frameworks/native/services/surfaceflinger/
  - main_surfaceflinger.cpp
  - SurfaceFlinger.cpp
  - DispSync.cpp
  - MessageQueue.cpp
  - DisplayHardware/HWComposer.cpp
  
frameworks/native/libs/gui/
  - DisplayEventReceiver.cpp
  - BitTube.cpp

service surfaceflinger /system/bin/surfaceflinger
    class core
    user system
    group graphics drmrpc
    onrestart restart zygote
    writepid /dev/cpuset/system-background/tasks

int main(int, char**) {
    ProcessState::self()->setThreadPoolMaxThreadCount(4);

    sp<ProcessState> ps(ProcessState::self());
    ps->startThreadPool();

    //实例化surfaceflinger【见小节2.2】
    sp<SurfaceFlinger> flinger =  new SurfaceFlinger();

    setpriority(PRIO_PROCESS, 0, PRIORITY_URGENT_DISPLAY);
    set_sched_policy(0, SP_FOREGROUND);

    //初始化【见小节2.3】
    flinger->init();

    //发布surface flinger，注册到Service Manager
    sp<IServiceManager> sm(defaultServiceManager());
    sm->addService(String16(SurfaceFlinger::getServiceName()), flinger, false);

    // 运行在当前线程【见小节2.11】
    flinger->run();

    return 0;
}

SurfaceFlinger::SurfaceFlinger()
    :   BnSurfaceComposer(),
        mTransactionFlags(0),
        mTransactionPending(false),
        mAnimTransactionPending(false),
        mLayersRemoved(false),
        mRepaintEverything(0),
        mRenderEngine(NULL),
        mBootTime(systemTime()),
        mVisibleRegionsDirty(false),
        mHwWorkListDirty(false),
        mAnimCompositionPending(false),
        mDebugRegion(0),
        mDebugDDMS(0),
        mDebugDisableHWC(0),
        mDebugDisableTransformHint(0),
        mDebugInSwapBuffers(0),
        mLastSwapBufferTime(0),
        mDebugInTransaction(0),
        mLastTransactionTime(0),
        mBootFinished(false),
        mForceFullDamage(false),
        mPrimaryHWVsyncEnabled(false),
        mHWVsyncAvailable(false),
        mDaltonize(false),
        mHasColorMatrix(false),
        mHasPoweredOff(false),
        mFrameBuckets(),
        mTotalTime(0),
        mLastSwapTime(0)
{
    ALOGI("SurfaceFlinger is starting");
    char value[PROPERTY_VALUE_MAX];

    property_get("ro.bq.gpu_to_cpu_unsupported", value, "0");
    mGpuToCpuSupported = !atoi(value);

    property_get("debug.sf.showupdates", value, "0");
    mDebugRegion = atoi(value);

    property_get("debug.sf.ddms", value, "0");
    mDebugDDMS = atoi(value);       
}

void SurfaceFlinger::onFirstRef()
{
    mEventQueue.init(this);
}

void MessageQueue::init(const sp<SurfaceFlinger>& flinger)
{
    mFlinger = flinger;
    mLooper = new Looper(true);
    mHandler = new Handler(*this); //【见小节2.2.3】
}

class MessageQueue {
    class Handler : public MessageHandler {
        enum {
            eventMaskInvalidate     = 0x1,
            eventMaskRefresh        = 0x2,
            eventMaskTransaction    = 0x4
        };
        MessageQueue& mQueue;
        int32_t mEventMask;
    public:
        Handler(MessageQueue& queue) : mQueue(queue), mEventMask(0) { }
        virtual void handleMessage(const Message& message);
        void dispatchRefresh();
        void dispatchInvalidate();
        void dispatchTransaction();
    };
    ...
}

void SurfaceFlinger::init() {
    Mutex::Autolock _l(mStateLock);

    //初始化EGL，作为默认的显示
    mEGLDisplay = eglGetDisplay(EGL_DEFAULT_DISPLAY);
    eglInitialize(mEGLDisplay, NULL, NULL);

    // 初始化硬件composer对象【见小节2.4】
    mHwc = new HWComposer(this, *static_cast<HWComposer::EventHandler *>(this));

    //获取RenderEngine引擎
    mRenderEngine = RenderEngine::create(mEGLDisplay, mHwc->getVisualID());

    //检索创建的EGL上下文
    mEGLContext = mRenderEngine->getEGLContext();

    //初始化非虚拟显示屏【见小节2.5】
    for (size_t i=0 ; i<DisplayDevice::NUM_BUILTIN_DISPLAY_TYPES ; i++) {
        DisplayDevice::DisplayType type((DisplayDevice::DisplayType)i);
        //建立已连接的显示设备
        if (mHwc->isConnected(i) || type==DisplayDevice::DISPLAY_PRIMARY) {
            bool isSecure = true;
            createBuiltinDisplayLocked(type);
            wp<IBinder> token = mBuiltinDisplays[i];

            sp<IGraphicBufferProducer> producer;
            sp<IGraphicBufferConsumer> consumer;
            //创建BufferQueue的生产者和消费者
            BufferQueue::createBufferQueue(&producer, &consumer,
                    new GraphicBufferAlloc());

            sp<FramebufferSurface> fbs = new FramebufferSurface(*mHwc, i, consumer);
            int32_t hwcId = allocateHwcDisplayId(type);
            //创建显示设备
            sp<DisplayDevice> hw = new DisplayDevice(this,
                    type, hwcId, mHwc->getFormat(hwcId), isSecure, token,
                    fbs, producer,
                    mRenderEngine->getEGLConfig());
            if (i > DisplayDevice::DISPLAY_PRIMARY) {
                hw->setPowerMode(HWC_POWER_MODE_NORMAL);
            }
            mDisplays.add(token, hw);
        }
    }

    getDefaultDisplayDevice()->makeCurrent(mEGLDisplay, mEGLContext);

    //当应用和sf的vsync偏移量一致时，则只创建一个EventThread线程
    if (vsyncPhaseOffsetNs != sfVsyncPhaseOffsetNs) {
        sp<VSyncSource> vsyncSrc = new DispSyncSource(&mPrimaryDispSync,
                vsyncPhaseOffsetNs, true, "app");
        mEventThread = new EventThread(vsyncSrc);
        sp<VSyncSource> sfVsyncSrc = new DispSyncSource(&mPrimaryDispSync,
                sfVsyncPhaseOffsetNs, true, "sf");
        mSFEventThread = new EventThread(sfVsyncSrc);
        mEventQueue.setEventThread(mSFEventThread);
    } else {
        //创建DispSyncSource对象【2.6】
        sp<VSyncSource> vsyncSrc = new DispSyncSource(&mPrimaryDispSync,
                vsyncPhaseOffsetNs, true, "sf-app");
        //创建线程EventThread 【见小节2.7】
        mEventThread = new EventThread(vsyncSrc);
        //设置EventThread 【见小节2.8】
        mEventQueue.setEventThread(mEventThread);
    }

    //【见小节2.9】
    mEventControlThread = new EventControlThread(this);
    mEventControlThread->run("EventControl", PRIORITY_URGENT_DISPLAY);

    //当不存在HWComposer时，则设置软件vsync
    if (mHwc->initCheck() != NO_ERROR) {
        mPrimaryDispSync.setPeriod(16666667);
    }

    //初始化绘图状态
    mDrawingState = mCurrentState;

    //初始化显示设备
    initializeDisplays();

    //启动开机动画【2.10】
    startBootAnim();
}

HWComposer::HWComposer(
        const sp<SurfaceFlinger>& flinger,
        EventHandler& handler)
    : mFlinger(flinger),
      mFbDev(0), mHwc(0), mNumDisplays(1),
      mCBContext(new cb_context),
      mEventHandler(handler),
      mDebugForceFakeVSync(false)
{
    ...
    bool needVSyncThread = true;
    int fberr = loadFbHalModule(); //加载framebuffer的HAL层模块
    loadHwcModule(); //加载HWComposer模块

    //标记已分配的display ID
    for (size_t i=0 ; i<NUM_BUILTIN_DISPLAYS ; i++) {
        mAllocatedDisplayIDs.markBit(i);
    }

    if (mHwc) {
        if (mHwc->registerProcs) {
            mCBContext->hwc = this;
            mCBContext->procs.invalidate = &hook_invalidate;
            //VSYNC信号的回调方法
            mCBContext->procs.vsync = &hook_vsync;
            if (hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_1))
                mCBContext->procs.hotplug = &hook_hotplug;
            else
                mCBContext->procs.hotplug = NULL;
            memset(mCBContext->procs.zero, 0, sizeof(mCBContext->procs.zero));
            //注册回调函数
            mHwc->registerProcs(mHwc, &mCBContext->procs);
        }

        //进入此处，说明已成功打开硬件composer设备，则不再需要vsync线程
        needVSyncThread = false;
        eventControl(HWC_DISPLAY_PRIMARY, HWC_EVENT_VSYNC, 0);
        ...
    }
    ...

    if (needVSyncThread) {
        //不支持硬件的VSYNC，则会创建线程来模拟定时VSYNC信号
        mVSyncThread = new VSyncThread(*this);
    }
}

void SurfaceFlinger::init() {
    ...
    for (size_t i=0 ; i<DisplayDevice::NUM_BUILTIN_DISPLAY_TYPES ; i++) {
        DisplayDevice::DisplayType type((DisplayDevice::DisplayType)i);
        //建立已连接的显示设备
        if (mHwc->isConnected(i) || type==DisplayDevice::DISPLAY_PRIMARY) {
            bool isSecure = true;
            createBuiltinDisplayLocked(type);
            wp<IBinder> token = mBuiltinDisplays[i];

            sp<IGraphicBufferProducer> producer;
            sp<IGraphicBufferConsumer> consumer;
            //创建BufferQueue的生产者和消费者
            BufferQueue::createBufferQueue(&producer, &consumer,
                    new GraphicBufferAlloc());

            sp<FramebufferSurface> fbs = new FramebufferSurface(*mHwc, i, consumer);
            int32_t hwcId = allocateHwcDisplayId(type);
            //创建显示设备
            sp<DisplayDevice> hw = new DisplayDevice(this,
                    type, hwcId, mHwc->getFormat(hwcId), isSecure, token,
                    fbs, producer,
                    mRenderEngine->getEGLConfig());
            if (i > DisplayDevice::DISPLAY_PRIMARY) {
                hw->setPowerMode(HWC_POWER_MODE_NORMAL);
            }
            mDisplays.add(token, hw);
        }
    }
    ...
}

class DispSyncSource : public VSyncSource, private DispSync::Callback {
  DispSyncSource(DispSync* dispSync, nsecs_t phaseOffset, bool traceVsync,
      const char* label) :
          mValue(0),
          mTraceVsync(traceVsync),
          mVsyncOnLabel(String8::format("VsyncOn-%s", label)),
          mVsyncEventLabel(String8::format("VSYNC-%s", label)),
          mDispSync(dispSync),
          mCallbackMutex(),
          mCallback(),
          mVsyncMutex(),
          mPhaseOffset(phaseOffset),
          mEnabled(false) {}
  ...   }

EventThread::EventThread(const sp<VSyncSource>& src)
    : mVSyncSource(src),
      mUseSoftwareVSync(false),
      mVsyncEnabled(false),
      mDebugVsyncEnabled(false),
      mVsyncHintSent(false) {

    for (int32_t i=0 ; i<DisplayDevice::NUM_BUILTIN_DISPLAY_TYPES ; i++) {
        mVSyncEvent[i].header.type = DisplayEventReceiver::DISPLAY_EVENT_VSYNC;
        mVSyncEvent[i].header.id = 0;
        mVSyncEvent[i].header.timestamp = 0;
        mVSyncEvent[i].vsync.count =  0;
    }
    struct sigevent se;
    se.sigev_notify = SIGEV_THREAD;
    se.sigev_value.sival_ptr = this;
    se.sigev_notify_function = vsyncOffCallback;
    se.sigev_notify_attributes = NULL;
    timer_create(CLOCK_MONOTONIC, &se, &mTimerId);
}

void EventThread::onFirstRef() {
    //运行EventThread线程【见小节2.7.2】
    run("EventThread", PRIORITY_URGENT_DISPLAY + PRIORITY_MORE_FAVORABLE);
}

bool EventThread::threadLoop() {
    DisplayEventReceiver::Event event;
    Vector< sp<EventThread::Connection> > signalConnections;
    // 等待事件【见小节2.7.3】
    signalConnections = waitForEvent(&event); 

    //分发事件给所有的监听者
    const size_t count = signalConnections.size();
    for (size_t i=0 ; i<count ; i++) {
        const sp<Connection>& conn(signalConnections[i]);
        //传递事件【见小节3.10】
        status_t err = conn->postEvent(event);
        if (err == -EAGAIN || err == -EWOULDBLOCK) {
            //可能此时connection已满，则直接抛弃事件
            ALOGW("EventThread: dropping event (%08x) for connection %p",
                    event.header.type, conn.get());
        } else if (err < 0) {
            //发生致命错误，则清理该连接
            removeDisplayEventConnection(signalConnections[i]);
        }
    }
    return true;
}

Vector< sp<EventThread::Connection> > EventThread::waitForEvent(
        DisplayEventReceiver::Event* event)
{
    Mutex::Autolock _l(mLock);
    Vector< sp<EventThread::Connection> > signalConnections;

    do {
        bool eventPending = false;
        bool waitForVSync = false;

        size_t vsyncCount = 0;
        nsecs_t timestamp = 0;
        for (int32_t i=0 ; i<DisplayDevice::NUM_BUILTIN_DISPLAY_TYPES ; i++) {
            timestamp = mVSyncEvent[i].header.timestamp;
            if (timestamp) {
                *event = mVSyncEvent[i];
                mVSyncEvent[i].header.timestamp = 0;
                vsyncCount = mVSyncEvent[i].vsync.count;
                break;
            }
        }

        if (!timestamp) {
            //没有vsync事件，则查看其它事件
            eventPending = !mPendingEvents.isEmpty();
            if (eventPending) {
                //存在其它事件可用于分发
                *event = mPendingEvents[0];
                mPendingEvents.removeAt(0);
            }
        }

        //查找正在等待事件的连接
        size_t count = mDisplayEventConnections.size();
        for (size_t i=0 ; i<count ; i++) {
            sp<Connection> connection(mDisplayEventConnections[i].promote());
            if (connection != NULL) {
                bool added = false;
                if (connection->count >= 0) {
                    //需要vsync事件，由于至少存在一个连接正在等待vsync
                    waitForVSync = true;
                    if (timestamp) {
                        if (connection->count == 0) {
                            connection->count = -1;
                            signalConnections.add(connection);
                            added = true;
                        } else if (connection->count == 1 ||
                                (vsyncCount % connection->count) == 0) {
                            signalConnections.add(connection);
                            added = true;
                        }
                    }
                }

                if (eventPending && !timestamp && !added) {
                    //没有vsync事件需要处理(timestamp==0),但存在pending消息
                    signalConnections.add(connection);
                }
            } else {
                //该连接已死亡，则直接清理
                mDisplayEventConnections.removeAt(i);
                --i; --count;
            }
        }

        if (timestamp && !waitForVSync) {
            //接收到VSYNC，但没有client需要它，则直接关闭VSYNC
            disableVSyncLocked();
        } else if (!timestamp && waitForVSync) {
            //至少存在一个client，则需要使能VSYNC
            enableVSyncLocked();
        }

        if (!timestamp && !eventPending) {
            if (waitForVSync) {
                bool softwareSync = mUseSoftwareVSync;
                nsecs_t timeout = softwareSync ? ms2ns(16) : ms2ns(1000);
                if (mCondition.waitRelative(mLock, timeout) == TIMED_OUT) {
                    mVSyncEvent[0].header.type = DisplayEventReceiver::DISPLAY_EVENT_VSYNC;
                    mVSyncEvent[0].header.id = DisplayDevice::DISPLAY_PRIMARY;
                    mVSyncEvent[0].header.timestamp = systemTime(SYSTEM_TIME_MONOTONIC);
                    mVSyncEvent[0].vsync.count++;
                }
            } else {
                //不存在对vsync感兴趣的连接，即将要进入休眠
                mCondition.wait(mLock);
            }
        }
    } while (signalConnections.isEmpty());

    //到此处，则保证存在timestamp以及连接
    return signalConnections;
}

void MessageQueue::setEventThread(const sp<EventThread>& eventThread)
{
    mEventThread = eventThread;
    //创建连接
    mEvents = eventThread->createEventConnection();
    //获取BitTube对象
    mEventTube = mEvents->getDataChannel();
    //监听BitTube，一旦有数据到来则调用cb_eventReceiver()
    mLooper->addFd(mEventTube->getFd(), 0, Looper::EVENT_INPUT,
            MessageQueue::cb_eventReceiver, this);
}

EventControlThread::EventControlThread(const sp<SurfaceFlinger>& flinger):
        mFlinger(flinger),
        mVsyncEnabled(false) {
}

bool EventControlThread::threadLoop() {
    Mutex::Autolock lock(mMutex);
    bool vsyncEnabled = mVsyncEnabled;

    mFlinger->eventControl(HWC_DISPLAY_PRIMARY, SurfaceFlinger::EVENT_VSYNC,
            mVsyncEnabled);

    while (true) {
        status_t err = mCond.wait(mMutex);
        ...
        
        if (vsyncEnabled != mVsyncEnabled) {
            mFlinger->eventControl(HWC_DISPLAY_PRIMARY,
                    SurfaceFlinger::EVENT_VSYNC, mVsyncEnabled);
            vsyncEnabled = mVsyncEnabled;
        }
    }

    return false;
}

void SurfaceFlinger::startBootAnim() {
    property_set("service.bootanim.exit", "0");
    property_set("ctl.start", "bootanim");
}

void SurfaceFlinger::run() {
    do {
        //不断循环地等待事件【见小节2.12】
        waitForEvent(); 
    } while (true);
}

void SurfaceFlinger::waitForEvent() {
    mEventQueue.waitMessage(); //【2.13】
}

void MessageQueue::waitMessage() {
    do {
        IPCThreadState::self()->flushCommands();
        int32_t ret = mLooper->pollOnce(-1);
        ...
    } while (true);
}

void HWComposer::hook_vsync(const struct hwc_procs* procs, int disp,
        int64_t timestamp) {
    cb_context* ctx = reinterpret_cast<cb_context*>(
            const_cast<hwc_procs_t*>(procs));
    ctx->hwc->vsync(disp, timestamp); //【见小节3.2】
}

void HWComposer::vsync(int disp, int64_t timestamp) {
    if (uint32_t(disp) < HWC_NUM_PHYSICAL_DISPLAY_TYPES) {
        {
            Mutex::Autolock _l(mLock);
            if (timestamp == mLastHwVSync[disp]) {
                return; //忽略重复的VSYNC信号
            }
            mLastHwVSync[disp] = timestamp;
        }
        //【见小节3.3】
        mEventHandler.onVSyncReceived(disp, timestamp);
    }
}

void SurfaceFlinger::onVSyncReceived(int type, nsecs_t timestamp) {
    bool needsHwVsync = false;

    {
        Mutex::Autolock _l(mHWVsyncLock);
        if (type == 0 && mPrimaryHWVsyncEnabled) {
            // 此处mPrimaryDispSync为DispSync类【见小节3.4】
            needsHwVsync = mPrimaryDispSync.addResyncSample(timestamp);
        }
    }

    if (needsHwVsync) {
        enableHardwareVsync();
    } else {
        disableHardwareVsync(false);
    }
}

DispSync::DispSync() :
        mRefreshSkipCount(0),
        mThread(new DispSyncThread()) {
    //【见小节3.4.2】
    mThread->run("DispSync", PRIORITY_URGENT_DISPLAY + PRIORITY_MORE_FAVORABLE);

    reset();
    beginResync();
    ...
}

virtual bool threadLoop() {
     status_t err;
     nsecs_t now = systemTime(SYSTEM_TIME_MONOTONIC);
     nsecs_t nextEventTime = 0;

     while (true) {
         Vector<CallbackInvocation> callbackInvocations;

         nsecs_t targetTime = 0;
         { // Scope for lock
             Mutex::Autolock lock(mMutex);
             if (mStop) {
                 return false;
             }

             if (mPeriod == 0) {
                 err = mCond.wait(mMutex);
                 continue;
             }

             nextEventTime = computeNextEventTimeLocked(now);
             targetTime = nextEventTime;
             bool isWakeup = false;

             if (now < targetTime) {
                 err = mCond.waitRelative(mMutex, targetTime - now);
                 if (err == TIMED_OUT) {
                     isWakeup = true;
                 } else if (err != NO_ERROR) {
                     return false;
                 }
             }

             now = systemTime(SYSTEM_TIME_MONOTONIC);

             if (isWakeup) {
                 mWakeupLatency = ((mWakeupLatency * 63) +
                         (now - targetTime)) / 64;
                 if (mWakeupLatency > 500000) {
                     mWakeupLatency = 500000;
                 }
             }
             //收集vsync信号的所有回调方法
             callbackInvocations = gatherCallbackInvocationsLocked(now);
         }

         if (callbackInvocations.size() > 0) {
             //回调所有对象的onDispSyncEvent方法
             fireCallbackInvocations(callbackInvocations);
         }
     }

     return false;
 }   

bool DispSync::addResyncSample(nsecs_t timestamp) {
    Mutex::Autolock lock(mMutex);

    size_t idx = (mFirstResyncSample + mNumResyncSamples) % MAX_RESYNC_SAMPLES;
    mResyncSamples[idx] = timestamp;

    if (mNumResyncSamples < MAX_RESYNC_SAMPLES) {
        mNumResyncSamples++;
    } else {
        mFirstResyncSample = (mFirstResyncSample + 1) % MAX_RESYNC_SAMPLES;
    }

    updateModelLocked(); //【见小节3.5】

    if (mNumResyncSamplesSincePresent++ > MAX_RESYNC_SAMPLES_WITHOUT_PRESENT) {
        resetErrorLocked();
    }

    if (kIgnorePresentFences) {
        return mThread->hasAnyEventListeners();
    }

    return mPeriod == 0 || mError > kErrorThreshold;
}

void DispSync::updateModelLocked() {
    ...
    //【见小节3.6】
    mThread->updateModel(mPeriod, mPhase);
}

class DispSyncThread: public Thread {
    void updateModel(nsecs_t period, nsecs_t phase) {
        Mutex::Autolock lock(mMutex);
        mPeriod = period;
        mPhase = phase;
        mCond.signal(); //唤醒目标线程
    }
}

virtual bool threadLoop() {
     ...
     while (true) {
         Vector<CallbackInvocation> callbackInvocations;

         nsecs_t targetTime = 0;
         { // Scope for lock
             Mutex::Autolock lock(mMutex);
            ...
             if (now < targetTime) {
                 err = mCond.waitRelative(mMutex, targetTime - now);
                 ...
             }
             ...
             //收集vsync信号的所有回调方法
             callbackInvocations = gatherCallbackInvocationsLocked(now);
         }

         if (callbackInvocations.size() > 0) {
             //回调所有对象的onDispSyncEvent方法 【见小节3.7.1】
             fireCallbackInvocations(callbackInvocations);
         }
     }

     return false;
 } 

void fireCallbackInvocations(const Vector<CallbackInvocation>& callbacks) {
    for (size_t i = 0; i < callbacks.size(); i++) {
        //【见小节3.8】
        callbacks[i].mCallback->onDispSyncEvent(callbacks[i].mEventTime);
    }
}

virtual void onDispSyncEvent(nsecs_t when) {
    sp<VSyncSource::Callback> callback;
    {
       Mutex::Autolock lock(mCallbackMutex);
       callback = mCallback;
    }

    if (callback != NULL) {
      callback->onVSyncEvent(when); //【见小节3.9】
    }
}

void EventThread::onVSyncEvent(nsecs_t timestamp) {
    Mutex::Autolock _l(mLock);
    mVSyncEvent[0].header.type = DisplayEventReceiver::DISPLAY_EVENT_VSYNC;
    mVSyncEvent[0].header.id = 0;
    mVSyncEvent[0].header.timestamp = timestamp;
    mVSyncEvent[0].vsync.count++;
    mCondition.broadcast(); //唤醒EventThread线程
}

status_t EventThread::Connection::postEvent(
        const DisplayEventReceiver::Event& event) {
    ssize_t size = DisplayEventReceiver::sendEvents(mChannel, &event, 1);
    return size < 0 ? status_t(size) : status_t(NO_ERROR);
}

ssize_t DisplayEventReceiver::sendEvents(const sp<BitTube>& dataChannel,
        Event const* events, size_t count)
{
    return BitTube::sendObjects(dataChannel, events, count);
}

int MessageQueue::cb_eventReceiver(int fd, int events, void* data) {
    MessageQueue* queue = reinterpret_cast<MessageQueue *>(data);
    return queue->eventReceiver(fd, events);
}

int MessageQueue::eventReceiver(int /*fd*/, int /*events*/) {
    ssize_t n;
    DisplayEventReceiver::Event buffer[8];
    while ((n = DisplayEventReceiver::getEvents(mEventTube, buffer, 8)) > 0) {
        for (int i=0 ; i<n ; i++) {
            if (buffer[i].header.type == DisplayEventReceiver::DISPLAY_EVENT_VSYNC) {
#if INVALIDATE_ON_VSYNC
                mHandler->dispatchInvalidate();
#else
                mHandler->dispatchRefresh(); //【见小节3.12】
#endif
                break;
            }
        }
    }
    return 1;
}

void MessageQueue::Handler::dispatchRefresh() {
    if ((android_atomic_or(eventMaskRefresh, &mEventMask) & eventMaskRefresh) == 0) {
        //发送消息，则进入handleMessage过程【见小节3.13】
        mQueue.mLooper->sendMessage(this, Message(MessageQueue::REFRESH));
    }
}

void MessageQueue::Handler::handleMessage(const Message& message) {
    switch (message.what) {
        case INVALIDATE:
            android_atomic_and(~eventMaskInvalidate, &mEventMask);
            mQueue.mFlinger->onMessageReceived(message.what);
            break;
        case REFRESH:
            android_atomic_and(~eventMaskRefresh, &mEventMask);
            mQueue.mFlinger->onMessageReceived(message.what);//【见小节3.14】
            break;
        case TRANSACTION:
            android_atomic_and(~eventMaskTransaction, &mEventMask);
            mQueue.mFlinger->onMessageReceived(message.what);
            break;
    }
}

void SurfaceFlinger::onMessageReceived(int32_t what) {
    ATRACE_CALL();
    switch (what) {
        case MessageQueue::TRANSACTION: {
            handleMessageTransaction();
            break;
        }
        case MessageQueue::INVALIDATE: {
            bool refreshNeeded = handleMessageTransaction();
            refreshNeeded |= handleMessageInvalidate();
            refreshNeeded |= mRepaintEverything;
            if (refreshNeeded) {
                signalRefresh();
            }
            break;
        }
        case MessageQueue::REFRESH: {
            handleMessageRefresh();
            break;
        }
    }
}

void SurfaceFlinger::handleMessageRefresh() {
    ATRACE_CALL();
    preComposition();
    rebuildLayerStacks();
    setUpHWComposer();
    doDebugFlashRegions();
    doComposition();
    postComposition();
}

frameworks/native/services/surfaceflinger
    - Layer.cpp
    - Client.cpp

void SurfaceFlinger::handleMessageRefresh() {
    ATRACE_CALL();
    preComposition(); //【见小节2.1】
    rebuildLayerStacks(); //【见小节3.1】
    setUpHWComposer(); //【见小节4.1】
    doDebugFlashRegions(); 
    doComposition(); //【见小节5.1】
    postComposition(); //【见小节6.1】
}

void SurfaceFlinger::preComposition()
{
    bool needExtraInvalidate = false;
    const LayerVector& layers(mDrawingState.layersSortedByZ);
    const size_t count = layers.size();
    for (size_t i=0 ; i<count ; i++) {
        //回调每个图层onPreComposition方法【见小节2.2】
        if (layers[i]->onPreComposition()) {
            needExtraInvalidate = true;
        }
    }
    
    //当存在图层有变化，则发送invalidate消息
    if (needExtraInvalidate) {
        signalLayerUpdate(); //【见小节2.3】
    }
}

struct State {
    //所有参与绘制的Layer图层
    LayerVector layersSortedByZ; 
    //所有输出设备的对象
    DefaultKeyedVector< wp<IBinder>, DisplayDeviceState> displays;
};

bool Layer::onPreComposition() {
    mRefreshPending = false;
    return mQueuedFrames > 0 || mSidebandStreamChanged;
}

void Layer::onFrameAvailable(const BufferItem& item) {
    { // Autolock scope
        Mutex::Autolock lock(mQueueItemLock);

        if (item.mFrameNumber == 1) {
            mLastFrameNumberReceived = 0;
        }

        while (item.mFrameNumber != mLastFrameNumberReceived + 1) {
            status_t result = mQueueItemCondition.waitRelative(mQueueItemLock,
                    ms2ns(500));
        }

        mQueueItems.push_back(item);
        android_atomic_inc(&mQueuedFrames); //加1操作

        //唤醒所有pending的回调方法
        mLastFrameNumberReceived = item.mFrameNumber;
        mQueueItemCondition.broadcast();
    }

    mFlinger->signalLayerUpdate(); //【见小节2.3】
}

void SurfaceFlinger::signalLayerUpdate() {
    mEventQueue.invalidate();
}

void MessageQueue::invalidate() {
#if INVALIDATE_ON_VSYNC
    mEvents->requestNextVsync();
#else
    mHandler->dispatchInvalidate();
#endif
}

void MessageQueue::Handler::dispatchInvalidate() {
    if ((android_atomic_or(eventMaskInvalidate, &mEventMask) & eventMaskInvalidate) == 0) {
        mQueue.mLooper->sendMessage(this, Message(MessageQueue::INVALIDATE));
    }
}

void MessageQueue::Handler::handleMessage(const Message& message) {
    switch (message.what) {
        case INVALIDATE:
            android_atomic_and(~eventMaskInvalidate, &mEventMask);
            mQueue.mFlinger->onMessageReceived(message.what);
            break;
        case REFRESH:
            android_atomic_and(~eventMaskRefresh, &mEventMask);
            mQueue.mFlinger->onMessageReceived(message.what);
            break;
        case TRANSACTION:
            android_atomic_and(~eventMaskTransaction, &mEventMask);
            mQueue.mFlinger->onMessageReceived(message.what);
            break;
    }
}

void SurfaceFlinger::onMessageReceived(int32_t what) {
    ATRACE_CALL();
    switch (what) {
        case MessageQueue::TRANSACTION: {
            handleMessageTransaction();
            break;
        }
        case MessageQueue::INVALIDATE: {
            //【见小节2.4】
            bool refreshNeeded = handleMessageTransaction();
            //【见小节2.5】
            refreshNeeded |= handleMessageInvalidate();
            refreshNeeded |= mRepaintEverything;
            if (refreshNeeded) {
                signalRefresh(); //【见小节2.6】
            }
            break;
        }
        case MessageQueue::REFRESH: {
            handleMessageRefresh();
            break;
        }
    }
}

bool SurfaceFlinger::handleMessageTransaction() {
    uint32_t transactionFlags = peekTransactionFlags(eTransactionMask);
    if (transactionFlags) {
        handleTransaction(transactionFlags); //【见小节2.4.1】
        return true;
    }
    return false;
}

void SurfaceFlinger::handleTransaction(uint32_t transactionFlags)
{
    State drawingState(mDrawingState);

    Mutex::Autolock _l(mStateLock);
    const nsecs_t now = systemTime();
    mDebugInTransaction = now;

    transactionFlags = getTransactionFlags(eTransactionMask);
    handleTransactionLocked(transactionFlags); //【见小节2.4.2】

    mLastTransactionTime = systemTime() - now;
    mDebugInTransaction = 0;
    //设置mHwWorkListDirty=true
    invalidateHwcGeometry();
}

void SurfaceFlinger::handleTransactionLocked(uint32_t transactionFlags)
{
    const LayerVector& currentLayers(mCurrentState.layersSortedByZ);
    const size_t count = currentLayers.size();

    //遍历所有Layer来执行其doTransaction方法
    if (transactionFlags & eTraversalNeeded) {
        for (size_t i=0 ; i<count ; i++) {
            const sp<Layer>& layer(currentLayers[i]);
            uint32_t trFlags = layer->getTransactionFlags(eTransactionNeeded);
            if (!trFlags) continue; //layer标志未改变则继续
            //【见小节2.4.3】
            const uint32_t flags = layer->doTransaction(0);
            if (flags & Layer::eVisibleRegion)
                mVisibleRegionsDirty = true; //Layer成为可见，需更新
        }
    }

