在前面SystemUI启动流程中说到，在SystemServer中会去启动各种系统服务，这里的launcher也是启动的其中一个服务ActivityManagerService去启动的。在android10之前，系统四大组件的启动都是在ActivityManagerService中，在android10中，单独抽出了一个ActivityTaskManagerService，主要负责Activity的管理和调度。这里先来看下ActivityManagerService服务的启动：
frameworks/base/services/java/com/android/server/SystemServer.java

private void startBootstrapServices() {
    ... ...
    // Activity manager runs the show.
    traceBeginAndSlog("StartActivityManager");
    // TODO: Might need to move after migration to WM.
    ActivityTaskManagerService atm = mSystemServiceManager.startService(
            ActivityTaskManagerService.Lifecycle.class).getService();
    mActivityManagerService = ActivityManagerService.Lifecycle.startService(
            mSystemServiceManager, atm);
    mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
    mActivityManagerService.setInstaller(installer);
    mWindowManagerGlobalLock = atm.getGlobalLock();
    traceEnd();
    ... ...
}

当SystemServiceManager调用 startService() 时，就会通过反射去创建传进去的class，然后在调用创建对象的 onStart() 方法，这里就是去初始化ActivityTaskManagerService和ActivityManagerService对象，并不会去启动launcher，而且系统服务启动分为三块：
frameworks/base/services/java/com/android/server/SystemServer.java

startBootstrapServices();   // 启动引导服务
startCoreServices();        // 启动核心服务
startOtherServices();       // 启动其他服务

在startOtherServices（）中可以看到：
frameworks/base/services/java/com/android/server/SystemServer.java

private void startOtherServices() {
    ... ...
    // We now tell the activity manager it is okay to run third party
    // code.  It will call back into us once it has gotten to the state
    // where third party code can really run (but before it has actually
    // started launching the initial applications), for us to complete our
    // initialization.
    mActivityManagerService.systemReady(() -> {
        ... ...
    });
}

这就说明在所有服务初始化完成后，在这里会通知ActivityManagerService的systemReady()启动 launcher 的进程。
下面一起来看 launcher 是如何被启动起来的：
frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

public void systemReady(final Runnable goingCallback, TimingsTraceLog traceLog) {
    ... ...
    mAtmInternal.startHomeOnAllDisplays(currentUserId, "systemReady");
    ... ...
    mAtmInternal.resumeTopActivities(false /* scheduleIdle */);
    ... ...
}

mAtmInternal类型是ActivityTaskManagerInternal，这是一个抽象类，其实现是ActivityTaskManagerService的内部类LocalService：
frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java

final class LocalService extends ActivityTaskManagerInternal {
    ... ...
    @Override
    public boolean startHomeOnAllDisplays(int userId, String reason) {
        synchronized (mGlobalLock) {
            return mRootActivityContainer.startHomeOnAllDisplays(userId, reason);
        }
    }
    ... ...
        @Override
    public void resumeTopActivities(boolean scheduleIdle){
        synchronized (mGlobalLock){
            mRootActivityContainer.resumeFocusedStacksTopActivities();
            if(scheduleIdle){
                mStackSupervisor.scheduleIdleLocked();
            }
        }
    }
    ... ...
}

这里的mRootActivityContainer类型是RootActivityContainer，按照文档上的说明，这是一个临时类，主要是将ActivityStackSupervisor.java中的一部分逻辑分离出来，在android11中，这个类就已经找不到了。替换成了RootWindowContainer，这里我们跟进 mRootActivityContainer.startHomeOnAllDisplays() 方法看，最终会调用到：startHomeOnDisplay() :
frameworks/base/services/core/java/com/android/server/wm/RootActivityContainer.java

boolean startHomeOnDisplay(int userId,String reason,int displayId,boolean allowInstrumenting,boolean fromHomeKey){
    // Fallback to top focused display if the displayId is invalid.
    if(displayId==INVALID_DISPLAY){
        displayId=getTopDisplayFocusedStack().mDisplayId;
    }
 
