Android11 FallbackHome启动和关闭流程分析
Android 7.0引入了新特性：Direct Boot Mode，设备启动后进入的一个新模式，直到用户解锁（unlock）设备此阶段结束。在这个模式下，系统调用 resolveHomeActivity 找到的是FallbackHome ，而不是我们的桌面应用。所以系统开始启动的是 FallbackHome 这个"桌面"。
03-13 16:58:41.359 431 431 D test10 : ===getDefaultTaskDisplayArea===
03-13 16:58:41.359 431 431 D test10 : comp:null
ResolveInfo:ResolveInfo{b15783 com.android.settings/.FallbackHome p=-1000 m=0x108000}
03-13 16:58:41.361 431 431 D test10 : bestChoice:ResolveInfo{b15783 com.android.settings/.FallbackHome p=-1000 m=0x108000}
03-13 16:58:41.361 431 431 D test10 : aInfo:ActivityInfo{67e5d00 com.android.settings.FallbackHome}
那为什么找到是FallbackHome 呢？FallbackHome 位于 com.android.settings这个包下，看一下主配置文件
//packages\apps\Settings\AndroidManifest.xml
<activity android:name=".FallbackHome"
//......
<intent-filter android:priority="-1000">
<action android:name="android.intent.action.MAIN" />
<category android:name="android.intent.category.HOME" />
<category android:name="android.intent.category.DEFAULT" />
</intent-filter>
</activity>
<application android:label="@string/settings_label"
//......
android:directBootAware="true"
android:name=".SettingsApplication"
android:appComponentFactory="androidx.core.app.CoreComponentFactory">
FallbackHome设置了HOME属性，且settings application配置了directBootAware属性，所以找到的是FallbackHome
FallbackHome的启动
FallbackHome的启动主要分为两个阶段
- systemserver告知Zygote要创建新进程
- 新进程通知AMS启动FallbackHome
systemserver告知Zygote要创建新进程
systemserver之间的调用这里就不详细分析，可以看一下调用的堆栈
startSpecificActivity r:ActivityRecord{eebff5 u0 com.android.settings/.FallbackHome t2}
03-13 16:58:41.400 431 431 D test10 : java.lang.Exception
03-13 16:58:41.400 431 431 D test10 : at com.android.server.wm.ActivityStackSupervisor.startSpecificActivity(ActivityStackSupervisor.java:979)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.wm.ActivityStack.resumeTopActivityInnerLocked(ActivityStack.java:1970)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.wm.ActivityStack.resumeTopActivityUncheckedLocked(ActivityStack.java:1516)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.wm.RootWindowContainer.resumeFocusedStacksTopActivities(RootWindowContainer.java:2311)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.wm.ActivityStarter.startActivityInner(ActivityStarter.java:1736)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.wm.ActivityStarter.startActivityUnchecked(ActivityStarter.java:1525)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.wm.ActivityStarter.executeRequest(ActivityStarter.java:1189)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.wm.ActivityStarter.execute(ActivityStarter.java:670)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.wm.ActivityStartController.startHomeActivity(ActivityStartController.java:207)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.wm.RootWindowContainer.startHomeOnTaskDisplayArea(RootWindowContainer.java:1549)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.wm.RootWindowContainer.startHomeOnDisplay(RootWindowContainer.java:1491)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.wm.RootWindowContainer.startHomeOnDisplay(RootWindowContainer.java:1475)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.wm.RootWindowContainer.startHomeOnAllDisplays(RootWindowContainer.java:1456)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.wm.ActivityTaskManagerService$LocalService.startHomeOnAllDisplays(ActivityTaskManagerService.java:6727)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.am.ActivityManagerService.systemReady(ActivityManagerService.java:9689)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.SystemServer.startOtherServices(SystemServer.java:2257)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.SystemServer.run(SystemServer.java:599)
03-13 16:58:41.400 431 431 D test10 : at com.android.server.SystemServer.main(SystemServer.java:415)
03-13 16:58:41.400 431 431 D test10 : at java.lang.reflect.Method.invoke(Native Method)
03-13 16:58:41.400 431 431 D test10 : at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:592)
03-13 16:58:41.400 431 431 D test10 : at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:925)
可以看出，首先在ActivityManagerService的systemReady方法中调用，一直执行到ActivityStackSupervisor的startSpecificActivity方法
void startSpecificActivity(ActivityRecord r, boolean andResume, boolean checkConfig) {
//......
