startService流程

开启Service进程的主要类

android.content包的ContextWrapper类
android.content包的Context类
android.app包的ContextImpl类
android.app包的ActivityManager类
android.os包的ServiceManager类
android.os包的ServiceManagerNative类
android.os包的ServiceManagerProxy类（也在ServiceManagerNative中）

SystemService进程

com.android.server.am包的ActivityManagerService类
com.android.server.am包的ActiveServices类

创建Service的进程

android.app包的ActivityThread类内部类ApplicationThread类
android.app包的ActivityThread类内部类H类(Handler的子类)
android.app包的ActivityThread类

可先阅读Android Binder机制浅析和APP进程和SystemServer进程通信会更好的理解其中的过程；

不考虑跨进程通信相关的类，主要使用的类其实只关注ContextImpl、ActivityManagerService、ActiveServices和ActivityThread；

• 开启Service的进程通过ContextImpl的startServiceCommon()方法，跨进程调用SystemService进程的ActivityManagerService的startService()方法；
• 在SystemServer中通过层层跳转，调用ActiveServices的realStartServiceLocked()方法，跨进程调用Service所在进程的ActivityThread的内部类ApplicationThread的scheduleCreateService()方法；

SystemServer进程浅析

SystemServer进程是由Zygote进程孵化的第一个进程，大部分Android提供的服务都在该进程中，SystemServer中运行的进程公共有六十多种，主要包括：ActivityManagerService(AMS)，WindowManagerService(WMS)，PackagManagerService(PMS)等；这些系统服务都是以一个线程的方式存在SystemServer进程中。

ActivityManagerService简称AMS，它是android中很重要的一个服务，它统筹管理着android的四大组件，统一调度各应用进程。

ActivityThread管理应用进程的主线程的执行(相当于普通Java程序的main入口函数)，并根据AMS的要求（通过IApplicationThread接口，AMS为Client、ActivityThread内部类ApplicationThread为Server）负责调度和执行activitiy、service、broadcast和其它操作。

开启Service的进程

ContextWrapper的startService()方法。

@Override
public ComponentName startService(Intent service) {
    return mBase.startService(service);
}

ContextImpl的startService()方法。

@Override
public ComponentName startService(Intent service) {
    warnIfCallingFromSystemProcess();
    return startServiceCommon(service, false, mUser);
}

ContextImpl的startServiceCommon()方法，通过跨进程通信调用SystemManagerService的startService()方法；

private ComponentName startServiceCommon(Intent service, boolean requireForeground,
        UserHandle user) {
  
    ComponentName cn = ActivityManager.getService().startService(
        mMainThread.getApplicationThread(), service, service.resolveTypeIfNeeded(
            getContentResolver()), requireForeground,
        getOpPackageName(), user.getIdentifier());
    
    return cn;
}

具体可参考APP进程和SystemServer进程通信
ActivityManager的getService()：获取IActivityManager的对象；

public static IActivityManager getService() {
    return IActivityManagerSingleton.get();
}

//单例，创建IActivityManager的对象；
private static final Singleton<IActivityManager> IActivityManagerSingleton =
        new Singleton<IActivityManager>() {
            @Override
            protected IActivityManager create() {
                final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE);
                final IActivityManager am = IActivityManager.Stub.asInterface(b);
                return am;
            }
        };

ServiceManager类通过getService()获取IBinder对象，以及ServiceManagerNative和其内部类ServiceManagerProxy等Binder相关的内容，不深入展开，可自行深入理解。

public final class ServiceManager {

    private static IServiceManager sServiceManager;
    //缓存
    private static HashMap<String, IBinder> sCache = new HashMap<String, IBinder>();

    private static IServiceManager getIServiceManager() {
        if (sServiceManager != null) {
            return sServiceManager;
        }

        sServiceManager = ServiceManagerNative
                .asInterface(Binder.allowBlocking(BinderInternal.getContextObject()));
        return sServiceManager;
    }

    //获取对应的IBinder对象；
    public static IBinder getService(String name) {
        try {
            IBinder service = sCache.get(name);
            if (service != null) {
                return service;
            } else {
                return Binder.allowBlocking(getIServiceManager().getService(name));
            }
        } catch (RemoteException e) {
            Log.e(TAG, "error in getService", e);
        }
        return null;
    }
}

