SystemServer启动流程代码走读（java层）

SystemServer启动流程代码走读（java层）

1、Main()方法主入口：

SystemServer构造，然后执行run()方法

/**
* The main entry point from zygote.
*/
public static void main(String[] args) {
	new SystemServer().run();
}

2、构造方法：

public SystemServer() {
    // Check for factory test mode.
    mFactoryTestMode = FactoryTest.getMode();

    // Record process start information.
    // Note SYSPROP_START_COUNT will increment by *2* on a FDE device when it fully boots;
    // one for the password screen, second for the actual boot.
    mStartCount = SystemProperties.getInt(SYSPROP_START_COUNT, 0) + 1;
    mRuntimeStartElapsedTime = SystemClock.elapsedRealtime();
    mRuntimeStartUptime = SystemClock.uptimeMillis();
    Process.setStartTimes(mRuntimeStartElapsedTime, mRuntimeStartUptime);

    // Remember if it's runtime restart(when sys.boot_completed is already set) or reboot
    // We don't use "mStartCount > 1" here because it'll be wrong on a FDE device.
    // TODO: mRuntimeRestart will *not* be set to true if the proccess crashes before
    // sys.boot_completed is set. Fix it.
    mRuntimeRestart = "1".equals(SystemProperties.get("sys.boot_completed"));
}

3、run()方法

private void run() {
    TimingsTraceAndSlog t = new TimingsTraceAndSlog();
    try {
        t.traceBegin("InitBeforeStartServices");

        //记录系统启动次数，开机后经历的时间（包括深度休眠），
        //以及开机后不包括休眠所经历的时间
        SystemProperties.set(SYSPROP_START_COUNT, String.valueOf(mStartCount));
        SystemProperties.set(SYSPROP_START_ELAPSED, String.valueOf(mRuntimeStartElapsedTime));
        SystemProperties.set(SYSPROP_START_UPTIME, String.valueOf(mRuntimeStartUptime));

        EventLog.writeEvent(EventLogTags.SYSTEM_SERVER_START,
                mStartCount, mRuntimeStartUptime, mRuntimeStartElapsedTime);

        //如果时区不存在，设置时区为GMT
        String timezoneProperty = SystemProperties.get("persist.sys.timezone");
        if (!isValidTimeZoneId(timezoneProperty)) {
            Slog.w(TAG, "persist.sys.timezone is not valid (" + timezoneProperty
                    + "); setting to GMT.");
            SystemProperties.set("persist.sys.timezone", "GMT");
        }

        // 如果设置过persist.sys.language属性，则设置
        // persist.sys.locale属性去替换，以保持和AndroidRuntime一致
        // 该属性仅能被system_server和system apps设置
        // AndroidRuntime源码位置：
        // frameworks/base/core/jni/AndroidRuntime.cpp
        if (!SystemProperties.get("persist.sys.language").isEmpty()) {
            final String languageTag = Locale.getDefault().toLanguageTag();

            SystemProperties.set("persist.sys.locale", languageTag);
            SystemProperties.set("persist.sys.language", "");
            SystemProperties.set("persist.sys.country", "");
            SystemProperties.set("persist.sys.localevar", "");
        }

        // The system server should never make non-oneway calls
        Binder.setWarnOnBlocking(true);
        // The system server should always load safe labels
        PackageItemInfo.forceSafeLabels();

        // Default to FULL within the system server.
        SQLiteGlobal.sDefaultSyncMode = SQLiteGlobal.SYNC_MODE_FULL;

        // Deactivate SQLiteCompatibilityWalFlags until settings provider is initialized
        SQLiteCompatibilityWalFlags.init(null);

        // Here we go!
        Slog.i(TAG, "Entered the Android system server!");
        final long uptimeMillis = SystemClock.elapsedRealtime();
        EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_SYSTEM_RUN, uptimeMillis);
        if (!mRuntimeRestart) {
            FrameworkStatsLog.write(FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME_REPORTED,
                    FrameworkStatsLog
                            .BOOT_TIME_EVENT_ELAPSED_TIME__EVENT__SYSTEM_SERVER_INIT_START,
                    uptimeMillis);
        }
        /// M: BOOTPROF
        sMtkSystemServerIns.addBootEvent("Android:SysServerInit_START");

        // 变更虚拟机库文件 
        SystemProperties.set("persist.sys.dalvik.vm.lib.2", VMRuntime.getRuntime().vmLibrary());

        // 清除vm内存上限，由于启动过程需要较多的虚拟机内存空间
        // NOTE: 值得注意的点，应用使用的VM内存，也是有上限的，超过设置的上限就会内存溢出，即应用崩溃。
        VMRuntime.getRuntime().clearGrowthLimit();

        // 有些设备运行依赖指纹，所以在进一步启动之前，确保指纹属性的定义
        Build.ensureFingerprintProperty();

        // 在system server中，访问环境变量需要指定用户
        Environment.setUserRequired(true);

        // 在system server中，任何传入的bundle必须避免抛出BadParcelableException异常
        // 猜测和内存使用相关
        BaseBundle.setShouldDefuse(true);

        // 在system server中，打包Exception数据的时候包含stack trace
        Parcel.setStackTraceParceling(true);

        // 确保binder调用进入system的时候，必须是foreground priority，不能是backaground priority
        BinderInternal.disableBackgroundScheduling(true);

        // 在system server中，提高binder线程的最大数量
        BinderInternal.setMaxThreads(sMaxBinderThreads);

        // Prepare the main looper thread (this thread).
        // 将当前线程优先级设置为foreground，并且不允许自身线程变成background优先级。NOTE：注意这里的结合使用。
        // 然后为自己的线程准备main looper，并设置其日志输出信息的配置
        android.os.Process.setThreadPriority(
                android.os.Process.THREAD_PRIORITY_FOREGROUND);
        android.os.Process.setCanSelfBackground(false);
        Looper.prepareMainLooper();
        Looper.getMainLooper().setSlowLogThresholdMs(
                SLOW_DISPATCH_THRESHOLD_MS, SLOW_DELIVERY_THRESHOLD_MS);

        // 注册标识，WTF级别错误相关（What the fuck级别的错误，意为基本不可能发生的错误）
        SystemServiceRegistry.sEnableServiceNotFoundWtf = true;

