启动service的两种方式

1. 通过StartService启动Service

通过startService启动后，service会一直无限期运行下去，

• 当外部调用了stopService()或stopSelf()方法时，该Service才会停止运行并销毁
• 当系统资源不足时， 会回收一些不重要的service，service被系统回收也会停止运行并被销毁

生命周期

• onCreate()
  1.如果service没被创建过，调用startService()后会执行onCreate()回调；
  2.如果service已处于运行中，调用startService()不会执行onCreate()方法。
  此方法适合完成一些初始化工作。

• onStartCommand()
  如果多次执行了Context的startService()方法，那么Service的onStartCommand()方法也会相应的多次调用。

• onBind()
  Service中的onBind()方法是抽象方法，Service类本身就是抽象类，所以onBind()方法是必须重写的，即使我们用不到。

• onDestory()
  在销毁的时候会执行Service该方法。

代码实例

MyActivity.java

public class MainActivity extends Activity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        // 启动service
        Intent mIntent=new Intent(MainActivity.this,MyService.class) ;
        startService(mIntent);
    }
}

MyServvice.java

public class MyService extends Service {
    private static final String TAG = "MyService";
    private NotificationManager notificationManager;
    private String notificationId = "channel_Id";
    private String notificationName = "channel_Name";

    public MyService() {
    }

    @Override
    public IBinder onBind(Intent intent) {
        // TODO: Return the communication channel to the service.
        throw new UnsupportedOperationException("Not yet implemented");
    }

    @Override
    public void onCreate() {
        Log.d(TAG, "onCreate: ...");
    }

    @Override
    public int onStartCommand(Intent intent, int flags, int startId) {
        Log.d(TAG, "onStartCommand: ...");
        return super.onStartCommand(intent, flags, startId);
    }

    @Override
    public void onDestroy() {
        Log.d(TAG, "onDestroy: ....");
        super.onDestroy();
    }

AndroidManifest.xml

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.iauto.demo">
    <application
        android:allowBackup="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/Theme.MainActivity ">
        <service
            android:name=".MyService"
            android:enabled="true"
            android:exported="true"
            ></service>

        <activity
            android:name=".MainActivity"
            android:exported="true" >
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>

    </application>

</manifest>

2. 通过bindService启动Service

bindService启动服务特点：

• bindService启动的服务和调用者之间是典型的client-server模式。调用者是client，service则是server端。service只有一个，但绑定到service上面的client可以有一个或很多个。这里所提到的client指的是组件，比如某个Activity。
• client可以通过IBinder接口获取Service实例，从而实现在client端直接调用Service中的方法以实现灵活交互，这在通过startService方法启动中是无法实现的。
• bindService启动服务的生命周期与其绑定的client息息相关。当client销毁时，client会自动与Service解除绑定。当然，client也可以明确调用Context的unbindService()方法与Service解除绑定。当没有任何client与Service绑定时，Service会自行销毁

生命周期

• onCreate()
  当服务通过onStartCommand()和onBind()被第一次创建的时候，系统调用该方法。该调用要求执行一次性安装。

• onBind()
  当其他组件想要通过bindService()来绑定服务时，系统调用该方法。如果你实现该方法，你需要返回IBinder对象来提供一个接口，以便客户来与服务通信。你必须实现该方法，如果你不允许绑定，则直接返回null。

• onUnbind()
  当客户中断所有服务发布的特殊接口时，系统调用该方法。

• onRebind()
  当新的客户端与服务连接，且此前它已经通过onUnbind(Intent)通知断开连接时，系统调用该方法。

• onDestroy()
  当服务不再有用或者被销毁时，系统调用该方法。你的服务需要实现该方法来清理任何资源，如线程，已注册的监听器，接收器等。

代码实例

MainAcivity.java

public class MainAcivity extends Activity{
    private Myservice = null;
    private boolean isBind = false;

    private ServiceConnection conn = new ServiceConnection() {
        @Override
        public void onServiceConnected(ComponentName name, IBinder binder) {
            isBind = true;
            TestTwoService.MyBinder myBinder = (TestTwoService.MyBinder) binder;
            service = myBinder.getService();
            int num = service.getRandomNumber();
        }

        @Override
        public void onServiceDisconnected(ComponentName name) {
            isBind = false;
        }
    };

    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_a);
        Intent intent = new Intent(this, TestTwoService.class);
        intent.putExtra("from", "MainAcivity");
        bindService(intent, conn, BIND_AUTO_CREATE);
    }

    @Override
    protected void onDestroy() {
        super.onDestroy();
        unbindService(conn);
    }
}

MyService.java

public class MyService extends Service{

    //client 可以通过Binder获取Service实例
    public class MyBinder extends Binder {
        public MyService getService() {
            return MyService .this;
        }
    }

    //通过binder实现调用者client与Service之间的通信
    private MyBinder binder = new MyBinder();

    @Override
    public void onCreate() {
        super.onCreate();
    }

    @Override
    public int onStartCommand(Intent intent, int flags, int startId) {
        return START_NOT_STICKY;
    }

    @Nullable
    @Override
    public IBinder onBind(Intent intent) {
        return binder;
    }

    @Override
    public boolean onUnbind(Intent intent) {
        return false;
    }

    @Override
    public void onDestroy() {
        super.onDestroy();
    }

    //getRandomNumber是Service暴露出去供client调用的公共方法
    public int getRandomNumber() {
        return generator.nextInt();
    }
}

如何保证service不被杀死

之前说过：当系统资源不足时， 会回收一些不重要的service，service被系统回收也会停止运行并被销毁，那么如何保证service不被杀死呢

1. onStartCommand方式中，返回START_STICKY

表示Service运行的进程被Android系统强制杀掉之后，Android系统会将该Service依然设置为started状态（即运行状态），但是不再保存onStartCommand方法传入的intent对象，然后Android系统会尝试再次重新创建该Service，并执行onStartCommand回调方法，但是onStartCommand回调方法的Intent参数为null，也就是onStartCommand方法虽然会执行但是获取不到intent信息。如果你的Service可以在任意时刻运行或结束都没什么问题，而且不需要intent信息，那么就可以在onStartCommand方法中返回START_STICKY

