Service启动流程源码分析之startService（一）

1、概要

我们平时在开发Android应用时，一般会将一些需要计算的逻辑放到独立进程的Service中处理，这样主进程就可以响应用户的其他操作从而提高用户体验。Android在此为我们提供了Service服务，我们只需实现继承Service的子类，然后通过startService来启动这个服务就可以了。

接下来我们将开始详细的介绍在主线程中如何通过startService来启动新进程中的服务（本文主要阐述启动新进程的服务，在同一进程中的服务我们也会稍微提及）。

由于Service的启动流程和Activity比较相似，所以在开始分析之前，希望大家可以先了解一下Activity的启动方式Activity启动流程源码分析之入门（一）。

2、startService启动流程时序图

以上就是通过startService来启动Service的流程时序图，接下来我们将对照该图详细的讲解其启动流程。

3、startService源码分析

由于大家平时在开发Android应用时，通过startService启动Service这种方式应该用的比较多了，所以这里我就不举示例了，但是我们要注意一点，今天我们是在新进程中启动Service，所以需要在AndroidManifest文件中把Service配置android:process属性，那样才能启动新进程。

好啦，话不多说让我们进入startService方法吧（顺便说一下，本次源码是基于Android5.1）。

大家首先要明白一个问题，在Activity中使用的startService方法是定义在Context的抽象类中，它的真正实现者是ContextImpl，所以我们首先进入ContextImpl类，大家如果不是很清楚可以看下我的另外一篇博客Android中的Context源码分析。

（1）ContextImpl.startService()

源码：frameworks/base/core/java/android/app/ContextImpl.java

@Override
public ComponentName startService(Intent service) {
warnIfCallingFromSystemProcess();
return startServiceCommon(service, mUser);
}

private ComponentName startServiceCommon(Intent service, UserHandle user) {
try {
validateServiceIntent(service);
service.prepareToLeaveProcess();
ComponentName cn = ActivityManagerNative.getDefault().startService(
mMainThread.getApplicationThread(), service,
service.resolveTypeIfNeeded(getContentResolver()), user.getIdentifier());
//......
return cn;
} catch (RemoteException e) {
return null;
}
}

从ContextImpl类的startService开始，然后进入本类的startServiceCommon方法，并最终调用ActivityManagerNative.getDefault()对象的startService方法。其实这里的ActivityManagerNative.getDefault()就是ActivityManagerProxy对象，如果不是很清楚可以看我的另外一篇博客ActivityManagerService与应用程序通信分析。

（2）ActivityManagerProxy.startService()

源码：frameworks/base/core/java/android/app/ActivityManagerNative.java

public ComponentName startService(IApplicationThread caller, Intent service,
String resolvedType, int userId) throws RemoteException
{
Parcel data = Parcel.obtain();
Parcel reply = Parcel.obtain();
data.writeInterfaceToken(IActivityManager.descriptor);
data.writeStrongBinder(caller != null ? caller.asBinder() : null);
service.writeToParcel(data, 0);
data.writeString(resolvedType);
data.writeInt(userId);
mRemote.transact(START_SERVICE_TRANSACTION, data, reply, 0);
reply.readException();
ComponentName res = ComponentName.readFromParcel(reply);
data.recycle();
reply.recycle();
return res;
}

通过Binder调用ActivityManagerNative类中onTransact方法，其识别码为START_SERVICE_TRANSACTION，并最终调用ActivityManagerNative的实现类ActivityManagerService的startService方法。

（3）ActivityManagerService.startService()

源码：frameworks/base/services/java/com/android/server/am/ActivityManagerService.java

@Override
public ComponentName startService(IApplicationThread caller, Intent service,
String resolvedType, int userId) {
enforceNotIsolatedCaller("startService");
//......
synchronized(this) {
final int callingPid = Binder.getCallingPid();
final int callingUid = Binder.getCallingUid();
final long origId = Binder.clearCallingIdentity();
ComponentName res = mServices.startServiceLocked(caller, service,
resolvedType, callingPid, callingUid, userId);
Binder.restoreCallingIdentity(origId);
return res;
}
}