        // 加载动态库android_servers, 初始化native services
        System.loadLibrary("android_servers");

        // 允许堆内存分析
        initZygoteChildHeapProfiling();

        // Debug版本中，孵化一个线程去监控文件句柄泄漏（fd leaks）
        if (Build.IS_DEBUGGABLE) {
            spawnFdLeakCheckThread();
        }

        // 检查上一次关机是否失败，它可能会导致直接关机/重启，因此这个方法可能不会return
        performPendingShutdown();

        // 初始化系统上下文system context
        createSystemContext();

        // Call per-process mainline module initialization.
        // 初始化system server的每一个进程
        ActivityThread.initializeMainlineModules();

        // dumper service设置，注意是设置，不是启动
        ServiceManager.addService("system_server_dumper", mDumper);
        mDumper.addDumpable(this);

        // 使用之前创建的system context创建system service manager
        mSystemServiceManager = new SystemServiceManager(mSystemContext);
        mSystemServiceManager.setStartInfo(mRuntimeRestart,
                mRuntimeStartElapsedTime, mRuntimeStartUptime);
        mDumper.addDumpable(mSystemServiceManager);
        // 将system service manager添加到LocalServices缓存池中，
        // LocalServices的作用就是，确保system server中的services之间的低耦合
        LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
        // 为system server进程中的初始化任务，准备并发线程池
        SystemServerInitThreadPool tp = SystemServerInitThreadPool.start();
        mDumper.addDumpable(tp);

        // 如果设置了系统字体懒加载，则预加载system font map，因为WindowManagerService等服务会用到。
        if (Typeface.ENABLE_LAZY_TYPEFACE_INITIALIZATION) {
            Typeface.loadPreinstalledSystemFontMap();
        }

        // 如果是debug版本，则开始加载jvmtiAgent，
        // JVM TI是JDK提供的一套用于开发JVM监控, 问题定位与性能调优工具的通用编程接口（API），
        // 通过JVMTI，我们可以开发各式各样的JVMTI Agent。
        // 这个Agent的表现形式是一个以c/c++语言编写的动态共享库。
        if (Build.IS_DEBUGGABLE) {
            // Property is of the form "library_path=parameters".
            String jvmtiAgent = SystemProperties.get("persist.sys.dalvik.jvmtiagent");
            if (!jvmtiAgent.isEmpty()) {
                int equalIndex = jvmtiAgent.indexOf('=');
                String libraryPath = jvmtiAgent.substring(0, equalIndex);
                String parameterList =
                        jvmtiAgent.substring(equalIndex + 1, jvmtiAgent.length());
                // Attach the agent.
                try {
                    Debug.attachJvmtiAgent(libraryPath, parameterList, null);
                } catch (Exception e) {
                    Slog.e("System", "*************************************************");
                    Slog.e("System", "********** Failed to load jvmti plugin: " + jvmtiAgent);
                }
            }
        }
    } finally {
        t.traceEnd();  // InitBeforeStartServices
    }

    /// M: Set paramters to mtkSystemserver.
    sMtkSystemServerIns.setPrameters(BOOT_TIMINGS_TRACE_LOG, mSystemServiceManager, mSystemContext);

    // 在Runtime中设置WTF错误处理Handler
    RuntimeInit.setDefaultApplicationWtfHandler(SystemServer::handleEarlySystemWtf);

    // 接下来就是启动各种服务的过程
    try {
        t.traceBegin("StartServices");
        // bootstrap级别的service
        startBootstrapServices(t);
        /// M: For mtk systemserver
        sMtkSystemServerIns.startMtkBootstrapServices();

        // 然后是核心服务
        startCoreServices(t);
        /// M: for mtk other service.
        sMtkSystemServerIns.startMtkCoreServices();

        // 剩下的服务，并在其中进行各类服务的systemReady()调用
        startOtherServices(t);
    } catch (Throwable ex) {
        Slog.e("System", "******************************************");
        Slog.e("System", "************ Failure starting system services", ex);
        throw ex;
    } finally {
        t.traceEnd(); // StartServices
    }

    // 严格模式的vm参数初始化？具体意义？性能相关？权限相关？
    StrictMode.initVmDefaults(null);

    // 如果是user版本，并且非Runtime restart，并且不是第一次开机或者OTA更新
    // system server启动如果耗时过长，就记录一个WTF错误
    if ("user".equals(Build.TYPE) && !mRuntimeRestart && !isFirstBootOrUpgrade()) {
        final long uptimeMillis = SystemClock.elapsedRealtime();
        FrameworkStatsLog.write(FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME_REPORTED,
                FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME__EVENT__SYSTEM_SERVER_READY,
                uptimeMillis);
        final long maxUptimeMillis = 60 * 1000;
        if (uptimeMillis > maxUptimeMillis) {
            Slog.wtf(SYSTEM_SERVER_TIMING_TAG,
                    "SystemServer init took too long. uptimeMillis=" + uptimeMillis);
        }
    }
    /// M: BOOTPROF
    sMtkSystemServerIns.addBootEvent("Android:SysServerInit_END");
    // 开始循环自身的looper，之前准备的那个Main looper还记得么？
    // 至此system server启动完毕
    Looper.loop();
    throw new RuntimeException("Main thread loop unexpectedly exited");
}

4、startBootstrapServices()

private void startBootstrapServices(@NonNull TimingsTraceAndSlog t) {
    t.traceBegin("startBootstrapServices");

    // watchdog服务，定时喂狗，超时则表示系统运行异常，
    // 最先加载这个服务，是为了在启动其他服务异常的时候，crash system server
    t.traceBegin("StartWatchdog");
    final Watchdog watchdog = Watchdog.getInstance();
    watchdog.start();
    t.traceEnd();

    // 还记得之前准备的线程池么？现在开始使用它了
    // 这里创建线程运行的是SystemConfig的getInstance方法，初始化一些系统配置
    Slog.i(TAG, "Reading configuration...");
    final String TAG_SYSTEM_CONFIG = "ReadingSystemConfig";
    t.traceBegin(TAG_SYSTEM_CONFIG);
    SystemServerInitThreadPool.submit(SystemConfig::getInstance, TAG_SYSTEM_CONFIG);
    t.traceEnd();