2. 提高Service的优先级

在AndroidManifest.xml文件中对于intent-filter可以通过android:priority = "1000"这个属性设置最高优先级，1000是最高值，如果数字越小则优先级越低

*： 但是我在service中设置intent-filter，设置优先级build报错，有兴趣的可以另行查证

3. 提升Service进程的优先级

前台进程foreground_app优先级相对较高，可以将service设置为前台进程
代码实例：
MainActivity.java

package com.iauto.helloword;

import androidx.appcompat.app.AppCompatActivity;

import android.app.Activity;
import android.content.Intent;
import android.os.Bundle;
import android.util.Log;

public class MainActivity extends Activity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        // 启动service
        Intent mIntent=new Intent(MainActivity.this,MyService.class) ;
        Log.d("activity", "onCreate: to start service");
        startForegroundService(mIntent);
        Log.d("activity", "onCreate: start service end");
        finish();
    }
}

MyService.java

package com.iauto.helloword;

import android.app.Notification;
import android.app.NotificationChannel;
import android.app.NotificationManager;
import android.app.PendingIntent;
import android.app.Service;
import android.content.Context;
import android.content.Intent;
import android.graphics.BitmapFactory;
import android.os.Build;
import android.os.IBinder;
import android.util.Log;

import androidx.core.app.NotificationCompat;

public class MyService extends Service {
    private static final String TAG = "MyService";
    private NotificationManager notificationManager;
    private String notificationId = "channel_Id";
    private String notificationName = "channel_Name";

    public MyService() {
    }

    @Override
    public IBinder onBind(Intent intent) {
        // TODO: Return the communication channel to the service.
        throw new UnsupportedOperationException("Not yet implemented");
    }

    @Override
    public void onCreate() {
        Log.d(TAG, "onCreate: ...");
        notificationManager = (NotificationManager) getSystemService(Context.NOTIFICATION_SERVICE);
        //创建NotificationChannel
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
            NotificationChannel channel = new NotificationChannel(notificationId, notificationName, NotificationManager.IMPORTANCE_HIGH);
            // 必须创建notifychannel, 不然会抛异常Bad notification for startForeground: java.lang.RuntimeException: invalid channel for service
            notificationManager.createNotificationChannel(channel);
        }
        startForeground(1, getNotification());
    }

    @Override
    public int onStartCommand(Intent intent, int flags, int startId) {
        Log.d(TAG, "onStartCommand: ...");
        return START_STICKY;
    }

    @Override
    public void onDestroy() {
        Log.d(TAG, "onDestroy: ....");
        super.onDestroy();
    }

    private Notification getNotification() {
        Notification.Builder builder = new Notification.Builder(this)
                .setContentTitle("ScenarioEngineLite正在后台运行")
                .setContentText("");

        //设置Notification的ChannelID,否则不能正常显示

        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
            builder.setChannelId(notificationId);
        }
        Notification notification = builder.build();
        return notification;

    }
}

AndroidManifest.xml

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.iauto.helloword">
    <!-- 必须设置以下权限，否则会抛异常RemoteException-->
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE"/>
    <application
        android:allowBackup="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/Theme.MainActivity"
        android:persistent="true">
        <service
            android:name=".MyService"
            android:enabled="true"
            android:exported="true">
<!--            <intent-filter android:priority = "1000"/>-->
        </service>

        <activity
            android:name=".MainActivity"
            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />

                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
    </application>

</manifest>

4.在onDestroy方法里重启Service

当service走到onDestroy()时，发送一个自定义广播，当收到广播时，重新启动service。

5.系统广播监听Service状态

6.将APK安装到/system/app，变身为系统级应用

Service 的绑定过程   

       我们可以通过调用Context 的 startService方法来启动Service，也可以通过Context 的bindService方法来绑定Service，绑定Service的过程要比启动Service的过程要复杂一些，首先建议先阅读“解析Service的启动过程”这篇文章，结合Service的启动过程会有更好的理解。 Service 的绑定过程将分为两个部分来进行讲解，分别是 Contextlmpl 到 AMS 的调用过程和绑定 Service 。本文基于Android8.1.0系统分析Service的启动过程。

1. Contextlmpl到AMS的调用过程

       我们可以用 bindService 方法来绑定 Service ，它在 ContextWrapper中实现， 代码如下所示：

frameworks/base/core/java/android/content/ContextWrapper.java

    public boolean bindService(Intent service, ServiceConnection conn,
            int flags) {
        return mBase.bindService(service, conn, flags);
    }

       在“解析Service的启动过程”一文章我们分析过，mBase具体指向就是ContextImpl，接着查看ContextImpl的bindService方法，代码如下所示：

frameworks/base/core/java/android/app/Contextlmpl.java

    public boolean bindService(Intent service, ServiceConnection conn,
            int flags) {
        warnIfCallingFromSystemProcess();
        return bindServiceCommon(service, conn, flags, mMainThread.getHandler(),
                Process.myUserHandle());
    }

    private boolean bindServiceCommon(Intent service, ServiceConnection conn, int flags, Handler
            handler, UserHandle user) {
        // Keep this in sync with DevicePolicyManager.bindDeviceAdminServiceAsUser.
        IServiceConnection sd;
        if (conn == null) {
            throw new IllegalArgumentException("connection is null");
        }
        if (mPackageInfo != null) {
            sd = mPackageInfo.getServiceDispatcher(conn, getOuterContext(), handler, flags); // ... 1
        } else {
            throw new RuntimeException("Not supported in system context");
        }
        validateServiceIntent(service);
        try {
            IBinder token = getActivityToken();
            if (token == null && (flags&BIND_AUTO_CREATE) == 0 && mPackageInfo != null
                    && mPackageInfo.getApplicationInfo().targetSdkVersion
                    < android.os.Build.VERSION_CODES.ICE_CREAM_SANDWICH) {
                flags |= BIND_WAIVE_PRIORITY;
            }
            service.prepareToLeaveProcess(this);
            int res = ActivityManager.getService().bindService(
                mMainThread.getApplicationThread(), getActivityToken(), service,
                service.resolveTypeIfNeeded(getContentResolver()),
                sd, flags, getOpPackageName(), user.getIdentifier()); // ... 2
            if (res < 0) {
                throw new SecurityException(
                        "Not allowed to bind to service " + service);
            }
            return res != 0;
        } catch (RemoteException e) {
            throw e.rethrowFromSystemServer();
        }
    }

