Android 6.0 SIM卡初始化流程

本文主要讲述Android 6.0 SIM卡初始化流程，这个过程也涉及到UICC框架的初始化，UICC(Universal Integrated Circuit Card)的架构图如下：

/**
 * This class is responsible for keeping all knowledge about
 * Universal Integrated Circuit Card (UICC), also know as SIM's,
 * in the system. It is also used as API to get appropriate
 * applications to pass them to phone and service trackers.
 *
 * UiccController is created with the call to make() function.
 * UiccController is a singleton and make() must only be called once
 * and throws an exception if called multiple times.
 *
 * Once created UiccController registers with RIL for "on" and "unsol_sim_status_changed"
 * notifications. When such notification arrives UiccController will call
 * getIccCardStatus (GET_SIM_STATUS). Based on the response of GET_SIM_STATUS
 * request appropriate tree of uicc objects will be created.
 *
 * Following is class diagram for uicc classes:
 *
 *                       UiccController
 *                            #
 *                            |
 *                        UiccCard
 *                          #   #
 *                          |   ------------------
 *                    UiccCardApplication    CatService
 *                      #            #
 *                      |            |
 *                 IccRecords    IccFileHandler
 *                 ^ ^ ^           ^ ^ ^ ^ ^
 *    SIMRecords---- | |           | | | | ---SIMFileHandler
 *    RuimRecords----- |           | | | ----RuimFileHandler
 *    IsimUiccRecords---           | | -----UsimFileHandler
 *                                 | ------CsimFileHandler
 *                                 ----IsimFileHandler
 *
 * Legend: # stands for Composition
 *         ^ stands for Generalization
 *
 * See also {@link com.android.internal.telephony.IccCard}
 * and {@link com.android.internal.telephony.uicc.IccCardProxy}
 */

---

本文来自 http://blog.csdn.net/linyongan ，转载请务必注明出处。

---

一、实例化UiccController对象

UiccController是整个UICC相关信息的控制接口，UiccController的实例化就是在RIL与UiccController 之间建立监听关系，这样的话，当SIM卡状态发生变化时，UiccController就可以马上知道并且做出相应的操作。
UiccController对象是在PhoneFacotry.java中的makeDefaultPhone()方法中初始化的，有个细节值得注意的是sCommandsInterfaces数组的i对应的是PhoneId。

    public static void makeDefaultPhone(Context context) {
        // Instantiate UiccController so that all other classes can just
        //得到UiccController对象
        mUiccController = UiccController.make(context, sCommandsInterfaces);
        for (int i = 0; i < numPhones; i++) {
            PhoneBase phone = null;
            int phoneType = TelephonyManager.getPhoneType(networkModes[i]);
            if (phoneType == PhoneConstants.PHONE_TYPE_GSM) {
                //sCommandsInterfaces的i对应的是PhoneId;第二小节会再次提到这个i值
                phone = TelephonyPluginDelegate.getInstance().makeGSMPhone(context,
                                sCommandsInterfaces[i], sPhoneNotifier, i);
            } else if (phoneType == PhoneConstants.PHONE_TYPE_CDMA) {
                phone = TelephonyPluginDelegate.getInstance().makeCDMALTEPhone(context,
                                sCommandsInterfaces[i], sPhoneNotifier, i);
            }
            Rlog.i(LOG_TAG, "Creating Phone with type = " + phoneType + " sub = " + i);
            sProxyPhones[i] = TelephonyPluginDelegate.getInstance().makePhoneProxy(phone);
        }
   }

    @TelephonyPluginBase.java
    public PhoneBase makeGSMPhone(Context context, CommandsInterface ci,
            PhoneNotifier notifier, int phoneId) {
        return new GSMPhone(context, ci, notifier, phoneId);
    }
    }

