on <trigger>
   <command>
   <command>
   <command>

on boot
    ifup lo
    hostname localhost
    domainname localdomain

static int __ref kernel_init(void *unused)

    ......
}

static noinline void __init kernel_init_freeable(void)

    integrity_load_keys();
    load_default_modules();
}

include $(CLEAR_VARS)
LOCAL_CPPFLAGS := $(init_cflags)
LOCAL_SRC_FILES:= 
    bootchart.cpp 
    builtins.cpp 
    devices.cpp 
    init.cpp 
    init_first_stage.cpp 
    keychords.cpp 
    property_service.cpp 
    reboot.cpp 
    signal_handler.cpp 
    ueventd.cpp 
    ueventd_parser.cpp 
    watchdogd.cpp 
LOCAL_MODULE:= init
LOCAL_C_INCLUDES += 
    system/core/mkbootimg

int main(int argc, char** argv) 
    if (!strcmp(basename(argv[0]), "watchdogd")) {
        return watchdogd_main(argc, argv);
    }
    // REBOOT_BOOTLOADER_ON_PANIC是否定义由init模块的 .mk 决定
    // 只有userdebug eng 这两个版本会打开这个选项，user 版本没有。 
    // 主要作用，当init进程崩溃后，不是让内核崩溃，而是重启bootloader，让开发者容易定位问题。
    if (REBOOT_BOOTLOADER_ON_PANIC) {
        install_reboot_signal_handlers();// 主要作用将各种信号量，如SIGABRT,SIGABRT等的行为设置为SA_RESTART
    }
    add_environment("PATH", _PATH_DEFPATH);
    
    bool is_first_stage = (getenv("INIT_SECOND_STAGE") == nullptr);
    if (is_first_stage) {
        boot_clock::time_point start_time = boot_clock::now();
        // 清除屏蔽字(file mode creation mask)，保证新建的目录的访问权限不受屏蔽字影响。
        umask(0);

        // 在initRamdisk上设置基本的文件系统，然后由rc文件设置剩余部分
        // initRamdisk 就是 RAM 创建的虚拟文件系统，之后挂载真实的文件系统
        // mpfs是一种虚拟内存文件系统，它会将所有的文件存储在虚拟内存中，如果将tmpfs文件系统卸载后，那么其下的所有的内容将不复存在。 
        mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755");
        mkdir("/dev/pts", 0755);
        mkdir("/dev/socket", 0755);
        // devpts文件系统为伪终端提供了一个标准接口，它的标准挂接点是/dev/ pts。只要pty的主复合设备/dev/ptmx被打开，就会在/dev/pts下动态的创建一个新的pty设备文件。
        mount("devpts", "/dev/pts", "devpts", 0, NULL);
        #define MAKE_STR(x) __STRING(x)
        // proc文件系统是一个非常重要的虚拟文件系统，它可以看作是内核内部数据结构的接口，通过它我们可以获得系统的信息，同时也能够在运行时修改特定的内核参数。
        mount("proc", "/proc", "proc", 0, "hidepid=2,gid=" MAKE_STR(AID_READPROC));
        chmod("/proc/cmdline", 0440);
        gid_t groups[] = { AID_READPROC };
        setgroups(arraysize(groups), groups);
        // 与proc文件系统类似，sysfs文件系统也是一个不占有任何磁盘空间的虚拟文件系统。它通常被挂接在/sys目录下。
        // sysfs文件系统是Linux2.6内核引入的，它把连接在系统上的设备和总线组织成为一个分级的文件，使得它们可以在用户空间存取。
        mount("sysfs", "/sys", "sysfs", 0, NULL);
        // 挂载SELinux文件系统
        mount("selinuxfs", "/sys/fs/selinux", "selinuxfs", 0, NULL);
        mknod("/dev/kmsg", S_IFCHR | 0600, makedev(1, 11));
        mknod("/dev/random", S_IFCHR | 0666, makedev(1, 8));
        mknod("/dev/urandom", S_IFCHR | 0666, makedev(1, 9));
        // 现在RAM已经挂载了存储设备
        InitKernelLogging(argv);
        LOG(INFO) << "init first stage started!";
        if (!DoFirstStageMount()) {
            LOG(ERROR) << "Failed to mount required partitions early ...";
            panic();
        }
        SetInitAvbVersionInRecovery();
        // 设置SELinux,加载SELinux策略
        selinux_initialize(true);
        if (restorecon("/init") == -1) {
            PLOG(ERROR) << "restorecon failed";
            security_failure();
        }
        setenv("INIT_SECOND_STAGE", "true", 1);
        static constexpr uint32_t kNanosecondsPerMillisecond = 1e6;
        uint64_t start_ms = start_time.time_since_epoch().count() / kNanosecondsPerMillisecond;
        setenv("INIT_STARTED_AT", StringPrintf("%" PRIu64, start_ms).c_str(), 1);
        char* path = argv[0];
        char* args[] = { path, nullptr };
        execv(path, args);
        PLOG(ERROR) << "execv("" << path << "") failed";
        security_failure();
    }

