (mBadProcesses.get(info.processName, info.uid) != null) { mBadProcesses.remove(info.processName, info.uid); if (app != null) { app.bad = false; } } } } else { //对于孤立进程，无法再利用已存在的进程 app = null; } //当存在ProcessRecord,且已分配pid(正在启动或者已经启动), // 且caller并不认为该进程已死亡或者没有thread对象attached到该进程.则不应该清理该进程 if (app != null && app.pid > 0) { if (!knownToBeDead || app.thread == null) { //如果这是进程中新package，则添加到列表 app.addPackage(info.packageName, info.versionCode, mProcessStats); return app; } //当ProcessRecord已经被attached到先前的一个进程，则杀死并清理该进程 killProcessGroup(app.info.uid, app.pid); handleAppDiedLocked(app, true, true); } String hostingNameStr = hostingName != null? hostingName.flattenToShortString() : null; if (app == null) { // 创建新的Process Record对象 app = newProcessRecordLocked(info, processName, isolated, isolatedUid); if (app == null) { return null; } app.crashHandler = crashHandler; } else { //如果这是进程中新package，则添加到列表 app.addPackage(info.packageName, info.versionCode, mProcessStats); } //当系统未准备完毕，则将当前进程加入到mProcessesOnHold if (!mProcessesReady && !isAllowedWhileBooting(info) && !allowWhileBooting) { if (!mProcessesOnHold.contains(app)) { mProcessesOnHold.add(app); } return app; } // 启动进程【见小节3.2】 startProcessLocked(app, hostingType, hostingNameStr, abiOverride, entryPoint, entryPointArgs); return (app.pid != 0) ? app : null; }</code></pre> <p>主要功能:</p> <ul> <li>对于非isolated进程,则根据进程名和uid来查询相应的ProcessRecord结构体. 如果当前进程处于后台且当前进程处于mBadProcesses列表,则直接返回;否则清空crash次数，以保证其不处于bad进程直到下次再弹出crash对话框。</li> <li>当存在ProcessRecord,且已分配pid(正在启动或者已经启动)的情况下 <ul> <li>当caller并不认为该进程已死亡或者没有thread对象attached到该进程.则不应该清理该进程,则直接返回;</li> <li>否则杀死并清理该进程;</li> </ul> </li> <li>当ProcessRecord为空则新建一个,当创建失败则直接返回;</li> <li>当系统未准备完毕，则将当前进程加入到mProcessesOnHold, 并直接返回;</li> <li>最后启动新进程,其中参数含义: <ul> <li>hostingType可取值为”activity”,”service”,”broadcast”,”content provider”;</li> <li>hostingNameStr数据类型为ComponentName,代表的是具体相对应的组件名.</li> </ul> </li> </ul> <h3><strong>3.2 AMS.startProcessLocked</strong></h3> <pre> <code class="language-java">private final void startProcessLocked(ProcessRecord app, String hostingType, String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs) { long startTime = SystemClock.elapsedRealtime(); //当app的pid大于0且不是当前进程的pid，则从mPidsSelfLocked中移除该app.pid if (app.pid > 0 && app.pid != MY_PID) { synchronized (mPidsSelfLocked) { mPidsSelfLocked.remove(app.pid); mHandler.removeMessages(PROC_START_TIMEOUT_MSG, app); } app.setPid(0); } //从mProcessesOnHold移除该app mProcessesOnHold.remove(app); updateCpuStats(); //更新cpu统计信息 try { try { if (AppGlobals.getPackageManager().isPackageFrozen(app.info.packageName)) { //当前package已被冻结,则抛出异常 throw new RuntimeException("Package " + app.info.packageName + " is frozen!"); } } catch (RemoteException e) { throw e.rethrowAsRuntimeException(); } int uid = app.uid; int[] gids = null; int mountExternal = Zygote.MOUNT_EXTERNAL_NONE; if (!app.isolated) { int[] permGids = null; try { //通过Package Manager获取gids final IPackageManager pm = AppGlobals.getPackageManager(); permGids = pm.getPackageGids(app.info.packageName, app.userId); MountServiceInternal mountServiceInternal = LocalServices.getService( MountServiceInternal.class); mountExternal = mountServiceInternal.getExternalStorageMountMode(uid, app.info.packageName); } catch (RemoteException e) { throw e.rethrowAsRuntimeException(); } //添加共享app和gids，用于app直接共享资源 if (ArrayUtils.isEmpty(permGids)) { gids = new int[2]; } else { gids = new int[permGids.length + 2]; System.arraycopy(permGids, 0, gids, 2, permGids.length); } gids[0] = UserHandle.getSharedAppGid(UserHandle.getAppId(uid)); gids[1] = UserHandle.getUserGid(UserHandle.getUserId(uid)); } //根据不同参数,设置相应的debugFlags ... app.gids = gids; app.requiredAbi = requiredAbi; app.instructionSet = instructionSet; boolean isActivityProcess = (entryPoint == null); if (entryPoint == null) entryPoint = "android.app.ActivityThread"; //请求Zygote创建新进程[见3.3] Process.ProcessStartResult startResult = Process.start(entryPoint, app.processName, uid, uid, gids, debugFlags, mountExternal, app.info.targetSdkVersion, app.info.seinfo, requiredAbi, instructionSet, app.info.dataDir, entryPointArgs); ... if (app.persistent) { Watchdog.getInstance().processStarted(app.processName, startResult.pid); } //重置ProcessRecord的成员变量 app.setPid(startResult.pid); app.usingWrapper = startResult.usingWrapper; app.removed = false; app.killed = false; app.killedByAm = false; //将新创建的进程加入到mPidsSelfLocked synchronized (mPidsSelfLocked) { this.mPidsSelfLocked.put(startResult.pid, app); if (isActivityProcess) { Message msg = mHandler.obtainMessage(PROC_START_TIMEOUT_MSG); msg.obj = app; //延迟发送消息PROC_START_TIMEOUT_MSG mHandler.sendMessageDelayed(msg, startResult.usingWrapper ? PROC_START_TIMEOUT_WITH_WRAPPER : PROC_START_TIMEOUT); } } } catch (RuntimeException e) { app.setPid(0); //进程创建失败,则重置pid } }</code></pre> <ul> <li>根据不同参数,设置相应的debugFlags,比如在AndroidManifest.xml中设置androidd:debuggable为true，代表app运行在debug模式,则增加debugger标识以及开启JNI check功能</li> <li>调用Process.start来创建新进程;</li> <li>重置ProcessRecord的成员变量, 一般情况下超时10s后发送PROC_START_TIMEOUT_MSG的handler消息;</li> </ul> <p>关于Process.start()是通过socket通信告知Zygote创建fork子进程，创建新进程后将ActivityThread类加载到新进程，并调用ActivityThread.main()方法。详细过程见 <a href="/misc/goto?guid=4959720056802377481" rel="nofollow,noindex">理解Android进程创建流程</a> ,接下来进入AT.main方法.</p> <h3><strong>3.3 ActivityThread.main</strong></h3> <p>[-> ActivityThread.java]</p> <pre> <code class="language-java">public static void main(String[] args) { //性能统计默认是关闭的 SamplingProfilerIntegration.start(); //将当前进程所在userId赋值给sCurrentUser Environment.initForCurrentUser(); EventLogger.setReporter(new EventLoggingReporter()); AndroidKeyStoreProvider.install(); //确保可信任的CA证书存放在正确的位置 final File configDir = Environment.getUserConfigDirectory(UserHandle.myUserId()); TrustedCertificateStore.setDefaultUserDirectory(configDir); Process.setArgV0("<pre-initialized>"); //创建主线程的Looper对象, 该Looper是不运行退出 Looper.prepareMainLooper(); //创建ActivityThread对象 ActivityThread thread = new ActivityThread(); //建立Binder通道 【见流程3.4】 thread.attach(false); if (sMainThreadHandler == null) { sMainThreadHandler = thread.getHandler(); } // 当设置为true时，可打开消息队列的debug log信息 if (false) { Looper.myLooper().setMessageLogging(new LogPrinter(Log.DEBUG, "ActivityThread")); } Looper.loop(); //消息循环运行 throw new RuntimeException("Main thread loop unexpectedly exited"); }</code></pre> <ul> <li> <p>创建主线程的Looper对象: 该Looper是不运行退出. 也就是说主线程的Looper是在进程创建完成时自动创建完成,如果子线程也需要创建handler通信过程,那么就需要手动创建Looper对象,并且每个线程只能创建一次.</p> </li> <li> <p>创建ActivityThread对象 thread = new ActivityThread() : 该过程会初始化几个很重要的变量:</p> <ul> <li> <p>mAppThread = new ApplicationThread()</p> </li> <li> <p>mLooper = Looper.myLooper()</p> </li> <li> <p>mH = new H(), H 继承于 Handler ;用于处理组件的生命周期.