    // Platform compat service，平台兼容性相关的服务，因为和兼容性相关，所以有native层和java层两个service
    // 它会被AMS，PMS等其他服务使用，所以优先添加这个服务
    t.traceBegin("PlatformCompat");
    PlatformCompat platformCompat = new PlatformCompat(mSystemContext);
    ServiceManager.addService(Context.PLATFORM_COMPAT_SERVICE, platformCompat);
    ServiceManager.addService(Context.PLATFORM_COMPAT_NATIVE_SERVICE,
            new PlatformCompatNative(platformCompat));
    AppCompatCallbacks.install(new long[0]);
    t.traceEnd();

    // 文件完整性校验服务，用于校验文件的完整性。启动其他服务大多也涉及到文件操作。因此优先启动。
    t.traceBegin("StartFileIntegrityService");
    mSystemServiceManager.startService(FileIntegrityService.class);
    t.traceEnd();

    // 用于安装Apk，jar等
    t.traceBegin("StartInstaller");
    Installer installer = mSystemServiceManager.startService(Installer.class);
    t.traceEnd();

    // device identifiers服务
    // 猜测：和硬件相关，本设备以及外设，内设的标识管理服务
    t.traceBegin("DeviceIdentifiersPolicyService");
    mSystemServiceManager.startService(DeviceIdentifiersPolicyService.class);
    t.traceEnd();

    // Uri赋予服务
    // 猜测：内部通过uri传递文件（安全性相关）
    t.traceBegin("UriGrantsManagerService");
    mSystemServiceManager.startService(UriGrantsManagerService.Lifecycle.class);
    t.traceEnd();

    t.traceBegin("StartPowerStatsService");
    // 电源状态管理服务，java层和native层两个服务
    mSystemServiceManager.startService(PowerStatsService.class);
    t.traceEnd();

    t.traceBegin("StartIStatsService");
    startIStatsService();
    t.traceEnd();

    // 内存监控代理服务
    // 猜测：用于监控内存状态
    t.traceBegin("MemtrackProxyService");
    startMemtrackProxyService();
    t.traceEnd();

    // AMS，不解释
    t.traceBegin("StartActivityManager");
    // TODO: Might need to move after migration to WM.
    ActivityTaskManagerService atm = mSystemServiceManager.startService(
            ActivityTaskManagerService.Lifecycle.class).getService();
    mActivityManagerService = ActivityManagerService.Lifecycle.startService(
            mSystemServiceManager, atm);
    mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
    mActivityManagerService.setInstaller(installer);
    mWindowManagerGlobalLock = atm.getGlobalLock();
    t.traceEnd();

    // 应用数据加载管理服务，PMS需要使用到它
    t.traceBegin("StartDataLoaderManagerService");
    mDataLoaderManagerService = mSystemServiceManager.startService(
            DataLoaderManagerService.class);
    t.traceEnd();

    // 增量服务，它是一个native层的服务，文件系统相关，可用于APK的安装，APK文件扫描，验证其完整性等等，PMS会用到它
    t.traceBegin("StartIncrementalService");
    mIncrementalServiceHandle = startIncrementalService();
    t.traceEnd();

    // 电源管理服务，优先启动，因为其他服务会用到它，比如电量消耗记录
    t.traceBegin("StartPowerManager");
    mPowerManagerService = mSystemServiceManager.startService(PowerManagerService.class);
    t.traceEnd();
    // 热量管理，监控热量，管理风扇之类的？
    t.traceBegin("StartThermalManager");
    mSystemServiceManager.startService(ThermalManagerService.class);
    t.traceEnd();
    // 提示管理，系统级别的提示、暗示？
    t.traceBegin("StartHintManager");
    mSystemServiceManager.startService(HintManagerService.class);
    t.traceEnd();

    // 至此电源管理相关的服务已经启动完毕，AMS初始化电源管理相关的功能。
    t.traceBegin("InitPowerManagement");
    mActivityManagerService.initPowerManagement();
    t.traceEnd();

    // 启动Recovery system服务，因为需要注册rescue party，这是一个Android自救程序；监控系统核心程序，在出现循环崩溃的时候，会启动该程序，根据不同的救援级别做出一系列操作，看是否可恢复设备，理解为Windows的安全模式。Android 8.0之后加入。
    t.traceBegin("StartRecoverySystemService");
    mSystemServiceManager.startService(RecoverySystemService.Lifecycle.class);
    t.traceEnd();

    // RescueParty监控系统健康
    RescueParty.registerHealthObserver(mSystemContext);
    // 记录system server启动了一次
    PackageWatchdog.getInstance(mSystemContext).noteBoot();

    // 启动服务LightsService
    // 管理led和显示背光，所以我们需要它来打开显示
    t.traceBegin("StartLightsService");
    mSystemServiceManager.startService(LightsService.class);
    t.traceEnd();

    t.traceBegin("StartSidekickService");
    // 如果定义了滑盖功能，启动滑盖管理服务
    if (SystemProperties.getBoolean("config.enable_sidekick_graphics", false)) {
        mSystemServiceManager.startService(WEAR_SIDEKICK_SERVICE_CLASS);
    }
    t.traceEnd();

    // Display Manager Service启动，显示管理服务
    t.traceBegin("StartDisplayManager");
    mDisplayManagerService = mSystemServiceManager.startService(DisplayManagerService.class);
    t.traceEnd();

    // 启动PackageManagerService之前，初始化一个默认的Display
    t.traceBegin("WaitForDisplay");
    mSystemServiceManager.startBootPhase(t, SystemService.PHASE_WAIT_FOR_DEFAULT_DISPLAY);
    t.traceEnd();

    // 加密状态下仅加载核心服务，设置mOnlyCore参数，后面会使用
    String cryptState = VoldProperties.decrypt().orElse("");
    if (ENCRYPTING_STATE.equals(cryptState)) {
        Slog.w(TAG, "Detected encryption in progress - only parsing core apps");
        mOnlyCore = true;
    } else if (ENCRYPTED_STATE.equals(cryptState)) {
        Slog.w(TAG, "Device encrypted - only parsing core apps");
        mOnlyCore = true;
    }

