1.什么是service

2.Service的启动过程

3.Service的绑定过程

1.什么是service

    Service是Android中实现程序后台运行的解决方案,它主要用来处理与用户界面无关的业务逻辑。

    Service分为本地服务和远程服务：区分这两种服务就是看客户端和服务端是否在同一个进程中。

    本地服务:服务和启动服务的activity在同一个进程中。该服务依附在主进程上而不是独立的进程，这样在一定程度上节约了资源，另外本地服务因为是在同一进程因此不需要IPC，也不需要AIDL。相应bindService会方便很多，当主进程被Kill后，服务便会终止。一般使用在音乐播放器播放等不需要常驻的服务。

    远程服务:服务和启动服务的activity在不同进程中。由于是独立的进程，因此在Activity所在进程被Kill的时候，该服务依然在运行，不受其他进程影响，有利于为多个进程提供服务具有较高的灵活性。由于是独立的进程，会占用一定资源，并且使用AIDL进行IPC比较麻烦。一般用于系统的Service，这种Service是常驻的。

    开启服务也有两种方式，一种是startService(),他对应的结束服务的方法是stopService()，另一种是bindService()，结束服务的是unBindService()，这两种方式的区别就是：当客户端Client使用startService方法开启服务的时候，这个服务和Client之间没有任何联系，Service的运行和Client是相互独立的，想结束这个服务的话，就在服务本身中调用stopService()方法结束服务。而当客户端Client使用bindService方法启动服务的时候，这个服务和Client是一种关联的关系，Client端可以获得服务端的访问接口。要是结束服务的话，需要在Client中和服务断开，调用unBindService方法。

    下面针对这两种启动方式进行详细的分析说明。

2.Service的启动过程

    整个service的启动时序图如下所示:

//frameworks/base/core/java/android/content/ContextWrapper.java
667      @Override
668      public ComponentName startService(Intent service) {
669          return mBase.startService(service);
670      }
671  

    mBase的类型是Context，Context的实现类是ContextImpl。它们的继承关系如下:

    所以接下来看下ContextImpl的startService()方法。

//frameworks/base/core/java/android/app/ContextImpl.java
1568      @Override
1569      public ComponentName startService(Intent service) {
1570          warnIfCallingFromSystemProcess();
1571          return startServiceCommon(service, false, mUser);
1572      }1596      private ComponentName startServiceCommon(Intent service, boolean requireForeground,
1597              UserHandle user) {
1598          try {
1599              validateServiceIntent(service);
1600              service.prepareToLeaveProcess(this);
1601              ComponentName cn = ActivityManager.getService().startService(
1602                  mMainThread.getApplicationThread(), service, service.resolveTypeIfNeeded(
1603                              getContentResolver()), requireForeground,
1604                              getOpPackageName(), user.getIdentifier());
1605              if (cn != null) {
1606                  if (cn.getPackageName().equals("!")) {
1607                      throw new SecurityException(
1608                              "Not allowed to start service " + service
1609                              + " without permission " + cn.getClassName());
1610                  } else if (cn.getPackageName().equals("!!")) {
1611                      throw new SecurityException(
1612                              "Unable to start service " + service
1613                              + ": " + cn.getClassName());
1614                  } else if (cn.getPackageName().equals("?")) {
1615                      throw new IllegalStateException(
1616                              "Not allowed to start service " + service + ": " + cn.getClassName());
1617                  }
1618              }
1619              return cn;
1620          } catch (RemoteException e) {
1621              throw e.rethrowFromSystemServer();
1622          }
1623      }

    ActivityManager.getService()其实就是ActivityManagerService，调用ActivityManagerService类里面的startService方法。

//frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
13894      public ComponentName startService(IApplicationThread caller, Intent service,
13895              String resolvedType, boolean requireForeground, String callingPackage, int userId)
13896              throws TransactionTooLargeException {
13897          enforceNotIsolatedCaller("startService");
13898          // Refuse possible leaked file descriptors
13899          if (service != null && service.hasFileDescriptors() == true) {
13900              throw new IllegalArgumentException("File descriptors passed in Intent");
13901          }
13902  
13903          if (callingPackage == null) {
13904              throw new IllegalArgumentException("callingPackage cannot be null");
13905          }
13906  
13907          if (DEBUG_SERVICE) Slog.v(TAG_SERVICE,
13908                  "*** startService: " + service + " type=" + resolvedType + " fg=" + requireForeground);
13909          synchronized(this) {
13910              final int callingPid = Binder.getCallingPid();
13911              final int callingUid = Binder.getCallingUid();
13912              final long origId = Binder.clearCallingIdentity();
13913              ComponentName res;
13914              try {
13915                  res = mServices.startServiceLocked(caller, service,
13916                          resolvedType, callingPid, callingUid,
13917                          requireForeground, callingPackage, userId);
13918              } finally {
13919                  Binder.restoreCallingIdentity(origId);
13920              }
13921              return res;
13922          }
13923      }

    通过mServices对象调用了startServiceLocked()方法，mServices是ActiveServices类的对象，可以看做是辅助ActivityManagerServices来管理Service的类，我们来看下它的startServiceLocked()方法.

//frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
401      ComponentName startServiceLocked(IApplicationThread caller, Intent service, String resolvedType,
402              int callingPid, int callingUid, boolean fgRequired, String callingPackage, final int userId)
403              throws TransactionTooLargeException {
404          return startServiceLocked(caller, service, resolvedType, callingPid, callingUid, fgRequired,
405                  callingPackage, userId, false);
406      }
407  
408      ComponentName startServiceLocked(IApplicationThread caller, Intent service, String resolvedType,
409              int callingPid, int callingUid, boolean fgRequired, String callingPackage,
410              final int userId, boolean allowBackgroundActivityStarts)
411              throws TransactionTooLargeException {
412          if (DEBUG_DELAYED_STARTS) Slog.v(TAG_SERVICE, "startService: " + service
413                  + " type=" + resolvedType + " args=" + service.getExtras());........
640          ComponentName cmp = startServiceInnerLocked(smap, service, r, callerFg, addToStarting);
641          return cmp;
642      }

    在最后，调用了startServiceInnerLocked()方法.

//frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
689      ComponentName startServiceInnerLocked(ServiceMap smap, Intent service, ServiceRecord r,
690              boolean callerFg, boolean addToStarting) throws TransactionTooLargeException {........
701          String error = bringUpServiceLocked(r, service.getFlags(), callerFg, false, false);
702          if (error != null) {
703              return new ComponentName("!!", error);
704          }........

    在这里会调用一个重要的函数bringUpServiceLocked。

//frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
500      private String bringUpServiceLocked(ServiceRecord r, int intentFlags, boolean execInFg,
2501              boolean whileRestarting, boolean permissionsReviewRequired)
2502              throws TransactionTooLargeException {
2503          if (r.app != null && r.app.thread != null) {//这里会调用service.onStartCommand()
2504              sendServiceArgsLocked(r, execInFg, false);
2505              return null;
2506          }.......
2557          if (!isolated) {
2558              app = mAm.getProcessRecordLocked(procName, r.appInfo.uid, false);
2559              if (DEBUG_MU) Slog.v(TAG_MU, "bringUpServiceLocked: appInfo.uid=" + r.appInfo.uid
2560                          + " app=" + app);
2561              if (app != null && app.thread != null) {
2562                  try {
2563                      app.addPackage(r.appInfo.packageName, r.appInfo.longVersionCode, mAm.mProcessStats);//启动服务
2564                      realStartServiceLocked(r, app, execInFg);
2565                      return null;
2566                  } catch (TransactionTooLargeException e) {
2567                      throw e;
2568                  } catch (RemoteException e) {
2569                      Slog.w(TAG, "Exception when starting service " + r.shortInstanceName, e);
2570                  }
2571  
2572                  // If a dead object exception was thrown -- fall through to
2573                  // restart the application.
2574              }........//如果进程不存在，首先创建进程
2595          if (app == null && !permissionsReviewRequired) {
2596              if ((app=mAm.startProcessLocked(procName, r.appInfo, true, intentFlags,
2597                      hostingRecord, false, isolated, false)) == null) {
2598                  String msg = "Unable to launch app "
2599                          + r.appInfo.packageName + "/"
2600                          + r.appInfo.uid + " for service "
2601                          + r.intent.getIntent() + ": process is bad";
2602                  Slog.w(TAG, msg);
2603                  bringDownServiceLocked(r);
2604                  return msg;
2605              }
2606              if (isolated) {
2607                  r.isolatedProc = app;
2608              }
2609          }........
2624          if (r.delayedStop) {
2625              // Oh and hey we've already been asked to stop!
2626              r.delayedStop = false;
2627              if (r.startRequested) {
2628                  if (DEBUG_DELAYED_STARTS) Slog.v(TAG_SERVICE,
2629                          "Applying delayed stop (in bring up): " + r);
2630                  stopServiceLocked(r);
2631              }
2632          }
2633  
2634          return null;
2635      }
2636  

