Android四大组件Service启动源码分析

1 用法

启动状态

Intent intent=new Intent(this,MyService.class);

startService(intent);

绑定状态

Intent intent=new Intent(this,MyService.class);

bindService(intent,mServiceConnection,BIND_AUTO_CREATE);

private ServiceConnection mServiceConnection= new ServiceConnection() {  
    // 当与service的连接建立后被调用  
    public void onServiceConnected(ComponentName className, IBinder service) {  
        //TODO
    }  
  
    // 当与service的连接意外断开时被调用  
    public void onServiceDisconnected(ComponentName className) {  
       //TODO
    }  
};  

2 源码分析

(1)先看启动状态

service启动状态时序图如下

1  ContextWrapper

    public ComponentName startService(Intent service) {        return mBase.startService(service);    }

Service的启动从ContextWrapper的startService开始，mBase是ContextImpl类，Activity通过attach方法和ContextImpl关联起来。以后会详细讲解Context族谱的关系。所以重点在ContextImpl中的startService方法中。

2 ContextImpl

@Override public ComponentName startService(Intent service) {        warnIfCallingFromSystemProcess();        return startServiceCommon(service, mUser);    }private ComponentName startServiceCommon(Intent service, UserHandle user) {.....            ComponentName cn = ActivityManagerNative.getDefault().startService(                mMainThread.getApplicationThread(), service, service.resolveTypeIfNeeded(                            getContentResolver()), getOpPackageName(), user.getIdentifier());        .....            return cn;            }

Activity篇分析过，ActivityManagerNative.getDefault()获得了ActivityManagerProxy（ActivityManagerNative的内部类），ActivityManagerProxy的startService真正是在AMS中执行

3  ActivityManagerProxy

public ComponentName startService(IApplicationThread caller, Intent service,            String resolvedType, int userId) throws RemoteException    {        Parcel data = Parcel.obtain();        Parcel reply = Parcel.obtain();        data.writeInterfaceToken(IActivityManager.descriptor);        data.writeStrongBinder(caller != null ? caller.asBinder() : null);        service.writeToParcel(data, 0);        data.writeString(resolvedType);        data.writeInt(userId);        mRemote.transact(START_SERVICE_TRANSACTION, data, reply, 0);        reply.readException();        ComponentName res = ComponentName.readFromParcel(reply);        data.recycle();        reply.recycle();        return res;    }

4  ActivityManagerService

public ComponentName startService(IApplicationThread caller, Intent service,            String resolvedType, int userId) {        ......            ComponentName res = mServices.startServiceLocked(caller, service,                    resolvedType, callingPid, callingUid, userId);        ......            return res;        }    }

ActivityManagerService的startService方法中，mServices是一个ActiveServices类，用于辅助AMS管理Service,类似于管理Activity的ActivityStakSupervisor。

5 ActiveServices

private final void realStartServiceLocked(ServiceRecord r,            ProcessRecord app, boolean execInFg) throws RemoteException {        ......            app.thread.scheduleCreateService(r, r.serviceInfo,                    mAm.compatibilityInfoForPackageLocked(r.serviceInfo.applicationInfo),                    app.repProcState);            r.postNotification();            created = true;        ......        sendServiceArgsLocked(r, execInFg, true);        ......    }

mServices.startServiceLocked执行一系列方法后，最后在realStartServiceLocked真正创建了service实例。类似Activity篇，app.thread是ApplicationThreadProxy，ServiceRecord是记录Service的数据结构。

6  ApplicationThreadProxy（ApplicationThreadNative内部类）

public final void scheduleCreateService(IBinder token, ServiceInfo info,            CompatibilityInfo compatInfo, int processState) throws RemoteException {        Parcel data = Parcel.obtain();        data.writeInterfaceToken(IApplicationThread.descriptor);        data.writeStrongBinder(token);        info.writeToParcel(data, 0);        compatInfo.writeToParcel(data, 0);        data.writeInt(processState);        mRemote.transact(SCHEDULE_CREATE_SERVICE_TRANSACTION, data, null,                IBinder.FLAG_ONEWAY);        data.recycle();    }

和Activity篇一样，这里是一个binder通信，ApplicationThreadProxy和ApplicationThread的通信，所以真正的执行在ApplicationThread的scheduleCreateService中

7  ApplicationThread（ActivityThread内部类）

public final void scheduleCreateService(IBinder token,                ServiceInfo info, CompatibilityInfo compatInfo, int processState) {            updateProcessState(processState, false);            CreateServiceData s = new CreateServiceData();            s.token = token;            s.info = info;            s.compatInfo = compatInfo;            sendMessage(H.CREATE_SERVICE, s);        }

