Service启动流程源码分析之startService（一）
1、概要
我们平时在开发Android应用时，一般会将一些需要计算的逻辑放到独立进程的Service中处理，这样主进程就可以响应用户的其他操作从而提高用户体验。Android在此为我们提供了Service服务，我们只需实现继承Service的子类，然后通过startService来启动这个服务就可以了。
接下来我们将开始详细的介绍在主线程中如何通过startService来启动新进程中的服务（本文主要阐述启动新进程的服务，在同一进程中的服务我们也会稍微提及）。
由于Service的启动流程和Activity比较相似，所以在开始分析之前，希望大家可以先了解一下Activity的启动方式Activity启动流程源码分析之入门（一）。
2、startService启动流程时序图
以上就是通过startService来启动Service的流程时序图，接下来我们将对照该图详细的讲解其启动流程。
3、startService源码分析
由于大家平时在开发Android应用时，通过startService启动Service这种方式应该用的比较多了，所以这里我就不举示例了，但是我们要注意一点，今天我们是在新进程中启动Service，所以需要在AndroidManifest文件中把Service配置android:process属性，那样才能启动新进程。
好啦，话不多说让我们进入startService方法吧（顺便说一下，本次源码是基于Android5.1）。
大家首先要明白一个问题，在Activity中使用的startService方法是定义在Context的抽象类中，它的真正实现者是ContextImpl，所以我们首先进入ContextImpl类，大家如果不是很清楚可以看下我的另外一篇博客Android中的Context源码分析。
（1）ContextImpl.startService()
源码：frameworks/base/core/java/android/app/ContextImpl.java
@Override
public ComponentName startService(Intent service) {
warnIfCallingFromSystemProcess();
return startServiceCommon(service, mUser);
}
private ComponentName startServiceCommon(Intent service, UserHandle user) {
try {
validateServiceIntent(service);
service.prepareToLeaveProcess();
ComponentName cn = ActivityManagerNative.getDefault().startService(
mMainThread.getApplicationThread(), service,
service.resolveTypeIfNeeded(getContentResolver()), user.getIdentifier());
//......
return cn;
} catch (RemoteException e) {
return null;
}
}从ContextImpl类的startService开始，然后进入本类的startServiceCommon方法，并最终调用ActivityManagerNative.getDefault()对象的startService方法。其实这里的ActivityManagerNative.getDefault()就是ActivityManagerProxy对象，如果不是很清楚可以看我的另外一篇博客ActivityManagerService与应用程序通信分析。
（2）ActivityManagerProxy.startService()
源码：frameworks/base/core/java/android/app/ActivityManagerNative.java
public ComponentName startService(IApplicationThread caller, Intent service,
String resolvedType, int userId) throws RemoteException
{
Parcel data = Parcel.obtain();
Parcel reply = Parcel.obtain();
data.writeInterfaceToken(IActivityManager.descriptor);
data.writeStrongBinder(caller != null ? caller.asBinder() : null);
service.writeToParcel(data, 0);
data.writeString(resolvedType);
data.writeInt(userId);
mRemote.transact(START_SERVICE_TRANSACTION, data, reply, 0);
reply.readException();
ComponentName res = ComponentName.readFromParcel(reply);
data.recycle();
reply.recycle();
return res;
}通过Binder调用ActivityManagerNative类中onTransact方法，其识别码为START_SERVICE_TRANSACTION，并最终调用ActivityManagerNative的实现类ActivityManagerService的startService方法。
（3）ActivityManagerService.startService()
源码：frameworks/base/services/java/com/android/server/am/ActivityManagerService.java
@Override
public ComponentName startService(IApplicationThread caller, Intent service,
String resolvedType, int userId) {
enforceNotIsolatedCaller("startService");
//......
synchronized(this) {
final int callingPid = Binder.getCallingPid();
final int callingUid = Binder.getCallingUid();
final long origId = Binder.clearCallingIdentity();
ComponentName res = mServices.startServiceLocked(caller, service,
resolvedType, callingPid, callingUid, userId);
Binder.restoreCallingIdentity(origId);
return res;
}
}在这里调用mServices对象的startServiceLocked方法，这里的mServices对象是ActiveServices类。
（4）ActiveServices.startServiceLocked()
源码：frameworks/base/services/java/com/android/server/am/ActiveServices.java
ComponentName startServiceLocked(IApplicationThread caller,
Intent service, String resolvedType,
int callingPid, int callingUid, int userId) {
//......
