一 前言

上一篇介紹了Activity的啟動過程，本篇將介紹Service的啟動過程，Service的綁定過程會再下一篇再進行介紹。
可以通過如下方式就可以啟動一個Service：
創(chuàng)建一個MyService.java

public class MyService extends Service {
    private Binder mBinder = new MyBinder();
    @Override
    public IBinder onBind(Intent intent) {
        return mBinder;
    }
    
    class MyBinder extends Binder {
        public void startTask() {
            // 執(zhí)行具體的任務
        }
    }
}

在AndroidManifest.xml中注冊MyService，并注冊為遠程進程android:process=":remote"，主要是為了后繼分析Service啟動過程時MyService運行在與app進程不同的新進程中。

<service android:name=".MyService"
         android:process=":remote">
 </service>

然后可以MainActivity.java中startService方法即可啟動一個Service:

Intent intent = new Intent(this,MyService.class);
startService(intent);

先給出startService啟動主流程的時序圖：

startService啟動過程.png

二 啟動流程分析

startService啟動流程與startActivity一樣也會經(jīng)歷不同的進程啟動，而不同進程間也是通過Binder方式來通信，以前言中演示的startService為例，需要經(jīng)歷以下進程：
MainActivity進程->system_server進程->Zygote進程->Service所在進程->system_server進程->Service所在進程

當MainActivity里調(diào)用startService(Intent service)方法時，它實際上是調(diào)用ContextWrapper.startService(Intent service)，然后就從此展示分析。

2.1 MainActivity所在的App進程

步驟1.ContextWrapper.startService
源碼位置：/frameworks/base/core/java/android/content/ContextWrapper.java

public class ContextWrapper extends Context {
    Context mBase;
    ...
    @Override
    public ComponentName startService(Intent service) {
        return mBase.startService(service);
    }
    ...
}

源碼中可知，mBase的對象類型是Context，它實際上指向了Context的實現(xiàn)類ContextImpl，所以該方法進一步調(diào)用ContextImpl.startService。

步驟2.ContextImpl.startService
源碼位置：/frameworks/base/core/java/android/app/ContextImpl.java

@Override
    public ComponentName startService(Intent service) {
        warnIfCallingFromSystemProcess();
        return startServiceCommon(service, mUser);
    }
private ComponentName startServiceCommon(Intent service, UserHandle user) {
        try {
            validateServiceIntent(service);
            service.prepareToLeaveProcess(this);
            ComponentName cn = ActivityManagerNative.getDefault().startService(
                mMainThread.getApplicationThread(), service, service.resolveTypeIfNeeded(
                            getContentResolver()), getOpPackageName(), user.getIdentifier());
            if (cn != null) {
                if (cn.getPackageName().equals("!")) {
                    throw new SecurityException(
                            "Not allowed to start service " + service
                            + " without permission " + cn.getClassName());
                } else if (cn.getPackageName().equals("!!")) {
                    throw new SecurityException(
                            "Unable to start service " + service
                            + ": " + cn.getClassName());
                }
            }
            return cn;
        } catch (RemoteException e) {
            throw e.rethrowFromSystemServer();
        }
    }

startService方法內(nèi)部又調(diào)用了startServiceCommon方法，在startServiceCommon方法中調(diào)用ActivityManagerNative.getDefault().startService方法，ActivityManagerNative.getDefault()在startActivity啟動過程也介紹過，返回ActivityManagerService的遠程接口，即ActivityManagerProxy接口，接著看ActivityManagerProxy.startService()方法調(diào)用的源碼。
步驟3.ActivityManagerProxy.startService
源碼位置：/frameworks/base/core/java/android/app/ActivityManagerNative.java的內(nèi)部類

public ComponentName startService(IApplicationThread caller, Intent service,
            String resolvedType, String callingPackage, int userId) throws RemoteException
    {
        Parcel data = Parcel.obtain();
        Parcel reply = Parcel.obtain();
        data.writeInterfaceToken(IActivityManager.descriptor);
        data.writeStrongBinder(caller != null ? caller.asBinder() : null);
        service.writeToParcel(data, 0);
        data.writeString(resolvedType);
        data.writeString(callingPackage);
        data.writeInt(userId);
        mRemote.transact(START_SERVICE_TRANSACTION, data, reply, 0);
        reply.readException();
        ComponentName res = ComponentName.readFromParcel(reply);
        data.recycle();
        reply.recycle();
        return res;
    }

