本文基于 Android 6.0 源码分析.

在分析Android系统启动流程之前,必须要对Android系统的架构有一个印象. 做Android开发的都知道,Android系统的架构分为五层架构,由上到下为应用层 -> Framwork层 -> 系统运行时库层 -> 硬件抽象层 -> Linux内核层 .

Android架构介绍

应用层(Apps): 系统内置的应用与我们开发的应用都运行在这一层,负责与用户的直接交互. 通常都是由Java语言开发的.
应用框架层(Java Framwork): 应用框架层为用户提供了开发程序需要的API. 这一层也是由Java代码编写的 ,可以称为Java Framwork.
系统运行库层(Runtime Library): 系统运行库层分为两类 – c/c++程序库和Android运行时库,Android运行时库又包含核心库与虚拟机.
硬件抽象层(HAL): 硬件抽象层位于Linux内核与硬件电路之间的接口层,主要目的是为了将硬件抽象化. 硬件抽象化可以隐藏特定平台的硬件接口细节,为上层平台提供统一的实现接口. 除了软件设计的的因素外,也是为了保护各大厂商的利益.

Linux内核是基于GUN许可协议的,即对源码的修改必须开源. 而Android系统是基于Apache许可协议的,可以修改代码而不需要开源. 所以把本应该在kernel的硬件驱动逻辑放到Android平台上,就不需要开源,从而保护各大厂商的利益.
Linux内核层(Linux Kernel): Android系统的核心服务是基于Linux内核的,在此基础上添加了部分Android专用的驱动.

附:Android系统架构图

Android启动概述

Boot ROM : 固化在ROM中的指令,不可修改
BootLoader : 系统的引导程序
Linux Kernel : Linux内核,负责直接与硬件交互
Init : 第一个用户进程,会做一些系统级的初始化工作
Zygote : 孵化器进程,Android中的应用程序都是由它负责创建的
ZygoteInit : Android应用的真正入口,位于Java层
SystemServer : Android中大部分提供的服务都位于 system_server 进程中
Launcher : 系统的启动器,一个特殊的App

Boot-ROM

当手机处于关机状态,按下开机键时,引导芯片开始从固化在ROM中的预设代码开始执行,加载BootLoader到RAM中.

BootLoader

BootLoader是启动Android之前的引导程序,它会初始化硬件设备,从而将系统的软硬件环境带到一个合适的状态.

Linux-Kernel

Android平台的基础是Linux内核. 在启动Kernel时,Kernel中会有三个特殊的进程. idle(swapper)进程(pid=0)、init进程(pid=1)和kthreadd进程(pid=2).

idle进程: swapper进程是由系统创建的第一个进程,也是唯一一个没有通过fork或者kernel_thread产生的进程.主要作用负责Linux内核的初始化工作. 在系统初始化完成之后演变为idle进程,负责进程调度、交换. 所以又被称之为交换进程.
init进程: init进程是由idle通过kernel_thread创建,在内核空间初始化完成之后加载init程序,最终转化为用户空间的init进程.
kthreadd进程: kthreadd进程是由idle进程通过kernel_thread创建,并且始终运行在内核空间,负责所有内核线程的调度和管理.

Init

Init进程是Linux内核启动之后创建的第一个用户空间的进程。在Init进程初始化完成之后，则通过执行init.rc的脚本文件启动zygote等其他进程。

init.cpp => /system/core/init/init.cpp

int main(int argc, char** argv) {
       if (!strcmp(basename(argv[0]), "ueventd")) {
           // ueventd主要是负责设备节点的创建、权限设定等一些列工作
           return ueventd_main(argc, argv);
       }
       if (!strcmp(basename(argv[0]), "watchdogd")) {
           // watchdogd俗称看门狗，用于系统出问题时重启系统
           return watchdogd_main(argc, argv);
       }
       // 清除 umask
       umask(0);
       // 添加环境变量 "/usr/local/bin:/usr/bin:/bin:."
       add_environment("PATH", _PATH_DEFPATH);
       bool is_first_stage = (argc == 1) || (strcmp(argv[1], "--second-stage") != 0);
       // 初始化设备节点
       if (is_first_stage) {
           mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755");
           mkdir("/dev/pts", 0755);
           mkdir("/dev/socket", 0755);
           mount("devpts", "/dev/pts", "devpts", 0, NULL);
           mount("proc", "/proc", "proc", 0, NULL);
           mount("sysfs", "/sys", "sysfs", 0, NULL);
       }
       // 把标准输入，输出，错误输出都重定位到"/dev/__null__"
       open_devnull_stdio();
       // 初始化kernel中的log模块
       klog_init();
       klog_set_level(KLOG_NOTICE_LEVEL);
       NOTICE("init%s started!\n", is_first_stage ? "" : " second stage");
       /* 29-37: 初始化SELinux */
       if (!is_first_stage) {
           close(open("/dev/.booting", O_WRONLY | O_CREAT | O_CLOEXEC, 0000));
           // 创建一块共享区域来存储属性值
           property_init();
           process_kernel_dt();
           process_kernel_cmdline();
           export_kernel_boot_props();
       }
       selinux_initialize(is_first_stage);
       // 在加载了SELinux安全策略之后,重新执行init切换到init域
       if (is_first_stage) {
           // 恢复SELinux文件属性
           if (restorecon("/init") == -1) {
               ERROR("restorecon failed: %s\n", strerror(errno));
               security_failure();
           }
           char* path = argv[0];
           char* args[] = { path, const_cast<char*>("--second-stage"), nullptr };
           // 切换到init域. 
           if (execv(path, args) == -1) {
               ERROR("execv(\"%s\") failed: %s\n", path, strerror(errno));
               security_failure();
           }
       }
       // 这些目录必须在初始策略加载之前创建，因此需要将其安全上下文还原为正确的值。
       // 这必须在ueventd填充"/dev"之前发生。
       INFO("Running restorecon...\n");
       restorecon("/dev");
       restorecon("/dev/socket");
       restorecon("/dev/__properties__");
       restorecon_recursive("/sys");
       epoll_fd = epoll_create1(EPOLL_CLOEXEC);
       if (epoll_fd == -1) {
           ERROR("epoll_create1 failed: %s\n", strerror(errno));
           exit(1);
       }
       // 初始化子线程退出的信号处理过程
       signal_handler_init();
       // 加载"/default.prop"中的配置
       property_load_boot_defaults();
       // 启动属性服务器
       start_property_service();
       // 开始解析"/init.rc"文件
       init_parse_config_file("/init.rc");
       // 执行rc文件中触发器为"on early-init"的语句
       action_for_each_trigger("early-init", action_add_queue_tail);
       // 将等待coldboot完成的操作排队，这样我们就知道ueventd已经设置了所有的/dev。。。
       queue_builtin_action(wait_for_coldboot_done_action, "wait_for_coldboot_done");
       // ... 这样我们就可以开始对需要/dev提供内容的操作进行排队。
       queue_builtin_action(mix_hwrng_into_linux_rng_action, "mix_hwrng_into_linux_rng");
       queue_builtin_action(keychord_init_action, "keychord_init");
       queue_builtin_action(console_init_action, "console_init");
       // 执行rc文件中触发器为"on init"的语句(启动所有启动操作以启动我们。)
       action_for_each_trigger("init", action_add_queue_tail);
       // Repeat mix_hwrng_into_linux_rng in case /dev/hw_random or /dev/random
       // wasn't ready immediately after wait_for_coldboot_done
       queue_builtin_action(mix_hwrng_into_linux_rng_action, "mix_hwrng_into_linux_rng");
       // 不要在充电器模式下安装文件系统或启动核心系统服务。
       char bootmode[PROP_VALUE_MAX];
       if (property_get("ro.bootmode", bootmode) > 0 && strcmp(bootmode, "charger") == 0) {
           action_for_each_trigger("charger", action_add_queue_tail);
       } else {
           action_for_each_trigger("late-init", action_add_queue_tail);
       }
       // 根据属性的当前状态运行所有属性触发器。
       queue_builtin_action(queue_property_triggers_action, "queue_property_triggers");
       // init初始化完成之后进入死循环,化为守护线程处理子进程的死亡信号、修改属性的请求和组合键事件.
       while (true) {
           if (!waiting_for_exec) {
               execute_one_command();
               restart_processes();
           }
           int timeout = -1;
           // 进程需要启动
           if (process_needs_restart) {
               timeout = (process_needs_restart - gettime()) * 1000;
               if (timeout < 0)
                   timeout = 0;
           }
           if (!action_queue_empty() || cur_action) {
               timeout = 0;
           }
           bootchart_sample(&timeout);
           epoll_event ev;
           // 循环,等待事情发生	
           int nr = TEMP_FAILURE_RETRY(epoll_wait(epoll_fd, &ev, 1, timeout));
           if (nr == -1) {
               ERROR("epoll_wait failed: %s\n", strerror(errno));
           } else if (nr == 1) {
               ((void (*)()) ev.data.ptr)();
           }
       }
       return 0;
   }

Init进程主要作用有以下几点

提供属性服务 property service.
解析init.rc文件,启动进程及确定启动的顺序.
化为守护线程处理子进程的死亡信号、修改属性的请求和组合键事件.