    目标进程已存在，则直接执行realStartServiceLocked()；若目标进程不存在，则先执行startProcessLocked创建进程， 经过层层调用最后会调用到AMS.attachApplicationLocked, 然后再执行realStartServiceLocked()。

    创建进程的过程我们再之前activity启动的时候已经分析过，所以这里我们直接分析realStartServiceLocked。

//frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
2652      private final void realStartServiceLocked(ServiceRecord r,
2653              ProcessRecord app, boolean execInFg) throws RemoteException {
2654          if (app.thread == null) {
2655              throw new RemoteException();
2656          }........
2669          boolean created = false;
2670          try {
2671              if (LOG_SERVICE_START_STOP) {
2672                  String nameTerm;
2673                  int lastPeriod = r.shortInstanceName.lastIndexOf('.');
2674                  nameTerm = lastPeriod >= 0 ? r.shortInstanceName.substring(lastPeriod)
2675                          : r.shortInstanceName;
2676                  EventLogTags.writeAmCreateService(
2677                          r.userId, System.identityHashCode(r), nameTerm, r.app.uid, r.app.pid);
2678              }
2679              StatsLog.write(StatsLog.SERVICE_LAUNCH_REPORTED, r.appInfo.uid, r.name.getPackageName(),
2680                      r.name.getClassName());
2681              synchronized (r.stats.getBatteryStats()) {
2682                  r.stats.startLaunchedLocked();
2683              }
2684              mAm.notifyPackageUse(r.serviceInfo.packageName,
2685                                   PackageManager.NOTIFY_PACKAGE_USE_SERVICE);
2686              app.forceProcessStateUpTo(ActivityManager.PROCESS_STATE_SERVICE);//binder调用，create service
2687              app.thread.scheduleCreateService(r, r.serviceInfo,
2688                      mAm.compatibilityInfoForPackage(r.serviceInfo.applicationInfo),
2689                      app.getReportedProcState());
2690              r.postNotification();
2691              created = true;
2692          } catch (DeadObjectException e) {
2693              Slog.w(TAG, "Application dead when creating service " + r);
2694              mAm.appDiedLocked(app);
2695              throw e;........//bind service 我们会在下一部分详细介绍
2719          requestServiceBindingsLocked(r, execInFg);........//bind service 我们会在下一部分详细介绍
2735          sendServiceArgsLocked(r, execInFg, true);
2736  
2737          if (r.delayed) {
2738              if (DEBUG_DELAYED_STARTS) Slog.v(TAG_SERVICE, "REM FR DELAY LIST (new proc): " + r);
2739              getServiceMapLocked(r.userId).mDelayedStartList.remove(r);
2740              r.delayed = false;
2741          }
2742  
2743          if (r.delayedStop) {
2744              // Oh and hey we've already been asked to stop!
2745              r.delayedStop = false;
2746              if (r.startRequested) {
2747                  if (DEBUG_DELAYED_STARTS) Slog.v(TAG_SERVICE,
2748                          "Applying delayed stop (from start): " + r);
2749                  stopServiceLocked(r);
2750              }
2751          }
2752      }

