前一篇文章讲到zygote启动SS进程，那么，SS会做些什么呢？

源码参考Android4.1.1，涉及文件有SystemServer.java等(framework文件夹下)

public static void main(String[] args) {
    .....
    .....

        // Mmmmmm... more memory!
        dalvik.system.VMRuntime.getRuntime().clearGrowthLimit();

        // The system server has to run all of the time, so it needs to be
        // as efficient as possible with its memory usage.
        VMRuntime.getRuntime().setTargetHeapUtilization(0.8f);
//system_init.cpp的代码将编译成libandroid_servers.so库
        System.loadLibrary("android_servers");
        init1(args);//调用到native层中的system_init.cpp中的system_init函数
    }

init1是本地函数，通过JIN调用com_android_server_SystemServer_init1.cpp文件中的init1函数，然后这个函数有调用 system_init();（system_init.cpp）:

extern "C" status_t system_init()
{
    ALOGI("Entered system_init()");

    sp<ProcessState> proc(ProcessState::self());
    //获取到一个ServiceManager对象，SM是注册系统服务的关键人物
    sp<IServiceManager> sm = defaultServiceManager();
    ALOGI("ServiceManager: %p\n", sm.get());

    sp<GrimReaper> grim = new GrimReaper();
    sm->asBinder()->linkToDeath(grim, grim.get(), 0);

    char propBuf[PROPERTY_VALUE_MAX];
    property_get("system_init.startsurfaceflinger", propBuf, "1");
    if (strcmp(propBuf, "1") == 0) {
        // Start the SurfaceFlinger
        SurfaceFlinger::instantiate();
    }

    property_get("system_init.startsensorservice", propBuf, "1");
    if (strcmp(propBuf, "1") == 0) {
        // Start the sensor service
        SensorService::instantiate();
    }

    // And now start the Android runtime.  We have to do this bit
    // of nastiness because the Android runtime initialization requires
    // some of the core system services to already be started.
    // All other servers should just start the Android runtime at
    // the beginning of their processes's main(), before calling
    // the init function.
    ALOGI("System server: starting Android runtime.\n");
    AndroidRuntime* runtime = AndroidRuntime::getRuntime();

    ALOGI("System server: starting Android services.\n");
    JNIEnv* env = runtime->getJNIEnv();
    if (env == NULL) {
        return UNKNOWN_ERROR;
    }
    jclass clazz = env->FindClass("com/android/server/SystemServer");
    if (clazz == NULL) {
        return UNKNOWN_ERROR;
    }
//下行获取成员函数id
    jmethodID methodId = env->GetStaticMethodID(clazz, "init2", "()V");
    if (methodId == NULL) {
        return UNKNOWN_ERROR;
    }
    //下行将调用Java层的init2函数
    env->CallStaticVoidMethod(clazz, methodId);

    ALOGI("System server: entering thread pool.\n");
    ProcessState::self()->startThreadPool();
    IPCThreadState::self()->joinThreadPool();
    ALOGI("System server: exiting thread pool.\n");
    return NO_ERROR;
}

• 小结一下，这个本地函数的主要工作是做一些C++层的设置，然后call回Java层。
  再看init2函数：

 public static final void init2() {

        Slog.i(TAG, "Entered the Android system server!");

        Thread thr = new ServerThread();

        thr.setName("android.server.ServerThread");

        thr.start();//开启线程，创建
Java
层的各种服务

    }

• 嗯，开启线程，等等，线程的工作内容是什么？

 @Override
    public void run() {
        EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_SYSTEM_RUN,
            SystemClock.uptimeMillis());

        Looper.prepare();

        android.os.Process.setThreadPriority(
                android.os.Process.THREAD_PRIORITY_FOREGROUND);

        BinderInternal.disableBackgroundScheduling(true);
        android.os.Process.setCanSelfBackground(false);
        ......
//包括（但不止）这些系统服务都会在此时被注册
//所以，加入你想写核心服务，你可能也需要在这里注册自己。
 LightsService lights = null;
        PowerManagerService power = null;
        BatteryService battery = null;
        VibratorService vibrator = null;
        AlarmManagerService alarm = null;
        NetworkManagementService networkManagement = null;
        NetworkStatsService networkStats = null;
        NetworkPolicyManagerService networkPolicy = null;
        ConnectivityService connectivity = null;
        WifiP2pService wifiP2p = null;
        WifiService wifi = null;
        NsdService serviceDiscovery= null;
        IPackageManager pm = null;
        Context context = null;
        WindowManagerService wm = null;
        BluetoothService bluetooth = null;
        BluetoothA2dpService bluetoothA2dp = null;
        DockObserver dock = null;
        UsbService usb = null;
        SerialService serial = null;
        UiModeManagerService uiMode = null;
        RecognitionManagerService recognition = null;
        ThrottleService throttle = null;
        NetworkTimeUpdateService networkTimeUpdater = null;
        CommonTimeManagementService commonTimeMgmtService = null;
        InputManagerService inputManager = null;
        ......
            Slog.i(TAG, "Alarm Manager");
             //new 出AlarmManagerService对象
            alarm = new AlarmManagerService(context);
            //将这个服务注册到系统中
            ServiceManager.addService(Context.ALARM_SERVICE, alarm);

       ......
          Slog.i(TAG, "Window Manager");
            wm = WindowManagerService.main(context, power,
                    factoryTest !=      SystemServer.FACTORY_TEST_LOW_LEVEL,
                    !firstBoot, onlyCore);
            ServiceManager.addService(Context.WINDOW_SERVICE, wm);
        .......
        looper.loop()

• 总之，在这个线程里面，就是把那些乱七八糟的系统服务都注册好.我之所以说这个进程是吊炸天的进程，是因为Android的几乎所有的核心服务都是在这里注册和启动的。包括但不限于AMS，WMS等等这些日常开发比较贴近的核心服务

但是其实这里只有非常深刻的Binder通信机制，暂且不说