Zygote

在Android系统中，所有的应用程序包括系统进程，都是zygote进程负责创建，所以zygote进程又称为孵化器。
Zygote进程是由Init进程解析init.rc文件启动的. 当Init进程解析到这条语句时,就会启动Zygote进程.

init.rc => /system/core/rootdir/init.zygote32.rc
init.zygote32.rc => /system/core/rootdir/init.zygote32.rc

service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
    class main
    socket zygote stream 660 root system
    onrestart write /sys/android_power/request_state wake
    onrestart write /sys/power/state on
    onrestart restart media
    onrestart restart netd

链接: init.rc 语法与解析

app_main.main

zygote进程对应的可执行文件/system/bin/app_process所对应的源文件是app_main

app_main.cpp => /frameworks/base/cmds/app_process/app_main.cpp

int main(int argc, char* const argv[])
{
    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
        // Older kernels don't understand PR_SET_NO_NEW_PRIVS and return
        // EINVAL. Don't die on such kernels.
        if (errno != EINVAL) {
            LOG_ALWAYS_FATAL("PR_SET_NO_NEW_PRIVS failed: %s", strerror(errno));
            return 12;
        }
    }
    // argv: [-Xzygote /system/bin --zygote --start-system-server]
    AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));
    // 处理参数,忽略第一个参数
    argc--;
    argv++;
    int i;
    for (i = 0; i < argc; i++) {
        if (argv[i][0] != '-') {
            break;
        }
        if (argv[i][1] == '-' && argv[i][2] == 0) {
            ++i; // Skip --.
            break;
        }
        runtime.addOption(strdup(argv[i]));
    }
    // 分析运行时参数。在第一个无法识别的选项处停止。
    bool zygote = false;
    bool startSystemServer = false;
    bool application = false;
    String8 niceName;
    String8 className;
    ++i;  // 跳过未使用的“parent dir”参数。
    while (i < argc) {
        const char* arg = argv[i++];
        if (strcmp(arg, "--zygote") == 0) {
            zygote = true;
            // ZYGOTE_NICE_NAME: zygote 或者 zygote64
            niceName = ZYGOTE_NICE_NAME;
        } else if (strcmp(arg, "--start-system-server") == 0) {
            startSystemServer = true;
        } else if (strcmp(arg, "--application") == 0) {
            application = true;
        } else if (strncmp(arg, "--nice-name=", 12) == 0) {
            niceName.setTo(arg + 12);
        } else if (strncmp(arg, "--", 2) != 0) {
            className.setTo(arg);
            break;
        } else {
            --i;
            break;
        }
    }

    Vector<String8> args;
    if (!className.isEmpty()) {
        // 运行application或tool程序
        args.add(application ? String8("application") : String8("tool"));
        runtime.setClassNameAndArgs(className, argc - i, argv + i);
    } else {
        //进入zygote模式，创建 /data/dalvik-cache路径
        maybeCreateDalvikCache();
        if (startSystemServer) {
            args.add(String8("start-system-server"));
        }
        char prop[PROP_VALUE_MAX];
        if (property_get(ABI_LIST_PROPERTY, prop, NULL) == 0) {
            LOG_ALWAYS_FATAL("app_process: Unable to determine ABI list from property %s.",
                ABI_LIST_PROPERTY);
            return 11;
        }
        String8 abiFlag("--abi-list=");
        abiFlag.append(prop);
        args.add(abiFlag);
        //在zygote模式下，将所有剩余参数传递给zygote#main()方法。
        for (; i < argc; ++i) {
            args.add(String8(argv[i]));
        }
    }

    if (!niceName.isEmpty()) {
        runtime.setArgv0(niceName.string());
        set_process_name(niceName.string());
    }
    //设置进程名
    if (zygote) {
        // 启动AppRuntime,见下一小节 AndroidRuntime.start()
        runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
    } else if (className) {
        runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
    } else {
        //没有指定类名或zygote，参数错误
        fprintf(stderr, "Error: no class name or --zygote supplied.\n");
        app_usage();
        LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");
        return 10;
    }
}

app_main主要操作如下

初始化AppRuntime,AppRuntime继承自AndroidRuntime
解析传入的参数
根据参数启动Zygote

AndroidRuntime.start

AppRuntime的父类是AndroidRuntime,当调用 runtime.start时,开始执行AndroidRuntime.start中的逻辑

AppRuntime.start => /frameworks/base/core/jni/AndroidRuntime.cpp

void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
{
    ALOGD(">>>>>> START %s uid %d <<<<<<\n",
            className != NULL ? className : "(unknown)", getuid());
    static const String8 startSystemServer("start-system-server");
    // "startSystemServer==true"表示"runtime"已过时并且再也不从init.rc运行了，
    // 所以我们在这里打印启动事件。
    for (size_t i = 0; i < options.size(); ++i) {
        if (options[i] == startSystemServer) {
           /* track our progress through the boot sequence */
           const int LOG_BOOT_PROGRESS_START = 3000;
           LOG_EVENT_LONG(LOG_BOOT_PROGRESS_START,  ns2ms(systemTime(SYSTEM_TIME_MONOTONIC)));
        }
    }
    const char* rootDir = getenv("ANDROID_ROOT");
    if (rootDir == NULL) {
        rootDir = "/system";
        if (!hasDir("/system")) {
            LOG_FATAL("No root directory specified, and /android does not exist.");
            return;
        }
        setenv("ANDROID_ROOT", rootDir, 1);
    }
    /* 启动虚拟机 */
    JniInvocation jni_invocation;
    jni_invocation.Init(NULL);
    JNIEnv* env;
    // 创建虚拟机,设置虚拟机参数
    if (startVm(&mJavaVM, &env, zygote) != 0) {
        return;
    }
    onVmCreated(env);
    // 注册android方法 (注册JNI方法),见 AndroidRuntime.startReg 小节
    if (startReg(env) < 0) {
        ALOGE("Unable to register all android natives\n");
        return;
    }
    /*
     * We want to call main() with a String array with arguments in it.
     * At present we have two arguments, the class name and an option string.
     * Create an array to hold them.
     */
    jclass stringClass;
    jobjectArray strArray;
    jstring classNameStr;
    // 等价 strArray= new String[options.size() + 1];
    stringClass = env->FindClass("java/lang/String");
    assert(stringClass != NULL);
    strArray = env->NewObjectArray(options.size() + 1, stringClass, NULL);
    assert(strArray != NULL);
    // 等价 strArray[0] = "com.android.internal.os.ZygoteInit"
    classNameStr = env->NewStringUTF(className);
    assert(classNameStr != NULL);
    env->SetObjectArrayElement(strArray, 0, classNameStr);
    // 等价 strArray[1] = "start-system-server"；
    // strArray[2] = "--abi-list=xxx"；
    // 其中xxx为系统响应的cpu架构类型，比如arm64-v8a.
    for (size_t i = 0; i < options.size(); ++i) {
        jstring optionsStr = env->NewStringUTF(options.itemAt(i).string());
        assert(optionsStr != NULL);
        env->SetObjectArrayElement(strArray, i + 1, optionsStr);
    }
    // 启动虚拟机.这个线程成为虚拟机的主线程,知道这个虚拟机退出.
    // className: com.android.internal.os.ZygoteInit 
    // toSlashClassName: 将小数点转化为斜线 
    char* slashClassName = toSlashClassName(className);
    jclass startClass = env->FindClass(slashClassName);
    if (startClass == NULL) {
        ALOGE("JavaVM unable to locate class '%s'\n", slashClassName);
    } else {
        jmethodID startMeth = env->GetStaticMethodID(startClass, "main",
            "([Ljava/lang/String;)V");
        if (startMeth == NULL) {
            ALOGE("JavaVM unable to find main() in '%s'\n", className);
        } else {
            // 调用ZygoteInit#main().
            env->CallStaticVoidMethod(startClass, startMeth, strArray);
            /* if (env->ExceptionCheck())  threadExitUncaughtException(env); */
        }
    }
    //释放相应对象的内存空间
    free(slashClassName);
    ALOGD("Shutting down VM\n");
    if (mJavaVM->DetachCurrentThread() != JNI_OK)
        ALOGW("Warning: unable to detach main thread\n");
    if (mJavaVM->DestroyJavaVM() != 0)
        ALOGW("Warning: VM did not shut down cleanly\n");
}

start方法中主要操作如下

启动虚拟机
注册JNI函数
调用JNI函数,启动ZygoteInit#main()

AndroidRuntime.startReg

AppRuntime.startReg => /frameworks/base/core/jni/AndroidRuntime.cpp

int AndroidRuntime::startReg(JNIEnv* env)
{
    // 此钩子将导致在此进程中创建的所有未来线程连接到JavaVM。（为了支持JNI-Attach调用，这需要离开。）
    androidSetCreateThreadFunc((android_create_thread_fn) javaCreateThreadEtc);
    ALOGV("--- registering native functions ---\n");
    /*
     * 每个“register”函数调用一个或多个返回本地引用的对象（例如FindClass）。
     * 因为我们还没有真正的启动VM，所以它们都存储在基架中，从未发布过。
     * 使用"Push"/"Pop"管理存储。
     */
    env->PushLocalFrame(200);
    // 注册jni方法.
    if (register_jni_procs(gRegJNI, NELEM(gRegJNI), env) < 0) {
        env->PopLocalFrame(NULL);
        return -1;
    }
    env->PopLocalFrame(NULL);
    //createJavaThread("fubar", quickTest, (void*) "hello");
    return 0;
}

startReg方法做了以下两点操作

修改了线程创建函数gCreateThreadFn -> javaCreateThreadEtc
注册了JNI函数gRegJNI.

ZygoteInit

ZygoteInit是Java层的一个类. AndroidRuntime执行到最后通过反射调用到ZygoteInit.main().

ZygoteInit.main => /frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

public static void main(String argv[]) {
       try {
           // 启动Ddms
           RuntimeInit.enableDdms();
           // 启动抽样分析器
           SamplingProfilerIntegration.start();
           boolean startSystemServer = false;
           String socketName = "zygote";
           String abiList = null;
           for (int i = 1; i < argv.length; i++) {
               if ("start-system-server".equals(argv[i])) {
                   startSystemServer = true;
               } else if (argv[i].startsWith(ABI_LIST_ARG)) {
                   abiList = argv[i].substring(ABI_LIST_ARG.length());
               } else if (argv[i].startsWith(SOCKET_NAME_ARG)) {
                   socketName = argv[i].substring(SOCKET_NAME_ARG.length());
               } else {
                   throw new RuntimeException("Unknown command line argument: " + argv[i]);
               }
           }
           if (abiList == null) {
               throw new RuntimeException("No ABI list supplied.");
           }
           // 向Zygote注册Socket
           registerZygoteSocket(socketName);
           EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
               SystemClock.uptimeMillis());
           // 预加载类和资源等
           preload();
           EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
               SystemClock.uptimeMillis());
           // 抽样分析器写入Zygote快照
           SamplingProfilerIntegration.writeZygoteSnapshot();
           // GC
           gcAndFinalize();
           Trace.setTracingEnabled(false);
           // 启动SystemServer
           if (startSystemServer) {
               startSystemServer(abiList, socketName);
           }
           Log.i(TAG, "Accepting command socket connections");
           // 进入循环模式
           runSelectLoop(abiList);
           closeServerSocket();
       } catch (MethodAndArgsCaller caller) {
           caller.run();
       } catch (RuntimeException ex) {
           Log.e(TAG, "Zygote died with exception", ex);
           closeServerSocket();
           throw ex;
       }
   }

ZygoteInit初始化操作包括以下几点

注册ZygoteSocket
预加载资源
启动SystemServer
进入轮询状态

ZygoteInit.registerZygoteSocket

ZygoteInit.registerZygoteSocket => /frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

private static void registerZygoteSocket(String socketName) {
        if (sServerSocket == null) {
            int fileDesc;
            final String fullSocketName = ANDROID_SOCKET_PREFIX + socketName;
            try {
                String env = System.getenv(fullSocketName);
                fileDesc = Integer.parseInt(env);
            } catch (RuntimeException ex) {
                throw new RuntimeException(fullSocketName + " unset or invalid", ex);
            }
            try {
                FileDescriptor fd = new FileDescriptor();
                fd.setInt$(fileDesc);
                sServerSocket = new LocalServerSocket(fd);
            } catch (IOException ex) {
                throw new RuntimeException(
                        "Error binding to local socket '" + fileDesc + "'", ex);
            }
        }
}

ZygoteInit.registerZygoteSocket方法主要作用就是通过LocalSocket与Zygote的Socket服务端建立联系.