final boolean isTop = andResume && r.isTopRunningActivity();
mService.startProcessAsync(r, knownToBeDead, isTop, isTop ? "top-activity" : "activity");
}
通过 startProcessAsync请求 Zygote创建 FallbackHome进程。startProcessAsync经过一步步的调用，最后调用到ProcessList的start方法
//frameworks\base\services\core\java\com\android\server\am\ProcessList.java
@GuardedBy("mService")
boolean startProcessLocked(ProcessRecord app, HostingRecord hostingRecord,
int zygotePolicyFlags, boolean disableHiddenApiChecks, boolean disableTestApiChecks,
boolean mountExtStorageFull, String abiOverride) {
//......
// Start the process. It will either succeed and return a result containing
// the PID of the new process, or else throw a RuntimeException.
final String entryPoint = "android.app.ActivityThread";
return startProcessLocked(hostingRecord, entryPoint, app, uid, gids,
runtimeFlags, zygotePolicyFlags, mountExternal, seInfo, requiredAbi,
instructionSet, invokeWith, startTime);
}
注意这里的一个参数entryPoint为 “android.app.ActivityThread”，调用其重载的方法，最后调用到Process的start方法
//frameworks\base\core\java\android\os\Process.java
public static final ZygoteProcess ZYGOTE_PROCESS = new ZygoteProcess();
public static ProcessStartResult start(......) {
return ZYGOTE_PROCESS.start(processClass, niceName, uid, gid, gids,
runtimeFlags, mountExternal, targetSdkVersion, seInfo,
abi, instructionSet, appDataDir, invokeWith, packageName,
zygotePolicyFlags, isTopApp, disabledCompatChanges,
pkgDataInfoMap, whitelistedDataInfoMap, bindMountAppsData,
ZYGOTE_PROCESS是 ZygoteProcess类对象，调用其start方法,进而调用其startViaZygote方法
private Process.ProcessStartResult startViaZygote( ...... ){
//一系列的参数设置，省略......
//这里的processClass为android.app.ActivityThread
argsForZygote.add(processClass);
if (extraArgs != null) {
Collections.addAll(argsForZygote, extraArgs);
}
synchronized(mLock) {
// The USAP pool can not be used if the application will not use the systems graphics
// driver. If that driver is requested use the Zygote application start path.
return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi),
zygotePolicyFlags,
argsForZygote);
}
}
1，调用openZygoteSocketIfNeeded 打开和 Zygote的链接
2，调用zygoteSendArgsAndGetResult发送参数并得到结果
先来看看openZygoteSocketIfNeeded 方法
@GuardedBy("mLock")
private ZygoteState openZygoteSocketIfNeeded(String abi) throws ZygoteStartFailedEx {
try {
attemptConnectionToPrimaryZygote();
if (primaryZygoteState.matches(abi)) {
return primaryZygoteState;
}
//......
}
@GuardedBy("mLock")
private void attemptConnectionToPrimaryZygote() throws IOException {
if (primaryZygoteState == null || primaryZygoteState.isClosed()) {
primaryZygoteState =
ZygoteState.connect(mZygoteSocketAddress, mUsapPoolSocketAddress);
//......