    Intent homeIntent=null;
    ActivityInfo aInfo=null;
    if(displayId==DEFAULT_DISPLAY){
        //拿到需要启动launcher的intent，通过resolveHomeActivity解析出需要启动的Activity
        homeIntent=mService.getHomeIntent();
        aInfo=resolveHomeActivity(userId,homeIntent);
    }else if(shouldPlaceSecondaryHomeOnDisplay(displayId)){
        Pair<ActivityInfo, Intent> info=resolveSecondaryHomeActivity(userId,displayId);
        aInfo=info.first;
        homeIntent=info.second;
    }
    if(aInfo==null||homeIntent==null){
        return false;
    }
 
    if(!canStartHomeOnDisplay(aInfo,displayId,allowInstrumenting)){
        return false;
    }
 
    // Updates the home component of the intent.
    homeIntent.setComponent(new ComponentName(aInfo.applicationInfo.packageName,aInfo.name));
    homeIntent.setFlags(homeIntent.getFlags()|FLAG_ACTIVITY_NEW_TASK);
    // Updates the extra information of the intent.
    if(fromHomeKey){
        homeIntent.putExtra(WindowManagerPolicy.EXTRA_FROM_HOME_KEY,true);
    }
    // Update the reason for ANR debugging to verify if the user activity is the one that
    // actually launched.
    final String myReason=reason+":"+userId+":"+UserHandle.getUserId(
    aInfo.applicationInfo.uid)+":"+displayId;
    mService.getActivityStartController().startHomeActivity(homeIntent,aInfo,myReason,
    displayId);
    return true;
}

这里可以分为两步看：
  1、通过ActivityTaskManagerService的getHomeIntent（）获取到需要启动的intent，在通过resolveHomeActivity（）解析出需要启动Activity的信息，
  2、mService.getActivityStartController()获取到的是ActivityStartController，这个类的主要作用是用于控制委派启动的Activity。
先来看下ActivityTaskManagerService的getHomeIntent() :
frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java

    Intent getHomeIntent() {
        Intent intent = new Intent(mTopAction, mTopData != null ? Uri.parse(mTopData) : null);
        intent.setComponent(mTopComponent);
        intent.addFlags(Intent.FLAG_DEBUG_TRIAGED_MISSING);
        if (mFactoryTest != FactoryTest.FACTORY_TEST_LOW_LEVEL) {
            intent.addCategory(Intent.CATEGORY_HOME);
        }
        return intent;
    }

注意看 intent.addCategory(Intent.CATEGORY_HOME) ，这个代表的就是要启动Activity的意图，通常来说，整个系统的只会有一个应用会在清单文件中配置CATEGORY_HOME，如果配置了多个，系统在启动的时候就会要求用户手动去选择哪个作为启动应用，如果在系统设置应用中进行配置了，就会选择配置的那个应用启动。（这个 CATEGORY_HOME 配置，说白了就只有 launcher 程序才会有）。
回到主线，接着看mService.getActivityStartController().startHomeActivity() :
frameworks/base/services/core/java/com/android/server/wm/ActivityStartController.java

    void startHomeActivity(Intent intent, ActivityInfo aInfo, String reason,
            TaskDisplayArea taskDisplayArea) {
        final ActivityOptions options = ActivityOptions.makeBasic();
        options.setLaunchWindowingMode(WINDOWING_MODE_FULLSCREEN);
        if (!ActivityRecord.isResolverActivity(aInfo.name)) {
            // The resolver activity shouldn't be put in home stack because when the foreground is
            // standard type activity, the resolver activity should be put on the top of current
            // foreground instead of bring home stack to front.
            options.setLaunchActivityType(ACTIVITY_TYPE_HOME);
        }
        final int displayId = taskDisplayArea.getDisplayId();
        options.setLaunchDisplayId(displayId);
        options.setLaunchTaskDisplayArea(taskDisplayArea.mRemoteToken
                .toWindowContainerToken());
        // The home activity will be started later, defer resuming to avoid unneccerary operations
        // (e.g. start home recursively) when creating home stack.
        mSupervisor.beginDeferResume();
        final ActivityStack homeStack;
        try {
            // Make sure home stack exists on display area.
            homeStack = taskDisplayArea.getOrCreateRootHomeTask(ON_TOP);
        } finally {
            mSupervisor.endDeferResume();
        }
        mLastHomeActivityStartResult = obtainStarter(intent, "startHomeActivity: " + reason)
                .setOutActivity(tmpOutRecord)
                .setCallingUid(0)
                .setActivityInfo(aInfo)
                .setActivityOptions(options.toBundle())
                .execute();
        mLastHomeActivityStartRecord = tmpOutRecord[0];
        if (homeStack.mInResumeTopActivity) {
            // If we are in resume section already, home activity will be initialized, but not
            // resumed (to avoid recursive resume) and will stay that way until something pokes it
            // again. We need to schedule another resume.
            mSupervisor.scheduleResumeTopActivities();
        }
    }
    /**
     * @return A starter to configure and execute starting an activity. It is valid until after
     *         {@link ActivityStarter#execute} is invoked. At that point, the starter should be
     *         considered invalid and no longer modified or used.
     */
    ActivityStarter obtainStarter(Intent intent, String reason) {
        return mFactory.obtain().setIntent(intent).setReason(reason);
    }

