Android应用程序启动是一个比较复杂的过程，就着系统源码一步步走，明白启动流程。
做过app开发的都知道，我们离不开activity，所有的页面显示都必须有一个activity承载着，那么我们系统的桌面（Launcher）也是一样的，请看下面大屏幕，我们的Launcher也是activity，当你在Launcher桌面桌面上点击icon，会看到调用了startActivitySafely()，点击Launcher启动一个app的第一步

 public final class Launcher extends Activity
 implements View.OnClickListener, OnLongClickListener, LauncherModel.Callbacks,
 View.OnTouchListener {


public void  onClick(View v) {
 if (tag instanceof ShortcutInfo) {
             // Open shortcut
           final Intent intent = ((ShortcutInfo) tag).intent;
            int[] pos = new int[2];
             v.getLocationOnScreen(pos);
             intent.setSourceBounds(new Rect(pos[0], pos[1],
                    pos[0] + v.getWidth(), pos[1] + v.getHeight()));

             boolean success = startActivitySafely(v, intent, tag);
     .....
     }
 }

一步步深入内部，接着下面代码

boolean startActivitySafely(View v, Intent intent, Object tag) {
        boolean success = false;
         try {
             success = startActivity(v, intent, tag);
        } catch (ActivityNotFoundException e) {
             Toast.makeText(this, R.string.activity_not_found, Toast.LENGTH_SHORT).show();
             Log.e(TAG, "Unable to launch. tag=" + tag + " intent=" + intent, e);
         }
         return success;
     }

继续走

 boolean More ...startActivity(View v, Intent intent, Object tag) {
         intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
         try {
             // Only launch using the new animation if the shortcut has not opted out (this is a
             // private contract between launcher and may be ignored in the future).
             boolean useLaunchAnimation = (v != null) &&
                     !intent.hasExtra(INTENT_EXTRA_IGNORE_LAUNCH_ANIMATION);
             UserHandle user = (UserHandle) intent.getParcelableExtra(ApplicationInfo.EXTRA_PROFILE);
             LauncherApps launcherApps = (LauncherApps)
                     this.getSystemService(Context.LAUNCHER_APPS_SERVICE);
             if (useLaunchAnimation) {
                 ActivityOptions opts = ActivityOptions.makeScaleUpAnimation(v, 0, 0,
                         v.getMeasuredWidth(), v.getMeasuredHeight());
                 if (user == null || user.equals(android.os.Process.myUserHandle())) {
                     // Could be launching some bookkeeping activity
                     startActivity(intent, opts.toBundle());
                } else {
                    launcherApps.startMainActivity(intent.getComponent(), user,
                            intent.getSourceBounds(),
                            opts.toBundle());
                }
            } else {
                if (user == null || user.equals(android.os.Process.myUserHandle())) {
                    startActivity(intent);
                } else {
                   launcherApps.startMainActivity(intent.getComponent(), user,
                            intent.getSourceBounds(), null);
                }
            }
            return true;
        } catch (SecurityException e) {
           ...
         }
         return false;
     }

看到我们熟悉的方法了

 public void  startActivity(Intent intent, @Nullable Bundle options) {
         if (options != null) {
             startActivityForResult(intent, -1, options);
         } else {
             // Note we want to go through this call for compatibility with
             // applications that may have overridden the method.
             startActivityForResult(intent, -1);
         }
     }

接着看

 public void startActivityForResult(@RequiresPermission Intent intent, int requestCode,
            @Nullable Bundle options) {
        if (mParent == null) {
            options = transferSpringboardActivityOptions(options);
            Instrumentation.ActivityResult ar =
                mInstrumentation.execStartActivity( this, mMainThread.getApplicationThread(), mToken, this,
                intent, requestCode, options);
            if (ar != null) {
                mMainThread.sendActivityResult(
                    mToken, mEmbeddedID, requestCode, ar.getResultCode(),
                    ar.getResultData());
            } 
            。。。

        } else {
            if (options != null) {
                mParent.startActivityFromChild(this, intent, requestCode, options);
            } else {
               mParent.startActivityFromChild(this, intent, requestCode);
            }
        }
    }