//frameworks/base/core/java/android/app/ActivityThread.java
943          public final void scheduleCreateService(IBinder token,
944                  ServiceInfo info, CompatibilityInfo compatInfo, int processState) {
945              updateProcessState(processState, false);
946              CreateServiceData s = new CreateServiceData();
947              s.token = token;
948              s.info = info;
949              s.compatInfo = compatInfo;
950  
951              sendMessage(H.CREATE_SERVICE, s);
952          }1853          public void handleMessage(Message msg) {
1854              if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));
1855              switch (msg.what) {........
1873                  case CREATE_SERVICE:
1874                      Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, ("serviceCreate: " + String.valueOf(msg.obj)));
1875                      handleCreateService((CreateServiceData)msg.obj);
1876                      Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
1877                      break;........3923      @UnsupportedAppUsage
3924      private void handleCreateService(CreateServiceData data) {
3925          // If we are getting ready to gc after going to the background, well
3926          // we are back active so skip it.
3927          unscheduleGcIdler();
3928  
3929          LoadedApk packageInfo = getPackageInfoNoCheck(
3930                  data.info.applicationInfo, data.compatInfo);
3931          Service service = null;
3932          try {////通过反射的方式，调用ClassLoader的loadClass()方法，创建一个Service对象
3933              java.lang.ClassLoader cl = packageInfo.getClassLoader();
3934              service = packageInfo.getAppFactory()
3935                      .instantiateService(cl, data.info.name, data.intent);
3936          } catch (Exception e) {
3937              if (!mInstrumentation.onException(service, e)) {
3938                  throw new RuntimeException(
3939                      "Unable to instantiate service " + data.info.name
3940                      + ": " + e.toString(), e);
3941              }
3942          }
3943  
3944          try {
3945              if (localLOGV) Slog.v(TAG, "Creating service " + data.info.name);
3946  //创建ContextImpl对象
3947              ContextImpl context = ContextImpl.createAppContext(this, packageInfo);
3948              context.setOuterContext(service);
3949  //创建Application
3950              Application app = packageInfo.makeApplication(false, mInstrumentation);
3951              service.attach(context, this, data.info.name, data.token, app,
3952                      ActivityManager.getService());//调用Service的onCreate()方法
3953              service.onCreate();
3954              mServices.put(data.token, service);
3955              try {
3956                  ActivityManager.getService().serviceDoneExecuting(
3957                          data.token, SERVICE_DONE_EXECUTING_ANON, 0, 0);
3958              } catch (RemoteException e) {
3959                  throw e.rethrowFromSystemServer();
3960              }
3961          } catch (Exception e) {
3962              if (!mInstrumentation.onException(service, e)) {
3963                  throw new RuntimeException(
3964                      "Unable to create service " + data.info.name
3965                      + ": " + e.toString(), e);
3966              }
3967          }
3968      }

       最终调用Service.onCreate()方法，对于目标服务都是继承于Service，并覆写该方式，调用目标服务的onCreate()方法。至此service的启动全部结束。

3.Service的绑定过程

    通过bind也可以启动service，service的绑定流程如下：

//frameworks/base/core/java/android/content/ContextWrapper.java
708      @Override
709      public boolean bindService(Intent service, int flags, Executor executor,
710              ServiceConnection conn) {
711          return mBase.bindService(service, flags, executor, conn);
712      }//frameworks/base/core/java/android/app/ContextImpl.java
1647      @Override
1648      public boolean bindService(Intent service, ServiceConnection conn, int flags) {
1649          warnIfCallingFromSystemProcess();
1650          return bindServiceCommon(service, conn, flags, null, mMainThread.getHandler(), null,
1651                  getUser());
1652      }1707      private boolean bindServiceCommon(Intent service, ServiceConnection conn, int flags,
1708              String instanceName, Handler handler, Executor executor, UserHandle user) {
1709          // Keep this in sync with DevicePolicyManager.bindDeviceAdminServiceAsUser.
1710          IServiceConnection sd;
1711          if (conn == null) {
1712              throw new IllegalArgumentException("connection is null");
1713          }
1714          if (handler != null && executor != null) {
1715              throw new IllegalArgumentException("Handler and Executor both supplied");
1716          }
1717          if (mPackageInfo != null) {
1718              if (executor != null) {
1719                  sd = mPackageInfo.getServiceDispatcher(conn, getOuterContext(), executor, flags);
1720              } else {
1721                  sd = mPackageInfo.getServiceDispatcher(conn, getOuterContext(), handler, flags);
1722              }
1723          } else {
1724              throw new RuntimeException("Not supported in system context");
1725          }
1726          validateServiceIntent(service);
1727          try {
1728              IBinder token = getActivityToken();
1729              if (token == null && (flags&BIND_AUTO_CREATE) == 0 && mPackageInfo != null
1730                      && mPackageInfo.getApplicationInfo().targetSdkVersion
1731                      < android.os.Build.VERSION_CODES.ICE_CREAM_SANDWICH) {
1732                  flags |= BIND_WAIVE_PRIORITY;
1733              }
1734              service.prepareToLeaveProcess(this);//AMS binder调用
1735              int res = ActivityManager.getService().bindIsolatedService(
1736                  mMainThread.getApplicationThread(), getActivityToken(), service,
1737                  service.resolveTypeIfNeeded(getContentResolver()),
1738                  sd, flags, instanceName, getOpPackageName(), user.getIdentifier());
1739              if (res < 0) {
1740                  throw new SecurityException(
1741                          "Not allowed to bind to service " + service);
1742              }
1743              return res != 0;
1744          } catch (RemoteException e) {
1745              throw e.rethrowFromSystemServer();
1746          }
1747      }