    // 处理显示设备的改变
    if (transactionFlags & eDisplayTransactionNeeded) {
        //当前显示设备状态的列表
        const KeyedVector<  wp<IBinder>, DisplayDeviceState>& curr(mCurrentState.displays);
        //之前使用过的显示设备状态的列表
        const KeyedVector<  wp<IBinder>, DisplayDeviceState>& draw(mDrawingState.displays);
        if (!curr.isIdenticalTo(draw)) {
            mVisibleRegionsDirty = true;
            const size_t cc = curr.size();
                  size_t dc = draw.size();

            for (size_t i=0 ; i<dc ; i++) {
                const ssize_t j = curr.indexOfKey(draw.keyAt(i));
                if (j < 0) {
                    if (!draw[i].isMainDisplay()) {
                        const sp<const DisplayDevice> defaultDisplay(getDefaultDisplayDevice());
                        defaultDisplay->makeCurrent(mEGLDisplay, mEGLContext);
                        sp<DisplayDevice> hw(getDisplayDevice(draw.keyAt(i)));
                        if (hw != NULL)
                            hw->disconnect(getHwComposer());
                        if (draw[i].type < DisplayDevice::NUM_BUILTIN_DISPLAY_TYPES)
                            mEventThread->onHotplugReceived(draw[i].type, false);
                        mDisplays.removeItem(draw.keyAt(i));
                    }
                } else {
                    const DisplayDeviceState& state(curr[j]);
                    const wp<IBinder>& display(curr.keyAt(j));
                    const sp<IBinder> state_binder = IInterface::asBinder(state.surface);
                    const sp<IBinder> draw_binder = IInterface::asBinder(draw[i].surface);
                    if (state_binder != draw_binder) {
                        sp<DisplayDevice> hw(getDisplayDevice(display));
                        if (hw != NULL)
                            hw->disconnect(getHwComposer());
                        mDisplays.removeItem(display);
                        mDrawingState.displays.removeItemsAt(i);
                        dc--; i--;
                        continue;
                    }

                    const sp<DisplayDevice> disp(getDisplayDevice(display));
                    if (disp != NULL) {
                        if (state.layerStack != draw[i].layerStack) {
                            disp->setLayerStack(state.layerStack);
                        }
                        if ((state.orientation != draw[i].orientation)
                                || (state.viewport != draw[i].viewport)
                                || (state.frame != draw[i].frame))
                        {
                            disp->setProjection(state.orientation,
                                    state.viewport, state.frame);
                        }
                        if (state.width != draw[i].width || state.height != draw[i].height) {
                            disp->setDisplaySize(state.width, state.height);
                        }
                    }
                }
            }

            //增加的显示设备
            for (size_t i=0 ; i<cc ; i++) {
                if (draw.indexOfKey(curr.keyAt(i)) < 0) {
                    const DisplayDeviceState& state(curr[i]);

                    sp<DisplaySurface> dispSurface;
                    sp<IGraphicBufferProducer> producer;
                    sp<IGraphicBufferProducer> bqProducer;
                    sp<IGraphicBufferConsumer> bqConsumer;
                    BufferQueue::createBufferQueue(&bqProducer, &bqConsumer,
                            new GraphicBufferAlloc());

                    int32_t hwcDisplayId = -1;
                    if (state.isVirtualDisplay()) {
                        if (state.surface != NULL) {

                            int width = 0;
                            int status = state.surface->query(
                                    NATIVE_WINDOW_WIDTH, &width);
                            int height = 0;
                            status = state.surface->query(
                                    NATIVE_WINDOW_HEIGHT, &height);
                            if (MAX_VIRTUAL_DISPLAY_DIMENSION == 0 ||
                                    (width <= MAX_VIRTUAL_DISPLAY_DIMENSION &&
                                     height <= MAX_VIRTUAL_DISPLAY_DIMENSION)) {
                                hwcDisplayId = allocateHwcDisplayId(state.type);
                            }

                            sp<VirtualDisplaySurface> vds = new VirtualDisplaySurface(
                                    *mHwc, hwcDisplayId, state.surface,
                                    bqProducer, bqConsumer, state.displayName);

                            dispSurface = vds;
                            producer = vds;
                        }
                    } else {
                        hwcDisplayId = allocateHwcDisplayId(state.type);
                        dispSurface = new FramebufferSurface(*mHwc, state.type,
                                bqConsumer);
                        producer = bqProducer;
                    }

                    const wp<IBinder>& display(curr.keyAt(i));
                    if (dispSurface != NULL) {
                        sp<DisplayDevice> hw = new DisplayDevice(this,
                                state.type, hwcDisplayId,
                                mHwc->getFormat(hwcDisplayId), state.isSecure,
                                display, dispSurface, producer,
                                mRenderEngine->getEGLConfig());
                        hw->setLayerStack(state.layerStack);
                        hw->setProjection(state.orientation,
                                state.viewport, state.frame);
                        hw->setDisplayName(state.displayName);
                        mDisplays.add(display, hw);
                        if (state.isVirtualDisplay()) {
                            if (hwcDisplayId >= 0) {
                                mHwc->setVirtualDisplayProperties(hwcDisplayId,
                                        hw->getWidth(), hw->getHeight(),
                                        hw->getFormat());
                            }
                        } else {
                            mEventThread->onHotplugReceived(state.type, true);
                        }
                    }
                }
            }
        }
    }

    if (transactionFlags & (eTraversalNeeded|eDisplayTransactionNeeded)) {
        sp<const DisplayDevice> disp;
        uint32_t currentlayerStack = 0;
        for (size_t i=0; i<count; i++) {
            const sp<Layer>& layer(currentLayers[i]);
            uint32_t layerStack = layer->getDrawingState().layerStack;
            if (i==0 || currentlayerStack != layerStack) {
                currentlayerStack = layerStack;
                disp.clear();
                for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
                    sp<const DisplayDevice> hw(mDisplays[dpy]);
                    if (hw->getLayerStack() == currentlayerStack) {
                        if (disp == NULL) {
                            disp = hw;
                        } else {
                            disp = NULL;
                            break;
                        }
                    }
                }
            }
            if (disp == NULL) {
                disp = getDefaultDisplayDevice();
            }
            layer->updateTransformHint(disp);
        }
    }

    const LayerVector& layers(mDrawingState.layersSortedByZ);
    // layers增加
    if (currentLayers.size() > layers.size()) {
        // layers have been added
        mVisibleRegionsDirty = true;
    }

    // layers移除
    if (mLayersRemoved) {
        mLayersRemoved = false;
        mVisibleRegionsDirty = true;
        const size_t count = layers.size();
        for (size_t i=0 ; i<count ; i++) {
            const sp<Layer>& layer(layers[i]);
            if (currentLayers.indexOf(layer) < 0) {
                const Layer::State& s(layer->getDrawingState());
                Region visibleReg = s.transform.transform(
                        Region(Rect(s.active.w, s.active.h)));
                invalidateLayerStack(s.layerStack, visibleReg);
            }
        }
    }
    
    commitTransaction(); //【见小节2.4.4】
    updateCursorAsync(); //【见小节2.4.5】
}

uint32_t Layer::doTransaction(uint32_t flags) {
    const Layer::State& s(getDrawingState()); //上次绘制状态
    const Layer::State& c(getCurrentState()); //当前设置的绘制状态

    const bool sizeChanged = (c.requested.w != s.requested.w) ||
                             (c.requested.h != s.requested.h);

    if (sizeChanged) {
        //当Layer尺寸改变，则调整surface缓存区大小
        mSurfaceFlingerConsumer->setDefaultBufferSize(
                c.requested.w, c.requested.h);
    }

    if (!isFixedSize()) {
        const bool resizePending = (c.requested.w != c.active.w) ||
                                   (c.requested.h != c.active.h);
        //当Layer不是固定大小，且请求大小和实际大小不同。
        if (resizePending && mSidebandStream == NULL) {
            flags |= eDontUpdateGeometryState;
        }
    }

    if (flags & eDontUpdateGeometryState)  {
    } else {
        Layer::State& editCurrentState(getCurrentState());
        editCurrentState.active = c.requested;
    }

    if (s.active != c.active) {
        flags |= Layer::eVisibleRegion; // invalidate且重新计算可见区域
    }

    if (c.sequence != s.sequence) {
        flags |= eVisibleRegion; // invalidate且重新计算可见区域
        this->contentDirty = true;
        const uint8_t type = c.transform.getType();
        mNeedsFiltering = (!c.transform.preserveRects() ||
                (type >= Transform::SCALE));
    }

    commitTransaction(); //【见小节2.4.4】
    return flags;
}

void SurfaceFlinger::commitTransaction()
{
    if (!mLayersPendingRemoval.isEmpty()) {
        // Notify removed layers now that they can't be drawn from
        for (size_t i = 0; i < mLayersPendingRemoval.size(); i++) {
            mLayersPendingRemoval[i]->onRemoved();
        }
        mLayersPendingRemoval.clear();
    }

    mAnimCompositionPending = mAnimTransactionPending;
    mDrawingState = mCurrentState; //设置状态
    mTransactionPending = false;
    mAnimTransactionPending = false;
    mTransactionCV.broadcast(); //唤醒
}

void SurfaceFlinger::updateCursorAsync()
{
    HWComposer& hwc(getHwComposer());
    for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
        sp<const DisplayDevice> hw(mDisplays[dpy]);
        const int32_t id = hw->getHwcDisplayId();
        if (id < 0) {
            continue;
        }
        const Vector< sp<Layer> >& currentLayers(
            hw->getVisibleLayersSortedByZ());
        const size_t count = currentLayers.size();
        HWComposer::LayerListIterator cur = hwc.begin(id);
        const HWComposer::LayerListIterator end = hwc.end(id);
        for (size_t i=0 ; cur!=end && i<count ; ++i, ++cur) {
            if (cur->getCompositionType() != HWC_CURSOR_OVERLAY) {
                continue;
            }
            const sp<Layer>& layer(currentLayers[i]);
            Rect cursorPos = layer->getPosition(hw);
            hwc.setCursorPositionAsync(id, cursorPos);
            break;
        }
    }
}

bool SurfaceFlinger::handleMessageInvalidate() {
    ATRACE_CALL();
    return handlePageFlip(); //【见小节2.5.1】
}

bool SurfaceFlinger::handlePageFlip()
{
    Region dirtyRegion;

    bool visibleRegions = false;
    const LayerVector& layers(mDrawingState.layersSortedByZ);
    bool frameQueued = false;

    Vector<Layer*> layersWithQueuedFrames;
    for (size_t i = 0, count = layers.size(); i<count ; i++) {
        const sp<Layer>& layer(layers[i]);
        //判断Layer是否有需要更新的图层
        if (layer->hasQueuedFrame()) {
            frameQueued = true;
            if (layer->shouldPresentNow(mPrimaryDispSync)) {
                //将需要更新的图层放入layersWithQueuedFrames
                layersWithQueuedFrames.push_back(layer.get());
            } else {
                layer->useEmptyDamage();
            }
        } else {
            layer->useEmptyDamage();
        }
    }
    for (size_t i = 0, count = layersWithQueuedFrames.size() ; i<count ; i++) {
        Layer* layer = layersWithQueuedFrames[i];
        //调用latchBuffer来处理
        const Region dirty(layer->latchBuffer(visibleRegions));
        layer->useSurfaceDamage();
        const Layer::State& s(layer->getDrawingState());
        invalidateLayerStack(s.layerStack, dirty);
    }

    mVisibleRegionsDirty |= visibleRegions;

    if (frameQueued && layersWithQueuedFrames.empty()) {
        signalLayerUpdate();
    }
    return !layersWithQueuedFrames.empty();
}

void SurfaceFlinger::signalRefresh() {
    mEventQueue.refresh();
}

void SurfaceFlinger::rebuildLayerStacks() {
    if (CC_UNLIKELY(mVisibleRegionsDirty)) {
        mVisibleRegionsDirty = false;
        invalidateHwcGeometry();
        //每个显示屏中的所有可见图层列表
        const LayerVector& layers(mDrawingState.layersSortedByZ);
        for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
            Region opaqueRegion;
            Region dirtyRegion;
            Vector< sp<Layer> > layersSortedByZ;
            const sp<DisplayDevice>& hw(mDisplays[dpy]);
            const Transform& tr(hw->getTransform());
            const Rect bounds(hw->getBounds());
            if (hw->isDisplayOn()) {
                //计算每个Layer的可见区域
                SurfaceFlinger::computeVisibleRegions(layers,
                        hw->getLayerStack(), dirtyRegion, opaqueRegion);

                const size_t count = layers.size();
                for (size_t i=0 ; i<count ; i++) {
                    const sp<Layer>& layer(layers[i]);
                    const Layer::State& s(layer->getDrawingState());
                    //当前layer和显示设备的layerStack相同
                    if (s.layerStack == hw->getLayerStack()) {
                        Region drawRegion(tr.transform(
                                layer->visibleNonTransparentRegion));
                        drawRegion.andSelf(bounds);
                        if (!drawRegion.isEmpty()) {
                            layersSortedByZ.add(layer);
                        }
                    }
                }
            }
            hw->setVisibleLayersSortedByZ(layersSortedByZ);
            hw->undefinedRegion.set(bounds);
            hw->undefinedRegion.subtractSelf(tr.transform(opaqueRegion));
            hw->dirtyRegion.orSelf(dirtyRegion);
        }
    }
}

void SurfaceFlinger::setUpHWComposer() {
    for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
        bool dirty = !mDisplays[dpy]->getDirtyRegion(false).isEmpty();
        bool empty = mDisplays[dpy]->getVisibleLayersSortedByZ().size() == 0;
        bool wasEmpty = !mDisplays[dpy]->lastCompositionHadVisibleLayers;
        bool mustRecompose = dirty && !(empty && wasEmpty);
        mDisplays[dpy]->beginFrame(mustRecompose);

        if (mustRecompose) {
            mDisplays[dpy]->lastCompositionHadVisibleLayers = !empty;
        }
    }

    HWComposer& hwc(getHwComposer());
    if (hwc.initCheck() == NO_ERROR) {
        if (CC_UNLIKELY(mHwWorkListDirty)) {
            mHwWorkListDirty = false;
            for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
                sp<const DisplayDevice> hw(mDisplays[dpy]);
                const int32_t id = hw->getHwcDisplayId();
                if (id >= 0) {
                    const Vector< sp<Layer> >& currentLayers(
                        hw->getVisibleLayersSortedByZ());
                    const size_t count = currentLayers.size();
                    //在HWComposer中创建列表
                    if (hwc.createWorkList(id, count) == NO_ERROR) {
                        HWComposer::LayerListIterator cur = hwc.begin(id);
                        const HWComposer::LayerListIterator end = hwc.end(id);
                        for (size_t i=0 ; cur!=end && i<count ; ++i, ++cur) {
                            const sp<Layer>& layer(currentLayers[i]);
                            layer->setGeometry(hw, *cur);
                        }
                    }
                }
            }
        }

        //设置每帧的数据
        for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
            sp<const DisplayDevice> hw(mDisplays[dpy]);
            const int32_t id = hw->getHwcDisplayId();
            if (id >= 0) {
                const Vector< sp<Layer> >& currentLayers(
                    hw->getVisibleLayersSortedByZ());
                const size_t count = currentLayers.size();
                HWComposer::LayerListIterator cur = hwc.begin(id);
                const HWComposer::LayerListIterator end = hwc.end(id);
                for (size_t i=0 ; cur!=end && i<count ; ++i, ++cur) {
                    /*
                     * update the per-frame h/w composer data for each layer
                     * and build the transparent region of the FB
                    /为每一个layer,更新每帧h/w合成器的数据
                    const sp<Layer>& layer(currentLayers[i]);
                    layer->setPerFrameData(hw, *cur);
                }
            }
        }

        //在每一个显示屏上，尝试使用cursor overlay
        for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
            sp<const DisplayDevice> hw(mDisplays[dpy]);
            const int32_t id = hw->getHwcDisplayId();
            if (id >= 0) {
                const Vector< sp<Layer> >& currentLayers(
                    hw->getVisibleLayersSortedByZ());
                const size_t count = currentLayers.size();
                HWComposer::LayerListIterator cur = hwc.begin(id);
                const HWComposer::LayerListIterator end = hwc.end(id);
                for (size_t i=0 ; cur!=end && i<count ; ++i, ++cur) {
                    const sp<Layer>& layer(currentLayers[i]);
                    if (layer->isPotentialCursor()) {
                        cur->setIsCursorLayerHint();
                        break;
                    }
                }
            }
        }

        status_t err = hwc.prepare(); //【见小节4.1】
        for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
            sp<const DisplayDevice> hw(mDisplays[dpy]);
            hw->prepareFrame(hwc);
        }
    }
}

status_t HWComposer::prepare() {
    Mutex::Autolock _l(mDisplayLock);
    for (size_t i=0 ; i<mNumDisplays ; i++) {
        DisplayData& disp(mDisplayData[i]);
        if (disp.framebufferTarget) {
            disp.framebufferTarget->compositionType = HWC_FRAMEBUFFER_TARGET;
        }
        mLists[i] = disp.list;
        if (mLists[i]) {
            if (hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_3)) {
                mLists[i]->outbuf = disp.outbufHandle;
                mLists[i]->outbufAcquireFenceFd = -1;
            } else if (hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_1)) {
                mLists[i]->dpy = (hwc_display_t)0xDEADBEEF;
                mLists[i]->sur = (hwc_surface_t)0xDEADBEEF;
            } else {
                mLists[i]->dpy = EGL_NO_DISPLAY;
                mLists[i]->sur = EGL_NO_SURFACE;
            }
        }
    }

    int err = mHwc->prepare(mHwc, mNumDisplays, mLists);

    if (err == NO_ERROR) {
        for (size_t i=0 ; i<mNumDisplays ; i++) {
            DisplayData& disp(mDisplayData[i]);
            disp.hasFbComp = false;
            disp.hasOvComp = false;
            if (disp.list) {
                for (size_t i=0 ; i<disp.list->numHwLayers ; i++) {
                    hwc_layer_1_t& l = disp.list->hwLayers[i];

                    if (l.flags & HWC_SKIP_LAYER) {
                        l.compositionType = HWC_FRAMEBUFFER;
                    }
                    if (l.compositionType == HWC_FRAMEBUFFER) {
                        disp.hasFbComp = true;
                    }
                    if (l.compositionType == HWC_OVERLAY) {
                        disp.hasOvComp = true;
                    }
                    if (l.compositionType == HWC_CURSOR_OVERLAY) {
                        disp.hasOvComp = true;
                    }
                }
                if (disp.list->numHwLayers == (disp.framebufferTarget ? 1 : 0)) {
                    disp.hasFbComp = true;
                }
            } else {
                disp.hasFbComp = true;
            }
        }
    }
    return (status_t)err;
}  

void SurfaceFlinger::doComposition() {
    const bool repaintEverything = android_atomic_and(0, &mRepaintEverything);
    for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
        const sp<DisplayDevice>& hw(mDisplays[dpy]);
        if (hw->isDisplayOn()) {
            //将脏区域转换为此屏幕的坐标空间
            const Region dirtyRegion(hw->getDirtyRegion(repaintEverything));

            //如果需要，则重绘framebuffer【见小节5.1】
            doDisplayComposition(hw, dirtyRegion);

            hw->dirtyRegion.clear();
            hw->flip(hw->swapRegion);
            hw->swapRegion.clear();
        }
        //通知h/w我们已完成合成操作
        hw->compositionComplete();
    }
    postFramebuffer(); //【见小节5.3】
}

void SurfaceFlinger::doDisplayComposition(const sp<const DisplayDevice>& hw,
        const Region& inDirtyRegion)
{
    bool isHwcDisplay = hw->getHwcDisplayId() >= 0;
    if (!isHwcDisplay && inDirtyRegion.isEmpty()) {
        return;
    }
    Region dirtyRegion(inDirtyRegion);

    //计算需要更新的区域
    hw->swapRegion.orSelf(dirtyRegion);

    uint32_t flags = hw->getFlags();
    if (flags & DisplayDevice::SWAP_RECTANGLE) {
        //矩形更新模式
        dirtyRegion.set(hw->swapRegion.bounds());
    } else {
        if (flags & DisplayDevice::PARTIAL_UPDATES) {
            //部分更新模式
            dirtyRegion.set(hw->swapRegion.bounds());
        } else {
            //更新区域为整个屏幕
            dirtyRegion.set(hw->bounds());
            hw->swapRegion = dirtyRegion;
        }
    }

    if (CC_LIKELY(!mDaltonize && !mHasColorMatrix)) {
        if (!doComposeSurfaces(hw, dirtyRegion)) return;
    } else {
        RenderEngine& engine(getRenderEngine());
        mat4 colorMatrix = mColorMatrix;
        if (mDaltonize) {
            colorMatrix = colorMatrix * mDaltonizer();
        }
        mat4 oldMatrix = engine.setupColorTransform(colorMatrix);
        doComposeSurfaces(hw, dirtyRegion);
        engine.setupColorTransform(oldMatrix);
    }

    //更新交换区域，并清除脏区域
    hw->swapRegion.orSelf(dirtyRegion);
    //交换buffer，输出图像
    hw->swapBuffers(getHwComposer());
}

bool SurfaceFlinger::doComposeSurfaces(const sp<const DisplayDevice>& hw, const Region& dirty)
{
    RenderEngine& engine(getRenderEngine());
    const int32_t id = hw->getHwcDisplayId();
    HWComposer& hwc(getHwComposer());
    HWComposer::LayerListIterator cur = hwc.begin(id);
    const HWComposer::LayerListIterator end = hwc.end(id);

    bool hasGlesComposition = hwc.hasGlesComposition(id);
    if (hasGlesComposition) {
        if (!hw->makeCurrent(mEGLDisplay, mEGLContext)) {
            eglMakeCurrent(mEGLDisplay, EGL_NO_SURFACE, EGL_NO_SURFACE, EGL_NO_CONTEXT);
            if(!getDefaultDisplayDevice()->makeCurrent(mEGLDisplay, mEGLContext)) {
            }
            return false;
        }

        const bool hasHwcComposition = hwc.hasHwcComposition(id);
        if (hasHwcComposition) {
            engine.clearWithColor(0, 0, 0, 0);
        } else {
            //全屏
            const Region bounds(hw->getBounds());
            const Region letterbox(bounds.subtract(hw->getScissor()));
            Region region(hw->undefinedRegion.merge(letterbox));
            region.andSelf(dirty);

            if (!region.isEmpty()) {
                //能发生在SurfaceView
                drawWormhole(hw, region);
            }
        }

        if (hw->getDisplayType() != DisplayDevice::DISPLAY_PRIMARY) {
            const Rect& bounds(hw->getBounds());
            const Rect& scissor(hw->getScissor());
            if (scissor != bounds) {
                const uint32_t height = hw->getHeight();
                engine.setScissor(scissor.left, height - scissor.bottom,
                        scissor.getWidth(), scissor.getHeight());
            }
        }
    }

    const Vector< sp<Layer> >& layers(hw->getVisibleLayersSortedByZ());
    const size_t count = layers.size();
    const Transform& tr = hw->getTransform();
    if (cur != end) {
        //使用h/w composer
        for (size_t i=0 ; i<count && cur!=end ; ++i, ++cur) {
            const sp<Layer>& layer(layers[i]);
            const Region clip(dirty.intersect(tr.transform(layer->visibleRegion)));
            if (!clip.isEmpty()) {
                switch (cur->getCompositionType()) {
                    case HWC_CURSOR_OVERLAY:
                    case HWC_OVERLAY: {
                        const Layer::State& state(layer->getDrawingState());
                        if ((cur->getHints() & HWC_HINT_CLEAR_FB)
                                && i
                                && layer->isOpaque(state) && (state.alpha == 0xFF)
                                && hasGlesComposition) {
                            layer->clearWithOpenGL(hw, clip);
                        }
                        break;
                    }
                    case HWC_FRAMEBUFFER: {
                        layer->draw(hw, clip); //执行图像绘制
                        break;
                    }
                    case HWC_FRAMEBUFFER_TARGET: {
                        break;
                    }
                }
            }
            layer->setAcquireFence(hw, *cur);
        }
    } else {
        //不使用h/w composer
        for (size_t i=0 ; i<count ; ++i) {
            const sp<Layer>& layer(layers[i]);
            const Region clip(dirty.intersect(
                    tr.transform(layer->visibleRegion)));
            if (!clip.isEmpty()) {
                layer->draw(hw, clip);
            }
        }
    }

    engine.disableScissor();
    return true;
}

void SurfaceFlinger::postFramebuffer()
{
    const nsecs_t now = systemTime();
    mDebugInSwapBuffers = now;

    HWComposer& hwc(getHwComposer());
    if (hwc.initCheck() == NO_ERROR) {
        if (!hwc.supportsFramebufferTarget()) {
            getDefaultDisplayDevice()->makeCurrent(mEGLDisplay, mEGLContext);
        }
        hwc.commit(); //【见小节5.4】
    }

    getDefaultDisplayDevice()->makeCurrent(mEGLDisplay, mEGLContext);

    for (size_t dpy=0 ; dpy<mDisplays.size() ; dpy++) {
        sp<const DisplayDevice> hw(mDisplays[dpy]);
        const Vector< sp<Layer> >& currentLayers(hw->getVisibleLayersSortedByZ());
        hw->onSwapBuffersCompleted(hwc);
        const size_t count = currentLayers.size();
        int32_t id = hw->getHwcDisplayId();
        if (id >=0 && hwc.initCheck() == NO_ERROR) {
            HWComposer::LayerListIterator cur = hwc.begin(id);
            const HWComposer::LayerListIterator end = hwc.end(id);
            for (size_t i = 0; cur != end && i < count; ++i, ++cur) {
                currentLayers[i]->onLayerDisplayed(hw, &*cur);
            }
        } else {
            for (size_t i = 0; i < count; i++) {
                currentLayers[i]->onLayerDisplayed(hw, NULL);
            }
        }
    }

    mLastSwapBufferTime = systemTime() - now;
    mDebugInSwapBuffers = 0;

    uint32_t flipCount = getDefaultDisplayDevice()->getPageFlipCount();
    if (flipCount % LOG_FRAME_STATS_PERIOD == 0) {
        logFrameStats();
    }
}

status_t HWComposer::commit() {
    int err = NO_ERROR;
    if (mHwc) {
        if (!hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_1)) {
            mLists[0]->dpy = eglGetCurrentDisplay();
            mLists[0]->sur = eglGetCurrentSurface(EGL_DRAW);
        }

        for (size_t i=VIRTUAL_DISPLAY_ID_BASE; i<mNumDisplays; i++) {
            DisplayData& disp(mDisplayData[i]);
            if (disp.outbufHandle) {
                mLists[i]->outbuf = disp.outbufHandle;
                mLists[i]->outbufAcquireFenceFd =
                        disp.outbufAcquireFence->dup();
            }
        }
        //处理图像输出到FrameBuffer
        err = mHwc->set(mHwc, mNumDisplays, mLists);

        for (size_t i=0 ; i<mNumDisplays ; i++) {
            DisplayData& disp(mDisplayData[i]);
            disp.lastDisplayFence = disp.lastRetireFence;
            disp.lastRetireFence = Fence::NO_FENCE;
            if (disp.list) {
                if (disp.list->retireFenceFd != -1) {
                    disp.lastRetireFence = new Fence(disp.list->retireFenceFd);
                    disp.list->retireFenceFd = -1;
                }
                disp.list->flags &= ~HWC_GEOMETRY_CHANGED;
            }
        }
    }
    return (status_t)err;
}

void SurfaceFlinger::postComposition()
{
    const LayerVector& layers(mDrawingState.layersSortedByZ);
    const size_t count = layers.size();
    for (size_t i=0 ; i<count ; i++) {
        layers[i]->onPostComposition();
    }

    const HWComposer& hwc = getHwComposer();
    sp<Fence> presentFence = hwc.getDisplayFence(HWC_DISPLAY_PRIMARY);

    if (presentFence->isValid()) {
        if (mPrimaryDispSync.addPresentFence(presentFence)) {
            enableHardwareVsync();
        } else {
            disableHardwareVsync(false);
        }
    }

    const sp<const DisplayDevice> hw(getDefaultDisplayDevice());
    if (kIgnorePresentFences) {
        if (hw->isDisplayOn()) {
            enableHardwareVsync();
        }
    }

    if (mAnimCompositionPending) {
        mAnimCompositionPending = false;

        if (presentFence->isValid()) {
            mAnimFrameTracker.setActualPresentFence(presentFence);
        } else {
            nsecs_t presentTime = hwc.getRefreshTimestamp(HWC_DISPLAY_PRIMARY);
            mAnimFrameTracker.setActualPresentTime(presentTime);
        }
        mAnimFrameTracker.advanceFrame();
    }

    if (hw->getPowerMode() == HWC_POWER_MODE_OFF) {
        return;
    }

    nsecs_t currentTime = systemTime();
    if (mHasPoweredOff) {
        mHasPoweredOff = false;
    } else {
        nsecs_t period = mPrimaryDispSync.getPeriod();
        nsecs_t elapsedTime = currentTime - mLastSwapTime;
        size_t numPeriods = static_cast<size_t>(elapsedTime / period);
        if (numPeriods < NUM_BUCKETS - 1) {
            mFrameBuckets[numPeriods] += elapsedTime;
        } else {
            mFrameBuckets[NUM_BUCKETS - 1] += elapsedTime;
        }
        mTotalTime += elapsedTime;
    }
    mLastSwapTime = currentTime;
}

Choreographer.java
DisplayEventReceiver.java
frameworks/base/core/jni/android_view_DisplayEventReceiver.cpp
frameworks/native/libs/gui/DisplayEventReceiver.cpp

public ViewRootImpl(Context context, Display display) {
    ...
    //这里便出现获取Choreographer实例【见小节2.1】
    mChoreographer = Choreographer.getInstance();
    ...
}

public static Choreographer getInstance() {
    return sThreadInstance.get(); //单例模式
}

private static final ThreadLocal<Choreographer> sThreadInstance =
    new ThreadLocal<Choreographer>() {

    protected Choreographer initialValue() {
        Looper looper = Looper.myLooper(); //获取当前线程的Looper
        if (looper == null) {
            throw new IllegalStateException("The current thread must have a looper!");
        }
        return new Choreographer(looper); //【见小节2.2】
    }
};

private Choreographer(Looper looper) {
    mLooper = looper;
    //创建Handler对象【见小节2.3】
    mHandler = new FrameHandler(looper);
    //创建用于接收VSync信号的对象【见小节2.4】
    mDisplayEventReceiver = USE_VSYNC ? new FrameDisplayEventReceiver(looper) : null;
    mLastFrameTimeNanos = Long.MIN_VALUE;
    mFrameIntervalNanos = (long)(1000000000 / getRefreshRate());
    //创建回调对象
    mCallbackQueues = new CallbackQueue[CALLBACK_LAST + 1];
    for (int i = 0; i <= CALLBACK_LAST; i++) {
        mCallbackQueues[i] = new CallbackQueue();
    }
}

private final class FrameHandler extends Handler {
    public FrameHandler(Looper looper) {
        super(looper);
    }

    @Override
    public void handleMessage(Message msg) {
        switch (msg.what) {
            case MSG_DO_FRAME:
                doFrame(System.nanoTime(), 0);
                break;
            case MSG_DO_SCHEDULE_VSYNC:
                doScheduleVsync();
                break;
            case MSG_DO_SCHEDULE_CALLBACK:
                doScheduleCallback(msg.arg1);
                break;
        }
    }
}

private final class FrameDisplayEventReceiver extends DisplayEventReceiver
        implements Runnable {

    public FrameDisplayEventReceiver(Looper looper) {
        super(looper); //【见小节2.4.1】
    }
}

public DisplayEventReceiver(Looper looper) {
    mMessageQueue = looper.getQueue(); //获取主线程的消息队列
    //【见小节2.4.2】
    mReceiverPtr = nativeInit(new WeakReference<DisplayEventReceiver>(this), mMessageQueue);
}

static jlong nativeInit(JNIEnv* env, jclass clazz, jobject receiverWeak,
        jobject messageQueueObj) {
    sp<MessageQueue> messageQueue = android_os_MessageQueue_getMessageQueue(env, messageQueueObj);
    ...
    //【见小节2.4.3】
    sp<NativeDisplayEventReceiver> receiver = new NativeDisplayEventReceiver(env,
            receiverWeak, messageQueue);
    //【见小节2.4.4】
    status_t status = receiver->initialize();
    ...