这里的mParent就是activity，如果第一次启动app的时候mParent未空，如果在app内部启动另外一个activity，这个就是调用startActivityFromChild，不管怎么调用最终都是调用的Instrumentation类execStartActivity()方法来处理逻辑，Instrumentation这个类是啥呢，是干啥的呢，看了源码就会知道，他其实就是一个工具类，辅助application和activity的创建和他们的生命周期控制。如

  public void callActivityOnRestart(Activity activity) {
        activity.onRestart();
    }

    public void callActivityOnResume(Activity activity) {
        activity.mResumed = true;
        activity.onResume();
     ｝

在acitivity中，这几个方法你肯定见过，而且是经常见，现在明白Instrumentation类的作用了吧

 public ActivityResult execStartActivity(
        Context who, IBinder contextThread, IBinder token, String target,
        Intent intent, int requestCode, Bundle options) {
        IApplicationThread whoThread = (IApplicationThread) contextThread;
        if (mActivityMonitors != null) {
            synchronized (mSync) {
                final int N = mActivityMonitors.size();
                for (int i=0; i<N; i++) {
                    final ActivityMonitor am = mActivityMonitors.get(i);
                    if (am.match(who, null, intent)) {
                        am.mHits++;
                        if (am.isBlocking()) {
                            return requestCode >= 0 ? am.getResult() : null;
                        }
                        break;
                    }
                }
            }
        }
        try {
            intent.migrateExtraStreamToClipData();
            intent.prepareToLeaveProcess(who);
            int result = ActivityManagerNative.getDefault()
                .startActivity(whoThread, who.getBasePackageName(), intent,
                        intent.resolveTypeIfNeeded(who.getContentResolver()),
                        token, target, requestCode, 0, null, options);
            checkStartActivityResult(result, intent);
        } catch (RemoteException e) {
            throw new RuntimeException("Failure from system", e);
        }
        return null;
    }

这里有一个新的东西ActivityManagerNative，看看这个是啥

public abstract class ActivityManagerNative extends Binder implements IActivityManager
{
    /**
 * Cast a Binder object into an activity manager interface, generating
 * a proxy if needed.
 */
    static public IActivityManager asInterface(IBinder obj) {
        if (obj == null) {
            return null;
        }
        IActivityManager in = (IActivityManager)obj.queryLocalInterface(descriptor);
        if (in != null) {
            return in;
        }
        return new ActivityManagerProxy(obj);
    }

class ActivityManagerProxy implements IActivityManager{
    public ActivityManagerProxy(IBinder remote){
        mRemote = remote;
    }

    public IBinder asBinder(){
        return mRemote;
    }

    public int startActivity(IApplicationThread caller, String callingPackage, Intent intent,
            String resolvedType, IBinder resultTo, String resultWho, int requestCode,
            int startFlags, ProfilerInfo profilerInfo, Bundle options) throws RemoteException {
        Parcel data = Parcel.obtain();
        Parcel reply = Parcel.obtain();
        data.writeInterfaceToken(IActivityManager.descriptor);
        。。。。
        mRemote.transact(START_ACTIVITY_TRANSACTION, data, reply, 0);
        reply.readException();
        int result = reply.readInt();
        reply.recycle();
        data.recycle();
        return result;
    }


  private static final Singleton<IActivityManager> gDefault = new Singleton<IActivityManager>() {
        protected IActivityManager create() {
            IBinder b = ServiceManager.getService("activity");
            if (false) {
                Log.v("ActivityManager", "default service binder = " + b);
            }
            IActivityManager am = asInterface(b);
            if (false) {
                Log.v("ActivityManager", "default service = " + am);
            }
            return am;
        }
    };
     static public IActivityManager getDefault() {
        return gDefault.get();
    }

从上面我们看到gDefault如果没有值就是创建，也就是通过ServiceManager去获取一个IBinder，这里binder实际是一个远程的ActivityManagerService实例，而且AMS也是继承ActivityManagerNative， 然后ActivityManagerProxy封装，ActivityManagerProxy和ActivityManagerNative都是实现IActivityManager接口，所以 ActivityManagerNative.getDefault(）.startActivity() 就直接调用到ActivityManagerService里面的startActivity()，这里面做的事情就是IPC通信，利用Binder对象，调用transact()，把所有需要的参数封装成Parcel对象，向AMS发送数据进行通信。
进入ActivityManagerService类，进入如下方法