在这里调用mServices对象的startServiceLocked方法，这里的mServices对象是ActiveServices类。

（4）ActiveServices.startServiceLocked()

源码：frameworks/base/services/java/com/android/server/am/ActiveServices.java

ComponentName startServiceLocked(IApplicationThread caller,
Intent service, String resolvedType,
int callingPid, int callingUid, int userId) {

//......
ServiceLookupResult res =
retrieveServiceLocked(service, resolvedType,
callingPid, callingUid, userId, true, callerFg);
ServiceRecord r = res.record;
//......
return startServiceInnerLocked(smap, service, r, callerFg, addToStarting);
}

首先通过retrieveServiceLocked方法来解析service这个Intent，就是解析前面我们在AndroidManifest.xml定义的Service标签的intent-filter相关内容，然后将解析结果放在res.record中，最后在调用startServiceInnerLocked方法。

（5）ActiveServices.startServiceInnerLocked()

源码：frameworks/base/services/java/com/android/server/am/ActiveServices.java

ComponentName startServiceInnerLocked(ServiceMap smap, Intent service,
ServiceRecord r, boolean callerFg, boolean addToStarting) {

//......
synchronized (r.stats.getBatteryStats()) {
r.stats.startRunningLocked();
}
String error = bringUpServiceLocked(r, service.getFlags(), callerFg, false);
//......
}

这里紧接着会调用bringUpServiceLocked方法。

（6）ActiveServices.bringUpServiceLocked()

源码：frameworks/base/services/java/com/android/server/am/ActiveServices.java

private final String bringUpServiceLocked(ServiceRecord r,
int intentFlags, boolean execInFg, boolean whileRestarting) {

//（1）这里如果当前的ProcessRecord不为null，那就不需要重新创建进程，而是调用realStartServiceLocked方法来启动Service
if (app != null && app.thread != null) {
try {
app.addPackage(r.appInfo.packageName, r.appInfo.versionCode, mAm.mProcessStats);
realStartServiceLocked(r, app, execInFg);
return null;
} catch (RemoteException e) {
Slog.w(TAG, "Exception when starting service " + r.shortName, e);
}

// If a dead object exception was thrown -- fall through to
// restart the application.
}

//（2）如果是需要创建新进程，那么将调用ActivityManagerService.startProcessLocked方法来启动新进程
if (app == null) {
if ((app=mAm.startProcessLocked(procName, r.appInfo, true, intentFlags,
"service", r.name, false, isolated, false)) == null) {
//......
bringDownServiceLocked(r);
return msg;
}
if (isolated) {
r.isolatedProc = app;
}
}

//最后将ServiceRecord保存到成员变量mPendingServices中
if (!mPendingServices.contains(r)) {
mPendingServices.add(r);
}
}

这个方法比较重要，这里有两种选择，当Service所在的进程存在时，将调用realStartServiceLocked方法来启动Service，否则的话调用startProcessLocked方法来启动新进程。

（7）ActivityManagerService.startProcessLocked()

源码：frameworks/base/services/java/com/android/server/am/ActivityManagerService.java

private final void startProcessLocked(ProcessRecord app, String hostingType,
String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs) {

boolean isActivityProcess = (entryPoint == null);
if (entryPoint == null) entryPoint = "android.app.ActivityThread";
checkTime(startTime, "startProcess: asking zygote to start proc");
//通过processName,uid等启动新进程
Process.ProcessStartResult startResult = Process.start(entryPoint,
app.processName, uid, uid, gids, debugFlags, mountExternal,
app.info.targetSdkVersion, app.info.seinfo, requiredAbi, instructionSet,
app.info.dataDir, entryPointArgs);
}

这里通过Process的start方法启动ActivityThread的新进程，我们进入该类的main方法。

（8）ActivityThread.main()

源码：frameworks/base/core/java/android/app/ActivityThread.java

public static void main(String[] args) {
//......