    // 非runtime重启时记录系统实际运行时间状态日志
    if (!mRuntimeRestart) {
        FrameworkStatsLog.write(FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME_REPORTED,
                FrameworkStatsLog
                        .BOOT_TIME_EVENT_ELAPSED_TIME__EVENT__PACKAGE_MANAGER_INIT_START,
                SystemClock.elapsedRealtime());
    }

    // 域名校验服务
    t.traceBegin("StartDomainVerificationService");
    DomainVerificationService domainVerificationService = new DomainVerificationService(
            mSystemContext, SystemConfig.getInstance(), platformCompat);
    mSystemServiceManager.startService(domainVerificationService);
    t.traceEnd();

    // PMS启动，注意传入的参数
    t.traceBegin("StartPackageManagerService");
    try {
        Watchdog.getInstance().pauseWatchingCurrentThread("packagemanagermain");
        mPackageManagerService = PackageManagerService.main(mSystemContext, installer,
                domainVerificationService, mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF,
                mOnlyCore);
    } finally {
        Watchdog.getInstance().resumeWatchingCurrentThread("packagemanagermain");
    }

    // 传入PMS，注册dex文件加载reporter，用于dex优化
    // 优化服务是：BackgroundDexOptService
    SystemServerDexLoadReporter.configureSystemServerDexReporter(mPackageManagerService);

    // 通过PMS判断是不是第一次启动，并获取一个PackageManager代理用于访问PMS
    mFirstBoot = mPackageManagerService.isFirstBoot();
    mPackageManager = mSystemContext.getPackageManager();
    t.traceEnd();
    // 非runtime重启，并且非第一次或者OTA启动，则记录系统实际运行时间日志
    if (!mRuntimeRestart && !isFirstBootOrUpgrade()) {
        FrameworkStatsLog.write(FrameworkStatsLog.BOOT_TIME_EVENT_ELAPSED_TIME_REPORTED,
                FrameworkStatsLog
                        .BOOT_TIME_EVENT_ELAPSED_TIME__EVENT__PACKAGE_MANAGER_INIT_READY,
                SystemClock.elapsedRealtime());
    }
    // 非onlyCore模式下，如果没有关闭Ota dex优化开关，则启动OtaDexoptService服务
    if (!mOnlyCore) {
        boolean disableOtaDexopt = SystemProperties.getBoolean("config.disable_otadexopt",
                false);
        if (!disableOtaDexopt) {
            t.traceBegin("StartOtaDexOptService");
            try {
                Watchdog.getInstance().pauseWatchingCurrentThread("moveab");
                OtaDexoptService.main(mSystemContext, mPackageManagerService);
            } catch (Throwable e) {
                reportWtf("starting OtaDexOptService", e);
            } finally {
                Watchdog.getInstance().resumeWatchingCurrentThread("moveab");
                t.traceEnd();
            }
        }
    }

    // 用户管理服务
    t.traceBegin("StartUserManagerService");
    mSystemServiceManager.startService(UserManagerService.LifeCycle.class);
    t.traceEnd();

    // 初始化属性缓存，用于缓存packages的resources
    t.traceBegin("InitAttributerCache");
    AttributeCache.init(mSystemContext);
    t.traceEnd();

    // AMS设置系统进程，具体含义？意义？
    t.traceBegin("SetSystemProcess");
    mActivityManagerService.setSystemProcess();
    t.traceEnd();

    // 注册package added、replaced、removed广播
    // PlatformCompat源码：/frameworks/base/services/core/java/com/android/server/compat/PlatformCompat.java
    platformCompat.registerPackageReceiver(mSystemContext);

    // 使用一个ActivityManager实例完成watchdog设置并监听重启，
    // 只有在ActivityManagerService作为一个系统进程正确启动后才能这样做
    t.traceBegin("InitWatchdog");
    watchdog.init(mSystemContext, mActivityManagerService);
    t.traceEnd();

    // 在AMS setSystemProcess之后，重新设置显示策略，因为AMS可能更新了显示策略
    mDisplayManagerService.setupSchedulerPolicies();

    /// M: CTA requirement - permission control  @{
    /*
        * M: MOTA for CTA permissions handling
        * This function is used for granting CTA permissions after OTA upgrade.
        * This should be placed after AMS is added to ServiceManager and before
        * starting other services since granting permissions needs AMS instance
        * to do permission checking.
        */
    // CTA相关？在AMS作为系统进程启动后执行，因为可能需要AMS实例去校验权限
    mPackageManagerService.onAmsAddedtoServiceMgr();
    /// @}

    // 管理覆盖安装的packages服务
    t.traceBegin("StartOverlayManagerService");
    mSystemServiceManager.startService(new OverlayManagerService(mSystemContext));
    t.traceEnd();

    // sensor私密服务？？？
    t.traceBegin("StartSensorPrivacyService");
    mSystemServiceManager.startService(new SensorPrivacyService(mSystemContext));
    t.traceEnd();

    // 这个值表示系统显示，即systemUi被修改了？
    if (SystemProperties.getInt("persist.sys.displayinset.top", 0) > 0) {
        // SystemUI发生了改变，DisplayManager立即处理覆盖
        // Launcher被替换之类的？
        mActivityManagerService.updateSystemUiContext();
        LocalServices.getService(DisplayManagerInternal.class).onOverlayChanged();
    }

    // 传感器服务需要访问包管理器服务、app ops服务和权限服务, 因此最后启动它
    t.traceBegin("StartSensorService");
    mSystemServiceManager.startService(SensorService.class);
    t.traceEnd();
    t.traceEnd(); // startBootstrapServices
}

5、startCoreServices()

private void startCoreServices(@NonNull TimingsTraceAndSlog t) {
    t.traceBegin("startCoreServices");

    // 启动系统配置服务
    t.traceBegin("StartSystemConfigService");
    mSystemServiceManager.startService(SystemConfigService.class);
    t.traceEnd();

    t.traceBegin("StartBatteryService");
    // 用于统计电池电量消耗，需要LightService
    mSystemServiceManager.startService(BatteryService.class);
    t.traceEnd();