 @Override
    public final int startActivity(IApplicationThread caller, String callingPackage,
            Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
            int startFlags, ProfilerInfo profilerInfo, Bundle bOptions) {
        return startActivityAsUser(caller, callingPackage, intent, resolvedType, resultTo,
                resultWho, requestCode, startFlags, profilerInfo, bOptions,
                UserHandle.getCallingUserId());
    }

进入startActivityAsUser

  @Override
    public final int startActivityAsUser(IApplicationThread caller, String callingPackage,
            Intent intent, String resolvedType, IBinder resultTo, String resultWho, int requestCode,
            int startFlags, ProfilerInfo profilerInfo, Bundle bOptions, int userId) {
        enforceNotIsolatedCaller("startActivity");
        userId = mUserController.handleIncomingUser(Binder.getCallingPid(), Binder.getCallingUid(),
                userId, false, ALLOW_FULL_ONLY, "startActivity", null);
        // TODO: Switch to user app stacks here.
        return mActivityStarter.startActivityMayWait(caller, -1, callingPackage, intent,
                resolvedType, null, null, resultTo, resultWho, requestCode, startFlags,
                profilerInfo, null, null, bOptions, false, userId, null, null);
    }

接着调用startActivityMayWait（），里面代码很多，ActivityStackSupervisor管理ActivityStack，ActivityStack管理activitystack。

final int startActivityMayWait(IApplicationThread caller, int callingUid,
            String callingPackage, Intent intent, String resolvedType,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            IBinder resultTo, String resultWho, int requestCode, int startFlags,
            ProfilerInfo profilerInfo, IActivityManager.WaitResult outResult, Configuration config,
            Bundle bOptions, boolean ignoreTargetSecurity, int userId,
            IActivityContainer iContainer, TaskRecord inTask) {
        .....
ActivityInfo aInfo = mSupervisor.resolveActivity(intent, rInfo, startFlags, profilerInfo);
        .....
       int res = startActivityLocked(caller, intent, ephemeralIntent, resolvedType,
                    aInfo, rInfo, voiceSession, voiceInteractor,
                    resultTo, resultWho, requestCode, callingPid,
                    callingUid, callingPackage, realCallingPid, realCallingUid, startFlags,
                    options, ignoreTargetSecurity, componentSpecified, outRecord, container,
                    inTask);

        .....

}

resolveActivity()解析MainActivity的intent里面数据封装在ActivityInfo。进入到startActivityLocked（），
ActivityRecord，Launcher（Activity）相关信息，并将启动actvity信息传到startActivityUnchecked（）里面

 final int startActivityLocked(IApplicationThread caller, Intent intent, Intent ephemeralIntent,
            String resolvedType, ActivityInfo aInfo, ResolveInfo rInfo,
            IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
            IBinder resultTo, String resultWho, int requestCode, int callingPid, int callingUid,
            String callingPackage, int realCallingPid, int realCallingUid, int startFlags,
            ActivityOptions options, boolean ignoreTargetSecurity, boolean componentSpecified,
            ActivityRecord[] outActivity, ActivityStackSupervisor.ActivityContainer container,
            TaskRecord inTask) {
            。。。
  ActivityRecord sourceRecord = null;
        ActivityRecord resultRecord = null;
        if (resultTo != null) {
            sourceRecord = mSupervisor.isInAnyStackLocked(resultTo);
            if (DEBUG_RESULTS) Slog.v(TAG_RESULTS,
                    "Will send result to " + resultTo + " " + sourceRecord);
            if (sourceRecord != null) {
                if (requestCode >= 0 && !sourceRecord.finishing) {
                    resultRecord = sourceRecord;
                }
            }

        。。。
          err = startActivityUnchecked(r, sourceRecord, voiceSession, voiceInteractor, startFlags,
                    true, options, inTask);
        。。。
｝