ActivityManagerProxy內(nèi)部通過Binder對象mRemote調(diào)用transact方法向ActivityManagerService發(fā)送一個START_SERVICE_TRANSACTION進程間通信請求。這樣就把啟動Service的操作交給system_server進程的ActivityManagerService處理

2.2 system_server進程

步驟4.ActivityManagerService.startService
源碼位置：
/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

@Override
    public ComponentName startService(IApplicationThread caller, Intent service,
            String resolvedType, String callingPackage, int userId)
            throws TransactionTooLargeException {
        enforceNotIsolatedCaller("startService");
        // Refuse possible leaked file descriptors
        if (service != null && service.hasFileDescriptors() == true) {
            throw new IllegalArgumentException("File descriptors passed in Intent");
        }

        if (callingPackage == null) {
            throw new IllegalArgumentException("callingPackage cannot be null");
        }

        if (DEBUG_SERVICE) Slog.v(TAG_SERVICE,
                "startService: " + service + " type=" + resolvedType);
        synchronized(this) {
            final int callingPid = Binder.getCallingPid();
            final int callingUid = Binder.getCallingUid();
            final long origId = Binder.clearCallingIdentity();
            ComponentName res = mServices.startServiceLocked(caller, service,
                    resolvedType, callingPid, callingUid, callingPackage, userId);
            Binder.restoreCallingIdentity(origId);
            return res;
        }
    }

mServices的類型是ActiveServices，ActiveServices是一個AMS的輔助類，管理Service類的啟動、綁定和銷毀等，因此進一步調(diào)用ActiveServices.startServiceLocked()方法執(zhí)行啟動Service組件的操作。
步驟5.ActiveServices.startServiceLocked
源碼位置：
/frameworks/base/services/core/java/com/android/server/am/ActiveServices.java

ComponentName startServiceLocked(IApplicationThread caller, Intent service, String resolvedType,
            int callingPid, int callingUid, String callingPackage, final int userId)
            throws TransactionTooLargeException {
      ...
    return startServiceInnerLocked(smap, service, r, callerFg, addToStarting);
}

ActiveServices.startServiceLocked方法最后會調(diào)用startServiceInnerLocked方法，看下它的實現(xiàn)。
步驟6.ActiveServices.startServiceInnerLocked
源碼位置：
/frameworks/base/services/core/java/com/android/server/am/ActiveServices.java

ComponentName startServiceInnerLocked(ServiceMap smap, Intent service, ServiceRecord r,
            boolean callerFg, boolean addToStarting) throws TransactionTooLargeException {
        ServiceState stracker = r.getTracker();
        if (stracker != null) {
            stracker.setStarted(true, mAm.mProcessStats.getMemFactorLocked(), r.lastActivity);
        }
        r.callStart = false;
        synchronized (r.stats.getBatteryStats()) {
            r.stats.startRunningLocked();
        }
        String error = bringUpServiceLocked(r, service.getFlags(), callerFg, false, false);
        if (error != null) {
            return new ComponentName("!!", error);
        }

        if (r.startRequested && addToStarting) {
            boolean first = smap.mStartingBackground.size() == 0;
            smap.mStartingBackground.add(r);
            r.startingBgTimeout = SystemClock.uptimeMillis() + BG_START_TIMEOUT;
            if (DEBUG_DELAYED_SERVICE) {
                RuntimeException here = new RuntimeException("here");
                here.fillInStackTrace();
                Slog.v(TAG_SERVICE, "Starting background (first=" + first + "): " + r, here);
            } else if (DEBUG_DELAYED_STARTS) {
                Slog.v(TAG_SERVICE, "Starting background (first=" + first + "): " + r);
            }
            if (first) {
                smap.rescheduleDelayedStarts();
            }
        } else if (callerFg) {
            smap.ensureNotStartingBackground(r);
        }