    // At this point we're in the second stage of init.
    InitKernelLogging(argv);
    LOG(INFO) << "init second stage started!";
    keyctl(KEYCTL_GET_KEYRING_ID, KEY_SPEC_SESSION_KEYRING, 1);
    close(open("/dev/.booting", O_WRONLY | O_CREAT | O_CLOEXEC, 0000));

    property_init();//property初始化property,创建一块存储区域
    process_kernel_dt();
    process_kernel_cmdline();
    export_kernel_boot_props();
    property_set("ro.boottime.init", getenv("INIT_STARTED_AT"));
    property_set("ro.boottime.init.selinux", getenv("INIT_SELINUX_TOOK"));
    const char* avb_version = getenv("INIT_AVB_VERSION");
    if (avb_version) property_set("ro.boot.avb_version", avb_version);
    // 清理环境
    unsetenv("INIT_SECOND_STAGE");
    unsetenv("INIT_STARTED_AT");
    unsetenv("INIT_SELINUX_TOOK");
    unsetenv("INIT_AVB_VERSION");

    selinux_initialize(false);
    selinux_restore_context();
    epoll_fd = epoll_create1(EPOLL_CLOEXEC);
    if (epoll_fd == -1) {
        PLOG(ERROR) << "epoll_create1 failed";
        exit(1);
    }
    signal_handler_init();
    property_load_boot_defaults();//加载默认的property
    export_oem_lock_status();
    start_property_service();//开启property service
    set_usb_controller();
    const BuiltinFunctionMap function_map;
    Action::set_function_map(&function_map);
    // 准备解析init.rc文件
    Parser& parser = Parser::GetInstance();
    parser.AddSectionParser("service",std::make_unique<ServiceParser>());
    parser.AddSectionParser("on", std::make_unique<ActionParser>());
    parser.AddSectionParser("import", std::make_unique<ImportParser>());
    std::string bootscript = GetProperty("ro.boot.init_rc", "");
    if (bootscript.empty())  else 
    if (false) parser.DumpState();

    ActionManager& am = ActionManager::GetInstance();
    // QueueEventTrigger函数就是利用参数构造EventTrigger，然后加入到trigger_queue_中。
    // 添加触发器early-init，执行on early-init内容
    am.QueueEventTrigger("early-init");

    // QueueBuiltinAction函数中构造新的action加入到actions_中，第一个参数作为新建action携带cmd的执行函数；
    // 第二个参数既作为action的trigger name，也作为action携带cmd的参数。
     // 等待冷启动完毕
    am.QueueBuiltinAction(wait_for_coldboot_done_action, "wait_for_coldboot_done");
    // 从硬件RNG的设备文件/dev/hw_random中读取512字节并写到Linux RNG的设备文件/dev/urandom中。
    am.QueueBuiltinAction(MixHwrngIntoLinuxRngAction, "MixHwrngIntoLinuxRng");
    am.QueueBuiltinAction(SetMmapRndBitsAction, "SetMmapRndBits");
    am.QueueBuiltinAction(SetKptrRestrictAction, "SetKptrRestrict");
    // 初始化组合键监听模块
    am.QueueBuiltinAction(keychord_init_action, "keychord_init");
     // 显示开机画面
    am.QueueBuiltinAction(console_init_action, "console_init");
    // 添加触发器init，执行on init内容，主要包括创建/挂载一些目录，以及symlink等
    am.QueueEventTrigger("init");

