@Override
public void onShellCommand(FileDescriptor in, FileDescriptor out,
        FileDescriptor err, String[] args, ShellCallback callback,
        ResultReceiver resultReceiver) {
    (new ActivityManagerShellCommand(this, false)).exec(
            this, in, out, err, args, callback, resultReceiver);
}

final class ActivityManagerShellCommand extends ShellCommand {...}
public abstract class ShellCommand extends BasicShellCommandHandler {...}

public int exec(Binder target, FileDescriptor in, FileDescriptor out, FileDescriptor err,
        String[] args) {
    String cmd;
    int start;
    if (args != null && args.length > 0) {
        cmd = args[0];
        start = 1;
    } else {
        cmd = null;
        start = 0;
    }
    init(target, in, out, err, args, start);
    mCmd = cmd;

    int res = -1;
    try {
        res = onCommand(mCmd);
        if (DEBUG) Log.d(TAG, "Executed command " + mCmd + " on " + mTarget);
    } catch (Throwable e) {
        //...
    }
    //...
}

// 这里主要进行对象的初始化
public void init(Binder target, FileDescriptor in, FileDescriptor out, FileDescriptor err,
        String[] args, int firstArgPos) {
    mTarget = target;
    mIn = in;
    mOut = out;
    mErr = err;
    mArgs = args;
    mCmd = null;
    mArgPos = firstArgPos;
    mCurArgData = null;
    mFileIn = null;
    mFileOut = null;
    mFileErr = null;
    mOutPrintWriter = null;
    mErrPrintWriter = null;
    mInputStream = null;
}

@Override
public int onCommand(String cmd) {
    if (cmd == null) {
        return handleDefaultCommands(cmd);
    }
    final PrintWriter pw = getOutPrintWriter();
    try {
        switch (cmd) {
            case "start":
            case "start-activity":
                return runStartActivity(pw);
            case "startservice":
            case "start-service":
                return runStartService(pw, false);
            case "startforegroundservice":
            case "startfgservice":
            case "start-foreground-service":
            case "start-fg-service":
                return runStartService(pw, true);
            case "stopservice":
            case "stop-service":
                return runStopService(pw);
            case "broadcast":
                return runSendBroadcast(pw);
            //...
            default:
                return handleDefaultCommands(cmd);
        }
    } catch (RemoteException e) {
        pw.println("Remote exception: " + e);
    }
    return -1;
}

Intent intent;
try {
    intent = makeIntent(UserHandle.USER_CURRENT);
} catch (URISyntaxException e) {
    throw new RuntimeException(e.getMessage(), e);
}

if (mWaitOption) {
    result = mInternal.startActivityAndWait(null, SHELL_PACKAGE_NAME, null, intent,
            mimeType, null, null, 0, mStartFlags, profilerInfo,
            options != null ? options.toBundle() : null, mUserId);
    res = result.result;
} else {
    res = mInternal.startActivityAsUserWithFeature(null, SHELL_PACKAGE_NAME, null,
            intent, mimeType, null, null, 0, mStartFlags, profilerInfo,
            options != null ? options.toBundle() : null, mUserId);
}

private Intent makeIntent(int defUser) throws URISyntaxException {
    mStartFlags = 0;
    mWaitOption = false;
    mStopOption = false;
    mRepeat = 0;
    mProfileFile = null;
    mSamplingInterval = 0;
    mAutoStop = false;
    mStreaming = false;
    mUserId = defUser;
    mDisplayId = INVALID_DISPLAY;
    mWindowingMode = WINDOWING_MODE_UNDEFINED;
    mActivityType = ACTIVITY_TYPE_UNDEFINED;
    mTaskId = INVALID_TASK_ID;
    mIsTaskOverlay = false;
    mIsLockTask = false;
    mAsync = false;
    mBroadcastOptions = null;

    return Intent.parseCommandArgs(this, new Intent.CommandOptionHandler() {...}

public static Intent parseCommandArgs(ShellCommand cmd, CommandOptionHandler optionHandler)
        throws URISyntaxException {
    Intent intent = new Intent();
    Intent baseIntent = intent;
    boolean hasIntentInfo = false;

    Uri data = null;
    String type = null;

    String opt;
    while ((opt=cmd.getNextOption()) != null) {
        switch (opt) {
            case "-a":
                intent.setAction(cmd.getNextArgRequired());
                if (intent == baseIntent) {
                    hasIntentInfo = true;
                }
                break;
            case "-d":
                data = Uri.parse(cmd.getNextArgRequired());
                if (intent == baseIntent) {
                    hasIntentInfo = true;
                }
                break;
            case "-t":
                type = cmd.getNextArgRequired();
                if (intent == baseIntent) {
                    hasIntentInfo = true;
                }
                break;
            //...
            default:
                if (optionHandler != null && optionHandler.handleOption(opt, cmd)) {
                    // Okay, caller handled this option.
                } else {
                    throw new IllegalArgumentException("Unknown option: " + opt);
                }
                break;
        }
    }
    intent.setDataAndType(data, type);
    //...
    return intent;
}

public static String AUTH = null;
public static boolean isPrintStack = false;