    //获取DisplayEventReceiver对象的引用
    receiver->incStrong(gDisplayEventReceiverClassInfo.clazz); 
    return reinterpret_cast<jlong>(receiver.get());
}

NativeDisplayEventReceiver::NativeDisplayEventReceiver(JNIEnv* env,
        jobject receiverWeak, const sp<MessageQueue>& messageQueue) :
        mReceiverWeakGlobal(env->NewGlobalRef(receiverWeak)),
        mMessageQueue(messageQueue), mWaitingForVsync(false) {
    ALOGV("receiver %p ~ Initializing display event receiver.", this);
}

status_t NativeDisplayEventReceiver::initialize() {
    //mReceiver为DisplayEventReceiver类型
    status_t result = mReceiver.initCheck();
    ...
    //监听mReceiver的所获取的文件句柄。
    int rc = mMessageQueue->getLooper()->addFd(mReceiver.getFd(), 0, Looper::EVENT_INPUT,
            this, NULL);
    ...
    
    return OK;
}

int NativeDisplayEventReceiver::handleEvent(int receiveFd, int events, void* data) {
    ...
    nsecs_t vsyncTimestamp;
    int32_t vsyncDisplayId;
    uint32_t vsyncCount;
    //清除所有的pending事件，只保留最后一次vsync【见小节2.5.1】
    if (processPendingEvents(&vsyncTimestamp, &vsyncDisplayId, &vsyncCount)) {
        mWaitingForVsync = false;
        //分发Vsync【见小节2.5.2】
        dispatchVsync(vsyncTimestamp, vsyncDisplayId, vsyncCount);
    }
    return 1;
}

bool NativeDisplayEventReceiver::processPendingEvents(
        nsecs_t* outTimestamp, int32_t* outId, uint32_t* outCount) {
    bool gotVsync = false;
    DisplayEventReceiver::Event buf[EVENT_BUFFER_SIZE];
    ssize_t n;
    while ((n = mReceiver.getEvents(buf, EVENT_BUFFER_SIZE)) > 0) {
        for (ssize_t i = 0; i < n; i++) {
            const DisplayEventReceiver::Event& ev = buf[i];
            switch (ev.header.type) {
            case DisplayEventReceiver::DISPLAY_EVENT_VSYNC:
                gotVsync = true; //获取VSync信号
                *outTimestamp = ev.header.timestamp;
                *outId = ev.header.id;
                *outCount = ev.vsync.count;
                break;
            case DisplayEventReceiver::DISPLAY_EVENT_HOTPLUG:
                dispatchHotplug(ev.header.timestamp, ev.header.id, ev.hotplug.connected);
                break;
            default:
                break;
            }
        }
    }
    return gotVsync;
}

void NativeDisplayEventReceiver::dispatchVsync(nsecs_t timestamp, int32_t id, uint32_t count) {
    JNIEnv* env = AndroidRuntime::getJNIEnv();

    ScopedLocalRef<jobject> receiverObj(env, jniGetReferent(env, mReceiverWeakGlobal));
    if (receiverObj.get()) {
        //【见小节2.6】
        env->CallVoidMethod(receiverObj.get(),
                gDisplayEventReceiverClassInfo.dispatchVsync, timestamp, id, count);
    }

    mMessageQueue->raiseAndClearException(env, "dispatchVsync");
}

private void dispatchVsync(long timestampNanos, int builtInDisplayId, int frame) {
    //【见小节2.7】
    onVsync(timestampNanos, builtInDisplayId, frame);
}

private final class FrameDisplayEventReceiver extends DisplayEventReceiver
        implements Runnable {
    private boolean mHavePendingVsync;
    private long mTimestampNanos;
    private int mFrame;

    @Override
    public void onVsync(long timestampNanos, int builtInDisplayId, int frame) {
        //忽略来自第二显示屏的Vsync
        if (builtInDisplayId != SurfaceControl.BUILT_IN_DISPLAY_ID_MAIN) {
            scheduleVsync();
            return;
        }
        ...
        
        mTimestampNanos = timestampNanos;
        mFrame = frame;
        //该消息的callback为当前对象FrameDisplayEventReceiver
        Message msg = Message.obtain(mHandler, this);
        msg.setAsynchronous(true);
        //此处mHandler为FrameHandler
        mHandler.sendMessageAtTime(msg, timestampNanos / TimeUtils.NANOS_PER_MS);
    }

    @Override
    public void run() {
        mHavePendingVsync = false;
        doFrame(mTimestampNanos, mFrame); //【见小节2.8】
    }
}

void doFrame(long frameTimeNanos, int frame) {
    final long startNanos;
    synchronized (mLock) {
        if (!mFrameScheduled) {
            return; // mFrameScheduled=false，则直接返回。
        }

        long intendedFrameTimeNanos = frameTimeNanos; //原本计划的绘帧时间点
        startNanos = System.nanoTime();
        final long jitterNanos = startNanos - frameTimeNanos;
        if (jitterNanos >= mFrameIntervalNanos) {
            
            final long skippedFrames = jitterNanos / mFrameIntervalNanos;
            //当掉帧个数超过30，则输出相应log
            if (skippedFrames >= SKIPPED_FRAME_WARNING_LIMIT) {
                Log.i(TAG, "Skipped " + skippedFrames + " frames!  "
                        + "The application may be doing too much work on its main thread.");
            }
            final long lastFrameOffset = jitterNanos % mFrameIntervalNanos;
            frameTimeNanos = startNanos - lastFrameOffset; //对齐帧的时间间隔
        }

        if (frameTimeNanos < mLastFrameTimeNanos) {
            scheduleVsyncLocked();
            return;
        }

        mFrameInfo.setVsync(intendedFrameTimeNanos, frameTimeNanos);
        mFrameScheduled = false;
        mLastFrameTimeNanos = frameTimeNanos;
    }

    try {
        Trace.traceBegin(Trace.TRACE_TAG_VIEW, "Choreographer#doFrame");

        mFrameInfo.markInputHandlingStart();
        doCallbacks(Choreographer.CALLBACK_INPUT, frameTimeNanos);

        mFrameInfo.markAnimationsStart();
        doCallbacks(Choreographer.CALLBACK_ANIMATION, frameTimeNanos);

        mFrameInfo.markPerformTraversalsStart();
        doCallbacks(Choreographer.CALLBACK_TRAVERSAL, frameTimeNanos);

        doCallbacks(Choreographer.CALLBACK_COMMIT, frameTimeNanos);
    } finally {
        Trace.traceEnd(Trace.TRACE_TAG_VIEW);
    }
}

void doCallbacks(int callbackType, long frameTimeNanos) {
    CallbackRecord callbacks;
    synchronized (mLock) {
        final long now = System.nanoTime();
        // 从队列查找相应类型的CallbackRecord对象【见小节2.8.2】
        callbacks = mCallbackQueues[callbackType].extractDueCallbacksLocked(
                now / TimeUtils.NANOS_PER_MS);
        if (callbacks == null) {
            return;  //当队列为空，则直接返回
        }
        mCallbacksRunning = true;

        if (callbackType == Choreographer.CALLBACK_COMMIT) {
            final long jitterNanos = now - frameTimeNanos;
            //当commit类型回调执行的时间点超过2帧，则更新mLastFrameTimeNanos。
            if (jitterNanos >= 2 * mFrameIntervalNanos) {
                final long lastFrameOffset = jitterNanos % mFrameIntervalNanos
                        + mFrameIntervalNanos;
                frameTimeNanos = now - lastFrameOffset;
                mLastFrameTimeNanos = frameTimeNanos;
            }
        }
    }
    try {
        for (CallbackRecord c = callbacks; c != null; c = c.next) {
            c.run(frameTimeNanos); //【见小节2.9】
        }
    } finally {
        ... //回收callbacks，加入mCallbackPool对象池
    }
}

private final class CallbackQueue {
    public CallbackRecord extractDueCallbacksLocked(long now) {
        CallbackRecord callbacks = mHead;
        //当队列头部的callbacks对象为空，或者执行时间还没到达，则直接返回
        if (callbacks == null || callbacks.dueTime > now) {
            return null; 
        }

        CallbackRecord last = callbacks;
        CallbackRecord next = last.next;
        while (next != null) {
            if (next.dueTime > now) {
                last.next = null;
                break;
            }
            last = next;
            next = next.next;
        }
        mHead = next;
        return callbacks;
    }
}

private static final class CallbackRecord {
    public CallbackRecord next;
    public long dueTime;
    public Object action; // Runnable or FrameCallback
    public Object token;

    public void run(long frameTimeNanos) {
        if (token == FRAME_CALLBACK_TOKEN) {
            ((FrameCallback)action).doFrame(frameTimeNanos);
        } else {
            ((Runnable)action).run();
        }
    }
}

WMS.scheduleAnimationLocked
  postFrameCallback
    postFrameCallbackDelayed
      postCallbackDelayedInternal
        scheduleFrameLocked

void scheduleAnimationLocked() {
     if (!mAnimationScheduled) { 
         mAnimationScheduled = true;
         //【见小节3.2】
         mChoreographer.postFrameCallback(mAnimator.mAnimationFrameCallback);
     }
 }

private WindowManagerService(
    ...
    mAnimator = new WindowAnimator(this); //【见小节3.1.2】
    ...
}

WindowAnimator(final WindowManagerService service) {
    mService = service;
    mContext = service.mContext;
    mPolicy = service.mPolicy;

    mAnimationFrameCallback = new Choreographer.FrameCallback() {
        public void doFrame(long frameTimeNs) {
            synchronized (mService.mWindowMap) {
                mService.mAnimationScheduled = false;
                animateLocked(frameTimeNs);
            }
        }
    };
}

public void postFrameCallback(FrameCallback callback) {
    postFrameCallbackDelayed(callback, 0);
}

public void postFrameCallbackDelayed(FrameCallback callback, long delayMillis) {
    ...
    //【见小节3.3】
    postCallbackDelayedInternal(CALLBACK_ANIMATION,
            callback, FRAME_CALLBACK_TOKEN, delayMillis);
}

// callbackType为动画，action为mAnimationFrameCallback
// token为FRAME_CALLBACK_TOKEN，delayMillis=0
private void postCallbackDelayedInternal(int callbackType,
    Object action, Object token, long delayMillis) {

    synchronized (mLock) {
        final long now = SystemClock.uptimeMillis();
        final long dueTime = now + delayMillis;
        //添加到mCallbackQueues队列
        mCallbackQueues[callbackType].addCallbackLocked(dueTime, action, token);

        if (dueTime <= now) {
            scheduleFrameLocked(now);
        } else {
            //发送消息MSG_DO_SCHEDULE_CALLBACK
            Message msg = mHandler.obtainMessage(MSG_DO_SCHEDULE_CALLBACK, action);
            msg.arg1 = callbackType;
            msg.setAsynchronous(true);
            mHandler.sendMessageAtTime(msg, dueTime);
        }
    }
}

private final class FrameHandler extends Handler {

    public void handleMessage(Message msg) {
        switch (msg.what) {
            case MSG_DO_FRAME:
                doFrame(System.nanoTime(), 0);
                break;
            case MSG_DO_SCHEDULE_VSYNC:
                doScheduleVsync();
                break;
            case MSG_DO_SCHEDULE_CALLBACK:
                doScheduleCallback(msg.arg1); //【见小节3.5】
                break;
        }
    }
}

void doScheduleCallback(int callbackType) {
    synchronized (mLock) {
        if (!mFrameScheduled) {
            final long now = SystemClock.uptimeMillis();
            if (mCallbackQueues[callbackType].hasDueCallbacksLocked(now)) {
                scheduleFrameLocked(now); //【见小节3.6】
            }
        }
    }
}

private void scheduleFrameLocked(long now) {
    if (!mFrameScheduled) {
        mFrameScheduled = true;
        if (USE_VSYNC) {
            if (isRunningOnLooperThreadLocked()) {
                //当运行在Looper线程，则立刻调度vsync
                scheduleVsyncLocked(); 
            } else {
                //否则，发送消息到UI线程
                Message msg = mHandler.obtainMessage(MSG_DO_SCHEDULE_VSYNC);
                msg.setAsynchronous(true);
                mHandler.sendMessageAtFrontOfQueue(msg);
            }
        } else {
            final long nextFrameTime = Math.max(
                    mLastFrameTimeNanos / TimeUtils.NANOS_PER_MS + sFrameDelay, now);
            Message msg = mHandler.obtainMessage(MSG_DO_FRAME);
            msg.setAsynchronous(true);
            mHandler.sendMessageAtTime(msg, nextFrameTime);
        }
    }
}

private void scheduleVsyncLocked() {
    mDisplayEventReceiver.scheduleVsync(); //【见小节3.8】
}

public void scheduleVsync() {
     if (mReceiverPtr == 0) {
        ...
     } else {
         nativeScheduleVsync(mReceiverPtr);
     }
}

static void nativeScheduleVsync(JNIEnv* env, jclass clazz, jlong receiverPtr) {
    sp<NativeDisplayEventReceiver> receiver =
            reinterpret_cast<NativeDisplayEventReceiver*>(receiverPtr);
    status_t status = receiver->scheduleVsync();
    ...
}

status_t NativeDisplayEventReceiver::scheduleVsync() {
    if (!mWaitingForVsync) {
        nsecs_t vsyncTimestamp;
        int32_t vsyncDisplayId;
        uint32_t vsyncCount;
        processPendingEvents(&vsyncTimestamp, &vsyncDisplayId, &vsyncCount);
        //【见小节3.11】
        status_t status = mReceiver.requestNextVsync();
        ...

        mWaitingForVsync = true;
    }
    return OK;
}

status_t DisplayEventReceiver::requestNextVsync() {
    if (mEventConnection != NULL) {
        mEventConnection->requestNextVsync();
        return NO_ERROR;
    }
    return NO_INIT;
}

private void animateLocked(long frameTimeNs) {
    if (!mInitialized) {
        return;
    }

    mCurrentTime = frameTimeNs / TimeUtils.NANOS_PER_MS;
    mBulkUpdateParams = SET_ORIENTATION_CHANGE_COMPLETE;
    boolean wasAnimating = mAnimating;
    mAnimating = false;
    mAppWindowAnimating = false;

    SurfaceControl.openTransaction(); //打开transacion
    SurfaceControl.setAnimationTransaction();
    try {
        final int numDisplays = mDisplayContentsAnimators.size();
        for (int i = 0; i < numDisplays; i++) {
            final int displayId = mDisplayContentsAnimators.keyAt(i);
            updateAppWindowsLocked(displayId);
            DisplayContentsAnimator displayAnimator = mDisplayContentsAnimators.valueAt(i);

            final ScreenRotationAnimation screenRotationAnimation =
                    displayAnimator.mScreenRotationAnimation;
            if (screenRotationAnimation != null && screenRotationAnimation.isAnimating()) {
                if (screenRotationAnimation.stepAnimationLocked(mCurrentTime)) {
                    mAnimating = true;
                } else {
                    mBulkUpdateParams |= SET_UPDATE_ROTATION;
                    screenRotationAnimation.kill();
                    displayAnimator.mScreenRotationAnimation = null;

                    if (mService.mAccessibilityController != null
                            && displayId == Display.DEFAULT_DISPLAY) {
                        mService.mAccessibilityController.onRotationChangedLocked(
                                mService.getDefaultDisplayContentLocked(), mService.mRotation);
                    }
                }
            }

            //更新所有应用的动画，包括正在退出的应用
            updateWindowsLocked(displayId);
            updateWallpaperLocked(displayId);

            final WindowList windows = mService.getWindowListLocked(displayId);
            final int N = windows.size();
            for (int j = 0; j< N; j++) {
                //输出动画
                windows.get(j).mWinAnimator.prepareSurfaceLocked(true);
            }
        }

        for (int i = 0; i < numDisplays; i++) {
            final int displayId = mDisplayContentsAnimators.keyAt(i);

            testTokenMayBeDrawnLocked(displayId);

            final ScreenRotationAnimation screenRotationAnimation =
                    mDisplayContentsAnimators.valueAt(i).mScreenRotationAnimation;
            if (screenRotationAnimation != null) {
                screenRotationAnimation.updateSurfacesInTransaction();
            }

            mAnimating |= mService.getDisplayContentLocked(displayId).animateDimLayers();

            if (mService.mAccessibilityController != null
                    && displayId == Display.DEFAULT_DISPLAY) {
                mService.mAccessibilityController.drawMagnifiedRegionBorderIfNeededLocked();
            }
        }

        if (mAnimating) {
            mService.scheduleAnimationLocked();
        }

        mService.setFocusedStackLayer();

        if (mService.mWatermark != null) {
            mService.mWatermark.drawIfNeeded();
        }
    } catch (RuntimeException e) {
        Slog.wtf(TAG, "Unhandled exception in Window Manager", e);
    } finally {
        SurfaceControl.closeTransaction(); //关闭transacion
    }

    boolean hasPendingLayoutChanges = false;
    final int numDisplays = mService.mDisplayContents.size();
    for (int displayNdx = 0; displayNdx < numDisplays; ++displayNdx) {
        final DisplayContent displayContent = mService.mDisplayContents.valueAt(displayNdx);
        final int pendingChanges = getPendingLayoutChanges(displayContent.getDisplayId());
        if ((pendingChanges & WindowManagerPolicy.FINISH_LAYOUT_REDO_WALLPAPER) != 0) {
            mBulkUpdateParams |= SET_WALLPAPER_ACTION_PENDING;
        }
        if (pendingChanges != 0) {
            hasPendingLayoutChanges = true;
        }
    }

    boolean doRequest = false;
    if (mBulkUpdateParams != 0) {
        doRequest = mService.copyAnimToLayoutParamsLocked();
    }

    if (hasPendingLayoutChanges || doRequest) {
        mService.requestTraversalLocked();
    }

    if (!mAnimating && wasAnimating) {
        mService.requestTraversalLocked();
    }
}

final void startActivityLocked(ActivityRecord r, boolean newTask,
        boolean doResume, boolean keepCurTransition, Bundle options) {
    TaskRecord rTask = r.task;
    final int taskId = rTask.taskId;
    if (!r.mLaunchTaskBehind && (taskForIdLocked(taskId) == null || newTask)) {
        insertTaskAtTop(rTask, r);
        //将Window相应task移至顶部[见小节2.1.1]
        mWindowManager.moveTaskToTop(taskId); 
    }
    TaskRecord task = null;
    if (!newTask) {
      boolean startIt = true;
      for (int taskNdx = mTaskHistory.size() - 1; taskNdx >= 0; --taskNdx) {
        task = mTaskHistory.get(taskNdx);
        if (task == r.task) {
          if (!startIt) {
              task.addActivityToTop(r);
              r.putInHistory();
              //创建AppWindowToken对象 [见小节2.1.2]
              mWindowManager.addAppToken(task.mActivities.indexOf(r), r.appToken,
                    r.task.taskId, mStackId, r.info.screenOrientation, r.fullscreen,
                    (r.info.flags & ActivityInfo.FLAG_SHOW_FOR_ALL_USERS) != 0,
                    r.userId, r.info.configChanges, task.voiceSession != null,
                    r.mLaunchTaskBehind);
              return;
          }
          break;
        } 
        ...
      }
    }
    ...
    
    if (!isHomeStack() || numActivities() > 0) {
        //当切换到新的task，或者下一个activity进程目前并没有运行
        boolean showStartingIcon = newTask;
        ProcessRecord proc = r.app;
        if (proc == null) {
            proc = mService.mProcessNames.get(r.processName, r.info.applicationInfo.uid);
        }

        if (proc == null || proc.thread == null) {
            showStartingIcon = true;
        }
        if ((r.intent.getFlags() & Intent.FLAG_ACTIVITY_NO_ANIMATION) != 0) {
            mWindowManager.prepareAppTransition(AppTransition.TRANSIT_NONE, keepCurTransition);
            mNoAnimActivities.add(r);
        } else {
            //设置transition方式[见小节2.1.3]
            mWindowManager.prepareAppTransition(newTask
                    ? r.mLaunchTaskBehind
                            ? AppTransition.TRANSIT_TASK_OPEN_BEHIND
                            : AppTransition.TRANSIT_TASK_OPEN
                    : AppTransition.TRANSIT_ACTIVITY_OPEN, keepCurTransition);
            mNoAnimActivities.remove(r);
        }
        mWindowManager.addAppToken(...);
        
        boolean doShow = true;
        if (newTask) {
            if ((r.intent.getFlags() & Intent.FLAG_ACTIVITY_RESET_TASK_IF_NEEDED) != 0) {
                resetTaskIfNeededLocked(r, r);
                doShow = topRunningNonDelayedActivityLocked(null) == r;
            }
        } else if (options != null && new ActivityOptions(options).getAnimationType()
                == ActivityOptions.ANIM_SCENE_TRANSITION) {
            doShow = false;
        }
        if (r.mLaunchTaskBehind) {
            mWindowManager.setAppVisibility(r.appToken, true);
            ensureActivitiesVisibleLocked(null, 0);
        } else if (SHOW_APP_STARTING_PREVIEW && doShow) {
            ActivityRecord prev = mResumedActivity;
            mWindowManager.setAppStartingWindow(
                    r.appToken, r.packageName, r.theme,
                    mService.compatibilityInfoForPackageLocked(
                             r.info.applicationInfo), r.nonLocalizedLabel,
                    r.labelRes, r.icon, r.logo, r.windowFlags,
                    prev != null ? prev.appToken : null, showStartingIcon);
            r.mStartingWindowShown = true;
        }
    } else {
        mWindowManager.addAppToken(...);
        ...
    }

    if (doResume) {
        //该方法内部调用AS.resumeTopActivityInnerLocked [见流程2.2]
        mStackSupervisor.resumeTopActivitiesLocked(this, r, options);
    }
}

public void moveTaskToTop(int taskId) {
    final long origId = Binder.clearCallingIdentity();
    try {
        synchronized(mWindowMap) {
            Task task = mTaskIdToTask.get(taskId);
            if (task == null) {
                return;
            }
            final TaskStack stack = task.mStack;
            final DisplayContent displayContent = task.getDisplayContent();
            //将该task所属的栈 移至display的顶部
            displayContent.moveStack(stack, true);
            if (displayContent.isDefaultDisplay) {
                final TaskStack homeStack = displayContent.getHomeStack();
                if (homeStack != stack) {
                    //当非home栈移至顶部，则把home栈移至底部
                    displayContent.moveStack(homeStack, false);
                }
            }
            //将该task 移至栈的顶部
            stack.moveTaskToTop(task);
            if (mAppTransition.isTransitionSet()) {
                task.setSendingToBottom(false);
            }
            //更新窗口布局
            moveStackWindowsLocked(displayContent);
        }
    } finally {
        Binder.restoreCallingIdentity(origId);
    }
}

public void addAppToken(int addPos, IApplicationToken token, int taskId, int stackId,
        int requestedOrientation, boolean fullscreen, boolean showForAllUsers, int userId,
        int configChanges, boolean voiceInteraction, boolean launchTaskBehind) {
    long inputDispatchingTimeoutNanos;
    inputDispatchingTimeoutNanos = token.getKeyDispatchingTimeout() * 1000000L;

    synchronized(mWindowMap) {
        AppWindowToken atoken = findAppWindowToken(token.asBinder());
        ...
        //创建AppWindowToken对象
        atoken = new AppWindowToken(this, token, voiceInteraction);
        atoken.inputDispatchingTimeoutNanos = inputDispatchingTimeoutNanos;
        atoken.appFullscreen = fullscreen;
        atoken.showForAllUsers = showForAllUsers;
        atoken.requestedOrientation = requestedOrientation;
        atoken.layoutConfigChanges = (configChanges &
                (ActivityInfo.CONFIG_SCREEN_SIZE | ActivityInfo.CONFIG_ORIENTATION)) != 0;
        atoken.mLaunchTaskBehind = launchTaskBehind;

        //获取或创建相应的Task
        Task task = mTaskIdToTask.get(taskId);
        if (task == null) {
            task = createTaskLocked(taskId, stackId, userId, atoken);
        }
        task.addAppToken(addPos, atoken);
        //将该Token添加到mTokenMap
        mTokenMap.put(token.asBinder(), atoken);

        atoken.hidden = true;
        atoken.hiddenRequested = true;
    }
}

public void prepareAppTransition(int transit, boolean alwaysKeepCurrent) {
    synchronized(mWindowMap) {
        if (!mAppTransition.isTransitionSet() || mAppTransition.isTransitionNone()) {
            mAppTransition.setAppTransition(transit);
        } else if (!alwaysKeepCurrent) {
            if (transit == AppTransition.TRANSIT_TASK_OPEN
                    && mAppTransition.isTransitionEqual(
                            AppTransition.TRANSIT_TASK_CLOSE)) {
                //正在打开新的task，取代关闭动画
                mAppTransition.setAppTransition(transit);
            } else if (transit == AppTransition.TRANSIT_ACTIVITY_OPEN
                    && mAppTransition.isTransitionEqual(
                        AppTransition.TRANSIT_ACTIVITY_CLOSE)) {
                //正在打开新的activity，取代关闭动画
                mAppTransition.setAppTransition(transit);
            }
        }
        if (okToDisplay() && mAppTransition.prepare()) {
            mSkipAppTransitionAnimation = false;
        }
        if (mAppTransition.isTransitionSet()) {
            mH.removeMessages(H.APP_TRANSITION_TIMEOUT);
            mH.sendEmptyMessageDelayed(H.APP_TRANSITION_TIMEOUT, 5000);
        }
    }
}

public void setAppStartingWindow(IBinder token, String pkg,
        int theme, CompatibilityInfo compatInfo,
        CharSequence nonLocalizedLabel, int labelRes, int icon, int logo,
        int windowFlags, IBinder transferFrom, boolean createIfNeeded) {
    ...
    wtoken.startingData = new StartingData(pkg, theme, compatInfo, nonLocalizedLabel,
                        labelRes, icon, logo, windowFlags);
    Message m = mH.obtainMessage(H.ADD_STARTING, wtoken);
    mH.sendMessageAtFrontOfQueue(m);
}

private boolean resumeTopActivityInnerLocked(ActivityRecord prev, Bundle options) {
    final ActivityRecord next = topRunningActivityLocked(null);
    ...
    //暂停上一个Activity
    boolean dontWaitForPause = (next.info.flags&ActivityInfo.FLAG_RESUME_WHILE_PAUSING) != 0;
    boolean pausing = mStackSupervisor.pauseBackStacks(userLeaving, true, dontWaitForPause);
    
    //进程已存在的情况
    if (next.app != null && next.app.thread != null) {
        //activity正在成为可见[见小节2.2.1]
        mWindowManager.setAppVisibility(next.appToken, true);
        ...

        ArrayList<ResultInfo> a = next.results;
        if (a != null) {
            final int N = a.size();
            if (!next.finishing && N > 0) {
                next.app.thread.scheduleSendResult(next.appToken, a);
            }
        }

        if (next.newIntents != null) {
            next.app.thread.scheduleNewIntent(next.newIntents, next.appToken);
        }

        next.sleeping = false;
        mService.showAskCompatModeDialogLocked(next);
        next.app.pendingUiClean = true;
        next.app.forceProcessStateUpTo(mService.mTopProcessState);
        next.clearOptionsLocked();
        //触发onResume 
        next.app.thread.scheduleResumeActivity(next.appToken, next.app.repProcState,
                mService.isNextTransitionForward(), resumeAnimOptions);

        mStackSupervisor.checkReadyForSleepLocked();
    }else {
        ...
        //目标Activity所属的进程不存在的情况
        mStackSupervisor.startSpecificActivityLocked(next, true, true);
    }
}

public void setAppVisibility(IBinder token, boolean visible) {
    AppWindowToken wtoken;

    synchronized(mWindowMap) {
        //从mTokenMap找到相应的Token对象
        wtoken = findAppWindowToken(token);
        mOpeningApps.remove(wtoken);
        mClosingApps.remove(wtoken);
        wtoken.waitingToShow = false;
        wtoken.hiddenRequested = !visible;

        if (okToDisplay() && mAppTransition.isTransitionSet()) {
            //设置用于占位的动画
            if (!wtoken.mAppAnimator.usingTransferredAnimation &&
                    (!wtoken.startingDisplayed || mSkipAppTransitionAnimation)) {
                wtoken.mAppAnimator.setDummyAnimation();
            }
            wtoken.inPendingTransaction = true;
            if (visible) {
                mOpeningApps.add(wtoken);
                wtoken.startingMoved = false;
                wtoken.mEnteringAnimation = true;

                if (wtoken.hidden) {
                    wtoken.allDrawn = false;
                    wtoken.deferClearAllDrawn = false;
                    wtoken.waitingToShow = true;

                    if (wtoken.clientHidden) {
                        wtoken.clientHidden = false;
                        wtoken.sendAppVisibilityToClients();
                    }
                }
            } else {
                mClosingApps.add(wtoken);
                wtoken.mEnteringAnimation = false;
            }
            if (mAppTransition.getAppTransition() == AppTransition.TRANSIT_TASK_OPEN_BEHIND) {
                //后台启动的，则将启动中的Activity添加到mOpeningApps.
                final WindowState win = findFocusedWindowLocked(getDefaultDisplayContentLocked());
                if (win != null) {
                    final AppWindowToken focusedToken = win.mAppToken;
                    if (focusedToken != null) {
                        //强制加载动画
                        focusedToken.hidden = true;
                        mOpeningApps.add(focusedToken);
                    }
                }
            }
            return;
        }

        final long origId = Binder.clearCallingIdentity();
        wtoken.inPendingTransaction = false;
        //设置AppWindowToken相应窗口可见
        setTokenVisibilityLocked(wtoken, null, visible, AppTransition.TRANSIT_UNSET,
                true, wtoken.voiceInteraction);
        wtoken.updateReportedVisibilityLocked();
        Binder.restoreCallingIdentity(origId);
    }
}

private void handleLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    handleConfigurationChanged(null, null);
    //初始化WMS【见小节2.3.1】
    WindowManagerGlobal.initialize();
    //【见小节2.4】
    Activity a = performLaunchActivity(r, customIntent);

    if (a != null) {
        r.createdConfig = new Configuration(mConfiguration);
        //【见小节2.5】
        handleResumeActivity(r.token, false, r.isForward,
                !r.activity.mFinished && !r.startsNotResumed);
        ...
    }
    ...
}

public static void initialize() {
    getWindowManagerService();
}
   
public static IWindowManager getWindowManagerService() {
    synchronized (WindowManagerGlobal.class) {
        if (sWindowManagerService == null) {
            //获取AMS的binder代理
            sWindowManagerService = IWindowManager.Stub.asInterface(
                    ServiceManager.getService("window"));
            sWindowManagerService = getWindowManagerService();
            ValueAnimator.setDurationScale(sWindowManagerService.getCurrentAnimatorScale());
        }
        return sWindowManagerService;
    }
}

private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {

    ActivityInfo aInfo = r.activityInfo;
    if (r.packageInfo == null) {
        //创建LoadedApk对象
        r.packageInfo = getPackageInfo(aInfo.applicationInfo, r.compatInfo,
                Context.CONTEXT_INCLUDE_CODE);
    }

    ComponentName component = r.intent.getComponent();
    if (component == null) {
        component = r.intent.resolveActivity(
            mInitialApplication.getPackageManager());
        r.intent.setComponent(component);
    }

    if (r.activityInfo.targetActivity != null) {
        //创建ComponentName对象
        component = new ComponentName(r.activityInfo.packageName,
                r.activityInfo.targetActivity);
    }

    Activity activity = null;
    //获取ClassLoader
    java.lang.ClassLoader cl = r.packageInfo.getClassLoader();
    //创建目标Activity对象
    activity = mInstrumentation.newActivity(
            cl, component.getClassName(), r.intent);
    StrictMode.incrementExpectedActivityCount(activity.getClass());
    r.intent.setExtrasClassLoader(cl);
    r.intent.prepareToEnterProcess();
    if (r.state != null) {
        r.state.setClassLoader(cl);
    }

    //创建Application对象
    Application app = r.packageInfo.makeApplication(false, mInstrumentation);
    if (activity != null) {
        Context appContext = createBaseContextForActivity(r, activity);
        CharSequence title = r.activityInfo.loadLabel(appContext.getPackageManager());
        Configuration config = new Configuration(mCompatConfiguration);
        //变量赋值操作【见小节2.4.1】
        activity.attach(appContext, this, getInstrumentation(), r.token,
                r.ident, app, r.intent, r.activityInfo, title, r.parent,
                r.embeddedID, r.lastNonConfigurationInstances, config,
                r.referrer, r.voiceInteractor);
        ...
        //【见小节2.4.2】
        if (r.isPersistable()) {
            mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
        } else {
            mInstrumentation.callActivityOnCreate(activity, r.state);
        }
        ...
        
        if (!r.activity.mFinished) {
            if (r.isPersistable()) {
                if (r.state != null || r.persistentState != null) {
                    mInstrumentation.callActivityOnRestoreInstanceState(activity, r.state,
                            r.persistentState);
                }
            } else if (r.state != null) {
                mInstrumentation.callActivityOnRestoreInstanceState(activity, r.state);
            }
        }
        ...
    }
    r.paused = true;
    mActivities.put(r.token, r);
    return activity;
}

final void attach(Context context, ActivityThread aThread,
        Instrumentation instr, IBinder token, int ident,
        Application application, Intent intent, ActivityInfo info,
        CharSequence title, Activity parent, String id,
        NonConfigurationInstances lastNonConfigurationInstances,
        Configuration config, String referrer, IVoiceInteractor voiceInteractor) {
    attachBaseContext(context);
    mFragments.attachHost(null /*parent*/);

    mWindow = new PhoneWindow(this); //创建PhoneWindow
    mWindow.setCallback(this);
    mWindow.setOnWindowDismissedCallback(this);
    mWindow.getLayoutInflater().setPrivateFactory(this);
    ...
    mUiThread = Thread.currentThread(); //获取UI线程
    mMainThread = aThread;
    mInstrumentation = instr;
    mToken = token; //远程ActivityRecord的appToken的代理端
    mIdent = ident;
    mApplication = application; //所属的Appplication
    mIntent = intent;
    mReferrer = referrer;
    mComponent = intent.getComponent();
    mActivityInfo = info;
    mParent = parent;
    ...
    //设置并获取WindowManagerImpl对象
    mWindow.setWindowManager(
            (WindowManager)context.getSystemService(Context.WINDOW_SERVICE),
            mToken, mComponent.flattenToString(),
            (info.flags & ActivityInfo.FLAG_HARDWARE_ACCELERATED) != 0);
    if (mParent != null) {
        mWindow.setContainer(mParent.getWindow());
    }
    mWindowManager = mWindow.getWindowManager();
    mCurrentConfig = config;
}

final void handleResumeActivity(IBinder token,
        boolean clearHide, boolean isForward, boolean reallyResume) {
    //[见小节2.5.1]
    ActivityClientRecord r = performResumeActivity(token, clearHide);

    if (r != null) {
        final Activity a = r.activity;
        boolean willBeVisible = !a.mStartedActivity;
        ...
        if (r.window == null && !a.mFinished && willBeVisible) {
            r.window = r.activity.getWindow();
            View decor = r.window.getDecorView();
            decor.setVisibility(View.INVISIBLE);
            ViewManager wm = a.getWindowManager();
            WindowManager.LayoutParams l = r.window.getAttributes();
            a.mDecor = decor;
            l.type = WindowManager.LayoutParams.TYPE_BASE_APPLICATION;
            l.softInputMode |= forwardBit;
            if (a.mVisibleFromClient) {
                a.mWindowAdded = true;
                wm.addView(decor, l);
            }

