一个需要进行Binder通信的Client一般通过bindService()来启动Service。
bindService(it, mServiceConnection, Service.BIND_AUTO_CREATE);binderService()的实现在ContextWrapper中，
frameworks/base/core/java/android/app/ContextImpl.java
@Override
public boolean bindService(Intent service, ServiceConnection conn,
int flags) {
//如果是系统进程，发出警告
warnIfCallingFromSystemProcess();
return bindServiceCommon(service, conn, flags, Process.myUserHandle());
}
......
private boolean bindServiceCommon(Intent service, ServiceConnection conn, int flags,
UserHandle user) {
IServiceConnection sd;
......
if (mPackageInfo != null) {
// 获取IServiceConnection对象
sd = mPackageInfo.getServiceDispatcher(conn, getOuterContext(),
mMainThread.getHandler(), flags);
} else {
throw new RuntimeException("Not supported in system context");
}
// 验证service有效性
validateServiceIntent(service);
try {
......
// 准备离开应用程序
service.prepareToLeaveProcess();
// 调用ActivityManagerProxy的bindService()
int res = ActivityManagerNative.getDefault().bindService(
mMainThread.getApplicationThread(), getActivityToken(),
service, service.resolveTypeIfNeeded(getContentResolver()),
sd, flags, user.getIdentifier());
......
}
}其中，getServiceDispatcher()返回一个IServiceConnection对象，它为一个Binder实体，将负责与ServiceConnection通信。
frameworks/base/core/java/android/app/LoadedApk.java
public final IServiceConnection getServiceDispatcher(ServiceConnection c,
Context context, Handler handler, int flags) {
synchronized (mServices) {
LoadedApk.ServiceDispatcher sd = null;
// 获取map，map存储ServiceConnection与ServiceDispatcher的映射
ArrayMap map = mServices.get(context);
if (map != null) {
sd = map.get(c);
}
// 如果map中没有c映射，新建一个插入到mServices和map中
if (sd == null) {
sd = new ServiceDispatcher(c, context, handler, flags);
if (map == null) {
map = new ArrayMap();
mServices.put(context, map);
}
map.put(c, sd);
} else {
sd.validate(context, handler);
}
// 返回mIServiceConnection，InnerConnection对象
return sd.getIServiceConnection();
}
} 接着看bindService。通过ActivityManagerNative.getDefault()获得了ActivityManagerProxy, 它的bindService()就是发起一个Binder调用。调用的远端为system_server的ActivityManagerService。
frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
public int bindService(IApplicationThread caller, IBinder token,
Intent service, String resolvedType,
IServiceConnection connection, int flags, int userId) {
enforceNotIsolatedCaller("bindService");
// Refuse possible leaked file descriptors
if (service != null && service.hasFileDescriptors() == true) {
throw new IllegalArgumentException("File descriptors passed in Intent");
}
synchronized(this) {
return mServices.bindServiceLocked(caller, token, service, resolvedType,
connection, flags, userId);
}
}mServices为ActiveServices的对象。
frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
int bindServiceLocked(IApplicationThread caller, IBinder token,
Intent service, String resolvedType,
IServiceConnection connection, int flags, int userId) {
......
// 查找发起bindSevice应用在AMS中的记录
final ProcessRecord callerApp = mAm.getRecordForAppLocked(caller);
......
if (callerApp.info.uid == Process.SYSTEM_UID) {
// 当应用为system进程时
......
}
......
final boolean callerFg = callerApp.setSchedGroup != Process.THREAD_GROUP_BG_NONINTERACTIVE;
// 根据Intent查找相应的服务
ServiceLookupResult res =
retrieveServiceLocked(service, resolvedType,
Binder.getCallingPid(), Binder.getCallingUid(), userId, true, callerFg);
......
ServiceRecord s = res.record;
final long origId = Binder.clearCallingIdentity();
try {
// 取消服务的restart机制
if (unscheduleServiceRestartLocked(s, callerApp.info.uid, false)) {
if (DEBUG_SERVICE) Slog.v(TAG, "BIND SERVICE WHILE RESTART PENDING: "
+ s);
}
if ((flags&Context.BIND_AUTO_CREATE) != 0) {
// 更新服务最后活跃时间
s.lastActivity = SystemClock.uptimeMillis();
if (!s.hasAutoCreateConnections()) {
// 如果是第一次连接，设置bind
// This is the first binding, let the tracker know.