SystemService进程

进程间通信，进而调用ActivityManagerService的startService()方法，该方法主要调用ActiveServices的startServiceLocked()；

@Override
public ComponentName startService(IApplicationThread caller, Intent service,
        String resolvedType, boolean requireForeground, String callingPackage, int userId)
        throws TransactionTooLargeException {
  
    synchronized(this) {
        final int callingPid = Binder.getCallingPid();
        final int callingUid = Binder.getCallingUid();
        final long origId = Binder.clearCallingIdentity();
        ComponentName res;
        try {
            res = mServices.startServiceLocked(caller, service,
                    resolvedType, callingPid, callingUid,
                    requireForeground, callingPackage, userId);
        } finally {
            Binder.restoreCallingIdentity(origId);
        }
        return res;
    }
}

ActiveServices的startServiceLocked()方法，主要调用retrieveServiceLocked()方法；

ComponentName startServiceLocked(IApplicationThread caller, Intent service, String resolvedType,
        int callingPid, int callingUid, boolean fgRequired, String callingPackage, final int userId)
        throws TransactionTooLargeException {
  
    ServiceLookupResult res =
        retrieveServiceLocked(service, resolvedType, callingPackage,
                callingPid, callingUid, userId, true, callerFg, false);

    ComponentName cmp = startServiceInnerLocked(smap, service, r, callerFg, addToStarting);
    return cmp;
}

ActiveServices的startServiceInnerLocked()，主要调用bringUpServiceLocked()方法；

ComponentName startServiceInnerLocked(ServiceMap smap, Intent service, ServiceRecord r,
        boolean callerFg, boolean addToStarting) throws TransactionTooLargeException {
    ServiceState stracker = r.getTracker();
    
    String error = bringUpServiceLocked(r, service.getFlags(), callerFg, false, false);
    if (error != null) {
        return new ComponentName("!!", error);
    }
    return r.name;
}

ActiveServices的bringUpServiceLocked()中判断要启动的Service是否在单独的进程中；

1. 在同一个进程中，调用realStartServiceLocked()方法；
2. 在不同的进程中，调用ActivityManagerService的startProcessLocked()，通过Zygote进程孵化Service所在的进程；最后也会调用realStartServiceLocked()方法；

private String bringUpServiceLocked(ServiceRecord r, int intentFlags, boolean execInFg,
        boolean whileRestarting, boolean permissionsReviewRequired)
        throws TransactionTooLargeException {
	//判断要启动的Service是否在单独的进程中；
    final boolean isolated = (r.serviceInfo.flags&ServiceInfo.FLAG_ISOLATED_PROCESS) != 0;
    final String procName = r.processName;
    String hostingType = "service";
    ProcessRecord app;

    //在同一个进程中；
    if (!isolated) {
        app = mAm.getProcessRecordLocked(procName, r.appInfo.uid, false);
        if (app != null && app.thread != null) {
            try {
                app.addPackage(r.appInfo.packageName, r.appInfo.versionCode, mAm.mProcessStats);
                realStartServiceLocked(r, app, execInFg);
                return null;
            }
        }
    } else {
        //如果Service运行在单独的进程中（和开启Service的进程不同），则调用tartProcessLocked()得到一个新的进程；
    }

    if (app == null && !permissionsReviewRequired) {
        //startProcessLocked()通过Zygote进程孵化Service所在的进程；
        if ((app=mAm.startProcessLocked(procName, r.appInfo, true, intentFlags,
                hostingType, r.name, false, isolated, false)) == null) {
            bringDownServiceLocked(r);
            return msg;
        }
        if (isolated) {
            r.isolatedProc = app;
        }
    }
    return null;
}