        }
        ...
        if (!r.activity.mFinished && willBeVisible
                && r.activity.mDecor != null && !r.hideForNow) {
            ...
            mNumVisibleActivities++;
            if (r.activity.mVisibleFromClient) {
                r.activity.makeVisible(); //[见小节2.5.2]
            }
        }

        //resume完成
        if (reallyResume) {
              ActivityManagerNative.getDefault().activityResumed(token);
        }
    } else {
        ...
    }
}

public final ActivityClientRecord performResumeActivity(IBinder token,
        boolean clearHide) {
    ActivityClientRecord r = mActivities.get(token);
    if (r != null && !r.activity.mFinished) {
        if (clearHide) {
            r.hideForNow = false;
            r.activity.mStartedActivity = false;
        }
        r.activity.onStateNotSaved();
        r.activity.mFragments.noteStateNotSaved();
        if (r.pendingIntents != null) {
            deliverNewIntents(r, r.pendingIntents);
            r.pendingIntents = null;
        }
        if (r.pendingResults != null) {
            deliverResults(r, r.pendingResults);
            r.pendingResults = null;
        }
        //回调onResume
        r.activity.performResume();
        ...
    }
    return r;
}

void makeVisible() {
    if (!mWindowAdded) {
        ViewManager wm = getWindowManager();
        //【见小节2.6】
        wm.addView(mDecor, getWindow().getAttributes());
        mWindowAdded = true;
    }
    mDecor.setVisibility(View.VISIBLE);
}

public void addView(@NonNull View view, @NonNull ViewGroup.LayoutParams params) {
    applyDefaultToken(params);
    //【见小节2.6.1】
    mGlobal.addView(view, params, mDisplay, mParentWindow);
}

public void addView(View view, ViewGroup.LayoutParams params,
        Display display, Window parentWindow) {
    ...
    final WindowManager.LayoutParams wparams = (WindowManager.LayoutParams) params;
    //创建ViewRootImpl[见小节2.7]
    ViewRootImpl root = new ViewRootImpl(view.getContext(), display);
    view.setLayoutParams(wparams);
    mViews.add(view);
    mRoots.add(root);
    mParams.add(wparams);
    
    //[见小节2.8]
    root.setView(view, wparams, panelParentView);
    ...
}

public ViewRootImpl(Context context, Display display) {
    mContext = context;
    //获取IWindowSession的代理类【见小节2.7.1】
    mWindowSession = WindowManagerGlobal.getWindowSession();
    mDisplay = display;
    mThread = Thread.currentThread(); //主线程
    mWindow = new W(this); //【见小节2.7.3】
    mChoreographer = Choreographer.getInstance();
    ...
}

public static IWindowSession getWindowSession() {
    synchronized (WindowManagerGlobal.class) {
        if (sWindowSession == null) {
            try {
                //获取IMS的代理类
                InputMethodManager imm = InputMethodManager.getInstance();
                //获取WMS的代理类
                IWindowManager windowManager = getWindowManagerService();
                //经过Binder调用，最终调用WMS[见小节2.7.2]
                sWindowSession = windowManager.openSession(
                        new IWindowSessionCallback.Stub() {...},
                        imm.getClient(), imm.getInputContext());
            } catch (RemoteException e) {
                ...
            }
        }
        return sWindowSession
    }
}

public IWindowSession openSession(IWindowSessionCallback callback, IInputMethodClient client,
        IInputContext inputContext) {
    //创建Session对象
    Session session = new Session(this, callback, client, inputContext);
    return session;
}

static class W extends IWindow.Stub {
    private final WeakReference<ViewRootImpl> mViewAncestor;
    private final IWindowSession mWindowSession;

    W(ViewRootImpl viewAncestor) {
        mViewAncestor = new WeakReference<ViewRootImpl>(viewAncestor);
        mWindowSession = viewAncestor.mWindowSession;
    }
    ...
}

public void setView(View view, WindowManager.LayoutParams attrs, View panelParentView) {
  synchronized (this) {
    ...
    //通过Binder调用，进入system进程的Session[见小节2.9]
    res = mWindowSession.addToDisplay(mWindow, mSeq, mWindowAttributes,
          getHostVisibility(), mDisplay.getDisplayId(),
          mAttachInfo.mContentInsets, mAttachInfo.mStableInsets,
          mAttachInfo.mOutsets, mInputChannel);
    ...
  }
}

final class Session extends IWindowSession.Stub implements IBinder.DeathRecipient {

    public int addToDisplay(IWindow window, int seq, WindowManager.LayoutParams attrs,
            int viewVisibility, int displayId, Rect outContentInsets, Rect outStableInsets,
            Rect outOutsets, InputChannel outInputChannel) {
        //[见小节2.9.1]
        return mService.addWindow(this, window, seq, attrs, viewVisibility, displayId,
                outContentInsets, outStableInsets, outOutsets, outInputChannel);
    }
}

public int addWindow(Session session, IWindow client, int seq,
           WindowManager.LayoutParams attrs, int viewVisibility, int displayId,
           Rect outContentInsets, Rect outStableInsets, Rect outOutsets,
           InputChannel outInputChannel) {
    ...
    WindowToken token = mTokenMap.get(attrs.token);
    //创建WindowState【见小节2.9.2】
    WindowState win = new WindowState(this, session, client, token,
                attachedWindow, appOp[0], seq, attrs, viewVisibility, displayContent);
    ...
    mPolicy.adjustWindowParamsLw(win.mAttrs);
    res = mPolicy.prepareAddWindowLw(win, attrs);
    addWindowToListInOrderLocked(win, true);
    updateFocusedWindowLocked(UPDATE_FOCUS_WILL_ASSIGN_LAYERS,
                    false /*updateInputWindows*/);
    assignLayersLocked(displayContent.getWindowList());
    ...
}

WindowState(WindowManagerService service, Session s, IWindow c, WindowToken token,
       WindowState attachedWindow, int appOp, int seq, WindowManager.LayoutParams a,
       int viewVisibility, final DisplayContent displayContent) {
    mService = service;
    mSession = s; //Session的Binder服务端
    mClient = c;  //IWindow的Binder代理端
    mToken = token;
    mOwnerUid = s.mUid; //所对应app的uid
    ...
    DeathRecipient deathRecipient = new DeathRecipient();
    c.asBinder().linkToDeath(deathRecipient, 0); //app端死亡则会有死亡回调
    
    WindowState appWin = this;
    WindowToken appToken = appWin.mToken;
    while (appToken.appWindowToken == null) {
       WindowToken parent = mService.mTokenMap.get(appToken.token);
       if (parent == null || appToken == parent) {
           break;
       }
       appToken = parent;
    }
    mAppToken = appToken.appWindowToken;
    
    //创建WindowStateAnimator对象
    mWinAnimator = new WindowStateAnimator(this);
    //创建InputWindowHandle对象
    mInputWindowHandle = new InputWindowHandle(
            mAppToken != null ? mAppToken.mInputApplicationHandle : null, this,
            displayContent.getDisplayId());
}

 JobScheduler scheduler = (JobScheduler) getSystemService(Context.JOB_SCHEDULER_SERVICE);  
 ComponentName jobService = new ComponentName(this, MyJobService.class); 
 
 JobInfo jobInfo = new JobInfo.Builder(123, jobService) //任务Id等于123
         .setMinimumLatency(5000)// 任务最少延迟时间  
         .setOverrideDeadline(60000)// 任务deadline，当到期没达到指定条件也会开始执行  
         .setRequiredNetworkType(JobInfo.NETWORK_TYPE_UNMETERED)// 网络条件，默认值NETWORK_TYPE_NONE
         .setRequiresCharging(true)// 是否充电  
         .setRequiresDeviceIdle(false)// 设备是否空闲 
         .setPersisted(true) //设备重启后是否继续执行
         .setBackoffCriteria(3000，JobInfo.BACKOFF_POLICY_LINEAR) //设置退避/重试策略
         .build();  
 scheduler.schedule(jobInfo); 

 scheduler.cancel(123); //取消jobId=123的任务
 scheduler.cancelAll(); //取消当前uid下的所有任务

private void startOtherServices() {
  ...
  mSystemServiceManager.startService(JobSchedulerService.class);
  ...
}

JobSchedulerService {
    List<StateController> mControllers;
    final JobHandler mHandler;
    final JobSchedulerStub mJobSchedulerStub;
    final JobStore mJobs;
    ...
    
    public JobSchedulerService(Context context) {
        super(context);
        mControllers = new ArrayList<StateController>();
        mControllers.add(ConnectivityController.get(this));
        mControllers.add(TimeController.get(this));
        mControllers.add(IdleController.get(this));
        mControllers.add(BatteryController.get(this));
        mControllers.add(AppIdleController.get(this));
        
        //创建主线程的looper[见小节2.3]
        mHandler = new JobHandler(context.getMainLooper());
        //创建binder服务端[见小节2.4]
        mJobSchedulerStub = new JobSchedulerStub();
        //[见小节2.5]
        mJobs = JobStore.initAndGet(this);
    }

    public void onStart() {
        publishBinderService(Context.JOB_SCHEDULER_SERVICE, mJobSchedulerStub);
    }
}

public class ConnectivityController extends StateController implements
        ConnectivityManager.OnNetworkActiveListener {
        
    public static ConnectivityController get(JobSchedulerService jms) {
        synchronized (sCreationLock) {
            if (mSingleton == null) {
                //单例模式
                mSingleton = new ConnectivityController(jms, jms.getContext());
            }
            return mSingleton;
        }
    }
    
    private ConnectivityController(StateChangedListener stateChangedListener, Context context) {
        super(stateChangedListener, context);
        //注册监听网络连接状态的广播，且采用BackgroundThread线程
        IntentFilter intentFilter = new IntentFilter();
        intentFilter.addAction(ConnectivityManager.CONNECTIVITY_ACTION);
        mContext.registerReceiverAsUser(
                mConnectivityChangedReceiver, UserHandle.ALL, intentFilter, null,
                BackgroundThread.getHandler());
        ConnectivityService cs =
                (ConnectivityService)ServiceManager.getService(Context.CONNECTIVITY_SERVICE);
        if (cs != null) {
            if (cs.getActiveNetworkInfo() != null) {
                mNetworkConnected = cs.getActiveNetworkInfo().isConnected();
            }
            mNetworkUnmetered = mNetworkConnected && !cs.isActiveNetworkMetered();
        }
    }
}

public class JobSchedulerService extends com.android.server.SystemService
    implements StateChangedListener, JobCompletedListener {
    private class JobHandler extends Handler {

    public JobHandler(Looper looper) {
        super(looper);
    }

    public void handleMessage(Message message) {
        synchronized (mJobs) {
            //当系统启动到phase 600，则mReadyToRock=true.
            if (!mReadyToRock) {
                return;
            }
        }
        switch (message.what) {
            case MSG_JOB_EXPIRED: ...
            case MSG_CHECK_JOB: ...
        }
        maybeRunPendingJobsH();
        removeMessages(MSG_CHECK_JOB);
    }

final class JobSchedulerStub extends IJobScheduler.Stub {
    ...
}

static JobStore initAndGet(JobSchedulerService jobManagerService) {
    synchronized (sSingletonLock) {
        if (sSingleton == null) {
            //[见小节2.6]
            sSingleton = new JobStore(jobManagerService.getContext(),
                    Environment.getDataDirectory());
        }
        return sSingleton;
    }
}

public class JobStore {
    final ArraySet<JobStatus> mJobSet;
    private final Handler mIoHandler = IoThread.getHandler();
    ...
    
    private JobStore(Context context, File dataDir) {
        mContext = context;
        mDirtyOperations = 0;

        File systemDir = new File(dataDir, "system");
        File jobDir = new File(systemDir, "job");
        jobDir.mkdirs();
        // 创建/data/system/job/jobs.xml
        mJobsFile = new AtomicFile(new File(jobDir, "jobs.xml"));
        mJobSet = new ArraySet<JobStatus>();
        //[见小节2.7.1]
        readJobMapFromDisk(mJobSet);
    }
}

private class ReadJobMapFromDiskRunnable implements Runnable {
    private final ArraySet<JobStatus> jobSet;

    ReadJobMapFromDiskRunnable(ArraySet<JobStatus> jobSet) {
        this.jobSet = jobSet;
    }

    public void run() {
        List<JobStatus> jobs;
        FileInputStream fis = mJobsFile.openRead();
        synchronized (JobStore.this) {
            jobs = readJobMapImpl(fis);  //[见小节2.7.2]
            if (jobs != null) {
                for (int i=0; i<jobs.size(); i++) {
                    this.jobSet.add(jobs.get(i));
                }
            }
        }
        fis.close();
    }
}

private List<JobStatus> readJobMapImpl(FileInputStream fis)
         throws XmlPullParserException, IOException {
     XmlPullParser parser = Xml.newPullParser();
     parser.setInput(fis, StandardCharsets.UTF_8.name());
     ...

     String tagName = parser.getName();
     if ("job-info".equals(tagName)) {
         final List<JobStatus> jobs = new ArrayList<JobStatus>();
         ...
         eventType = parser.next();
         do {
             //读取每一个 <job/>
             if (eventType == XmlPullParser.START_TAG) {
                 tagName = parser.getName();
                 if ("job".equals(tagName)) {
                      //[见小节2.7.3]
                     JobStatus persistedJob = restoreJobFromXml(parser);
                     if (persistedJob != null) {
                         jobs.add(persistedJob);
                     } 
                 }
             }
             eventType = parser.next();
         } while (eventType != XmlPullParser.END_DOCUMENT);
         return jobs;
     }
     return null;
 }

private JobStatus restoreJobFromXml(XmlPullParser parser) throws XmlPullParserException,
            IOException {
    JobInfo.Builder jobBuilder;
    int uid;
    //创建用于获取jobInfo的Builder[见小节2.7.4]
    jobBuilder = buildBuilderFromXml(parser);
    jobBuilder.setPersisted(true);
    uid = Integer.valueOf(parser.getAttributeValue(null, "uid"));
    ...
    
    buildConstraintsFromXml(jobBuilder, parser); //读取常量
    //读取job执行的两个时间点：delay和deadline
    Pair<Long, Long> elapsedRuntimes = buildExecutionTimesFromXml(parser);
    ...
    //[见小节2.8]
    return new JobStatus(jobBuilder.build(), uid, 
                elapsedRuntimes.first, elapsedRuntimes.second);
}

private JobInfo.Builder buildBuilderFromXml(XmlPullParser parser) throws NumberFormatException {
    int jobId = Integer.valueOf(parser.getAttributeValue(null, "jobid"));
    String packageName = parser.getAttributeValue(null, "package");
    String className = parser.getAttributeValue(null, "class");
    ComponentName cname = new ComponentName(packageName, className);
    //[见小节2.7.5]
    return new JobInfo.Builder(jobId, cname);
}

public class JobInfo implements Parcelable {
    public static final class Builder {
        public Builder(int jobId, ComponentName jobService) {
             mJobService = jobService;
             mJobId = jobId;
        }
        public JobInfo build() {
            mExtras = new PersistableBundle(mExtras); 
            return new JobInfo(this); //创建JobInfo
        }
    }
}

public JobStatus(JobInfo job, int uId, long earliestRunTimeElapsedMillis,
                  long latestRunTimeElapsedMillis) {
    this(job, uId, 0);

    this.earliestRunTimeElapsedMillis = earliestRunTimeElapsedMillis;
    this.latestRunTimeElapsedMillis = latestRunTimeElapsedMillis;
}

private JobStatus(JobInfo job, int uId, int numFailures) {
    this.job = job;
    this.uId = uId;
    this.name = job.getService().flattenToShortString();
    this.tag = "*job*/" + this.name;
    this.numFailures = numFailures;
}

public void onBootPhase(int phase) {
    if (PHASE_SYSTEM_SERVICES_READY == phase) {
        //阶段500，则开始注册package和use移除的广播监听
        final IntentFilter filter = new IntentFilter(Intent.ACTION_PACKAGE_REMOVED);
        filter.addDataScheme("package");
        getContext().registerReceiverAsUser(
                mBroadcastReceiver, UserHandle.ALL, filter, null, null);
        final IntentFilter userFilter = new IntentFilter(Intent.ACTION_USER_REMOVED);
        userFilter.addAction(PowerManager.ACTION_DEVICE_IDLE_MODE_CHANGED);
        getContext().registerReceiverAsUser(
                mBroadcastReceiver, UserHandle.ALL, userFilter, null, null);
        mPowerManager = (PowerManager)getContext().getSystemService(Context.POWER_SERVICE);
    } else if (phase == PHASE_THIRD_PARTY_APPS_CAN_START) {
        synchronized (mJobs) {
            mReadyToRock = true;
            mBatteryStats = IBatteryStats.Stub.asInterface(ServiceManager.getService(
                    BatteryStats.SERVICE_NAME));
            for (int i = 0; i < MAX_JOB_CONTEXTS_COUNT; i++) {
                //创建JobServiceContext对象
                mActiveServices.add(
                        new JobServiceContext(this, mBatteryStats,
                                getContext().getMainLooper()));
            }
            ArraySet<JobStatus> jobs = mJobs.getJobs();
            for (int i=0; i<jobs.size(); i++) {
                JobStatus job = jobs.valueAt(i);
                for (int controller=0; controller<mControllers.size(); controller++) {
                    mControllers.get(controller).deviceIdleModeChanged(mDeviceIdleMode);
                    mControllers.get(controller).maybeStartTrackingJob(job);
                }
            }
            mHandler.obtainMessage(MSG_CHECK_JOB).sendToTarget();
        }
    }
}

JobServiceContext(JobSchedulerService service, IBatteryStats batteryStats, Looper looper) {
    this(service.getContext(), batteryStats, service, looper);
}

JobServiceContext(Context context, IBatteryStats batteryStats,
        JobCompletedListener completedListener, Looper looper) {
    mContext = context;
    mBatteryStats = batteryStats;
    mCallbackHandler = new JobServiceHandler(looper);
    mCompletedListener = completedListener;
    mAvailable = true;
}

registerService(Context.JOB_SCHEDULER_SERVICE, JobScheduler.class,
        new StaticServiceFetcher<JobScheduler>() {
    public JobScheduler createService() {
        IBinder b = ServiceManager.getService(Context.JOB_SCHEDULER_SERVICE);
        return new JobSchedulerImpl(IJobScheduler.Stub.asInterface(b));
    }});

public abstract class JobService extends Service {
    IJobService mBinder = new IJobService.Stub() {
        public void startJob(JobParameters jobParams) {
            ensureHandler();
            //向主线程的Handler发送执行任务的消息
            Message m = Message.obtain(mHandler, MSG_EXECUTE_JOB, jobParams);
            m.sendToTarget();
        }
        public void stopJob(JobParameters jobParams) {
            ensureHandler();
            //向主线程的Handler发送停止任务的消息
            Message m = Message.obtain(mHandler, MSG_STOP_JOB, jobParams);
            m.sendToTarget();
        }
    };
    
    void ensureHandler() {
       synchronized (mHandlerLock) {
           if (mHandler == null) {
               //[见小节3.2.1]
               mHandler = new JobHandler(getMainLooper());
           }
       }
   }
   public final IBinder onBind(Intent intent) {
      return mBinder.asBinder();
  }
  
}

class JobHandler extends Handler {
    ...
    public void handleMessage(Message msg) {
        final JobParameters params = (JobParameters) msg.obj;
        switch (msg.what) {
            case MSG_EXECUTE_JOB:
                boolean workOngoing = JobService.this.onStartJob(params);
                ackStartMessage(params, workOngoing);
                break;
            case MSG_STOP_JOB:
                boolean ret = JobService.this.onStopJob(params);
                ackStopMessage(params, ret);
                break;
            case MSG_JOB_FINISHED:
                final boolean needsReschedule = (msg.arg2 == 1);
                IJobCallback callback = params.getCallback();
                if (callback != null) {
                    callback.jobFinished(params.getJobId(), needsReschedule);
                }
                break;
            default:
                break;
        }
    }
}    

public int schedule(JobInfo job) {
    try {
        return mBinder.schedule(job); //[见小节3.4]
    } catch (RemoteException e) {
        return JobScheduler.RESULT_FAILURE;
    }
}

public int schedule(JobInfo job) throws RemoteException {
    final int pid = Binder.getCallingPid();
    final int uid = Binder.getCallingUid();
    enforceValidJobRequest(uid, job);

    long ident = Binder.clearCallingIdentity();
    try {
        return JobSchedulerService.this.schedule(job, uid);  //[见小节3.5]
    } finally {
        Binder.restoreCallingIdentity(ident);
    }
}

public int schedule(JobInfo job, int uId) {
    //创建JobStatus
    JobStatus jobStatus = new JobStatus(job, uId);
    //先取消该uid下的任务【见小节3.6】
    cancelJob(uId, job.getId());
    //开始追踪该任务【见小节3.7】
    startTrackingJob(jobStatus);
    //向system_server进程的主线程发送message.【见小节3.8】
    mHandler.obtainMessage(MSG_CHECK_JOB).sendToTarget();
    return JobScheduler.RESULT_SUCCESS;
}

public void cancelJob(int uid, int jobId) {
    JobStatus toCancel;
    synchronized (mJobs) {
        //查找到相应的JobStatus
        toCancel = mJobs.getJobByUidAndJobId(uid, jobId);
    }
    if (toCancel != null) {
        //【见小节4.3】
        cancelJobImpl(toCancel);
    }
}

private void startTrackingJob(JobStatus jobStatus) {
    boolean update;
    boolean rocking;
    synchronized (mJobs) {
        update = mJobs.add(jobStatus);
        rocking = mReadyToRock;
    }
    if (rocking) {
        for (int i=0; i<mControllers.size(); i++) {
            StateController controller = mControllers.get(i);
            if (update) {
                controller.maybeStopTrackingJob(jobStatus);
            }
            controller.maybeStartTrackingJob(jobStatus);
        }
    }
}

private class JobHandler extends Handler {
    public void handleMessage(Message message) {
        synchronized (mJobs) {
            if (!mReadyToRock) {
                return;
            }
        }
        switch (message.what) {
            case MSG_JOB_EXPIRED: ...                    
                break;
            case MSG_CHECK_JOB:
                synchronized (mJobs) {
                    //[见小节3.9]
                    maybeQueueReadyJobsForExecutionLockedH();
                }
                break;
        }
        //[见小节3.10]
        maybeRunPendingJobsH();
        removeMessages(MSG_CHECK_JOB);
    }
}

private void maybeQueueReadyJobsForExecutionLockedH() {
    int chargingCount = 0;
    int idleCount =  0;
    int backoffCount = 0;
    int connectivityCount = 0;
    List<JobStatus> runnableJobs = new ArrayList<JobStatus>();
    ArraySet<JobStatus> jobs = mJobs.getJobs();
    for (int i=0; i<jobs.size(); i++) {
        JobStatus job = jobs.valueAt(i);
        if (isReadyToBeExecutedLocked(job)) {
            if (job.getNumFailures() > 0) {
                backoffCount++;
            }
            if (job.hasIdleConstraint()) {
                idleCount++;
            }
            if (job.hasConnectivityConstraint() || job.hasUnmeteredConstraint()) {
                connectivityCount++;
            }
            if (job.hasChargingConstraint()) {
                chargingCount++;
            }
            //将所有job加入runnableJobs队列
            runnableJobs.add(job);
        } else if (isReadyToBeCancelledLocked(job)) {
            stopJobOnServiceContextLocked(job);
        }
    }
    if (backoffCount > 0 ||
            idleCount >= MIN_IDLE_COUNT ||
            connectivityCount >= MIN_CONNECTIVITY_COUNT ||
            chargingCount >= MIN_CHARGING_COUNT ||
            runnableJobs.size() >= MIN_READY_JOBS_COUNT) {
        for (int i=0; i<runnableJobs.size(); i++) {
            //加入到mPendingJobs队列
            mPendingJobs.add(runnableJobs.get(i));
        }
    } 
}

private void maybeRunPendingJobsH() {
    synchronized (mJobs) {
        if (mDeviceIdleMode) {
            return;
        }
        Iterator<JobStatus> it = mPendingJobs.iterator();
        while (it.hasNext()) {
            JobStatus nextPending = it.next();
            JobServiceContext availableContext = null;
            for (int i=0; i<mActiveServices.size(); i++) {
                JobServiceContext jsc = mActiveServices.get(i);
                final JobStatus running = jsc.getRunningJob();
                if (running != null && running.matches(nextPending.getUid(),
                        nextPending.getJobId())) {
                    availableContext = null;
                    break;
                }
                if (jsc.isAvailable()) {
                    availableContext = jsc;
                }
            }
            if (availableContext != null) {
                //[见小节3.11]
                if (!availableContext.executeRunnableJob(nextPending)) {
                    mJobs.remove(nextPending);
                }
                it.remove();
            }
        }
    }
}

boolean executeRunnableJob(JobStatus job) {
    synchronized (mLock) {
        if (!mAvailable) {
            return false;
        }

        mRunningJob = job;
        final boolean isDeadlineExpired =
                job.hasDeadlineConstraint() &&
                        (job.getLatestRunTimeElapsed() < SystemClock.elapsedRealtime());
        mParams = new JobParameters(this, job.getJobId(), job.getExtras(), isDeadlineExpired);
        mExecutionStartTimeElapsed = SystemClock.elapsedRealtime();

        mVerb = VERB_BINDING;
        scheduleOpTimeOut();
        final Intent intent = new Intent().setComponent(job.getServiceComponent());
        //bind服务【见小节3.11.1】
        boolean binding = mContext.bindServiceAsUser(intent, this,
                Context.BIND_AUTO_CREATE | Context.BIND_NOT_FOREGROUND,
                new UserHandle(job.getUserId()));
        if (!binding) {
            mRunningJob = null;
            mParams = null;
            mExecutionStartTimeElapsed = 0L;
            mVerb = VERB_FINISHED;
            removeOpTimeOut();
            return false;
        }
        ...
        mAvailable = false;
        return true;
    }
}

public void onServiceConnected(ComponentName name, IBinder service) {
    JobStatus runningJob;
    synchronized (mLock) {
        runningJob = mRunningJob;
    }
    if (runningJob == null || !name.equals(runningJob.getServiceComponent())) {
        mCallbackHandler.obtainMessage(MSG_SHUTDOWN_EXECUTION).sendToTarget();
        return;
    }
    //获取远程JobService的代理端
    this.service = IJobService.Stub.asInterface(service);
    ...
    //发送消息【见小节3.11.2】
    mCallbackHandler.obtainMessage(MSG_SERVICE_BOUND).sendToTarget();
}

private class JobServiceHandler extends Handler {
    JobServiceHandler(Looper looper) {
        super(looper);
    }

    public void handleMessage(Message message) {
        switch (message.what) {
            case MSG_SERVICE_BOUND:
                removeOpTimeOut(); //移除MSG_TIMEOUT消息
                handleServiceBoundH(); //【见小节3.11.3】
                break;
            ...
        }
    }
}

private void handleServiceBoundH() {
    if (mVerb != VERB_BINDING) {
        closeAndCleanupJobH(false /* reschedule */);
        return;
    }
    if (mCancelled.get()) {
        closeAndCleanupJobH(true /* reschedule */);
        return;
    }
    mVerb = VERB_STARTING;
    scheduleOpTimeOut();
    //此处经过binder调用【见小节3.11.4】
    service.startJob(mParams);
}

public abstract class JobService extends Service {
    IJobService mBinder = new IJobService.Stub() {
        public void startJob(JobParameters jobParams) {
            ensureHandler();
            //向主线程的Handler发送执行任务的消息【见小节3.11.5】
            Message m = Message.obtain(mHandler, MSG_EXECUTE_JOB, jobParams);
            m.sendToTarget();
        }
        
        public void stopJob(JobParameters jobParams) {
            ...
        }
    };
    
  
}

class JobHandler extends Handler {
    ...
    public void handleMessage(Message msg) {
        final JobParameters params = (JobParameters) msg.obj;
        switch (msg.what) {
            case MSG_EXECUTE_JOB:
                boolean workOngoing = JobService.this.onStartJob(params);
                ackStartMessage(params, workOngoing);
                break;
            case MSG_STOP_JOB: ...
            case MSG_JOB_FINISHED:...
            default: break;
        }
    }
}   

public class JobSchedulerImpl extends JobScheduler {
    public void cancel(int jobId) {
        try {
            mBinder.cancel(jobId); //【见小节4.2】
        } catch (RemoteException e) {}
    }

    public void cancelAll() {
        try {
            mBinder.cancelAll();
        } catch (RemoteException e) {}
    }
    ...
}

final class JobSchedulerStub extends IJobScheduler.Stub {
    public void cancel(int jobId) throws RemoteException {
        final int uid = Binder.getCallingUid();
        long ident = Binder.clearCallingIdentity();
        try {
            //【见小节4.3】
            JobSchedulerService.this.cancelJob(uid, jobId);
        } finally {
            Binder.restoreCallingIdentity(ident);
        }
    }
    
    public void cancelAll() throws RemoteException {
        final int uid = Binder.getCallingUid();
        long ident = Binder.clearCallingIdentity();
        try {
            JobSchedulerService.this.cancelJobsForUid(uid);
        } finally {
            Binder.restoreCallingIdentity(ident);
        }
    }
    
    ...
}

public class JobSchedulerService extends com.android.server.SystemService
        implements StateChangedListener, JobCompletedListener {
        
    public void cancelJob(int uid, int jobId) {
        JobStatus toCancel;
        synchronized (mJobs) {
            //【见小节4.3.1】
            toCancel = mJobs.getJobByUidAndJobId(uid, jobId);
        }
        if (toCancel != null) {
            cancelJobImpl(toCancel);
        }
    }
    
    public void cancelJobsForUid(int uid) {
        List<JobStatus> jobsForUid;
        synchronized (mJobs) {
            //【见小节4.3.2】
            jobsForUid = mJobs.getJobsByUid(uid);
        }
        for (int i=0; i<jobsForUid.size(); i++) {
            JobStatus toRemove = jobsForUid.get(i);
            //【见小节4.4】
            cancelJobImpl(toRemove);
        }
    }
    ...
}

public JobStatus getJobByUidAndJobId(int uid, int jobId) {
    Iterator<JobStatus> it = mJobSet.iterator();
    while (it.hasNext()) {
        JobStatus ts = it.next();
        if (ts.getUid() == uid && ts.getJobId() == jobId) {
            return ts;
        }
    }
    return null;
}

public List<JobStatus> getJobsByUid(int uid) {
    List<JobStatus> matchingJobs = new ArrayList<JobStatus>();
    Iterator<JobStatus> it = mJobSet.iterator();
    while (it.hasNext()) {
        JobStatus ts = it.next();
        if (ts.getUid() == uid) {
            matchingJobs.add(ts);
        }
    }
    return matchingJobs;
}

private void cancelJobImpl(JobStatus cancelled) {
    stopTrackingJob(cancelled); //【见小节4.5】
    synchronized (mJobs) {
        mPendingJobs.remove(cancelled);
        //【见小节4.6】
        stopJobOnServiceContextLocked(cancelled);
    }
}

private boolean stopTrackingJob(JobStatus jobStatus) {
    boolean removed;
    boolean rocking;
    synchronized (mJobs) {
        removed = mJobs.remove(jobStatus);
        rocking = mReadyToRock;
    }
    if (removed && rocking) {
        for (int i=0; i<mControllers.size(); i++) {
            StateController controller = mControllers.get(i);
            //获取StateController的具体实现子类停止执行
            controller.maybeStopTrackingJob(jobStatus);
        }
    }
    return removed;
}

private boolean stopJobOnServiceContextLocked(JobStatus job) {
    for (int i=0; i<mActiveServices.size(); i++) {
        JobServiceContext jsc = mActiveServices.get(i);
        final JobStatus executing = jsc.getRunningJob();
        if (executing != null && executing.matches(job.getUid(), job.getJobId())) {
            //找到匹配的正在执行任务，则取消该任务【见小节4.6.1】
            jsc.cancelExecutingJob();
            return true;
        }
    }
    return false;
}

void cancelExecutingJob() {
    //【见小节4.6.2】
    mCallbackHandler.obtainMessage(MSG_CANCEL).sendToTarget();
}

private void handleCancelH() {
    if (mRunningJob == null) {
        return;
    }
    switch (mVerb) {
        case VERB_BINDING:
        case VERB_STARTING:
            mCancelled.set(true);
            break;
        case VERB_EXECUTING:
            if (hasMessages(MSG_CALLBACK)) {
                //当client已调用jobFinished，则忽略本次取消操作
                return;
            }
            sendStopMessageH(); //【见小节4.6.3】
            break;
        case VERB_STOPPING:
            break;
        default:
            break;
    }
}

private void sendStopMessageH() {
    removeOpTimeOut();
    if (mVerb != VERB_EXECUTING) {
        //停止还没有启动的job
        closeAndCleanupJobH(false /* reschedule */);
        return;
    }
    try {
        mVerb = VERB_STOPPING;
        scheduleOpTimeOut();
        //【见小节4.6.4】
        service.stopJob(mParams);
    } catch (RemoteException e) {
        closeAndCleanupJobH(false /* reschedule */);
    }
}

public abstract class JobService extends Service {
    IJobService mBinder = new IJobService.Stub() {
        public void startJob(JobParameters jobParams) {
            ...
        }
        public void stopJob(JobParameters jobParams) {
            ensureHandler();
            //向主线程的Handler发送停止任务的消息【见小节4.6.5】
            Message m = Message.obtain(mHandler, MSG_STOP_JOB, jobParams);
            m.sendToTarget();
        }
    };
    