在UiccController.java的make()方法中new了一个UiccController对象，

    public static UiccController make(Context c, CommandsInterface[] ci) {
        synchronized (mLock) {
            if (mInstance != null) {
                throw new RuntimeException("MSimUiccController.make() should only be called once");
            }
            //实例化UiccController对象
            mInstance = new UiccController(c, ci);
            return (UiccController)mInstance;
        }
    }

    private UiccController(Context c, CommandsInterface []ci) {
        if (DBG) log("Creating UiccController");
        mContext = c;
        mCis = ci;
        for (int i = 0; i < mCis.length; i++) {
            //index对应的是PhoneId
            Integer index = new Integer(i);
            //注册监听四种事件
            mCis[i].registerForIccStatusChanged(this, EVENT_ICC_STATUS_CHANGED, index);
            mCis[i].registerForAvailable(this, EVENT_ICC_STATUS_CHANGED, index);
            mCis[i].registerForNotAvailable(this, EVENT_RADIO_UNAVAILABLE, index);
            mCis[i].registerForIccRefresh(this, EVENT_SIM_REFRESH, index);
        }
    }

在上面UiccController的构造方法中可以看到，注册了三个事件EVENT_ICC_STATUS_CHANGED（监听SIM卡的状态变化），EVENT_RADIO_UNAVAILABLE（一旦radio变成不可用状态，就清空SIM卡的信息），EVENT_SIM_REFRESH。index对应的是PhoneId，当上面这三种消息上来时，就知道对应哪个Phone对象，也就对应那张卡。
当接收到EVENT_ICC_STATUS_CHANGED消息后，UiccController调用RIL.java的getIccCardStatus()方法给MODEM发送RIL_REQUEST_GET_SIM_STATUS消息，查询SIM卡的状态。

    public void handleMessage (Message msg) {
        .....
        //1.首先从Message中取出PhoneId
        Integer index = getCiIndex(msg);
        .....
        case EVENT_ICC_STATUS_CHANGED:
            if (DBG) log("Received EVENT_ICC_STATUS_CHANGED, calling getIccCardStatus");
            //2.查询当前SIM卡的状态
            mCis[index].getIccCardStatus(obtainMessage(EVENT_GET_ICC_STATUS_DONE, index));
        break;
        case EVENT_GET_ICC_STATUS_DONE:
            if (DBG) log("Received EVENT_GET_ICC_STATUS_DONE");
            //3.处理查询到的状态信息
            onGetIccCardStatusDone(ar, index);
        break;
   }

二、实例化UiccCard对象

当查询SIM卡的状态完毕后，先从result中解析出IccCardStatus，依据IccCardStatus来创建UiccCard对象，一个UiccCard 对象代表着一张SIM卡；如果UiccCard对象已存在就直接调它的update()方法更新UiccCard的信息。

    private synchronized void onGetIccCardStatusDone(AsyncResult ar, Integer index) {
        if (ar.exception != null) {
            Rlog.e(LOG_TAG,"Error getting ICC status. "
                    + "RIL_REQUEST_GET_ICC_STATUS should "
                    + "never return an error", ar.exception);
            return;
        }
        if (!isValidCardIndex(index)) {
            Rlog.e(LOG_TAG,"onGetIccCardStatusDone: invalid index : " + index);
            return;
        }

        IccCardStatus status = (IccCardStatus)ar.result;
        //1.创建或更新UiccCard
        if (mUiccCards[index] == null) {
            //Create new card（Android6.0 调的是4个参数的构造方法）
            mUiccCards[index] = new UiccCard(mContext, mCis[index], status, index);
        } else {
            //Update already existing card
            mUiccCards[index].update(mContext, mCis[index] , status);
        }

        if (DBG) log("Notifying IccChangedRegistrants");
        //2.通知监听UiccController的监听者
        mIccChangedRegistrants.notifyRegistrants(new AsyncResult(null, index, null));

    }

在UiccCard的构造方法中，最终还是调用了update()方法

    public UiccCard(Context c, CommandsInterface ci, IccCardStatus ics, int phoneId) {
        mCardState = ics.mCardState;
        mPhoneId = phoneId;
        update(c, ci, ics);
    }

    public void update(Context c, CommandsInterface ci, IccCardStatus ics) {
        synchronized (mLock) {
            CardState oldState = mCardState;
            mCardState = ics.mCardState;
            mUniversalPinState = ics.mUniversalPinState;
            mGsmUmtsSubscriptionAppIndex = ics.mGsmUmtsSubscriptionAppIndex;
            mCdmaSubscriptionAppIndex = ics.mCdmaSubscriptionAppIndex;
            mImsSubscriptionAppIndex = ics.mImsSubscriptionAppIndex;
            mContext = c;
            mCi = ci;