}
}
调用ZygoteState的connect
static ZygoteState connect(@NonNull LocalSocketAddress zygoteSocketAddress,
@Nullable LocalSocketAddress usapSocketAddress)
throws IOException {
DataInputStream zygoteInputStream;
BufferedWriter zygoteOutputWriter;
final LocalSocket zygoteSessionSocket = new LocalSocket();
if (zygoteSocketAddress == null) {
throw new IllegalArgumentException("zygoteSocketAddress can't be null");
}
try {
zygoteSessionSocket.connect(zygoteSocketAddress);
zygoteInputStream = new DataInputStream(zygoteSessionSocket.getInputStream());
zygoteOutputWriter =
new BufferedWriter(
new OutputStreamWriter(zygoteSessionSocket.getOutputStream()),
Zygote.SOCKET_BUFFER_SIZE);
} catch (IOException ex) {
try {
zygoteSessionSocket.close();
} catch (IOException ignore) { }
throw ex;
}
return new ZygoteState(zygoteSocketAddress, usapSocketAddress,
zygoteSessionSocket, zygoteInputStream, zygoteOutputWriter,
getAbiList(zygoteOutputWriter, zygoteInputStream));
}
注意这里的 zygoteSocketAddress 即 Zygote.PRIMARY_SOCKET_NAME（zygote）,调用connect连接名为zygote的socket服务，并初始化输入输出流，封装在ZygoteState对象中返回。该对象作为参数，传个zygoteSendArgsAndGetResult方法。 再来看一下zygoteSendArgsAndGetResult这个方法
@GuardedBy("mLock")
private Process.ProcessStartResult zygoteSendArgsAndGetResult(
ZygoteState zygoteState, int zygotePolicyFlags, @NonNull ArrayList<String> args)
throws ZygoteStartFailedEx {
//......
if (shouldAttemptUsapLaunch(zygotePolicyFlags, args)) {
try {
return attemptUsapSendArgsAndGetResult(zygoteState, msgStr);
} catch (IOException ex) {
// If there was an IOException using the USAP pool we will log the error and
// attempt to start the process through the Zygote.
Log.e(LOG_TAG, "IO Exception while communicating with USAP pool - "
+ ex.getMessage());
}
}
return attemptZygoteSendArgsAndGetResult(zygoteState, msgStr);
}
private Process.ProcessStartResult attemptZygoteSendArgsAndGetResult(
ZygoteState zygoteState, String msgStr) throws ZygoteStartFailedEx {
try {
final BufferedWriter zygoteWriter = zygoteState.mZygoteOutputWriter;
final DataInputStream zygoteInputStream = zygoteState.mZygoteInputStream;
zygoteWriter.write(msgStr);
zygoteWriter.flush();
// Always read the entire result from the input stream to avoid leaving
// bytes in the stream for future process starts to accidentally stumble
// upon.
Process.ProcessStartResult result = new Process.ProcessStartResult();
result.pid = zygoteInputStream.readInt();
result.usingWrapper = zygoteInputStream.readBoolean();
if (result.pid < 0) {
throw new ZygoteStartFailedEx("fork() failed");
}
return result;
} catch (IOException ex) {
zygoteState.close();
Log.e(LOG_TAG, "IO Exception while communicating with Zygote - "
+ ex.toString());
throw new ZygoteStartFailedEx(ex);
}
}
使用前面封装的ZygoteState 中的输入输出流，写入数据并返回结果。在 Android 11 Zygote启动流程 一文中提到，Zygote启动的时候，创建了Zygote服务端，并调用runSelectLoop，进入循环等待，等待客户端的请求。接收到请求调用processOneCommand方法。在processOneCommand方法中，先fork子进程，子进程fork成功，就在子进程中返回一个Runnable，并执行其run方法。这里的子进程是FallbackHome进程
新进程通知AMS启动FallbackHome
返回的Runnable是通过handleChildProc方法得到的
private Runnable handleChildProc(ZygoteArguments parsedArgs,
FileDescriptor pipeFd, boolean isZygote) {
//......
Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
if (parsedArgs.mInvokeWith != null) {
//
} else {
if (!isZygote) {
return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion,
parsedArgs.mDisabledCompatChanges,
parsedArgs.mRemainingArgs, null /* classLoader */);
} else {
return ZygoteInit.childZygoteInit(parsedArgs.mTargetSdkVersion,
parsedArgs.mRemainingArgs, null /* classLoader */);
}
}
}
剩下的就和systemserver启动流程一样，只不过这里是调用前面提到的android.app.ActivityThread类的main方法 。具体参考Android 11 SystemServer启动流程。来看看ActivityThread的main方法
public static void main(String[] args) {
Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ActivityThreadMain");
//......