在startActivityUnchecked做了很多处理，n多代码，最后进了ActivityStack，调用mTargetStack.startActivityLocked(mStartActivity, newTask, mKeepCurTransition, mOptions),对ActivityRecord进行进一步处理；继续进入ActivityStack.startActivityLocked()

 final void startActivityLocked(ActivityRecord r, boolean newTask, boolean keepCurTransition,
            ActivityOptions options) {

...
  ProcessRecord proc = r.app;
            if (proc == null) {
                proc = mService.mProcessNames.get(r.processName, r.info.applicationInfo.uid);
            }
            if (proc == null || proc.thread == null) {
                showStartingIcon = true;
            }
            if (DEBUG_TRANSITION) Slog.v(TAG_TRANSITION,
                    "Prepare open transition: starting " + r);
            if ((r.intent.getFlags() & Intent.FLAG_ACTIVITY_NO_ANIMATION) != 0) {
                mWindowManager.prepareAppTransition(TRANSIT_NONE, keepCurTransition);
                mNoAnimActivities.add(r);
            } else {
                mWindowManager.prepareAppTransition(newTask
                        ? r.mLaunchTaskBehind
                                ? TRANSIT_TASK_OPEN_BEHIND
                                : TRANSIT_TASK_OPEN
                        : TRANSIT_ACTIVITY_OPEN, keepCurTransition);
                mNoAnimActivities.remove(r);
            }
   ....


  if (doResume) {
            mStackSupervisor.resumeTopActivitiesLocked(this, r, options);
  }
}

首先为目标Activity创建ProcessRecord，然后用WindowManager进行一些切换窗口的操作，最后调用mStackSupervisor.resumeTopActivitiesLocked(this, r, options)。
进入resumeTopActivitiesLocked()

boolean resumeTopActivitiesLocked(ActivityStack targetStack, ActivityRecord target,Bundle targetOptions) {
         if (targetStack == null) {
             targetStack = getFocusedStack();
         }
         // Do targetStack first.
         boolean result = false;
         if (isFrontStack(targetStack)) {
             result = targetStack.resumeTopActivityLocked(target, targetOptions);
         }
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
             final ArrayList<ActivityStack> stacks = mActivityDisplays.valueAt(displayNdx).mStacks;
             for (int stackNdx = stacks.size() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = stacks.get(stackNdx);
                 if (stack == targetStack) {
                     // Already started above.
                     continue;
                 }
                 if (isFrontStack(stack)) {
                     stack.resumeTopActivityLocked(null);
                 }
             }
         }
         return result;
     }

这里再次进入到ActivityStack，resumeTopActivityLocked();

 final boolean  resumeTopActivityLocked(ActivityRecord prev, Bundle options) {
         if (mStackSupervisor.inResumeTopActivity) {
             // Don't even start recursing.
             return false;
         }
         boolean result = false;
         try {
             // Protect against recursion.
             mStackSupervisor.inResumeTopActivity = true;
             if (mService.mLockScreenShown == ActivityManagerService.LOCK_SCREEN_LEAVING) {
                 mService.mLockScreenShown = ActivityManagerService.LOCK_SCREEN_HIDDEN;
                 mService.updateSleepIfNeededLocked();
             }
             result = resumeTopActivityInnerLocked(prev, options);
         } finally {
             mStackSupervisor.inResumeTopActivity = false;
         }
         return result;
     }

这里也是做了前期的验证，走resumeTopActivityInnerLocked()这里面代码太多了，有点晕

 final boolean resumeTopActivityInnerLocked(ActivityRecord prev, Bundle options) {

    //判断AMS是否启动
    if (!mService.mBooting && !mService.mBooted) {
             // Not ready yet!
             return false;
     }
     ...
     // 如果当前栈顶Activity处于resume状态，且就是我们要打开的Activity，则直接结束
        if (mResumedActivity == next && next.state == ActivityState.RESUMED &&
                mStackSupervisor.allResumedActivitiesComplete()) {
            // Make sure we have executed any pending transitions, since there
            // should be nothing left to do at this point.
            mWindowManager.executeAppTransition();
            mNoAnimActivities.clear();
            ActivityOptions.abort(options);
            if (DEBUG_STATES) Slog.d(TAG_STATES,
                    "resumeTopActivityLocked: Top activity resumed " + next);
            if (DEBUG_STACK) mStackSupervisor.validateTopActivitiesLocked();
            return false;
        }