            //更新UiccApplications
            if (DBG) log(ics.mApplications.length + " applications");
            for ( int i = 0; i < mUiccApplications.length; i++) {
                if (mUiccApplications[i] == null) {
                    //Create newly added Applications
                    if (i < ics.mApplications.length) {
                        mUiccApplications[i] = new UiccCardApplication(this,
                                ics.mApplications[i], mContext, mCi);
                    }
                } else if (i >= ics.mApplications.length) {
                    //Delete removed applications
                    mUiccApplications[i].dispose();
                    mUiccApplications[i] = null;
                } else {
                    //Update the rest
                    mUiccApplications[i].update(ics.mApplications[i], mContext, mCi);
                }
            }
            //创建CatService,用于读取STK的信息
            createAndUpdateCatService();

            // Reload the carrier privilege rules if necessary.
            log("Before privilege rules: " + mCarrierPrivilegeRules + " : " + mCardState);
            if (mCarrierPrivilegeRules == null && mCardState == CardState.CARDSTATE_PRESENT) {
                mCarrierPrivilegeRules = new UiccCarrierPrivilegeRules(this,
                        mHandler.obtainMessage(EVENT_CARRIER_PRIVILIGES_LOADED));
            } else if (mCarrierPrivilegeRules != null && mCardState != CardState.CARDSTATE_PRESENT) {
                mCarrierPrivilegeRules = null;
            }

            sanitizeApplicationIndexes();
            //先获取radio的状态
            RadioState radioState = mCi.getRadioState();
            if (DBG) log("update: radioState=" + radioState + " mLastRadioState="
                    + mLastRadioState);
            // No notifications while radio is off or we just powering up
            //根据radio的状态和卡的状态来判断有没有插拔SIM卡动作
            if (radioState == RadioState.RADIO_ON && mLastRadioState == RadioState.RADIO_ON) {
                if (oldState != CardState.CARDSTATE_ABSENT &&
                        mCardState == CardState.CARDSTATE_ABSENT) {
                    if (DBG) log("update: notify card removed");
                    mAbsentRegistrants.notifyRegistrants();
                    mHandler.sendMessage(mHandler.obtainMessage(EVENT_CARD_REMOVED, null));
                } else if (oldState == CardState.CARDSTATE_ABSENT &&
                        mCardState != CardState.CARDSTATE_ABSENT) {
                    if (DBG) log("update: notify card added");
                    mHandler.sendMessage(mHandler.obtainMessage(EVENT_CARD_ADDED, null));
                }
           }
            mLastRadioState = radioState;
        }
    }

在UiccCard.java的update()方法中，实例化了UiccCardApplication对象，或者调UiccCardApplication的update()方法更新状态。mCardState记录着卡的状态，根据新旧mCardState就可以知道CARD_ADDED或者CARD_REMOVED。

三、实例化UiccCardApplication对象

    UiccCardApplication(UiccCard uiccCard,
                        IccCardApplicationStatus as,
                        Context c,
                        CommandsInterface ci) {
        if (DBG) log("Creating UiccApp: " + as);
        mUiccCard = uiccCard;
        mAppState = as.app_state;
        mAppType = as.app_type;
        mAuthContext = getAuthContext(mAppType);
        mPersoSubState = as.perso_substate;
        mAid = as.aid;
        mAppLabel = as.app_label;
        mPin1Replaced = (as.pin1_replaced != 0);
        mPin1State = as.pin1;
        mPin2State = as.pin2;

        mContext = c;
        mCi = ci;
        //根据AppType实例化IccFileHandler
        mIccFh = createIccFileHandler(as.app_type);
        //根据AppType实例化IccRecords
        mIccRecords = createIccRecords(as.app_type, mContext, mCi);
        if (mAppState == AppState.APPSTATE_READY) {
            queryFdn();
            //查询PIN1码的状态
            queryPin1State();
        }
        //注册监听
        mCi.registerForNotAvailable(mHandler, EVENT_RADIO_UNAVAILABLE, null);
    }