</p> </li> </ul> </li> <li> <p>attach过程是当前主线程向system_server进程通信的过程, 将thread信息告知AMS.接下来还会进一步说明该过程.</p> </li> <li> <p>sMainThreadHandler通过getHandler(),获取的对象便是 mH ,这就是主线程的handler对象.</p> </li> </ul> <p>之后主线程调用Looper.loop(),进入消息循环状态, 当没有消息时主线程进入休眠状态, 一旦有消息到来则唤醒主线程并执行相关操作.</p> <h3><strong>3.4. ActivityThread.attach</strong></h3> <p>[-> ActivityThread.java]</p> <pre> <code class="language-java">private void attach(boolean system) { sCurrentActivityThread = this; mSystemThread = system; if (!system) { //开启虚拟机的jit即时编译功能 ViewRootImpl.addFirstDrawHandler(new Runnable() { @Override public void run() { ensureJitEnabled(); } }); android.ddm.DdmHandleAppName.setAppName("<pre-initialized>", UserHandle.myUserId()); RuntimeInit.setApplicationObject(mAppThread.asBinder()); //创建ActivityManagerProxy对象 final IActivityManager mgr = ActivityManagerNative.getDefault(); try { //调用基于IActivityManager接口的Binder通道【见流程3.5】 mgr.attachApplication(mAppThread); } catch (RemoteException ex) { } //观察是否快接近heap的上限 BinderInternal.addGcWatcher(new Runnable() { @Override public void run() { if (!mSomeActivitiesChanged) { return; } Runtime runtime = Runtime.getRuntime(); long dalvikMax = runtime.maxMemory(); long dalvikUsed = runtime.totalMemory() - runtime.freeMemory(); if (dalvikUsed > ((3*dalvikMax)/4)) { mSomeActivitiesChanged = false; try { //当已用内存超过最大内存的3/4,则请求释放内存空间 mgr.releaseSomeActivities(mAppThread); } catch (RemoteException e) { } } } }); } else { ... } //添加dropbox日志到libcore DropBox.setReporter(new DropBoxReporter()); //添加Config回调接口 ViewRootImpl.addConfigCallback(new ComponentCallbacks2() { @Override public void onConfigurationChanged(Configuration newConfig) { synchronized (mResourcesManager) { if (mResourcesManager.applyConfigurationToResourcesLocked(newConfig, null)) { if (mPendingConfiguration == null || mPendingConfiguration.isOtherSeqNewer(newConfig)) { mPendingConfiguration = newConfig; sendMessage(H.CONFIGURATION_CHANGED, newConfig); } } } } @Override public void onLowMemory() { } @Override public void onTrimMemory(int level) { } }); }</code></pre> <p>对于非系统attach的处理流程:</p> <ul> <li> <p>创建线程来开启虚拟机的jit即时编译;</p> </li> <li> <p>通过binder, 调用到AMS.attachApplication, 其参数mAppThread的数据类型为 ApplicationThread</p> </li> <li> <p>观察是否快接近heap的上限,当已用内存超过最大内存的3/4,则请求释放内存空间</p> </li> <li> <p>添加dropbox日志到libcore</p> </li> <li> <p>添加Config回调接口</p> </li> </ul> <h3><strong>3.5 AMP.attachApplication</strong></h3> <p>[-> ActivityManagerProxy.java]</p> <pre> <code class="language-java">public void attachApplication(IApplicationThread app) throws RemoteException { Parcel data = Parcel.obtain(); Parcel reply = Parcel.obtain(); data.writeInterfaceToken(IActivityManager.descriptor); data.writeStrongBinder(app.asBinder()); mRemote.transact(ATTACH_APPLICATION_TRANSACTION, data, reply, 0); //【见流程3.6】 reply.readException(); data.recycle(); reply.recycle(); }</code></pre> <p>此处 descriptor = “android.app.IActivityManager”</p> <h3><strong>3.6 AMN.onTransact</strong></h3> <p>[-> ActivityManagerNative.java]</p> <pre> <code class="language-java">public boolean onTransact(int code, Parcel data, Parcel reply, int flags) throws RemoteException { switch (code) { ... case ATTACH_APPLICATION_TRANSACTION: { data.enforceInterface(IActivityManager.descriptor); //获取ApplicationThread的binder代理类 ApplicationThreadProxy IApplicationThread app = ApplicationThreadNative.asInterface( data.readStrongBinder()); if (app != null) { attachApplication(app); //此处是ActivityManagerService类中的方法 【见流程3.7】 } reply.writeNoException(); return true; } } }</code></pre> <h3><strong>3.7 AMS.attachApplication</strong></h3> <p>[-> ActivityManagerService.java]</p> <pre> <code class="language-java">public final void attachApplication(IApplicationThread thread) { synchronized (this) { int callingPid = Binder.getCallingPid(); final long origId = Binder.clearCallingIdentity(); attachApplicationLocked(thread, callingPid); // 【见流程3.8】 Binder.restoreCallingIdentity(origId); } }</code></pre> <p>此处的 thread 便是ApplicationThreadProxy对象,用于跟前面通过Process.start()所创建的进程中ApplicationThread对象进行通信.</p> <h3><strong>3.8 AMS.attachApplicationLocked</strong></h3> <p>[-> ActivityManagerService.java]</p> <pre> <code class="language-java">private final boolean attachApplicationLocked(IApplicationThread thread, int pid) { ProcessRecord app; if (pid != MY_PID && pid >= 0) { synchronized (mPidsSelfLocked) { app = mPidsSelfLocked.get(pid); // 根据pid获取ProcessRecord } } else { app = null; } if (app == null) { if (pid > 0 && pid != MY_PID) { //ProcessRecord为空，则杀掉该进程 Process.killProcessQuiet(pid); } else { //退出新建进程的Looper thread.scheduleExit(); } return false; } //还刚进入attach过程,此时thread应该为null,若不为null则表示该app附到上一个进程，则立刻清空 if (app.thread != null) { handleAppDiedLocked(app, true, true); } final String processName = app.processName; try { //绑定死亡通知 AppDeathRecipient adr = new AppDeathRecipient(app, pid, thread); thread.asBinder().linkToDeath(adr, 0); app.deathRecipient = adr; } catch (RemoteException e) { app.resetPackageList(mProcessStats); startProcessLocked(app, "link fail", processName); //重新启动进程 return false; } //重置进程信息 app.makeActive(thread, mProcessStats); //执行完该语句,则app.thread便不再为空 app.curAdj = app.setAdj = -100; app.curSchedGroup = app.setSchedGroup = Process.THREAD_GROUP_DEFAULT; app.forcingToForeground = null; updateProcessForegroundLocked(app, false, false); app.hasShownUi = false; app.debugging = false; app.cached = false; app.killedByAm = false; mHandler.removeMessages(PROC_START_TIMEOUT_MSG, app); //移除进程启动超时的消息 //系统处于ready状态或者该app为FLAG_PERSISTENT进程,则为true boolean normalMode = mProcessesReady || isAllowedWhileBooting(app.info); List<ProviderInfo> providers = normalMode ? generateApplicationProvidersLocked(app) : null; //app进程存在正在启动中的provider,则超时10s后发送CONTENT_PROVIDER_PUBLISH_TIMEOUT_MSG消息 if (providers != null && checkAppInLaunchingProvidersLocked(app)) { Message msg = mHandler.obtainMessage(CONTENT_PROVIDER_PUBLISH_TIMEOUT_MSG); msg.obj = app; mHandler.sendMessageDelayed(msg, CONTENT_PROVIDER_PUBLISH_TIMEOUT); } try { ... ensurePackageDexOpt(app.instrumentationInfo != null ? app.instrumentationInfo.packageName : app.info.packageName); ApplicationInfo appInfo = app.instrumentationInfo != null ? app.instrumentationInfo : app.info; ... // 绑定应用 [见流程3.9] thread.bindApplication(processName, appInfo, providers, app.instrumentationClass, profilerInfo, app.instrumentationArguments, app.instrumentationWatcher, app.instrumentationUiAutomationConnection, testMode, enableOpenGlTrace, isRestrictedBackupMode || !normalMode, app.persistent, new Configuration(mConfiguration), app.compat, getCommonServicesLocked(app.isolated), mCoreSettingsObserver.getCoreSettingsLocked()); //更新进程LRU队列 