        return r.name;
    }

該方法中調(diào)用bringUpServiceLocked方法來啟動目標Service了，源碼如下
步驟7.ActiveServices.bringUpServiceLocked
源碼位置：
/frameworks/base/services/core/java/com/android/server/am/ActiveServices.java

private String bringUpServiceLocked(ServiceRecord r, int intentFlags, boolean execInFg,
            boolean whileRestarting, boolean permissionsReviewRequired)
            throws TransactionTooLargeException {
        ... 省略代碼
       
        final boolean isolated = (r.serviceInfo.flags&ServiceInfo.FLAG_ISOLATED_PROCESS) != 0;
        final String procName = r.processName;
        ProcessRecord app;

        if (!isolated) {
            // //根據(jù)進程名和uid，查詢ProcessRecord
            app = mAm.getProcessRecordLocked(procName, r.appInfo.uid, false);
            if (DEBUG_MU) Slog.v(TAG_MU, "bringUpServiceLocked: appInfo.uid=" + r.appInfo.uid
                        + " app=" + app);
            if (app != null && app.thread != null) {
                try {
                    app.addPackage(r.appInfo.packageName, r.appInfo.versionCode, mAm.mProcessStats);
              //如果service所在進程已經(jīng)存在，則通過以下方法啟動Service 
                    realStartServiceLocked(r, app, execInFg);
                    return null;
                } catch (TransactionTooLargeException e) {
                    throw e;
                } catch (RemoteException e) {
                    Slog.w(TAG, "Exception when starting service " + r.shortName, e);
                }

            }
        } else {
            app = r.isolatedProc;
        }
       //如果service所在進程未啟動，則通過startProcessLocked創(chuàng)建
        if (app == null && !permissionsReviewRequired) {
            if ((app=mAm.startProcessLocked(procName, r.appInfo, true, intentFlags,
                    "service", r.name, false, isolated, false)) == null) {
                String msg = "Unable to launch app "
                        + r.appInfo.packageName + "/"
                        + r.appInfo.uid + " for service "
                        + r.intent.getIntent() + ": process is bad";
                Slog.w(TAG, msg);
                bringDownServiceLocked(r);
                return msg;
            }
            if (isolated) {
                r.isolatedProc = app;
            }
        }

        if (!mPendingServices.contains(r)) {
            mPendingServices.add(r);
        }

        if (r.delayedStop) {
            // Oh and hey we've already been asked to stop!
            r.delayedStop = false;
            if (r.startRequested) {
                if (DEBUG_DELAYED_STARTS) Slog.v(TAG_SERVICE,
                        "Applying delayed stop (in bring up): " + r);
                stopServiceLocked(r);
            }
        }

        return null;
    }

前言中舉的例子MySerivce是一個遠程服務與MainActivity所在app屬于不同的進程，而此時MySerivce所在進程未啟動，因此會調(diào)用mAm.startProcessLocked方法，mAm是ActivityManagerService類的對象，那么接著看ActivityManagerService.startProcessLocked方法源碼。
步驟8.ActiveServices.startProcessLocked
源碼位置：
/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

final ProcessRecord startProcessLocked(String processName,
            ApplicationInfo info, boolean knownToBeDead, int intentFlags,
            String hostingType, ComponentName hostingName, boolean allowWhileBooting,
            boolean isolated, boolean keepIfLarge) {
        return startProcessLocked(processName, info, knownToBeDead, intentFlags, hostingType,
                hostingName, allowWhileBooting, isolated, 0 /* isolatedUid */, keepIfLarge,
                null /* ABI override */, null /* entryPoint */, null /* entryPointArgs */,
                null /* crashHandler */);
    }

startProcessLocked方法會調(diào)用該類不同的startProcessLocked重載方法，最終會調(diào)用如下方法
步驟9.ActiveServices.startProcessLocked
源碼位置：
/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

private final void startProcessLocked(ProcessRecord app, String hostingType,
            String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs) {
      ...
      Process.ProcessStartResult startResult = Process.start(entryPoint,
                    app.processName, uid, uid, gids, debugFlags, mountExternal,
                    app.info.targetSdkVersion, app.info.seinfo, requiredAbi, instructionSet,
                    app.info.dataDir, entryPointArgs);
      ...

