前一篇文章講到zygote啟動SS進(jìn)程，那么，SS會做些什么呢？

源碼參考Android4.1.1，涉及文件有SystemServer.java等(framework文件夾下)

public static void main(String[] args) {
    .....
    .....

        // Mmmmmm... more memory!
        dalvik.system.VMRuntime.getRuntime().clearGrowthLimit();

        // The system server has to run all of the time, so it needs to be
        // as efficient as possible with its memory usage.
        VMRuntime.getRuntime().setTargetHeapUtilization(0.8f);
//system_init.cpp的代碼將編譯成libandroid_servers.so庫
        System.loadLibrary("android_servers");
        init1(args);//調(diào)用到native層中的system_init.cpp中的system_init函數(shù)
    }

init1是本地函數(shù)，通過JIN調(diào)用com_android_server_SystemServer_init1.cpp文件中的init1函數(shù)，然后這個函數(shù)有調(diào)用 system_init();（system_init.cpp）:

extern "C" status_t system_init()
{
    ALOGI("Entered system_init()");

    sp<ProcessState> proc(ProcessState::self());
    //獲取到一個ServiceManager對象，SM是注冊系統(tǒng)服務(wù)的關(guān)鍵人物
    sp<IServiceManager> sm = defaultServiceManager();
    ALOGI("ServiceManager: %p\n", sm.get());

    sp<GrimReaper> grim = new GrimReaper();
    sm->asBinder()->linkToDeath(grim, grim.get(), 0);

    char propBuf[PROPERTY_VALUE_MAX];
    property_get("system_init.startsurfaceflinger", propBuf, "1");
    if (strcmp(propBuf, "1") == 0) {
        // Start the SurfaceFlinger
        SurfaceFlinger::instantiate();
    }

    property_get("system_init.startsensorservice", propBuf, "1");
    if (strcmp(propBuf, "1") == 0) {
        // Start the sensor service
        SensorService::instantiate();
    }

    // And now start the Android runtime.  We have to do this bit
    // of nastiness because the Android runtime initialization requires
    // some of the core system services to already be started.
    // All other servers should just start the Android runtime at
    // the beginning of their processes's main(), before calling
    // the init function.
    ALOGI("System server: starting Android runtime.\n");
    AndroidRuntime* runtime = AndroidRuntime::getRuntime();

    ALOGI("System server: starting Android services.\n");
    JNIEnv* env = runtime->getJNIEnv();
    if (env == NULL) {
        return UNKNOWN_ERROR;
    }
    jclass clazz = env->FindClass("com/android/server/SystemServer");
    if (clazz == NULL) {
        return UNKNOWN_ERROR;
    }
//下行獲取成員函數(shù)id
    jmethodID methodId = env->GetStaticMethodID(clazz, "init2", "()V");
    if (methodId == NULL) {
        return UNKNOWN_ERROR;
    }
    //下行將調(diào)用Java層的init2函數(shù)
    env->CallStaticVoidMethod(clazz, methodId);

    ALOGI("System server: entering thread pool.\n");
    ProcessState::self()->startThreadPool();
    IPCThreadState::self()->joinThreadPool();
    ALOGI("System server: exiting thread pool.\n");
    return NO_ERROR;
}

• 小結(jié)一下，這個本地函數(shù)的主要工作是做一些C++層的設(shè)置，然后call回Java層。
  再看init2函數(shù)：

 public static final void init2() {

        Slog.i(TAG, "Entered the Android system server!");

        Thread thr = new ServerThread();

        thr.setName("android.server.ServerThread");

        thr.start();//開啟線程，創(chuàng)建
Java
層的各種服務(wù)

    }

• 嗯，開啟線程，等等，線程的工作內(nèi)容是什么？

 @Override
    public void run() {
        EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_SYSTEM_RUN,
            SystemClock.uptimeMillis());

        Looper.prepare();

        android.os.Process.setThreadPriority(
                android.os.Process.THREAD_PRIORITY_FOREGROUND);

        BinderInternal.disableBackgroundScheduling(true);
        android.os.Process.setCanSelfBackground(false);
        ......
//包括（但不止）這些系統(tǒng)服務(wù)都會在此時被注冊
//所以，加入你想寫核心服務(wù)，你可能也需要在這里注冊自己。
 LightsService lights = null;
        PowerManagerService power = null;
        BatteryService battery = null;
        VibratorService vibrator = null;
        AlarmManagerService alarm = null;
        NetworkManagementService networkManagement = null;
        NetworkStatsService networkStats = null;
        NetworkPolicyManagerService networkPolicy = null;
        ConnectivityService connectivity = null;
        WifiP2pService wifiP2p = null;
        WifiService wifi = null;
        NsdService serviceDiscovery= null;
        IPackageManager pm = null;
        Context context = null;
        WindowManagerService wm = null;
        BluetoothService bluetooth = null;
        BluetoothA2dpService bluetoothA2dp = null;
        DockObserver dock = null;
        UsbService usb = null;
        SerialService serial = null;
        UiModeManagerService uiMode = null;
        RecognitionManagerService recognition = null;
        ThrottleService throttle = null;
        NetworkTimeUpdateService networkTimeUpdater = null;
        CommonTimeManagementService commonTimeMgmtService = null;
        InputManagerService inputManager = null;
        ......
            Slog.i(TAG, "Alarm Manager");
             //new 出AlarmManagerService對象
            alarm = new AlarmManagerService(context);
            //將這個服務(wù)注冊到系統(tǒng)中
            ServiceManager.addService(Context.ALARM_SERVICE, alarm);

       ......
          Slog.i(TAG, "Window Manager");
            wm = WindowManagerService.main(context, power,
                    factoryTest !=      SystemServer.FACTORY_TEST_LOW_LEVEL,
                    !firstBoot, onlyCore);
            ServiceManager.addService(Context.WINDOW_SERVICE, wm);
        .......
        looper.loop()

• 總之，在這個線程里面，就是把那些亂七八糟的系統(tǒng)服務(wù)都注冊好.我之所以說這個進(jìn)程是吊炸天的進(jìn)程，是因為Android的幾乎所有的核心服務(wù)都是在這里注冊和啟動的。包括但不限于AMS，WMS等等這些日常開發(fā)比較貼近的核心服務(wù)

但是其實這里只有非常深刻的Binder通信機(jī)制，暫且不說