ZygoteInit.preload

ZygoteInit.preload => /frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

static void preload() {
       Log.d(TAG, "begin preload");
       // 预加载位于"/system/etc/preloaded-classes"文件中的类 
       // 源码位于"frameworks/base/preloaded-classes"
       preloadClasses();  
       // 预加载资源，包含drawable和color资源
       preloadResources();  
       // 预加载OpenGL
       preloadOpenGL();  
       // 预加载"android","compiler_rt","jnigraphics"这3个共享库
       preloadSharedLibraries();
       // 预加载文本自动断字资源
       preloadTextResources();
       // 预加载WebView,为Chromium动态库预保留加载地址。
       WebViewFactory.prepareWebViewInZygote();
       Log.d(TAG, "end preload");
   }

ZygoteInit.preload主要是对系统资源做一些预加载操作.

ZygoteInit.startSystemServer

ZygoteInit.startSystemServer => /frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

private static boolean startSystemServer(String abiList, String socketName)
            throws MethodAndArgsCaller, RuntimeException {
        long capabilities = posixCapabilitiesAsBits(
            OsConstants.CAP_BLOCK_SUSPEND,
            OsConstants.CAP_KILL,
            OsConstants.CAP_NET_ADMIN,
            OsConstants.CAP_NET_BIND_SERVICE,
            OsConstants.CAP_NET_BROADCAST,
            OsConstants.CAP_NET_RAW,
            OsConstants.CAP_SYS_MODULE,
            OsConstants.CAP_SYS_NICE,
            OsConstants.CAP_SYS_RESOURCE,
            OsConstants.CAP_SYS_TIME,
            OsConstants.CAP_SYS_TTY_CONFIG
        );
        /* 启动系统服务器的硬编码命令行 */
        String args[] = {
            "--setuid=1000",
            "--setgid=1000",
            "--setgroups=1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1018,1021,1032,3001,3002,3003,3006,3007",
            "--capabilities=" + capabilities + "," + capabilities,
            "--nice-name=system_server",
            "--runtime-args",
            "com.android.server.SystemServer",
        };
        ZygoteConnection.Arguments parsedArgs = null;
        int pid;
        try {
            parsedArgs = new ZygoteConnection.Arguments(args);
            ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
            ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);
            // 请求fork"system server"进程 
            pid = Zygote.forkSystemServer(
                    parsedArgs.uid, parsedArgs.gid,
                    parsedArgs.gids,
                    parsedArgs.debugFlags,
                    null,
                    parsedArgs.permittedCapabilities,
                    parsedArgs.effectiveCapabilities);
        } catch (IllegalArgumentException ex) {
            throw new RuntimeException(ex);
        }
        // 进入子进程
        if (pid == 0) {
            // 如果有第二个进程,等待第二个进程完成
            if (hasSecondZygote(abiList)) {
                waitForSecondaryZygote(socketName);
            }
            // 完成剩下的工作,见handleSystemServerProcess小节.
            handleSystemServerProcess(parsedArgs);
        }
        return true;
    }

ZygoteInit.startSystemServer的主要作用是fork出SystemServer所需要的进程,同时如果有第二个进程的话等待第二个进程完成之后调用ZygoteInit.handleSystemServerProcess去处理具体细节.

ZygoteInit.handleSystemServerProcess

ZygoteInit.handleSystemServerProcess => /frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

"" private static void handleSystemServerProcess(
            ZygoteConnection.Arguments parsedArgs)
            throws ZygoteInit.MethodAndArgsCaller {
        // 通过fork复制了zygote中的socket服务端,这里关闭了复制过来的socket.
        closeServerSocket();
        // 修改umask为0077,默认获取所有权限
        Os.umask(S_IRWXG | S_IRWXO);
        if (parsedArgs.niceName != null) {
            // 设置当前进程名为"system_server"
            Process.setArgV0(parsedArgs.niceName);
        }
        // 获取SystemServer的环境变量
        final String systemServerClasspath = Os.getenv("SYSTEMSERVERCLASSPATH");
        if (systemServerClasspath != null) {
            // 对jar包进行优化
            performSystemServerDexOpt(systemServerClasspath);
        }
        // zygote启动参数不包含"--invoke-with",走false
        if (parsedArgs.invokeWith != null) {
            String[] args = parsedArgs.remainingArgs;
            // 如果系统服务器类路径为非空，则必须复制现有参数，并将类路径追加到它。
            // 当我们执行一个新进程时，ART将正确地处理类路径。
            if (systemServerClasspath != null) {
                String[] amendedArgs = new String[args.length + 2];
                amendedArgs[0] = "-cp";
                amendedArgs[1] = systemServerClasspath;
                System.arraycopy(parsedArgs.remainingArgs, 0, amendedArgs, 2, parsedArgs.remainingArgs.length);
            }
            WrapperInit.execApplication(parsedArgs.invokeWith,
                    parsedArgs.niceName, parsedArgs.targetSdkVersion,
                    VMRuntime.getCurrentInstructionSet(), null, args);
        } else {
            // 给当前线程设置ClassLoader.
            ClassLoader cl = null;
            if (systemServerClasspath != null) {
                cl = new PathClassLoader(systemServerClasspath, ClassLoader.getSystemClassLoader());
                Thread.currentThread().setContextClassLoader(cl);
            }
            // 将其余参数传递给SystemServer。
            // "parsedArgs.remainingArgs" 的值为 "com.android.server.SystemServer"
            RuntimeInit.zygoteInit(parsedArgs.targetSdkVersion, parsedArgs.remainingArgs, cl);
        }
        /* 不应该到达这里 */
    }

ZygoteInit.handleSystemServerProcess的主要作用是通过RuntimeInit.zygoteInit方法最终调用Runtime.invokeStaticMain方法,通过抛出一个ZygoteInit.MethodAndArgsCaller异常,清除调用栈,之后调用SystemServer的main函数.

ZygoteInit.runSelectLoop

ZygoteInit.runSelectLoop => /frameworks/base/core/java/com/android/internal/os/ZygoteInit.java

private static void runSelectLoop(String abiList) throws MethodAndArgsCaller {
      ArrayList<FileDescriptor> fds = new ArrayList<FileDescriptor>();
      ArrayList<ZygoteConnection> peers = new ArrayList<ZygoteConnection>();
      // sServerSocket是Zygote进程的socket服务端.
      fds.add(sServerSocket.getFileDescriptor());
      peers.add(null);
      // 进入轮询状态
      while (true) {
          StructPollfd[] pollFds = new StructPollfd[fds.size()];
          for (int i = 0; i < pollFds.length; ++i) {
              pollFds[i] = new StructPollfd();
              pollFds[i].fd = fds.get(i);
              pollFds[i].events = (short) POLLIN;
          }
          try {
              // 如果pollFds有事件继续执行,否则阻塞
              Os.poll(pollFds, -1);
          } catch (ErrnoException ex) {
              throw new RuntimeException("poll failed", ex);
          }
          for (int i = pollFds.length - 1; i >= 0; --i) {
              // 采用I/O多路复用机制,有事件向下执行,否则跳出本次循环
              if ((pollFds[i].revents & POLLIN) == 0) {
                  continue;
              }
              if (i == 0) {
                  // 新的连接添加到集合
                  ZygoteConnection newPeer = acceptCommandPeer(abiList);
                  peers.add(newPeer);
                  fds.add(newPeer.getFileDesciptor());
              } else {
                  // 如果不需要继续处理,返回true
                  boolean done = peers.get(i).runOnce();
                  if (done) {
                       // 将已经完成的连接移出集合
                      peers.remove(i);
                      fds.remove(i);
                  }
              }
          }
      }
  }

ZygoteInit.runSelectLoop的主要作用是进入轮询中,监听和接收ZygoteSocket发过来的消息.

SystemServer

SystemServer是Android系统的核心之一,大部分Android提供的服务都在这个进程中. 在system_server进程中一共运行着60多种服务. 为了防止对系统的破坏,Android中的应用程序无法直接访问底层,只能通过SystemService中的代理访问. 其中又使用到了Binder机制.