    ...
}

class JobHandler extends Handler {
    ...
    public void handleMessage(Message msg) {
        final JobParameters params = (JobParameters) msg.obj;
        switch (msg.what) {
            case MSG_EXECUTE_JOB:...
            case MSG_STOP_JOB:
                boolean ret = JobService.this.onStopJob(params);
                ackStopMessage(params, ret);
                break;
            case MSG_JOB_FINISHED:...
            default: break;
        }
    }
}  

PendingIntent pi = PendingIntent.getBroadcast(mContext, 0, new Intent(ACTION_JOB_EXPIRED), 0);
AlarmManager alarmManager=(AlarmManager)getSystemService(Service.ALARM_SERVICE); 
alarmManager.set(AlarmManager.ELAPSED_REALTIME, SystemClock.elapsedRealtime(), pi);  

private void startOtherServices() {
  ...
  mSystemServiceManager.startService(AlarmManagerService.class);
  ...
}

public AlarmManagerService(Context context) {
    super(context);
    mConstants = new Constants(mHandler);
}

private final class Constants extends ContentObserver {
    public Constants(Handler handler) {
        super(handler);
        updateAllowWhileIdleMinTimeLocked();
        updateAllowWhileIdleWhitelistDurationLocked();
    }
    
    public void updateAllowWhileIdleMinTimeLocked() {
        mAllowWhileIdleMinTime = mPendingIdleUntil != null
                ? ALLOW_WHILE_IDLE_LONG_TIME : ALLOW_WHILE_IDLE_SHORT_TIME;
    }

    public void updateAllowWhileIdleWhitelistDurationLocked() {
        if (mLastAllowWhileIdleWhitelistDuration != ALLOW_WHILE_IDLE_WHITELIST_DURATION) {
            mLastAllowWhileIdleWhitelistDuration = ALLOW_WHILE_IDLE_WHITELIST_DURATION;
            BroadcastOptions opts = BroadcastOptions.makeBasic();
            //设置为10s
            opts.setTemporaryAppWhitelistDuration(ALLOW_WHILE_IDLE_WHITELIST_DURATION);
            mIdleOptions = opts.toBundle();
        }
    }
    ...
}

public void onStart() {
    mNativeData = init(); //【2.4】
    mNextWakeup = mNextNonWakeup = 0;

    //由于重启后内核并没有保存时区信息，则必须将当前时区设置到内核；若时区改变则会发送相应
    setTimeZoneImpl(SystemProperties.get(TIMEZONE_PROPERTY));

    PowerManager pm = (PowerManager) getContext().getSystemService(Context.POWER_SERVICE);
    mWakeLock = pm.newWakeLock(PowerManager.PARTIAL_WAKE_LOCK, "*alarm*");
    //TIME_TICK广播
    mTimeTickSender = PendingIntent.getBroadcastAsUser(getContext(), 0,
            new Intent(Intent.ACTION_TIME_TICK).addFlags(
                    Intent.FLAG_RECEIVER_REGISTERED_ONLY
                    | Intent.FLAG_RECEIVER_FOREGROUND), 0,
                    UserHandle.ALL);
    //DATE_CHANGED广播
    Intent intent = new Intent(Intent.ACTION_DATE_CHANGED);
    intent.addFlags(Intent.FLAG_RECEIVER_REPLACE_PENDING);
    mDateChangeSender = PendingIntent.getBroadcastAsUser(getContext(), 0, intent,
            Intent.FLAG_RECEIVER_REGISTERED_ONLY_BEFORE_BOOT, UserHandle.ALL);
            
    //【见小节2.5】
    mClockReceiver = new ClockReceiver();
    //首次调度一次，后面每分钟执行一次【见小节2.6】
    mClockReceiver.scheduleTimeTickEvent();
    //日期改变的广播，流程同上
    mClockReceiver.scheduleDateChangedEvent();
    
    //用于监听亮屏/灭屏广播
    mInteractiveStateReceiver = new InteractiveStateReceiver();
    //用于监听package移除/重启，sdcard不可用的广播
    mUninstallReceiver = new UninstallReceiver();
    
    if (mNativeData != 0) {
        //创建"AlarmManager"【见小节2.8】
        AlarmThread waitThread = new AlarmThread();
        waitThread.start();
    } 
    //发布alarm服务
    publishBinderService(Context.ALARM_SERVICE, mService);
}

static jlong android_server_AlarmManagerService_init(JNIEnv*, jobject)
{
    jlong ret = init_alarm_driver(); //【2.4.1】
    if (ret) {
        return ret;
    }
    return init_timerfd(); //【2.4.2】
}

static jlong init_alarm_driver()
{
    int fd = open("/dev/alarm", O_RDWR);
    //创建Alarm驱动对象
    AlarmImpl *ret = new AlarmImplAlarmDriver(fd);
    return reinterpret_cast<jlong>(ret);
}

static jlong init_timerfd()
{
    int epollfd;
    int fds[N_ANDROID_TIMERFDS];

    epollfd = epoll_create(N_ANDROID_TIMERFDS);
    for (size_t i = 0; i < N_ANDROID_TIMERFDS; i++) {
        fds[i] = timerfd_create(android_alarm_to_clockid[i], 0);
        
    }

    //创建AlarmImplTimerFd对象
    AlarmImpl *ret = new AlarmImplTimerFd(fds, epollfd, wall_clock_rtc());
    for (size_t i = 0; i < N_ANDROID_TIMERFDS; i++) {
        epoll_event event;
        event.events = EPOLLIN | EPOLLWAKEUP;
        event.data.u32 = i;

        int err = epoll_ctl(epollfd, EPOLL_CTL_ADD, fds[i], &event);
        ...
    }

    struct itimerspec spec;
    memset(&spec, 0, sizeof(spec));

    int err = timerfd_settime(fds[ANDROID_ALARM_TYPE_COUNT],
            TFD_TIMER_ABSTIME | TFD_TIMER_CANCEL_ON_SET, &spec, NULL);
    ...

    return reinterpret_cast<jlong>(ret);
}

android_alarm_to_clockid[N_ANDROID_TIMERFDS] = {
    CLOCK_REALTIME_ALARM,
    CLOCK_REALTIME,
    CLOCK_BOOTTIME_ALARM,
    CLOCK_BOOTTIME,
    CLOCK_MONOTONIC,
    CLOCK_REALTIME,
};

class ClockReceiver extends BroadcastReceiver {
    public ClockReceiver() {
        IntentFilter filter = new IntentFilter();
        filter.addAction(Intent.ACTION_TIME_TICK);
        filter.addAction(Intent.ACTION_DATE_CHANGED);
        getContext().registerReceiver(this, filter);
    }
    ...
}

public void scheduleTimeTickEvent() {
    final long currentTime = System.currentTimeMillis();
    final long nextTime = 60000 * ((currentTime / 60000) + 1);
    //距离下一分钟的时间戳
    final long tickEventDelay = nextTime - currentTime;

    final WorkSource workSource = null
    //【见小节2.7】
    setImpl(ELAPSED_REALTIME, SystemClock.elapsedRealtime() + tickEventDelay, 0,
            0, mTimeTickSender, AlarmManager.FLAG_STANDALONE, workSource, null,
            Process.myUid());
}

void setImpl(int type, long triggerAtTime, long windowLength, long interval,
         PendingIntent operation, int flags, WorkSource workSource,
         AlarmManager.AlarmClockInfo alarmClock, int callingUid) {
      ...
     final long nowElapsed = SystemClock.elapsedRealtime();
     //获取闹钟触发的时间点
     final long nominalTrigger = convertToElapsed(triggerAtTime, type);
     final long minTrigger = nowElapsed + mConstants.MIN_FUTURITY;
     //保证alarm时间至少是在5s之后发生
     final long triggerElapsed = (nominalTrigger > minTrigger) ? nominalTrigger : minTrigger;

     final long maxElapsed;
     if (windowLength == AlarmManager.WINDOW_EXACT) {
         maxElapsed = triggerElapsed;
     } else if (windowLength < 0) {
         maxElapsed = maxTriggerTime(nowElapsed, triggerElapsed, interval);
         windowLength = maxElapsed - triggerElapsed;
     } else {
         maxElapsed = triggerElapsed + windowLength;
     }

     synchronized (mLock) {
         //【见小节2.7.1】
         setImplLocked(type, triggerAtTime, triggerElapsed, windowLength, maxElapsed,
                 interval, operation, flags, true, workSource, alarmClock, callingUid);
     }
 }

private void setImplLocked(int type, long when, long whenElapsed, long windowLength,
        long maxWhen, long interval, PendingIntent operation, int flags,
        boolean doValidate, WorkSource workSource, AlarmManager.AlarmClockInfo alarmClock,
        int uid) {
    //创建Alarm对象
    Alarm a = new Alarm(type, when, whenElapsed, windowLength, maxWhen, interval,
            operation, workSource, flags, alarmClock, uid);
    removeLocked(operation);
    //【见小节2.7.2】
    setImplLocked(a, false, doValidate);
}

private void setImplLocked(Alarm a, boolean rebatching, boolean doValidate) {
    if ((a.flags&AlarmManager.FLAG_IDLE_UNTIL) != 0) {
        if (mNextWakeFromIdle != null && a.whenElapsed > mNextWakeFromIdle.whenElapsed) {
            a.when = a.whenElapsed = a.maxWhenElapsed = mNextWakeFromIdle.whenElapsed;
        }
        //增加模糊事件，让alarm比实际预期事件更早的执行
        final long nowElapsed = SystemClock.elapsedRealtime();
        final int fuzz = fuzzForDuration(a.whenElapsed-nowElapsed);
        if (fuzz > 0) {
            if (mRandom == null) {
                mRandom = new Random();
            }
            //创建随机模糊时间
            final int delta = mRandom.nextInt(fuzz);
            a.whenElapsed -= delta;
            a.when = a.maxWhenElapsed = a.whenElapsed;
        }

    } else if (mPendingIdleUntil != null) {
        if ((a.flags&(AlarmManager.FLAG_ALLOW_WHILE_IDLE
                | AlarmManager.FLAG_ALLOW_WHILE_IDLE_UNRESTRICTED
                | AlarmManager.FLAG_WAKE_FROM_IDLE))
                == 0) {
            mPendingWhileIdleAlarms.add(a);
            return;
        }
    }

    int whichBatch = ((a.flags&AlarmManager.FLAG_STANDALONE) != 0)
            ? -1 : attemptCoalesceLocked(a.whenElapsed, a.maxWhenElapsed);
    if (whichBatch < 0) {
        //TIME_TICK是独立的，不与其他alarm一起批处理
        Batch batch = new Batch(a);
        addBatchLocked(mAlarmBatches, batch);
    } else {
        ...
    }
    ...

    boolean needRebatch = false;

    if ((a.flags&AlarmManager.FLAG_IDLE_UNTIL) != 0) {
        mPendingIdleUntil = a;
        mConstants.updateAllowWhileIdleMinTimeLocked();
        needRebatch = true;
    } else if ((a.flags&AlarmManager.FLAG_WAKE_FROM_IDLE) != 0) {
        if (mNextWakeFromIdle == null || mNextWakeFromIdle.whenElapsed > a.whenElapsed) {
            mNextWakeFromIdle = a;
            if (mPendingIdleUntil != null) {
                needRebatch = true;
            }
        }
    }

    if (!rebatching) {
        if (needRebatch) {
            //需要对所有alarm重新执行批处理
            rebatchAllAlarmsLocked(false);
        }

        rescheduleKernelAlarmsLocked();
        //重新计算下一个alarm
        updateNextAlarmClockLocked();
    }
}

private class AlarmThread extends Thread
{
    public AlarmThread()
    {
        super("AlarmManager");
    }
    
    public void run()
    {
        ArrayList<Alarm> triggerList = new ArrayList<Alarm>();
        while (true)
        {
            //[见小节2.8.1]
            int result = waitForAlarm(mNativeData);
            triggerList.clear();

            final long nowRTC = System.currentTimeMillis();
            final long nowELAPSED = SystemClock.elapsedRealtime();

            if ((result & TIME_CHANGED_MASK) != 0) {
                ...
            }

            if (result != TIME_CHANGED_MASK) {
                synchronized (mLock) {
                    boolean hasWakeup = triggerAlarmsLocked(triggerList, nowELAPSED, nowRTC);
                    if (!hasWakeup && checkAllowNonWakeupDelayLocked(nowELAPSED)) {
                        if (mPendingNonWakeupAlarms.size() == 0) {
                            mStartCurrentDelayTime = nowELAPSED;
                            mNextNonWakeupDeliveryTime = nowELAPSED
                                    + ((currentNonWakeupFuzzLocked(nowELAPSED)*3)/2);
                        }
                        mPendingNonWakeupAlarms.addAll(triggerList);
                        mNumDelayedAlarms += triggerList.size();
                        rescheduleKernelAlarmsLocked();
                        updateNextAlarmClockLocked();
                    } else {
                        rescheduleKernelAlarmsLocked();
                        updateNextAlarmClockLocked();
                        if (mPendingNonWakeupAlarms.size() > 0) {
                            calculateDeliveryPriorities(mPendingNonWakeupAlarms);
                            triggerList.addAll(mPendingNonWakeupAlarms);
                            Collections.sort(triggerList, mAlarmDispatchComparator);
                            final long thisDelayTime = nowELAPSED - mStartCurrentDelayTime;
                            mTotalDelayTime += thisDelayTime;
                            if (mMaxDelayTime < thisDelayTime) {
                                mMaxDelayTime = thisDelayTime;
                            }
                            mPendingNonWakeupAlarms.clear();
                        }
                        //分发Alarm事件.[见小节4.1]
                        deliverAlarmsLocked(triggerList, nowELAPSED);
                    }
                }
            }
        }
    }
}

int AlarmImplTimerFd::waitForAlarm()
{
    epoll_event events[N_ANDROID_TIMERFDS];

    int nevents = epoll_wait(epollfd, events, N_ANDROID_TIMERFDS, -1);
    if (nevents < 0) {
        return nevents;
    }

    int result = 0;
    for (int i = 0; i < nevents; i++) {
        uint32_t alarm_idx = events[i].data.u32;
        uint64_t unused;
        ssize_t err = read(fds[alarm_idx], &unused, sizeof(unused));
        if (err < 0) {
            if (alarm_idx == ANDROID_ALARM_TYPE_COUNT && errno == ECANCELED) {
                result |= ANDROID_ALARM_TIME_CHANGE_MASK;
            } else {
                return err;
            }
        } else {
            result |= (1 << alarm_idx);
        }
    }

    return result;
}

//【见小节3.1】
PendingIntent pi = PendingIntent.getBroadcast(mContext, 0, new Intent(ACTION_JOB_EXPIRED), 0);
AlarmManager alarmManager=(AlarmManager)getSystemService(Service.ALARM_SERVICE); 
//[见小节3.3]
alarmManager.set(AlarmManager.ELAPSED_REALTIME, SystemClock.elapsedRealtime(), pi);  

PendingIntent.getActivity
PendingIntent.getService
PendingIntent.getBroadcastAsUser

public static PendingIntent getBroadcastAsUser(Context context, int requestCode,
        Intent intent, int flags, UserHandle userHandle) {
    String packageName = context.getPackageName();
    String resolvedType = intent != null ? intent.resolveTypeIfNeeded(
            context.getContentResolver()) : null;
    try {
        intent.prepareToLeaveProcess();
        IIntentSender target =
            ActivityManagerNative.getDefault().getIntentSender(
                ActivityManager.INTENT_SENDER_BROADCAST, packageName,
                null, null, requestCode, new Intent[] { intent },
                resolvedType != null ? new String[] { resolvedType } : null,
                flags, null, userHandle.getIdentifier());
        return target != null ? new PendingIntent(target) : null;
    } catch (RemoteException e) {
    }
    return null;
}

public static PendingIntent getActivityAsUser(Context context, int requestCode,
        Intent intent, int flags, Bundle options, UserHandle user) {
    String packageName = context.getPackageName();
    String resolvedType = intent != null ? intent.resolveTypeIfNeeded(
            context.getContentResolver()) : null;
    try {
        intent.migrateExtraStreamToClipData();
        intent.prepareToLeaveProcess();
        //[见小节3.1.4]
        IIntentSender target =
            ActivityManagerNative.getDefault().getIntentSender(
                ActivityManager.INTENT_SENDER_ACTIVITY, packageName,
                null, null, requestCode, new Intent[] { intent },
                resolvedType != null ? new String[] { resolvedType } : null,
                flags, options, user.getIdentifier());
        return target != null ? new PendingIntent(target) : null;
    } catch (RemoteException e) {
    }
    return null;
}

public static PendingIntent getService(Context context, int requestCode,
         Intent intent,  int flags) {
    String packageName = context.getPackageName();
    String resolvedType = intent != null ? intent.resolveTypeIfNeeded(
            context.getContentResolver()) : null;
    try {
        intent.prepareToLeaveProcess();
        IIntentSender target =
            ActivityManagerNative.getDefault().getIntentSender(
                ActivityManager.INTENT_SENDER_SERVICE, packageName,
                null, null, requestCode, new Intent[] { intent },
                resolvedType != null ? new String[] { resolvedType } : null,
                flags, null, UserHandle.myUserId());
        return target != null ? new PendingIntent(target) : null;
    } catch (RemoteException e) {
    }
    return null;
}

public IIntentSender getIntentSender(int type,
        String packageName, IBinder token, String resultWho,
        int requestCode, Intent[] intents, String[] resolvedTypes,
        int flags, Bundle options, int userId) {
    //重新拷贝一次intent对象内容
    if (intents != null) {
        for (int i=0; i<intents.length; i++) {
            Intent intent = intents[i];
            if (intent != null) {
                intents[i] = new Intent(intent);
            }
        }
    }
    ...
    
    synchronized(this) {
        int callingUid = Binder.getCallingUid();
        int origUserId = userId;
        userId = handleIncomingUser(Binder.getCallingPid(), callingUid, userId,
                type == ActivityManager.INTENT_SENDER_BROADCAST,
                ALLOW_NON_FULL, "getIntentSender", null);
        if (origUserId == UserHandle.USER_CURRENT) {
            userId = UserHandle.USER_CURRENT;
        }
        //【见小节3.1.5】
        return getIntentSenderLocked(type, packageName, callingUid, userId,
              token, resultWho, requestCode, intents, resolvedTypes, flags, options);
    }
}

IIntentSender getIntentSenderLocked(int type, String packageName,
        int callingUid, int userId, IBinder token, String resultWho,
        int requestCode, Intent[] intents, String[] resolvedTypes, int flags,
        Bundle options) {
    ActivityRecord activity = null;
    ...
    //创建Key对象
    PendingIntentRecord.Key key = new PendingIntentRecord.Key(
            type, packageName, activity, resultWho,
            requestCode, intents, resolvedTypes, flags, options, userId);
    WeakReference<PendingIntentRecord> ref;
    ref = mIntentSenderRecords.get(key);
    PendingIntentRecord rec = ref != null ? ref.get() : null;
    if (rec != null) {
        if (!cancelCurrent) {
            if (updateCurrent) {
                if (rec.key.requestIntent != null) {
                    rec.key.requestIntent.replaceExtras(intents != null ?
                            intents[intents.length - 1] : null);
                }
                if (intents != null) {
                    intents[intents.length-1] = rec.key.requestIntent;
                    rec.key.allIntents = intents;
                    rec.key.allResolvedTypes = resolvedTypes;
                } else {
                    rec.key.allIntents = null;
                    rec.key.allResolvedTypes = null;
                }
            }
            return rec;
        }
        rec.canceled = true;
        mIntentSenderRecords.remove(key);
    }
    if (noCreate) {
        return rec;
    }
    //创建PendingIntentRecord对象
    rec = new PendingIntentRecord(this, key, callingUid);
    mIntentSenderRecords.put(key, rec.ref);
    ...
    return rec;
}

registerService(Context.ALARM_SERVICE, AlarmManager.class,
        new CachedServiceFetcher<AlarmManager>() {

    public AlarmManager createService(ContextImpl ctx) {
        IBinder b = ServiceManager.getService(Context.ALARM_SERVICE);
        IAlarmManager service = IAlarmManager.Stub.asInterface(b);
        return new AlarmManager(service, ctx);
    }});

AlarmManager(IAlarmManager service, Context ctx) {
    mService = service; //ALMS的binder代理端
    mPackageName = ctx.getPackageName();
    mTargetSdkVersion = ctx.getApplicationInfo().targetSdkVersion;
    mAlwaysExact = (mTargetSdkVersion < Build.VERSION_CODES.KITKAT);
    mMainThreadHandler = new Handler(ctx.getMainLooper());
}

public void set(int type, long triggerAtMillis, PendingIntent operation) {
    //[见小节3.4]
    setImpl(type, triggerAtMillis, legacyExactLength(), 0, 0, operation, null, null,
        null, null, null);
}

private void setImpl(int type, long triggerAtMillis, long windowMillis, long intervalMillis,
        int flags, PendingIntent operation, final OnAlarmListener listener, String listenerTag,
        Handler targetHandler, WorkSource workSource, AlarmClockInfo alarmClock) {
    ListenerWrapper recipientWrapper = null;
    if (listener != null) {
        synchronized (AlarmManager.class) {
            if (sWrappers == null) {
                sWrappers = new ArrayMap<OnAlarmListener, ListenerWrapper>();
            }

            recipientWrapper = sWrappers.get(listener);
            if (recipientWrapper == null) {
                recipientWrapper = new ListenerWrapper(listener);
                sWrappers.put(listener, recipientWrapper);
            }
        }
        //当没有设置handler对象时,则采用当前进程的主线程handler
        final Handler handler = (targetHandler != null) ? targetHandler : mMainThreadHandler;
        recipientWrapper.setHandler(handler);
    }
    //【见小节2.7】
    mService.set(mPackageName, type, triggerAtMillis, windowMillis, intervalMillis, flags,
            operation, recipientWrapper, listenerTag, workSource, alarmClock);
}

void deliverAlarmsLocked(ArrayList<Alarm> triggerList, long nowELAPSED) {
    mLastAlarmDeliveryTime = nowELAPSED;
    for (int i=0; i<triggerList.size(); i++) {
        Alarm alarm = triggerList.get(i);
        final boolean allowWhileIdle = (alarm.flags&AlarmManager.FLAG_ALLOW_WHILE_IDLE) != 0;
        try {
            ...
            //[见小节4.2]
            mDeliveryTracker.deliverLocked(alarm, nowELAPSED, allowWhileIdle);
        } catch (RuntimeException e) {
        }
    }
}

public void deliverLocked(Alarm alarm, long nowELAPSED, boolean allowWhileIdle) {
    if (alarm.operation != null) {
        //执行PendingIntent操作[见小节4.3]
        alarm.operation.send(getContext(), 0,
                mBackgroundIntent.putExtra(
                    Intent.EXTRA_ALARM_COUNT, alarm.count),
                    mDeliveryTracker, mHandler, null,
                    allowWhileIdle ? mIdleOptions : null);
    } else {
       //[见小节4.4]
       alarm.listener.doAlarm(this);
       // 5s的超时时长 
       mHandler.sendMessageDelayed(
               mHandler.obtainMessage(AlarmHandler.LISTENER_TIMEOUT,
                       alarm.listener.asBinder()),
               mConstants.LISTENER_TIMEOUT);
    }
    //alarm正在触发
    final InFlight inflight = new InFlight(AlarmManagerService.this,
            alarm.operation, alarm.listener, alarm.workSource, alarm.uid,
            alarm.packageName, alarm.type, alarm.statsTag, nowELAPSED);
    mInFlight.add(inflight);
    mBroadcastRefCount++;
    qcNsrmExt.addTriggeredUid((alarm.operation != null) ?
                            alarm.operation.getCreatorUid() :
                            alarm.uid);
    ...
}

public void send(Context context, int code, @Nullable Intent intent,
        @Nullable OnFinished onFinished, @Nullable Handler handler,
        @Nullable String requiredPermission, @Nullable Bundle options)
        throws CanceledException {
    try {
        String resolvedType = intent != null ?
                intent.resolveTypeIfNeeded(context.getContentResolver())
                : null;
        int res = mTarget.send(code, intent, resolvedType,
                onFinished != null
                        ? new FinishedDispatcher(this, onFinished, handler)
                        : null,
                requiredPermission, options);
        ...
    } catch (RemoteException e) {
        throw new CanceledException(e);
    }
}

public int send(int code, Intent intent, String resolvedType, IIntentReceiver finishedReceiver,
        String requiredPermission, Bundle options) throws TransactionTooLargeException {
    return sendInner(code, intent, resolvedType, finishedReceiver,
            requiredPermission, null, null, 0, 0, 0, options, null);
}

int sendInner(int code, Intent intent, String resolvedType, IIntentReceiver finishedReceiver,
        String requiredPermission, IBinder resultTo, String resultWho, int requestCode,
        int flagsMask, int flagsValues, Bundle options, IActivityContainer container)
        throws TransactionTooLargeException {
    synchronized(owner) {
            ...
            final long origId = Binder.clearCallingIdentity();

            boolean sendFinish = finishedReceiver != null;
            int userId = key.userId;
            if (userId == UserHandle.USER_CURRENT) {
                userId = owner.getCurrentUserIdLocked();
            }
            switch (key.type) {
                case ActivityManager.INTENT_SENDER_ACTIVITY:
                    ...
                    if (key.allIntents != null && key.allIntents.length > 1) {
                        Intent[] allIntents = new Intent[key.allIntents.length];
                        String[] allResolvedTypes = new String[key.allIntents.length];
                        System.arraycopy(key.allIntents, 0, allIntents, 0,
                                key.allIntents.length);
                        if (key.allResolvedTypes != null) {
                            System.arraycopy(key.allResolvedTypes, 0, allResolvedTypes, 0,
                                    key.allResolvedTypes.length);
                        }
                        allIntents[allIntents.length-1] = finalIntent;
                        allResolvedTypes[allResolvedTypes.length-1] = resolvedType;
                        //核心方法
                        owner.startActivitiesInPackage(uid, key.packageName, allIntents,
                                allResolvedTypes, resultTo, options, userId);
                    } else {
                        owner.startActivityInPackage(uid, key.packageName, finalIntent,
                                resolvedType, resultTo, resultWho, requestCode, 0,
                                options, userId, container, null);
                    }
                    break;
                case ActivityManager.INTENT_SENDER_ACTIVITY_RESULT:
                    if (key.activity.task.stack != null) {
                        //核心方法
                        key.activity.task.stack.sendActivityResultLocked(-1, key.activity,
                                key.who, key.requestCode, code, finalIntent);
                    }
                    break;
                case ActivityManager.INTENT_SENDER_BROADCAST:
                    //核心方法
                    int sent = owner.broadcastIntentInPackage(key.packageName, uid,
                            finalIntent, resolvedType, finishedReceiver, code, null, null,
                            requiredPermission, options, (finishedReceiver != null),
                            false, userId);
                    if (sent == ActivityManager.BROADCAST_SUCCESS) {
                        sendFinish = false;
                    }

                    break;
                case ActivityManager.INTENT_SENDER_SERVICE:
                    //核心方法
                    owner.startServiceInPackage(uid, finalIntent,
                            resolvedType, key.packageName, userId);
                    break;
            }

            if (sendFinish) {
                finishedReceiver.performReceive(new Intent(finalIntent), 0,
                        null, null, false, false, key.userId);
            }
            Binder.restoreCallingIdentity(origId);
            return 0;
        }
    }
    return ActivityManager.START_CANCELED;
}

 final class ListenerWrapper extends IAlarmListener.Stub implements Runnable {
     final OnAlarmListener mListener;
     Handler mHandler;
     IAlarmCompleteListener mCompletion;

     public ListenerWrapper(OnAlarmListener listener) {
         mListener = listener;
     }

     //执行alarm操作[见小节4.4.1]
     public void doAlarm(IAlarmCompleteListener alarmManager) {
         mCompletion = alarmManager;
         mHandler.post(this);
     }
 }

final class ListenerWrapper extends IAlarmListener.Stub implements Runnable {
    
    public void run() {
        //从wrapper的缓存中移除该listener, 由于服务端已经认为它不存在
        synchronized (AlarmManager.class) {
            if (sWrappers != null) {
                sWrappers.remove(mListener);
            }
        }

        
        try {
            //分发目标监听者的onAlarm[4.4.2]
            mListener.onAlarm();
        } finally {
            mCompletion.alarmComplete(this);
        }
    }
}

private void setDelayExpiredAlarmLocked(long alarmTimeElapsedMillis, int uid) {
    alarmTimeElapsedMillis = maybeAdjustAlarmTime(alarmTimeElapsedMillis);
    mNextDelayExpiredElapsedMillis = alarmTimeElapsedMillis;
    //将mNextDelayExpiredListener设置到alarm的回调过程
    updateAlarmWithListenerLocked(DELAY_TAG, mNextDelayExpiredListener,
            mNextDelayExpiredElapsedMillis, uid);
}

private void updateAlarmWithListenerLocked(String tag, OnAlarmListener listener,
        long alarmTimeElapsed, int uid) {
    ensureAlarmServiceLocked();
    if (alarmTimeElapsed == Long.MAX_VALUE) {
        ...
    } else {
        mAlarmService.set(AlarmManager.ELAPSED_REALTIME_WAKEUP, alarmTimeElapsed,
                AlarmManager.WINDOW_HEURISTIC, 0, tag, listener, null, new WorkSource(uid));
    }
}


private final OnAlarmListener mNextDelayExpiredListener = new OnAlarmListener() {
    @Override
    public void onAlarm() {
        checkExpiredDelaysAndResetAlarm();
    }
};

set(int type，long startTime，PendingIntent pi)，//设置一次闹钟
setRepeating(int type，long startTime，long intervalTime，PendingIntent pi)，//设置重复闹钟
setInexactRepeating（int type，long startTime，long intervalTime，PendingIntent pi），//设置重复闹钟,但不准确

PendingIntent pi = PendingIntent.getBroadcast(mContext, 0, new Intent(ACTION_JOB_EXPIRED), 0);
AlarmManager alarmManager=(AlarmManager)getSystemService(Service.ALARM_SERVICE); 
alarmManager.set(AlarmManager.ELAPSED_REALTIME, SystemClock.elapsedRealtime(), pi);  

private void startOtherServices() {
  ...
  mSystemServiceManager.startService(AlarmManagerService.class);
  ...
}

public AlarmManagerService(Context context) {
    super(context);
    mConstants = new Constants(mHandler);
}

private final class Constants extends ContentObserver {
    public Constants(Handler handler) {
        super(handler);
        updateAllowWhileIdleMinTimeLocked();
        updateAllowWhileIdleWhitelistDurationLocked();
    }
    
    public void updateAllowWhileIdleMinTimeLocked() {
        mAllowWhileIdleMinTime = mPendingIdleUntil != null
                ? ALLOW_WHILE_IDLE_LONG_TIME : ALLOW_WHILE_IDLE_SHORT_TIME;
    }

    public void updateAllowWhileIdleWhitelistDurationLocked() {
        if (mLastAllowWhileIdleWhitelistDuration != ALLOW_WHILE_IDLE_WHITELIST_DURATION) {
            mLastAllowWhileIdleWhitelistDuration = ALLOW_WHILE_IDLE_WHITELIST_DURATION;
            BroadcastOptions opts = BroadcastOptions.makeBasic();
            //设置为10s
            opts.setTemporaryAppWhitelistDuration(ALLOW_WHILE_IDLE_WHITELIST_DURATION);
            mIdleOptions = opts.toBundle();
        }
    }
    ...
}

public void onStart() {
    mNativeData = init(); //【2.4】
    mNextWakeup = mNextNonWakeup = 0;

    //由于重启后内核并没有保存时区信息，则必须将当前时区设置到内核；若时区改变则会发送相应
    setTimeZoneImpl(SystemProperties.get(TIMEZONE_PROPERTY));

    PowerManager pm = (PowerManager) getContext().getSystemService(Context.POWER_SERVICE);
    mWakeLock = pm.newWakeLock(PowerManager.PARTIAL_WAKE_LOCK, "*alarm*");
    //TIME_TICK广播
    mTimeTickSender = PendingIntent.getBroadcastAsUser(getContext(), 0,
            new Intent(Intent.ACTION_TIME_TICK).addFlags(
                    Intent.FLAG_RECEIVER_REGISTERED_ONLY
                    | Intent.FLAG_RECEIVER_FOREGROUND), 0,
                    UserHandle.ALL);
    //DATE_CHANGED广播
    Intent intent = new Intent(Intent.ACTION_DATE_CHANGED);
    intent.addFlags(Intent.FLAG_RECEIVER_REPLACE_PENDING);
    mDateChangeSender = PendingIntent.getBroadcastAsUser(getContext(), 0, intent,
            Intent.FLAG_RECEIVER_REGISTERED_ONLY_BEFORE_BOOT, UserHandle.ALL);
            