    调用AMS的函数bindIsolatedService。

//frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
14041      public int bindIsolatedService(IApplicationThread caller, IBinder token, Intent service,
14042              String resolvedType, IServiceConnection connection, int flags, String instanceName,
14043              String callingPackage, int userId) throws TransactionTooLargeException {
14044          enforceNotIsolatedCaller("bindService");
14045  
14046          // Refuse possible leaked file descriptors
14047          if (service != null && service.hasFileDescriptors() == true) {
14048              throw new IllegalArgumentException("File descriptors passed in Intent");
14049          }
14050  
14051          if (callingPackage == null) {
14052              throw new IllegalArgumentException("callingPackage cannot be null");
14053          }
14054  
14055          // Ensure that instanceName, which is caller provided, does not contain
14056          // unusual characters.
14057          if (instanceName != null) {
14058              for (int i = 0; i < instanceName.length(); ++i) {
14059                  char c = instanceName.charAt(i);
14060                  if (!((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z')
14061                              || (c >= '0' && c <= '9') || c == '_' || c == '.')) {
14062                      throw new IllegalArgumentException("Illegal instanceName");
14063                  }
14064              }
14065          }
14066  
14067          synchronized(this) {
14068              return mServices.bindServiceLocked(caller, token, service,
14069                      resolvedType, connection, flags, instanceName, callingPackage, userId);
14070          }
14071      }

    最后调用ActiveServices的bindServiceLocked函数

//frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
1548      int bindServiceLocked(IApplicationThread caller, IBinder token, Intent service,
1549              String resolvedType, final IServiceConnection connection, int flags,
1550              String instanceName, String callingPackage, final int userId)
1551              throws TransactionTooLargeException {
1552          if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "bindService: " + service
1553                  + " type=" + resolvedType + " conn=" + connection.asBinder()
1554                  + " flags=0x" + Integer.toHexString(flags));//获取调用者的进程信息
1555          final ProcessRecord callerApp = mAm.getRecordForAppLocked(caller);.......//token不为空，代表具有activity
1564          if (token != null) {
1565              activity = mAm.mAtmInternal.getServiceConnectionsHolder(token);
1566              if (activity == null) {
1567                  Slog.w(TAG, "Binding with unknown activity: " + token);
1568                  return 0;
1569              }
1570          }.......//根据intent检索服务
1625          ServiceLookupResult res =
1626              retrieveServiceLocked(service, instanceName, resolvedType, callingPackage,
1627                      Binder.getCallingPid(), Binder.getCallingUid(), userId, true,
1628                      callerFg, isBindExternal, allowInstant);........//创建ConnectionRecord 对象
1746              ConnectionRecord c = new ConnectionRecord(b, activity,
1747                      connection, flags, clientLabel, clientIntent,
1748                      callerApp.uid, callerApp.processName, callingPackage);........
1777              if ((flags&Context.BIND_AUTO_CREATE) != 0) {
1778                  s.lastActivity = SystemClock.uptimeMillis();//启动service，和上一节service的启动过程一样
1779                  if (bringUpServiceLocked(s, service.getFlags(), callerFg, false,
1780                          permissionsReviewRequired) != null) {
1781                      return 0;
1782                  }
1783              }........
1823              } else if (!b.intent.requested) {//回调onBind方法
1824                  requestServiceBindingLocked(s, b.intent, callerFg, false);
1825              }
1826  
1827              getServiceMapLocked(s.userId).ensureNotStartingBackgroundLocked(s);
1828  
1829          } finally {
1830              Binder.restoreCallingIdentity(origId);
1831          }
1832  
1833          return 1;
1834      }