SystemServer.main

SystemServer => /frameworks/base/services/java/com/android/server/SystemServer.java

1
2
3

public static void main(String[] args) {
    new SystemServer().run();
}

private void run() {
        // 修复时间
        if (System.currentTimeMillis() < EARLIEST_SUPPORTED_TIME) {
            Slog.w(TAG, "System clock is before 1970; setting to 1970.");
            SystemClock.setCurrentTimeMillis(EARLIEST_SUPPORTED_TIME);
        }
        // 设置默认语言配置
        if (!SystemProperties.get("persist.sys.language").isEmpty()) {
            final String languageTag = Locale.getDefault().toLanguageTag();
            SystemProperties.set("persist.sys.locale", languageTag);
            SystemProperties.set("persist.sys.language", "");
            SystemProperties.set("persist.sys.country", "");
            SystemProperties.set("persist.sys.localevar", "");
        }
        // Here we go!
        Slog.i(TAG, "Entered the Android system server!");
        EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_SYSTEM_RUN, SystemClock.uptimeMillis());
        // 设置当前虚拟机的运行库路径，5.0以后是libart.so
        SystemProperties.set("persist.sys.dalvik.vm.lib.2", VMRuntime.getRuntime().vmLibrary());
        // 如果开启了性能分析标志，则开启性能分析
        if (SamplingProfilerIntegration.isEnabled()) {
            SamplingProfilerIntegration.start();
            mProfilerSnapshotTimer = new Timer();
            mProfilerSnapshotTimer.schedule(new TimerTask() {
                @Override
                public void run() {
                    SamplingProfilerIntegration.writeSnapshot("system_server", null);
                }
            }, SNAPSHOT_INTERVAL, SNAPSHOT_INTERVAL);
        }
        // 虚拟机配置
        VMRuntime.getRuntime().clearGrowthLimit();
        VMRuntime.getRuntime().setTargetHeapUtilization(0.8f);
        // 有些设备依赖于运行时指纹生成，因此请确保在进一步启动之前，我们已经定义了它。
        Build.ensureFingerprintProperty();
        // 设置访问环境变量的条件，即需要明确指定用户。
        Environment.setUserRequired(true);
        // 确保对系统的绑定器调用始终以前台优先级运行。
        BinderInternal.disableBackgroundScheduling(true);
        // 准备MainLopper.
        android.os.Process.setThreadPriority(
                android.os.Process.THREAD_PRIORITY_FOREGROUND);
        android.os.Process.setCanSelfBackground(false);
        Looper.prepareMainLooper();
        // Initialize native services.
        System.loadLibrary("android_servers");
        // 检查上次是否关机失败。此呼叫可能无法返回。
        performPendingShutdown();
        // Initialize the system context.
        createSystemContext();
        // Create the system service manager.
        mSystemServiceManager = new SystemServiceManager(mSystemContext);
        LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
        // Start services.
        try {
            // 启动boot服务
            startBootstrapServices();
            // 启动core服务
            startCoreServices();
            // 启动其他服务
            startOtherServices();
        } catch (Throwable ex) {
            Slog.e("System", "******************************************");
            Slog.e("System", "************ Failure starting system services", ex);
            throw ex;
        }
        // 对于调试生成，将事件循环暂停到dropbox进行分析。
        if (StrictMode.conditionallyEnableDebugLogging()) {
            Slog.i(TAG, "Enabled StrictMode for system server main thread.");
        }
        // 永远循环。
        Looper.loop();
        throw new RuntimeException("Main thread loop unexpectedly exited");
    }

SystemServer.run所做的工作如下:

调整时间，如果系统时间比1970还早，调整到1970
如果没有设置语言，则设置相应的语言
设置属性persist.sys.dalvik.vm.lib.2的值为当前虚拟机运行库路径
判断是否需要开启性能分析
调整虚拟机堆的内存
装载库libandroid_servers.so
创建SystemServiceManager的对象mSystemServiceManager,负责系统Service的管理
调用startBootstrapServices()、startCoreServices()和 startOtherServices()创建并运行所有Java服务
调用Loop.loop()，进入处理消息的循环

SystemServer.startBootstrapServices

启动一些关键服务，这些服务是使系统启动所必需的。而且这些服务具有相互复杂的关系,这也就是为什么要放在一起启动的原因. 用户新建的服务除非也缠绕在这些依赖项中，否则它应该在其他函数中初始化。

SystemServerstartBootstrapServices => /frameworks/base/services/java/com/android/server/SystemServer.java

private void startBootstrapServices() {
      // 初始化 Installer
      Installer installer = mSystemServiceManager.startService(Installer.class);
      // 初始化 ActivityManagerService
      mActivityManagerService = mSystemServiceManager.startService(
              ActivityManagerService.Lifecycle.class).getService();
      mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
      mActivityManagerService.setInstaller(installer);
      // 初始化 PowerManagerService
      mPowerManagerService = mSystemServiceManager.startService(PowerManagerService.class);
      // ActivityManagerService与PowerManagerService绑定
      mActivityManagerService.initPowerManagement();
      // 初始化 LightsService
      mSystemServiceManager.startService(LightsService.class);
      // 初始化 DisplayManagerService
      mDisplayManagerService = mSystemServiceManager.startService(DisplayManagerService.class);
      // 设置启动阶段 100
      mSystemServiceManager.startBootPhase(SystemService.PHASE_WAIT_FOR_DEFAULT_DISPLAY);
      // 只有在加密设备的情况下才能运行“core”应用程序。
      String cryptState = SystemProperties.get("vold.decrypt");
      if (ENCRYPTING_STATE.equals(cryptState)) {
          Slog.w(TAG, "Detected encryption in progress - only parsing core apps");
          mOnlyCore = true;
      } else if (ENCRYPTED_STATE.equals(cryptState)) {
          Slog.w(TAG, "Device encrypted - only parsing core apps");
          mOnlyCore = true;
      }
      // 初始化 PackageManagerService
      Slog.i(TAG, "Package Manager");
      mPackageManagerService = PackageManagerService.main(mSystemContext, installer,
              mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore);
      mFirstBoot = mPackageManagerService.isFirstBoot();
      mPackageManager = mSystemContext.getPackageManager();
      // 初始化 UserManagerService
      Slog.i(TAG, "User Service");
      ServiceManager.addService(Context.USER_SERVICE, UserManagerService.getInstance());
      // 初始化用于缓存包中资源的属性缓存。
      AttributeCache.init(mSystemContext);
      // 为系统进程设置应用程序实例并开始。
      // 通过AMS启动其他相关的系统服务.
      mActivityManagerService.setSystemProcess();
      // 传感器服务需要访问包管理器服务AppOps服务和权限服务，因此我们在它们之后启动它。
      startSensorService();
  }

SystemServer.startCoreServices

启动一些在引导过程中不会被缠住的基本服务。

SystemServerstartCoreServices => /frameworks/base/services/java/com/android/server/SystemServer.java

private void startCoreServices() {
    // 跟踪电池电量。需要LightService。
    mSystemServiceManager.startService(BatteryService.class);
    // 跟踪应用程序使用情况统计。
    mSystemServiceManager.startService(UsageStatsService.class);
    // 在AMS中设置UsageStatsManagerInternal服务.
    mActivityManagerService.setUsageStatsManager( LocalServices.getService(UsageStatsManagerInternal.class));
     // Update after UsageStatsService is available, needed before performBootDexOpt.
     mPackageManagerService.getUsageStatsIfNoPackageUsageInfo();
    // 跟踪可更新的WebView是否处于就绪状态，并监视更新安装。
     mSystemServiceManager.startService(WebViewUpdateService.class);
}

SystemServer.startOtherServices

启动其他的一些服务,代码很长,但是都是重复的代码.

SystemServerstartOtherServices => /frameworks/base/services/java/com/android/server/SystemServer.java

private void startOtherServices() {
        final Context context = mSystemContext;
        AccountManagerService accountManager = null;
        ContentService contentService = null;
        VibratorService vibrator = null;
        IAlarmManager alarm = null;
        IMountService mountService = null;
        NetworkManagementService networkManagement = null;
        NetworkStatsService networkStats = null;
        NetworkPolicyManagerService networkPolicy = null;
        ConnectivityService connectivity = null;
        NetworkScoreService networkScore = null;
        NsdService serviceDiscovery= null;
        WindowManagerService wm = null;
        UsbService usb = null;
        SerialService serial = null;
        NetworkTimeUpdateService networkTimeUpdater = null;
        CommonTimeManagementService commonTimeMgmtService = null;
        InputManagerService inputManager = null;
        TelephonyRegistry telephonyRegistry = null;
        ConsumerIrService consumerIr = null;
        AudioService audioService = null;
        MmsServiceBroker mmsService = null;
        EntropyMixer entropyMixer = null;
        CameraService cameraService = null;
        // 获取相应的属性
        boolean disableStorage = SystemProperties.getBoolean("config.disable_storage", false);
        boolean disableBluetooth = SystemProperties.getBoolean("config.disable_bluetooth", false);
        boolean disableLocation = SystemProperties.getBoolean("config.disable_location", false);
        boolean disableSystemUI = SystemProperties.getBoolean("config.disable_systemui", false);
        boolean disableNonCoreServices = SystemProperties.getBoolean("config.disable_noncore", false);
        boolean disableNetwork = SystemProperties.getBoolean("config.disable_network", false);
        boolean disableNetworkTime = SystemProperties.getBoolean("config.disable_networktime", false);
        boolean isEmulator = SystemProperties.get("ro.kernel.qemu").equals("1");
        try {
            Slog.i(TAG, "Reading configuration...");
            SystemConfig.getInstance();
            Slog.i(TAG, "Scheduling Policy");
             // 添加调度策略服务
            ServiceManager.addService("scheduling_policy", new SchedulingPolicyService());
            // 开启通话逻辑控制服务，用于加载Telecom
            mSystemServiceManager.startService(TelecomLoaderService.class);
            Slog.i(TAG, "Telephony Registry");
            // 添加电话注册服务
            telephonyRegistry = new TelephonyRegistry(context);
            ServiceManager.addService("telephony.registry", telephonyRegistry);
            // 生成随机数的一个东西.
            Slog.i(TAG, "Entropy Mixer");
            entropyMixer = new EntropyMixer(context);
            // 获取context解析器
            mContentResolver = context.getContentResolver();
            // 启动相机服务
            Slog.i(TAG, "Camera Service");
            mSystemServiceManager.startService(CameraService.class);
            // The AccountManager must come before the ContentService
            try {
                // TODO: seems like this should be disable-able, but req'd by ContentService
                Slog.i(TAG, "Account Manager");
                // 创建账户服务,并且添加到ServiceManager中.
                accountManager = new AccountManagerService(context);
                ServiceManager.addService(Context.ACCOUNT_SERVICE, accountManager);
            } catch (Throwable e) {
                Slog.e(TAG, "Failure starting Account Manager", e);
            }
            Slog.i(TAG, "Content Manager");
            contentService = ContentService.main(context,
                    mFactoryTestMode == FactoryTest.FACTORY_TEST_LOW_LEVEL);
            // 启动ContentProvider
            Slog.i(TAG, "System Content Providers");
            mActivityManagerService.installSystemProviders();
            // 震动服务
            Slog.i(TAG, "Vibrator Service");
            vibrator = new VibratorService(context);
            ServiceManager.addService("vibrator", vibrator);
            // 远程控制服务
            Slog.i(TAG, "Consumer IR Service");
            consumerIr = new ConsumerIrService(context);
            ServiceManager.addService(Context.CONSUMER_IR_SERVICE, consumerIr);
            // 闹铃服务
            mSystemServiceManager.startService(AlarmManagerService.class);
            alarm = IAlarmManager.Stub.asInterface(
                    ServiceManager.getService(Context.ALARM_SERVICE));
            // 获取Watchedog对象初始化
            Slog.i(TAG, "Init Watchdog");
            final Watchdog watchdog = Watchdog.getInstance();
            watchdog.init(context, mActivityManagerService);
            // 输入服务
            Slog.i(TAG, "Input Manager");
            inputManager = new InputManagerService(context);
            // 启动WMS服务
            Slog.i(TAG, "Window Manager");
            wm = WindowManagerService.main(context, inputManager,
                    mFactoryTestMode != FactoryTest.FACTORY_TEST_LOW_LEVEL,
                    !mFirstBoot, mOnlyCore);
            ServiceManager.addService(Context.WINDOW_SERVICE, wm);
            ServiceManager.addService(Context.INPUT_SERVICE, inputManager);
            // 将AMS与WMS绑定
            mActivityManagerService.setWindowManager(wm);
            // 输入服务添加窗口改变监听
            inputManager.setWindowManagerCallbacks(wm.getInputMonitor());
            inputManager.start();
            // 调用WMS刷新UI
            // TODO: Use service dependencies instead.
            mDisplayManagerService.windowManagerAndInputReady();
            // Skip Bluetooth if we have an emulator kernel
            // TODO: Use a more reliable check to see if this product should
            // support Bluetooth - see bug 988521
            // 蓝牙开机逻辑判断
            if (isEmulator) {
                // 模拟器不打开
                Slog.i(TAG, "No Bluetooh Service (emulator)");
            } else if (mFactoryTestMode == FactoryTest.FACTORY_TEST_LOW_LEVEL) {
                // 工厂测试模式不打开
                Slog.i(TAG, "No Bluetooth Service (factory test)");
            } else if (!context.getPackageManager().hasSystemFeature
                       (PackageManager.FEATURE_BLUETOOTH)) {
                // 没有蓝牙设备不打开
                Slog.i(TAG, "No Bluetooth Service (Bluetooth Hardware Not Present)");
            } else if (disableBluetooth) {
                // 禁用蓝牙不打开
                Slog.i(TAG, "Bluetooth Service disabled by config");
            } else {
                // 否则启动蓝牙服务
                Slog.i(TAG, "Bluetooth Service");
                mSystemServiceManager.startService(BluetoothService.class);
            }
        } catch (RuntimeException e) {
            Slog.e("System", "******************************************");
            Slog.e("System", "************ Failure starting core service", e);
        }