    am.QueueBuiltinAction(mix_hwrng_into_linux_rng_action, "mix_hwrng_into_linux_rng");
    //这里做个判断，如果是充电的情况，先不开机，执行init.rc:charger
    //否则，执行init.rc:late-init
    std::string bootmode = GetProperty("ro.bootmode", "");
    if (bootmode == "charger") {
        am.QueueEventTrigger("charger");
    } else {
        am.QueueEventTrigger("late-init");
    }
    am.QueueBuiltinAction(queue_property_triggers_action, "queue_property_triggers");
    while (true) 
        if (!(waiting_for_prop || ServiceManager::GetInstance().IsWaitingForExec())) 
            // 存在命令待执行，等待时间置零，立刻执行
            if (am.HasMoreCommands()) epoll_timeout_ms = 0;
        }
        epoll_event ev;
        // 没有事件等待 epoll_timeout_ms
        int nr = TEMP_FAILURE_RETRY(epoll_wait(epoll_fd, &ev, 1, epoll_timeout_ms));
        if (nr == -1) {
            PLOG(ERROR) << "epoll_wait failed";
        } else if (nr == 1) { 
            // 有事件到来，执行对应处理函数
            // 根据上文知道，epoll句柄（即epoll_fd）主要监听子进程结束，及其它进程设置系统属性的请求。
            ((void (*)()) ev.data.ptr)();
        }
    }
    return 0;
}

# Mount filesystems and start core system services.
on late-init
    trigger early-fs
    #通过mount_all命令在init {{device} .rc中挂载fstab。
    #可选参数'--early'可以被指定为跳过'latemount'的条目。 
    #/system 和/vendor 必须安装在阶段fs的末尾，而/data是可选的。
    trigger fs

    #启动logd
    trigger post-fs

    #在init {$ Device} .rc中使用'--late'参数通过mount_all挂载fstab，以便仅使用'latemount'挂载条目
    trigger late-fs

    #现在我们可以挂载/数据。文件加密需要keymaster解密/数据，只有当系统属性存在时才能加载。
    trigger post-fs-data

    #这里启动Zygote进程，也就是第一个java进程
    #这里是Andoird O版本改变的地方，O以前Zygote进程并非在此，具体位置待查
    trigger zygote-start

    # 加载永久属性
    trigger load_persist_props_action

    # Remove a file to wake up anything waiting for firmware.
    trigger firmware_mounts_complete

    trigger early-boot
    #boot中启动core服务，core服务有ueventd、logd、healthd、sh、adbd、servicemanager、vold、SurfaceFlinger、bootanimation。
    trigger boot

int main(int argc, char* const argv[])

      ALOGV("app_process main with argv: %s", argv_String.string());
    }
    // 这里的AppRuntime继承了大名鼎鼎的AndroidRuntime
    AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));
    // 忽略参数 argv[0]
    argc--;
    argv++;

    const char* spaced_commands[] = { "-cp", "-classpath" };
    // Allow "spaced commands" to be succeeded by exactly 1 argument (regardless of -s).
    bool known_command = false;

    int i;
    for (i = 0; i < argc; i++) 

        for (int j = 0;
            j < static_cast<int>(sizeof(spaced_commands) / sizeof(spaced_commands[0]));
            ++j) 
        }

        if (argv[i][0] != '-') {
            break;
        }
        if (argv[i][1] == '-' && argv[i][2] == 0) {
            ++i; // Skip --.
            break;
        }

        runtime.addOption(strdup(argv[i]));
        ALOGV("app_process main add option '%s'", argv[i]);
    }

    // Parse runtime arguments.  Stop at first unrecognized option.
    bool zygote = false;
    bool startSystemServer = false;
    bool application = false;
    String8 niceName;
    String8 className;

    ++i;  // Skip unused "parent dir" argument.
    while (i < argc)  else if (strcmp(arg, "--start-system-server") == 0) {
            startSystemServer = true;
        } else if (strcmp(arg, "--application") == 0) {
            application = true;
        } else if (strncmp(arg, "--nice-name=", 12) == 0)  else if (strncmp(arg, "--", 2) != 0)  else {
            --i;
            break;
        }
    }

    Vector<String8> args;
    if (!className.isEmpty()) 
          ALOGV("Class name = %s, args = %s", className.string(), restOfArgs.string());
        }
    } else 

        char prop[PROP_VALUE_MAX];
        if (property_get(ABI_LIST_PROPERTY, prop, NULL) == 0) {
            LOG_ALWAYS_FATAL("app_process: Unable to determine ABI list from property %s.",
                ABI_LIST_PROPERTY);
            return 11;
        }