2. 绑定 Service

 接着我们来分析 AMS 的 bindService 方法，代码如下所示：

frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

   public int bindService(IApplicationThread caller, IBinder token, Intent service,
            String resolvedType, IServiceConnection connection, int flags, String callingPackage,
            int userId) throws TransactionTooLargeException {
        enforceNotIsolatedCaller("bindService");

        // Refuse possible leaked file descriptors
        if (service != null && service.hasFileDescriptors() == true) {
            throw new IllegalArgumentException("File descriptors passed in Intent");
        }

        if (callingPackage == null) {
            throw new IllegalArgumentException("callingPackage cannot be null");
        }

        synchronized(this) {
            return mServices.bindServiceLocked(caller, token, service,
                    resolvedType, connection, flags, callingPackage, userId);
        }
    }

    int bindServiceLocked(IApplicationThread caller, IBinder token, Intent service,
            String resolvedType, final IServiceConnection connection, int flags,
            String callingPackage, final int userId) throws TransactionTooLargeException {
        ...
       
        try {

            ...

            AppBindRecord b = s.retrieveAppBindingLocked(service, callerApp); // ... 1
  
            ...

            if ((flags&Context.BIND_AUTO_CREATE) != 0) {
                s.lastActivity = SystemClock.uptimeMillis();

                // 启动Service
                if (bringUpServiceLocked(s, service.getFlags(), callerFg, false,
                        permissionsReviewRequired) != null) { // ... 2
                    return 0;
                }
            }

            ...

            if (s.app != null && b.intent.received) { // ... 3
                // Service is already running, so we can immediately
                // publish the connection.
                try {
                    c.conn.connected(s.name, b.intent.binder, false); // ... 4
                } catch (Exception e) {
                    Slog.w(TAG, "Failure sending service " + s.shortName
                            + " to connection " + c.conn.asBinder()
                            + " (in " + c.binding.client.processName + ")", e);
                }

                // If this is the first app connected back to this binding,
                // and the service had previously asked to be told when
                // rebound, then do so.
                if (b.intent.apps.size() == 1 && b.intent.doRebind) { // ... 5
                    requestServiceBindingLocked(s, b.intent, callerFg, true); // ... 6
                }
            } else if (!b.intent.requested) { // ... 7
                requestServiceBindingLocked(s, b.intent, callerFg, false); // ... 8
            }

            getServiceMapLocked(s.userId).ensureNotStartingBackgroundLocked(s);

        } finally {
            Binder.restoreCallingIdentity(origId);
        }

        return 1;
    }

    private final boolean requestServiceBindingLocked(ServiceRecord r, IntentBindRecord i,
            boolean execInFg, boolean rebind) throws TransactionTooLargeException {

        ...

        if ((!i.requested || rebind) && i.apps.size() > 0) { // ... 1
            try {
                bumpServiceExecutingLocked(r, execInFg, "bind");
                r.app.forceProcessStateUpTo(ActivityManager.PROCESS_STATE_SERVICE);
                r.app.thread.scheduleBindService(r, i.intent.getIntent(), rebind,
                        r.app.repProcState); // ... 2
                if (!rebind) {
                    i.requested = true;
                }
                i.hasBound = true;
                i.doRebind = false;
            } catch (TransactionTooLargeException e) {
                // Keep the executeNesting count accurate.
                if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "Crashed while binding " + r, e);
                final boolean inDestroying = mDestroyingServices.contains(r);
                serviceDoneExecutingLocked(r, inDestroying, inDestroying);
                throw e;
            } catch (RemoteException e) {
                if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "Crashed while binding " + r);
                // Keep the executeNesting count accurate.
                final boolean inDestroying = mDestroyingServices.contains(r);
                serviceDoneExecutingLocked(r, inDestroying, inDestroying);
                return false;
            }
        }
        return true;
    }

final class IntentBindRecord {
    /** 被绑定的Service */
    final ServiceRecord service;
    /** 绑定Service的Intent */
    final Intent.FilterComparison intent; // 
    /** 所有用当前Intent绑定Service的应用程序进程 */
    final ArrayMap<ProcessRecord, AppBindRecord> apps
            = new ArrayMap<ProcessRecord, AppBindRecord>(); // ... 1

   ...

}

    public AppBindRecord retrieveAppBindingLocked(Intent intent,
            ProcessRecord app) {
        Intent.FilterComparison filter = new Intent.FilterComparison(intent);
        IntentBindRecord i = bindings.get(filter);
        if (i == null) {
            i = new IntentBindRecord(this, filter); // ... 1
            bindings.put(filter, i);
        }
        AppBindRecord a = i.apps.get(app); // ... 2
        if (a != null) {
            return a;
        }
        a = new AppBindRecord(this, i, app); // ... 3
        i.apps.put(app, a);
        return a;
    }

        public final void scheduleBindService(IBinder token, Intent intent,
                boolean rebind, int processState) {
            updateProcessState(processState, false);
            BindServiceData s = new BindServiceData();
            s.token = token;
            s.intent = intent;
            s.rebind = rebind;

            if (DEBUG_SERVICE)
                Slog.v(TAG, "scheduleBindService token=" + token + " intent=" + intent + " uid="
                        + Binder.getCallingUid() + " pid=" + Binder.getCallingPid());
            sendMessage(H.BIND_SERVICE, s);
        }