        StatusBarManagerService statusBar = null;
        INotificationManager notification = null;
        InputMethodManagerService imm = null;
        WallpaperManagerService wallpaper = null;
        LocationManagerService location = null;
        CountryDetectorService countryDetector = null;
        TextServicesManagerService tsms = null;
        LockSettingsService lockSettings = null;
        AssetAtlasService atlas = null;
        MediaRouterService mediaRouter = null;

        // Bring up services needed for UI.
        // 如果不是工厂测试模式的话打开以下服务.(工厂模式不需要这些服务)
        if (mFactoryTestMode != FactoryTest.FACTORY_TEST_LOW_LEVEL) {
            try {
                // 输入法服务
                Slog.i(TAG, "Input Method Service");
                imm = new InputMethodManagerService(context, wm);
                ServiceManager.addService(Context.INPUT_METHOD_SERVICE, imm);
            } catch (Throwable e) {
                reportWtf("starting Input Manager Service", e);
            }
            try {
                // 访问管理器服务
                Slog.i(TAG, "Accessibility Manager");
                ServiceManager.addService(Context.ACCESSIBILITY_SERVICE,
                        new AccessibilityManagerService(context));
            } catch (Throwable e) {
                reportWtf("starting Accessibility Manager", e);
            }
        }

        try {
            // 准备显示
            wm.displayReady();
        } catch (Throwable e) {
            reportWtf("making display ready", e);
        }

        if (mFactoryTestMode != FactoryTest.FACTORY_TEST_LOW_LEVEL) {
            if (!disableStorage &&
                !"0".equals(SystemProperties.get("system_init.startmountservice"))) {
                try {
                    // NotificationManagerService依赖于MountService，
                    // (用于媒体/usb通知）因此我们必须首先启动MountService。
                    mSystemServiceManager.startService(MOUNT_SERVICE_CLASS);
                    mountService = IMountService.Stub.asInterface(
                            ServiceManager.getService("mount"));
                } catch (Throwable e) {
                    reportWtf("starting Mount Service", e);
                }
            }
        }

        // 启动UI管理模式，即夜间模式和行车模式
        mSystemServiceManager.startService(UiModeManagerService.class);

        try {
            // 进行dex优化
            mPackageManagerService.performBootDexOpt();
        } catch (Throwable e) {
            reportWtf("performing boot dexopt", e);
        }

        try {
            // 显示启动界面 ("正在启动应用")
            ActivityManagerNative.getDefault().showBootMessage(
                    context.getResources().getText(
                            com.android.internal.R.string.android_upgrading_starting_apps),
                    false);
        } catch (RemoteException e) {
        }

        if (mFactoryTestMode != FactoryTest.FACTORY_TEST_LOW_LEVEL) {
            if (!disableNonCoreServices) {
                try {
                    // 创建锁屏图案密码服务 
                    Slog.i(TAG,  "LockSettingsService");
                    lockSettings = new LockSettingsService(context);
                    ServiceManager.addService("lock_settings", lockSettings);
                } catch (Throwable e) {
                    reportWtf("starting LockSettingsService service", e);
                }
                if (!SystemProperties.get(PERSISTENT_DATA_BLOCK_PROP).equals("")) {
                    // 启动回复出厂设置的数据保存服务
                    mSystemServiceManager.startService(PersistentDataBlockService.class);
                }
                // 启动设备空闲控制器，在Android 6.0上power改动比较大
                // 粗略的看PowerManagerService感觉变动不大，
                // 只是在PowerManagerService的改动代码比较少，
                // 但是其是指改动比较大，特比增加了这个DeviceIdleController，来控制设备的Idle状态，
                // 当设备在idle状态时，它会忽略CPU的wakelock，Alarm等。     
                mSystemServiceManager.startService(DeviceIdleController.class);
                // 开启 设备配置管理服务
                mSystemServiceManager.startService(DevicePolicyManagerService.Lifecycle.class);
            }

            if (!disableSystemUI) {
                try {
                    // 状态栏服务
                    Slog.i(TAG, "Status Bar");
                    statusBar = new StatusBarManagerService(context, wm);
                    ServiceManager.addService(Context.STATUS_BAR_SERVICE, statusBar);
                } catch (Throwable e) {
                    reportWtf("starting StatusBarManagerService", e);
                }
            }

            if (!disableNonCoreServices) {
                try {
                    // 剪切板服务
                    Slog.i(TAG, "Clipboard Service");
                    ServiceManager.addService(Context.CLIPBOARD_SERVICE,
                            new ClipboardService(context));
                } catch (Throwable e) {
                    reportWtf("starting Clipboard Service", e);
                }
            }

            if (!disableNetwork) {
                try {
                    // 网络管理服务
                    Slog.i(TAG, "NetworkManagement Service");
                    networkManagement = NetworkManagementService.create(context);
                    ServiceManager.addService(Context.NETWORKMANAGEMENT_SERVICE, networkManagement);
                } catch (Throwable e) {
                    reportWtf("starting NetworkManagement Service", e);
                }
            }

            if (!disableNonCoreServices) {
                try {
                    // 提供拼写和检查的文本服务
                    Slog.i(TAG, "Text Service Manager Service");
                    tsms = new TextServicesManagerService(context);
                    ServiceManager.addService(Context.TEXT_SERVICES_MANAGER_SERVICE, tsms);
                } catch (Throwable e) {
                    reportWtf("starting Text Service Manager Service", e);
                }
            }

            if (!disableNetwork) {
                try {
                    // 网络通信记录服务
                    Slog.i(TAG, "Network Score Service");
                    networkScore = new NetworkScoreService(context);
                    ServiceManager.addService(Context.NETWORK_SCORE_SERVICE, networkScore);
                } catch (Throwable e) {
                    reportWtf("starting Network Score Service", e);
                }

                try {
                    // 网络连接状态服务
                    Slog.i(TAG, "NetworkStats Service");
                    networkStats = new NetworkStatsService(context, networkManagement, alarm);
                    ServiceManager.addService(Context.NETWORK_STATS_SERVICE, networkStats);
                } catch (Throwable e) {
                    reportWtf("starting NetworkStats Service", e);
                }

                try {
                    // 网络策略管理服务
                    Slog.i(TAG, "NetworkPolicy Service");
                    networkPolicy = new NetworkPolicyManagerService(
                            context, mActivityManagerService,
                            (IPowerManager)ServiceManager.getService(Context.POWER_SERVICE),
                            networkStats, networkManagement);
                    ServiceManager.addService(Context.NETWORK_POLICY_SERVICE, networkPolicy);
                } catch (Throwable e) {
                    reportWtf("starting NetworkPolicy Service", e);
                }
                // 开启wifi相关服务
                mSystemServiceManager.startService(WIFI_P2P_SERVICE_CLASS);
                mSystemServiceManager.startService(WIFI_SERVICE_CLASS);
                mSystemServiceManager.startService(
                            "com.android.server.wifi.WifiScanningService");
                mSystemServiceManager.startService("com.android.server.wifi.RttService");
                // 以太网服务
                if (mPackageManager.hasSystemFeature(PackageManager.FEATURE_ETHERNET) ||
                    mPackageManager.hasSystemFeature(PackageManager.FEATURE_USB_HOST)) {
                    mSystemServiceManager.startService(ETHERNET_SERVICE_CLASS);
                }
                try {
                    // 网络连接管理服务
                    Slog.i(TAG, "Connectivity Service");
                    connectivity = new ConnectivityService(
                            context, networkManagement, networkStats, networkPolicy);
                    ServiceManager.addService(Context.CONNECTIVITY_SERVICE, connectivity);
                    networkStats.bindConnectivityManager(connectivity);
                    networkPolicy.bindConnectivityManager(connectivity);
                } catch (Throwable e) {
                    reportWtf("starting Connectivity Service", e);
                }

                try {
                     // 创建并注册NsdService服务，它是基于苹果的Bonjour服务发现协议，提供远程服务的发现和零配置功能的服务
                    Slog.i(TAG, "Network Service Discovery Service");
                    serviceDiscovery = NsdService.create(context);
                    ServiceManager.addService(
                            Context.NSD_SERVICE, serviceDiscovery);
                } catch (Throwable e) {
                    reportWtf("starting Service Discovery Service", e);
                }
            }

            if (!disableNonCoreServices) {
                try {
                    // UpdateLockService  更新锁服务
                    Slog.i(TAG, "UpdateLock Service");
                    ServiceManager.addService(Context.UPDATE_LOCK_SERVICE,
                            new UpdateLockService(context));
                } catch (Throwable e) {
                    reportWtf("starting UpdateLockService", e);
                }
            }