        String8 abiFlag("--abi-list=");
        abiFlag.append(prop);
        args.add(abiFlag);

        // zygote模式下，将所有参数传给zygote.main()
        for (; i < argc; ++i) {
            args.add(String8(argv[i]));
        }
    }

    if (!niceName.isEmpty()) 

    if (zygote) {
        // 2.3.1 启动AndroidRuntime和zygote进程
        runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
    } else if (className) {
        runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
    } else {
        fprintf(stderr, "Error: no class name or --zygote supplied.
");
        app_usage();
        LOG_ALWAYS_FATAL("app_process: no class name or --zygote supplied.");
    }
}

void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)

    }
    // Android根目录
    const char* rootDir = getenv("ANDROID_ROOT");
    if (rootDir == NULL) 
        setenv("ANDROID_ROOT", rootDir, 1);
    }
     // 启动虚拟机，详细后续分析虚拟机
    JniInvocation jni_invocation;
    jni_invocation.Init(NULL);
    JNIEnv* env;
    if (startVm(&mJavaVM, &env, zygote) != 0) {
        return;
    }
    onVmCreated(env);

    // 向JavaVM注册安卓原生函数(JNI)
    if (startReg(env) < 0) {
        ALOGE("Unable to register all android natives
");
        return;
    }

    // 将参数转成Java String类型的对象
    jclass stringClass;
    jobjectArray strArray;
    jstring classNameStr;
    stringClass = env->FindClass("java/lang/String");
    assert(stringClass != NULL);
    // 创建String数组
    strArray = env->NewObjectArray(options.size() + 1, stringClass, NULL);
    assert(strArray != NULL);
    classNameStr = env->NewStringUTF(className);
    assert(classNameStr != NULL);
    env->SetObjectArrayElement(strArray, 0, classNameStr);
    for (size_t i = 0; i < options.size(); ++i) {
        jstring optionsStr = env->NewStringUTF(options.itemAt(i).string());
        assert(optionsStr != NULL);
        env->SetObjectArrayElement(strArray, i + 1, optionsStr);
    }

    // 启动JavaVM,本线程成为VM的主线程，一直运行直到VM退出
    // 这里的 className = "com.android.internal.os.ZygoteInit"
    // slashClassName = "com/android/internal/os/ZygoteInit"
    char* slashClassName = toSlashClassName(className);
    jclass startClass = env->FindClass(slashClassName);
    if (startClass == NULL) {
        ALOGE("JavaVM unable to locate class '%s'
", slashClassName);
    } else  else 
    }
    free(slashClassName);
    ALOGD("Shutting down VM
");
    if (mJavaVM->DetachCurrentThread() != JNI_OK)
        ALOGW("Warning: unable to detach main thread
");
    if (mJavaVM->DestroyJavaVM() != 0)
        ALOGW("Warning: VM did not shut down cleanly
");
}

    public static void main(String argv[])  catch (ErrnoException ex) 
        try 

            String bootTimeTag = Process.is64Bit() ? "Zygote64Timing" : "Zygote32Timing";
            BootTimingsTraceLog bootTimingsTraceLog = new BootTimingsTraceLog(bootTimeTag,
                    Trace.TRACE_TAG_DALVIK);
            bootTimingsTraceLog.traceBegin("ZygoteInit");
            RuntimeInit.enableDdms();
            // 启动性能统计，默认关闭，persist.sys.profiler_ms属性控制(>0开启)
            SamplingProfilerIntegration.start();

            boolean startSystemServer = false;
            String socketName = "zygote";
            String abiList = null;
            boolean enableLazyPreload = false;
            for (int i = 1; i < argv.length; i++)  else if ("--enable-lazy-preload".equals(argv[i])) {
                    enableLazyPreload = true;
                } else if (argv[i].startsWith(ABI_LIST_ARG)) {
                    abiList = argv[i].substring(ABI_LIST_ARG.length());
                } else if (argv[i].startsWith(SOCKET_NAME_ARG)) {
                    socketName = argv[i].substring(SOCKET_NAME_ARG.length());
                } else {
                    throw new RuntimeException("Unknown command line argument: " + argv[i]);
                }
            }