ProcessStats.ServiceState stracker = s.getTracker();
if (stracker != null) {
stracker.setBound(true, mAm.mProcessStats.getMemFactorLocked(),
s.lastActivity);
}
}
}
mAm.startAssociationLocked(callerApp.uid, callerApp.processName,
s.appInfo.uid, s.name, s.processName);
// 创建AppBindRecord，关联应用与服务
AppBindRecord b = s.retrieveAppBindingLocked(service, callerApp);
// 创建ConnectionRecord，记录bind信息
ConnectionRecord c = new ConnectionRecord(b, activity,
connection, flags, clientLabel, clientIntent);
// 转换interface到binder
IBinder binder = connection.asBinder();
ArrayList clist = s.connections.get(binder);
if (clist == null) {
clist = new ArrayList();
s.connections.put(binder, clist);
}
// 将新的Connection加入到ServiceRecord和AppBindRecord中
clist.add(c);
b.connections.add(c);
if (activity != null) {
// 当由activity发起bind时，将Connection加入到ActivityRecord
if (activity.connections == null) {
activity.connections = new HashSet();
}
activity.connections.add(c);
}
// 将新的Connection加入到AppBindRecord的client中
b.client.connections.add(c);
if ((c.flags&Context.BIND_ABOVE_CLIENT) != 0) {
b.client.hasAboveClient = true;
}
if (s.app != null) {
updateServiceClientActivitiesLocked(s.app, c, true);
}
// 将新的Connection加入到service connections映射表中
clist = mServiceConnections.get(binder);
if (clist == null) {
clist = new ArrayList();
mServiceConnections.put(binder, clist);
}
clist.add(c);
if ((flags&Context.BIND_AUTO_CREATE) != 0) {
// 更新服务最后活跃时间，启动服务
s.lastActivity = SystemClock.uptimeMillis();
if (bringUpServiceLocked(s, service.getFlags(), callerFg, false) != null) {
return 0;
}
}
......
if (s.app != null && b.intent.received) {
// 如果service已经运行，声明已连接，回调到应用的onServiceConnected
try {
c.conn.connected(s.name, b.intent.binder);
......
}
// 如果第一个连接的应用重新bind时执行onRebind
if (b.intent.apps.size() == 1 && b.intent.doRebind) {
requestServiceBindingLocked(s, b.intent, callerFg, true);
}
} else if (!b.intent.requested) {
// 执行onBind
requestServiceBindingLocked(s, b.intent, callerFg, false);
}
getServiceMap(s.userId).ensureNotStartingBackground(s);
} finally {
Binder.restoreCallingIdentity(origId);
}
return 1;
} 上述的流程中有两个对connection的描述，需要区分一下。一个是传参进入的IServiceConnection对象，它实质上时一个Binder，由bindService发起端创建。应用创建一个ServiceConnection Binder，将代理传递到system_server中，这样system_server可以返回conneted和disconnected等状态。另一个connect是函数内部创建的ConnectionRecord对象。它描述了bind service的相关信息，并存储到ServiceRecord和AppBindRecord中。
Service的启动通过bringUpServiceLocked()完成。
frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
private final String bringUpServiceLocked(ServiceRecord r,
int intentFlags, boolean execInFg, boolean whileRestarting) {
if (r.app != null && r.app.thread != null) {
// 如果service已经运行，直接执行onStartCommand
sendServiceArgsLocked(r, execInFg, false);
return null;
}
......
// Service启动过程中不能停止package
try {
AppGlobals.getPackageManager().setPackageStoppedState(
r.packageName, false, r.userId);
......
}
final boolean isolated = (r.serviceInfo.flags&ServiceInfo.FLAG_ISOLATED_PROCESS) != 0;
final String procName = r.processName;
ProcessRecord app;
if (!isolated) {
// 如果服务进程已经启动，则启动服务
app = mAm.getProcessRecordLocked(procName, r.appInfo.uid, false);
if (app != null && app.thread != null) {
try {
app.addPackage(r.appInfo.packageName, r.appInfo.versionCode, mAm.mProcessStats);
realStartServiceLocked(r, app, execInFg);
return null;
......
}
// 如果服务进程不存在，先创建进程，然后将服务加入队列，等待执行
if (app == null) {
if ((app=mAm.startProcessLocked(procName, r.appInfo, true, intentFlags,
"service", r.name, false, isolated, false)) == null) {
......
