SystemServer是被Zygote进程所启动的，首先调用了SystemServer的main函数

/frameworks/base/services/java/com/android/server/SystemServer.java

关键代码：

/**
 * The main entry point from zygote.
 */
public static void main(String[] args) {
    new SystemServer().run();
}

追踪run()函数

private void run() {
    try {
    // Prepare the main looper thread (this thread).
    android.os.Process.setThreadPriority(
        android.os.Process.THREAD_PRIORITY_FOREGROUND);
    android.os.Process.setCanSelfBackground(false);
    Looper.prepareMainLooper();
    // Create the system service manager.
    mSystemServiceManager = new SystemServiceManager(mSystemContext);
    mSystemServiceManager.setRuntimeRestarted(mRuntimeRestart);
    LocalServices.addService(SystemServiceManager.class, mSystemServiceManager);
    // Prepare the thread pool for init tasks that can be parallelized
    SystemServerInitThreadPool.get();
    // Start services.
    try {
        traceBeginAndSlog("StartServices");
        startBootstrapServices();
        /// M: For mtk systemserver
        sMtkSystemServerIns.startMtkBootstrapServices();
        startCoreServices();
        /// M: for mtk other service.
        sMtkSystemServerIns.startMtkCoreServices();
        startOtherServices();
        SystemServerInitThreadPool.shutdown();
    } 
    Looper.loop();

可以看到，上面的代码大概做了这些事：
初始化looper，创建SystemServiceManager，
准备线程池，启动各种服务，开启looper循环。

重点追踪函数：startBootstrapServices()

/**
 * Starts the small tangle of critical services that are needed to get
 * the system off the ground.  These services have complex mutual dependencies
 * which is why we initialize them all in one place here.  Unless your service
 * is also entwined in these dependencies, it should be initialized in one of
 * the other functions.
 */
private void startBootstrapServices() { 
    Installer installer = mSystemServiceManager.startService(Installer.class);
    // Activity manager runs the show.
    traceBeginAndSlog("StartActivityManager");
    mActivityManagerService = mSystemServiceManager.startService(
            ActivityManagerService.Lifecycle.class).getService();
    mActivityManagerService.setSystemServiceManager(mSystemServiceManager);
    mActivityManagerService.setInstaller(installer);
    // Power manager needs to be started early because other services need it.
    // Native daemons may be watching for it to be registered so it must be ready
    // to handle incoming binder calls immediately (including being able to verify
    // the permissions for those calls).
    traceBeginAndSlog("StartPowerManager");
    mPowerManagerService = mSystemServiceManager.startService(PowerManagerService.class);
    traceEnd();
    traceBeginAndSlog("StartPackageManagerService");
    mPackageManagerService = PackageManagerService.main(mSystemContext, installer,
            mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore);
    mFirstBoot = mPackageManagerService.isFirstBoot();
    mPackageManager = mSystemContext.getPackageManager();
    traceEnd();

在这里启动的服务都是互相依赖的，主要启动了AMS，PowerManagerService ，PackageManagerService 等

继续追踪关键代码：mActivityManagerService = mSystemServiceManager.startService(
        ActivityManagerService.Lifecycle.class).getService();

/**
 * Creates and starts a system service. The class must be a subclass of
 * {@link com.android.server.SystemService}.
 *
 * @param serviceClass A Java class that implements the SystemService interface.
 * @return The service instance, never null.
 * @throws RuntimeException if the service fails to start.
 */
@SuppressWarnings("unchecked")
public <T extends SystemService> T startService(Class<T> serviceClass) {
    try {
        final String name = serviceClass.getName();

        // Create the service.
        final T service;
        try {
            Constructor<T> constructor = serviceClass.getConstructor(Context.class);
            service = constructor.newInstance(mContext);
        }
        startService(service);
        return service;
    }
}

上述该部分代码，会构造一个service实例，并且调用startService(service)对这个实例进一步处理，最后返回service。

继续追踪代码：startService(service)

public void startService(@NonNull final SystemService service) {
    // Register it.
    mServices.add(service);
    // Start it.
    long time = SystemClock.elapsedRealtime();
    try {
        service.onStart();
    }
}

上述该部分代码，注册了service，并且调用了service的onStart()函数。

回过头看启动ActivityManagerService的代码：mActivityManagerService = mSystemServiceManager.startService(
        ActivityManagerService.Lifecycle.class).getService();
可知，ActivityManagerService.Lifecycle.class 就是 service，所以 ActivityManagerService.Lifecycle.class 的 onStart() 函数会被调用。

继续追踪代码：ActivityManagerService.Lifecycle

/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

public static final class Lifecycle extends SystemService {
    private final ActivityManagerService mService;

    public Lifecycle(Context context) {
        super(context);
        mService = new ActivityManagerService(context);
    }

    @Override
    public void onStart() {
        mService.start();
    }

    public ActivityManagerService getService() {
        return mService;
    }
}

上述该部分代码，在 AMS 的内部类 Lifecycle 中的 onStart 函数中，调用了 AMS 的 start() 函数。代码略。

回到SystemServer.java的run()函数，

因为startCoreServices()函数启动的服务不多，且跟AMS无关，略。

再重点追踪startOtherServices()函数：

/frameworks/base/services/java/com/android/server/SystemServer.java

/**
 * Starts a miscellaneous grab bag of stuff that has yet to be refactored
 * and organized.
 */
private void startOtherServices() {
mActivityManagerService.setWindowManager(wm);// 给 AMS 设置了 WMS，也可以认为是 AMS 跟 WMS 发生了交互
// We now tell the activity manager it is okay to run third party
// code.  It will call back into us once it has gotten to the state
// where third party code can really run (but before it has actually
// started launching the initial applications), for us to complete our
// initialization.
mActivityManagerService.systemReady(() -> {
    ......
    /// M: BOOTPROF
    sMtkSystemServerIns.addBootEvent("SystemServer:PhaseThirdPartyAppsCanStart");
}, BOOT_TIMINGS_TRACE_LOG);

追踪systemReady()函数：

/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

public void systemReady(final Runnable goingCallback, TimingsTraceLog traceLog) {
       synchronized (this) {
             startHomeActivityLocked(currentUserId, "systemReady");

可知，当AMS准备好后，就会启动HomeActivity，即Launcher。