            if (abiList == null) {
                throw new RuntimeException("No ABI list supplied.");
            }
            // 创建名为 ANDROID_SOCKET_zygote 的Socket接口
            zygoteServer.registerServerSocket(socketName);
            // 某些配置下，预加载资源和类会在第一次fork时进行
            if (!enableLazyPreload) {
                bootTimingsTraceLog.traceBegin("ZygotePreload");
                EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_START,
                    SystemClock.uptimeMillis());
                preload(bootTimingsTraceLog);
                EventLog.writeEvent(LOG_BOOT_PROGRESS_PRELOAD_END,
                    SystemClock.uptimeMillis());
                bootTimingsTraceLog.traceEnd(); // ZygotePreload
            } else 
            SamplingProfilerIntegration.writeZygoteSnapshot();

            // 初始化gc
            bootTimingsTraceLog.traceBegin("PostZygoteInitGC");
            gcAndFinalize();
            bootTimingsTraceLog.traceEnd(); // PostZygoteInitGC

            bootTimingsTraceLog.traceEnd(); // ZygoteInit
            // 关闭trace以防止fork出的进程trace错误
            Trace.setTracingEnabled(false);

            // Zygote 进程卸载根存储空间，喵喵喵？
            // 大概是Zygote进程存在的唯一意义是用于fork进程，不涉及存储操作，为防止出错，索性使Zygote进程无法接触存储设备
            Zygote.nativeUnmountStorageOnInit();

            // 设置Android沙盒策略
            Seccomp.setPolicy();
            // 停止无多线程模式
            ZygoteHooks.stopZygoteNoThreadCreation();

            if (startSystemServer) {
                // 2.5 启动 SystemServer 进程
                startSystemServer(abiList, socketName, zygoteServer);
            }

            Log.i(TAG, "Accepting command socket connections");
            zygoteServer.runSelectLoop(abiList); // 2.4.1 无限循环监听Socket接口等待AMS请求创建应用进程

            zygoteServer.closeServerSocket();
        } catch (Zygote.MethodAndArgsCaller caller) {
            caller.run();
        } catch (Throwable ex) {
            Log.e(TAG, "System zygote died with exception", ex);
            zygoteServer.closeServerSocket();
            throw ex;
        }
    }

    void runSelectLoop(String abiList) throws Zygote.MethodAndArgsCaller 
            try {
                Os.poll(pollFds, -1);
            } catch (ErrnoException ex) {
                throw new RuntimeException("poll failed", ex);
            }
            for (int i = pollFds.length - 1; i >= 0; --i) 
                if (i == 0)  else 
                }
            }
        }
    }

    private static boolean startSystemServer(String abiList, String socketName, ZygoteServer zygoteServer)
            throws Zygote.MethodAndArgsCaller, RuntimeException 
        /* Hardcoded command line to start the system server */
        String args[] = ;
        ZygoteConnection.Arguments parsedArgs = null;

        int pid;

        try {
            parsedArgs = new ZygoteConnection.Arguments(args);
            ZygoteConnection.applyDebuggerSystemProperty(parsedArgs);
            ZygoteConnection.applyInvokeWithSystemProperty(parsedArgs);
            // 请求 fork SystemServer 进程
            /* Request to fork the system server process */
            pid = Zygote.forkSystemServer(
                    parsedArgs.uid, parsedArgs.gid,
                    parsedArgs.gids,
                    parsedArgs.debugFlags,
                    null,
                    parsedArgs.permittedCapabilities,
                    parsedArgs.effectiveCapabilities);
        } catch (IllegalArgumentException ex) {
            throw new RuntimeException(ex);
        }

        /* For child process */
        if (pid == 0) 

            zygoteServer.closeServerSocket();
            handleSystemServerProcess(parsedArgs);
        }

        return true;
    }

    public static void main(String[] args) {
        new SystemServer().run();
    }

    public SystemServer() 

    private void run() 
            // 如果没有设置时区,统一设置为GMT
            String timezoneProperty =  SystemProperties.get("persist.sys.timezone");
            if (timezoneProperty == null || timezoneProperty.isEmpty()) 
            // 设置系统语言，只有SystemServer进程和系统app允许修改
            // NOTE: Most changes made here will need an equivalent change to
            // core/jni/AndroidRuntime.cpp
            if (!SystemProperties.get("persist.sys.language").isEmpty()) 

            // The system server should never make non-oneway calls
            Binder.setWarnOnBlocking(true);