        public void handleMessage(Message msg) {
            if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));
            switch (msg.what) {
                ...
                case BIND_SERVICE:
                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceBind");
                    handleBindService((BindServiceData)msg.obj);
                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                    break;
                ...
            }
           ...           
        }

    private void handleBindService(BindServiceData data) {
        Service s = mServices.get(data.token); // ... 1
        if (DEBUG_SERVICE)
            Slog.v(TAG, "handleBindService s=" + s + " rebind=" + data.rebind);
        if (s != null) {
            try {
                data.intent.setExtrasClassLoader(s.getClassLoader());
                data.intent.prepareToEnterProcess();
                try {
                    if (!data.rebind) { // ... 2
                        IBinder binder = s.onBind(data.intent); // ... 3
                        ActivityManager.getService().publishService(
                                data.token, data.intent, binder); // ... 4
                    } else {
                        s.onRebind(data.intent); // ... 5
                        ActivityManager.getService().serviceDoneExecuting(
                                data.token, SERVICE_DONE_EXECUTING_ANON, 0, 0);
                    }
                    ensureJitEnabled();
                } catch (RemoteException ex) {
                    throw ex.rethrowFromSystemServer();
                }
            } catch (Exception e) {
                if (!mInstrumentation.onException(s, e)) {
                    throw new RuntimeException(
                            "Unable to bind to service " + s
                            + " with " + data.intent + ": " + e.toString(), e);
                }
            }
        }
    }

    public void publishService(IBinder token, Intent intent, IBinder service) {
        // Refuse possible leaked file descriptors
        if (intent != null && intent.hasFileDescriptors() == true) {
            throw new IllegalArgumentException("File descriptors passed in Intent");
        }

        synchronized(this) {
            if (!(token instanceof ServiceRecord)) {
                throw new IllegalArgumentException("Invalid service token");
            }
            mServices.publishServiceLocked((ServiceRecord)token, intent, service);
        }
    }

    void publishServiceLocked(ServiceRecord r, Intent intent, IBinder service) {
        final long origId = Binder.clearCallingIdentity();
        try {          
            ...       
            if (r != null) {
                Intent.FilterComparison filter
                        = new Intent.FilterComparison(intent);
                IntentBindRecord b = r.bindings.get(filter);
                if (b != null && !b.received) {
                    b.binder = service;
                    b.requested = true;
                    b.received = true;
                    for (int conni=r.connections.size()-1; conni>=0; conni--) {
                        ArrayList<ConnectionRecord> clist = r.connections.valueAt(conni);
                        for (int i=0; i<clist.size(); i++) {
                            ConnectionRecord c = clist.get(i);
                            if (!filter.equals(c.binding.intent.intent)) {
                                if (DEBUG_SERVICE) Slog.v(
                                        TAG_SERVICE, "Not publishing to: " + c);
                                if (DEBUG_SERVICE) Slog.v(
                                        TAG_SERVICE, "Bound intent: " + c.binding.intent.intent);
                                if (DEBUG_SERVICE) Slog.v(
                                        TAG_SERVICE, "Published intent: " + intent);
                                continue;
                            }
                            if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "Publishing to: " + c);
                            try {
                                c.conn.connected(r.name, service, false); // ... 1
                            } catch (Exception e) {
                                Slog.w(TAG, "Failure sending service " + r.name +
                                      " to connection " + c.conn.asBinder() +
                                      " (in " + c.binding.client.processName + ")", e);
                            }
                        }
                    }
                }

                serviceDoneExecutingLocked(r, mDestroyingServices.contains(r), false);
            }
        } finally {
            Binder.restoreCallingIdentity(origId);
        }
    }

 static final class ServiceDispatcher {  
      ...
      private static class InnerConnection extends IServiceConnection.Stub {
            final WeakReference<LoadedApk.ServiceDispatcher> mDispatcher;

            InnerConnection(LoadedApk.ServiceDispatcher sd) {
                mDispatcher = new WeakReference<LoadedApk.ServiceDispatcher>(sd);
            }

            public void connected(ComponentName name, IBinder service, boolean dead)
                    throws RemoteException {
                LoadedApk.ServiceDispatcher sd = mDispatcher.get();
                if (sd != null) {
                    sd.connected(name, service, dead); // ... 1
                }
            }
        }
      ...
  }

        public void connected(ComponentName name, IBinder service, boolean dead) {
            if (mActivityThread != null) {
                mActivityThread.post(new RunConnection(name, service, 0, dead)); // ... 1
            } else {
                doConnected(name, service, dead);
            }
        }

        private final class RunConnection implements Runnable {
            RunConnection(ComponentName name, IBinder service, int command, boolean dead) {
                mName = name;
                mService = service;
                mCommand = command;
                mDead = dead;
            }

            public void run() {
                if (mCommand == 0) {
                    doConnected(mName, mService, mDead);
                } else if (mCommand == 1) {
                    doDeath(mName, mService);
                }
            }

            final ComponentName mName;
            final IBinder mService;
            final int mCommand;
            final boolean mDead;
        }

        public void doConnected(ComponentName name, IBinder service, boolean dead) {
            ...

            // If there was an old service, it is now disconnected.
            if (old != null) {
                mConnection.onServiceDisconnected(name);
            }
            if (dead) {
                mConnection.onBindingDied(name);
            }
            // If there is a new service, it is now connected.
            if (service != null) {
                mConnection.onServiceConnected(name, service); // ... 1
            }
        }

转载请标明出处:【顾林海的博客】
本篇文章已授权微信公众号 顾林海 独家发布

Service启动方式有两种，一种是通过Context的startService启动Service，另一种是通过Context的bindService绑定Service，下面对这两种启动方式的启动流程进行详细的讲解。

startService的启动流程

通过startService方法启动Service会调用ContextWrapper的startService方法，如下所示：

//路径：/frameworks/base/core/java/android/content/ContextWrapper.java
public class ContextWrapper extends Context {
    
    Context mBase;
    
    ...
    