ServiceLookupResult res =
retrieveServiceLocked(service, resolvedType,
callingPid, callingUid, userId, true, callerFg);
ServiceRecord r = res.record;
//......
return startServiceInnerLocked(smap, service, r, callerFg, addToStarting);
}首先通过retrieveServiceLocked方法来解析service这个Intent，就是解析前面我们在AndroidManifest.xml定义的Service标签的intent-filter相关内容，然后将解析结果放在res.record中，最后在调用startServiceInnerLocked方法。
（5）ActiveServices.startServiceInnerLocked()
源码：frameworks/base/services/java/com/android/server/am/ActiveServices.java
ComponentName startServiceInnerLocked(ServiceMap smap, Intent service,
ServiceRecord r, boolean callerFg, boolean addToStarting) {
//......
synchronized (r.stats.getBatteryStats()) {
r.stats.startRunningLocked();
}
String error = bringUpServiceLocked(r, service.getFlags(), callerFg, false);
//......
}这里紧接着会调用bringUpServiceLocked方法。
（6）ActiveServices.bringUpServiceLocked()
源码：frameworks/base/services/java/com/android/server/am/ActiveServices.java
private final String bringUpServiceLocked(ServiceRecord r,
int intentFlags, boolean execInFg, boolean whileRestarting) {
//（1）这里如果当前的ProcessRecord不为null，那就不需要重新创建进程，而是调用realStartServiceLocked方法来启动Service
if (app != null && app.thread != null) {
try {
app.addPackage(r.appInfo.packageName, r.appInfo.versionCode, mAm.mProcessStats);
realStartServiceLocked(r, app, execInFg);
return null;
} catch (RemoteException e) {
Slog.w(TAG, "Exception when starting service " + r.shortName, e);
}
// If a dead object exception was thrown -- fall through to
// restart the application.
}
//（2）如果是需要创建新进程，那么将调用ActivityManagerService.startProcessLocked方法来启动新进程
if (app == null) {
if ((app=mAm.startProcessLocked(procName, r.appInfo, true, intentFlags,
"service", r.name, false, isolated, false)) == null) {
//......
bringDownServiceLocked(r);
return msg;
}
if (isolated) {
r.isolatedProc = app;
}
}
//最后将ServiceRecord保存到成员变量mPendingServices中
if (!mPendingServices.contains(r)) {
mPendingServices.add(r);
}
}这个方法比较重要，这里有两种选择，当Service所在的进程存在时，将调用realStartServiceLocked方法来启动Service，否则的话调用startProcessLocked方法来启动新进程。
（7）ActivityManagerService.startProcessLocked()
源码：frameworks/base/services/java/com/android/server/am/ActivityManagerService.java
private final void startProcessLocked(ProcessRecord app, String hostingType,
String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs) {
boolean isActivityProcess = (entryPoint == null);
if (entryPoint == null) entryPoint = "android.app.ActivityThread";
checkTime(startTime, "startProcess: asking zygote to start proc");
//通过processName,uid等启动新进程
Process.ProcessStartResult startResult = Process.start(entryPoint,
app.processName, uid, uid, gids, debugFlags, mountExternal,
app.info.targetSdkVersion, app.info.seinfo, requiredAbi, instructionSet,
app.info.dataDir, entryPointArgs);
}这里通过Process的start方法启动ActivityThread的新进程，我们进入该类的main方法。
（8）ActivityThread.main()
源码：frameworks/base/core/java/android/app/ActivityThread.java
public static void main(String[] args) {
//......