Looper.prepareMainLooper();
//......
ActivityThread thread = new ActivityThread();
thread.attach(false, startSeq);
//......
Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
Looper.loop();
throw new RuntimeException("Main thread loop unexpectedly exited");
}
创建 ActivityThread 对象并执行其attach方法
@UnsupportedAppUsage
private void attach(boolean system, long startSeq) {
sCurrentActivityThread = this;
mSystemThread = system;
if (!system) {
android.ddm.DdmHandleAppName.setAppName("" ,
UserHandle.myUserId());
RuntimeInit.setApplicationObject(mAppThread.asBinder());
final IActivityManager mgr = ActivityManager.getService();
try {
mgr.attachApplication(mAppThread, startSeq);
//......
获取AMS代理类对象，通过binder调用，调用AMS的attachApplication方法
@Override
public final void attachApplication(IApplicationThread thread, long startSeq) {
if (thread == null) {
throw new SecurityException("Invalid application interface");
}
synchronized (this) {
int callingPid = Binder.getCallingPid();
final int callingUid = Binder.getCallingUid();
final long origId = Binder.clearCallingIdentity();
attachApplicationLocked(thread, callingPid, callingUid, startSeq);
Binder.restoreCallingIdentity(origId);
}
}
继续调用attachApplicationLocked方法
@GuardedBy("this")
private boolean attachApplicationLocked(@NonNull IApplicationThread thread,
int pid, int callingUid, long startSeq) {
//......
//创建Application并执行其oncreate方法
thread.bindApplication(processName, appInfo, providerList,
instr2.mClass,
profilerInfo, instr2.mArguments,
instr2.mWatcher,
instr2.mUiAutomationConnection, testMode,
mBinderTransactionTrackingEnabled, enableTrackAllocation,
isRestrictedBackupMode || !normalMode, app.isPersistent(),
new Configuration(app.getWindowProcessController().getConfiguration()),
app.compat, getCommonServicesLocked(app.isolated),
mCoreSettingsObserver.getCoreSettingsLocked(),
buildSerial, autofillOptions, contentCaptureOptions,
app.mDisabledCompatChanges);
//......
// See if the top visible activity is waiting to run in this process...
if (normalMode) {
try {
didSomething = mAtmInternal.attachApplication(app.getWindowProcessController());//启动Activity
} catch (Exception e) {
Slog.wtf(TAG, "Exception thrown launching activities in " + app, e);
badApp = true;
}
}
}
接下来就是AMS通知FallbackHome进程，执行FallbackHome的生命周期。FallbackHome就会启动起来
FallbackHome的退出
来看一下FallbackHome的onCreate方法
@Override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
//......
registerReceiver(mReceiver, new IntentFilter(Intent.ACTION_USER_UNLOCKED));
maybeFinish();
}
注册了一个ACTION_USER_UNLOCKED的广播，并在这里调用了maybeFinish方法。接收到这个广播也是调用maybeFinish
private BroadcastReceiver mReceiver = new BroadcastReceiver() {
@Override
public void onReceive(Context context, Intent intent) {
maybeFinish();
}
};
所以接下来看看maybeFinish到底干了什么
private void maybeFinish() {
if (getSystemService(UserManager.class).isUserUnlocked()) {
final Intent homeIntent = new Intent(Intent.ACTION_MAIN)
.addCategory(Intent.CATEGORY_HOME);
final ResolveInfo homeInfo = getPackageManager().resolveActivity(homeIntent, 0);
if (Objects.equals(getPackageName(), homeInfo.activityInfo.packageName)) {
if (UserManager.isSplitSystemUser()
&& UserHandle.myUserId() == UserHandle.USER_SYSTEM) {
// This avoids the situation where the system user has no home activity after
// SUW and this activity continues to throw out warnings. See b/28870689.