    @Override
    public ComponentName startService(Intent service) {
        return mBase.startService(service);
    }
    
    ...
}

在ContextWrapper的startService方法中调用mBase的startService方法，mBase的类型是Context，而Context是一个抽象类，内部定义了很多方法以及静态常量，它的具体实现类是ContextImpl，进入ContextImpl的startService方法：

    //路径：/frameworks/base/core/java/android/app/ContextImpl.java
    @Override
    public ComponentName startService(Intent service) {
        warnIfCallingFromSystemProcess();
        return startServiceCommon(service, false, mUser);
    }

ContextImpl的startService方法中又调用了startServiceCommon方法：

    //路径：/frameworks/base/core/java/android/app/ContextImpl.java
    private ComponentName startServiceCommon(Intent service, boolean requireForeground,
            UserHandle user) {
        try {
            validateServiceIntent(service);
            service.prepareToLeaveProcess(this);
            //注释1
            ComponentName cn = ActivityManager.getService().startService(
                mMainThread.getApplicationThread(), service, service.resolveTypeIfNeeded(
                            getContentResolver()), requireForeground,
                            getOpPackageName(), user.getIdentifier());
            ...
            return cn;
        } catch (RemoteException e) {
            throw e.rethrowFromSystemServer();
        }
    }

注释1处通过ActivityManager的getService方法获取ActivityManagerService的代理类IActivityManager，进入ActivityManager的getService方法：

    //路径：/frameworks/base/core/java/android/app/ActivityManager.java
    public static IActivityManager getService() {
        return IActivityManagerSingleton.get();
    }

    private static final Singleton<IActivityManager> IActivityManagerSingleton =
            new Singleton<IActivityManager>() {
                @Override
                protected IActivityManager create() {
                    final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE);
                    final IActivityManager am = IActivityManager.Stub.asInterface(b);
                    return am;
                }
            };

getService方法通过IActivityManagerSingleton的get方法获取IActivityManager对象，IActivityManagerSingleton是一个单例类，在create方法中从ServiceManager中获取一个名叫“activity”的Service引用，同时也是IBinder类型的ActivityManagerService的引用，最后通过IActivityManager.Stub.asInterface方法将它转换成IActivityManager，看到IActivityManager.Stub.asInterface这段代码时可以知道这里采用的是AIDL方式来实现进程间通信，也就是说服务端ActivityManagerService会实现IActivityManager.Stub类并实现相应的方法。

继续回到ContextImpl的startServiceCommon方法：

    //路径：/frameworks/base/core/java/android/app/ContextImpl.java
    private ComponentName startServiceCommon(Intent service, boolean requireForeground,
            UserHandle user) {
        try {
            validateServiceIntent(service);
            service.prepareToLeaveProcess(this);
            //注释1
            ComponentName cn = ActivityManager.getService().startService(
                mMainThread.getApplicationThread(), service, service.resolveTypeIfNeeded(
                            getContentResolver()), requireForeground,
                            getOpPackageName(), user.getIdentifier());
            ...
            return cn;
        } catch (RemoteException e) {
            throw e.rethrowFromSystemServer();
        }
    }

在注释1处获取到ActivityManagerService的代理类IActivityManager，接着通过这个代理类向ActivityManagerService发送startActivity的消息。

将上面的知识点进行总结，如下图所示：

之前的操作是在应用程序进程中进行的，ActivityManagerService属于SystemServer进程，因此两者通过Binder通信，进入ActivityManagerService的startService方法：

    //路径：/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
    @Override
    public ComponentName startService(IApplicationThread caller, Intent service,
            String resolvedType, boolean requireForeground, String callingPackage, int userId)
            throws TransactionTooLargeException {
        ...
        synchronized(this) {
            final int callingPid = Binder.getCallingPid();
            final int callingUid = Binder.getCallingUid();
            final long origId = Binder.clearCallingIdentity();
            ComponentName res;
            try {
                //注释1
                res = mServices.startServiceLocked(caller, service,
                        resolvedType, callingPid, callingUid,
                        requireForeground, callingPackage, userId);
            } finally {
                Binder.restoreCallingIdentity(origId);
            }
            return res;
        }
    }

注释1处调用mServices的startServiceLocked方法，mServices的类型是ActiveServices，进入ActiveServices的startServiceLocked方法：

    //路径：/frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
    ComponentName startServiceLocked(IApplicationThread caller, Intent service, String resolvedType,
            int callingPid, int callingUid, boolean fgRequired, String callingPackage, final int userId)
            throws TransactionTooLargeException {
        ...
        //注释1
        ServiceLookupResult res =
            retrieveServiceLocked(service, resolvedType, callingPackage,
                    callingPid, callingUid, userId, true, callerFg, false);
        if (res == null) {
            return null;
        }
        ...
        //注释2
        ServiceRecord r = res.record;
        ...
        //注释3
        ComponentName cmp = startServiceInnerLocked(smap, service, r, callerFg, addToStarting);
        return cmp;
    }

注释1处retrieveServiceLocked方法获取与参数service对应的ServiceRecord，如果没有对应的就会从PackageManagerService中查找与service对应的Service信息，并封装成ServiceRecord中，最后将ServiceRecord赋值给ServiceLookupResult的成员变量record，ServiceRecord是一个用于描述Service相关信息的类，在注释2处将ServiceLookupResult中的成员变量record赋值给r，同时将ServiceRecord作为参数传递给注释3处的startServiceInnerLocked。

startServiceInnerLocked方法如下所示：

    //路径：/frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
    ComponentName startServiceInnerLocked(ServiceMap smap, Intent service, ServiceRecord r,
            boolean callerFg, boolean addToStarting) throws TransactionTooLargeException {
        ...
        String error = bringUpServiceLocked(r, service.getFlags(), callerFg, false, false);
        ...
        return r.name;
    }
    