// 监听auth为ActivityThread.AUTH的Provider的情况
// 如果ActivityThread.AUTH=all，则监控所有
public void printAuth(String curAuth) {
    if (ActivityThread.AUTH == null) {
        return;
    }
    if ("all".equals(ActivityThread.AUTH) ||
            curAuth.equals(ActivityThread.AUTH)) {
        String TestTAG = "AMS Provider Test";
        Slog.w(TestTAG, "CallerPackage" + "{" +
                "Uid=" + Process.myUid() + "," +
                "Pid=" + Process.myPid() + "} " +
                "start execute acquireProvider() for " + ActivityThread.AUTH);
        if (isPrintStack) {
            new Exception(TestTAG).printStackTrace();
        }
    }
}

// AMS Test Log
case "monitor-auth":
    runMonitorAuth();
    return 0;

// AMS Test Log
private void runMonitorAuth() throws RemoteException {
    String opt;
    String authority = null;
    int uid = 0;
    boolean isPrintStack = false;

    // getNextOption()获取类似-a的参数
    while ((opt = getNextOption()) != null) {
        switch (opt) {
            case "--auth": //获取auth
                String auth = getNextArg(); // 获取--auth后面的参数值
                if (auth == null || auth.equals("null")) {
                    authority = null;
                } else {
                    authority = auth;
                }
                break;
            case "--uid":
                String resUid = getNextArg();
                if ("all".equals(resUid)) {
                    uid = -1;
                } else {
                    uid = Integer.parseInt(resUid);
                }
                break;
            case "--stack": //是否打印堆栈
                String resStack = getNextArg();
                isPrintStack = resStack.equals("yes");
                break;
            case "--end":
                mInterface.setMonitorAuth(authority, uid, isPrintStack);
                break;
            default:
                break;
        }
    }
}

public void setMonitorAuth(String authority, int uid, boolean isPrintStack) {
    // 设置系统进程的AUTH
    ActivityThread.AUTH = authority;
    // 设置指定Uid进程的AUTH
    final int numOfNames = getProcessNamesLOSP().getMap().size();
    for (int ip = 0; ip < numOfNames; ip++) {
        //获取某个进程名下的所有进程
        SparseArray<ProcessRecord> procs = getProcessNamesLOSP().getMap().valueAt(ip);
        if (procs == null) {
            return;
        }
        for (int ia = 0, size = procs.size(); ia < size; ia++) {
            ProcessRecord app = procs.valueAt(ia);
            IApplicationThread thread;
            // 比较uid，如果uid=-1则对所有正在运行的进程执行操作
            if ((uid == -1 || app.uid == uid) && (thread = app.getThread()) != null) {
                try {
                    thread.setMonitorAuth(authority, isPrintStack);
                } catch (RemoteException e) {
                    // If the other end already died, then our work here is done.
                }
            }
        }
    }
}

public void setMonitorAuth(String authority, boolean isPrint) {
    AUTH = authority;
    isPrintStack = isPrint;
}

/**
 * Return the next option on the command line -- that is an argument that
 * starts with '-'.  If the next argument is not an option, null is returned.
 */
public String getNextOption() {
    if (mCurArgData != null) {
        String prev = mArgs[mArgPos - 1];
        throw new IllegalArgumentException("No argument expected after \"" + prev + "\"");
    }
    if (mArgPos >= mArgs.length) {
        return null;
    }
    String arg = mArgs[mArgPos];
    if (!arg.startsWith("-")) {
        return null;
    }
    mArgPos++;
    if (arg.equals("--")) {
        return null;
    }
    if (arg.length() > 1 && arg.charAt(1) != '-') {
        if (arg.length() > 2) { //这里处理-avalue类型的参数
            mCurArgData = arg.substring(2); //返回值value
            return arg.substring(0, 2);  //返回option即-a
        } else {
            mCurArgData = null;
            return arg;
        }
    }
    mCurArgData = null;
    return arg; //返回形如-a或--key的option
}

/**
 * Return the next argument on the command line, whatever it is; if there are
 * no arguments left, throws an IllegalArgumentException to report this to the user.
 */
public String getNextArgRequired() {
    String arg = getNextArg();
    if (arg == null) {
        String prev = mArgs[mArgPos - 1];
        throw new IllegalArgumentException("Argument expected after \"" + prev + "\"");
    }
    return arg;
}

/**
 * Return the next argument on the command line, whatever it is; if there are
 * no arguments left, return null.
 */
public String getNextArg() {
    if (mCurArgData != null) {
        String arg = mCurArgData;
        mCurArgData = null;
        return arg;
    } else if (mArgPos < mArgs.length) {
        return mArgs[mArgPos++];
    } else {
        return null;
    }
}