            /*
             * MountService has a few dependencies: Notification Manager and
             * AppWidget Provider. Make sure MountService is completely started
             * first before continuing.
             * MountService有几个依赖项：Notification Manager和AppWidget Provider。
             * 继续之前，请确保MountService已完全启动。
             */
            if (mountService != null && !mOnlyCore) {
                try {
                    mountService.waitForAsecScan();
                } catch (RemoteException ignored) {
                }
            }

            try {
                // 客户经理服务
                // 为所有用户提供帐户、密码和authtoken管理的系统服务设备上的帐户
                if (accountManager != null)
                    accountManager.systemReady();
            } catch (Throwable e) {
                reportWtf("making Account Manager Service ready", e);
            }

            try {
                // 内容服务
                if (contentService != null)
                    contentService.systemReady();
            } catch (Throwable e) {
                reportWtf("making Content Service ready", e);
            }
            // 通知管理器服务
            mSystemServiceManager.startService(NotificationManagerService.class);
            notification = INotificationManager.Stub.asInterface(
                    ServiceManager.getService(Context.NOTIFICATION_SERVICE));
            networkPolicy.bindNotificationManager(notification);
            // 磁盘空间状态检测服务
            mSystemServiceManager.startService(DeviceStorageMonitorService.class);

            if (!disableLocation) {
                try {
                    // 定位服务
                    Slog.i(TAG, "Location Manager");
                    location = new LocationManagerService(context);
                    ServiceManager.addService(Context.LOCATION_SERVICE, location);
                } catch (Throwable e) {
                    reportWtf("starting Location Manager", e);
                }

                try {
                    // 检测用户国家
                    Slog.i(TAG, "Country Detector");
                    countryDetector = new CountryDetectorService(context);
                    ServiceManager.addService(Context.COUNTRY_DETECTOR, countryDetector);
                } catch (Throwable e) {
                    reportWtf("starting Country Detector", e);
                }
            }

            if (!disableNonCoreServices) {
                try {
                    // 搜索管理服务
                    Slog.i(TAG, "Search Service");
                    ServiceManager.addService(Context.SEARCH_SERVICE,
                            new SearchManagerService(context));
                } catch (Throwable e) {
                    reportWtf("starting Search Service", e);
                }
            }

            try {
                // 系统运行时日志的存储与管理
                Slog.i(TAG, "DropBox Service");
                ServiceManager.addService(Context.DROPBOX_SERVICE,
                        new DropBoxManagerService(context, new File("/data/system/dropbox")));
            } catch (Throwable e) {
                reportWtf("starting DropBoxManagerService", e);
            }

            if (!disableNonCoreServices && context.getResources().getBoolean(
                        R.bool.config_enableWallpaperService)) {
                try {
                    // 壁纸管理服务
                    Slog.i(TAG, "Wallpaper Service");
                    wallpaper = new WallpaperManagerService(context);
                    ServiceManager.addService(Context.WALLPAPER_SERVICE, wallpaper);
                } catch (Throwable e) {
                    reportWtf("starting Wallpaper Service", e);
                }
            }

            try {
                // AudioService，用于AudioFlinger的上层管理封装，主要是音量、音效及铃声等的管理开启
                Slog.i(TAG, "Audio Service");
                audioService = new AudioService(context);
                ServiceManager.addService(Context.AUDIO_SERVICE, audioService);
            } catch (Throwable e) {
                reportWtf("starting Audio Service", e);
            }

            if (!disableNonCoreServices) {
                // 开启DockObserver，如果设备有一个座子，管理当手机装上或者拔出这个座子的状态
                mSystemServiceManager.startService(DockObserver.class);
            }

            try {
                // 开启WiredAccessoryManager，用于检测手机的耳机
                Slog.i(TAG, "Wired Accessory Manager");
                // Listen for wired headset changes
                inputManager.setWiredAccessoryCallbacks(
                        new WiredAccessoryManager(context, inputManager));
            } catch (Throwable e) {
                reportWtf("starting WiredAccessoryManager", e);
            }

            if (!disableNonCoreServices) {
                // MIDI服务，
                if (mPackageManager.hasSystemFeature(PackageManager.FEATURE_MIDI)) {
                    // Start MIDI Manager service
                    mSystemServiceManager.startService(MIDI_SERVICE_CLASS);
                }
                // USB服务
                if (mPackageManager.hasSystemFeature(PackageManager.FEATURE_USB_HOST)
                        || mPackageManager.hasSystemFeature(
                                PackageManager.FEATURE_USB_ACCESSORY)) {
                    // Manage USB host and device support
                    mSystemServiceManager.startService(USB_SERVICE_CLASS);
                }

                try {
                    // 串口服务
                    Slog.i(TAG, "Serial Service");
                    // Serial port support
                    serial = new SerialService(context);
                    ServiceManager.addService(Context.SERIAL_SERVICE, serial);
                } catch (Throwable e) {
                    Slog.e(TAG, "Failure starting SerialService", e);
                }
            }
            // 黄昏服务，用来检测用户所在位置是否为晚上，被UiModeManager等用来调整夜间模式
            mSystemServiceManager.startService(TwilightService.class);
            // 工作调度服务
            mSystemServiceManager.startService(JobSchedulerService.class);

            if (!disableNonCoreServices) {
                // 备份服务
                if (mPackageManager.hasSystemFeature(PackageManager.FEATURE_BACKUP)) {
                    mSystemServiceManager.startService(BACKUP_MANAGER_SERVICE_CLASS);
                }
                // AppWidgetService
                if (mPackageManager.hasSystemFeature(PackageManager.FEATURE_APP_WIDGETS)) {
                    mSystemServiceManager.startService(APPWIDGET_SERVICE_CLASS);
                }
                // 语音识别服务
                if (mPackageManager.hasSystemFeature(PackageManager.FEATURE_VOICE_RECOGNIZERS)) {
                    mSystemServiceManager.startService(VOICE_RECOGNITION_MANAGER_SERVICE_CLASS);
                }
            }

            try {
                // 磁盘状态服务
                Slog.i(TAG, "DiskStats Service");
                ServiceManager.addService("diskstats", new DiskStatsService(context));
            } catch (Throwable e) {
                reportWtf("starting DiskStats Service", e);
            }

            try {
                // need to add this service even if SamplingProfilerIntegration.isEnabled()
                // is false, because it is this service that detects system property change and
                // turns on SamplingProfilerIntegration. Plus, when sampling profiler doesn't work,
                // there is little overhead for running this service.
                // 耗时统计服务
                Slog.i(TAG, "SamplingProfiler Service");
                ServiceManager.addService("samplingprofiler",
                            new SamplingProfilerService(context));
            } catch (Throwable e) {
                reportWtf("starting SamplingProfiler Service", e);
            }

            if (!disableNetwork && !disableNetworkTime) {
                try {
                    // 网络时间更新服务，当网络时间变化时更新本地时间。
                    Slog.i(TAG, "NetworkTimeUpdateService");
                    networkTimeUpdater = new NetworkTimeUpdateService(context);
                } catch (Throwable e) {
                    reportWtf("starting NetworkTimeUpdate service", e);
                }
            }

            try {
                // 常见时间管理服务,用来管理本地时间
                Slog.i(TAG, "CommonTimeManagementService");
                commonTimeMgmtService = new CommonTimeManagementService(context);
                ServiceManager.addService("commontime_management", commonTimeMgmtService);
            } catch (Throwable e) {
                reportWtf("starting CommonTimeManagementService service", e);
            }

            if (!disableNetwork) {
                try {
                    // 创建 CertBlacklister，CertBlacklister提供了一个简单的机制来更新SSL证书公钥和序列号的平台黑名单  
                    Slog.i(TAG, "CertBlacklister");
                    CertBlacklister blacklister = new CertBlacklister(context);
                } catch (Throwable e) {
                    reportWtf("starting CertBlacklister", e);
                }
            }

            if (!disableNonCoreServices) {
                // Dreams (interactive idle-time views, a/k/a screen savers, and doze mode)
                // 屏幕保护服务
                mSystemServiceManager.startService(DreamManagerService.class);
            }

            if (!disableNonCoreServices) {
                try {
                    // AssetAtlas服务,用于将预加载bitmap组装成纹理贴图可以用来被跨进程使用，以减少内存
                    Slog.i(TAG, "Assets Atlas Service");
                    atlas = new AssetAtlasService(context);
                    ServiceManager.addService(AssetAtlasService.ASSET_ATLAS_SERVICE, atlas);
                } catch (Throwable e) {
                    reportWtf("starting AssetAtlasService", e);
                }
            }