这里主要是先获取一个ActivityStarter（主要用于启动Activity），然后把需要的参数设置进去，最后再调用它的ActivityStarter.execute（）方法：
frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java

int execute() {
    try {
        ... ...
        final LaunchingState launchingState;
        synchronized (mService.mGlobalLock) {
            final ActivityRecord caller = ActivityRecord.forTokenLocked(mRequest.resultTo);
            // 通过ActivityMetricsLogger.notifyActivityLaunching创建LaunchingState并记录创建Activity开始的时间
            launchingState = mSupervisor.getActivityMetricsLogger().notifyActivityLaunching(
                    mRequest.intent, caller);
        }
        
        ... ...
        // 执行启动请求
        res = executeRequest(mRequest);
        ... ...
        
        // Notify ActivityMetricsLogger that the activity has launched.
        // ActivityMetricsLogger will then wait for the windows to be drawn and populate
        // WaitResult.
        // 通过ActivityMetricsLogger.notifyActivityLaunched记录Activity启动完成的时间
        mSupervisor.getActivityMetricsLogger().notifyActivityLaunched(launchingState, res,
                mLastStartActivityRecord);
        // 同时将Request.waitResult添加到ActivityStackSupervisor的mWaitingActivityLaunched中，等待窗口绘制完成
        return getExternalResult(mRequest.waitResult == null ? res
                : waitForResult(res, mLastStartActivityRecord));        
        } finally {
            onExecutionComplete();
        }
    }

通过上面代码我们知道，启动是在 executeRequest() 方法里：
frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java

    private int executeRequest(Request request) {
    ... ...
        //调用 startActivityUnchecked
        mLastStartActivityResult = startActivityUnchecked(r, sourceRecord, voiceSession,
                request.voiceInteractor, startFlags, true /* doResume */, checkedOptions, inTask,
                restrictedBgActivity, intentGrants);
        return mLastStartActivityResult;
    }

ActivityStarter.startActivityUnchecked()
frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java

    private int startActivityUnchecked(final ActivityRecord r, ActivityRecord sourceRecord,
                IVoiceInteractionSession voiceSession, IVoiceInteractor voiceInteractor,
                int startFlags, boolean doResume, ActivityOptions options, Task inTask,
                boolean restrictedBgActivity, NeededUriGrants intentGrants) {
        int result = START_CANCELED;
      ... ...
        try {
            //延时布局
            mService.deferWindowLayout();
            //执行startActivityInner
            result = startActivityInner(r, sourceRecord, voiceSession, voiceInteractor,
                    startFlags, doResume, options, inTask, restrictedBgActivity, intentGrants);
        } finally {
            //恢复布局
            mService.continueWindowLayout();
        }
      ... ...
        return result;
    }

ActivityStarter.startActivityInner()
frameworks/base/services/core/java/com/android/server/wm/ActivityStarter.java

int startActivityInner() { 
    ... ...
       if (mDoResume) {
            //ActivityRecord 记录着 Activity 信息
            final ActivityRecord topTaskActivity =
                    mStartActivity.getTask().topRunningActivityLocked();
            if (!mTargetStack.isTopActivityFocusable()
                    || (topTaskActivity != null && topTaskActivity.isTaskOverlay()
                    && mStartActivity != topTaskActivity)) {
                mTargetStack.getDisplay().mDisplayContent.executeAppTransition();
            } else {
                //执行resumeFocusedStacksTopActivities
                mRootWindowContainer.resumeFocusedStacksTopActivities(
                        mTargetStack, mStartActivity, mOptions);
            }
        }
    ... ...
        return START_SUCCESS;
    }