        // 对prevActivity（Launcher）所在的Task进行一些判断，如果prevTask和nextTask相同，那么直接将
        // prevTask直接设为栈顶Task；如果prevTask不是当前ActivityStack栈顶的Task，那么它后面的Task
        // 都应该放到Launcher的Task后面；后面则是有关是否为桌面的判断和处理了。
        final TaskRecord nextTask = next.task;
        if (prevTask != null && prevTask.stack == this &&
                prevTask.isOverHomeStack() && prev.finishing && prev.frontOfTask) {
            if (DEBUG_STACK)  mStackSupervisor.validateTopActivitiesLocked();
            if (prevTask == nextTask) {
                prevTask.setFrontOfTask();
            } else if (prevTask != topTask()) {
                // This task is going away but it was supposed to return to the home stack.
                // Now the task above it has to return to the home task instead.
                final int taskNdx = mTaskHistory.indexOf(prevTask) + 1;
                mTaskHistory.get(taskNdx).setTaskToReturnTo(HOME_ACTIVITY_TYPE);
            } else if (!isOnHomeDisplay()) {
                return false;
            } else if (!isHomeStack()){
                if (DEBUG_STATES) Slog.d(TAG_STATES,
                        "resumeTopActivityLocked: Launching home next");
                final int returnTaskType = prevTask == null || !prevTask.isOverHomeStack() ?
                        HOME_ACTIVITY_TYPE : prevTask.getTaskToReturnTo();
                return isOnHomeDisplay() &&
                        mStackSupervisor.resumeHomeStackTask(returnTaskType, prev, "prevFinished");
            }
        }
        。。。


     mStackSupervisor.startSpecificActivityLocked(next, true, true);
}

进入ActivityStackSupervisor类的startSpecificActivityLocked方法，通过要打开的activity进程名字和uid取得ProcessRecord，如果没有创建就去创建一个ProcessRecord

void startSpecificActivityLocked(ActivityRecord r,
        boolean andResume, boolean checkConfig) {
            // Is this activity's application already running?
            ProcessRecord app = mService.getProcessRecordLocked(r.processName,
                    r.info.applicationInfo.uid, true);

            r.task.stack.setLaunchTime(r);

            if (app != null && app.thread != null) {
                try {
                    if ((r.info.flags&ActivityInfo.FLAG_MULTIPROCESS) == 0
                            || !"android".equals(r.info.packageName)) {
                        // Don't add this if it is a platform component that is marked
                        // to run in multiple processes, because this is actually
                        // part of the framework so doesn't make sense to track as a
                        // separate apk in the process.
                        app.addPackage(r.info.packageName, r.info.applicationInfo.versionCode,
                                mService.mProcessStats);
                    }
                    realStartActivityLocked(r, app, andResume, checkConfig);
                    return;
                } catch (RemoteException e) {
                    Slog.w(TAG, "Exception when starting activity "
                            + r.intent.getComponent().flattenToShortString(), e);
                }

                // If a dead object exception was thrown -- fall through to
                // restart the application.
            }

            mService.startProcessLocked(r.processName, r.info.applicationInfo, true, 0,
                    "activity", r.intent.getComponent(), false, false, true);
        }

第一次 启动app肯定没创建的ProcessRecord，那么就进入ActivityManagerService的startProcessLocked()方法，去创建进程，然后在开启activity，如果进程存在，就直接进入realStartActivityLocked方法，