在UiccCardApplication初始化的时候，会调用自身的createIccRecords()方法，根据AppType创建对应的IccRecords 对象。

    private IccRecords createIccRecords(AppType type, Context c, CommandsInterface ci) {
        if (type == AppType.APPTYPE_USIM || type == AppType.APPTYPE_SIM) {
            //实例化SIMRecords对象
            return TelephonyPluginDelegate.getInstance().makeSIMRecords(this, c, ci);
        } else if (type == AppType.APPTYPE_RUIM || type == AppType.APPTYPE_CSIM){
            return new RuimRecords(this, c, ci);
        } else if (type == AppType.APPTYPE_ISIM) {
            return new IsimUiccRecords(this, c, ci);
        } else {
            // Unknown app type (maybe detection is still in progress)
            return null;
        }
    }

接着会进入TelephonyPluginDelegate.java和TelephonyPluginBase.java的makeSIMRecords()方法

    @TelephonyPluginDelegate.java
    public SIMRecords makeSIMRecords (UiccCardApplication app, Context c, CommandsInterface ci) {
        return sPlugin.makeSIMRecords (app, c, ci);
    }

    @TelephonyPluginBase.java
    public SIMRecords makeSIMRecords (UiccCardApplication app, Context c, CommandsInterface ci) {
        return new SIMRecords(app, c, ci);
    }

到这里就可以看到直接new 了一个SIMRecords对象。

四、实例化SIMRecords对象

    public SIMRecords(UiccCardApplication app, Context c, CommandsInterface ci) {
        super(app, c, ci);
        mAdnCache = new AdnRecordCache(mFh);
        mVmConfig = new VoiceMailConstants();
        //从spn-conf.xml文件中加载SPN
        mSpnOverride = new SpnOverride();
        // No load request is made till SIM ready
        mRecordsRequested = false; 
        // recordsToLoad is set to 0 because no requests are made yet
        mRecordsToLoad = 0;

        mCi.setOnSmsOnSim(this, EVENT_SMS_ON_SIM, null);
        mCi.registerForIccRefresh(this, EVENT_SIM_REFRESH, null);

        //初始化成员变量
        resetRecords();
        //注册监听，如果已ready，那么开始加载数据
        mParentApp.registerForReady(this, EVENT_APP_READY, null);
        mParentApp.registerForLocked(this, EVENT_APP_LOCKED, null);
        if (DBG) log("SIMRecords X ctor this=" + this);
    }

等到AppState变成APPSTATE_READY是，UiccCardApplication会在notifyReadyRegistrantsIfNeeded()方法里通知SIMRecords，那么在SIMRecords的handleMessage()方法就会收到EVENT_APP_READY消息。

    public void handleMessage(Message msg) {
            case EVENT_APP_READY:
                onReady();
                break;
    }

    @Override
    public void onReady() {
        fetchSimRecords();
    }

五、读取EF文件信息

当执行到fetchSimRecords()方法时，才真正开始加载EF文件信息。
具体的读取SIM卡EF文件信息的过程是由 IccFileHandler 来实现的，根据EF文件的类型，调用不同的方法，loadEFTransparent()和loadEFLinearFixed()最终都会调用RIL.java的iccIOForApp()方法。
读取某一项信息时会调用两次RIL.java的iccIOForApp()：
第一次：先读取当前分区的长度lc.mRecordSize。

   Message response = obtainMessage(EVENT_GET_RECORD_SIZE_DONE,
      new LoadLinearFixedContext(fileid, recordNum, efPath, onLoaded));

   mCi.iccIOForApp(COMMAND_GET_RESPONSE, fileid, efPath,
       0, 0, 
       GET_RESPONSE_EF_SIZE_BYTES,
       null, null, mAid, response);