    //【见小节2.5】
    mClockReceiver = new ClockReceiver();
    //首次调度一次，后面每分钟执行一次【见小节2.6】
    mClockReceiver.scheduleTimeTickEvent();
    //日期改变的广播，流程同上
    mClockReceiver.scheduleDateChangedEvent();
    
    //用于监听亮屏/灭屏广播
    mInteractiveStateReceiver = new InteractiveStateReceiver();
    //用于监听package移除/重启，sdcard不可用的广播
    mUninstallReceiver = new UninstallReceiver();
    
    if (mNativeData != 0) {
        //创建"AlarmManager"【见小节2.8】
        AlarmThread waitThread = new AlarmThread();
        waitThread.start();
    } 
    //发布alarm服务
    publishBinderService(Context.ALARM_SERVICE, mService);
}

static jlong android_server_AlarmManagerService_init(JNIEnv*, jobject)
{
    jlong ret = init_alarm_driver(); //【2.4.1】
    if (ret) {
        return ret;
    }
    return init_timerfd(); //【2.4.2】
}

static jlong init_alarm_driver()
{
    int fd = open("/dev/alarm", O_RDWR);
    //创建Alarm驱动对象
    AlarmImpl *ret = new AlarmImplAlarmDriver(fd);
    return reinterpret_cast<jlong>(ret);
}

static jlong init_timerfd()
{
    int epollfd;
    int fds[N_ANDROID_TIMERFDS];

    epollfd = epoll_create(N_ANDROID_TIMERFDS);
    for (size_t i = 0; i < N_ANDROID_TIMERFDS; i++) {
        fds[i] = timerfd_create(android_alarm_to_clockid[i], 0);
        
    }

    //创建AlarmImplTimerFd对象
    AlarmImpl *ret = new AlarmImplTimerFd(fds, epollfd, wall_clock_rtc());
    for (size_t i = 0; i < N_ANDROID_TIMERFDS; i++) {
        epoll_event event;
        event.events = EPOLLIN | EPOLLWAKEUP;
        event.data.u32 = i;

        int err = epoll_ctl(epollfd, EPOLL_CTL_ADD, fds[i], &event);
        ...
    }

    struct itimerspec spec;
    memset(&spec, 0, sizeof(spec));

    int err = timerfd_settime(fds[ANDROID_ALARM_TYPE_COUNT],
            TFD_TIMER_ABSTIME | TFD_TIMER_CANCEL_ON_SET, &spec, NULL);
    ...

    return reinterpret_cast<jlong>(ret);
}

android_alarm_to_clockid[N_ANDROID_TIMERFDS] = {
    CLOCK_REALTIME_ALARM,
    CLOCK_REALTIME,
    CLOCK_BOOTTIME_ALARM,
    CLOCK_BOOTTIME,
    CLOCK_MONOTONIC,
    CLOCK_REALTIME,
};

class ClockReceiver extends BroadcastReceiver {
    public ClockReceiver() {
        IntentFilter filter = new IntentFilter();
        filter.addAction(Intent.ACTION_TIME_TICK);
        filter.addAction(Intent.ACTION_DATE_CHANGED);
        getContext().registerReceiver(this, filter);
    }
    ...
}

public void scheduleTimeTickEvent() {
    final long currentTime = System.currentTimeMillis();
    final long nextTime = 60000 * ((currentTime / 60000) + 1);
    //距离下一分钟的时间戳
    final long tickEventDelay = nextTime - currentTime;

    final WorkSource workSource = null
    //【见小节2.7】
    setImpl(ELAPSED_REALTIME, SystemClock.elapsedRealtime() + tickEventDelay, 0,
            0, mTimeTickSender, AlarmManager.FLAG_STANDALONE, workSource, null,
            Process.myUid());
}

void setImpl(int type, long triggerAtTime, long windowLength, long interval,
         PendingIntent operation, int flags, WorkSource workSource,
         AlarmManager.AlarmClockInfo alarmClock, int callingUid) {
      ...
     final long nowElapsed = SystemClock.elapsedRealtime();
     //获取闹钟触发的时间点
     final long nominalTrigger = convertToElapsed(triggerAtTime, type);
     final long minTrigger = nowElapsed + mConstants.MIN_FUTURITY;
     //保证alarm时间至少是在5s之后发生
     final long triggerElapsed = (nominalTrigger > minTrigger) ? nominalTrigger : minTrigger;

     final long maxElapsed;
     if (windowLength == AlarmManager.WINDOW_EXACT) {
         maxElapsed = triggerElapsed;
     } else if (windowLength < 0) {
         maxElapsed = maxTriggerTime(nowElapsed, triggerElapsed, interval);
         windowLength = maxElapsed - triggerElapsed;
     } else {
         maxElapsed = triggerElapsed + windowLength;
     }

     synchronized (mLock) {
         //【见小节2.7.1】
         setImplLocked(type, triggerAtTime, triggerElapsed, windowLength, maxElapsed,
                 interval, operation, flags, true, workSource, alarmClock, callingUid);
     }
 }

private void setImplLocked(int type, long when, long whenElapsed, long windowLength,
        long maxWhen, long interval, PendingIntent operation, int flags,
        boolean doValidate, WorkSource workSource, AlarmManager.AlarmClockInfo alarmClock,
        int uid) {
    //创建Alarm对象
    Alarm a = new Alarm(type, when, whenElapsed, windowLength, maxWhen, interval,
            operation, workSource, flags, alarmClock, uid);
    removeLocked(operation);
    //【见小节2.7.2】
    setImplLocked(a, false, doValidate);
}

private void setImplLocked(Alarm a, boolean rebatching, boolean doValidate) {
    if ((a.flags&AlarmManager.FLAG_IDLE_UNTIL) != 0) {
        if (mNextWakeFromIdle != null && a.whenElapsed > mNextWakeFromIdle.whenElapsed) {
            a.when = a.whenElapsed = a.maxWhenElapsed = mNextWakeFromIdle.whenElapsed;
        }
        //增加模糊事件，让alarm比实际预期事件更早的执行
        final long nowElapsed = SystemClock.elapsedRealtime();
        final int fuzz = fuzzForDuration(a.whenElapsed-nowElapsed);
        if (fuzz > 0) {
            if (mRandom == null) {
                mRandom = new Random();
            }
            //创建随机模糊时间
            final int delta = mRandom.nextInt(fuzz);
            a.whenElapsed -= delta;
            a.when = a.maxWhenElapsed = a.whenElapsed;
        }

    } else if (mPendingIdleUntil != null) {
        if ((a.flags&(AlarmManager.FLAG_ALLOW_WHILE_IDLE
                | AlarmManager.FLAG_ALLOW_WHILE_IDLE_UNRESTRICTED
                | AlarmManager.FLAG_WAKE_FROM_IDLE))
                == 0) {
            mPendingWhileIdleAlarms.add(a);
            return;
        }
    }

    int whichBatch = ((a.flags&AlarmManager.FLAG_STANDALONE) != 0)
            ? -1 : attemptCoalesceLocked(a.whenElapsed, a.maxWhenElapsed);
    if (whichBatch < 0) {
        //TIME_TICK是独立的，不与其他alarm一起批处理
        Batch batch = new Batch(a);
        addBatchLocked(mAlarmBatches, batch);
    } else {
        ...
    }
    ...

    boolean needRebatch = false;

    if ((a.flags&AlarmManager.FLAG_IDLE_UNTIL) != 0) {
        mPendingIdleUntil = a;
        mConstants.updateAllowWhileIdleMinTimeLocked();
        needRebatch = true;
    } else if ((a.flags&AlarmManager.FLAG_WAKE_FROM_IDLE) != 0) {
        if (mNextWakeFromIdle == null || mNextWakeFromIdle.whenElapsed > a.whenElapsed) {
            mNextWakeFromIdle = a;
            if (mPendingIdleUntil != null) {
                needRebatch = true;
            }
        }
    }

    if (!rebatching) {
        if (needRebatch) {
            //需要对所有alarm重新执行批处理
            rebatchAllAlarmsLocked(false);
        }

        rescheduleKernelAlarmsLocked();
        //重新计算下一个alarm
        updateNextAlarmClockLocked();
    }
}

private class AlarmThread extends Thread
{
    public AlarmThread()
    {
        super("AlarmManager");
    }
    
    public void run()
    {
        ArrayList<Alarm> triggerList = new ArrayList<Alarm>();
        while (true)
        {
            //[见小节2.8.1]
            int result = waitForAlarm(mNativeData);
            triggerList.clear();

            final long nowRTC = System.currentTimeMillis();
            final long nowELAPSED = SystemClock.elapsedRealtime();

            if ((result & TIME_CHANGED_MASK) != 0) {
                ...
            }

            if (result != TIME_CHANGED_MASK) {
                synchronized (mLock) {
                    boolean hasWakeup = triggerAlarmsLocked(triggerList, nowELAPSED, nowRTC);
                    if (!hasWakeup && checkAllowNonWakeupDelayLocked(nowELAPSED)) {
                        if (mPendingNonWakeupAlarms.size() == 0) {
                            mStartCurrentDelayTime = nowELAPSED;
                            mNextNonWakeupDeliveryTime = nowELAPSED
                                    + ((currentNonWakeupFuzzLocked(nowELAPSED)*3)/2);
                        }
                        mPendingNonWakeupAlarms.addAll(triggerList);
                        mNumDelayedAlarms += triggerList.size();
                        rescheduleKernelAlarmsLocked();
                        updateNextAlarmClockLocked();
                    } else {
                        rescheduleKernelAlarmsLocked();
                        updateNextAlarmClockLocked();
                        if (mPendingNonWakeupAlarms.size() > 0) {
                            calculateDeliveryPriorities(mPendingNonWakeupAlarms);
                            triggerList.addAll(mPendingNonWakeupAlarms);
                            Collections.sort(triggerList, mAlarmDispatchComparator);
                            final long thisDelayTime = nowELAPSED - mStartCurrentDelayTime;
                            mTotalDelayTime += thisDelayTime;
                            if (mMaxDelayTime < thisDelayTime) {
                                mMaxDelayTime = thisDelayTime;
                            }
                            mPendingNonWakeupAlarms.clear();
                        }
                        //分发Alarm事件.[见小节4.1]
                        deliverAlarmsLocked(triggerList, nowELAPSED);
                    }
                }
            }
        }
    }
}

int AlarmImplTimerFd::waitForAlarm()
{
    epoll_event events[N_ANDROID_TIMERFDS];

    int nevents = epoll_wait(epollfd, events, N_ANDROID_TIMERFDS, -1);
    if (nevents < 0) {
        return nevents;
    }

    int result = 0;
    for (int i = 0; i < nevents; i++) {
        uint32_t alarm_idx = events[i].data.u32;
        uint64_t unused;
        ssize_t err = read(fds[alarm_idx], &unused, sizeof(unused));
        if (err < 0) {
            if (alarm_idx == ANDROID_ALARM_TYPE_COUNT && errno == ECANCELED) {
                result |= ANDROID_ALARM_TIME_CHANGE_MASK;
            } else {
                return err;
            }
        } else {
            result |= (1 << alarm_idx);
        }
    }

    return result;
}

//【见小节3.1】
PendingIntent pi = PendingIntent.getBroadcast(mContext, 0, new Intent(ACTION_JOB_EXPIRED), 0);
AlarmManager alarmManager=(AlarmManager)getSystemService(Service.ALARM_SERVICE); 
//[见小节3.3]
alarmManager.set(AlarmManager.ELAPSED_REALTIME, SystemClock.elapsedRealtime(), pi);  

PendingIntent.getActivity
PendingIntent.getService
PendingIntent.getBroadcastAsUser

public static PendingIntent getBroadcastAsUser(Context context, int requestCode,
        Intent intent, int flags, UserHandle userHandle) {
    String packageName = context.getPackageName();
    String resolvedType = intent != null ? intent.resolveTypeIfNeeded(
            context.getContentResolver()) : null;
    try {
        intent.prepareToLeaveProcess();
        IIntentSender target =
            ActivityManagerNative.getDefault().getIntentSender(
                ActivityManager.INTENT_SENDER_BROADCAST, packageName,
                null, null, requestCode, new Intent[] { intent },
                resolvedType != null ? new String[] { resolvedType } : null,
                flags, null, userHandle.getIdentifier());
        return target != null ? new PendingIntent(target) : null;
    } catch (RemoteException e) {
    }
    return null;
}

public static PendingIntent getActivityAsUser(Context context, int requestCode,
        Intent intent, int flags, Bundle options, UserHandle user) {
    String packageName = context.getPackageName();
    String resolvedType = intent != null ? intent.resolveTypeIfNeeded(
            context.getContentResolver()) : null;
    try {
        intent.migrateExtraStreamToClipData();
        intent.prepareToLeaveProcess();
        //[见小节3.1.4]
        IIntentSender target =
            ActivityManagerNative.getDefault().getIntentSender(
                ActivityManager.INTENT_SENDER_ACTIVITY, packageName,
                null, null, requestCode, new Intent[] { intent },
                resolvedType != null ? new String[] { resolvedType } : null,
                flags, options, user.getIdentifier());
        return target != null ? new PendingIntent(target) : null;
    } catch (RemoteException e) {
    }
    return null;
}

public static PendingIntent getService(Context context, int requestCode,
         Intent intent,  int flags) {
    String packageName = context.getPackageName();
    String resolvedType = intent != null ? intent.resolveTypeIfNeeded(
            context.getContentResolver()) : null;
    try {
        intent.prepareToLeaveProcess();
        IIntentSender target =
            ActivityManagerNative.getDefault().getIntentSender(
                ActivityManager.INTENT_SENDER_SERVICE, packageName,
                null, null, requestCode, new Intent[] { intent },
                resolvedType != null ? new String[] { resolvedType } : null,
                flags, null, UserHandle.myUserId());
        return target != null ? new PendingIntent(target) : null;
    } catch (RemoteException e) {
    }
    return null;
}

public IIntentSender getIntentSender(int type,
        String packageName, IBinder token, String resultWho,
        int requestCode, Intent[] intents, String[] resolvedTypes,
        int flags, Bundle options, int userId) {
    //重新拷贝一次intent对象内容
    if (intents != null) {
        for (int i=0; i<intents.length; i++) {
            Intent intent = intents[i];
            if (intent != null) {
                intents[i] = new Intent(intent);
            }
        }
    }
    ...
    
    synchronized(this) {
        int callingUid = Binder.getCallingUid();
        int origUserId = userId;
        userId = handleIncomingUser(Binder.getCallingPid(), callingUid, userId,
                type == ActivityManager.INTENT_SENDER_BROADCAST,
                ALLOW_NON_FULL, "getIntentSender", null);
        if (origUserId == UserHandle.USER_CURRENT) {
            userId = UserHandle.USER_CURRENT;
        }
        //【见小节3.1.5】
        return getIntentSenderLocked(type, packageName, callingUid, userId,
              token, resultWho, requestCode, intents, resolvedTypes, flags, options);
    }
}

IIntentSender getIntentSenderLocked(int type, String packageName,
        int callingUid, int userId, IBinder token, String resultWho,
        int requestCode, Intent[] intents, String[] resolvedTypes, int flags,
        Bundle options) {
    ActivityRecord activity = null;
    ...
    //创建Key对象
    PendingIntentRecord.Key key = new PendingIntentRecord.Key(
            type, packageName, activity, resultWho,
            requestCode, intents, resolvedTypes, flags, options, userId);
    WeakReference<PendingIntentRecord> ref;
    ref = mIntentSenderRecords.get(key);
    PendingIntentRecord rec = ref != null ? ref.get() : null;
    if (rec != null) {
        if (!cancelCurrent) {
            if (updateCurrent) {
                if (rec.key.requestIntent != null) {
                    rec.key.requestIntent.replaceExtras(intents != null ?
                            intents[intents.length - 1] : null);
                }
                if (intents != null) {
                    intents[intents.length-1] = rec.key.requestIntent;
                    rec.key.allIntents = intents;
                    rec.key.allResolvedTypes = resolvedTypes;
                } else {
                    rec.key.allIntents = null;
                    rec.key.allResolvedTypes = null;
                }
            }
            return rec;
        }
        rec.canceled = true;
        mIntentSenderRecords.remove(key);
    }
    if (noCreate) {
        return rec;
    }
    //创建PendingIntentRecord对象
    rec = new PendingIntentRecord(this, key, callingUid);
    mIntentSenderRecords.put(key, rec.ref);
    ...
    return rec;
}

registerService(Context.ALARM_SERVICE, AlarmManager.class,
        new CachedServiceFetcher<AlarmManager>() {

    public AlarmManager createService(ContextImpl ctx) {
        IBinder b = ServiceManager.getService(Context.ALARM_SERVICE);
        IAlarmManager service = IAlarmManager.Stub.asInterface(b);
        return new AlarmManager(service, ctx);
    }});

AlarmManager(IAlarmManager service, Context ctx) {
    mService = service; //ALMS的binder代理端
    mPackageName = ctx.getPackageName();
    mTargetSdkVersion = ctx.getApplicationInfo().targetSdkVersion;
    mAlwaysExact = (mTargetSdkVersion < Build.VERSION_CODES.KITKAT);
    mMainThreadHandler = new Handler(ctx.getMainLooper());
}

public void set(int type, long triggerAtMillis, PendingIntent operation) {
    //[见小节3.4]
    setImpl(type, triggerAtMillis, legacyExactLength(), 0, 0, operation, null, null,
        null, null, null);
}

private void setImpl(int type, long triggerAtMillis, long windowMillis, long intervalMillis,
        int flags, PendingIntent operation, final OnAlarmListener listener, String listenerTag,
        Handler targetHandler, WorkSource workSource, AlarmClockInfo alarmClock) {
    ListenerWrapper recipientWrapper = null;
    if (listener != null) {
        synchronized (AlarmManager.class) {
            if (sWrappers == null) {
                sWrappers = new ArrayMap<OnAlarmListener, ListenerWrapper>();
            }

            recipientWrapper = sWrappers.get(listener);
            if (recipientWrapper == null) {
                recipientWrapper = new ListenerWrapper(listener);
                sWrappers.put(listener, recipientWrapper);
            }
        }
        //当没有设置handler对象时,则采用当前进程的主线程handler
        final Handler handler = (targetHandler != null) ? targetHandler : mMainThreadHandler;
        recipientWrapper.setHandler(handler);
    }
    //【见小节2.7】
    mService.set(mPackageName, type, triggerAtMillis, windowMillis, intervalMillis, flags,
            operation, recipientWrapper, listenerTag, workSource, alarmClock);
}

void deliverAlarmsLocked(ArrayList<Alarm> triggerList, long nowELAPSED) {
    mLastAlarmDeliveryTime = nowELAPSED;
    for (int i=0; i<triggerList.size(); i++) {
        Alarm alarm = triggerList.get(i);
        final boolean allowWhileIdle = (alarm.flags&AlarmManager.FLAG_ALLOW_WHILE_IDLE) != 0;
        try {
            ...
            //[见小节4.2]
            mDeliveryTracker.deliverLocked(alarm, nowELAPSED, allowWhileIdle);
        } catch (RuntimeException e) {
        }
    }
}

public void deliverLocked(Alarm alarm, long nowELAPSED, boolean allowWhileIdle) {
    if (alarm.operation != null) {
        //执行PendingIntent操作[见小节4.3]
        alarm.operation.send(getContext(), 0,
                mBackgroundIntent.putExtra(
                    Intent.EXTRA_ALARM_COUNT, alarm.count),
                    mDeliveryTracker, mHandler, null,
                    allowWhileIdle ? mIdleOptions : null);
    } else {
       //[见小节4.4]
       alarm.listener.doAlarm(this);
       // 5s的超时时长 
       mHandler.sendMessageDelayed(
               mHandler.obtainMessage(AlarmHandler.LISTENER_TIMEOUT,
                       alarm.listener.asBinder()),
               mConstants.LISTENER_TIMEOUT);
    }
    //alarm正在触发
    final InFlight inflight = new InFlight(AlarmManagerService.this,
            alarm.operation, alarm.listener, alarm.workSource, alarm.uid,
            alarm.packageName, alarm.type, alarm.statsTag, nowELAPSED);
    mInFlight.add(inflight);
    mBroadcastRefCount++;
    qcNsrmExt.addTriggeredUid((alarm.operation != null) ?
                            alarm.operation.getCreatorUid() :
                            alarm.uid);
    ...
}

public void send(Context context, int code, @Nullable Intent intent,
        @Nullable OnFinished onFinished, @Nullable Handler handler,
        @Nullable String requiredPermission, @Nullable Bundle options)
        throws CanceledException {
    try {
        String resolvedType = intent != null ?
                intent.resolveTypeIfNeeded(context.getContentResolver())
                : null;
        int res = mTarget.send(code, intent, resolvedType,
                onFinished != null
                        ? new FinishedDispatcher(this, onFinished, handler)
                        : null,
                requiredPermission, options);
        ...
    } catch (RemoteException e) {
        throw new CanceledException(e);
    }
}

public int send(int code, Intent intent, String resolvedType, IIntentReceiver finishedReceiver,
        String requiredPermission, Bundle options) throws TransactionTooLargeException {
    return sendInner(code, intent, resolvedType, finishedReceiver,
            requiredPermission, null, null, 0, 0, 0, options, null);
}

int sendInner(int code, Intent intent, String resolvedType, IIntentReceiver finishedReceiver,
        String requiredPermission, IBinder resultTo, String resultWho, int requestCode,
        int flagsMask, int flagsValues, Bundle options, IActivityContainer container)
        throws TransactionTooLargeException {
    synchronized(owner) {
            ...
            final long origId = Binder.clearCallingIdentity();

            boolean sendFinish = finishedReceiver != null;
            int userId = key.userId;
            if (userId == UserHandle.USER_CURRENT) {
                userId = owner.getCurrentUserIdLocked();
            }
            switch (key.type) {
                case ActivityManager.INTENT_SENDER_ACTIVITY:
                    ...
                    if (key.allIntents != null && key.allIntents.length > 1) {
                        Intent[] allIntents = new Intent[key.allIntents.length];
                        String[] allResolvedTypes = new String[key.allIntents.length];
                        System.arraycopy(key.allIntents, 0, allIntents, 0,
                                key.allIntents.length);
                        if (key.allResolvedTypes != null) {
                            System.arraycopy(key.allResolvedTypes, 0, allResolvedTypes, 0,
                                    key.allResolvedTypes.length);
                        }
                        allIntents[allIntents.length-1] = finalIntent;
                        allResolvedTypes[allResolvedTypes.length-1] = resolvedType;
                        //核心方法
                        owner.startActivitiesInPackage(uid, key.packageName, allIntents,
                                allResolvedTypes, resultTo, options, userId);
                    } else {
                        owner.startActivityInPackage(uid, key.packageName, finalIntent,
                                resolvedType, resultTo, resultWho, requestCode, 0,
                                options, userId, container, null);
                    }
                    break;
                case ActivityManager.INTENT_SENDER_ACTIVITY_RESULT:
                    if (key.activity.task.stack != null) {
                        //核心方法
                        key.activity.task.stack.sendActivityResultLocked(-1, key.activity,
                                key.who, key.requestCode, code, finalIntent);
                    }
                    break;
                case ActivityManager.INTENT_SENDER_BROADCAST:
                    //核心方法
                    int sent = owner.broadcastIntentInPackage(key.packageName, uid,
                            finalIntent, resolvedType, finishedReceiver, code, null, null,
                            requiredPermission, options, (finishedReceiver != null),
                            false, userId);
                    if (sent == ActivityManager.BROADCAST_SUCCESS) {
                        sendFinish = false;
                    }

                    break;
                case ActivityManager.INTENT_SENDER_SERVICE:
                    //核心方法
                    owner.startServiceInPackage(uid, finalIntent,
                            resolvedType, key.packageName, userId);
                    break;
            }

            if (sendFinish) {
                finishedReceiver.performReceive(new Intent(finalIntent), 0,
                        null, null, false, false, key.userId);
            }
            Binder.restoreCallingIdentity(origId);
            return 0;
        }
    }
    return ActivityManager.START_CANCELED;
}

 final class ListenerWrapper extends IAlarmListener.Stub implements Runnable {
     final OnAlarmListener mListener;
     Handler mHandler;
     IAlarmCompleteListener mCompletion;

     public ListenerWrapper(OnAlarmListener listener) {
         mListener = listener;
     }

     //执行alarm操作[见小节4.4.1]
     public void doAlarm(IAlarmCompleteListener alarmManager) {
         mCompletion = alarmManager;
         mHandler.post(this);
     }
 }

final class ListenerWrapper extends IAlarmListener.Stub implements Runnable {
    
    public void run() {
        //从wrapper的缓存中移除该listener, 由于服务端已经认为它不存在
        synchronized (AlarmManager.class) {
            if (sWrappers != null) {
                sWrappers.remove(mListener);
            }
        }

        
        try {
            //分发目标监听者的onAlarm[4.4.2]
            mListener.onAlarm();
        } finally {
            mCompletion.alarmComplete(this);
        }
    }
}

private void setDelayExpiredAlarmLocked(long alarmTimeElapsedMillis, int uid) {
    alarmTimeElapsedMillis = maybeAdjustAlarmTime(alarmTimeElapsedMillis);
    mNextDelayExpiredElapsedMillis = alarmTimeElapsedMillis;
    //将mNextDelayExpiredListener设置到alarm的回调过程
    updateAlarmWithListenerLocked(DELAY_TAG, mNextDelayExpiredListener,
            mNextDelayExpiredElapsedMillis, uid);
}

private void updateAlarmWithListenerLocked(String tag, OnAlarmListener listener,
        long alarmTimeElapsed, int uid) {
    ensureAlarmServiceLocked();
    if (alarmTimeElapsed == Long.MAX_VALUE) {
        ...
    } else {
        mAlarmService.set(AlarmManager.ELAPSED_REALTIME_WAKEUP, alarmTimeElapsed,
                AlarmManager.WINDOW_HEURISTIC, 0, tag, listener, null, new WorkSource(uid));
    }
}


private final OnAlarmListener mNextDelayExpiredListener = new OnAlarmListener() {
    @Override
    public void onAlarm() {
        checkExpiredDelaysAndResetAlarm();
    }
};

set(int type，long startTime，PendingIntent pi)，//设置一次闹钟
setRepeating(int type，long startTime，long intervalTime，PendingIntent pi)，//设置重复闹钟
setInexactRepeating（int type，long startTime，long intervalTime，PendingIntent pi），//设置重复闹钟,但不准确

public class PathClassLoader extends BaseDexClassLoader {

    public PathClassLoader(String dexPath, ClassLoader parent) {
        super(dexPath, null, null, parent);
    }

    public PathClassLoader(String dexPath, String libraryPath,
            ClassLoader parent) {
        super(dexPath, null, libraryPath, parent);
    }
}

public class DexClassLoader extends BaseDexClassLoader {

    public DexClassLoader(String dexPath, String optimizedDirectory,
            String libraryPath, ClassLoader parent) {
        super(dexPath, new File(optimizedDirectory), libraryPath, parent);
    }
}

public class BaseDexClassLoader extends ClassLoader {
    private final DexPathList pathList;

    public BaseDexClassLoader(String dexPath, File optimizedDirectory,
        String libraryPath, ClassLoader parent) {
        super(parent);
        //[见小节2.3.1]
        this.pathList = new DexPathList(this, dexPath, libraryPath, optimizedDirectory);
    }
}

public DexPathList(ClassLoader definingContext, String dexPath,
        String libraryPath, File optimizedDirectory) {
    ...
    this.definingContext = definingContext;

    ArrayList<IOException> suppressedExceptions = new ArrayList<IOException>();
    //记录所有的dexFile文件
    this.dexElements = makePathElements(splitDexPath(dexPath), optimizedDirectory, suppressedExceptions);

    //app目录的native库
    this.nativeLibraryDirectories = splitPaths(libraryPath, false);
    //系统目录的native库
    this.systemNativeLibraryDirectories = splitPaths(System.getProperty("java.library.path"), true);
    List<File> allNativeLibraryDirectories = new ArrayList<>(nativeLibraryDirectories);
    allNativeLibraryDirectories.addAll(systemNativeLibraryDirectories);
    //记录所有的Native动态库
    this.nativeLibraryPathElements = makePathElements(allNativeLibraryDirectories, null,
                                                      suppressedExceptions);
    ...
}

class BootClassLoader extends ClassLoader {
    private static BootClassLoader instance;

    public static synchronized BootClassLoader getInstance() {
        if (instance == null) {
            instance = new BootClassLoader();
        }

        return instance;
    }

    public BootClassLoader() {
        super(null, true);
    } }

public abstract class ClassLoader {
    private ClassLoader parent;

    protected ClassLoader() {
        //[见小节2.5.1]
        this(getSystemClassLoader(), false);
    }

    protected ClassLoader(ClassLoader parentLoader) {
        this(parentLoader, false);
    }

    ClassLoader(ClassLoader parentLoader, boolean nullAllowed) {
        if (parentLoader == null && !nullAllowed) {
            //父类的类加载器为空,则抛出异常
            throw new NullPointerException("parentLoader == null && !nullAllowed");
        }
        parent = parentLoader;
    }
}

public abstract class ClassLoader {

    static private class SystemClassLoader {
        public static ClassLoader loader = ClassLoader.createSystemClassLoader();
    }

    public static ClassLoader getSystemClassLoader() {
        return SystemClassLoader.loader;
    }

    private static ClassLoader createSystemClassLoader() {
        String classPath = System.getProperty("java.class.path", ".");
        return new PathClassLoader(classPath, BootClassLoader.getInstance());
    }
}

public abstract class ClassLoader {

    public Class<?> loadClass(String className) throws ClassNotFoundException {
        return loadClass(className, false);
    }

    protected Class<?> loadClass(String className, boolean resolve) throws ClassNotFoundException {
        Class<?> clazz = findLoadedClass(className);

        if (clazz == null) {
            ClassNotFoundException suppressed = null;
            try {
                clazz = parent.loadClass(className, false);
            } catch (ClassNotFoundException e) {
                suppressed = e;
            }

            if (clazz == null) {
                try {
                    //[见小节3.2]
                    clazz = findClass(className);
                } catch (ClassNotFoundException e) {
                    e.addSuppressed(suppressed);
                    throw e;
                }
            }
        }

        return clazz;
    }
}

public class BaseDexClassLoader extends ClassLoader {
    protected Class<?> findClass(String name) throws ClassNotFoundException {
        List<Throwable> suppressedExceptions = new ArrayList<Throwable>();
        //[见小节3.3]
        Class c = pathList.findClass(name, suppressedExceptions);
        ...
        return c;
    }
}

final class DexPathList {
    public Class findClass(String name, List<Throwable> suppressed) {
        for (Element element : dexElements) {
            DexFile dex = element.dexFile;

            if (dex != null) {
                //[见小节3.4]
                Class clazz = dex.loadClassBinaryName(name, definingContext, suppressed);
                if (clazz != null) {
                    return clazz;
                }
            }
        }
        if (dexElementsSuppressedExceptions != null) {
            suppressed.addAll(Arrays.asList(dexElementsSuppressedExceptions));
        }
        return null;
    }
}

public final class DexFile {

    public Class loadClassBinaryName(String name, ClassLoader loader, List<Throwable> suppressed) {
        return defineClass(name, loader, mCookie, suppressed);
    }

    private static Class defineClass(String name, ClassLoader loader, Object cookie,
                                     List<Throwable> suppressed) {
        Class result = null;
        try {
            result = defineClassNative(name, loader, cookie);
        } catch (NoClassDefFoundError e) {
            if (suppressed != null) {
                suppressed.add(e);
            }
        } catch (ClassNotFoundException e) {
            if (suppressed != null) {
                suppressed.add(e);
            }
        }
        return result;
    }
}

static jclass DexFile_defineClassNative(JNIEnv* env, jclass, jstring javaName, jobject javaLoader,
                                        jobject cookie) {
  std::unique_ptr<std::vector<const DexFile*>> dex_files = ConvertJavaArrayToNative(env, cookie);
  if (dex_files.get() == nullptr) {
    return nullptr; //dex文件为空, 则直接返回
  }