    // 统计应用使用情况
    t.traceBegin("StartUsageService");
    mSystemServiceManager.startService(UsageStatsService.class);
    mActivityManagerService.setUsageStatsManager(
            LocalServices.getService(UsageStatsManagerInternal.class));
    t.traceEnd();

    // 跟踪可更新的WebView是否处于就绪状态，并监视更新安装
    if (mPackageManager.hasSystemFeature(PackageManager.FEATURE_WEBVIEW)) {
        t.traceBegin("StartWebViewUpdateService");
        mWebViewUpdateService = mSystemServiceManager.startService(WebViewUpdateService.class);
        t.traceEnd();
    }

    // 跟踪和缓存设备状态
    t.traceBegin("StartCachedDeviceStateService");
    mSystemServiceManager.startService(CachedDeviceStateService.class);
    t.traceEnd();

    // 跟踪Binder调用所消耗的CPU
    t.traceBegin("StartBinderCallsStatsService");
    mSystemServiceManager.startService(BinderCallsStatsService.LifeCycle.class);
    t.traceEnd();

    // 跟踪Looper处理消息所花费的时间
    t.traceBegin("StartLooperStatsService");
    mSystemServiceManager.startService(LooperStatsService.Lifecycle.class);
    t.traceEnd();

    // 管理APK的rollback.
    t.traceBegin("StartRollbackManagerService");
    mSystemServiceManager.startService(ROLLBACK_MANAGER_SERVICE_CLASS);
    t.traceEnd();

    // 监控/data/tombstones目录下文件的变动，和dropbox配合使用，商业行为，国内有墙，无法使用的样子
    t.traceBegin("StartNativeTombstoneManagerService");
    mSystemServiceManager.startService(NativeTombstoneManagerService.class);
    t.traceEnd();

    // 管理Bugreport的服务，比如将BUG回传给Google
    t.traceBegin("StartBugreportManagerService");
    mSystemServiceManager.startService(BugreportManagerService.class);
    t.traceEnd();

    // GPU服务
    t.traceBegin("GpuService");
    mSystemServiceManager.startService(GpuService.class);
    t.traceEnd();

    t.traceEnd(); // startCoreServices
}

6、startOtherServices()

private void startOtherServices(@NonNull TimingsTraceAndSlog t) {
    t.traceBegin("startOtherServices");

    final Context context = mSystemContext;
    DynamicSystemService dynamicSystem = null;
    IStorageManager storageManager = null;
    NetworkManagementService networkManagement = null;
    IpSecService ipSecService = null;
    VpnManagerService vpnManager = null;
    VcnManagementService vcnManagement = null;
    NetworkStatsService networkStats = null;
    NetworkPolicyManagerService networkPolicy = null;
    NsdService serviceDiscovery = null;
    WindowManagerService wm = null;
    SerialService serial = null;
    NetworkTimeUpdateService networkTimeUpdater = null;
    InputManagerService inputManager = null;
    TelephonyRegistry telephonyRegistry = null;
    ConsumerIrService consumerIr = null;
    MmsServiceBroker mmsService = null;
    HardwarePropertiesManagerService hardwarePropertiesService = null;
    PacProxyService pacProxyService = null;

    //开始获取一些系统配置
    boolean disableSystemTextClassifier = SystemProperties.getBoolean(
            "config.disable_systemtextclassifier", false);

    boolean disableNetworkTime = SystemProperties.getBoolean("config.disable_networktime",
            false);
    boolean disableCameraService = SystemProperties.getBoolean("config.disable_cameraservice",
            false);
    boolean enableLeftyService = SystemProperties.getBoolean("config.enable_lefty", false);

    boolean isEmulator = SystemProperties.get("ro.boot.qemu").equals("1");

    boolean isWatch = context.getPackageManager().hasSystemFeature(
            PackageManager.FEATURE_WATCH);

    boolean isArc = context.getPackageManager().hasSystemFeature(
            "org.chromium.arc");

    boolean enableVrService = context.getPackageManager().hasSystemFeature(
            PackageManager.FEATURE_VR_MODE_HIGH_PERFORMANCE);

    // For debugging RescueParty
    if (Build.IS_DEBUGGABLE && SystemProperties.getBoolean("debug.crash_system", false)) {
        throw new RuntimeException();
    }

    try {
        final String SECONDARY_ZYGOTE_PRELOAD = "SecondaryZygotePreload";
        // 第二个Zygote预加载，为32位编译出来的App准备，因为他们使用的CPU指令集不同。
        // 32位Zygote负责孵化32位编译App的启动
        mZygotePreload = SystemServerInitThreadPool.submit(() -> {
            try {
                Slog.i(TAG, SECONDARY_ZYGOTE_PRELOAD);
                TimingsTraceAndSlog traceLog = TimingsTraceAndSlog.newAsyncLog();
                traceLog.traceBegin(SECONDARY_ZYGOTE_PRELOAD);
                if (!Process.ZYGOTE_PROCESS.preloadDefault(Build.SUPPORTED_32_BIT_ABIS[0])) {
                    Slog.e(TAG, "Unable to preload default resources");
                }
                traceLog.traceEnd();
            } catch (Exception ex) {
                Slog.e(TAG, "Exception preloading default resources", ex);
            }
        }, SECONDARY_ZYGOTE_PRELOAD);

        t.traceBegin("StartKeyAttestationApplicationIdProviderService");
        ServiceManager.addService("sec_key_att_app_id_provider",
                new KeyAttestationApplicationIdProviderService(context));
        t.traceEnd();

        // 钥匙串服务
        t.traceBegin("StartKeyChainSystemService");
        mSystemServiceManager.startService(KeyChainSystemService.class);
        t.traceEnd();

        // Schedule任务的策略服务？
        t.traceBegin("StartSchedulingPolicyService");
        ServiceManager.addService("scheduling_policy", new SchedulingPolicyService());
        t.traceEnd();

        // telecom加载服务，用于加载telecom
        t.traceBegin("StartTelecomLoaderService");
        mSystemServiceManager.startService(TelecomLoaderService.class);
        t.traceEnd();

        // telephony注册服务
        t.traceBegin("StartTelephonyRegistry");
        telephonyRegistry = new TelephonyRegistry(
                context, new TelephonyRegistry.ConfigurationProvider());
        ServiceManager.addService("telephony.registry", telephonyRegistry);
        t.traceEnd();