Process.start()會向Zygote進程發(fā)送創(chuàng)建進程的請求。

2.3 Zygote進程

Zygote進程創(chuàng)建一個新的應用進程（即Service所在進程），這個新進程以ActivityThread 類的靜態(tài)成員函數(shù)main()為入口。

2.4 Service所在進程

步驟10.ActivityThread.main
源碼位置：/frameworks/base/core/java/android/app/ActivityThread.java

public static void main(String[] args) {
        Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "ActivityThreadMain");
        SamplingProfilerIntegration.start();

        // CloseGuard defaults to true and can be quite spammy.  We
        // disable it here, but selectively enable it later (via
        // StrictMode) on debug builds, but using DropBox, not logs.
        CloseGuard.setEnabled(false);

        Environment.initForCurrentUser();

        // Set the reporter for event logging in libcore
        EventLogger.setReporter(new EventLoggingReporter());

        // Make sure TrustedCertificateStore looks in the right place for CA certificates
        final File configDir = Environment.getUserConfigDirectory(UserHandle.myUserId());
        TrustedCertificateStore.setDefaultUserDirectory(configDir);

        Process.setArgV0("<pre-initialized>");

        Looper.prepareMainLooper();

        ActivityThread thread = new ActivityThread();
        thread.attach(false);

        if (sMainThreadHandler == null) {
            sMainThreadHandler = thread.getHandler();
        }

        if (false) {
            Looper.myLooper().setMessageLogging(new
                    LogPrinter(Log.DEBUG, "ActivityThread"));
        }

        // End of event ActivityThreadMain.
        Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
        Looper.loop();

        throw new RuntimeException("Main thread loop unexpectedly exited");
    }

在main函數(shù)中，也會創(chuàng)建該進程的UI線程的Looper以及l(fā)oop()。創(chuàng)建完ActivityThread調(diào)用ActivityThread.attach函數(shù)進一步處理。
步驟11.ActivityThread.attach
源碼位置:/frameworks/base/core/java/android/app/ActivityThread.java

private void attach(boolean system) {
      ...
       final IActivityManager mgr = ActivityManagerNative.getDefault();
            try {
                mgr.attachApplication(mAppThread);
            } catch (RemoteException ex) {
                throw ex.rethrowFromSystemServer();
            }
      ...
}

ActivityManagerNative.getDefault()已經(jīng)見過多次，它會ActivityManagerProxy類對象
步驟12.ActivityManagerProxy.attachApplication
源碼位置：/frameworks/base/core/java/android/app/ActivityManagerNative.java內(nèi)部類

 public void attachApplication(IApplicationThread app) throws RemoteException
    {
        Parcel data = Parcel.obtain();
        Parcel reply = Parcel.obtain();
        data.writeInterfaceToken(IActivityManager.descriptor);
        data.writeStrongBinder(app.asBinder());
        mRemote.transact(ATTACH_APPLICATION_TRANSACTION, data, reply, 0);
        reply.readException();
        data.recycle();
        reply.recycle();
    }

ActivityManagerProxy內(nèi)部通過Binder對象mRemote調(diào)用transact方法向ActivityManagerService發(fā)送一個ATTACH_APPLICATION_TRANSACTION進程間通信請求。這樣就又把啟動Service的操作交回給system_server進程的ActivityManagerService處理

2.5 system_server進程

步驟13.ActivityManagerService.attachApplication
源碼位置：
/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