updateLruProcessLocked(app, false, null); app.lastRequestedGc = app.lastLowMemory = SystemClock.uptimeMillis(); } catch (Exception e) { app.resetPackageList(mProcessStats); app.unlinkDeathRecipient(); //每当bind操作失败,则重启启动进程, 此处有可能会导致进程无限重启 startProcessLocked(app, "bind fail", processName); return false; } mPersistentStartingProcesses.remove(app); mProcessesOnHold.remove(app); boolean badApp = false; boolean didSomething = false; //Activity: 检查最顶层可见的Activity是否等待在该进程中运行 if (normalMode) { try { if (mStackSupervisor.attachApplicationLocked(app)) { didSomething = true; } } catch (Exception e) { badApp = true; } } //Service: 寻找所有需要在该进程中运行的服务 if (!badApp) { try { didSomething |= mServices.attachApplicationLocked(app, processName); } catch (Exception e) { badApp = true; } } //广播:检查是否在这个进程中有下一个广播接收者 if (!badApp && isPendingBroadcastProcessLocked(pid)) { try { didSomething |= sendPendingBroadcastsLocked(app); } catch (Exception e) { badApp = true; } } //检查是否在这个进程中有下一个backup代理 if (!badApp && mBackupTarget != null && mBackupTarget.appInfo.uid == app.uid) { ensurePackageDexOpt(mBackupTarget.appInfo.packageName); try { thread.scheduleCreateBackupAgent(mBackupTarget.appInfo, compatibilityInfoForPackageLocked(mBackupTarget.appInfo), mBackupTarget.backupMode); } catch (Exception e) { badApp = true; } } if (badApp) { //杀掉bad应用 app.kill("error during init", true); handleAppDiedLocked(app, false, true); return false; } if (!didSomething) { updateOomAdjLocked(); //更新adj的值 } return true; }</code></pre> <ol> <li> <p>根据pid从mPidsSelfLocked中查询到相应的ProcessRecord对象app;</p> </li> <li> <p>当app==null,意味着本次创建的进程不存在, 则直接返回.</p> </li> <li> <p>还刚进入attach过程,此时thread应该为null,若不为null则表示该app附到上一个进程，则调用handleAppDiedLocked清理.</p> </li> <li> <p>绑定死亡通知,当进程pid死亡时会通过binder死亡回调,来通知system_server进程死亡的消息;</p> </li> <li> <p>重置ProcessRecord进程信息, 此时app.thread也赋予了新值,便不再为空.</p> </li> <li> <p>app进程存在正在启动中的provider,则超时10s后发送CONTENT_PROVIDER_PUBLISH_TIMEOUT_MSG消息</p> </li> <li> <p>调用thread.bindApplication绑定应用进程, 后面再进一步说明</p> </li> <li> <p>处理Provider, Activity, Service, Broadcast相应流程</p> </li> </ol> <p>下面,再来说说thread.bindApplication的过程.</p> <h3><strong>3.9 ATP.bindApplication</strong></h3> <p>[-> ApplicationThreadNative.java ::ApplicationThreadProxy]</p> <pre> <code class="language-java">class ApplicationThreadProxy implements IApplicationThread { ... public final void bindApplication(String packageName, ApplicationInfo info, List<ProviderInfo> providers, ComponentName testName, ProfilerInfo profilerInfo, Bundle testArgs, IInstrumentationWatcher testWatcher, IUiAutomationConnection uiAutomationConnection, int debugMode, boolean openGlTrace, boolean restrictedBackupMode, boolean persistent, Configuration config, CompatibilityInfo compatInfo, Map<String, IBinder> services, Bundle coreSettings) throws RemoteException { Parcel data = Parcel.obtain(); data.writeInterfaceToken(IApplicationThread.descriptor); data.writeString(packageName); info.writeToParcel(data, 0); data.writeTypedList(providers); if (testName == null) { data.writeInt(0); } else { data.writeInt(1); testName.writeToParcel(data, 0); } if (profilerInfo != null) { data.writeInt(1); profilerInfo.writeToParcel(data, Parcelable.PARCELABLE_WRITE_RETURN_VALUE); } else { data.writeInt(0); } data.writeBundle(testArgs); data.writeStrongInterface(testWatcher); data.writeStrongInterface(uiAutomationConnection); data.writeInt(debugMode); data.writeInt(openGlTrace ? 