            // 正式进入Android SystemServer
            Slog.i(TAG, "Entered the Android system server!");//在android.log输出:"I SystemServer: Entered the Android system server!"
            int uptimeMillis = (int) SystemClock.elapsedRealtime();//开机时间
            //在event.log里输出:"I boot_progress_system_run: 11663",后面的数字代表开机时长，单位ms
            EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_SYSTEM_RUN, uptimeMillis);
            if (!mRuntimeRestart) {
                //非runtime重启或者手机重启进入
                //在event.log里输出:"sysui_histogram: [boot_system_server_init,11663]"
                MetricsLogger.histogram(null, "boot_system_server_init", uptimeMillis);
            }

            //设置运行时属性，防止如OTA更新导致运行时不同步
            //也就是设置虚拟机库文件
            SystemProperties.set("persist.sys.dalvik.vm.lib.2", VMRuntime.getRuntime().vmLibrary());

            // 启动采样分析器，进行性能统计
            if (SamplingProfilerIntegration.isEnabled()) {
                SamplingProfilerIntegration.start();
                mProfilerSnapshotTimer = new Timer();
                mProfilerSnapshotTimer.schedule(new TimerTask() {
                        @Override
                        public void run() {
                            //SystemServer性能统计，每小时统计一次，统计结果输出为文件
                            SamplingProfilerIntegration.writeSnapshot("system_server", null);
                        }
                    }, SNAPSHOT_INTERVAL, SNAPSHOT_INTERVAL);//private static final long SNAPSHOT_INTERVAL = 60 * 60 * 1000; // 1hr
            }

            // 清除vm内存增长上限，由于启动过程需要较多的虚拟机内存空间
            VMRuntime.getRuntime().clearGrowthLimit();

            // 系统服务会一直运行，所以设置内存的可能有效使用率为0.8，也就是增强程序堆内存的处理效率
            //为啥是0.8？？
            VMRuntime.getRuntime().setTargetHeapUtilization(0.8f);

            // 针对部分设备依赖于运行时就产生指纹信息，因此需要在开机完成前已经定义
            Build.ensureFingerprintProperty();

            // 访问环境变量前，需要明确指定用户
            Environment.setUserRequired(true);

            // 系统服务中拒绝接收任何Bundle以避免抛出BadParcelableException
            BaseBundle.setShouldDefuse(true);

            // 确保系统Binder运行在前台优先级
            BinderInternal.disableBackgroundScheduling(true);

            // 设置系统服务的最大Binder线程数为31
            BinderInternal.setMaxThreads(sMaxBinderThreads);

            // 设置当前进程的优先级为前台优先级，且不允许转为后台优先级
            android.os.Process.setThreadPriority(
                android.os.Process.THREAD_PRIORITY_FOREGROUND);
            android.os.Process.setCanSelfBackground(false);
            Looper.prepareMainLooper();//主线程的Looper就在当前线程运行

            // 初始化本地服务，也就是加载库文件: android_servers.so
            // 该库包含的源码在frameworks/base/services/目录下
            System.loadLibrary("android_servers");

            // 检测上次关机过程是否失败，该方法可能不会返回[2.7.1]
            performPendingShutdown();

            // 创建系统上下文,详细见Application创建流程
            createSystemContext();

            // 创建SystemServiceManager
            mSystemServiceManager = new SystemServiceManager(mSystemContext);
            mSystemServiceManager.setRuntimeRestarted(mRuntimeRestart);
            LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
            // 为可以并行化的init任务准备线程池
            SystemServerInitThreadPool.get();
        } finally {
            traceEnd(); 
        }

        //启动各类服务
        try {
            traceBeginAndSlog("StartServices");// 在android.log里输出:"SystemServer: StartServices"
            startBootstrapServices();//启动引导服务[2.7.2]
            startCoreServices();//启动核心服务[2.7.3]
            startOtherServices();//启动其他服务[2.7.4]
            // 关闭SystemServerInitThreadPool
            // 在android.log输出:"SystemServerInitThreadPool: Shutdown successful"
            SystemServerInitThreadPool.shutdown();
        } catch (Throwable ex) {
            Slog.e("System", "******************************************");
            Slog.e("System", "************ Failure starting system services", ex);
            throw ex;
        } finally {
            traceEnd();
        }
        // 对于调试版本，日志事件循环停止到dropbox进行分析。
        if (StrictMode.conditionallyEnableDebugLogging()) {
            Slog.i(TAG, "Enabled StrictMode for system server main thread.");
        }
     