8 ActivityThread

private void sendMessage(int what, Object obj, int arg1, int arg2, boolean async) {        ......        mH.sendMessage(msg);    }

很显然，这个过程和Activity的启动过程类似，都是通过发送消息给Handler H来完成。

private class H extends Handler {    ......        public void handleMessage(Message msg) {            switch (msg.what) {                case LAUNCH_ACTIVITY: {                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityStart");                    ActivityClientRecord r = (ActivityClientRecord)msg.obj;                    r.packageInfo = getPackageInfoNoCheck(                            r.activityInfo.applicationInfo, r.compatInfo);                    handleLaunchActivity(r, null);                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);                } break;               ......                case CREATE_SERVICE:                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceCreate");                    handleCreateService((CreateServiceData)msg.obj);                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);                    break;                case BIND_SERVICE:                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceBind");                    handleBindService((BindServiceData)msg.obj);                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);                    break;                case UNBIND_SERVICE:                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceUnbind");                    handleUnbindService((BindServiceData)msg.obj);                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);                    break;                case SERVICE_ARGS:                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceStart");                    handleServiceArgs((ServiceArgsData)msg.obj);                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);                    break;                case STOP_SERVICE:                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceStop");                    handleStopService((IBinder)msg.obj);                    maybeSnapshot();                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);                    break;               ......        }    }

这里进入CREATE_SERVICE分支，执行了handleCreateService方法，所以重点在handleCreateService方法中

private void handleCreateService(CreateServiceData data) {              LoadedApk packageInfo = getPackageInfoNoCheck(                data.info.applicationInfo, data.compatInfo);        Service service = null;  //首先通过类加载器创建了Service的实例            java.lang.ClassLoader cl = packageInfo.getClassLoader();            service = (Service) cl.loadClass(data.info.name).newInstance();        .....//接着创建了ContextImpl对象，并通过Service的attach方法建立了二者的关系            ContextImpl context = new ContextImpl();            context.init(packageInfo, null, this);                Application app = packageInfo.makeApplication(false, mInstrumentation);            context.setOuterContext(service);            service.attach(context, this, data.info.name, data.token, app,                    ActivityManagerNative.getDefault());

//最后调用Service的onCreate方法并将Service对象存储到mServices中 service.onCreate(); mServices.put(data.token, service)
这里涉及到LoadedApk ，ClassLoader ，ContextImpl，mServices
final ArrayMap<IBinder, Service> mServices
            = new ArrayMap<IBinder, Service>();
这里Service的启动状态就分析完了

（2）绑定状态

和Service启动状态一样，绑定状态也是从ContextWrapper开始

1 ContextWrapper

@Override    public boolean bindService(Intent service, ServiceConnection conn,            int flags) {        return mBase.bindService(service, conn, flags);    }

mBase是ContextImpl，上面已经说过了。

2 ContextImpl
ContextImpl的bindService最终会调用到自己的bindServiceCommon

private boolean bindServiceCommon(Intent service, ServiceConnection conn, int flags,            UserHandle user) {        IServiceConnection sd;        //这里将客户端的ServiceConnection转化为ServiceDispatcher。InnerConnection对象        //之所以要转化,因为这里可能涉及到跨进程          if (mPackageInfo != null) { sd = mPackageInfo.getServiceDispatcher(conn, getOuterContext(),      mMainThread.getHandler(), flags); }       ......       int res = ActivityManagerNative.getDefault().bindService( mMainThread.getApplicationThread(),         getActivityToken(), service, service.resolveTypeIfNeeded(getContentResolver()       ), sd, flags, getOpPackageName(), user.getIdentifier());         ...... }

3  LoadedApk
这里，mPackageInfo是个LoadedApk类，从getServiceDispatcher方法可看出，map中保存了客户端conn和LoadedApk.ServiceDispatcher的一份映射,首先在map查找是否有相应的conn，没有就创建一个ServiceDispatcher，并放入mServices中

public final IServiceConnection getServiceDispatcher(ServiceConnection c,            Context context, Handler handler, int flags) {        synchronized (mServices) {            LoadedApk.ServiceDispatcher sd = null;            ArrayMap<ServiceConnection, LoadedApk.ServiceDispatcher> map = mServices.get(context);            if (map != null) {                sd = map.get(c);            }            if (sd == null) {                sd = new ServiceDispatcher(c, context, handler, flags);                if (map == null) {                    map = new ArrayMap<ServiceConnection, LoadedApk.ServiceDispatcher>();                    mServices.put(context, map);                }                map.put(c, sd);            } else {                sd.validate(context, handler);            }            return sd.getIServiceConnection();        }    }