1 : 0); data.writeInt(restrictedBackupMode ? 1 : 0); data.writeInt(persistent ? 1 : 0); config.writeToParcel(data, 0); compatInfo.writeToParcel(data, 0); data.writeMap(services); data.writeBundle(coreSettings); mRemote.transact(BIND_APPLICATION_TRANSACTION, data, null, IBinder.FLAG_ONEWAY); data.recycle(); } ... }</code></pre> <p>ATP经过binder ipc传递到ATN的onTransact过程.</p> <h3><strong>3.10 ATN.onTransact</strong></h3> <p>[-> ApplicationThreadNative.java]</p> <pre> <code class="language-java">public boolean onTransact(int code, Parcel data, Parcel reply, int flags) throws RemoteException { switch (code) { ... case BIND_APPLICATION_TRANSACTION: { data.enforceInterface(IApplicationThread.descriptor); String packageName = data.readString(); ApplicationInfo info = ApplicationInfo.CREATOR.createFromParcel(data); List<ProviderInfo> providers = data.createTypedArrayList(ProviderInfo.CREATOR); ComponentName testName = (data.readInt() != 0) ? new ComponentName(data) : null; ProfilerInfo profilerInfo = data.readInt() != 0 ? ProfilerInfo.CREATOR.createFromParcel(data) : null; Bundle testArgs = data.readBundle(); IBinder binder = data.readStrongBinder(); IInstrumentationWatcher testWatcher = IInstrumentationWatcher.Stub.asInterface(binder); binder = data.readStrongBinder(); IUiAutomationConnection uiAutomationConnection = IUiAutomationConnection.Stub.asInterface(binder); int testMode = data.readInt(); boolean openGlTrace = data.readInt() != 0; boolean restrictedBackupMode = (data.readInt() != 0); boolean persistent = (data.readInt() != 0); Configuration config = Configuration.CREATOR.createFromParcel(data); CompatibilityInfo compatInfo = CompatibilityInfo.CREATOR.createFromParcel(data); HashMap<String, IBinder> services = data.readHashMap(null); Bundle coreSettings = data.readBundle(); //[见流程3.11] bindApplication(packageName, info, providers, testName, profilerInfo, testArgs, testWatcher, uiAutomationConnection, testMode, openGlTrace, restrictedBackupMode, persistent, config, compatInfo, services, coreSettings); return true; } ... }</code></pre> <h3><strong>3.11 AT.bindApplication</strong></h3> <p>[-> ActivityThread.java ::ApplicationThread]</p> <pre> <code class="language-java">public final void bindApplication(String processName, ApplicationInfo appInfo, List<ProviderInfo> providers, ComponentName instrumentationName, ProfilerInfo profilerInfo, Bundle instrumentationArgs, IInstrumentationWatcher instrumentationWatcher, IUiAutomationConnection instrumentationUiConnection, int debugMode, boolean enableOpenGlTrace, boolean isRestrictedBackupMode, boolean persistent, Configuration config, CompatibilityInfo compatInfo, Map<String, IBinder> services, Bundle coreSettings) { if (services != null) { //将services缓存起来, 减少binder检索服务的次数 ServiceManager.initServiceCache(services); } //发送消息H.SET_CORE_SETTINGS setCoreSettings(coreSettings); IPackageManager pm = getPackageManager(); android.content.pm.PackageInfo pi = null; try { pi = pm.getPackageInfo(appInfo.packageName, 0, UserHandle.myUserId()); } catch (RemoteException e) { } if (pi != null) { boolean sharedUserIdSet = (pi.sharedUserId != null); boolean processNameNotDefault = (pi.applicationInfo != null && !appInfo.packageName.equals(pi.applicationInfo.processName)); boolean sharable = (sharedUserIdSet || processNameNotDefault); if (!sharable) { VMRuntime.registerAppInfo(appInfo.packageName, appInfo.dataDir, appInfo.processName); } } //初始化AppBindData, 再发送消息H.BIND_APPLICATION AppBindData data = new AppBindData(); data.processName = processName; data.appInfo = appInfo; data.providers = providers; data.instrumentationName = instrumentationName; data.instrumentationArgs = instrumentationArgs; data.instrumentationWatcher = instrumentationWatcher; data.instrumentationUiAutomationConnection = instrumentationUiConnection; data.debugMode = debugMode; data.enableOpenGlTrace = enableOpenGlTrace; data.restrictedBackupMode = isRestrictedBackupMode; data.persistent = persistent; data.config = config; data.compatInfo = compatInfo; data.initProfilerInfo = profilerInfo; sendMessage(H.BIND_APPLICATION, data); }</code></pre> <p>其中setCoreSettings()过程就是调用sendMessage(H.SET_CORE_SETTINGS, coreSettings) 来向主线程发送SET_CORE_SETTINGS消息.bindApplication方法的主要功能是依次向主线程发送消息 H.SET_CORE_SETTINGS 和 H.BIND_APPLICATION . 接下来再来说说这两个消息的处理过程</p> <h3><strong>3.12 H.SET_CORE_SETTINGS</strong></h3> <p>[-> ActivityThread.java ::H]</p> <p>当主线程收到H.SET_CORE_SETTINGS,则调用handleSetCoreSettings</p> <pre> <code class="language-java">private void handleSetCoreSettings(Bundle coreSettings) { synchronized (mResourcesManager) { mCoreSettings = coreSettings; } onCoreSettingsChange(); } private void onCoreSettingsChange() { boolean debugViewAttributes = mCoreSettings.getInt(Settings.Global.DEBUG_VIEW_ATTRIBUTES, 0) != 0; if (debugViewAttributes != View.mDebugViewAttributes) { View.mDebugViewAttributes = debugViewAttributes; // 由于发生改变, 请求所有的activities重启启动 for (Map.Entry<IBinder, ActivityClientRecord> entry : mActivities.entrySet()) { requestRelaunchActivity(entry.getKey(), null, null, 0, false, null, null, false); } } }</code></pre> <h3><strong>3.13 H.BIND_APPLICATION</strong></h3> <p>[-> ActivityThread.java ::H]</p> <p>当主线程收到H.BIND_APPLICATION,则调用handleBindApplication</p> <pre> <code class="language-java">private void handleBindApplication(AppBindData data) { mBoundApplication = data; mConfiguration = new Configuration(data.config); mCompatConfiguration = new Configuration(data.config); ... //设置进程名 Process.setArgV0(data.processName); android.ddm.DdmHandleAppName.setAppName(data.processName, UserHandle.myUserId()); if (data.persistent) { //低内存设备, persistent进程不采用硬件加速绘制,以节省内存使用量 if (!ActivityManager.isHighEndGfx()) { HardwareRenderer.disable(false); } } //重置时区 TimeZone.setDefault(null); Locale.setDefault(data.config.locale); //更新系统配置 mResourcesManager.applyConfigurationToResourcesLocked(data.config, data.compatInfo); mCurDefaultDisplayDpi = data.config.densityDpi; applyCompatConfiguration(mCurDefaultDisplayDpi); data.info = getPackageInfoNoCheck(data.appInfo, data.compatInfo); ... // 创建ContextImpl上下文 final ContextImpl appContext = ContextImpl.createAppContext(this, data.info); if (!Process.isIsolated()) { final File cacheDir = appContext.getCacheDir(); if (cacheDir != null) { System.setProperty("java.io.tmpdir", cacheDir.getAbsolutePath()); } //用于存储产生/编译的图形代码 final File codeCacheDir = appContext.getCodeCacheDir(); if (codeCacheDir != null) { setupGraphicsSupport(data.info, codeCacheDir); } } final boolean is24Hr = "24".equals(mCoreSettings.getString(Settings.System.TIME_12_24)); DateFormat.set24HourTimePref(is24Hr); View.mDebugViewAttributes = mCoreSettings.getInt(Settings.Global.DEBUG_VIEW_ATTRIBUTES, 0) != 0; ... //当处于调试模式,则运行应用生成systrace信息 boolean appTracingAllowed = (data.appInfo.flags&ApplicationInfo.FLAG_DEBUGGABLE) != 0; Trace.setAppTracingAllowed(appTracingAllowed); //初始化 默认的http代理 IBinder b = ServiceManager.getService(Context.CONNECTIVITY_SERVICE); if (b != null) { IConnectivityManager service = IConnectivityManager.Stub.asInterface(b); final ProxyInfo proxyInfo = service.getProxyForNetwork(null); Proxy.setHttpProxySystemProperty(proxyInfo); } if (data.instrumentationName != null) { InstrumentationInfo ii = null; ii = appContext.getPackageManager().getInstrumentationInfo(data.instrumentationName, 0); mInstrumentationPackageName = ii.packageName; mInstrumentationAppDir = ii.sourceDir; mInstrumentationSplitAppDirs = ii.splitSourceDirs; mInstrumentationLibDir = ii.nativeLibraryDir; mInstrumentedAppDir = data.info.getAppDir(); mInstrumentedSplitAppDirs = data.info.getSplitAppDirs(); mInstrumentedLibDir = data.info.getLibDir(); ApplicationInfo instrApp = new ApplicationInfo(); instrApp.packageName = ii.packageName; instrApp.sourceDir = ii.sourceDir; instrApp.publicSourceDir = ii.publicSourceDir; instrApp.splitSourceDirs = ii.splitSourceDirs; instrApp.splitPublicSourceDirs = ii.splitPublicSourceDirs; instrApp.dataDir = ii.dataDir; instrApp.nativeLibraryDir = ii.nativeLibraryDir; LoadedApk pi = getPackageInfo(instrApp, data.compatInfo, appContext.getClassLoader(), false, true, false); ContextImpl instrContext = ContextImpl.createAppContext(this, pi); //通过反射,创建目标类 java.lang.ClassLoader cl = instrContext.getClassLoader(); mInstrumentation = (Instrumentation) cl.loadClass(data.instrumentationName.getClassName()).newInstance(); mInstrumentation.init(this, instrContext, appContext, new ComponentName(ii.packageName, ii.name), data.instrumentationWatcher, data.instrumentationUiAutomationConnection); ... } else { mInstrumentation = new Instrumentation(); } //FLAG_LARGE_HEAP则清除内存增长上限 if ((data.appInfo.flags&ApplicationInfo.FLAG_LARGE_HEAP) != 0) { dalvik.system.VMRuntime.getRuntime().clearGrowthLimit(); } else { dalvik.system.VMRuntime.getRuntime().clampGrowthLimit(); } try { Application app = data.info.makeApplication(data.restrictedBackupMode, null); mInitialApplication = app; if (!data.restrictedBackupMode) { List<ProviderInfo> providers = data.providers; if (providers != null) { installContentProviders(app, providers); mH.sendEmptyMessageDelayed(H.ENABLE_JIT, 10*1000); } } mInstrumentation.onCreate(data.instrumentationArgs); //调用app.onCreate()方法. mInstrumentation.callApplicationOnCreate(app); } finally { StrictMode.setThreadPolicy(savedPolicy); } }</code></pre> <h2><strong>四. 总结</strong></h2> <p>本文首先介绍AMS的4个同名不同参数的方法startProcessLocked; 紧接着讲述了四大组件与进程的关系, Activity, Service, ContentProvider, BroadcastReceiver这四大组件,在启动的过程,当其所承载的进程不存在时需要先创建进程. 再然后进入重点以startProcessLocked以引线一路讲解整个过程所遇到的核心方法. 在整个过程中有新创建的进程与system_server进程之间的交互过程 是通过binder进行通信的, 这里有两条binder通道分别为AMP/AMN 和 ATP/ATN.</p> <p style="text-align:center"><img src="https://simg.open-open.com/show/a678656b4fb8f43dc79947a600a61e4b.jpg"></p> <p>上图便是一次完整的进程创建过程,app的任何组件需要有一个承载其运行的容器,那就是进程, 那么进程的创建过程都是由系统进程system_server通过socket向zygote进程来请求fork()新进程, 当创建出来的app process与system_server进程之间的通信便是通过binder IPC机制.</p> <p> </p> <p> </p> <p>来自：http://gityuan.com/2016/10/09/app-process-create-2/</p> <p> </p>