Process.setArgV0("" );
Looper.prepareMainLooper();
//创建ActivityThread对象，并调用其attach方法
ActivityThread thread = new ActivityThread();
thread.attach(false);
if (sMainThreadHandler == null) {
sMainThreadHandler = thread.getHandler();
}
if (false) {
Looper.myLooper().setMessageLogging(new
LogPrinter(Log.DEBUG, "ActivityThread"));
}
Looper.loop();
throw new RuntimeException("Main thread loop unexpectedly exited");
}
private void attach(boolean system) {
final IActivityManager mgr = ActivityManagerNative.getDefault();
try {
//这里调用了ActivityManagerProxy.attachApplication方法。
mgr.attachApplication(mAppThread);
} catch (RemoteException ex) {
// Ignore
}
}在Android应用程序中，每一个进程对应一个ActivityThread实例，然后这里创建了ActivityThread对象并调用了其attach方法，在attach方法中又调用了ActivityManagerProxy.attachApplication方法。
（9）ActivityManagerProxy.attachApplication()
源码：frameworks/base/core/java/android/app/ActivityManagerNative.java
public void attachApplication(IApplicationThread app) throws RemoteException
{
Parcel data = Parcel.obtain();
Parcel reply = Parcel.obtain();
data.writeInterfaceToken(IActivityManager.descriptor);
data.writeStrongBinder(app.asBinder());
mRemote.transact(ATTACH_APPLICATION_TRANSACTION, data, reply, 0);
reply.readException();
data.recycle();
reply.recycle();
}通过Binder机制会调用ActivityManagerNative中的onTransact方法，其识别码为ATTACH_APPLICATION_TRANSACTION，并最终调用ActivityManagerService中的attachApplication方法。
（10）ActivityManagerService.attachApplication()
源码：frameworks/base/services/java/com/android/server/am/ActivityManagerService.java
@Override
public final void attachApplication(IApplicationThread thread) {
synchronized (this) {
int callingPid = Binder.getCallingPid();
final long origId = Binder.clearCallingIdentity();
attachApplicationLocked(thread, callingPid);
Binder.restoreCallingIdentity(origId);
//......
}
}这里调用attachApplicationLocked方法来进一步处理。
（11）ActivityManagerService.attachApplicationLocked()
源码：frameworks/base/services/java/com/android/server/am/ActivityManagerService.java
private final boolean attachApplicationLocked(IApplicationThread thread,
int pid) {
// See if the top visible activity is waiting to run in this process...
if (normalMode) {
try {
if (mStackSupervisor.attachApplicationLocked(app)) {
didSomething = true;
}
} catch (Exception e) {
Slog.wtf(TAG, "Exception thrown launching activities in " + app, e);
badApp = true;
}
}
// Find any services that should be running in this process...
if (!badApp) {
try {
//这里会调用ActiveServices对象的attachApplicationLocked方法
didSomething |= mServices.attachApplicationLocked(app, processName);
} catch (Exception e) {
Slog.wtf(TAG, "Exception thrown starting services in " + app, e);
badApp = true;
}
}
}这里如果是启动Service将调用ActiveServices对象的attachApplicationLocked方法，而如果是启动Activity将调用ActivityStackSupervisor对象的attachApplicationLocked方法。
（12）ActiveServices.attachApplicationLocked()
源码：frameworks/base/services/java/com/android/server/am/ActiveServices.java
boolean attachApplicationLocked(ProcessRecord proc, String processName)
throws RemoteException {
boolean didSomething = false;
// Collect any services that are waiting for this process to come up.
if (mPendingServices.size() > 0) {
ServiceRecord sr = null;
try {
for (int i=0; i
sr = mPendingServices.get(i);
if (proc != sr.isolatedProc && (proc.uid != sr.appInfo.uid
|| !processName.equals(sr.processName))) {
continue;
}
mPendingServices.remove(i);
i--;
proc.addPackage(sr.appInfo.packageName, sr.appInfo.versionCode,mAm.mProcessStats);
//这里调用realStartServiceLocked方法
realStartServiceLocked(sr, proc, sr.createdFromFg);
didSomething = true;
}
} catch (RemoteException e) {
Slog.w(TAG, "Exception in new application when starting service "+ sr.shortName, e);
throw e;
}
}
//......