  final ProcessRecord  startProcessLocked(String processName, ApplicationInfo info,
              boolean knownToBeDead, int intentFlags, String hostingType, ComponentName hostingName,
              boolean allowWhileBooting, boolean isolated, int isolatedUid, boolean keepIfLarge,
              String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) {
          long startTime = SystemClock.elapsedRealtime();
          ProcessRecord app;
          if (!isolated) {
              app = getProcessRecordLocked(processName, info.uid, keepIfLarge);
              checkTime(startTime, "startProcess: after getProcessRecord");
          } else { 
              app = null;
          } 
              if (app != null && app.pid > 0) {
              if (!knownToBeDead || app.thread == null) { 
                  if (DEBUG_PROCESSES) Slog.v(TAG, "App already running: " + app); 
                  app.addPackage(info.packageName, info.versionCode, mProcessStats);
                  checkTime(startTime, "startProcess: done, added package to proc");
                  return app;
              } 
              if (DEBUG_PROCESSES || DEBUG_CLEANUP) Slog.v(TAG, "App died: " + app);
              checkTime(startTime, "startProcess: bad proc running, killing");
              Process.killProcessGroup(app.info.uid, app.pid);
              handleAppDiedLocked(app, true, true);
              checkTime(startTime, "startProcess: done killing old proc");
          }
          String hostingNameStr = hostingName != null? hostingName.flattenToShortString() : null 
          if (!isolated) {
              if ((intentFlags&Intent.FLAG_FROM_BACKGROUND) != 0) { 
                  if (mBadProcesses.get(info.processName, info.uid) != null) {                     
                     return null;
                  }
              } else { 
                  mProcessCrashTimes.remove(info.processName, info.uid);
                  if (mBadProcesses.get(info.processName, info.uid) != null) {
                      EventLog.writeEvent(EventLogTags.AM_PROC_GOOD,  UserHandle.getUserId(info.uid), info.uid,  info.processName);
                      mBadProcesses.remove(info.processName, info.uid);
                      if (app != null) {
                          app.bad = false;
                      }
                  }
              }
          }

          if (app == null) {
              checkTime(startTime, "startProcess: creating new process record");
              app = newProcessRecordLocked(info, processName, isolated, isolatedUid);
              if (app == null) { 
                  return null;
              }
              app.crashHandler = crashHandler;
              mProcessNames.put(processName, app.uid, app);
              if (isolated) {
                  mIsolatedProcesses.put(app.uid, app);
              }
              checkTime(startTime, "startProcess: done creating new process record");
          } else { 
              app.addPackage(info.packageName, info.versionCode, mProcessStats);
              checkTime(startTime, "startProcess: added package to existing proc");
          }

          //如果系统还没启动完毕，则等待系统启动完毕后再启动进程
          if (!mProcessesReady && !isAllowedWhileBooting(info)
                  && !allowWhileBooting) {
              if (!mProcessesOnHold.contains(app)) {
                  mProcessesOnHold.add(app);
              }
              if (DEBUG_PROCESSES) Slog.v(TAG, "System not ready, putting on hold: " + app);
              checkTime(startTime, "startProcess: returning with proc on hold");
              return app;
          }
          checkTime(startTime, "startProcess: stepping in to startProcess");
          startProcessLocked(app, hostingType, hostingNameStr, abiOverride, entryPoint, entryPointArgs);
          checkTime(startTime, "startProcess: done starting proc!");
          return (app.pid != 0) ? app : null;
      }

通过newProcessRecordLocked()，创建进程ProcessRecord，ActivityManagerService.startProcessLocked()创建进程。

 private final void  startProcessLocked(ProcessRecord app, String hostingType, String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs) {
         //pid不为0，初始化pid，清楚PROC_START_TIMEOUT_MSG超时信息
     if (app.pid > 0 && app.pid != MY_PID) {
              checkTime(startTime, "startProcess: removing from pids map");
              synchronized (mPidsSelfLocked) {
                  mPidsSelfLocked.remove(app.pid);
                  mHandler.removeMessages(PROC_START_TIMEOUT_MSG, app);
              }
              checkTime(startTime, "startProcess: done removing from pids map");
              app.setPid(0);
      }
      。。。
          //初始化信息
         if (!app.isolated) {
          int[] permGids = null;
           try {
               checkTime(startTime, "startProcess: getting gids from package manager");
               final PackageManager pm = mContext.getPackageManager();
               permGids = pm.getPackageGids(app.info.packageName);

               if (Environment.isExternalStorageEmulated()) {
                   checkTime(startTime, "startProcess: checking external storage perm");
                   if (pm.checkPermission(
                           android.Manifest.permission.ACCESS_ALL_EXTERNAL_STORAGE,
                           app.info.packageName) == PERMISSION_GRANTED) {
                       mountExternal = Zygote.MOUNT_EXTERNAL_MULTIUSER_ALL;
                   } else {
                       mountExternal = Zygote.MOUNT_EXTERNAL_MULTIUSER;
                   }
               }
           } catch (PackageManager.NameNotFoundException e) {
               Slog.w(TAG, "Unable to retrieve gids", e);
           }
      ｝