  ScopedUtfChars class_name(env, javaName);
  if (class_name.c_str() == nullptr) {
    return nullptr; //类名为空, 则直接返回
  }

  const std::string descriptor(DotToDescriptor(class_name.c_str()));
  const size_t hash(ComputeModifiedUtf8Hash(descriptor.c_str())); //将类名转换为hash码
  for (auto& dex_file : *dex_files) {
    const DexFile::ClassDef* dex_class_def = dex_file->FindClassDef(descriptor.c_str(), hash);
    if (dex_class_def != nullptr) {
      ScopedObjectAccess soa(env);
      ClassLinker* class_linker = Runtime::Current()->GetClassLinker();
      class_linker->RegisterDexFile(*dex_file);
      StackHandleScope<1> hs(soa.Self());
      Handle<mirror::ClassLoader> class_loader(
          hs.NewHandle(soa.Decode<mirror::ClassLoader*>(javaLoader)));
      //获取目标类
      mirror::Class* result = class_linker->DefineClass(soa.Self(), descriptor.c_str(), hash,
                                                        class_loader, *dex_file, *dex_class_def);
      if (result != nullptr) {
        // 找到目标对象
        return soa.AddLocalReference<jclass>(result);
      }
    }
  }
  return nullptr; //没有找到目标类
}

libcore/luni/src/main/java/java/lang/System.java
libcore/luni/src/main/java/java/lang/Runtime.java
libcore/luni/src/main/native/java_lang_System.cpp
bionic/linker/linker.cpp
art/runtime/native/java_lang_Runtime.cc
art/runtime/java_vm_ext.cc

void *dlopen(const char * pathname,int mode);  //打开动态库  
void *dlsym(void *handle,const char *name);  //获取动态库对象地址  
char *dlerror(vid);   //错误检测  
int dlclose(void * handle); //关闭动态库  

System.loadLibrary("gityuan_jni");

public static void loadLibrary(String libName) {
    Runtime.getRuntime().loadLibrary(libName, VMStack.getCallingClassLoader());
}

void loadLibrary(String libraryName, ClassLoader loader) {
    if (loader != null) {
        //[见小节2.4]
        String filename = loader.findLibrary(libraryName);
        if (filename == null) {
            throw new UnsatisfiedLinkError(...);
        }
        //成功执行完doLoad,则返回.[见小节2.5]
        String error = doLoad(filename, loader);
        if (error != null) {
            throw new UnsatisfiedLinkError(error);
        }
        return;
    }
    //当loader为空的情况下执行[见2.3]
    String filename = System.mapLibraryName(libraryName);
    List<String> candidates = new ArrayList<String>();
    String lastError = null;

    //此处的mLibPaths取值 [见小节三]
    for (String directory : mLibPaths) {
        String candidate = directory + filename;
        candidates.add(candidate);

        if (IoUtils.canOpenReadOnly(candidate)) {
            String error = doLoad(candidate, loader);
            if (error == null) {
                return; //成功执行完doLoad,则返回.
            }
            lastError = error;
        }
    }

    if (lastError != null) {
        throw new UnsatisfiedLinkError(lastError);
    }
    throw new UnsatisfiedLinkError("Library " + libraryName + " not found; tried " + candidates);
}

public static String mapLibraryName(String nickname) {
    if (nickname == null) {
        throw new NullPointerException("nickname == null");
    }
    return "lib" + nickname + ".so";
}

public class BaseDexClassLoader extends ClassLoader {
    private final DexPathList pathList;

    public BaseDexClassLoader(String dexPath, File optimizedDirectory,
            String libraryPath, ClassLoader parent) {
        super(parent);
        //dexPath一般是指apk所在路径
        this.pathList = new DexPathList(this, dexPath, libraryPath, optimizedDirectory);
    }

    public String findLibrary(String name) {
        return pathList.findLibrary(name); //[见小节2.4.3]
    }
}

public DexPathList(ClassLoader definingContext, String dexPath,
        String libraryPath, File optimizedDirectory) {
    ...
    this.definingContext = definingContext;

    ArrayList<IOException> suppressedExceptions = new ArrayList<IOException>();
    //记录所有的dexFile文件
    this.dexElements = makePathElements(splitDexPath(dexPath), optimizedDirectory, suppressedExceptions);

    //app目录的native库
    this.nativeLibraryDirectories = splitPaths(libraryPath, false);
    //系统目录的native库
    this.systemNativeLibraryDirectories = splitPaths(System.getProperty("java.library.path"), true);
    List<File> allNativeLibraryDirectories = new ArrayList<>(nativeLibraryDirectories);
    allNativeLibraryDirectories.addAll(systemNativeLibraryDirectories);
    //记录所有的Native动态库
    this.nativeLibraryPathElements = makePathElements(allNativeLibraryDirectories, null,
                                                      suppressedExceptions);
    ...
}

public String findLibrary(String libraryName) {
    String fileName = System.mapLibraryName(libraryName);

    for (Element element : nativeLibraryPathElements) {
        //[见小节2.4.4]
        String path = element.findNativeLibrary(fileName);
        if (path != null) {
            return path;
        }
    }
    return null;
}

final class DexPathList {
    static class Element {

        public String findNativeLibrary(String name) {
            maybeInit();
            if (isDirectory) {
                String path = new File(dir, name).getPath();
                if (IoUtils.canOpenReadOnly(path)) {
                    return path;
                }
            } else if (zipFile != null) {
                String entryName = new File(dir, name).getPath();
                if (isZipEntryExistsAndStored(zipFile, entryName)) {
                  return zip.getPath() + zipSeparator + entryName;
                }
            }
            return null;
        }
    }
}

private String doLoad(String name, ClassLoader loader) {
    String ldLibraryPath = null;
    String dexPath = null;
    if (loader == null) {
        ldLibraryPath = System.getProperty("java.library.path");
    } else if (loader instanceof BaseDexClassLoader) {
        BaseDexClassLoader dexClassLoader = (BaseDexClassLoader) loader;
        ldLibraryPath = dexClassLoader.getLdLibraryPath();
    }
    synchronized (this) {
        //[见小节2.5.1]
        return nativeLoad(name, loader, ldLibraryPath);
    }
}

static jstring Runtime_nativeLoad(JNIEnv* env, jclass, jstring javaFilename, jobject javaLoader,
                                  jstring javaLdLibraryPathJstr) {
  ScopedUtfChars filename(env, javaFilename);
  if (filename.c_str() == nullptr) {
    return nullptr;
  }

  SetLdLibraryPath(env, javaLdLibraryPathJstr);

  std::string error_msg;
  {
    JavaVMExt* vm = Runtime::Current()->GetJavaVM();
    //[见小节2.5.2]
    bool success = vm->LoadNativeLibrary(env, filename.c_str(), javaLoader, &error_msg);
    if (success) {
      return nullptr;
    }
  }

  env->ExceptionClear();
  return env->NewStringUTF(error_msg.c_str());
}

bool JavaVMExt::LoadNativeLibrary(JNIEnv* env, const std::string& path, jobject class_loader,
                                  std::string* error_msg) {
  error_msg->clear();

  SharedLibrary* library;
  Thread* self = Thread::Current();
  {
    MutexLock mu(self, *Locks::jni_libraries_lock_);
    library = libraries_->Get(path); //检查该动态库是否已加载
  }
  if (library != nullptr) {
    if (env->IsSameObject(library->GetClassLoader(), class_loader) == JNI_FALSE) {
      //不能加载同一个采用多个不同的ClassLoader
      return false;
    }
    ...
    return true;
  }

  const char* path_str = path.empty() ? nullptr : path.c_str();
  //通过dlopen打开动态共享库.该库不会立刻被卸载直到引用技术为空.
  void* handle = dlopen(path_str, RTLD_NOW);
  bool needs_native_bridge = false;
  if (handle == nullptr) {
    if (android::NativeBridgeIsSupported(path_str)) {
      handle = android::NativeBridgeLoadLibrary(path_str, RTLD_NOW);
      needs_native_bridge = true;
    }
  }

  if (handle == nullptr) {
    *error_msg = dlerror(); //打开失败
    VLOG(jni) << "dlopen(\""<< path << "\", RTLD_NOW) failed: "<< *error_msg;
    return false;
  }


  bool created_library = false;
  {
    std::unique_ptr<SharedLibrary> new_library(
        new SharedLibrary(env, self, path, handle, class_loader));
    MutexLock mu(self, *Locks::jni_libraries_lock_);
    library = libraries_->Get(path);
    if (library == nullptr) {
      library = new_library.release();
      //创建共享库,并添加到列表
      libraries_->Put(path, library);
      created_library = true;
    }
  }
  ...

  bool was_successful = false;
  void* sym;
  //查询JNI_OnLoad符号所对应的方法
  if (needs_native_bridge) {
    library->SetNeedsNativeBridge();
    sym = library->FindSymbolWithNativeBridge("JNI_OnLoad", nullptr);
  } else {
    sym = dlsym(handle, "JNI_OnLoad");
  }

  if (sym == nullptr) {
    was_successful = true;
  } else {
    //需要先覆盖当前ClassLoader.
    ScopedLocalRef<jobject> old_class_loader(env, env->NewLocalRef(self->GetClassLoaderOverride()));
    self->SetClassLoaderOverride(class_loader);

    typedef int (*JNI_OnLoadFn)(JavaVM*, void*);
    JNI_OnLoadFn jni_on_load = reinterpret_cast<JNI_OnLoadFn>(sym);
    // 真正调用JNI_OnLoad()方法的过程
    int version = (*jni_on_load)(this, nullptr);

    if (runtime_->GetTargetSdkVersion() != 0 && runtime_->GetTargetSdkVersion() <= 21) {
      fault_manager.EnsureArtActionInFrontOfSignalChain();
    }
    //执行完成后, 需要恢复到原来的ClassLoader
    self->SetClassLoaderOverride(old_class_loader.get());
    ...
  }

  library->SetResult(was_successful);
  return was_successful;
}

public final class System {
    static {
        ...
        //[见小节3.1]
        unchangeableSystemProperties = initUnchangeableSystemProperties();
        systemProperties = createSystemProperties();
        addLegacyLocaleSystemProperties();
    }
}

private static Properties initUnchangeableSystemProperties() {
    VMRuntime runtime = VMRuntime.getRuntime();
    Properties p = new Properties();
    ...
    p.put("java.boot.class.path", runtime.bootClassPath());
    p.put("java.class.path", runtime.classPath());
    // [见小节3.2]
    parsePropertyAssignments(p, specialProperties());
    ...
    return p;
}

private static void parsePropertyAssignments(Properties p, String[] assignments) {
    for (String assignment : assignments) {
        int split = assignment.indexOf('=');
        String key = assignment.substring(0, split);
        String value = assignment.substring(split + 1);
        p.put(key, value);
    }
}

static jobjectArray System_specialProperties(JNIEnv* env, jclass) {
    std::vector<std::string> properties;
    char path[PATH_MAX];
    ...

    const char* library_path = getenv("LD_LIBRARY_PATH");
    if (library_path == NULL) {
        // [见小节3.3]
        android_get_LD_LIBRARY_PATH(path, sizeof(path));
        library_path = path;
    }
    properties.push_back(std::string("java.library.path=") + library_path);
    return toStringArray(env, properties);
}

void do_android_get_LD_LIBRARY_PATH(char* buffer, size_t buffer_size) {
  //[见小节3.4]
  size_t required_len = strlen(kDefaultLdPaths[0]) + strlen(kDefaultLdPaths[1]) + 2;
  char* end = stpcpy(buffer, kDefaultLdPaths[0]);
  *end = ':';
  strcpy(end + 1, kDefaultLdPaths[1]);
}

static const char* const kDefaultLdPaths[] = {
#if defined(__LP64__)
  "/vendor/lib64",
  "/system/lib64",
#else
  "/vendor/lib",
  "/system/lib",
#endif
  nullptr
};

public final class SystemServer {
    private void run() {
        ...
        createSystemContext(); //[见2.2]
        ...
        startBootstrapServices();
        ...
    }
}

private void createSystemContext() {
    ActivityThread activityThread = ActivityThread.systemMain(); //[见2.3]
    mSystemContext = activityThread.getSystemContext();  //[见2.x]
    ...
}

public static ActivityThread systemMain() {
    ...
    ActivityThread thread = new ActivityThread();  //[见2.4]
    thread.attach(true);  //[见2.5]
    return thread;
}

public final class ActivityThread {
    //创建ApplicationThread对象
    final ApplicationThread mAppThread = new ApplicationThread();
    final Looper mLooper = Looper.myLooper();
    final H mH = new H();
    //当前进程中首次初始化的app对象
    Application mInitialApplication;
    final ArrayList<Application> mAllApplications;
    //标记当前进程是否为system进程
    boolean mSystemThread = false;
    //记录system进程的ContextImpl对象
    private ContextImpl mSystemContext;

    final ArrayMap<String, WeakReference<LoadedApk>> mPackages;
    static Handler sMainThreadHandler;
    private static ActivityThread sCurrentActivityThread;

    ActivityThread() {
        mResourcesManager = ResourcesManager.getInstance();
    }
}

private void attach(boolean system) {
    sCurrentActivityThread = this;
    mSystemThread = system; //设置mSystemThread为true
    if (!system) {
        ...
    } else { //system进程才执行该流程
        //创建Instrumentation
        mInstrumentation = new Instrumentation();
        //[见小节2.6]
        ContextImpl context = ContextImpl.createAppContext(
                this, getSystemContext().mPackageInfo);
        //[见小节2.7]
        mInitialApplication = context.mPackageInfo.makeApplication(true, null);
        mInitialApplication.onCreate();
        ...
    }
}

static ContextImpl createAppContext(ActivityThread mainThread, LoadedApk packageInfo) {
    //[见小节2.6.4]
    return new ContextImpl(null, mainThread,
            packageInfo, null, null, false, null, null, Display.INVALID_DISPLAY);
}

createSystemContext(ActivityThread mainThread)
createAppContext(ActivityThread mainThread, LoadedApk packageInfo)
createApplicationContext(ApplicationInfo application, int flags)
createPackageContext(String packageName, int flags)

public ContextImpl getSystemContext() {
    synchronized (this) {
        if (mSystemContext == null) {
            mSystemContext = ContextImpl.createSystemContext(this);
        }
        return mSystemContext;
    }
}

static ContextImpl createSystemContext(ActivityThread mainThread) {
    //创建LoadedApk对象 【见小节2.6.3】
    LoadedApk packageInfo = new LoadedApk(mainThread);
    // 创建ContextImpl【见小节2.6.4】
    ContextImpl context = new ContextImpl(null, mainThread,
            packageInfo, null, null, false, null, null, Display.INVALID_DISPLAY);
    ...
    return context;
}

public final class LoadedApk {
    private final ActivityThread mActivityThread;
    private ApplicationInfo mApplicationInfo;
    private Application mApplication;
    final String mPackageName;
    private final ClassLoader mBaseClassLoader;
    private ClassLoader mClassLoader;

    LoadedApk(ActivityThread activityThread) {
        mActivityThread = activityThread; //ActivityThread对象
        mApplicationInfo = new ApplicationInfo(); //创建ApplicationInfo对象
        mApplicationInfo.packageName = "android";
        mPackageName = "android";  //默认包名为"android"
        ...
        mBaseClassLoader = null;
        mClassLoader = ClassLoader.getSystemClassLoader(); //创建ClassLoader
        ...
    }
}

class ContextImpl extends Context {
    final ActivityThread mMainThread;
    final LoadedApk mPackageInfo;
    private final IBinder mActivityToken;
    private final String mBasePackageName;
    private Context mOuterContext;
    //缓存Binder服务
    final Object[] mServiceCache = SystemServiceRegistry.createServiceCache();

    private ContextImpl(ContextImpl container, ActivityThread mainThread,
            LoadedApk packageInfo, IBinder activityToken, UserHandle user, boolean restricted,
            Display display, Configuration overrideConfiguration, int createDisplayWithId) {
        mOuterContext = this; //ContextImpl对象
        mMainThread = mainThread; // ActivityThread赋值
        mPackageInfo = packageInfo; // LoadedApk赋值
        mBasePackageName = packageInfo.mPackageName; //mBasePackageName等于“android”
        ...
    }
}

public Application makeApplication(boolean forceDefaultAppClass,
        Instrumentation instrumentation) {
    //保证一个LoadedApk对象只创建一个对应的Application对象
    if (mApplication != null) {
        return mApplication;
    }

    String appClass = mApplicationInfo.className;
    if (forceDefaultAppClass || (appClass == null)) {
        appClass = "android.app.Application"; //system_server进程, 则进入该分支
    }

    //创建ClassLoader对象【见小节2.8】
    java.lang.ClassLoader cl = getClassLoader();
    if (!mPackageName.equals("android")) {
        initializeJavaContextClassLoader();  //[见小节2.9]
    }

    ContextImpl appContext = ContextImpl.createAppContext(mActivityThread, this);
    //创建Application对象[见2.10]
    Application app = mActivityThread.mInstrumentation.newApplication(cl, appClass, appContext);
    appContext.setOuterContext(app);
    ...

    mActivityThread.mAllApplications.add(app);
    mApplication = app; //将刚创建的app赋值给mApplication
    ...
    return app;
}

public ClassLoader getClassLoader() {
    synchronized (this) {
        if (mClassLoader != null) {
            return mClassLoader;
        }

        if (mPackageName.equals("android")) {
            if (mBaseClassLoader == null) {
                //创建Classloader对象
                mClassLoader = ClassLoader.getSystemClassLoader();
            } else {
                mClassLoader = mBaseClassLoader;
            }
            return mClassLoader;
        }

        // 当包名不为"android"的情况
        if (mRegisterPackage) {
            //【见小节2.8.1】
            ActivityManagerNative.getDefault().addPackageDependency(mPackageName);
        }

        zipPaths.add(mAppDir);
        libPaths.add(mLibDir);
        apkPaths.addAll(zipPaths);
        ...

        if (mApplicationInfo.isSystemApp()) {
            isBundledApp = true;
            //对于系统app，则添加vendor/lib, system/lib库
            libPaths.add(System.getProperty("java.library.path"));
            ...
        }

        final String zip = TextUtils.join(File.pathSeparator, zipPaths);

        //获取ClassLoader对象【见小节2.8.2】
        mClassLoader = ApplicationLoaders.getDefault().getClassLoader(zip,
                mApplicationInfo.targetSdkVersion, isBundledApp, librarySearchPath,
                libraryPermittedPath, mBaseClassLoader);
        return mClassLoader;
    }
}

public void addPackageDependency(String packageName) {
    synchronized (this) {
        int callingPid = Binder.getCallingPid();
        if (callingPid == Process.myPid()) {
            return;
        }
        ProcessRecord proc;
        synchronized (mPidsSelfLocked) {
            //查询的进程
            proc = mPidsSelfLocked.get(Binder.getCallingPid());
        }
        if (proc != null) {
            if (proc.pkgDeps == null) {
                proc.pkgDeps = new ArraySet<String>(1);
            }
            //将当前
            proc.pkgDeps.add(packageName);
        }
    }
}

public ClassLoader getClassLoader(String zip, int targetSdkVersion, boolean isBundled,
                              String librarySearchPath, String libraryPermittedPath,
                              ClassLoader parent) {
    //获取父类的类加载器
    ClassLoader baseParent = ClassLoader.getSystemClassLoader().getParent();

    synchronized (mLoaders) {
        if (parent == null) {
            parent = baseParent;
        }

        if (parent == baseParent) {
            ClassLoader loader = mLoaders.get(zip);
            if (loader != null) {
                return loader;
            }
            //创建PathClassLoader对象
            PathClassLoader pathClassloader = PathClassLoaderFactory.createClassLoader(
                                          zip,
                                          librarySearchPath,
                                          libraryPermittedPath,
                                          parent,
                                          targetSdkVersion,
                                          isBundled);
            //
            mLoaders.put(zip, pathClassloader);
            return pathClassloader;
        }

        PathClassLoader pathClassloader = new PathClassLoader(zip, parent);
        return pathClassloader;
    }
}

private void initializeJavaContextClassLoader() {
    IPackageManager pm = ActivityThread.getPackageManager();
    android.content.pm.PackageInfo pi;
    pi = pm.getPackageInfo(mPackageName, 0, UserHandle.myUserId());

    boolean sharedUserIdSet = (pi.sharedUserId != null);
    boolean processNameNotDefault =
        (pi.applicationInfo != null &&
         !mPackageName.equals(pi.applicationInfo.processName));
    boolean sharable = (sharedUserIdSet || processNameNotDefault);
    ClassLoader contextClassLoader =
        (sharable)
        ? new WarningContextClassLoader()
        : mClassLoader;
    //设置当前线程的Context ClassLoader
    Thread.currentThread().setContextClassLoader(contextClassLoader);
}

public Application newApplication(ClassLoader cl, String className, Context context)
        throws InstantiationException, IllegalAccessException,
        ClassNotFoundException {
    return newApplication(cl.loadClass(className), context);
}

static public Application newApplication(Class<?> clazz, Context context)
       throws InstantiationException, IllegalAccessException,
       ClassNotFoundException {
   Application app = (Application)clazz.newInstance(); //【见小节2.10.2】
   app.attach(context); //【见小节2.10.3】
   return app;
}

public class Application extends ContextWrapper implements ComponentCallbacks2 {
    public LoadedApk mLoadedApk;

    public Application() {
        super(null);
    }
}

final void attach(Context context) {
    attachBaseContext(context); //Application的mBase
    mLoadedApk = ContextImpl.getImpl(context).mPackageInfo;
}

public static void main(String[] args) {
    ,,,
    ActivityThread thread = new ActivityThread();
    thread.attach(false);
    ,,,
}

private void attach(boolean system) {
    sCurrentActivityThread = this;
    mSystemThread = system;
    if (!system) {
        //初始化RuntimeInit.mApplicationObject值
        RuntimeInit.setApplicationObject(mAppThread.asBinder());
        final IActivityManager mgr = ActivityManagerNative.getDefault();
        mgr.attachApplication(mAppThread); //
    } else {
        ...
    }
}

private final boolean attachApplicationLocked(IApplicationThread thread,
        int pid) {
    ProcessRecord app;
    if (pid != MY_PID && pid >= 0) {
        synchronized (mPidsSelfLocked) {
            app = mPidsSelfLocked.get(pid); // 根据pid获取ProcessRecord
        }
    }

    ...
    ApplicationInfo appInfo = app.instrumentationInfo != null
            ? app.instrumentationInfo : app.info;
    //[见流程3.4]
    thread.bindApplication(processName, appInfo, providers, app.instrumentationClass,
            profilerInfo, app.instrumentationArguments, app.instrumentationWatcher,
            app.instrumentationUiAutomationConnection, testMode, enableOpenGlTrace,
            isRestrictedBackupMode || !normalMode, app.persistent,
            new Configuration(mConfiguration), app.compat,
            getCommonServicesLocked(app.isolated),
            mCoreSettingsObserver.getCoreSettingsLocked());
    ...

    return true;
}

private void handleBindApplication(AppBindData data) {
    mBoundApplication = data;
    Process.setArgV0(data.processName);//设置进程名
    ...
    //获取LoadedApk对象[见小节3.5]
    data.info = getPackageInfoNoCheck(data.appInfo, data.compatInfo);
    ...

    // 创建ContextImpl上下文[2.6.4]
    final ContextImpl appContext = ContextImpl.createAppContext(this, data.info);
    ...

    try {
        // 此处data.info是指LoadedApk, 通过反射创建目标应用Application对象[见小节2.7]
        Application app = data.info.makeApplication(data.restrictedBackupMode, null);
        mInitialApplication = app;
        ...
        mInstrumentation.onCreate(data.instrumentationArgs);
        mInstrumentation.callApplicationOnCreate(app);

    } finally {
        StrictMode.setThreadPolicy(savedPolicy);
    }
}

public final LoadedApk getPackageInfoNoCheck(ApplicationInfo ai,
        CompatibilityInfo compatInfo) {
    return getPackageInfo(ai, compatInfo, null, false, true, false);
}

private LoadedApk getPackageInfo(ApplicationInfo aInfo, CompatibilityInfo compatInfo,
    ClassLoader baseLoader, boolean securityViolation, boolean includeCode,
        boolean registerPackage) {
    final boolean differentUser = (UserHandle.myUserId() != UserHandle.getUserId(aInfo.uid));
    synchronized (mResourcesManager) {
        WeakReference<LoadedApk> ref;
        if (differentUser) {
            ref = null;
        } else if (includeCode) {
            ref = mPackages.get(aInfo.packageName); //从mPackages查询
        } else {
            ...
        }

        LoadedApk packageInfo = ref != null ? ref.get() : null;
        if (packageInfo == null || (packageInfo.mResources != null
                && !packageInfo.mResources.getAssets().isUpToDate())) {
            //创建LoadedApk对象
            packageInfo = new LoadedApk(this, aInfo, compatInfo, baseLoader,
                        securityViolation, includeCode &&
                        (aInfo.flags&ApplicationInfo.FLAG_HAS_CODE) != 0, registerPackage);

            if (mSystemThread && "android".equals(aInfo.packageName)) {
                ...
            }

            if (differentUser) {
                ...
            } else if (includeCode) {
                //将新创建的LoadedApk加入到mPackages
                mPackages.put(aInfo.packageName,
                        new WeakReference<LoadedApk>(packageInfo));
            } else {
                ...
            }
        }
        return packageInfo;
    }
}

private Activity performLaunchActivity(ActivityClientRecord r, Intent customIntent) {
    ...
    ActivityInfo aInfo = r.activityInfo;
    if (r.packageInfo == null) {
        //step 1: 创建LoadedApk对象
        r.packageInfo = getPackageInfo(aInfo.applicationInfo, r.compatInfo,
                Context.CONTEXT_INCLUDE_CODE);
    }
    ... //component初始化过程

    java.lang.ClassLoader cl = r.packageInfo.getClassLoader();
    //step 2: 创建Activity对象
    Activity activity = mInstrumentation.newActivity(cl, component.getClassName(), r.intent);
    ...

    //step 3: 创建Application对象
    Application app = r.packageInfo.makeApplication(false, mInstrumentation);

    if (activity != null) {
        //step 4: 创建ContextImpl对象
        Context appContext = createBaseContextForActivity(r, activity);
        CharSequence title = r.activityInfo.loadLabel(appContext.getPackageManager());
        Configuration config = new Configuration(mCompatConfiguration);
        //step5: 将Application/ContextImpl都attach到Activity对象 [见小节4.3.1]
        activity.attach(appContext, this, getInstrumentation(), r.token,
                r.ident, app, r.intent, r.activityInfo, title, r.parent,
                r.embeddedID, r.lastNonConfigurationInstances, config,
                r.referrer, r.voiceInteractor);

        ...
        int theme = r.activityInfo.getThemeResource();
        if (theme != 0) {
            activity.setTheme(theme);
        }

        activity.mCalled = false;
        if (r.isPersistable()) {
            //step 6: 执行回调onCreate
            mInstrumentation.callActivityOnCreate(activity, r.state, r.persistentState);
        } else {
            mInstrumentation.callActivityOnCreate(activity, r.state);
        }

        r.activity = activity;
        r.stopped = true;
        if (!r.activity.mFinished) {
            activity.performStart(); //执行回调onStart
            r.stopped = false;
        }
        if (!r.activity.mFinished) {
            //执行回调onRestoreInstanceState
            if (r.isPersistable()) {
                if (r.state != null || r.persistentState != null) {
                    mInstrumentation.callActivityOnRestoreInstanceState(activity, r.state,
                            r.persistentState);
                }
            } else if (r.state != null) {
                mInstrumentation.callActivityOnRestoreInstanceState(activity, r.state);
            }
        }
        ...
        r.paused = true;
        mActivities.put(r.token, r);
    }

    return activity;
}

private void handleCreateService(CreateServiceData data) {
    ...
    //step 1: 创建LoadedApk
    LoadedApk packageInfo = getPackageInfoNoCheck(
        data.info.applicationInfo, data.compatInfo);

    java.lang.ClassLoader cl = packageInfo.getClassLoader();
    //step 2: 创建Service对象
    service = (Service) cl.loadClass(data.info.name).newInstance();

    //step 3: 创建ContextImpl对象
    ContextImpl context = ContextImpl.createAppContext(this, packageInfo);
    context.setOuterContext(service);

    //step 4: 创建Application对象
    Application app = packageInfo.makeApplication(false, mInstrumentation);

    //step 5: 将Application/ContextImpl都attach到Activity对象 [见小节4.3.2]
    service.attach(context, this, data.info.name, data.token, app,
            ActivityManagerNative.getDefault());

    //step 6: 执行onCreate回调
    service.onCreate();
    mServices.put(data.token, service);
    ActivityManagerNative.getDefault().serviceDoneExecuting(
            data.token, SERVICE_DONE_EXECUTING_ANON, 0, 0);
    ...
}

private void handleReceiver(ReceiverData data) {
    ...
    String component = data.intent.getComponent().getClassName();
    //step 1: 创建LoadedApk对象
    LoadedApk packageInfo = getPackageInfoNoCheck(
            data.info.applicationInfo, data.compatInfo);

    IActivityManager mgr = ActivityManagerNative.getDefault();
    java.lang.ClassLoader cl = packageInfo.getClassLoader();
    data.intent.setExtrasClassLoader(cl);
    data.intent.prepareToEnterProcess();
    data.setExtrasClassLoader(cl);
    //step 2: 创建BroadcastReceiver对象
    BroadcastReceiver receiver = (BroadcastReceiver)cl.loadClass(component).newInstance();

    //step 3: 创建Application对象
    Application app = packageInfo.makeApplication(false, mInstrumentation);

    //step 4: 创建ContextImpl对象
    ContextImpl context = (ContextImpl)app.getBaseContext();
    sCurrentBroadcastIntent.set(data.intent);
    receiver.setPendingResult(data);

    //step 5: 执行onReceive回调 [见小节4.3.3]
    receiver.onReceive(context.getReceiverRestrictedContext(), data.intent);
    ...
}

private IActivityManager.ContentProviderHolder installProvider(Context context,
        IActivityManager.ContentProviderHolder holder, ProviderInfo info,
        boolean noisy, boolean noReleaseNeeded, boolean stable) {
    ContentProvider localProvider = null;
    IContentProvider provider;
    if (holder == null || holder.provider == null) {
        Context c = null;
        ApplicationInfo ai = info.applicationInfo;
        if (context.getPackageName().equals(ai.packageName)) {
            c = context;
        } else if (mInitialApplication != null &&
                mInitialApplication.getPackageName().equals(ai.packageName)) {
            c = mInitialApplication;
        } else {
            //step 1/2: 创建LoadedApk和ContextImpl对象
            c = context.createPackageContext(ai.packageName,Context.CONTEXT_INCLUDE_CODE);
        }

        final java.lang.ClassLoader cl = c.getClassLoader();
        //step 3: 创建ContentProvider对象
        localProvider = (ContentProvider)cl.loadClass(info.name).newInstance();
        provider = localProvider.getIContentProvider();

        //step 4/5: ContextImpl都attach到ContentProvider对象,并执行回调onCreate [见小节4.3.4]
        localProvider.attachInfo(c, info);
    } else {
        ...
    }
    ...
    return retHolder;
}

private void handleBindApplication(AppBindData data) {
    //step 1: 创建LoadedApk对象
    data.info = getPackageInfoNoCheck(data.appInfo, data.compatInfo);
    ...
    //step 2: 创建ContextImpl对象;
    final ContextImpl appContext = ContextImpl.createAppContext(this, data.info);

    //step 3: 创建Instrumentation
    mInstrumentation = new Instrumentation();

    //step 4: 创建Application对象; [见小节3.2]
    Application app = data.info.makeApplication(data.restrictedBackupMode, null);
    mInitialApplication = app;

    //step 5: 安装providers
    List<ProviderInfo> providers = data.providers;
    installContentProviders(app, providers);

    //step 6: 执行Application.Create回调
    mInstrumentation.callApplicationOnCreate(app);

public final LoadedApk getPackageInfo(ApplicationInfo ai, CompatibilityInfo compatInfo,
        int flags) {
    boolean includeCode = (flags&Context.CONTEXT_INCLUDE_CODE) != 0;
    //是否违反隐私问题
    boolean securityViolation = includeCode && ai.uid != 0
            && ai.uid != Process.SYSTEM_UID && (mBoundApplication != null
                    ? !UserHandle.isSameApp(ai.uid, mBoundApplication.appInfo.uid)
                    : true);
    boolean registerPackage = includeCode && (flags&Context.CONTEXT_REGISTER_PACKAGE) != 0;
    ...
    return getPackageInfo(ai, compatInfo, null, securityViolation, includeCode,
            registerPackage);
}

private LoadedApk getPackageInfo(ApplicationInfo aInfo, CompatibilityInfo compatInfo,
    ClassLoader baseLoader, boolean securityViolation, boolean includeCode,
        boolean registerPackage) {
    final boolean differentUser = (UserHandle.myUserId() != UserHandle.getUserId(aInfo.uid));
    synchronized (mResourcesManager) {
        WeakReference<LoadedApk> ref;
        if (differentUser) {
            ref = null;
        } else if (includeCode) {
            ref = mPackages.get(aInfo.packageName); //从mPackages查询
        } else {
            ...
        }

        LoadedApk packageInfo = ref != null ? ref.get() : null;
        if (packageInfo == null || (packageInfo.mResources != null
                && !packageInfo.mResources.getAssets().isUpToDate())) {
            //创建LoadedApk对象, 此时baseLoader为null
            packageInfo = new LoadedApk(this, aInfo, compatInfo, baseLoader,
                        securityViolation, includeCode &&
                        (aInfo.flags&ApplicationInfo.FLAG_HAS_CODE) != 0, registerPackage);
            ...

            if (differentUser) {
                ...
            } else if (includeCode) {
                //将新创建的LoadedApk加入到mPackages
                mPackages.put(aInfo.packageName, new WeakReference<LoadedApk>(packageInfo));
            } else {
                ...
            }
        }
        return packageInfo;
    }
}

public final LoadedApk getPackageInfoNoCheck(ApplicationInfo ai,
        CompatibilityInfo compatInfo) {
    return getPackageInfo(ai, compatInfo, null, false, true, false);
}

public Application makeApplication(boolean forceDefaultAppClass,
        Instrumentation instrumentation) {
    //保证一个LoadedApk对象只创建一个对应的Application对象
    if (mApplication != null) {
        return mApplication;
    }