       可以看到最终也是通过bringUpServiceLocked()启动目标服务，后面目标程序的启动就和上一章一样，区别在于bindService在调用realStartServiceLocked之后继续调用requestServiceBindingsLocked和sendServiceArgsLocked，这两个函数的执行和startService的时候不同。

//frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
2652      private final void realStartServiceLocked(ServiceRecord r,
2653              ProcessRecord app, boolean execInFg) throws RemoteException {
2654          if (app.thread == null) {
2655              throw new RemoteException();
2656          }........
2669          boolean created = false;
2670          try {
2671              if (LOG_SERVICE_START_STOP) {
2672                  String nameTerm;
2673                  int lastPeriod = r.shortInstanceName.lastIndexOf('.');
2674                  nameTerm = lastPeriod >= 0 ? r.shortInstanceName.substring(lastPeriod)
2675                          : r.shortInstanceName;
2676                  EventLogTags.writeAmCreateService(
2677                          r.userId, System.identityHashCode(r), nameTerm, r.app.uid, r.app.pid);
2678              }
2679              StatsLog.write(StatsLog.SERVICE_LAUNCH_REPORTED, r.appInfo.uid, r.name.getPackageName(),
2680                      r.name.getClassName());
2681              synchronized (r.stats.getBatteryStats()) {
2682                  r.stats.startLaunchedLocked();
2683              }
2684              mAm.notifyPackageUse(r.serviceInfo.packageName,
2685                                   PackageManager.NOTIFY_PACKAGE_USE_SERVICE);
2686              app.forceProcessStateUpTo(ActivityManager.PROCESS_STATE_SERVICE);//binder调用，create service
2687              app.thread.scheduleCreateService(r, r.serviceInfo,
2688                      mAm.compatibilityInfoForPackage(r.serviceInfo.applicationInfo),
2689                      app.getReportedProcState());
2690              r.postNotification();
2691              created = true;
2692          } catch (DeadObjectException e) {
2693              Slog.w(TAG, "Application dead when creating service " + r);
2694              mAm.appDiedLocked(app);
2695              throw e;........//bind service 详情见下
2719          requestServiceBindingsLocked(r, execInFg);........//bind service 详情见下
2735          sendServiceArgsLocked(r, execInFg, true);
2736  
2737          if (r.delayed) {
2738              if (DEBUG_DELAYED_STARTS) Slog.v(TAG_SERVICE, "REM FR DELAY LIST (new proc): " + r);
2739              getServiceMapLocked(r.userId).mDelayedStartList.remove(r);
2740              r.delayed = false;
2741          }
2742  
2743          if (r.delayedStop) {
2744              // Oh and hey we've already been asked to stop!
2745              r.delayedStop = false;
2746              if (r.startRequested) {
2747                  if (DEBUG_DELAYED_STARTS) Slog.v(TAG_SERVICE,
2748                          "Applying delayed stop (from start): " + r);
2749                  stopServiceLocked(r);
2750              }
2751          }
2752      }

       我们来详细看下这两个函数的执行过程。

//frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
2637      private final void requestServiceBindingsLocked(ServiceRecord r, boolean execInFg)
2638              throws TransactionTooLargeException {
2639          for (int i=r.bindings.size()-1; i>=0; i--) {
2640              IntentBindRecord ibr = r.bindings.valueAt(i);
2641              if (!requestServiceBindingLocked(r, ibr, execInFg, false)) {
2642                  break;
2643              }
2644          }
2645      }2285      private final boolean requestServiceBindingLocked(ServiceRecord r, IntentBindRecord i,
2286              boolean execInFg, boolean rebind) throws TransactionTooLargeException {
2287          if (r.app == null || r.app.thread == null) {
2288              // If service is not currently running, can't yet bind.
2289              return false;
2290          }
2291          if (DEBUG_SERVICE) Slog.d(TAG_SERVICE, "requestBind " + i + ": requested=" + i.requested
2292                  + " rebind=" + rebind);
2293          if ((!i.requested || rebind) && i.apps.size() > 0) {//startService不会进入这个执行流程
2294              try {//发送bind开始的消息
2295                  bumpServiceExecutingLocked(r, execInFg, "bind");
2296                  r.app.forceProcessStateUpTo(ActivityManager.PROCESS_STATE_SERVICE);//Binder调用，执行ActivityThread里面的scheduleBindService
2297                  r.app.thread.scheduleBindService(r, i.intent.getIntent(), rebind,
2298                          r.app.getReportedProcState());
2299                  if (!rebind) {
2300                      i.requested = true;
2301                  }
2302                  i.hasBound = true;
2303                  i.doRebind = false;
2304              } catch (TransactionTooLargeException e) {
2305                  // Keep the executeNesting count accurate.
2306                  if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "Crashed while binding " + r, e);
2307                  final boolean inDestroying = mDestroyingServices.contains(r);
2308                  serviceDoneExecutingLocked(r, inDestroying, inDestroying);
2309                  throw e;
2310              } catch (RemoteException e) {
2311                  if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "Crashed while binding " + r);
2312                  // Keep the executeNesting count accurate.
2313                  final boolean inDestroying = mDestroyingServices.contains(r);
2314                  serviceDoneExecutingLocked(r, inDestroying, inDestroying);
2315                  return false;
2316              }
2317          }
2318          return true;
2319      }