第二次：再根据lc.mRecordSize去读取具体内容。

case EVENT_GET_RECORD_SIZE_DONE:
    ......
    mCi.iccIOForApp(COMMAND_READ_RECORD, lc.mEfid, path,
       lc.mRecordNum,READ_RECORD_MODE_ABSOLUTE,
       lc.mRecordSize, 
       null, null, mAid,obtainMessage(EVENT_READ_RECORD_DONE, lc));

某一项信息的加载流程如下流程图。

    protected void fetchSimRecords() {
        mRecordsRequested = true;
        if (DBG) log("fetchSimRecords " + mRecordsToLoad);
        //读取IMSI
        mCi.getIMSIForApp(mParentApp.getAid(), obtainMessage(EVENT_GET_IMSI_DONE));
        //每开始load一条记录，mRecordsToLoad加1，等加载完一条记录后
        //mRecordsToLoad就减1，当mRecordsToLoad等于0时说明已加载完所有数据了。
        mRecordsToLoad++;
        //从EF_ICCID（0x2fe2）读取ICCID
        mFh.loadEFTransparent(EF_ICCID, obtainMessage(EVENT_GET_ICCID_DONE));
        mRecordsToLoad++;

        // FIXME should examine EF[MSISDN]'s capability configuration
        // to determine which is the voice/data/fax line
        new AdnRecordLoader(mFh).loadFromEF(EF_MSISDN, getExtFromEf(EF_MSISDN), 1,
                    obtainMessage(EVENT_GET_MSISDN_DONE));
        mRecordsToLoad++;

        //读取VoiceMail信息
        mFh.loadEFLinearFixed(EF_MBI, 1, obtainMessage(EVENT_GET_MBI_DONE));
        mRecordsToLoad++;

        mFh.loadEFTransparent(EF_AD, obtainMessage(EVENT_GET_AD_DONE));
        mRecordsToLoad++;

        // Record number is subscriber profile
        mFh.loadEFLinearFixed(EF_MWIS, 1, obtainMessage(EVENT_GET_MWIS_DONE));
        mRecordsToLoad++;


        // Also load CPHS-style voice mail indicator, which stores
        // the same info as EF[MWIS]. If both exist, both are updated
        // but the EF[MWIS] data is preferred
        // Please note this must be loaded after EF[MWIS]
        mFh.loadEFTransparent(
                EF_VOICE_MAIL_INDICATOR_CPHS,
                obtainMessage(EVENT_GET_VOICE_MAIL_INDICATOR_CPHS_DONE));
        mRecordsToLoad++;

        // Same goes for Call Forward Status indicator: fetch both
        // EF[CFIS] and CPHS-EF, with EF[CFIS] preferred.
        loadCallForwardingRecords();
        //从EF_SPN(0x6F46)、EF_SPN_CPHS(0x6f14)、EF_SPN_SHORT_CPHS(0x6f18)三个地址上读取SPN
        getSpnFsm(true, null);
        //从EF_SPDI（0x6fcd）读取SPDI
        mFh.loadEFTransparent(EF_SPDI, obtainMessage(EVENT_GET_SPDI_DONE));
        mRecordsToLoad++;
        //从EF_PNN（0x6fc5）读取PNN
        mFh.loadEFLinearFixed(EF_PNN, 1, obtainMessage(EVENT_GET_PNN_DONE));
        mRecordsToLoad++;

        mFh.loadEFTransparent(EF_SST, obtainMessage(EVENT_GET_SST_DONE));
        mRecordsToLoad++;

        mFh.loadEFTransparent(EF_INFO_CPHS, obtainMessage(EVENT_GET_INFO_CPHS_DONE));
        mRecordsToLoad++;

        mFh.loadEFTransparent(EF_CSP_CPHS,obtainMessage(EVENT_GET_CSP_CPHS_DONE));
        mRecordsToLoad++;

        mFh.loadEFTransparent(EF_GID1, obtainMessage(EVENT_GET_GID1_DONE));
        mRecordsToLoad++;

        mFh.loadEFTransparent(EF_GID2, obtainMessage(EVENT_GET_GID2_DONE));
        mRecordsToLoad++;

        loadEfLiAndEfPl();