Process.setArgV0("<pre-initialized>");

Looper.prepareMainLooper();
//创建ActivityThread对象，并调用其attach方法
ActivityThread thread = new ActivityThread();
thread.attach(false);

if (sMainThreadHandler == null) {
sMainThreadHandler = thread.getHandler();
}

if (false) {
Looper.myLooper().setMessageLogging(new
LogPrinter(Log.DEBUG, "ActivityThread"));
}

Looper.loop();

throw new RuntimeException("Main thread loop unexpectedly exited");
}

private void attach(boolean system) {
final IActivityManager mgr = ActivityManagerNative.getDefault();
try {
//这里调用了ActivityManagerProxy.attachApplication方法。
mgr.attachApplication(mAppThread);
} catch (RemoteException ex) {
// Ignore
}
}

在Android应用程序中，每一个进程对应一个ActivityThread实例，然后这里创建了ActivityThread对象并调用了其attach方法，在attach方法中又调用了ActivityManagerProxy.attachApplication方法。

（9）ActivityManagerProxy.attachApplication()

源码：frameworks/base/core/java/android/app/ActivityManagerNative.java

public void attachApplication(IApplicationThread app) throws RemoteException
{
Parcel data = Parcel.obtain();
Parcel reply = Parcel.obtain();
data.writeInterfaceToken(IActivityManager.descriptor);
data.writeStrongBinder(app.asBinder());
mRemote.transact(ATTACH_APPLICATION_TRANSACTION, data, reply, 0);
reply.readException();
data.recycle();
reply.recycle();
}

通过Binder机制会调用ActivityManagerNative中的onTransact方法，其识别码为ATTACH_APPLICATION_TRANSACTION，并最终调用ActivityManagerService中的attachApplication方法。

（10）ActivityManagerService.attachApplication()

源码：frameworks/base/services/java/com/android/server/am/ActivityManagerService.java

@Override
public final void attachApplication(IApplicationThread thread) {
synchronized (this) {
int callingPid = Binder.getCallingPid();
final long origId = Binder.clearCallingIdentity();
attachApplicationLocked(thread, callingPid);
Binder.restoreCallingIdentity(origId);

//......
}
}

这里调用attachApplicationLocked方法来进一步处理。

（11）ActivityManagerService.attachApplicationLocked()

源码：frameworks/base/services/java/com/android/server/am/ActivityManagerService.java

private final boolean attachApplicationLocked(IApplicationThread thread,
int pid) {

// See if the top visible activity is waiting to run in this process...
if (normalMode) {
try {
if (mStackSupervisor.attachApplicationLocked(app)) {
didSomething = true;
}
} catch (Exception e) {
Slog.wtf(TAG, "Exception thrown launching activities in " + app, e);
badApp = true;
}
}

// Find any services that should be running in this process...
if (!badApp) {
try {
//这里会调用ActiveServices对象的attachApplicationLocked方法
didSomething |= mServices.attachApplicationLocked(app, processName);
} catch (Exception e) {
Slog.wtf(TAG, "Exception thrown starting services in " + app, e);
badApp = true;
}
}
}

这里如果是启动Service将调用ActiveServices对象的attachApplicationLocked方法，而如果是启动Activity将调用ActivityStackSupervisor对象的attachApplicationLocked方法。

（12）ActiveServices.attachApplicationLocked()

源码：frameworks/base/services/java/com/android/server/am/ActiveServices.java

boolean attachApplicationLocked(ProcessRecord proc, String processName)
throws RemoteException {

boolean didSomething = false;
// Collect any services that are waiting for this process to come up.
if (mPendingServices.size() > 0) {
ServiceRecord sr = null;
try {
for (int i=0; i<mPendingServices.size(); i++) {
sr = mPendingServices.get(i);
if (proc != sr.isolatedProc && (proc.uid != sr.appInfo.uid
|| !processName.equals(sr.processName))) {
continue;
}

mPendingServices.remove(i);
i--;
proc.addPackage(sr.appInfo.packageName, sr.appInfo.versionCode,mAm.mProcessStats);

//这里调用realStartServiceLocked方法
realStartServiceLocked(sr, proc, sr.createdFromFg);
didSomething = true;
}
} catch (RemoteException e) {
Slog.w(TAG, "Exception in new application when starting service "+ sr.shortName, e);
throw e;
}
}
//......
}

（13）ActiveServices.realStartServiceLocked()