            if (!disableNonCoreServices) {
                // GraphicsStatsService，负责收集汇总Android系统的渲染剖面数据(profile data)
                // 主要途径是通过允许渲染线程请求匿名共享存储缓冲(ashmem buffer)来存放它们统计信息来实现的。
                ServiceManager.addService(GraphicsStatsService.GRAPHICS_STATS_SERVICE,
                        new GraphicsStatsService(context));
            }

            if (mPackageManager.hasSystemFeature(PackageManager.FEATURE_PRINTING)) {
                // 打印服务
                mSystemServiceManager.startService(PRINT_MANAGER_SERVICE_CLASS);
            }
            // 限制管理器服务,负责查询管理用户限制的机制。因为APP可以向远程设备管理员发送权限请求
            mSystemServiceManager.startService(RestrictionsManagerService.class);
            // MediaSession服务,是MediaSession框架的管理服务
            mSystemServiceManager.startService(MediaSessionService.class);
            // Hdmi控制服务，负责HDMI
            if (mPackageManager.hasSystemFeature(PackageManager.FEATURE_HDMI_CEC)) {
                mSystemServiceManager.startService(HdmiControlService.class);
            }
            // TV输入管理服务，负责android TV
            if (mPackageManager.hasSystemFeature(PackageManager.FEATURE_LIVE_TV)) {
                mSystemServiceManager.startService(TvInputManagerService.class);
            }
            
            if (!disableNonCoreServices) {
                try {
                    //多媒体路由服务,负责多媒体路由(因为多媒体可能既有有线，也有无线等)
                    Slog.i(TAG, "Media Router Service");
                    mediaRouter = new MediaRouterService(context);
                    ServiceManager.addService(Context.MEDIA_ROUTER_SERVICE, mediaRouter);
                } catch (Throwable e) {
                    reportWtf("starting MediaRouterService", e);
                }
                // 信任管理器服务,管理信任证书  
                mSystemServiceManager.startService(TrustManagerService.class);
                // 指纹服务,负责指纹识别
                mSystemServiceManager.startService(FingerprintService.class);

                try {
                    // 启动JobSchedule 后台进行Dex优化
                    Slog.i(TAG, "BackgroundDexOptService");
                    BackgroundDexOptService.schedule(context, 0);
                } catch (Throwable e) {
                    reportWtf("starting BackgroundDexOptService", e);
                }

            }
            // LauncherApps服务,负责管理Launcher的请求和回调
            mSystemServiceManager.startService(LauncherAppsService.class);
        }

        if (!disableNonCoreServices) {
            // 媒体投影会话
            mSystemServiceManager.startService(MediaProjectionManagerService.class);
        }
    
        // Before things start rolling, be sure we have decided whether
        // we are in safe mode.
        // 安全模式
        final boolean safeMode = wm.detectSafeMode();
        if (safeMode) {
            mActivityManagerService.enterSafeMode();
            // Disable the JIT for the system_server process
            VMRuntime.getRuntime().disableJitCompilation();
        } else {
            // Enable the JIT for the system_server process
            VMRuntime.getRuntime().startJitCompilation();
        }

        // MMS service broker
        // MmsService 的代理，因为MmsService运行在电话进程中，可能随时crash，它会通过一个connection与MmsService 建立一个桥梁，MmsService实现了公开的 SMS/MMS 的API。
        mmsService = mSystemServiceManager.startService(MmsServiceBroker.class);

        // It is now time to start up the app processes...

        try {
            // 震动 已经准备完毕 
            vibrator.systemReady();
        } catch (Throwable e) {
            reportWtf("making Vibrator Service ready", e);
        }

        if (lockSettings != null) {
            try {
                // 图形锁屏服务准备完毕
                lockSettings.systemReady();
            } catch (Throwable e) {
                reportWtf("making Lock Settings Service ready", e);
            }
        }

        // Needed by DevicePolicyManager for initialization
        // stage 480
        mSystemServiceManager.startBootPhase(SystemService.PHASE_LOCK_SETTINGS_READY);
        // stage 500
        mSystemServiceManager.startBootPhase(SystemService.PHASE_SYSTEM_SERVICES_READY);

        try {
            // WMS 准备完成
            wm.systemReady();
        } catch (Throwable e) {
            reportWtf("making Window Manager Service ready", e);
        }

        if (safeMode) {
            // 显示安全模式覆盖层
            mActivityManagerService.showSafeModeOverlay();
        }

        // Update the configuration for this context by hand, because we're going
        // to start using it before the config change done in wm.systemReady() will
        // propagate to it.
        // 手动更新此上下文的配置，因为我们将在wm.systemReady（）中完成的配置更改传播到它之前开始使用它。
        Configuration config = wm.computeNewConfiguration();
        DisplayMetrics metrics = new DisplayMetrics();
        WindowManager w = (WindowManager)context.getSystemService(Context.WINDOW_SERVICE);
        w.getDefaultDisplay().getMetrics(metrics);
        context.getResources().updateConfiguration(config, metrics);

        try {
            // TODO: use boot phase
            mPowerManagerService.systemReady(mActivityManagerService.getAppOpsService());
        } catch (Throwable e) {
            reportWtf("making Power Manager Service ready", e);
        }

        try {
            // PKMS 准备完成
            mPackageManagerService.systemReady();
        } catch (Throwable e) {
            reportWtf("making Package Manager Service ready", e);
        }

        try {
            // TODO: use boot phase and communicate these flags some other way
            // 显示器管理服务准备完成
            mDisplayManagerService.systemReady(safeMode, mOnlyCore);
        } catch (Throwable e) {
            reportWtf("making Display Manager Service ready", e);
        }

        // These are needed to propagate to the runnable below.
        // 它们需要传播到下面的runnable。
        final NetworkManagementService networkManagementF = networkManagement;
        final NetworkStatsService networkStatsF = networkStats;
        final NetworkPolicyManagerService networkPolicyF = networkPolicy;
        final ConnectivityService connectivityF = connectivity;
        final NetworkScoreService networkScoreF = networkScore;
        final WallpaperManagerService wallpaperF = wallpaper;
        final InputMethodManagerService immF = imm;
        final LocationManagerService locationF = location;
        final CountryDetectorService countryDetectorF = countryDetector;
        final NetworkTimeUpdateService networkTimeUpdaterF = networkTimeUpdater;
        final CommonTimeManagementService commonTimeMgmtServiceF = commonTimeMgmtService;
        final TextServicesManagerService textServiceManagerServiceF = tsms;
        final StatusBarManagerService statusBarF = statusBar;
        final AssetAtlasService atlasF = atlas;
        final InputManagerService inputManagerF = inputManager;
        final TelephonyRegistry telephonyRegistryF = telephonyRegistry;
        final MediaRouterService mediaRouterF = mediaRouter;
        final AudioService audioServiceF = audioService;
        final MmsServiceBroker mmsServiceF = mmsService;

        // We now tell the activity manager it is okay to run third party
        // code.  It will call back into us once it has gotten to the state
        // where third party code can really run (but before it has actually
        // started launching the initial applications), for us to complete our
        // initialization.
        // 我们现在告诉活动管理器可以运行第三方代码。一旦它到达第三方代码可以真正运行的状态（但在它真正开始启动初始应用程序之前），它就会调用我们来完成初始化。
        mActivityManagerService.systemReady(new Runnable() {
            @Override
            public void run() {
                Slog.i(TAG, "Making services ready");
                // stage 550
                mSystemServiceManager.startBootPhase(
                        SystemService.PHASE_ACTIVITY_MANAGER_READY);
                try {
                    mActivityManagerService.startObservingNativeCrashes();
                } catch (Throwable e) {
                    reportWtf("observing native crashes", e);
                }

                Slog.i(TAG, "WebViewFactory preparation");
                WebViewFactory.prepareWebViewInSystemServer();

                try {
                    startSystemUi(context);
                } catch (Throwable e) {
                    reportWtf("starting System UI", e);
                }
                try {
                    if (networkScoreF != null) networkScoreF.systemReady();
                } catch (Throwable e) {
                    reportWtf("making Network Score Service ready", e);
                }
                try {
                    if (networkManagementF != null) networkManagementF.systemReady();
                } catch (Throwable e) {
                    reportWtf("making Network Managment Service ready", e);
                }
                try {
                    if (networkStatsF != null) networkStatsF.systemReady();
                } catch (Throwable e) {
                    reportWtf("making Network Stats Service ready", e);
                }
                try {
                    if (networkPolicyF != null) networkPolicyF.systemReady();
                } catch (Throwable e) {
                    reportWtf("making Network Policy Service ready", e);
                }
                try {
                    if (connectivityF != null) connectivityF.systemReady();
                } catch (Throwable e) {
                    reportWtf("making Connectivity Service ready", e);
                }
                try {
                    if (audioServiceF != null) audioServiceF.systemReady();
                } catch (Throwable e) {
                    reportWtf("Notifying AudioService running", e);
                }
                Watchdog.getInstance().start();

                // 现在可以让各种系统服务启动它们的第三方代码。。。
                // stage 600
                mSystemServiceManager.startBootPhase(
                        SystemService.PHASE_THIRD_PARTY_APPS_CAN_START);

                try {
                    if (wallpaperF != null) wallpaperF.systemRunning();
                } catch (Throwable e) {
                    reportWtf("Notifying WallpaperService running", e);
                }
                try {
                    if (immF != null) immF.systemRunning(statusBarF);
                } catch (Throwable e) {
                    reportWtf("Notifying InputMethodService running", e);
                }
                try {
                    if (locationF != null) locationF.systemRunning();
                } catch (Throwable e) {
                    reportWtf("Notifying Location Service running", e);
                }
                try {
                    if (countryDetectorF != null) countryDetectorF.systemRunning();
                } catch (Throwable e) {
                    reportWtf("Notifying CountryDetectorService running", e);
                }
                try {
                    if (networkTimeUpdaterF != null) networkTimeUpdaterF.systemRunning();
                } catch (Throwable e) {
                    reportWtf("Notifying NetworkTimeService running", e);
                }
                try {
                    if (commonTimeMgmtServiceF != null) {
                        commonTimeMgmtServiceF.systemRunning();
                    }
                } catch (Throwable e) {
                    reportWtf("Notifying CommonTimeManagementService running", e);
                }
                try {
                    if (textServiceManagerServiceF != null)
                        textServiceManagerServiceF.systemRunning();
                } catch (Throwable e) {
                    reportWtf("Notifying TextServicesManagerService running", e);
                }
                try {
                    if (atlasF != null) atlasF.systemRunning();
                } catch (Throwable e) {
                    reportWtf("Notifying AssetAtlasService running", e);
                }
                try {
                    // TODO(BT) Pass parameter to input manager
                    if (inputManagerF != null) inputManagerF.systemRunning();
                } catch (Throwable e) {
                    reportWtf("Notifying InputManagerService running", e);
                }
                try {
                    if (telephonyRegistryF != null) telephonyRegistryF.systemRunning();
                } catch (Throwable e) {
                    reportWtf("Notifying TelephonyRegistry running", e);
                }
                try {
                    if (mediaRouterF != null) mediaRouterF.systemRunning();
                } catch (Throwable e) {
                    reportWtf("Notifying MediaRouterService running", e);
                }

                try {
                    if (mmsServiceF != null) mmsServiceF.systemRunning();
                } catch (Throwable e) {
                    reportWtf("Notifying MmsService running", e);
                }
            }
        });
    }