        // XXX should seek instead of examining them all
        if (false) { // XXX
            mFh.loadEFLinearFixedAll(EF_SMS, obtainMessage(EVENT_GET_ALL_SMS_DONE));
            mRecordsToLoad++;
        }

        if (CRASH_RIL) {
            String sms = "0107912160130310f20404d0110041007030208054832b0120"
                         + "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
                         + "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
                         + "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
                         + "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
                         + "ffffffffffffffffffffffffffffff";
            byte[] ba = IccUtils.hexStringToBytes(sms);

            mFh.updateEFLinearFixed(EF_SMS, 1, ba, null,
                            obtainMessage(EVENT_MARK_SMS_READ_DONE, 1));
        }
        if (DBG) log("fetchSimRecords " + mRecordsToLoad + " requested: " + mRecordsRequested);
    }

六、读取数据完毕

读取ICCID : ICCID通常有20位，根据TS 102.221，ICCID 是BCD编码的，只允许出现数字和字符F，如果出现其他字母，就会在下面IccUtils.bcdToString()方法中被截断。（如中国移动的SIM卡，会使用字符b代表188号段，那么应用层得到的ICCID就不是20位的了）

            case EVENT_GET_ICCID_DONE:
                isRecordLoadResponse = true;

                ar = (AsyncResult)msg.obj;
                data = (byte[])ar.result;

                if (ar.exception != null) {
                    break;
                }
                //查询到的ICCID
                mIccId = IccUtils.bcdToString(data, 0, data.length);

                log("iccid: " + mIccId);

            break;

mIccId的值最后会通过IccRecords.java的getIccId()方法，提供给应用层使用。

    public String getIccId() {
        return mIccId;
    }

读取SPDI ： SPDI存储的是由numeric network ID组成的列表。

            case EVENT_GET_SPDI_DONE:
                isRecordLoadResponse = true;
                ar = (AsyncResult)msg.obj;
                data = (byte[])ar.result;
                if (ar.exception != null) {
                    break;
                }
                parseEfSpdi(data);
            break;

    /**
     * Parse TS 51.011 EF[SPDI] record
     * This record contains the list of numeric network IDs that
     * are treated specially when determining SPN display
     */
    private void
    parseEfSpdi(byte[] data) {
        SimTlv tlv = new SimTlv(data, 0, data.length);

        byte[] plmnEntries = null;

        for ( ; tlv.isValidObject() ; tlv.nextObject()) {
            // Skip SPDI tag, if existant
            if (tlv.getTag() == TAG_SPDI) {
              tlv = new SimTlv(tlv.getData(), 0, tlv.getData().length);
            }
            // There should only be one TAG_SPDI_PLMN_LIST
            if (tlv.getTag() == TAG_SPDI_PLMN_LIST) {
                plmnEntries = tlv.getData();
                break;
            }
        }

        if (plmnEntries == null) {
            return;
        }
        //把查询到的值存储到mSpdiNetworks这个列表中
        mSpdiNetworks = new ArrayList(plmnEntries.length / 3);

        for (int i = 0 ; i + 2 < plmnEntries.length ; i += 3) {
            String plmnCode;
            plmnCode = IccUtils.bcdToString(plmnEntries, i, 3);

            // Valid operator codes are 5 or 6 digits
            if (plmnCode.length() >= 5) {
                log("EF_SPDI network: " + plmnCode);
                mSpdiNetworks.add(plmnCode);
            }
        }
    }

最终会把值存储到mSpdiNetworks这个列表中，mSpdiNetworks在判断PLMN和SPN显示规则时会使用到。

读取VoiceMail：后续写VoiceMail相关文章时会详细讲解。
读取SPN：后续写SPN相关文章时会详细讲解。

读取PNN：读取到PNN的值后，赋值给了mPnnHomeName，但是mPnnHomeName并没有被其他地方调用。

            case EVENT_GET_PNN_DONE:
                isRecordLoadResponse = true;

                ar = (AsyncResult)msg.obj;
                data = (byte[])ar.result;

                if (ar.exception != null) {
                    break;
                }

                SimTlv tlv = new SimTlv(data, 0, data.length);

                for ( ; tlv.isValidObject() ; tlv.nextObject()) {
                    if (tlv.getTag() == TAG_FULL_NETWORK_NAME) {
                        //从SIM卡中查询到的PNN
                        mPnnHomeName
                            = IccUtils.networkNameToString(
                                tlv.getData(), 0, tlv.getData().length);
                        break;
                    }
                }
            break;