@Override
    public final void attachApplication(IApplicationThread thread) {
        synchronized (this) {
            int callingPid = Binder.getCallingPid();
            final long origId = Binder.clearCallingIdentity();
            attachApplicationLocked(thread, callingPid);
            Binder.restoreCallingIdentity(origId);
        }
    }

步驟14.ActivityManagerService.attachApplicationLocked
源碼位置：
/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

private final boolean attachApplicationLocked(IApplicationThread thread,
            int pid) {
      ...
      if (!badApp) {
            try {
                didSomething |= mServices.attachApplicationLocked(app, processName);
            } catch (Exception e) {
                Slog.wtf(TAG, "Exception thrown starting services in " + app, e);
                badApp = true;
            }
        }
      ...
}

步驟15.ActivityServices.attachApplicationLocked
源碼位置：
/frameworks/base/services/core/java/com/android/server/am/ActiveServices.java

boolean attachApplicationLocked(ProcessRecord proc, String processName)
            throws RemoteException {
      boolean didSomething = false;
        // Collect any services that are waiting for this process to come up.
        if (mPendingServices.size() > 0) {
            ServiceRecord sr = null;
            try {
                for (int i=0; i<mPendingServices.size(); i++) {
                    sr = mPendingServices.get(i);
                    if (proc != sr.isolatedProc && (proc.uid != sr.appInfo.uid
                            || !processName.equals(sr.processName))) {
                        continue;
                    }

                    mPendingServices.remove(i);
                    i--;
                    proc.addPackage(sr.appInfo.packageName, sr.appInfo.versionCode,
                            mAm.mProcessStats);
                    realStartServiceLocked(sr, proc, sr.createdFromFg);
                    didSomething = true;
                    if (!isServiceNeeded(sr, false, false)) {
                        bringDownServiceLocked(sr);
                    }
                }
            } catch (RemoteException e) {
                Slog.w(TAG, "Exception in new application when starting service "
                        + sr.shortName, e);
                throw e;
            }
        }
        if (mRestartingServices.size() > 0) {
            ServiceRecord sr;
            for (int i=0; i<mRestartingServices.size(); i++) {
                sr = mRestartingServices.get(i);
                if (proc != sr.isolatedProc && (proc.uid != sr.appInfo.uid
                        || !processName.equals(sr.processName))) {
                    continue;
                }
                mAm.mHandler.removeCallbacks(sr.restarter);
                mAm.mHandler.post(sr.restarter);
            }
        }
        return didSomething;

步驟16.ActivityServices.realStartServiceLocked
源碼位置：
/frameworks/base/services/core/java/com/android/server/am/ActiveServices.java

private final void realStartServiceLocked(ServiceRecord r,
            ProcessRecord app, boolean execInFg) throws RemoteException {
      ...
      app.thread.scheduleCreateService(r, r.serviceInfo,
                    mAm.compatibilityInfoForPackageLocked(r.serviceInfo.applicationInfo),
                    app.repProcState);
      ...
}

該函數(shù)進一步調(diào)用ApplicationThreadNative$ApplicationThreadProxy.scheduleCreateService()方法執(zhí)行Service組件啟動操作?？丛创a：

public final void scheduleCreateService(IBinder token, ServiceInfo info,
            CompatibilityInfo compatInfo, int processState) throws RemoteException {
        Parcel data = Parcel.obtain();
        data.writeInterfaceToken(IApplicationThread.descriptor);
        data.writeStrongBinder(token);
        info.writeToParcel(data, 0);
        compatInfo.writeToParcel(data, 0);
        data.writeInt(processState);
        try {
            mRemote.transact(SCHEDULE_CREATE_SERVICE_TRANSACTION, data, null,
                    IBinder.FLAG_ONEWAY);
        } catch (TransactionTooLargeException e) {
            Log.e("CREATE_SERVICE", "Binder failure starting service; service=" + info);
            throw e;
        }
        data.recycle();
    }

ApplicationThreadProxy內(nèi)部通過Binder對象mRemote調(diào)用transact方法向ApplicationThread發(fā)送一個SCHEDULE_CREATE_SERVICE_TRANSACTION進程間通信請求。這樣就又把啟動Service的操作交回給service所在的進程處理