SystemServer启动服务总结

上文中启动了很多的服务. 可以分为以下三类:分为引导服务、核心服务、其他服务

**引导服务(7个)**：
ActivityManagerService：Android的核心服务，管理所有组件
PowerManagerService : Android中管理电源的服务
LightsService：管理和控制光线传感器的服务
DisplayManagerService：管理屏幕设备的服务
PackageManagerService：Android的包管理服务
UserManagerService：管理Android用户的身份和信息的服务
SensorService : 管理传感器
**核心服务(3个)**：
BatteryService：监控电池状态的服务，当电池状态改变时会广播Intent。
UsageStatsService : 统计应用使用情况
WebViewUpdateService : 注册更新WebView监听
**其他服务(60个以上)**：

AccesssibilityManagerService：截取用户输入，并根据输入给用户一些额外的反馈，起到辅助效果的服务。
AccountManagerService：管理设备中所有账号的服务，有账号、密码、授权管理功能
AlarmManagerService：Android系统的闹钟服务
AppWidgetService：管理Laucher的用户Widget的服务
AsserAtlasService：把预加载的图片资源都打包成一张单一的图片，并跨进程共享由此产生的纹理，以降低总的内存使用情况的服务。
AudioService：提供应用设置音量、音效、铃声等接口的服务
BackupManagerService：备份和恢复应用数据的服务
BluetoothManagerService：管理系统蓝牙设备的服务
CertBlacklister：提供了一种简单的机制来更新系统SSL证书的公共密钥和序列号黑名单服务
ClipboardService：提供系统级别的剪贴板功能的服务
CommonTimeManagermentService：管理本地公共时间配置的服务
ConnectivityService：Android系统提供网络连接的服务
ContentService：管理Android中数据更新通知的服务，当ContentProvider中的内容发生变化时，它将发出广播通知这种变化
CountryDetectorService：检测当前用户所属国家的服务
DevicePolicyManagerService：提供系统配置管理的服务
DeviceStorageMonitorService：监控存储空间的服务，当存储空间低于10%的时候会广播警告
DiskStatsService：提供存储空间的统计服务
DreamManagerService：管理屏幕保护的应用
DropBoxManagerService：产生和管理系统运行时的日志文件的服务。
EntroypyMixer：熵服务周期性地加载和保存随机信息，防止/dev/random 的状态编程可预知的，否则，这样一些需要随机数的应用程序得到将是重新的值。这个服务没有为应用程序提供接口
IdleMaintenanaceService：监视系统济宁idle服务。通过它可以获得系统计入idle通知
InputManagerService：管理键盘和触屏输入的服务
InputMethodManagerService：提供输入法管理功能的服务，包括disable/enable输入法，切换输入法等
LocationManagerService：提供位置管理的服务
LockSettingService：管理锁屏服务
MountService：管理Android系统存储设备的服务
NetworkManagermentService：提供网络物理接口管理服务
NetworkPolicyManagerService：提供网络管理策略服务
NetworkStateService：管理网络连接状态的服务，当网络状态变化时，将发出广播
NetworkTimeUpdateService：提供根据网络时间更新本地时间的服务
NotificationManagerService：管理系统的Notifaction的服务
NsdService：基于苹果的Bonjour服务发现协议，提供远程的发现和零配置功能的服务
PrintManagerService：提供打印管理的服务
RecognitionManagerService：身份识别服务
SamplingProfilerService：记录和分析系统启动性能的服务
SchedulingPolicyService：设置线程调度策略的服务
SearchManagerService：提供搜索功能的服务
SerialService：提供打开接串口设备的服务
StatusBarManagerService：提供更新stateBar上图标、动画接口的服务
TelephonyRegistry：监听和管理通话事件和状态的服务
TextServicesManagerService：提供拼写检查等文本功能的服务
TwilightService：根据用户的地理位置判断目前是否是黄昏时分的服务
UIModeManagerService：管理和设备系统的UI模式的服务
UsbService：管理USB设备和连接的服务
VibratorService：管理和控制振动设备的服务
WallpaperManagerService：管理桌面背景的服务
WifiP2pService：管理WiFi点对点连接的服务
WifiService：管理和控制Wifi设备的服务
WindowManagerService：Android的核心服务，提供窗口管理功能。

等等….

Launcher

目前为止,Android核心功能分析都差不多了,接下来就应该分析Android中的启动器Launcher是如何启动的了. 在前分析到SystemServer.startOtherService中,最后调用了mActivityManagerService.systemReady.代码如下:

SystemServer.startOtherService => /frameworks/base/services/java/com/android/server/SystemServer

private void startOtherServices() { 
    ...
 mActivityManagerService.systemReady(new Runnable() {
           @Override
           public void run() {
             ...
           }
     });
}

然后在 ActivityManagerService.systemReady函数中,会调用到startHomeActivityLocked方法.

ActivityManagerService.systemReady => /frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

public void systemReady(final Runnable goingCallback) {
       ...
       synchronized (this) {
           ...
           // Start up initial activity.
           mBooting = true;
           startHomeActivityLocked(mCurrentUserId, "systemReady");
           ...
       }
   }

ActivityManagerService.startHomeActivityLocked函数中会通过getHomeIntent获取启动Launcher的Intent,之后通过mStackSupervisor.startHomeActivity启动.

ActivityManagerService.startHomeActivityLocked => /frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

boolean startHomeActivityLocked(int userId, String reason) {
        if (mFactoryTest == FactoryTest.FACTORY_TEST_LOW_LEVEL
                && mTopAction == null) {
            // 我们正在工厂测试模式下运行，但找不到工厂测试应用程序，
            // 所以坐在那里显示错误信息，不要尝试启动任何操作。
            return false;
        }
        Intent intent = getHomeIntent();
        ActivityInfo aInfo =
            resolveActivityInfo(intent, STOCK_PM_FLAGS, userId);
        if (aInfo != null) {
            intent.setComponent(new ComponentName(
                    aInfo.applicationInfo.packageName, aInfo.name));
            // Don't do this if the home app is currently being
            // instrumented.
            aInfo = new ActivityInfo(aInfo);
            aInfo.applicationInfo = getAppInfoForUser(aInfo.applicationInfo, userId);
            ProcessRecord app = getProcessRecordLocked(aInfo.processName,
                    aInfo.applicationInfo.uid, true);
            if (app == null || app.instrumentationClass == null) {
                intent.setFlags(intent.getFlags() | Intent.FLAG_ACTIVITY_NEW_TASK);
                mStackSupervisor.startHomeActivity(intent, aInfo, reason);
            }
        }

        return true;
    }

ActivityManagerService.getHomeIntent方法中直接返回了intent对象.

ActivityManagerService.getHomeIntent => /frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

Intent getHomeIntent() {
       Intent intent = new Intent(mTopAction, mTopData != null ? Uri.parse(mTopData) : null);
       intent.setComponent(mTopComponent);
       if (mFactoryTest != FactoryTest.FACTORY_TEST_LOW_LEVEL) {
           intent.addCategory(Intent.CATEGORY_HOME);
       }
       return intent;
   }

ActivityStackSupervisor.startHomeActivity中会将Launcher的Activity移动到上面,然后开启.

ActivityStackSupervisor.startHomeActivity => /frameworks/base/services/core/java/com/android/server/am/ActivityStackSupervisor.java

void startHomeActivity(Intent intent, ActivityInfo aInfo, String reason) {
    moveHomeStackTaskToTop(HOME_ACTIVITY_TYPE, reason);
    startActivityLocked(null /* caller */, intent, null /* resolvedType */, aInfo,
            null /* voiceSession */, null /* voiceInteractor */, null /* resultTo */,
            null /* resultWho */, 0 /* requestCode */, 0 /* callingPid */, 0 /* callingUid */,
            null /* callingPackage */, 0 /* realCallingPid */, 0 /* realCallingUid */,
            0 /* startFlags */, null /* options */, false /* ignoreTargetSecurity */,
            false /* componentSpecified */,
            null /* outActivity */, null /* container */,  null /* inTask */);
    if (inResumeTopActivity) {
        // If we are in resume section already, home activity will be initialized, but not
        // resumed (to avoid recursive resume) and will stay that way until something pokes it
        // again. We need to schedule another resume.
        scheduleResumeTopActivities();
    }
}

至此,Android桌面就会出现用户眼前.

总结

Android系统的启动从开机键按下开始,可以总结为:

当用户按下开机键时,系统首先会从预设的芯片位置加载引导程序BootLoader到ROM之中
BootLoader初始化会硬件设备到合适的状态从而启动Linux Kernel中的swapper进程(idle进程)
接着swapper进程会fork出init进程,并且通过解析init.rc文件,启动其他进程,其中包括zygote进程
zygote进程会通过app_main.cpp启动虚拟机(VM)、注册jni函数以及调用ZygoteInit.main方法调用到java层
ZygoteInit则会在初始化的时候启动SystemServer,初始化系统所需要的各种服务,其中又包含AMS
SystemServer中的AMS服务会在SystemServer初始化完毕之后执行onReady方法,通过getHomeIntent与startHomeActivity启动Launcher应用

X的博客

Android系统启动流程分析