ActiveServices的realStartServiceLocked()方法主要做两件事：

1. 调用IApplicationThread的scheduleCreateService()方法，回到创建Service进程中，调用ActivityThread的内部类ApplicationThread的scheduleCreateService()方法；
2. 调用sendServiceArgsLocked()，该方法中最后也是调用ActivityThread的内部类ApplicationThread的scheduleServiceArgs()方法；

private final void realStartServiceLocked(ServiceRecord r,
        ProcessRecord app, boolean execInFg) throws RemoteException {
    
    boolean created = false;
    try {
        app.thread.scheduleCreateService(r, r.serviceInfo,
                mAm.compatibilityInfoForPackageLocked(r.serviceInfo.applicationInfo),
                app.repProcState);
        created = true;
    } catch (DeadObjectException e) {
        Slog.w(TAG, "Application dead when creating service " + r);
        mAm.appDiedLocked(app);
        throw e;
    } finally {
    }
    
    sendServiceArgsLocked(r, execInFg, true);
}

ActiveServices的sendServiceArgsLocked()，最后调用ActivityThread的内部类ApplicationThread的scheduleServiceArgs()方法；

private final void sendServiceArgsLocked(ServiceRecord r, boolean execInFg,
        boolean oomAdjusted) throws TransactionTooLargeException {
    try {
        r.app.thread.scheduleServiceArgs(r, slice);
    } catch (TransactionTooLargeException e) {
    }
}

创建Service的APP进程

ActivityThread的内部类ApplicationThread的scheduleCreateService()方法，发送Handler消息；在ActivityThread的内部类H（Handler的子类）的handleMessage中调用ActivityThread的handleCreateService()方法

public final void scheduleCreateService(IBinder token,
        ServiceInfo info, CompatibilityInfo compatInfo, int processState) {
    updateProcessState(processState, false);
    CreateServiceData s = new CreateServiceData();
    s.token = token;
    s.info = info;
    s.compatInfo = compatInfo;
	//发送Handler消息；handleMessage中调用handleCreateService();
    sendMessage(H.CREATE_SERVICE, s);
}

ActivityThread的内部类ApplicationThread的scheduleServiceArgs()

public final void scheduleServiceArgs(IBinder token, ParceledListSlice args) {
    List<ServiceStartArgs> list = args.getList();

    for (int i = 0; i < list.size(); i++) {
        ServiceStartArgs ssa = list.get(i);
        ServiceArgsData s = new ServiceArgsData();
        s.token = token;
        s.taskRemoved = ssa.taskRemoved;
        s.startId = ssa.startId;
        s.flags = ssa.flags;
        s.args = ssa.args;
		//发送Handler消息；handleMessage中调用handleCreateService();
        sendMessage(H.SERVICE_ARGS, s);
    }
}

ActivityThread的handleCreateService()方法创建对应Service的实例，调用Service的onCreate()方法；

private void handleCreateService(CreateServiceData data) {
   
    LoadedApk packageInfo = getPackageInfoNoCheck(
            data.info.applicationInfo, data.compatInfo);
    Service service = null;
    //通过反射创建对应Service的实例；
    try {
        java.lang.ClassLoader cl = packageInfo.getClassLoader();
        service = (Service) cl.loadClass(data.info.name).newInstance();
    } catch (Exception e) {  
        throw new RuntimeException( "Unable to instantiate service ");
    }

    try {
        if (localLOGV) Slog.v(TAG, "Creating service " + data.info.name);
		//创建ContextImpl实例；
        ContextImpl context = ContextImpl.createAppContext(this, packageInfo);
        context.setOuterContext(service);

        Application app = packageInfo.makeApplication(false, mInstrumentation);
        //调用Service的attach()方法；
        service.attach(context, this, data.info.name, data.token, app,
                ActivityManager.getService());
        //调用Service的onCreate()方法；
        service.onCreate();
        //将Service保存到ArrayMap<IBinder, Service> mServices中；
        mServices.put(data.token, service);
    } catch (Exception e) {
        throw new RuntimeException("Unable to create service ");
    }
}

ActivityThread的handleServiceArgs()方法根据IBinder获取Service实例，调用Service的onStartCommand()方法；

private void handleServiceArgs(ServiceArgsData data) {
    //根据IBinder获取对应的Service实例；
    Service s = mServices.get(data.token);
    if (s != null) {
        try {
            int res;
            if (!data.taskRemoved) {
                //调用Service的onStartCommand()方法；
                res = s.onStartCommand(data.args, data.flags, data.startId);
            }
        } catch (Exception e) {
            throw new RuntimeException("Unable to start service " + s + " with ");
        }
    }
}

以上就是startService的主要流程，binderService、stopService和unbindService的主要流程和startService的流程基本类似，如有问题，请多指教，谢谢！