sd.getIServiceConnection得到ServiceDispatcher.InnerConnection实例。InnerConnection是一个binder，是一个IServiceConnection类型（这里的InnerConnection不是代理，是真正的binder）
mServices的类型
    private final ArrayMap<Context, ArrayMap<ServiceConnection, LoadedApk.ServiceDispatcher>> mServices
        = new ArrayMap<Context, ArrayMap<ServiceConnection, LoadedApk.ServiceDispatcher>>();
这里涉及到ServiceConnection,LoadedApk，ServiceDispatcher，InnerConnection，详细讲解下他们的关系

4  ServiceDispatcher（LoadedApk内部类）

getServiceDispatcher方法中，如果mServices不存在客户端conn，就创建ServiceDispatcher，sd = new ServiceDispatcher(c, context, handler, flags);

 ServiceDispatcher(ServiceConnection conn,                Context context, Handler activityThread, int flags) {            mIServiceConnection = new InnerConnection(this);            mConnection = conn;            mContext = context;            mActivityThread = activityThread;            mLocation = new ServiceConnectionLeaked(null);            mLocation.fillInStackTrace();            mFlags = flags;        } IServiceConnection getIServiceConnection() {            return mIServiceConnection;        }

5  InnerConnection（ServiceDispatcher内部类）

ServiceDispatcher构造函数中会创建一个InnerConnection实例，从IServiceConnection.Stub可以看出，InnerConnection是一个binder

  private static class InnerConnection extends IServiceConnection.Stub {            final WeakReference<LoadedApk.ServiceDispatcher> mDispatcher;            InnerConnection(LoadedApk.ServiceDispatcher sd) {                mDispatcher = new WeakReference<LoadedApk.ServiceDispatcher>(sd);            }            public void connected(ComponentName name, IBinder service) throws RemoteException {                LoadedApk.ServiceDispatcher sd = mDispatcher.get();                if (sd != null) {                    sd.connected(name, service);                }            }        }

6  ActivityManagerProxy

回到ContextImpl，3-4-5步只是将客户端ServiceConnection转化为InnerConnection（binder），接下来是重点，ActivityManagerNative.getDefault().bindService

   public int bindService(IApplicationThread caller, IBinder token,            Intent service, String resolvedType, IServiceConnection connection,            int flags, int userId) throws RemoteException {        Parcel data = Parcel.obtain();        Parcel reply = Parcel.obtain();        data.writeInterfaceToken(IActivityManager.descriptor);        data.writeStrongBinder(caller != null ? caller.asBinder() : null);        data.writeStrongBinder(token);        service.writeToParcel(data, 0);        data.writeString(resolvedType);        data.writeStrongBinder(connection.asBinder());        data.writeInt(flags);        data.writeInt(userId);        mRemote.transact(BIND_SERVICE_TRANSACTION, data, reply, 0);        reply.readException();        int res = reply.readInt();        data.recycle();        reply.recycle();        return res;    }

7 ActivityManagerService

按部就班，从ActivityManagerProxy的bindService    到   ActivityManagerService的bindService

 public int bindService(IApplicationThread caller, IBinder token,            Intent service, String resolvedType,            IServiceConnection connection, int flags, int userId) {        ......        synchronized(this) {            return mServices.bindServiceLocked(caller, token, service, resolvedType,                    connection, flags, userId);        }    }

8 ActiveServices

mServices是ActiveServices类型，mServices.bindServiceLocked执行经过一系列方法，最后又到了realStartServiceLocked方法

  private final void realStartServiceLocked(ServiceRecord r,            ProcessRecord app, boolean execInFg) throws RemoteException {        .......//startService启动方式            app.thread.scheduleCreateService(r, r.serviceInfo,                    mAm.compatibilityInfoForPackageLocked(r.serviceInfo.applicationInfo),                    app.repProcState);        ......//bindService启动方式        requestServiceBindingsLocked(r, execInFg);......        //onStartCommand        sendServiceArgsLocked(r, execInFg, true);......    }