RootWindowContainer.resumeFocusedStacksTopActivities()
frameworks/base/services/core/java/com/android/server/wm/RootWindowContainer.java

boolean resumeFocusedStacksTopActivities(
            ActivityStack targetStack, ActivityRecord target, ActivityOptions targetOptions) {
    ... ...
        //如果是栈顶Activity，启动resumeTopActivityUncheckedLocked
        if (targetStack != null && (targetStack.isTopStackInDisplayArea()
                || getTopDisplayFocusedStack() == targetStack)) {
            result = targetStack.resumeTopActivityUncheckedLocked(target, targetOptions);
        }
    ... ...
        if (!resumedOnDisplay) {
            //获取栈顶的 ActivityRecord
            final ActivityStack focusedStack = display.getFocusedStack();
            if (focusedStack != null) {
                //执行resumeTopActivityUncheckedLocked
                result |= focusedStack.resumeTopActivityUncheckedLocked(target, targetOptions);
            }else if (targetStack == null) {
                    result |= resumeHomeActivity(null /* prev */, "no-focusable-task",
                            display.getDefaultTaskDisplayArea());
            }
        }
      return result;
}

ActivityStack.resumeTopActivityUncheckedLocked()
frameworks/base/services/core/java/com/android/server/wm/ActivityStack.java

    boolean resumeTopActivityUncheckedLocked(ActivityRecord prev, ActivityOptions options) {
        if (mInResumeTopActivity) {
            // Don't even start recursing.
            return false;
        }
        boolean result = false;
        try {
            mInResumeTopActivity = true;
            // 执行 resumeTopActivityInnerLocked,
            // 最终调用到 ActivityStackSupervisor.startSpecificActivity()
            result = resumeTopActivityInnerLocked(prev, options);
            final ActivityRecord next = topRunningActivity(true /* focusableOnly */);
            if (next == null || !next.canTurnScreenOn()) {
                checkReadyForSleep();
            }
        } finally {
            mInResumeTopActivity = false;
        }
        return result;
    }

ActivityStackSupervisor.startSpecificActivity()
frameworks/base/services/core/java/com/android/server/wm/ActivityStackSupervisor.java

    void startSpecificActivity(ActivityRecord r, boolean andResume, boolean checkConfig) {
        // Is this activity's application already running?
        final WindowProcessController wpc =
                mService.getProcessController(r.processName, r.info.applicationInfo.uid);
 
        boolean knownToBeDead = false;
        //进程存在
        if (wpc != null && wpc.hasThread()) {
            try {
                //真正启动Activity方法
                realStartActivityLocked(r, wpc, andResume, checkConfig);
                return;
            } catch (RemoteException e) {
                Slog.w(TAG, "Exception when starting activity "
                        + r.intent.getComponent().flattenToShortString(), e);
            }
            // If a dead object exception was thrown -- fall through to
            // restart the application.
            knownToBeDead = true;
        }
 
        r.notifyUnknownVisibilityLaunchedForKeyguardTransition();
 
        final boolean isTop = andResume && r.isTopRunningActivity();
        //进程不存在 mService =ATMS
        mService.startProcessAsync(r, knownToBeDead, isTop, isTop ? "top-activity" : "activity");
    }

startSpecificActivity() 这个方法是关键方法，如果进程已经存在直接执行 realStartActivityLocked 去启动 Activity，进程不存在则通过AMS去创建 Socket，然后通知 Zygote 去 fork 进程。由于这里第一次创建，所以会走到 startProcessAsync() 。
Launcher启动流程调用栈：