可以自己新增代码，把mPnnHomeName通过setSystemProperty(key,value)方法存储到一个key里，然后在应用层就可以通过这个key，获取到PNN的值。

//存储mPnnHomeName的值
setSystemProperty(TelephonyProperties.PNN_NAME, mPnnHomeName);
//获取PNN的值，下面这行代码返回的是String
TelephonyManager.getTelephonyProperty(mPhone.getPhoneId(),
TelephonyProperties.PNN_NAME, "");

回到fetchSimRecords()方法，每加载一项，mRecordsToLoad就加1；等到某一项读取数据完毕，handleMessage()方法被执行，就会调onRecordLoaded()方法

    protected void onRecordLoaded() {
        // One record loaded successfully or failed, In either case
        // we need to update the recordsToLoad count
        //每查询完一条记录，mRecordsToLoad减1
        mRecordsToLoad -= 1;
        if (DBG) log("onRecordLoaded " + mRecordsToLoad + " requested: " + mRecordsRequested);
        //当mRecordsToLoad等于0，说明在fetchSimRecords()方法
        //中启动加载的数据都已经加载完了。
        if (mRecordsToLoad == 0 && mRecordsRequested == true) {
            onAllRecordsLoaded();
        } else if (mRecordsToLoad < 0) {
            loge("recordsToLoad <0, programmer error suspected");
            mRecordsToLoad = 0;
        }
    }

mRecordsToLoad的值会减1，直到mRecordsToLoad的值为0时，说明在fetchSimRecords()中启动加载的数据都已异步读取完成。就会进入onAllRecordsLoaded()方法。

    @Override
    protected void onAllRecordsLoaded() {
        if (DBG) log("record load complete");

        Resources resource = Resources.getSystem();
        if (resource.getBoolean(com.android.internal.R.bool.config_use_sim_language_file)) {
            setSimLanguage(mEfLi, mEfPl);
        } else {
            if (DBG) log ("Not using EF LI/EF PL");
        }

        setVoiceCallForwardingFlagFromSimRecords();

        if (mParentApp.getState() == AppState.APPSTATE_PIN ||
               mParentApp.getState() == AppState.APPSTATE_PUK) {
            // reset recordsRequested, since sim is not loaded really
            mRecordsRequested = false;
            // lock state, only update language
            return ;
        }

        // Some fields require more than one SIM record to set
        //获取MCC + MNC
        String operator = getOperatorNumeric();
        if (!TextUtils.isEmpty(operator)) {
            log("onAllRecordsLoaded set 'gsm.sim.operator.numeric' to operator='" +
                    operator + "'");
            log("update icc_operator_numeric=" + operator);
            mTelephonyManager.setSimOperatorNumericForPhone(
                    mParentApp.getPhoneId(), operator);
            final SubscriptionController subController = SubscriptionController.getInstance();
            subController.setMccMnc(operator, subController.getDefaultSmsSubId());
        } else {
            log("onAllRecordsLoaded empty 'gsm.sim.operator.numeric' skipping");
        }

        if (!TextUtils.isEmpty(mImsi)) {
            log("onAllRecordsLoaded set mcc imsi" + (VDBG ? ("=" + mImsi) : ""));
            mTelephonyManager.setSimCountryIsoForPhone(
                    mParentApp.getPhoneId(), MccTable.countryCodeForMcc(
                    Integer.parseInt(mImsi.substring(0,3))));
        } else {
            log("onAllRecordsLoaded empty imsi skipping setting mcc");
        }

        setVoiceMailByCountry(operator);
        setSpnFromConfig(operator);
        //通知应用层
        mRecordsLoadedRegistrants.notifyRegistrants(
            new AsyncResult(null, null, null));
    }

在onAllRecordsLoaded()方法中会对读取到的数据进行处理和存储，到这里，SIM卡初始化的流程就结束了。