和启动service是通过app.thread.scheduleCreateService不同，绑定service是通过requestServiceBindingsLocked执行

private final boolean requestServiceBindingLocked(ServiceRecord r,            IntentBindRecord i, boolean execInFg, boolean rebind) {        ......                r.app.thread.scheduleBindService(r, i.intent.getIntent(), rebind,                        r.app.repProcState);                ......        return true;    }

app.thread出现多次了，ApplicationThreadProxy!   ApplicationThreadProxy!    ApplicationThreadProxy!重要的事说三遍。

9 ApplicationThreadProxy（ApplicationThreadNative内部类）

 public final void scheduleBindService(IBinder token, Intent intent, boolean rebind,            int processState) throws RemoteException {        Parcel data = Parcel.obtain();        data.writeInterfaceToken(IApplicationThread.descriptor);        data.writeStrongBinder(token);        intent.writeToParcel(data, 0);        data.writeInt(rebind ? 1 : 0);        data.writeInt(processState);        mRemote.transact(SCHEDULE_BIND_SERVICE_TRANSACTION, data, null,                IBinder.FLAG_ONEWAY);        data.recycle();    }

10  ApplicationThread

 public final void scheduleBindService(IBinder token, Intent intent,                boolean rebind, int processState) {            updateProcessState(processState, false);            BindServiceData s = new BindServiceData();            s.token = token;            s.intent = intent;            s.rebind = rebind;            if (DEBUG_SERVICE)                Slog.v(TAG, "scheduleBindService token=" + token + " intent=" + intent + " uid="                        + Binder.getCallingUid() + " pid=" + Binder.getCallingPid());            sendMessage(H.BIND_SERVICE, s);        }

11  ActivityThread

又到了我们最熟悉的地方了，贴代码，不想说

  private void sendMessage(int what, Object obj, int arg1, int arg2, boolean async) {        if (DEBUG_MESSAGES) Slog.v(            TAG, "SCHEDULE " + what + " " + mH.codeToString(what)            + ": " + arg1 + " / " + obj);        Message msg = Message.obtain();        msg.what = what;        msg.obj = obj;        msg.arg1 = arg1;        msg.arg2 = arg2;        if (async) {            msg.setAsynchronous(true);        }        mH.sendMessage(msg);    }

private class H extends Handler {    ......        public void handleMessage(Message msg) {            switch (msg.what) {                case LAUNCH_ACTIVITY: {                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "activityStart");                    ActivityClientRecord r = (ActivityClientRecord)msg.obj;                    r.packageInfo = getPackageInfoNoCheck(                            r.activityInfo.applicationInfo, r.compatInfo);                    handleLaunchActivity(r, null);                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);                } break;               ......                case CREATE_SERVICE:                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceCreate");                    handleCreateService((CreateServiceData)msg.obj);                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);                    break;                case BIND_SERVICE:                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceBind");                    handleBindService((BindServiceData)msg.obj);                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);                    break;                case UNBIND_SERVICE:                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceUnbind");                    handleUnbindService((BindServiceData)msg.obj);                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);                    break;                case SERVICE_ARGS:                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceStart");                    handleServiceArgs((ServiceArgsData)msg.obj);                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);                    break;                case STOP_SERVICE:                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceStop");                    handleStopService((IBinder)msg.obj);                    maybeSnapshot();                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);                    break;               ......        }    }

BIND_SERVICE对应于handleBindService

private void handleBindService(BindServiceData data) {        Service s = mServices.get(data.token);             ......                data.intent.setExtrasClassLoader(s.getClassLoader());                    if (!data.rebind) {                        IBinder binder = s.onBind(data.intent);                        ActivityManagerNative.getDefault().publishService(                                data.token, data.intent, binder);                    } else {                        s.onRebind(data.intent);                        ActivityManagerNative.getDefault().serviceDoneExecuting(                                data.token, 0, 0, 0);                    }                    ensureJitEnabled();               ......                  }    }

在第8步realStartServiceLocked方法中app.thread.scheduleCreateService会创建service，这个在启动模式中已经分析过了。还记得创建service时会把service放入mServices中吗？再次回顾下ActivityThread的方法handleCreateService

private void handleCreateService(CreateServiceData data) {       ......        LoadedApk packageInfo = getPackageInfoNoCheck(                data.info.applicationInfo, data.compatInfo);        Service service = null;            java.lang.ClassLoader cl = packageInfo.getClassLoader();            service = (Service) cl.loadClass(data.info.name).newInstance();                            ContextImpl context = new ContextImpl();            context.init(packageInfo, null, this);            Application app = packageInfo.makeApplication(false, mInstrumentation);            context.setOuterContext(service);            service.attach(context, this, data.info.name, data.token, app,                    ActivityManagerNative.getDefault());            //mService存储创建的service            mServices.put(data.token, service);           }