创建Socket建立连接
ActivityTaskManagerService.startProcessAsync()
frameworks/base/services/core/java/com/android/server/wm/ActivityTaskManagerService.java

    void startProcessAsync(ActivityRecord activity, boolean knownToBeDead, boolean isTop,
            String hostingType) {
        try {
            if (Trace.isTagEnabled(TRACE_TAG_WINDOW_MANAGER)) {
                Trace.traceBegin(TRACE_TAG_WINDOW_MANAGER, "dispatchingStartProcess:"
                        + activity.processName);
            }
            // Post message to start process to avoid possible deadlock of calling into AMS with the
            // ATMS lock held.
            final Message m = PooledLambda.obtainMessage(ActivityManagerInternal::startProcess,
                    mAmInternal, activity.processName, activity.info.applicationInfo, knownToBeDead,
                    isTop, hostingType, activity.intent.getComponent());
            mH.sendMessage(m);
        } finally {
            Trace.traceEnd(TRACE_TAG_WINDOW_MANAGER);
        }
    }

通过handler发消息执行ActivityManagerInternal.startProcess() ，内部又转调用ActivityManagerService.startProcessLocked() :
frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

@GuardedBy("this")
final ProcessRecord startProcessLocked(String processName,
        ApplicationInfo info, boolean knownToBeDead, int intentFlags,
        HostingRecord hostingRecord, int zygotePolicyFlags, boolean allowWhileBooting,
        boolean isolated, boolean keepIfLarge) {
    return mProcessList.startProcessLocked(processName, info, knownToBeDead, intentFlags,
            hostingRecord, zygotePolicyFlags, allowWhileBooting, isolated, 0 /* isolatedUid */,
            keepIfLarge, null /* ABI override */, null /* entryPoint */,
            null /* entryPointArgs */, null /* crashHandler */);
}

mProcessList类型是ProcessList，这是一个进程管理类，描述了进程的adj值，当系统资源吃紧时，就会根据这里描述的adj去判断杀死哪个应用来释放资源，可以通过adb shell dumpsys meminfo来查看当前所有进程的分类情况，接着来看下ProcessList.startProcessLocked():
frameworks/base/services/core/java/com/android/server/am/ProcessList.java

    final ProcessRecord startProcessLocked(String processName, ApplicationInfo info,
            boolean knownToBeDead, int intentFlags, HostingRecord hostingRecord,
            boolean allowWhileBooting, boolean isolated, int isolatedUid, boolean keepIfLarge,
            String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) {
        
        ProcessRecord app;
        ... ...
        checkSlow(startTime, "startProcess: stepping in to startProcess");
        final boolean success = startProcessLocked(app, hostingRecord, abiOverride);
        checkSlow(startTime, "startProcess: done starting proc!");
        return success ? app : null;
    }
 
    boolean startProcessLocked(ProcessRecord app, HostingRecord hostingRecord,
            boolean disableHiddenApiChecks, boolean mountExtStorageFull,
            String abiOverride) {
            ... ...
        try {
            ... ...
            // Start the process.  It will either succeed and return a result containing
            // the PID of the new process, or else throw a RuntimeException.
            final String entryPoint = "android.app.ActivityThread";
 
            return startProcessLocked(hostingRecord, entryPoint, app, uid, gids,
                    runtimeFlags, mountExternal, seInfo, requiredAbi, instructionSet, invokeWith,
                    startTime);
        } catch (RuntimeException e) {
            Slog.e(ActivityManagerService.TAG, "Failure starting process " + app.processName, e);
 
            // Something went very wrong while trying to start this process; one
            // common case is when the package is frozen due to an active
            // upgrade. To recover, clean up any active bookkeeping related to
            // starting this process. (We already invoked this method once when
            // the package was initially frozen through KILL_APPLICATION_MSG, so
            // it doesn't hurt to use it again.)
            mService.forceStopPackageLocked(app.info.packageName, UserHandle.getAppId(app.uid),
                    false, false, true, false, false, app.userId, "start failure");
            return false;
        }
    }
 
    boolean startProcessLocked(HostingRecord hostingRecord,String entryPoint,
            ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal,
            String seInfo, String requiredAbi, String instructionSet, String invokeWith,long startTime) {
            ... ...
            final Process.ProcessStartResult startResult = startProcess(app.hostingRecord,entryPoint, app, app.startUid, gids, runtimeFlags, mountExternal,app.seInfo, requiredAbi, instructionSet, invokeWith, app.startTime);
            ... ...
    }
 