        if (!mRuntimeRestart && !isFirstBootOrUpgrade()) 
        }

        // 正常情况下，无限循环等待消息
        Looper.loop();
        throw new RuntimeException("Main thread loop unexpectedly exited");// 抛出异常
    }

    private void performPendingShutdown()  else {
                reason = null;
            }

            if (reason != null && reason.startsWith(PowerManager.REBOOT_RECOVERY_UPDATE))  catch (IOException e) {
                        Slog.e(TAG, "Error reading uncrypt package file", e);
                    }

                    if (filename != null && filename.startsWith("/data")) 
                    }
                }
            }
            // 当"sys.shutdown.requested"值不为空，也就是上次关机失败会导致重启或者关机
            ShutdownThread.rebootOrShutdown(null, reboot, reason);
        }
    }

installer
DeviceIdentifiersPolicyService
ActivityManagerService.Lifecycle
PowerManagerService
RecoverySystemService
LightsService
DisplayManagerService
等待1-7 服务启动完毕(onBootPhase: PHASE_WAIT_FOR_DEFAULT_DISPLAY)
设备支持时：RegionalizationService
PackageManagerService
UserManagerService
初始化AttributeCache
OverlayManagerService
startSensorService,启动Sensor服务

    private void startBootstrapServices() 

        // OS启动的基础已经搭好，但是接来下的启动可能会陷入死循环，这里检测预防这种情况
        RescueParty.noteBoot(mSystemContext);

        // 启动灯光管理服务
        traceBeginAndSlog("StartLightsService");
        mSystemServiceManager.startService(LightsService.class);
        traceEnd();

        // 启动显示管理服务，该服务需要在包管理服务前启动以提供相关服务
        traceBeginAndSlog("StartDisplayManager");
        mDisplayManagerService = mSystemServiceManager.startService(DisplayManagerService.class);
        traceEnd();

        // 等待显示管理服务启动完毕
        // mCurrentPhase = -1
        // Phase 100: 在初始化package manager之前，需要默认的显示.
        traceBeginAndSlog("WaitForDisplay");
        // 逐个调用已启动的服务的onBootPharse()方法,也就是等待mServices中各个服务启动完毕
        mSystemServiceManager.startBootPhase(SystemService.PHASE_WAIT_FOR_DEFAULT_DISPLAY);
        traceEnd();

        // 判断设备是否正在加密，是则仅运行核心
        String cryptState = SystemProperties.get("vold.decrypt");
        if (ENCRYPTING_STATE.equals(cryptState)) {
            Slog.w(TAG, "Detected encryption in progress - only parsing core apps");
            mOnlyCore = true;
        } else if (ENCRYPTED_STATE.equals(cryptState)) {
            Slog.w(TAG, "Device encrypted - only parsing core apps");
            mOnlyCore = true;
        }
        // 设备支持的情况下，启动RegionalizationService
        if (RegionalizationEnvironment.isSupported()) {
            Slog.i(TAG, "Regionalization Service");
            RegionalizationService regionalizationService = new RegionalizationService();
            ServiceManager.addService("regionalization", regionalizationService);
        }

        // 初始化包管理服务
        if (!mRuntimeRestart) {
            // 非Runtime重启时进入，输出event.log:"sysui_histogram: [boot_package_manager_init_start,11998]"
            MetricsLogger.histogram(null, "boot_package_manager_init_start",
                    (int) SystemClock.elapsedRealtime());
        }
        traceBeginAndSlog("StartPackageManagerService");
        // 启动PackageManagerService
        mPackageManagerService = PackageManagerService.main(mSystemContext, installer,
                mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore);
        mFirstBoot = mPackageManagerService.isFirstBoot();
        mPackageManager = mSystemContext.getPackageManager();
        traceEnd();
        if (!mRuntimeRestart && !isFirstBootOrUpgrade()) {
            // 非Runtime重启或者非第一次启动或更新时进入，输出event.log:"sysui_histogram: [boot_package_manager_init_ready,13942]"
            MetricsLogger.histogram(null, "boot_package_manager_init_ready",
                    (int) SystemClock.elapsedRealtime());
        }
        // 管理A / B OTA dexopting。这是一个引导程序服务，需要它在引导之后重命名A / B工件，在其他任何可能碰到/需要它们之前。
        // 注意：这在解密过程中不需要（反正我们没有/data）
        if (!mOnlyCore)  catch (Throwable e) {
                    reportWtf("starting OtaDexOptService", e);
                } finally {
                    traceEnd();
                }
            }
        }
        // 启动UserManagerService
        traceBeginAndSlog("StartUserManagerService");
        mSystemServiceManager.startService(UserManagerService.LifeCycle.class);
        traceEnd();