接着调用bringUpServiceLocked方法，如下所示：

    //路径：/frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
    private String bringUpServiceLocked(ServiceRecord r, int intentFlags, boolean execInFg,
            boolean whileRestarting, boolean permissionsReviewRequired)
            throws TransactionTooLargeException {
       ...
        final String procName = r.processName;
        String hostingType = "service";
        ProcessRecord app;

        if (!isolated) {
            //注释1
            app = mAm.getProcessRecordLocked(procName, r.appInfo.uid, false);
            ...
            if (app != null && app.thread != null) {
                try {
                    app.addPackage(r.appInfo.packageName, r.appInfo.versionCode, mAm.mProcessStats);
                    //注释2
                    realStartServiceLocked(r, app, execInFg);
                    return null;
                } catch (TransactionTooLargeException e) {
                    throw e;
                } catch (RemoteException e) {
                    ...
                }

            }
        } else {
            ...
        }
        //注释3
        if (app == null && !permissionsReviewRequired) {
            if ((app=mAm.startProcessLocked(procName, r.appInfo, true, intentFlags,
                    hostingType, r.name, false, isolated, false)) == null) {
                ...
            }
            ...
        }

        if (!mPendingServices.contains(r)) {
            mPendingServices.add(r);
        }

        ...

        return null;
    }

启动Service时会在注释3处判断app==null，app的类型是ProcessRecord，用来描述运行的应用程序进程的信息，在注释1处将Service运行的进程名和uid传递给ActivityManagerService的getProcessRecordLocked方法，从而获取运行Service的应用程序进程信息ProcessRecord，如果用来运行Service的应用程序进程不存在，就会调用ActivityManagerService的startProcessLocked方法来创建对应的应用程序进程；如果用来运行Service的应用程序进程存在，会调用注释2处的realStartServiceLocked方法。

进入realStartServiceLocked方法：

    //路径：/frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
    private final void realStartServiceLocked(ServiceRecord r,
            ProcessRecord app, boolean execInFg) throws RemoteException {
            ...
            try {
               ...
               //注释1
                app.thread.scheduleCreateService(r, r.serviceInfo,
                    mAm.compatibilityInfoForPackageLocked(r.serviceInfo.applicationInfo),
                    app.repProcState);
                r.postNotification();
                created = true;
        } catch (DeadObjectException e) {
            ...
        } finally {
            ...
        }
                
    }

注释2处调用了app.thread的scheduleCreateService方法，app.thread是IApplicationThread类型，它的实现类ActivityThread的内部类ApplicationThread，通过ApplicationThread与应用程序进程进行Binder通信。

进入ApplicationThread的scheduleCreateService方法：

    //路径：/frameworks/base/core/java/android/app/ActivityThread.java
        public final void scheduleCreateService(IBinder token,
                ServiceInfo info, CompatibilityInfo compatInfo, int processState) {
            updateProcessState(processState, false);
            CreateServiceData s = new CreateServiceData();
            s.token = token;
            s.info = info;
            s.compatInfo = compatInfo;

            sendMessage(H.CREATE_SERVICE, s);
        }

将启动Service的参数封装成CreateServiceData对象并发送CREATE_SERVICE消息。

sendMessage方法如下所示：

    //路径：/frameworks/base/core/java/android/app/ActivityThread.java
    private void sendMessage(int what, Object obj, int arg1, int arg2, boolean async) {
        Message msg = Message.obtain();
        msg.what = what;
        msg.obj = obj;
        msg.arg1 = arg1;
        msg.arg2 = arg2;
        if (async) {
            msg.setAsynchronous(true);
        }
        mH.sendMessage(msg);
    }

向mH类发送CREATE_SERVICE类型的消息，并将CreateServiceData传递过去，mH指的是H，它是ActivityThread的内部类并继承自Handler，AMS通过IApplicationThread向应用程序进程发送消息，接受消息的操作是在应用程序进程的Binder线程池中进行，因此需要Handler来发送消息切换到主线程，查看H的handleMessage方法：

//路径：/frameworks/base/core/java/android/app/ActivityThread.java
 public void handleMessage(Message msg) {
            if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));
            switch (msg.what) {
                ...
                 case CREATE_SERVICE:
                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, ("serviceCreate: " + String.valueOf(msg.obj)));
                    handleCreateService((CreateServiceData)msg.obj);
                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                    break;
                ...
            }
            ...
}

根据消息类型CREATE_SERVICE，调用handleCreateService方法：

//路径：/frameworks/base/core/java/android/app/ActivityThread.java
    private void handleCreateService(CreateServiceData data) {
        ...
        //注释1
        LoadedApk packageInfo = getPackageInfoNoCheck(
                data.info.applicationInfo, data.compatInfo);
        Service service = null;
        try {
            //获取类加载器
            java.lang.ClassLoader cl = packageInfo.getClassLoader();
            //注释2
            service = (Service) cl.loadClass(data.info.name).newInstance();
        } catch (Exception e) {
            ...
        }

        try {
            //注释3
            ContextImpl context = ContextImpl.createAppContext(this, packageInfo);
            context.setOuterContext(service);

            Application app = packageInfo.makeApplication(false, mInstrumentation);
            //注释4
            service.attach(context, this, data.info.name, data.token, app,
                    ActivityManager.getService());
            //注释5
            service.onCreate();
            //注释6
            mServices.put(data.token, service);
            try {
                ActivityManager.getService().serviceDoneExecuting(
                        data.token, SERVICE_DONE_EXECUTING_ANON, 0, 0);
            } catch (RemoteException e) {
                throw e.rethrowFromSystemServer();
            }
        } catch (Exception e) {
           ...
        }
    }

注释1处获取启动Service的应用程序的LoadedApk，LoadedApk是一个APK文件的描述类，从中获取类加载器并在注释2处加载Service类，在注释5处调用Service的onCreate方法，Service就被启动了，同时在注释6处将启动的Service加入到ActivityThread的成员变量mServices中。其中注释3处通过ContextImpl的createAppContext方法创建ContextImpl也就是Service的上下文，并将该ContextImpl传入注释2处service的attach方法中，如下所示：