。。。
    // Start the process.  It will either succeed and return a result containing
    // the PID of the new process, or else throw a RuntimeException.
    //定制创建进程后入口ActivityThread
    if (entryPoint == null) entryPoint = "android.app.ActivityThread";
            Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "Start proc: " +
                    app.processName);
            checkTime(startTime, "startProcess: asking zygote to start proc");
    //创建应用进程
   Process.ProcessStartResult startResult = Process.start(entryPoint,
        app.processName, uid, uid, gids, debugFlags, mountExternal,
        app.info.targetSdkVersion, app.info.seinfo, requiredAbi, instructionSet,
        app.info.dataDir, entryPointArgs);
。。。。

      //以pid为key，ProcessRecord为value，存储在mPidsSelfLocked里面
     synchronized (mPidsSelfLocked) {
             this.mPidsSelfLocked.put(startResult.pid, app);
             if (isActivityProcess) {
                 Message msg = mHandler.obtainMessage(PROC_START_TIMEOUT_MSG);
                 msg.obj = app;
                 mHandler.sendMessageDelayed(msg, startResult.usingWrapper
           ? PROC_START_TIMEOUT_WITH_WRAPPER : PROC_START_TIMEOUT);
             }
         }

}

Process类中， Process.start

public static final ProcessStartResult start(final String processClass, final String niceName,
                                    int uid, int gid, int[] gids, int debugFlags, int mountExternal,
                                    int targetSdkVersion,  String seInfo,  String abi,
                                    String instructionSet, String appDataDir, String[] zygoteArgs) {
          try {
              return startViaZygote(processClass, niceName, uid, gid, gids,
                      debugFlags, mountExternal, targetSdkVersion, seInfo,
                      abi, instructionSet, appDataDir, zygoteArgs);
          } catch (ZygoteStartFailedEx ex) {
              Log.e(LOG_TAG,
                      "Starting VM process through Zygote failed");
              throw new RuntimeException(
                      "Starting VM process through Zygote failed", ex);
          }
      }

  private static ProcessStartResult startViaZygote(final String processClass,   final String niceName,
                                  final int uid, final int gid, final int[] gids, int debugFlags, int mountExternal,
                                  int targetSdkVersion,   String seInfo, String abi,
                                  String instructionSet,   String appDataDir,    String[] extraArgs) throws ZygoteStartFailedEx {
        synchronized(Process.class) {

。。。
 return zygoteSendArgsAndGetResult(openZygoteSocketIfNeeded(abi), argsForZygote);

｝

 private static ProcessStartResult zygoteSendArgsAndGetResult(
            ZygoteState zygoteState, ArrayList<String> args)
            throws ZygoteStartFailedEx {
        。。。。
final BufferedWriter writer = zygoteState.writer;
            final DataInputStream inputStream = zygoteState.inputStream;

            writer.write(Integer.toString(args.size()));
            writer.newLine();

            for (int i = 0; i < sz; i++) {
                String arg = args.get(i);
                writer.write(arg);
                writer.newLine();
            }

            writer.flush();

            // Should there be a timeout on this?
            ProcessStartResult result = new ProcessStartResult();

            // Always read the entire result from the input stream to avoid leaving
            // bytes in the stream for future process starts to accidentally stumble
            // upon.
            result.pid = inputStream.readInt();
            result.usingWrapper = inputStream.readBoolean();

            。。。
｝

我们的数据最终都是写到ZygoteState里面，ZygoteState，fork()创建进程。这个时候就该进入ActivityThread类的main方法，学过Handler的肯定都知道这个类，这里面主要是一些创建进程后的初始化工作，好，下篇继续创建进程之后的流程。