        // 用于产生随机数
        t.traceBegin("StartEntropyMixer");
        mEntropyMixer = new EntropyMixer(context);
        t.traceEnd();

        mContentResolver = context.getContentResolver();

        // 账号管理服务
        t.traceBegin("StartAccountManagerService");
        mSystemServiceManager.startService(ACCOUNT_SERVICE_CLASS);
        t.traceEnd();

        // 内容管理服务
        t.traceBegin("StartContentService");
        mSystemServiceManager.startService(CONTENT_SERVICE_CLASS);
        t.traceEnd();

        // 安装系统Providers，包括SettingsProvider
        t.traceBegin("InstallSystemProviders");
        mActivityManagerService.getContentProviderHelper().installSystemProviders();
        // Now that SettingsProvider is ready, reactivate SQLiteCompatibilityWalFlags

        // SQLite Wal系统flags重置，启动wal系统，这是一种数据库读写系统，用于提高磁盘I/O操作效率
        SQLiteCompatibilityWalFlags.reset();
        t.traceEnd();

        // DropBox管理服务
        t.traceBegin("StartDropBoxManager");
        mSystemServiceManager.startService(DropBoxManagerService.class);
        t.traceEnd();

        // 用于管理角色的默认权限
        t.traceBegin("StartRoleManagerService");
        LocalManagerRegistry.addManager(RoleServicePlatformHelper.class,
                new RoleServicePlatformHelperImpl(mSystemContext));
        mSystemServiceManager.startService(ROLE_SERVICE_CLASS);
        t.traceEnd();

        // 震动管理服务
        t.traceBegin("StartVibratorManagerService");
        mSystemServiceManager.startService(VibratorManagerService.Lifecycle.class);
        t.traceEnd();

        // 动态系统服务，DSU和GSI相关
        t.traceBegin("StartDynamicSystemService");
        dynamicSystem = new DynamicSystemService(context);
        ServiceManager.addService("dynamic_system", dynamicSystem);
        t.traceEnd();

        // 红外服务
        if (!isWatch) {
            t.traceBegin("StartConsumerIrService");
            consumerIr = new ConsumerIrService(context);
            ServiceManager.addService(Context.CONSUMER_IR_SERVICE, consumerIr);
            t.traceEnd();
        }

        // Alarm管理服务
        t.traceBegin("StartAlarmManagerService");
        if(!sMtkSystemServerIns.startMtkAlarmManagerService()){
            mSystemServiceManager.startService(ALARM_MANAGER_SERVICE_CLASS);
        }
        t.traceEnd();

        // input管理服务
        t.traceBegin("StartInputManagerService");
        inputManager = new InputManagerService(context);
        t.traceEnd();

        // 设备状态管理服务
        t.traceBegin("DeviceStateManagerService");
        mSystemServiceManager.startService(DeviceStateManagerService.class);
        t.traceEnd();

        // camera代理服务
        if (!disableCameraService) {
            t.traceBegin("StartCameraServiceProxy");
            mSystemServiceManager.startService(CameraServiceProxy.class);
            t.traceEnd();
        }

        // WMS服务启动
        t.traceBegin("StartWindowManagerService");
        // WMS 需要Senser服务ready
        mSystemServiceManager.startBootPhase(t, SystemService.PHASE_WAIT_FOR_SENSOR_SERVICE);
        wm = WindowManagerService.main(context, inputManager, !mFirstBoot, mOnlyCore,
                new PhoneWindowManager(), mActivityManagerService.mActivityTaskManager);
        ServiceManager.addService(Context.WINDOW_SERVICE, wm, /* allowIsolated= */ false,
                DUMP_FLAG_PRIORITY_CRITICAL | DUMP_FLAG_PROTO);
        // 添加WMS服务之后再添加input manager服务，因为input manager服务需要使用WMS
        ServiceManager.addService(Context.INPUT_SERVICE, inputManager,
                /* allowIsolated= */ false, DUMP_FLAG_PRIORITY_CRITICAL);
        t.traceEnd();

        // 为AMS设置WMS
        t.traceBegin("SetWindowManagerService");
        mActivityManagerService.setWindowManager(wm);
        t.traceEnd();

        // WMS onInitReady
        t.traceBegin("WindowManagerServiceOnInitReady");
        wm.onInitReady();
        t.traceEnd();

        // 提交一个任务到线程池，用于启动HIDL服务，
        // HAL interface definition language(硬件抽象层接口定义语言)
        SystemServerInitThreadPool.submit(() -> {
            TimingsTraceAndSlog traceLog = TimingsTraceAndSlog.newAsyncLog();
            traceLog.traceBegin(START_HIDL_SERVICES);
            startHidlServices();
            traceLog.traceEnd();
        }, START_HIDL_SERVICES);

        // 非手表并且允许vr服务运行时，启动vr管理服务
        if (!isWatch && enableVrService) {
            t.traceBegin("StartVrManagerService");
            mSystemServiceManager.startService(VrManagerService.class);
            t.traceEnd();
        }

        // input管理服务启动
        t.traceBegin("StartInputManager");
        inputManager.setWindowManagerCallbacks(wm.getInputManagerCallback());
        inputManager.start();
        t.traceEnd();

        // WMS和input启动后，通知显示管理
        t.traceBegin("DisplayManagerWindowManagerAndInputReady");
        mDisplayManagerService.windowManagerAndInputReady();
        t.traceEnd();

        // 启动蓝牙服务
        if (mFactoryTestMode == FactoryTest.FACTORY_TEST_LOW_LEVEL) {
            Slog.i(TAG, "No Bluetooth Service (factory test)");
        } else if (!context.getPackageManager().hasSystemFeature
                (PackageManager.FEATURE_BLUETOOTH)) {
            Slog.i(TAG, "No Bluetooth Service (Bluetooth Hardware Not Present)");
        } else {
            t.traceBegin("StartBluetoothService");
            mSystemServiceManager.startService(BluetoothService.class);
            t.traceEnd();
        }