return;
}
Log.d(TAG, "User unlocked but no home; let's hope someone enables one soon?");
mHandler.sendEmptyMessageDelayed(0, 500);
} else {
Log.d(TAG, "User unlocked and real home found; let's go!");
getSystemService(PowerManager.class).userActivity(
SystemClock.uptimeMillis(), false);
finish();
}
}
}
如果系统已经解锁并且查找到的Launcher不是自己时就finish自己。所以可以理解为：FallbackHome注册了ACTION_USER_UNLOCKED这个广播，当接收到这个广播时，如果系统已经解锁并且查找到的Launcher不是自己时就finish自己。ACTION_USER_UNLOCKED这个广播是在哪里发出的呢？
在Android11开机动画退出流程分析一文中，有分析到，开机动画的退出是在performEnableScreen 方法中。退出开机动画后，调用AMS的bootAnimationComplete方法，然后调用到其finishBooting，我们从finishBooting开始分析
final void finishBooting() {
//......
mUserController.sendBootCompleted(
new IIntentReceiver.Stub() {
@Override
public void performReceive(Intent intent, int resultCode,
String data, Bundle extras, boolean ordered,
boolean sticky, int sendingUser) {
synchronized (ActivityManagerService.this) {
mOomAdjuster.mCachedAppOptimizer.compactAllSystem();
requestPssAllProcsLocked(SystemClock.uptimeMillis(), true, false);
}
}
});
//......
}
调用到UserController对象的sendBootCompleted方法，其源码路径为frameworks\base\services\core\java\com\android\server\am\UserController.java
void sendBootCompleted(IIntentReceiver resultTo) {
final boolean systemUserFinishedBooting;
// Get a copy of mStartedUsers to use outside of lock
SparseArray<UserState> startedUsers;
synchronized (mLock) {
systemUserFinishedBooting = mCurrentUserId != UserHandle.USER_SYSTEM;
startedUsers = mStartedUsers.clone();
}
for (int i = 0; i < startedUsers.size(); i++) {
UserState uss = startedUsers.valueAt(i);
if (systemUserFinishedBooting && uss.mHandle.isSystem()) {
// On Automotive, at this point the system user has already been started and
// unlocked, and some of the tasks we do here have already been done. So skip those
// in that case.
// TODO(b/132262830): this workdound shouldn't be necessary once we move the
// headless-user start logic to UserManager-land
Slog.d(TAG, "sendBootCompleted(): skipping on non-current system user");
continue;
}
finishUserBoot(uss, resultTo);
}
}
继续调用finishUserBoot，最终调用到 finishUserUnlocking
private boolean finishUserUnlocking(final UserState uss) {
//......
mHandler.obtainMessage(USER_UNLOCK_MSG, userId, 0, uss).sendToTarget();
//......
}
发送USER_UNLOCK_MSG消息,接收消息后，调用 finishUserUnlocked
void finishUserUnlocked(final UserState uss) {
// Dispatch unlocked to external apps
final Intent unlockedIntent = new Intent(Intent.ACTION_USER_UNLOCKED);
unlockedIntent.putExtra(Intent.EXTRA_USER_HANDLE, userId);
unlockedIntent.addFlags(
Intent.FLAG_RECEIVER_REGISTERED_ONLY | Intent.FLAG_RECEIVER_FOREGROUND);
mInjector.broadcastIntent(unlockedIntent, null, null, 0, null,
null, null, AppOpsManager.OP_NONE, null, false, false, MY_PID, SYSTEM_UID,
Binder.getCallingUid(), Binder.getCallingPid(), userId);
//......
finishUserUnlockedCompleted(uss);//发送开机广播
}
可以看出，就是在这里发出解锁广播和开机广播的。
总结
本文简单的介绍了FallbackHome启动和关闭的代码调用流程。
启动流程主要分为以下几步
- Systemserver进程通过socket，通知Zygote创建新进程
- 新进程创建成功，新进程通知Systemserver可以启动FallbackHome
- Systemserver通知FallbackHome，执行其生命周期
FallbackHome退出的话，是接收到ACTION_USER_UNLOCKED广播，判断是否解锁并且查找到的Launcher不是自己时，就退出自己