路径：/frameworks/base/core/java/android/app/Service.java

public final void attach(
            Context context,
            ActivityThread thread, String className, IBinder token,
            Application application, Object activityManager) {
        attachBaseContext(context);//注释1
        mThread = thread;           // NOTE:  unused - remove?
        mClassName = className;
        mToken = token;
        mApplication = application;
        mActivityManager = (IActivityManager)activityManager;
        mStartCompatibility = getApplicationInfo().targetSdkVersion
                < Build.VERSION_CODES.ECLAIR;
    }

在注释1处调用ContextWrapper的attachBaseContext方法，如下所示：

路径：/frameworks/base/core/java/android/content/ContextWrapper.java

protected void attachBaseContext(Context base) {
        if (mBase != null) {
            throw new IllegalStateException("Base context already set");
        }
        mBase = base;
    }

Service的ContextImpl最终被赋值给ContextWrapper的成员变量mBase，由于Service继承自ContextWrapper，因此Service也可以使用Context的方法。

总结如下：

bindService的绑定流程

通过bindService方法绑定Service会调用ContextWrapper的bindService方法，如下所示：

    //路径：/frameworks/base/core/java/android/content/ContextWrapper.java
    @Override
    public boolean bindService(Intent service, ServiceConnection conn,
            int flags) {
        return mBase.bindService(service, conn, flags);
    }

mBase具体实现类是ContextImpl，ContextImpl的bindService方法：

    //路径：/frameworks/base/core/java/android/app/ContextImpl.java
    @Override
    public boolean bindService(Intent service, ServiceConnection conn,
            int flags) {
        warnIfCallingFromSystemProcess();
        return bindServiceCommon(service, conn, flags, mMainThread.getHandler(),
                Process.myUserHandle());
    }

bindService方法又调用了bindServiceCommon方法：

    //路径：/frameworks/base/core/java/android/app/ContextImpl.java
    private boolean bindServiceCommon(Intent service, ServiceConnection conn, int flags, Handler
            handler, UserHandle user) {
        IServiceConnection sd;
        if (conn == null) {
            throw new IllegalArgumentException("connection is null");
        }
        if (mPackageInfo != null) {
            //注释1
            sd = mPackageInfo.getServiceDispatcher(conn, getOuterContext(), handler, flags);
        } else {
            throw new RuntimeException("Not supported in system context");
        }
        validateServiceIntent(service);
        try {
            ...
            //注释2
            int res = ActivityManager.getService().bindService(
                mMainThread.getApplicationThread(), getActivityToken(), service,
                service.resolveTypeIfNeeded(getContentResolver()),
                sd, flags, getOpPackageName(), user.getIdentifier());
            if (res < 0) {
                throw new SecurityException(
                        "Not allowed to bind to service " + service);
            }
            return res != 0;
        } catch (RemoteException e) {
            throw e.rethrowFromSystemServer();
        }
    }

注释1处将ServiceConnection封装成IServiceConnection类型的对象sd，IServiceConnection实现了Binder机制，这样Service的绑定就支持跨进程通信了，在注释2处获取ActivityManagerService的代理类IActivityManager，向ActivityManagerService发送bindService消息。

到这里总结如下：

    //路径：/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
    
    final ActiveServices mServices;
    
    public int bindService(IApplicationThread caller, IBinder token, Intent service,
            String resolvedType, IServiceConnection connection, int flags, String callingPackage,
            int userId) throws TransactionTooLargeException {
        ...
        synchronized(this) {
            return mServices.bindServiceLocked(caller, token, service,
                    resolvedType, connection, flags, callingPackage, userId);
        }
    }

最后在同步代码块中调用了mServices的bindServiceLocked方法，mServices的类型是ActiveServices，ActiveServices的bindServiceLocked方法如下：

    //路径：/frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
    int bindServiceLocked(IApplicationThread caller, IBinder token, Intent service,
            String resolvedType, final IServiceConnection connection, int flags,
            String callingPackage, final int userId) throws TransactionTooLargeException {
            ...
            if ((flags&Context.BIND_AUTO_CREATE) != 0) {
                s.lastActivity = SystemClock.uptimeMillis();
                //注释1
                if (bringUpServiceLocked(s, service.getFlags(), callerFg, false,
                        permissionsReviewRequired) != null) {
                    return 0;
                }
            }
            ...
            if (s.app != null && b.intent.received) {
                ...
            } else if (!b.intent.requested) {
                //注释2
                requestServiceBindingLocked(s, b.intent, callerFg, false);
            }
            
    }

注释1处会调用bringUpServiceLocked方法，最终会调用realStartServiceLocked方法，在该方法中通过ApplicationThread与应用程序进程进行Binder通信，调用ApplicationThread的scheduleCreateService方法以此来创建并启动Service，关于创建和启动Service已经在第一部分讲过了。

注释2处当Service没有绑定时调用requestServiceBindingLocked方法：

     //路径：/frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
    private final boolean requestServiceBindingLocked(ServiceRecord r, IntentBindRecord i,
            boolean execInFg, boolean rebind) throws TransactionTooLargeException {
        ...
        if ((!i.requested || rebind) && i.apps.size() > 0) {
            try {
                bumpServiceExecutingLocked(r, execInFg, "bind");
                r.app.forceProcessStateUpTo(ActivityManager.PROCESS_STATE_SERVICE);
                //注释1
                r.app.thread.scheduleBindService(r, i.intent.getIntent(), rebind,
                        r.app.repProcState);
                if (!rebind) {
                    i.requested = true;
                }
                i.hasBound = true;
                i.doRebind = false;
            } catch (TransactionTooLargeException e) {
               ...
            } catch (RemoteException e) {
               ...
            }
        }
        return true;
    }

注释1处，r.app.thread的类型是IApplicationThread，实现类是ActivityThread的内部类ApplicationThread，通过Binder机制调用ApplicationThread的scheduleBindService方法：