        // 用于记录ip的可连接性
        t.traceBegin("IpConnectivityMetrics");
        mSystemServiceManager.startService(IP_CONNECTIVITY_METRICS_CLASS);
        t.traceEnd();
        // 网络监视清单服务，黑名单？
        t.traceBegin("NetworkWatchlistService");
        mSystemServiceManager.startService(NetworkWatchlistService.Lifecycle.class);
        t.traceEnd();
        // 用于锁定某些模块在内存中，避免这些模块被移出/移入内存从而提高程序的运行效率
        t.traceBegin("PinnerService");
        mSystemServiceManager.startService(PinnerService.class);
        t.traceEnd();
        // 提供一个服务，它将预测将需要哪些I/O操作并提前运行，来减少应用程序在I/O操作中的等待时间
        t.traceBegin("IorapForwardingService");
        mSystemServiceManager.startService(IorapForwardingService.class);
        t.traceEnd();
        
        if (Build.IS_DEBUGGABLE && ProfcollectForwardingService.enabled()) {
            t.traceBegin("ProfcollectForwardingService");
            mSystemServiceManager.startService(ProfcollectForwardingService.class);
            t.traceEnd();
        }

        // 签名配置服务
        t.traceBegin("SignedConfigService");
        SignedConfigService.registerUpdateReceiver(mSystemContext);
        t.traceEnd();

        // app完整性管理服务
        t.traceBegin("AppIntegrityService");
        mSystemServiceManager.startService(AppIntegrityManagerService.class);
        t.traceEnd();

    } catch (Throwable e) {
        Slog.e("System", "******************************************");
        Slog.e("System", "************ Failure starting core service");
        throw e;
    }

    ...

    // PMS dex优化
    if (!mOnlyCore) {
        t.traceBegin("UpdatePackagesIfNeeded");
        try {
            Watchdog.getInstance().pauseWatchingCurrentThread("dexopt");
            mPackageManagerService.updatePackagesIfNeeded();
        } catch (Throwable e) {
            reportWtf("update packages", e);
        } finally {
            Watchdog.getInstance().resumeWatchingCurrentThread("dexopt");
        }
        t.traceEnd();
    }

    // 清理磁盘，释放空间
    t.traceBegin("PerformFstrimIfNeeded");
    try {
        mPackageManagerService.performFstrimIfNeeded();
    } catch (Throwable e) {
        reportWtf("performing fstrim", e);
    }
    t.traceEnd();

    ...
    
    // 现在开始启动各种App进程
    t.traceBegin("MakeLockSettingsServiceReady");
    if (lockSettings != null) {
        try {
            lockSettings.systemReady();
        } catch (Throwable e) {
            reportWtf("making Lock Settings Service ready", e);
        }
    }
    t.traceEnd();

    // 这个阶段后，可以获得锁设置数据
    t.traceBegin("StartBootPhaseLockSettingsReady");
    mSystemServiceManager.startBootPhase(t, SystemService.PHASE_LOCK_SETTINGS_READY);
    t.traceEnd();
    // 这个阶段后，可以安全的调用核心系统服务
    t.traceBegin("StartBootPhaseSystemServicesReady");
    mSystemServiceManager.startBootPhase(t, SystemService.PHASE_SYSTEM_SERVICES_READY);
    t.traceEnd();

    // WMS系统准备
    t.traceBegin("MakeWindowManagerServiceReady");
    try {
        wm.systemReady();
    } catch (Throwable e) {
        reportWtf("making Window Manager Service ready", e);
    }
    t.traceEnd();

    // Emit any pending system_server WTFs
    synchronized (SystemService.class) {
        if (sPendingWtfs != null) {
            mActivityManagerService.schedulePendingSystemServerWtfs(sPendingWtfs);
            sPendingWtfs = null;
        }
    }

    if (safeMode) {
        mActivityManagerService.showSafeModeOverlay();
    }

    // XCSW GuoYanjie add for BuildType start
    if ( ("eng".equals(Build.TYPE) || "userdebug".equals(Build.TYPE)
            || !SystemProperties.get("ro.xc.demo", "").isEmpty())) {
        mActivityManagerService.showDemoModeOverlay();
    }
    // XCSW GuoYanjie add for BuildType end

    // Update the configuration for this context by hand, because we're going
    // to start using it before the config change done in wm.systemReady() will
    // propagate to it.
    final Configuration config = wm.computeNewConfiguration(DEFAULT_DISPLAY);
    DisplayMetrics metrics = new DisplayMetrics();
    context.getDisplay().getMetrics(metrics);
    context.getResources().updateConfiguration(config, metrics);

    // The system context's theme may be configuration-dependent.
    final Theme systemTheme = context.getTheme();
    if (systemTheme.getChangingConfigurations() != 0) {
        systemTheme.rebase();
    }

    t.traceBegin("MakePowerManagerServiceReady");
    try {
        // TODO: use boot phase
        mPowerManagerService.systemReady(mActivityManagerService.getAppOpsService());
    } catch (Throwable e) {
        reportWtf("making Power Manager Service ready", e);
    }
    t.traceEnd();

    // Permission policy service
    t.traceBegin("StartPermissionPolicyService");
    mSystemServiceManager.startService(PermissionPolicyService.class);
    t.traceEnd();

    t.traceBegin("MakePackageManagerServiceReady");
    mPackageManagerService.systemReady();
    t.traceEnd();

    t.traceBegin("MakeDisplayManagerServiceReady");
    try {
        // TODO: use boot phase and communicate these flags some other way
        mDisplayManagerService.systemReady(safeMode, mOnlyCore);
    } catch (Throwable e) {
        reportWtf("making Display Manager Service ready", e);
    }
    t.traceEnd();

    mSystemServiceManager.setSafeMode(safeMode);

    // NOTE：启动所有的定制的，独特的服务
    t.traceBegin("StartDeviceSpecificServices");
    final String[] classes = mSystemContext.getResources().getStringArray(
            R.array.config_deviceSpecificSystemServices);
    for (final String className : classes) {
        t.traceBegin("StartDeviceSpecificServices " + className);
        try {
            mSystemServiceManager.startService(className);
        } catch (Throwable e) {
            reportWtf("starting " + className, e);
        }
        t.traceEnd();
    }
    t.traceEnd();

    t.traceBegin("GameManagerService");
    mSystemServiceManager.startService(GAME_MANAGER_SERVICE_CLASS);
    t.traceEnd();

    if (context.getPackageManager().hasSystemFeature(PackageManager.FEATURE_UWB)) {
        t.traceBegin("UwbService");
        mSystemServiceManager.startService(UWB_SERVICE_CLASS);
        t.traceEnd();
    }