    private Process.ProcessStartResult startProcess(HostingRecord hostingRecord, String entryPoint,
            ProcessRecord app, int uid, int[] gids, int runtimeFlags, int mountExternal,
            String seInfo, String requiredAbi, String instructionSet, String invokeWith,
            long startTime) {
        try {
            Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "Start proc: " +
                    app.processName);
            checkSlow(startTime, "startProcess: asking zygote to start proc");
            final Process.ProcessStartResult startResult;
            if (hostingRecord.usesWebviewZygote()) {
                ... ...
            } else if (hostingRecord.usesAppZygote()) {
                final AppZygote appZygote = createAppZygoteForProcessIfNeeded(app);
 
                startResult = appZygote.getProcess().start(entryPoint,
                        app.processName, uid, uid, gids, runtimeFlags, mountExternal,
                        app.info.targetSdkVersion, seInfo, requiredAbi, instructionSet,
                        app.info.dataDir, null, app.info.packageName,
                        /*useUsapPool=*/ false,
                        new String[] {PROC_START_SEQ_IDENT + app.startSeq});
            } else {
                ... ...
            }
            checkSlow(startTime, "startProcess: returned from zygote!");
            return startResult;
        } finally {
            Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
        }
    }

这里有几个我们需要关注的点，一个是第二个方法定义的entryPoint=“android.app.ActivityThread”，这个就是后面创建进程时会通过反射调用到的类，再来看最后一个方法，这里会执行else if语句，也就是执行ZygoteProcess的start（）方法。最终到 ZygoteProcess 的attemptUsapSendArgsAndGetResult 通过 Socket 通信，fork 一个新的 Launcher 进程，调用过程如图：

ZygoteProcess.attemptZygoteSendArgsAndGetResult()
frameworks/base/core/java/android/os/ZygoteProcess.java

    private Process.ProcessStartResult attemptZygoteSendArgsAndGetResult(
            ZygoteState zygoteState, String msgStr) throws ZygoteStartFailedEx {
        try {
            final BufferedWriter zygoteWriter = zygoteState.mZygoteOutputWriter;
            final DataInputStream zygoteInputStream = zygoteState.mZygoteInputStream;
 
            zygoteWriter.write(msgStr);把应用进程的一些参数写给前面连接的zygote进程
            zygoteWriter.flush();//进入Zygote进程，处于阻塞状态
            //从socket中得到zygote创建的应用pid，赋值给 ProcessStartResult的对象
            Process.ProcessStartResult result = new Process.ProcessStartResult();
            result.pid = zygoteInputStream.readInt();
            result.usingWrapper = zygoteInputStream.readBoolean();
            return result;
        } catch (IOException ex) {
            zygoteState.close();
        }
    }

Zygote进程处理
ZygoteInit.main
frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

public static void main(String argv[]) {
    Runnable caller;
    if (startSystemServer) {
        //Zygote Fork出的第一个进程 SystmeServer
        Runnable r = forkSystemServer(abiList, zygoteSocketName, zygoteServer);
 
        if (r != null) {
            r.run();
            return;
        }
    }
    //循环等待fork出其他的应用进程，比如Launcher
    caller = zygoteServer.runSelectLoop(abiList);
    ...
    if (caller != null) {
        caller.run(); //执行runSelectLoop返回的Runnable对象，进入子进程
    }
}

ZygoteServer.runSelectLoop
frameworks/base/core/java/com/android/internal/os/ZygoteServer.java

Runnable runSelectLoop(String abiList) {
    while (true) {
        int pollReturnValue;
            try {
                //epoll机制 循环
                pollReturnValue = Os.poll(pollFDs, pollTimeoutMs);
            } catch (ErrnoException ex) {
                throw new RuntimeException("poll failed", ex);
            }
            ...
            //来了消息后，调用processOneCommand()来进行进程的处理
            final Runnable command =  connection.processOneCommand(this);
    } 
}

ZygoteConnection.processOneCommand
frameworks/base/core/java/com/android/internal/os/ZygoteConnection.java