    String appClass = mApplicationInfo.className;
    if (forceDefaultAppClass || (appClass == null)) {
        appClass = "android.app.Application"; //设置应用类名
    }


    java.lang.ClassLoader cl = getClassLoader();
    if (!mPackageName.equals("android")) {
        initializeJavaContextClassLoader();
    }

    //创建ContextImpl对象
    ContextImpl appContext = ContextImpl.createAppContext(mActivityThread, this);
    //创建Application对象, 并将appContext attach到新创建的Application[见3.2.2]
    Application app = mActivityThread.mInstrumentation.newApplication(cl, appClass, appContext);
    appContext.setOuterContext(app);
    ...

    mActivityThread.mAllApplications.add(app);
    mApplication = app; //将刚创建的app赋值给mApplication
    ...
    return app;
}

static public Application newApplication(Class<?> clazz, Context context)
        throws InstantiationException, IllegalAccessException, ClassNotFoundException {
    Application app = (Application)clazz.newInstance(); //创建Application
    app.attach(context); //执行attach操作[见小节4.3.5]
    return app;
}

private Context createBaseContextForActivity(ActivityClientRecord r, final Activity activity) {
    int displayId = Display.DEFAULT_DISPLAY;
    try {
        displayId = ActivityManagerNative.getDefault().getActivityDisplayId(r.token);
    } catch (RemoteException e) {
    }

    //创建ContextImpl对象
    ContextImpl appContext = ContextImpl.createActivityContext(
            this, r.packageInfo, displayId, r.overrideConfig);
    appContext.setOuterContext(activity);
    Context baseContext = appContext;
    ...

    return baseContext;
}

static ContextImpl createActivityContext(ActivityThread mainThread,
        LoadedApk packageInfo, int displayId, Configuration overrideConfiguration) {
    return new ContextImpl(null, mainThread, packageInfo,
            null, null, false,
            null, overrideConfiguration, displayId);
}

static ContextImpl createAppContext(ActivityThread mainThread, LoadedApk packageInfo) {
    if (packageInfo == null) throw new IllegalArgumentException("packageInfo");
    return new ContextImpl(null, mainThread, packageInfo,
             null, null, false,
             null, null, Display.INVALID_DISPLAY);
}

public Context createPackageContext(String packageName, int flags)
        throws NameNotFoundException {
    return createPackageContextAsUser(packageName, flags,
            mUser != null ? mUser : Process.myUserHandle());
}

public Context createPackageContextAsUser(String packageName, int flags, UserHandle user)
        throws NameNotFoundException {
    final boolean restricted = (flags & CONTEXT_RESTRICTED) == CONTEXT_RESTRICTED;
    if (packageName.equals("system") || packageName.equals("android")) {
        return new ContextImpl(this, mMainThread, mPackageInfo, mActivityToken,
                user, restricted, mDisplay, null, Display.INVALID_DISPLAY);
    }

    //创建LoadedApk
    LoadedApk pi = mMainThread.getPackageInfo(packageName, mResources.getCompatibilityInfo(),
            flags | CONTEXT_REGISTER_PACKAGE, user.getIdentifier());
    if (pi != null) {
        //创建ContextImpl
        ContextImpl c = new ContextImpl(this, mMainThread, pi,
                mActivityToken,user, restricted,
                mDisplay, null, Display.INVALID_DISPLAY);
        if (c.mResources != null) {
            return c;
        }
    }

}

class ContextImpl extends Context {
    final ActivityThread mMainThread;
    final LoadedApk mPackageInfo;
    private final IBinder mActivityToken;
    private final String mBasePackageName;
    private Context mOuterContext;
    //缓存Binder服务
    final Object[] mServiceCache = SystemServiceRegistry.createServiceCache();

    private ContextImpl(ContextImpl container, ActivityThread mainThread,
            LoadedApk packageInfo, IBinder activityToken, UserHandle user, boolean restricted,
            Display display, Configuration overrideConfiguration, int createDisplayWithId) {
        mOuterContext = this; //ContextImpl对象
        mMainThread = mainThread; // ActivityThread赋值
        mPackageInfo = packageInfo; // LoadedApk赋值
        mBasePackageName = packageInfo.mPackageName; //mBasePackageName等于“android”
        ...
    }
}

public Context getApplicationContext() {
    return (mPackageInfo != null) ?
            mPackageInfo.getApplication() : mMainThread.getApplication();
}

final void attach(Context context, ActivityThread aThread,
        Instrumentation instr, IBinder token, int ident,
        Application application, Intent intent, ActivityInfo info,
        CharSequence title, Activity parent, String id,
        NonConfigurationInstances lastNonConfigurationInstances,
        Configuration config, String referrer, IVoiceInteractor voiceInteractor) {
    attachBaseContext(context); //调用父类方法设置mBase.
    mUiThread = Thread.currentThread();
    mMainThread = aThread;
    mApplication = application;
    mIntent = intent;
    mComponent = intent.getComponent();
    mActivityInfo = info;
    ...
}

public final void attach(
        Context context,
        ActivityThread thread, String className, IBinder token,
        Application application, Object activityManager) {
    attachBaseContext(context); //调用父类方法设置mBase.
    mClassName = className;
    mToken = token;
    mApplication = application;
    ...
}

final Context getReceiverRestrictedContext() {
    if (mReceiverRestrictedContext != null) {
        return mReceiverRestrictedContext;
    }
    return mReceiverRestrictedContext = new ReceiverRestrictedContext(getOuterContext());
}

public void attachInfo(Context context, ProviderInfo info) {
    attachInfo(context, info, false);
}

private void attachInfo(Context context, ProviderInfo info, boolean testing) {
    mNoPerms = testing;

    if (mContext == null) {
        //将新创建ContextImpl对象保存到ContentProvider对象的成员变量mContext
        mContext = context;
        ...
        if (info != null) {
            setReadPermission(info.readPermission);
            setWritePermission(info.writePermission);
            setPathPermissions(info.pathPermissions);
            mExported = info.exported;
            mSingleUser = (info.flags & ProviderInfo.FLAG_SINGLE_USER) != 0;
            setAuthorities(info.authority);
        }
        // 执行onCreate回调;
        ContentProvider.this.onCreate();
    }
}

final void attach(Context context) {
    attachBaseContext(context); //Application的mBase
    mLoadedApk = ContextImpl.getImpl(context).mPackageInfo;
}

private class DeathRecipient implements IBinder.DeathRecipient {
    public void binderDied() {
        try {
            synchronized(mService.mWindowMap) {
                WindowState win = mService.windowForClientLocked(mSession, mClient, false);
                Slog.i(TAG, "WIN DEATH: " + win);
                if (win != null) {
                    mService.removeWindowLocked(win);
                } else if (mHasSurface) {
                    Slog.e(TAG, "!!! LEAK !!! Window removed but surface still valid.");
                    mService.removeWindowLocked(WindowState.this);
                }
            }
        } catch (IllegalArgumentException ex) {
            ...
        }
    }
}

<service android:name =".GityuanService"  android:process =":remote">  
    <intent-filter>  
       <action android:name ="com.action.gityuan" />  
    </intent-filter>  
</service>

ArrayMap<Intent.FilterComparison, IntentBindRecord> bindings

ArrayMap<ProcessRecord, AppBindRecord> apps

startService(Intent service)
stopService(Intent service)
bindService(Intent service, ServiceConnection conn, int flags)
unbindService(ServiceConnection conn)

public interface ServiceConnection {
    public void onServiceConnected(ComponentName name, IBinder service);
    public void onServiceDisconnected(ComponentName name);
}

unbindService(ServiceConnection conn)

startForeground(int id, Notification notification)
stopForeground(boolean removeNotification)

LoadedApk
    ReceiverDispatcher
        InnerReceiver extends IIntentReceiver.Stub
        Args extends BroadcastReceiver.PendingResult implements Runnable

    ServiceDispatcher
        InnerConnection extends IServiceConnection.Stub
        RunConnection implements Runnable

SharedPreferences sharedPreferences = getSharedPreferences("gityuan", Context.MODE_PRIVATE);

Editor editor = sharedPreferences.edit();
editor.putString("blog", "www.gityuan.com");
editor.putInt("years", 3);
editor.commit();

<?xml version='1.0' encoding='utf-8' standalone='yes' ?><map><stringname="blog">"www.gityuan.com</string><intname="years"value="3"/></map>

public SharedPreferences getPreferences(int mode) {
    //[见下文]
    return getSharedPreferences(getLocalClassName(), mode);
}

public static SharedPreferences getDefaultSharedPreferences(Context context) {
    //[见下文]
    return context.getSharedPreferences(getDefaultSharedPreferencesName(context),
           getDefaultSharedPreferencesMode());
}

class ContextImpl extends Context {
    private ArrayMap<String, File> mSharedPrefsPaths;

    public SharedPreferences getSharedPreferences(String name, int mode) {
        File file;
        synchronized (ContextImpl.class) {
            if (mSharedPrefsPaths == null) {
                mSharedPrefsPaths = new ArrayMap<>();
            }
            //先从mSharedPrefsPaths查询是否存在相应文件
            file = mSharedPrefsPaths.get(name);
            if (file == null) {
                //如果文件不存在, 则创建新的文件 [见小节2.1.4]
                file = getSharedPreferencesPath(name);
                mSharedPrefsPaths.put(name, file);
            }
        }
        //[见小节2.2]
        return getSharedPreferences(file, mode);
    }
}

public File getSharedPreferencesPath(String name) {
    return makeFilename(getPreferencesDir(), name + ".xml");
}

private File getPreferencesDir() {
    synchronized (mSync) {
        if (mPreferencesDir == null) {
            //创建目录/data/data/package name/shared_prefs/
            mPreferencesDir = new File(getDataDir(), "shared_prefs");
        }
        return ensurePrivateDirExists(mPreferencesDir);
    }
} 流程说明:

public SharedPreferences getSharedPreferences(File file, int mode) {
    checkMode(mode); //[见小节2.2.1]
    SharedPreferencesImpl sp;
    synchronized (ContextImpl.class) {
        //[见小节2.2.2]
        final ArrayMap<File, SharedPreferencesImpl> cache = getSharedPreferencesCacheLocked();
        sp = cache.get(file);
        if (sp == null) {
            //创建SharedPreferencesImpl[见小节2.3]
            sp = new SharedPreferencesImpl(file, mode);
            cache.put(file, sp);
            return sp;
        }
    }

    //指定多进程模式, 则当文件被其他进程改变时,则会重新加载
    if ((mode & Context.MODE_MULTI_PROCESS) != 0 ||
        getApplicationInfo().targetSdkVersion < android.os.Build.VERSION_CODES.HONEYCOMB) {
        sp.startReloadIfChangedUnexpectedly();
    }
    return sp;
}

private void checkMode(int mode) {
    if (getApplicationInfo().targetSdkVersion >= Build.VERSION_CODES.N) {
        if ((mode & MODE_WORLD_READABLE) != 0) {
            throw new SecurityException("MODE_WORLD_READABLE no longer supported");
        }
        if ((mode & MODE_WORLD_WRITEABLE) != 0) {
            throw new SecurityException("MODE_WORLD_WRITEABLE no longer supported");
        }
    }
}

private ArrayMap<File, SharedPreferencesImpl> getSharedPreferencesCacheLocked() {
    if (sSharedPrefsCache == null) {
        sSharedPrefsCache = new ArrayMap<>();
    }

    final String packageName = getPackageName();
    ArrayMap<File, SharedPreferencesImpl> packagePrefs = sSharedPrefsCache.get(packageName);
    if (packagePrefs == null) {
        packagePrefs = new ArrayMap<>();
        sSharedPrefsCache.put(packageName, packagePrefs);
    }
    return packagePrefs;
}

SharedPreferencesImpl(File file, int mode) {
    mFile = file;
    //创建为.bak为后缀的备份文件
    mBackupFile = makeBackupFile(file);
    mMode = mode;
    mLoaded = false;
    mMap = null;
    startLoadFromDisk(); //[见小节2.3.1]
}

private void startLoadFromDisk() {
    synchronized (this) {
        mLoaded = false;
    }
    new Thread("SharedPreferencesImpl-load") {
        public void run() {
            loadFromDisk(); //[见小节2.3.2]
        }
    }.start();
}

private void loadFromDisk() {
    synchronized (SharedPreferencesImpl.this) {
        if (mLoaded) {
            return;
        }
        if (mBackupFile.exists()) {
            mFile.delete();
            mBackupFile.renameTo(mFile);
        }
    }

    Map map = null;
    StructStat stat = null;
    try {
        stat = Os.stat(mFile.getPath());
        if (mFile.canRead()) {
            BufferedInputStream str = null;
            try {
                str = new BufferedInputStream(new FileInputStream(mFile), 16*1024);
                map = XmlUtils.readMapXml(str);
            } catch (XmlPullParserException | IOException e) {
                ...
            } finally {
                IoUtils.closeQuietly(str);
            }
        }
    } catch (ErrnoException e) {
        ...
    }

    synchronized (SharedPreferencesImpl.this) {
        mLoaded = true;
        if (map != null) {
            mMap = map; //从文件读取的信息保存到mMap
            mStatTimestamp = stat.st_mtime; //更新修改时间
            mStatSize = stat.st_size; //更新文件大小
        } else {
            mMap = new HashMap<>();
        }
        notifyAll(); //唤醒处于等待状态的线程
    }
}

public String getString(String key, @Nullable String defValue) {
    synchronized (this) {
        //检查是否加载完成[见小节2.4.2]
        awaitLoadedLocked();
        String v = (String)mMap.get(key);
        return v != null ? v : defValue;
    }
}

private void awaitLoadedLocked() {
    if (!mLoaded) {
        BlockGuard.getThreadPolicy().onReadFromDisk();
    }
    while (!mLoaded) {
        try {
            wait(); //当没有加载完成,则进入等待状态
        } catch (InterruptedException unused) {
        }
    }
}

public Editor edit() {
    synchronized (this) {
        awaitLoadedLocked(); //[见小节2.4.2]
    }

    return new EditorImpl(); //创建EditorImpl
}

public final class EditorImpl implements Editor {
    private final Map<String, Object> mModified = Maps.newHashMap();
    private boolean mClear = false;

    //插入数据
    public Editor putString(String key, @Nullable String value) {
        synchronized (this) {
            //插入数据, 先暂存到mModified对象
            mModified.put(key, value);
            return this;
        }
    }
    //移除数据
    public Editor remove(String key) {
        synchronized (this) {
            mModified.put(key, this);
            return this;
        }
    }

    //清空全部数据
    public Editor clear() {
        synchronized (this) {
            mClear = true;
            return this;
        }
    }
}

public boolean commit() {
    //将数据更新到内存[见小节4.2]
    MemoryCommitResult mcr = commitToMemory();
    //将内存数据同步到文件[见小节4.3]
    SharedPreferencesImpl.this.enqueueDiskWrite(mcr, null);
    try {
        //进入等待状态, 直到写入文件的操作完成
        mcr.writtenToDiskLatch.await();
    } catch (InterruptedException e) {
        return false;
    }
    //通知监听则, 并在主线程回调onSharedPreferenceChanged()方法
    notifyListeners(mcr);
    // 返回文件操作的结果数据
    return mcr.writeToDiskResult;
}

private MemoryCommitResult commitToMemory() {
    MemoryCommitResult mcr = new MemoryCommitResult();
    synchronized (SharedPreferencesImpl.this) {
        if (mDiskWritesInFlight > 0) {
            mMap = new HashMap<String, Object>(mMap);
        }
        mcr.mapToWriteToDisk = mMap;
        mDiskWritesInFlight++;

        //是否有监听key改变的监听者
        boolean hasListeners = mListeners.size() > 0;
        if (hasListeners) {
            mcr.keysModified = new ArrayList<String>();
            mcr.listeners = new HashSet<OnSharedPreferenceChangeListener>(mListeners.keySet());
        }

        synchronized (this) {
            //当mClear为true, 则直接清空mMap
            if (mClear) {
                if (!mMap.isEmpty()) {
                    mcr.changesMade = true;
                    mMap.clear();
                }
                mClear = false;
            }

            for (Map.Entry<String, Object> e : mModified.entrySet()) {
                String k = e.getKey();
                Object v = e.getValue();
                //注意此处的this是个特殊值, 用于移除相应的key操作.
                if (v == this || v == null) {
                    if (!mMap.containsKey(k)) {
                        continue;
                    }
                    mMap.remove(k);
                } else {
                    if (mMap.containsKey(k)) {
                        Object existingValue = mMap.get(k);
                        if (existingValue != null && existingValue.equals(v)) {
                            continue;
                        }
                    }
                    mMap.put(k, v);
                }

                mcr.changesMade = true; // changesMade代表数据是否有改变
                if (hasListeners) {
                    mcr.keysModified.add(k); //记录发生改变的key
                }
            }
            mModified.clear(); //清空EditorImpl中的mModified数据
        }
    }
    return mcr;
}

private void enqueueDiskWrite(final MemoryCommitResult mcr,
                              final Runnable postWriteRunnable) {
    final Runnable writeToDiskRunnable = new Runnable() {
            public void run() {
                synchronized (mWritingToDiskLock) {
                    //执行文件写入操作[见小节4.3.1]
                    writeToFile(mcr);
                }
                synchronized (SharedPreferencesImpl.this) {
                    mDiskWritesInFlight--;
                }
                //此时postWriteRunnable为null不执行该方法
                if (postWriteRunnable != null) {
                    postWriteRunnable.run();
                }
            }
        };

    final boolean isFromSyncCommit = (postWriteRunnable == null);

    if (isFromSyncCommit) { //commit方法会进入该分支
        boolean wasEmpty = false;
        synchronized (SharedPreferencesImpl.this) {
            //commitToMemory过程会加1,则wasEmpty=true
            wasEmpty = mDiskWritesInFlight == 1;
        }
        if (wasEmpty) {
            //跳转到上面
            writeToDiskRunnable.run();
            return;
        }
    }
    //不执行该方法
    QueuedWork.singleThreadExecutor().execute(writeToDiskRunnable);
}

private void writeToFile(MemoryCommitResult mcr) {
    if (mFile.exists()) {
        if (!mcr.changesMade) { //没有key发生改变, 则直接返回
            mcr.setDiskWriteResult(true);
            return;
        }
        if (!mBackupFile.exists()) {
            //当备份文件不存在, 则把mFile重命名为备份文件
            if (!mFile.renameTo(mBackupFile)) {
                mcr.setDiskWriteResult(false);
                return;
            }
        } else {
            mFile.delete(); //否则,直接删除mFile
        }
    }

    try {
        FileOutputStream str = createFileOutputStream(mFile);
        if (str == null) {
            mcr.setDiskWriteResult(false);
            return;
        }
        //将mMap全部信息写入文件
        XmlUtils.writeMapXml(mcr.mapToWriteToDisk, str);
        FileUtils.sync(str);
        str.close();
        ContextImpl.setFilePermissionsFromMode(mFile.getPath(), mMode, 0);
        try {
            final StructStat stat = Os.stat(mFile.getPath());
            synchronized (this) {
                mStatTimestamp = stat.st_mtime;
                mStatSize = stat.st_size;
            }
        } catch (ErrnoException e) {
            ...
        }
        //写入成功, 则删除备份文件
        mBackupFile.delete();
        //返回写入成功, 唤醒等待线程
        mcr.setDiskWriteResult(true);
        return;
    } catch (XmlPullParserException e) {
        ...
    } catch (IOException e) {
        ...
    }
    //如果写入文件的操作失败, 则删除未成功写入的文件
    if (mFile.exists()) {
        if (!mFile.delete()) {
            ...
        }
    }
    //返回写入失败, 唤醒等待线程
    mcr.setDiskWriteResult(false);
}

public void apply() {
    //把数据更新到内存[见小节4.2]
    final MemoryCommitResult mcr = commitToMemory();
    final Runnable awaitCommit = new Runnable() {
            public void run() {
                try {
                    //进入等待状态
                    mcr.writtenToDiskLatch.await();
                } catch (InterruptedException ignored) {
                }
            }
        };

    //将awaitCommit添加到QueuedWork
    QueuedWork.add(awaitCommit);

    Runnable postWriteRunnable = new Runnable() {
            public void run() {
                awaitCommit.run();
                //从QueuedWork移除
                QueuedWork.remove(awaitCommit);
            }
        };

    //[见小节4.4.1]
    SharedPreferencesImpl.this.enqueueDiskWrite(mcr, postWriteRunnable);
    notifyListeners(mcr);
}

private void enqueueDiskWrite(final MemoryCommitResult mcr,
                              final Runnable postWriteRunnable) {
    final Runnable writeToDiskRunnable = new Runnable() {
            public void run() {
                synchronized (mWritingToDiskLock) {
                    //执行文件写入操作[见小节4.3.1]
                    writeToFile(mcr);
                }
                synchronized (SharedPreferencesImpl.this) {
                    mDiskWritesInFlight--;
                }

                if (postWriteRunnable != null) {
                    postWriteRunnable.run();
                }
            }
        };

    final boolean isFromSyncCommit = (postWriteRunnable == null);
    if (isFromSyncCommit) {
        ... //postWriteRunnable不为空
    }
    //将任务放入单线程的线程池来执行
    QueuedWork.singleThreadExecutor().execute(writeToDiskRunnable);
}

public class QueuedWork {

    private static final ConcurrentLinkedQueue<Runnable> sPendingWorkFinishers =
       new ConcurrentLinkedQueue<Runnable>();

    public static void add(Runnable finisher) {
        sPendingWorkFinishers.add(finisher);
    }

    public static void remove(Runnable finisher) {
        sPendingWorkFinishers.remove(finisher);
    }

    public static void waitToFinish() {
        Runnable toFinish;
        while ((toFinish = sPendingWorkFinishers.poll()) != null) {
            toFinish.run();
        }
    }

    public static boolean hasPendingWork() {
        return !sPendingWorkFinishers.isEmpty();
    }
}

//1. 自定义广播接收者
public class LocalReceiver extends BroadcastReceiver {
    public void onReceive(Context context, Intent intent) {
        ...
    }
}
LocalReceiver localReceiver = new LocalReceiver();

//2. 注册广播
LocalBroadcastManager.getInstance(context)
             .registerReceiver(localReceiver, new IntentFilter(“gityuan”));
//4. 发送广播
LocalBroadcastManager.getInstance(context).sendBroadcast(new Intent("gityuan"));
//5. 取消注册广播
LocalBroadcastManager.getInstance(context).unregisterReceiver(localReceiver);

public final class LocalBroadcastManager {
    public static LocalBroadcastManager getInstance(Context context) {
        synchronized (mLock) {
            if (mInstance == null) {
                //单例模式，创建LocalBroadcastManager对象
                mInstance = new LocalBroadcastManager(context.getApplicationContext());
            }
            return mInstance;
        }
    }

    private LocalBroadcastManager(Context context) {
        mAppContext = context;
        //创建运行在主线程的Handler
        mHandler = new Handler(context.getMainLooper()) {

            @Override
            public void handleMessage(Message msg) {
                switch (msg.what) {
                    case MSG_EXEC_PENDING_BROADCASTS:
                        executePendingBroadcasts();
                        break;
                    default:
                        super.handleMessage(msg);
                }
            }
        };
    }
}

public void registerReceiver(BroadcastReceiver receiver, IntentFilter filter) {
    synchronized (mReceivers) {
        //创建ReceiverRecord对象
        ReceiverRecord entry = new ReceiverRecord(filter, receiver);
        //查询或创建数据到mReceivers
        ArrayList<IntentFilter> filters = mReceivers.get(receiver);
        if (filters == null) {
            filters = new ArrayList<IntentFilter>(1);
            mReceivers.put(receiver, filters);
        }
        filters.add(filter);
        //查询或创建数据到mActions
        for (int i=0; i<filter.countActions(); i++) {
            String action = filter.getAction(i);
            ArrayList<ReceiverRecord> entries = mActions.get(action);
            if (entries == null) {
                entries = new ArrayList<ReceiverRecord>(1);
                mActions.put(action, entries);
            }
            entries.add(entry);
        }
    }
}

public boolean sendBroadcast(Intent intent) {
    synchronized (mReceivers) {
        final String action = intent.getAction();
        final String type = intent.resolveTypeIfNeeded(
                mAppContext.getContentResolver());
        final Uri data = intent.getData();
        final String scheme = intent.getScheme();
        final Set<String> categories = intent.getCategories();
        //根据Intent的action来查询相应的广播接收者列表
        ArrayList<ReceiverRecord> entries = mActions.get(intent.getAction());
        if (entries != null) {
            ArrayList<ReceiverRecord> receivers = null;
            for (int i=0; i<entries.size(); i++) {
                ReceiverRecord receiver = entries.get(i);
                if (receiver.broadcasting) {
                    continue; //正在处理广播的receiver，则跳过
                }

                int match = receiver.filter.match(action, type, scheme, data,
                        categories, "LocalBroadcastManager");
                if (match >= 0) {
                    if (receivers == null) {
                        receivers = new ArrayList<ReceiverRecord>();
                    }
                    receivers.add(receiver);
                    receiver.broadcasting = true;
                }
            }

            if (receivers != null) {
                for (int i=0; i<receivers.size(); i++) {
                    receivers.get(i).broadcasting = false;
                }
                //创建相应广播，添加到mPendingBroadcasts队列
                mPendingBroadcasts.add(new BroadcastRecord(intent, receivers));
                if (!mHandler.hasMessages(MSG_EXEC_PENDING_BROADCASTS)) {
                    //发送消息【见小节2.3.1】
                    mHandler.sendEmptyMessage(MSG_EXEC_PENDING_BROADCASTS);
                }
                return true;
            }
        }
    }
    return false;
}

private void executePendingBroadcasts() {
    while (true) {
        BroadcastRecord[] brs = null;
        //将mPendingBroadcasts保存到brs数组
        synchronized (mReceivers) {
            final int N = mPendingBroadcasts.size();
            if (N <= 0) {
                return;
            }
            brs = new BroadcastRecord[N];
            mPendingBroadcasts.toArray(brs);
            mPendingBroadcasts.clear();
        }
        //回调相应广播接收者的onReceive方法。
        for (int i=0; i<brs.length; i++) {
            BroadcastRecord br = brs[i];
            for (int j=0; j<br.receivers.size(); j++) {
                br.receivers.get(j).receiver.onReceive(mAppContext, br.intent);
            }
        }
    }
}

public void unregisterReceiver(BroadcastReceiver receiver) {
    synchronized (mReceivers) {
        //从mReceivers移除该广播接收者
        ArrayList<IntentFilter> filters = mReceivers.remove(receiver);
        if (filters == null) {
            return;
        }
        
        //从mActions移除接收者为空的action
        for (int i=0; i<filters.size(); i++) {
            IntentFilter filter = filters.get(i);
            for (int j=0; j<filter.countActions(); j++) {
                String action = filter.getAction(j);
                ArrayList<ReceiverRecord> receivers = mActions.get(action);
                if (receivers != null) {
                    for (int k=0; k<receivers.size(); k++) {
                        if (receivers.get(k).receiver == receiver) {
                            receivers.remove(k);
                            k--;
                        }
                    }
                    if (receivers.size() <= 0) {
                        mActions.remove(action);
                    }
                }
            }
        }
    }
}

ActivityStackSupervisor.mActivityDisplays 
-> ActivityDisplay.mStacks 
-> ActivityStack.mTaskHistory 
-> TaskRecord.mActivities 
-> ActivityRecord

ActivityRecord.task 
-> TaskRecord.stack 
-> ActivityStack.mStackSupervisor
-> ActivityStackSupervisor

frameworks/base/services/core/java/com/android/server/am/
  - ActivityManagerService.java
  - ProcessRecord
  - ActivityStackSupervisor.java 
  - ActivityStack.java
  - ActiveServices
  - BroadcastQueue

<service android:name =".GityuanService"  android:process =":remote">  
    <intent-filter>  
       <action android:name ="com.action.gityuan" />  
    </intent-filter>  
</service>

public final class ActivityManagerService extends ...{
    //当前聚焦的Activity
    ActivityRecord mFocusedActivity = null;
    //用于管理各个Activity栈
    final ActivityStackSupervisor mStackSupervisor;
}

public final class ActivityStackSupervisor implements DisplayListener {
    //桌面app所在栈
    ActivityStack mHomeStack;

    //当前可以接受Input事件，或许启动下一个Activity的栈
    ActivityStack mFocusedStack;

    //当该值等于mFocusedStack，代表当前栈顶的Activity已进入resumed状态；
    //当该值等于上一个旧栈时，代表正处理activity切换状态；
    private ActivityStack mLastFocusedStack;

    //在完成相应目标前，等待新的Activity成为可见的Activity列表
    final ArrayList<ActivityRecord> mWaitingVisibleActivities = new ArrayList<>();

    //等待找到下一个可见Activity的等待列表
    final ArrayList<IActivityManager.WaitResult> mWaitingActivityVisible = new ArrayList<>();

    //等待找到下一个已启动Activity的等待列表
    final ArrayList<IActivityManager.WaitResult> mWaitingActivityLaunched = new ArrayList<>();

    //等待上一个activity安置完成，则即将进入被stopped的Activity列表
    final ArrayList<ActivityRecord> mStoppingActivities = new ArrayList<>();

    //等待上一个activity安置完成，则即将进入被finished的Activity列表
    final ArrayList<ActivityRecord> mFinishingActivities = new ArrayList<>();

    //即将进入sleep状态的进程所对应的Activity列表
    final ArrayList<ActivityRecord> mGoingToSleepActivities = new ArrayList<>();
}

final class ActivityStack{
    //记录该栈中所有的task
    private final ArrayList<TaskRecord> mTaskHistory = new ArrayList<>();

    //按LRU方式排序的Activity列表，队尾成员是最新活动的Activity
    final ArrayList<ActivityRecord> mLRUActivities = new ArrayList<>();

    //正在执行pausing过程的Activity
    ActivityRecord mPausingActivity = null;

    //已处于paused状态的Activity
    ActivityRecord mLastPausedActivity = null;

    //已处于Resumed状态的Activity
    ActivityRecord mResumedActivity = null;
}

public final class ActiveServices {
    //记录不同User下所有的Service信息
    final SparseArray<ServiceMap> mServiceMap = new SparseArray<>();

    //bind service的连接信息，以IServiceConnection的Bp端作为Keys
    final ArrayMap<IBinder, ArrayList<ConnectionRecord>> mServiceConnections = new ArrayMap<>();

    //已请求启动但尚未启动的Service列表
    final ArrayList<ServiceRecord> mPendingServices = new ArrayList<>();

    //crash后需要计划重启的Service列表
    final ArrayList<ServiceRecord> mRestartingServices = new ArrayList<>();

    //正在执行destroyed的service列表
    final ArrayList<ServiceRecord> mDestroyingServices = new ArrayList<>();
}

public final class ActivityManagerService extends ...{
    //前台广播队列
    BroadcastQueue mFgBroadcastQueue;
    //后台广播队列
    BroadcastQueue mBgBroadcastQueue;
    //广播队列数组，也就是前台和后台广播队列
    final BroadcastQueue[] mBroadcastQueues = new BroadcastQueue[2];
    
    //粘性广播，[userId，action，ArrayList<Intent>]
    final SparseArray<ArrayMap<String, ArrayList<Intent>>> mStickyBroadcasts;
    
    //动态注册的广播接收者，其中key为客户端InnerReceiver的Bp端，value为ReceiverList
    final HashMap<IBinder, ReceiverList> mRegisteredReceivers = new HashMap<>();
    
    //从广播intent到已注册接收者的解析器
    final IntentResolver<BroadcastFilter, BroadcastFilter> mReceiverResolver；
}

public final class BroadcastQueue{
    //并行广播列表
    final ArrayList<BroadcastRecord> mParallelBroadcasts = new ArrayList<>();
    //串行广播列表
    final ArrayList<BroadcastRecord> mOrderedBroadcasts = new ArrayList<>();
    
    //即将要处理的串行广播，等待目标进程创建完成。每个广播队列只有一个，其他必须等待该广播完成。
    BroadcastRecord mPendingBroadcast = null;
}

public final class ActivityManagerService extends ...{
    //记录系统所有的provider信息
    final ProviderMap mProviderMap;
    
    //记录有client正在等待的provider列表，当provider发布完成则从该队列移除
    final ArrayList<ContentProviderRecord> mLaunchingProviders;
}

public final class ProviderMap {
    //以provider名字(auth)为key的方式所记录的provider信息
    private final HashMap<String, ContentProviderRecord> mSingletonByName;
    //以provider组件名(ComponentName)为key的方式所记录的provider信息
    private final HashMap<ComponentName, ContentProviderRecord> mSingletonByClass;
    
    //记录不同UserId下的，以auth为key的方式所记录的provider信息
    private final SparseArray<HashMap<String, ContentProviderRecord>> mProvidersByNamePerUser;
    //记录不同UserId下的，以ComponentName为key的方式所记录的provider信息
    private final SparseArray<HashMap<ComponentName, ContentProviderRecord>> mProvidersByClassPerUser;
}