    // 这个阶段后，设备独特的服务可以被使用
    t.traceBegin("StartBootPhaseDeviceSpecificServicesReady");
    mSystemServiceManager.startBootPhase(t, SystemService.PHASE_DEVICE_SPECIFIC_SERVICES_READY);
    t.traceEnd();

    t.traceBegin("AppSearchManagerService");
    mSystemServiceManager.startService(APP_SEARCH_MANAGER_SERVICE_CLASS);
    t.traceEnd();

    t.traceBegin("StartMediaCommunicationService");
    mSystemServiceManager.startService(MEDIA_COMMUNICATION_SERVICE_CLASS);
    t.traceEnd();

    ConcurrentUtils.waitForFutureNoInterrupt(mBlobStoreServiceStart,
            START_BLOB_STORE_SERVICE);

    // These are needed to propagate to the runnable below.
    final NetworkManagementService networkManagementF = networkManagement;
    final NetworkStatsService networkStatsF = networkStats;
    final NetworkPolicyManagerService networkPolicyF = networkPolicy;
    final CountryDetectorService countryDetectorF = countryDetector;
    final NetworkTimeUpdateService networkTimeUpdaterF = networkTimeUpdater;
    final InputManagerService inputManagerF = inputManager;
    final TelephonyRegistry telephonyRegistryF = telephonyRegistry;
    final MediaRouterService mediaRouterF = mediaRouter;
    final MmsServiceBroker mmsServiceF = mmsService;
    final IpSecService ipSecServiceF = ipSecService;
    final VpnManagerService vpnManagerF = vpnManager;
    final VcnManagementService vcnManagementF = vcnManagement;
    final WindowManagerService windowManagerF = wm;
    final ConnectivityManager connectivityF = (ConnectivityManager)
            context.getSystemService(Context.CONNECTIVITY_SERVICE);

    // AMS系统ready
    mActivityManagerService.systemReady(() -> {
        Slog.i(TAG, "Making services ready");
        t.traceBegin("StartActivityManagerReadyPhase");
        // AMS ready执行完成后回调通知系统进入PHASE_ACTIVITY_MANAGER_READY阶段
        // 该阶段进入后，服务可以使用广播
        mSystemServiceManager.startBootPhase(t, SystemService.PHASE_ACTIVITY_MANAGER_READY);
        t.traceEnd();
        // 开始监察Native crash
        t.traceBegin("StartObservingNativeCrashes");
        try {
            mActivityManagerService.startObservingNativeCrashes();
        } catch (Throwable e) {
            reportWtf("observing native crashes", e);
        }
        t.traceEnd();
        // app插件策略？
        t.traceBegin("RegisterAppOpsPolicy");
        try {
            mActivityManagerService.setAppOpsPolicy(new AppOpsPolicy(mSystemContext));
        } catch (Throwable e) {
            reportWtf("registering app ops policy", e);
        }
        t.traceEnd();

        // 运行第三方App之前，准备好WebView
        final String WEBVIEW_PREPARATION = "WebViewFactoryPreparation";
        Future<?> webviewPrep = null;
        if (!mOnlyCore && mWebViewUpdateService != null) {
            webviewPrep = SystemServerInitThreadPool.submit(() -> {
                Slog.i(TAG, WEBVIEW_PREPARATION);
                TimingsTraceAndSlog traceLog = TimingsTraceAndSlog.newAsyncLog();
                traceLog.traceBegin(WEBVIEW_PREPARATION);
                ConcurrentUtils.waitForFutureNoInterrupt(mZygotePreload, "Zygote preload");
                mZygotePreload = null;
                mWebViewUpdateService.prepareWebViewInSystemServer();
                traceLog.traceEnd();
            }, WEBVIEW_PREPARATION);
        }
        // 车载相关服务模块的定义和启动
        if (mPackageManager.hasSystemFeature(PackageManager.FEATURE_AUTOMOTIVE)) {
            t.traceBegin("StartCarServiceHelperService");
            final SystemService cshs = mSystemServiceManager
                    .startService(CAR_SERVICE_HELPER_SERVICE_CLASS);
            if (cshs instanceof Dumpable) {
                mDumper.addDumpable((Dumpable) cshs);
            }
            if (cshs instanceof DevicePolicySafetyChecker) {
                dpms.setDevicePolicySafetyChecker((DevicePolicySafetyChecker) cshs);
            }
            t.traceEnd();
        }

        // 安全模式下设置为飞行模式
        if (safeMode) {
            t.traceBegin("EnableAirplaneModeInSafeMode");
            try {
                connectivityF.setAirplaneMode(true);
            } catch (Throwable e) {
                reportWtf("enabling Airplane Mode during Safe Mode bootup", e);
            }
            t.traceEnd();
        }
        // network管理服务ready
        t.traceBegin("MakeNetworkManagementServiceReady");
        try {
            if (networkManagementF != null) {
                networkManagementF.systemReady();
            }
        } catch (Throwable e) {
            reportWtf("making Network Managment Service ready", e);
        }
        
        ...

        // 等待PMS准备好所有的App data
        mPackageManagerService.waitForAppDataPrepared();

        // 准备进入最后的阶段，可以开始运行第三方app
        t.traceBegin("PhaseThirdPartyAppsCanStart");
        // 在运行第三方app之前，确保Webview准备完毕
        if (webviewPrep != null) {
            ConcurrentUtils.waitForFutureNoInterrupt(webviewPrep, WEBVIEW_PREPARATION);
        }
        mSystemServiceManager.startBootPhase(t, SystemService.PHASE_THIRD_PARTY_APPS_CAN_START);
        t.traceEnd();

        ...
        
    }, t);

    // 启动SystemUI，状态栏，锁屏，Launcher等
    t.traceBegin("StartSystemUI");
    try {
        startSystemUi(context, windowManagerF);
    } catch (Throwable e) {
        reportWtf("starting System UI", e);
    }
    t.traceEnd();

    t.traceEnd(); // startOtherServices
}