        //路径：/frameworks/base/core/java/android/app/ActivityThread.java
        public final void scheduleBindService(IBinder token, Intent intent,
                boolean rebind, int processState) {
            updateProcessState(processState, false);
            BindServiceData s = new BindServiceData();
            s.token = token;
            s.intent = intent;
            s.rebind = rebind;

            if (DEBUG_SERVICE)
                Slog.v(TAG, "scheduleBindService token=" + token + " intent=" + intent + " uid="
                        + Binder.getCallingUid() + " pid=" + Binder.getCallingPid());
            sendMessage(H.BIND_SERVICE, s);
        }

scheduleBindService放中将Service信息封装成BindServiceData对象，并通过H类发送BIND_SERVICE消息。

 //路径：/frameworks/base/core/java/android/app/ActivityThread.java
 public void handleMessage(Message msg) {
            if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));
            switch (msg.what) {
                ...
                case BIND_SERVICE:
                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceBind");
                    handleBindService((BindServiceData)msg.obj);
                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                    break;
                ...
            }

H类在处理BIND_SERVICE消息时调用了handleBindService方法：

//路径：/frameworks/base/core/java/android/app/ActivityThread.java
    private void handleBindService(BindServiceData data) {
        //注释1
        Service s = mServices.get(data.token);
        ...
        if (s != null) {
            try {
                data.intent.setExtrasClassLoader(s.getClassLoader());
                data.intent.prepareToEnterProcess();
                try {
                    if (!data.rebind) {
                        //注释2
                        IBinder binder = s.onBind(data.intent);
                        ActivityManager.getService().publishService(
                                data.token, data.intent, binder);
                    } else {
                        ...
                    }
                    ensureJitEnabled();
                } catch (RemoteException ex) {
                    throw ex.rethrowFromSystemServer();
                }
            } catch (Exception e) {
                ...
            }
        }
    }

注释1处获取要绑定的Service，注释2处当Service还没绑定时调用Service的onBind方法进行绑定并调用ActivityManagerService的publishService方法：

    //路径：/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
    public void publishService(IBinder token, Intent intent, IBinder service) {
        ...
        synchronized(this) {
            if (!(token instanceof ServiceRecord)) {
                throw new IllegalArgumentException("Invalid service token");
            }
            mServices.publishServiceLocked((ServiceRecord)token, intent, service);
        }
    }

进入mServices的publishServiceLocked方法：

    //路径：/frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
    void publishServiceLocked(ServiceRecord r, Intent intent, IBinder service) {
        ...
        try {
            ...
            if (r != null) {
                ...
                if (b != null && !b.received) {
                    b.binder = service;
                    b.requested = true;
                    b.received = true;
                    for (int conni=r.connections.size()-1; conni>=0; conni--) {
                        ...
                        for (int i=0; i<clist.size(); i++) {
                            ...
                            try {
                                //注释1
                                c.conn.connected(r.name, service, false);
                            } catch (Exception e) {
                                ...
                            }
                        }
                    }
                }

                ...
            }
        } finally {
            Binder.restoreCallingIdentity(origId);
        }
    }

注释1处的c.conn的类型是IServiceConnection，它是ServiceConnection在本地的代理，用于解决当前应用程序进程和Service跨进程通信的问题，IServiceConnection的具体实现类是ServiceDispatcher.InnerConnection，ServiceDispatcher是LoadedApk的内部类。ServiceDispatcher.InnerConnection的connected方法如下所示：

    //路径：/frameworks/base/core/java/android/app/LoadedApk.java
    static final class ServiceDispatcher {
        ...
        private final Handler mActivityThread;
        ...
        private static class InnerConnection extends IServiceConnection.Stub {
            final WeakReference<LoadedApk.ServiceDispatcher> mDispatcher;

            InnerConnection(LoadedApk.ServiceDispatcher sd) {
                mDispatcher = new WeakReference<LoadedApk.ServiceDispatcher>(sd);
            }

            public void connected(ComponentName name, IBinder service, boolean dead)
                    throws RemoteException {
                LoadedApk.ServiceDispatcher sd = mDispatcher.get();
                if (sd != null) {
                    //注释1
                    sd.connected(name, service, dead);
                }
            }
        }
        ...
         public void connected(ComponentName name, IBinder service, boolean dead) {
            if (mActivityThread != null) {
                //注释2
                mActivityThread.post(new RunConnection(name, service, 0, dead));
            } else {
                doConnected(name, service, dead);
            }
        }
        ...
    }

注释1处获取ServiceDispatcher类型sd的connected，也是就是调用注释2处的connected方法，并调用Handler类型的对象mActivityThread的post方法，mActivityThread实际指向的是ActivityThread的内部类H，最终通过H类的post方法将RunConnection对象的内容运行在主线程中，RunConnections是LoadedApk的内部类。代码如下所示：

//路径：/frameworks/base/core/java/android/app/LoadedApk.java
        private final class RunConnection implements Runnable {
            RunConnection(ComponentName name, IBinder service, int command, boolean dead) {
                mName = name;
                mService = service;
                mCommand = command;
                mDead = dead;
            }

            public void run() {
                if (mCommand == 0) {
                    //注释1
                    doConnected(mName, mService, mDead);
                } else if (mCommand == 1) {
                    doDeath(mName, mService);
                }
            }

            final ComponentName mName;
            final IBinder mService;
            final int mCommand;
            final boolean mDead;
        }

在run方法中调用注释1处的doConnected方法：

//路径：/frameworks/base/core/java/android/app/LoadedApk.java
        public void doConnected(ComponentName name, IBinder service, boolean dead) {
            ...
            if (service != null) {
                //注释1
                mConnection.onServiceConnected(name, service);
            }
        }

注释1处调用mConnection的onServiceConnected，mConnection的类型是ServiceConnection，这样客户端实现ServiceConnection接口类的onServiceConnected方法就会被调用。

最后总结如下：