    接下来通过binder调用进入ActivityThread。

//frameworks/base/core/java/android/app/ActivityThread.java
954          public final void scheduleBindService(IBinder token, Intent intent,
955                  boolean rebind, int processState) {
956              updateProcessState(processState, false);
957              BindServiceData s = new BindServiceData();
958              s.token = token;
959              s.intent = intent;
960              s.rebind = rebind;
961  
962              if (DEBUG_SERVICE)
963                  Slog.v(TAG, "scheduleBindService token=" + token + " intent=" + intent + " uid="
964                          + Binder.getCallingUid() + " pid=" + Binder.getCallingPid());
965              sendMessage(H.BIND_SERVICE, s);
966          }1853          public void handleMessage(Message msg) {
1854              if (DEBUG_MESSAGES) Slog.v(TAG, ">>> handling: " + codeToString(msg.what));...........
1878                  case BIND_SERVICE:
1879                      Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceBind");
1880                      handleBindService((BindServiceData)msg.obj);
1881                      Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);
1882                      break;.......3970      private void handleBindService(BindServiceData data) {
3971          Service s = mServices.get(data.token);
3972          if (DEBUG_SERVICE)
3973              Slog.v(TAG, "handleBindService s=" + s + " rebind=" + data.rebind);
3974          if (s != null) {
3975              try {
3976                  data.intent.setExtrasClassLoader(s.getClassLoader());
3977                  data.intent.prepareToEnterProcess();
3978                  try {
3979                      if (!data.rebind) {//执行Service.onBind()回调方法
3980                          IBinder binder = s.onBind(data.intent);//调用AMS的publishService
3981                          ActivityManager.getService().publishService(
3982                                  data.token, data.intent, binder);
3983                      } else {
3984                          s.onRebind(data.intent);
3985                          ActivityManager.getService().serviceDoneExecuting(
3986                                  data.token, SERVICE_DONE_EXECUTING_ANON, 0, 0);
3987                      }
3988                  } catch (RemoteException ex) {
3989                      throw ex.rethrowFromSystemServer();
3990                  }
3991              } catch (Exception e) {
3992                  if (!mInstrumentation.onException(s, e)) {
3993                      throw new RuntimeException(
3994                              "Unable to bind to service " + s
3995                              + " with " + data.intent + ": " + e.toString(), e);
3996                  }
3997              }
3998          }
3999      }

//frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
14085      public void publishService(IBinder token, Intent intent, IBinder service) {
14086          // Refuse possible leaked file descriptors
14087          if (intent != null && intent.hasFileDescriptors() == true) {
14088              throw new IllegalArgumentException("File descriptors passed in Intent");
14089          }
14090  
14091          synchronized(this) {
14092              if (!(token instanceof ServiceRecord)) {
14093                  throw new IllegalArgumentException("Invalid service token");
14094              }
14095              mServices.publishServiceLocked((ServiceRecord)token, intent, service);
14096          }
14097      }