}
if (!mPendingServices.contains(r)) {
mPendingServices.add(r);
}
......
return null;
}当服务进程不存在时，需要先创建服务进程，然后再启动进程。启动进程通过AMS的startProcessLocked来完成。startProcessLocked中通过Process.start()创建新进程。新进程启动时会执行ActivityThread的main函数，里面会调用到ActivityThread.attach。这个attach通过binder最终调用到AMS中的attachApplication，再调用ActiveServices的attachApplicationLocked，这里启动pending的service。启动还是通过realStartServiceLocked完成的。
frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
private final void realStartServiceLocked(ServiceRecord r,
ProcessRecord app, boolean execInFg) throws RemoteException {
......
r.app = app;
r.restartTime = r.lastActivity = SystemClock.uptimeMillis();
app.services.add(r);
bumpServiceExecutingLocked(r, execInFg, "create");
mAm.updateLruProcessLocked(app, false, null);
mAm.updateOomAdjLocked();
boolean created = false;
try {
......
mAm.ensurePackageDexOpt(r.serviceInfo.packageName);
app.forceProcessStateUpTo(ActivityManager.PROCESS_STATE_SERVICE);
// 启动service
app.thread.scheduleCreateService(r, r.serviceInfo,
mAm.compatibilityInfoForPackageLocked(r.serviceInfo.applicationInfo),
app.repProcState);
r.postNotification();
created = true;
......
}
// 执行service的onBind
requestServiceBindingsLocked(r, execInFg);
// 更新client状态
updateServiceClientActivitiesLocked(app, null, true);
......
// 执行Service的onStartCommand方法
sendServiceArgsLocked(r, execInFg, true);
......
}app.thread为新建服务的Binder代理，运行scheduleCreateService()就远程调用到ActivityThread中。
frameworks/base/core/java/android/app/ActivityThread.java
private class ApplicationThread extends ApplicationThreadNative {
......
public final void scheduleCreateService(IBinder token,
ServiceInfo info, CompatibilityInfo compatInfo, int processState) {
updateProcessState(processState, false);
CreateServiceData s = new CreateServiceData();
s.token = token;
s.info = info;
s.compatInfo = compatInfo;
// 发送消息CREATE_SERVICE
sendMessage(H.CREATE_SERVICE, s);
}
......
}
........
private class H extends Handler {
......
public void handleMessage(Message msg) {
......
case CREATE_SERVICE:
Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceCreate");
// 在handler中处理消息
handleCreateService((CreateServiceData)msg.obj);
Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
break;
......
}
......
private void handleCreateService(CreateServiceData data) {l
// 跳过GC
unscheduleGcIdler();
LoadedApk packageInfo = getPackageInfoNoCheck(
data.info.applicationInfo, data.compatInfo);
Service service = null;
try {
// 通过反射创建service
java.lang.ClassLoader cl = packageInfo.getClassLoader();
service = (Service) cl.loadClass(data.info.name).newInstance();
......
}
try {
// 创建context
ContextImpl context = ContextImpl.createAppContext(this, packageInfo);
context.setOuterContext(service);
// 创建Application
Application app = packageInfo.makeApplication(false, mInstrumentation);
service.attach(context, this, data.info.name, data.token, app,
ActivityManagerNative.getDefault());
// 调用service的onCreate方法，正式启动service
service.onCreate();
mServices.put(data.token, service);
try {
ActivityManagerNative.getDefault().serviceDoneExecuting(
data.token, SERVICE_DONE_EXECUTING_ANON, 0, 0);
} catch (RemoteException e) {
// nothing to do.
}
......
}
}到这里，Service就已经完成启动。之后AMS会进行bindService，服务端执行bind时调用publishService来发布service，表明service已经可以使用。Bind过程最后会通过bindService最开始时传给AMS的IServiceConnection代理回调到应用进程，执行onServiceConnected()。这个Binder回调也会将新建服务的Binder代理传回去，这样应用就可以使用这个代理与服务进行通信。细节就不再继续分析，通过下面的图简单描述一下整个流程。本文只是在最简单的角度来分析bindService过程，实际代码中许多的细节都没有描述。
上图重点描述各进程之间的关系，可以看到整个Service的bind过程涉及到多个不同的Binder。
- IActivityManager：应用进程或服务进程与AMS通信时使用的Binder接口。AMS启动后向ServiceManager注册，其他进程从ServiceManager中获取代理。
- IApplicationThread：服务进程启动后创建的Binder接口。回传给AMS，并由AMS进行管理。
- IServiceConnection：应用进程创建发送给AMS，当服务连接成功后通过该Binder回调到应用进程，同时将服务进程的Binder接口回传给应用。
本文仅讲解了通过bindService来启动服务，但Android中存在多种启动服务的方式，它们存在区别，使用场景也不同。
- startService: 仅仅启动Service，通常为后台服务。服务启动后就与发起者无关。
- bindService：启动Service并绑定，用于发起者与服务进行交互。当发起者退出时，服务也跟随退出。
- 启动系统服务：创建一个进程，通过ServiceManager.addService()注册为系统服务，Client通过ServiceManager.getService()来获取服务。这种方法在native和java都可以使用，但需要手动启动服务进程。
Service的管理也是不同的，系统服务是由ServiceManager进行管理的，而startService和bindService启动的服务是由AMS来管理。