再次看看mServices

final ArrayMap<IBinder, Service> mServices            = new ArrayMap<IBinder, Service>();

复习完毕，现在再来看handleBindService，Service s = mServices.get(data.token);，从mServices中获取Service对象，然后调用s.onBind()。

到这里为止，已经创建了service实例，并且调用了service的方法onBind()，但是此时客户端（通常是Activity）还没有连接到service，所以还要调用客户端的serviceConnection中的onServiceConnected，这个过程是由ActivityManagerNative.getDefault().publishService来完成，ActivityManagerNative.getDefault()就是ActivityManagerProxy!   ActivityManagerProxy!    ActivityManagerProxy!，重要的事说三遍！

12  ActivityManagerProxy

public void publishService(IBinder token,            Intent intent, IBinder service) throws RemoteException {        Parcel data = Parcel.obtain();        Parcel reply = Parcel.obtain();        data.writeInterfaceToken(IActivityManager.descriptor);        data.writeStrongBinder(token);        intent.writeToParcel(data, 0);        data.writeStrongBinder(service);        mRemote.transact(PUBLISH_SERVICE_TRANSACTION, data, reply, 0);        reply.readException();        data.recycle();        reply.recycle();    }

真正的执行过程在AMS中

13 ActivityManagerService

 public void publishService(IBinder token, Intent intent, IBinder service) {        // Refuse possible leaked file descriptors        if (intent != null && intent.hasFileDescriptors() == true) {            throw new IllegalArgumentException("File descriptors passed in Intent");        }        synchronized(this) {            if (!(token instanceof ServiceRecord)) {                throw new IllegalArgumentException("Invalid service token");            }            mServices.publishServiceLocked((ServiceRecord)token, intent, service);        }    }

又见到mServices了，这个ActiveServices类是服务端AMS管理service的助手

14 ActiveServices

void publishServiceLocked(ServiceRecord r, Intent intent, IBinder service) {                ......    ArrayList<ConnectionRecord> clist = r.connections.valueAt(conni);                ......    ConnectionRecord c = clist.get(i);                ......   c.conn.connected(r.name, service); ...... }

15 InnerConnection （LoadedApk内部类ServiceDispathcer中的内部类）

ConnectionRecord 就是记录客户端（Activity）中connection的数据结构，客户端的connection经过3->4->5转化为InnerConnection，即一个binder，用于跨进程通信。

 private static class InnerConnection extends IServiceConnection.Stub {            final WeakReference<LoadedApk.ServiceDispatcher> mDispatcher;            InnerConnection(LoadedApk.ServiceDispatcher sd) {                mDispatcher = new WeakReference<LoadedApk.ServiceDispatcher>(sd);            }            public void connected(ComponentName name, IBinder service) throws RemoteException {                LoadedApk.ServiceDispatcher sd = mDispatcher.get();                if (sd != null) {                    sd.connected(name, service);                }            }        }

c.conn.connected中调用了sd.connected，即调用了ServiceDispatcher 的connected方法

16  ServiceDispatcher 

public void connected(ComponentName name, IBinder service) {            if (mActivityThread != null) {                mActivityThread.post(new RunConnection(name, service, 0));            } else {                doConnected(name, service);            }        }

这里涉及到mActivityThread（Handler），注意一下，将客户端connection转化为binder是在客户端内进行的，也就是说3->4->5步是在客户端进行的，LoadedApk相关的类的执行都是在客户端执行的。还记得第2步吗？

mActivityThread就是ActivityThread中的Handler H，new RunConnection(name, service, 0)方法经过mActivityThread.post就运行在主线程中

 private final class RunConnection implements Runnable {            RunConnection(ComponentName name, IBinder service, int command) {                mName = name;                mService = service;                mCommand = command;            }            public void run() {                if (mCommand == 0) {                    doConnected(mName, mService);                } else if (mCommand == 1) {                    doDeath(mName, mService);                }            }            final ComponentName mName;            final IBinder mService;            final int mCommand;        }

  public void doConnected(ComponentName name, IBinder service) {                        ......                mConnection.onServiceDisconnected(name);                       if (service != null) {                mConnection.onServiceConnected(name, service);            }        }

因为ServiceDispatcher保存了客户端的connection对象，所以可以调用onServiceConnected。在第4步就保存了。到这里客户端（Activity）就和服务端关联了。

3 总结