} （13）ActiveServices.realStartServiceLocked()
源码：frameworks/base/services/java/com/android/server/am/ActiveServices.java
private final void realStartServiceLocked(ServiceRecord r,
ProcessRecord app, boolean execInFg) throws RemoteException {
if (app.thread == null) {
throw new RemoteException();
}
//......
app.thread.scheduleCreateService(r, r.serviceInfo,
mAm.compatibilityInfoForPackageLocked(r.serviceInfo.applicationInfo),
app.repProcState);
}此处的app.thread是一个IApplicationThread对象，而IApplicationThread的代理类是ApplicationThreadProxy，我们进入app.thread对象的scheduleCreateService方法。
（14）ApplicationThreadProxy.scheduleCreateService()
源码：frameworks/base/core/java/android/app/ApplicationThreadNative.java
public final void scheduleCreateService(IBinder token, ServiceInfo info,
CompatibilityInfo compatInfo, int processState) throws RemoteException {
Parcel data = Parcel.obtain();
data.writeInterfaceToken(IApplicationThread.descriptor);
data.writeStrongBinder(token);
info.writeToParcel(data, 0);
compatInfo.writeToParcel(data, 0);
data.writeInt(processState);
mRemote.transact(SCHEDULE_CREATE_SERVICE_TRANSACTION, data, null,
IBinder.FLAG_ONEWAY);
data.recycle();
}通过Binder对象调用ApplicationThreadNative的onTransact方法，在其方法中调用子类的scheduleCreateService方法，即最终调用ApplicationThreadNative的子类ApplicationThread的scheduleCreateService方法。
（15）ApplicationThread.scheduleCreateService()
源码：frameworks/base/core/java/android/app/ActivityThread.java
public final void scheduleCreateService(IBinder token,
ServiceInfo info, CompatibilityInfo compatInfo, int processState) {
updateProcessState(processState, false);
CreateServiceData s = new CreateServiceData();
s.token = token;
s.info = info;
s.compatInfo = compatInfo;
sendMessage(H.CREATE_SERVICE, s);
}通过Handler发送Message来处理该操作，并进入到H的handleMessage方法中，其识别码为CREATE_SERVICE。
（16）H.handleMessage()
源码：frameworks/base/core/java/android/app/ApplicationThread.java
private class H extends Handler {
public void handleMessage(Message msg) {
Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceCreate");
//这里调用handleCreateService方法
handleCreateService((CreateServiceData)msg.obj);
Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
}
}我们继续进入handleCreateService方法。
（17）ApplicationThread.handleCreateService()
源码：frameworks/base/core/java/android/app/ActivityThread.java
private void handleCreateService(CreateServiceData data) {
Service service = null;
try {
//（1）通过类加载器来加载Service对象
java.lang.ClassLoader cl = packageInfo.getClassLoader();
service = (Service) cl.loadClass(data.info.name).newInstance();
} catch (Exception e) {
//......
}
//（2）这里创建ContextImpl对象
ContextImpl context = ContextImpl.createAppContext(this, packageInfo);
context.setOuterContext(service);
Application app = packageInfo.makeApplication(false, mInstrumentation);
service.attach(context, this, data.info.name, data.token, app,
ActivityManagerNative.getDefault());
//（3）这里调用Service的onCreate方法
service.onCreate();
mServices.put(data.token, service);
}（1）处通过类加载器ClassLoader来加载Service对象，此处的data.info.name就是我们要启动的Service，加载完成后需要将其强转换为Service对象，也就是说我们的Service必须要继承于Service基类。
（2）处这里先创建一个ContextImpl对象，每个Activity和Service都有一个Context对象。
（3）处这里调用Service的OnCreate方法。
好啦，到此整个Service通过startService的方式就启动起来了，接下来我们总结一下步骤。
4、总结
1、（1）-（7）从主进程调用到ActivityManagerService进程中，并调用其startProcessLocked方法来启动新的进程。
2、（8）-（11）从新进程调用到ActivityManagerService进程中，获取要启动的服务的相关信息。
3、（12）-（17）从ActivityManagerService进程回到新进程中并最终将服务启动起来。
好啦，本篇通过startService来启动新进程服务就介绍到这里啦，下篇我们将分析通过bindService来启动服务Service启动流程源码分析之bindService（二）。