        // 初始化属性缓存，用于缓存来自包的资源
        traceBeginAndSlog("InitAttributerCache");
        AttributeCache.init(mSystemContext);
        traceEnd();

        // 设置系统进程的应用程序实例
        traceBeginAndSlog("SetSystemProcess");
        mActivityManagerService.setSystemProcess();
        traceEnd();

        // 因为AMS.setSystemProcess() 会覆盖策略,所以
        // DisplayManagerService需要设置android.display调度相关的策略
        mDisplayManagerService.setupSchedulerPolicies();

        // 启动OverlayManagerService，管理覆盖包
        traceBeginAndSlog("StartOverlayManagerService");
        mSystemServiceManager.startService(new OverlayManagerService(mSystemContext, installer));
        traceEnd();

        // 传感器服务需要访问PackageManagerService，AppOps和Permissions Service，因此我们在它们之后启动它
        // 启动传感器服务在一个单独的线程中，使用前应检查完成情况。
        mSensorServiceStart = SystemServerInitThreadPool.get().submit(() -> {
            BootTimingsTraceLog traceLog = new BootTimingsTraceLog(
                    SYSTEM_SERVER_TIMING_ASYNC_TAG, Trace.TRACE_TAG_SYSTEM_SERVER);
            traceLog.traceBegin(START_SENSOR_SERVICE);
            startSensorService();
            traceLog.traceEnd();
        }, START_SENSOR_SERVICE);
    }

    private void startCoreServices() 

    private void startOtherServices() 
            // Phase 600
            mSystemServiceManager.startBootPhase(
                    SystemService.PHASE_THIRD_PARTY_APPS_CAN_START);
            traceEnd();
            ......
        }, BOOT_TIMINGS_TRACE_LOG);
    }

Installer
DeviceIdentifiersPolicyService
ActivityManagerService.Lifecycle
PowerManagerService
RecoverySystemService
LightsService
DisplayManagerService
设备支持时：RegionalizationService
PackageManagerService
UserManagerService
OverlayManagerService
SensorService

DropBoxManagerService
BatteryService
UsageStatsService
WebViewUpdateService

AlarmManagerService、AccountManagerService、ContentService、InputManagerService、WindowManagerService…

ActivityManagerService PackageManagerService WindowManagerService
PowerManagerService BatteryService BatteryStatsService
DreamManagerService DropBoxManagerService SamplingProfilerService
UsageStatsService DiskStatsService DeviceStorageMonitorService
SchedulingPolicyService AlarmManagerService DeviceIdleController
ThermalObserver JobSchedulerService AccessibilityManagerService
DisplayManagerService LightsService GraphicsStatsService
StatusBarManagerService NotificationManagerService WallpaperManagerService
UiModeManagerService AppWidgetService LauncherAppsService
TextServicesManagerService ContentService LockSettingsService
InputMethodManagerService InputManagerService MountService
FingerprintService TvInputManagerService DockObserver
NetworkManagementService NetworkScoreService NetworkStatsService
NetworkPolicyManagerService ConnectivityService BluetoothService
WifiP2pService WifiService WifiScanningService
AudioService MediaRouterService VoiceInteractionManagerService
MediaProjectionManagerService MediaSessionService RegionalizationService
DevicePolicyManagerService PrintManagerService BackupManagerService
UserManagerService AccountManagerService TrustManagerService
SensorService LocationManagerService VibratorService
CountryDetectorService GestureLauncherService PersistentDataBlockService
EthernetService WebViewUpdateService ClipboardService
TelephonyRegistry TelecomLoaderService NsdService
UpdateLockService SerialService SearchManagerService
CommonTimeManagementService AssetAtlasService ConsumerIrService
MidiServiceCameraService TwilightService RestrictionsManagerService
MmsServiceBroker RttService UsbService