Runnable processOneCommand(ZygoteServer zygoteServer) {
            //fork进程，得到新进程pid
            //pid=0 表示Zygote  fork子进程成功
            //pid > 0 表示子进程 的真正的PID
            pid = Zygote.forkAndSpecialize(parsedArgs.mUid, parsedArgs.mGid, parsedArgs.mGids,
                parsedArgs.mRuntimeFlags, rlimits, parsedArgs.mMountExternal, parsedArgs.mSeInfo,
                parsedArgs.mNiceName, fdsToClose, fdsToIgnore, parsedArgs.mStartChildZygote,
                parsedArgs.mInstructionSet, parsedArgs.mAppDataDir, parsedArgs.mIsTopApp,
                parsedArgs.mPkgDataInfoList, parsedArgs.mWhitelistedDataInfoList,
                parsedArgs.mBindMountAppDataDirs, parsedArgs.mBindMountAppStorageDirs);
        try {
            //fork成功，第一次返回的pid = 0
            if (pid == 0) {
                return handleChildProc(parsedArgs, childPipeFd, parsedArgs.mStartChildZygote);
            } else {
                handleParentProc(pid, serverPipeFd);
                return null;
            }
}

ZygoteConnection.handleChildProc
这里主要执行到 ZygoteInit.zygoteInit，zygoteInit 进行一些环境的初始化、启动Binder进程等操作，最终反射执行 ActivityThread.main
frameworks/base/core/java/com/android/internal/os/ZygoteConnection.java

    private Runnable handleChildProc(ZygoteArguments parsedArgs,
            FileDescriptor pipeFd, boolean isZygote) {
        closeSocket();
        Zygote.setAppProcessName(parsedArgs, TAG);
            if (!isZygote) {
                //App进程将会调用到这里，最终反射执行ActivityThread.main
                return ZygoteInit.zygoteInit(parsedArgs.mTargetSdkVersion,
                        parsedArgs.mDisabledCompatChanges,
                        parsedArgs.mRemainingArgs, null /* classLoader */);
            } else {
                return ZygoteInit.childZygoteInit(parsedArgs.mTargetSdkVersion,
                        parsedArgs.mRemainingArgs, null /* classLoader */);
            }
        
    }

Zygote进程调用栈:

ActivityThread中处理
Zygote fork出了 Launcher 的进程，并把接下来的 Launcher 启动任务交给了 ActivityThread 来进行，接下来我们就从 ActivityThread.main方法来分析 Launcher 的创建过程。
frameworks/base/core/java/android/app/ActivityThread.java

    public static void main(String[] args) {
        Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ActivityThreadMain");
        ... ...
        //创建主线程Looper
        Looper.prepareMainLooper();
        ... ...
        ActivityThread thread = new ActivityThread();
        //执行attach
        ... ...
        thread.attach(false, startSeq);
        //开启循环
        ... ...
        Looper.loop();
        throw new RuntimeException("Main thread loop unexpectedly exited");
    }

这里就是android层面划分为一个应用进程的开始，初始化一个looper，也就是android中说的主线程，并开始looper循环，这里调用到了ActivitThread.attach() :
frameworks/base/core/java/android/app/ActivityThread.java

    private void attach(boolean system, long startSeq) {
        sCurrentActivityThread = this;
        mSystemThread = system;
        if (!system) {
            ... ...
            // 这里会拿到ActivityManagerService的代理
            final IActivityManager mgr = ActivityManager.getService();
            try {
               //应用的句柄发给AMS，从而使AMS可以管理新进程
                mgr.attachApplication(mAppThread, startSeq);
            } catch (RemoteException ex) {
                throw ex.rethrowFromSystemServer();
            }
             ... ...
        } else {
            // 在前面讲Zygote进程的时候，里面创建ActivityThread就会执行到这里
        }
 
        //当系统配置发生变更时会执行这个回调
        ViewRootImpl.ConfigChangedCallback configChangedCallback
                = (Configuration globalConfig) -> {
            ... ...
        };
        ViewRootImpl.addConfigCallback(configChangedCallback);
    }

这里会执行if语句里面的内容，mAppThread的类型是ApplicationThread，这个类的主要作用是在ActivityManagerService中回调回ActivityThread中来，mgr是ActivityManagerService的代理，在执行它的ActivityManagerService.attachApplication() 方法：
frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

    public final void attachApplication(IApplicationThread thread, long startSeq) {
        synchronized (this) {
            int callingPid = Binder.getCallingPid();
            final int callingUid = Binder.getCallingUid();
            final long origId = Binder.clearCallingIdentity();
            attachApplicationLocked(thread, callingPid, callingUid, startSeq);
            Binder.restoreCallingIdentity(origId);
        }
    }