源码：frameworks/base/services/java/com/android/server/am/ActiveServices.java

private final void realStartServiceLocked(ServiceRecord r,
ProcessRecord app, boolean execInFg) throws RemoteException {

if (app.thread == null) {
throw new RemoteException();
}

//......

app.thread.scheduleCreateService(r, r.serviceInfo,
mAm.compatibilityInfoForPackageLocked(r.serviceInfo.applicationInfo),
app.repProcState);
}

此处的app.thread是一个IApplicationThread对象，而IApplicationThread的代理类是ApplicationThreadProxy，我们进入app.thread对象的scheduleCreateService方法。

（14）ApplicationThreadProxy.scheduleCreateService()

源码：frameworks/base/core/java/android/app/ApplicationThreadNative.java

public final void scheduleCreateService(IBinder token, ServiceInfo info,
CompatibilityInfo compatInfo, int processState) throws RemoteException {
Parcel data = Parcel.obtain();
data.writeInterfaceToken(IApplicationThread.descriptor);
data.writeStrongBinder(token);
info.writeToParcel(data, 0);
compatInfo.writeToParcel(data, 0);
data.writeInt(processState);
mRemote.transact(SCHEDULE_CREATE_SERVICE_TRANSACTION, data, null,
IBinder.FLAG_ONEWAY);
data.recycle();
}

通过Binder对象调用ApplicationThreadNative的onTransact方法，在其方法中调用子类的scheduleCreateService方法，即最终调用ApplicationThreadNative的子类ApplicationThread的scheduleCreateService方法。

（15）ApplicationThread.scheduleCreateService()

源码：frameworks/base/core/java/android/app/ActivityThread.java

public final void scheduleCreateService(IBinder token,
ServiceInfo info, CompatibilityInfo compatInfo, int processState) {
updateProcessState(processState, false);
CreateServiceData s = new CreateServiceData();
s.token = token;
s.info = info;
s.compatInfo = compatInfo;

sendMessage(H.CREATE_SERVICE, s);
}

通过Handler发送Message来处理该操作，并进入到H的handleMessage方法中，其识别码为CREATE_SERVICE。

（16）H.handleMessage()

源码：frameworks/base/core/java/android/app/ApplicationThread.java

private class H extends Handler {

public void handleMessage(Message msg) {
Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceCreate");
//这里调用handleCreateService方法
handleCreateService((CreateServiceData)msg.obj);
Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
}
}

我们继续进入handleCreateService方法。

（17）ApplicationThread.handleCreateService()

源码：frameworks/base/core/java/android/app/ActivityThread.java

private void handleCreateService(CreateServiceData data) {

Service service = null;
try {
//（1）通过类加载器来加载Service对象
java.lang.ClassLoader cl = packageInfo.getClassLoader();
service = (Service) cl.loadClass(data.info.name).newInstance();
} catch (Exception e) {
//......
}

//（2）这里创建ContextImpl对象
ContextImpl context = ContextImpl.createAppContext(this, packageInfo);
context.setOuterContext(service);

Application app = packageInfo.makeApplication(false, mInstrumentation);
service.attach(context, this, data.info.name, data.token, app,
ActivityManagerNative.getDefault());
//（3）这里调用Service的onCreate方法
service.onCreate();
mServices.put(data.token, service);
}

（1）处通过类加载器ClassLoader来加载Service对象，此处的data.info.name就是我们要启动的Service，加载完成后需要将其强转换为Service对象，也就是说我们的Service必须要继承于Service基类。

（2）处这里先创建一个ContextImpl对象，每个Activity和Service都有一个Context对象。

（3）处这里调用Service的OnCreate方法。

好啦，到此整个Service通过startService的方式就启动起来了，接下来我们总结一下步骤。

4、总结

1、（1）-（7）从主进程调用到ActivityManagerService进程中，并调用其startProcessLocked方法来启动新的进程。

2、（8）-（11）从新进程调用到ActivityManagerService进程中，获取要启动的服务的相关信息。

3、（12）-（17）从ActivityManagerService进程回到新进程中并最终将服务启动起来。

好啦，本篇通过startService来启动新进程服务就介绍到这里啦，下篇我们将分析通过bindService来启动服务Service启动流程源码分析之bindService（二）。