2.5 service所在進程

步驟17.ActivityThread$ApplicationThread.scheduleCreateService
源碼位置：
/frameworks/base/core/java/android/app/ActivityThread.java

public final void scheduleCreateService(IBinder token,
                ServiceInfo info, CompatibilityInfo compatInfo, int processState) {
            updateProcessState(processState, false);
            CreateServiceData s = new CreateServiceData();
            s.token = token;
            s.info = info;
            s.compatInfo = compatInfo;

            sendMessage(H.CREATE_SERVICE, s);
        }

步驟18.ActivityThread.sendMessage
源碼位置：
/frameworks/base/core/java/android/app/ActivityThread.java

private void sendMessage(int what, Object obj, int arg1, int arg2, boolean async) {
        if (DEBUG_MESSAGES) Slog.v(
            TAG, "SCHEDULE " + what + " " + mH.codeToString(what)
            + ": " + arg1 + " / " + obj);
        Message msg = Message.obtain();
        msg.what = what;
        msg.obj = obj;
        msg.arg1 = arg1;
        msg.arg2 = arg2;
        if (async) {
            msg.setAsynchronous(true);
        }
        mH.sendMessage(msg);
    }

mH是一個H對象，類H是ActivityThread的內(nèi)部類，并繼承了Handler。接著在handleMessage方法中看CREATE_SERVICE類型消息的處理
步驟19.ActivityThread$H.handleMessage
源碼位置：
/frameworks/base/core/java/android/app/ActivityThread.java內(nèi)部類H

public void handleMessage(Message msg) {
      ...
      case CREATE_SERVICE:
                    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, ("serviceCreate: " + String.valueOf(msg.obj)));
                    handleCreateService((CreateServiceData)msg.obj);
                    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
                    break;
      ...
}

啟動過程又調(diào)用ActivityThread.handleCreateService方法來實現(xiàn)
步驟20.ActivityThread.handleCreateService
源碼位置：
/frameworks/base/core/java/android/app/ActivityThread.java

private void handleCreateService(CreateServiceData data) {
        // If we are getting ready to gc after going to the background, well
        // we are back active so skip it.
        unscheduleGcIdler();

        LoadedApk packageInfo = getPackageInfoNoCheck(
                data.info.applicationInfo, data.compatInfo);
        Service service = null;
        try {
            java.lang.ClassLoader cl = packageInfo.getClassLoader();
            service = (Service) cl.loadClass(data.info.name).newInstance();
        } catch (Exception e) {
            if (!mInstrumentation.onException(service, e)) {
                throw new RuntimeException(
                    "Unable to instantiate service " + data.info.name
                    + ": " + e.toString(), e);
            }
        }

        try {
            if (localLOGV) Slog.v(TAG, "Creating service " + data.info.name);

            ContextImpl context = ContextImpl.createAppContext(this, packageInfo);
            context.setOuterContext(service);

            Application app = packageInfo.makeApplication(false, mInstrumentation);
            service.attach(context, this, data.info.name, data.token, app,
                    ActivityManagerNative.getDefault());
            service.onCreate();
            mServices.put(data.token, service);
            try {
                ActivityManagerNative.getDefault().serviceDoneExecuting(
                        data.token, SERVICE_DONE_EXECUTING_ANON, 0, 0);
            } catch (RemoteException e) {
                throw e.rethrowFromSystemServer();
            }
        } catch (Exception e) {
            if (!mInstrumentation.onException(service, e)) {
                throw new RuntimeException(
                    "Unable to create service " + data.info.name
                    + ": " + e.toString(), e);
            }
        }
    }

handleCreateService方法執(zhí)行一些對象的創(chuàng)建，然后在代碼中調(diào)用service.onCreate()方法
步驟21.Activity.onCreate
源碼位置：/frameworks/base/core/java/android/app/Service.java
終于找到期待已久的Service生命周期中onCreate方法的調(diào)用。

這樣就完成了startService啟動主流程的追蹤分析。