ActivityManagerService.attachApplicationLocked()
调用AMS的 attachApplication()，最终层层调用到 ActivityStackSupervisor 的 realStartActivityLocked，真正准备去启动Activity。
frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

    private final boolean attachApplicationLocked(IApplicationThread thread,int pid, int callingUid, long startSeq) {
        ... ...
        //这里会去调用ActivityThrea的bindApplication(),也就是会去创建Application
        thread.bindApplication(... ...)
        ... ...
        //如果当前的Application记录仍然依附到之前的进程中，则清理掉
        if (app.thread != null) {
            handleAppDiedLocked(app, true, true);
        }
        ... ...
        // See if the top visible activity is waiting to run in this process...
        if (normalMode) {
            try {
                //调用ActivityTaskManagerService的attachApplication()，最终层层调用到ActivityStackSupervisor.java的 realStartActivityLocked()
                didSomething = mAtmInternal.attachApplication(app.getWindowProcessController());
            } catch (Exception e) {
                Slog.wtf(TAG, "Exception thrown launching activities in " + app, e);
                badApp = true;
            }
        }
        ... ...
    }

这里通过AMS最终会调用到ActivityStackSupervisor.realStartActivityLocked()：
frameworks/base/services/core/java/com/android/server/wm/ActivityStackSupervisor.java

    boolean realStartActivityLocked(ActivityRecord r, WindowProcessController proc,
            boolean andResume, boolean checkConfig) throws RemoteException {
        //确保所有的Activity执行了onPause才会往下继续执行
        if (!mRootActivityContainer.allPausedActivitiesComplete()) {
            // While there are activities pausing we skipping starting any new activities until
            // pauses are complete. NOTE: that we also do this for activities that are starting in
            // the paused state because they will first be resumed then paused on the client side.
            if (DEBUG_SWITCH || DEBUG_PAUSE || DEBUG_STATES) Slog.v(TAG_PAUSE,
                    "realStartActivityLocked: Skipping start of r=" + r
                    + " some activities pausing...");
            return false;
        }
        ... ...
 
        try {
            ... ...
            try{
                ... ...
                // Create activity launch transaction.
                final ClientTransaction clientTransaction = ClientTransaction.obtain(
                        proc.getThread(), r.appToken);
 
                final DisplayContent dc = r.getDisplay().mDisplayContent;
                //在回调序列的末尾添加一条消息
                clientTransaction.addCallback(LaunchActivityItem.obtain(... ...));
 
                // Set desired final state.
                final ActivityLifecycleItem lifecycleItem;
                if (andResume) {
                    lifecycleItem = ResumeActivityItem.obtain(dc.isNextTransitionForward());
                } else {
                    lifecycleItem = PauseActivityItem.obtain();
                }
                //添加最后执行的生命周期状态
                clientTransaction.setLifecycleStateRequest(lifecycleItem);
 
                // 这里其实就是执行ClientTransaction的schedule()方法
                mService.getLifecycleManager().scheduleTransaction(clientTransaction);
                ... ...
            } catch (RemoteException e) {
                if (r.launchFailed) {
                    // 第二次启动失败，finish activity并放弃启动
                    Slog.e(TAG, "Second failure launching "
                            + r.intent.getComponent().flattenToShortString() + ", giving up", e);
                    proc.appDied();
                    stack.requestFinishActivityLocked(r.appToken, Activity.RESULT_CANCELED, null,
                            "2nd-crash", false);
                    return false;
                }
 
                //第一次启动失败，尝试重启进程
                r.launchFailed = true;
                proc.removeActivity(r);
                throw e;
            }
        } finally {
            endDeferResume();
        }
        ... ...
 
        return true;
    }

ActivityThread调用栈:

小结

至此已经走到 realStartActivityLocked，接下来就是 Activity 的启动流程，Activity 启动下篇文章会单独分析。总结一下 Launcher 启动流程，Launcher的启动经过了三个阶段：
  1、SystemServer 创建AMS和ATMS，通过 SystemReady 进入 LauncherActivity 的调用
  2、Zygote 进程 fork 出 Launcher 进程，通过 Socket 进行通信
  3、进入 ActivityThread 的处理，完成 Launcher 的 Acitivty 启动