    在publishService中又调用了ActivityServices的publishServiceLocked方法。

//frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
1836      void publishServiceLocked(ServiceRecord r, Intent intent, IBinder service) {
1837          final long origId = Binder.clearCallingIdentity();
1838          try {
1839              if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "PUBLISHING " + r
1840                      + " " + intent + ": " + service);
1841              if (r != null) {
1842                  Intent.FilterComparison filter
1843                          = new Intent.FilterComparison(intent);
1844                  IntentBindRecord b = r.bindings.get(filter);
1845                  if (b != null && !b.received) {
1846                      b.binder = service;
1847                      b.requested = true;
1848                      b.received = true;
1849                      ArrayMap<IBinder, ArrayList<ConnectionRecord>> connections = r.getConnections();
1850                      for (int conni = connections.size() - 1; conni >= 0; conni--) {
1851                          ArrayList<ConnectionRecord> clist = connections.valueAt(conni);
1852                          for (int i=0; i<clist.size(); i++) {
1853                              ConnectionRecord c = clist.get(i);
1854                              if (!filter.equals(c.binding.intent.intent)) {
1855                                  if (DEBUG_SERVICE) Slog.v(
1856                                          TAG_SERVICE, "Not publishing to: " + c);
1857                                  if (DEBUG_SERVICE) Slog.v(
1858                                          TAG_SERVICE, "Bound intent: " + c.binding.intent.intent);
1859                                  if (DEBUG_SERVICE) Slog.v(
1860                                          TAG_SERVICE, "Published intent: " + intent);
1861                                  continue;
1862                              }
1863                              if (DEBUG_SERVICE) Slog.v(TAG_SERVICE, "Publishing to: " + c);
1864                              try {//调用ServiceDispatcher.InnerConnection的connected方法
1865                                  c.conn.connected(r.name, service, false);
1866                              } catch (Exception e) {
1867                                  Slog.w(TAG, "Failure sending service " + r.shortInstanceName
1868                                        + " to connection " + c.conn.asBinder()
1869                                        + " (in " + c.binding.client.processName + ")", e);
1870                              }
1871                          }
1872                      }
1873                  }
1874  
1875                  serviceDoneExecutingLocked(r, mDestroyingServices.contains(r), false);
1876              }
1877          } finally {
1878              Binder.restoreCallingIdentity(origId);
1879          }
1880      }

    c.conn会调用ServiceDispatcher.InnerConnection的connected方法。

//frameworks/base/core/java/android/app/LoadedApk.java
1756      static final class ServiceDispatcher {
1757          private final ServiceDispatcher.InnerConnection mIServiceConnection;
1758          @UnsupportedAppUsage
1759          private final ServiceConnection mConnection;
1760          @UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.P, trackingBug = 115609023)
1761          private final Context mContext;
1762          private final Handler mActivityThread;
1763          private final Executor mActivityExecutor;
1764          private final ServiceConnectionLeaked mLocation;
1765          private final int mFlags;
1766  
1767          private RuntimeException mUnbindLocation;
1768  
1769          private boolean mForgotten;
1770  
1771          private static class ConnectionInfo {
1772              IBinder binder;
1773              IBinder.DeathRecipient deathMonitor;
1774          }
1775  
1776          private static class InnerConnection extends IServiceConnection.Stub {
1777              @UnsupportedAppUsage
1778              final WeakReference<LoadedApk.ServiceDispatcher> mDispatcher;
1779  
1780              InnerConnection(LoadedApk.ServiceDispatcher sd) {
1781                  mDispatcher = new WeakReference<LoadedApk.ServiceDispatcher>(sd);
1782              }
1783  
1784              public void connected(ComponentName name, IBinder service, boolean dead)
1785                      throws RemoteException {
1786                  LoadedApk.ServiceDispatcher sd = mDispatcher.get();
1787                  if (sd != null) {//调用ServiceDispatcher类型的sd对象的connected
1788                      sd.connected(name, service, dead);
1789                  }
1790              }
1791          }1878          public void connected(ComponentName name, IBinder service, boolean dead) {
1879              if (mActivityExecutor != null) {
1880                  mActivityExecutor.execute(new RunConnection(name, service, 0, dead));
1881              } else if (mActivityThread != null) {//将RunConnection对象的内容运行在主线程中
1882                  mActivityThread.post(new RunConnection(name, service, 0, dead));
1883              } else {
1884                  doConnected(name, service, dead);
1885              }
1886          }

//frameworks/base/core/java/android/app/LoadedApk.java
1970          private final class RunConnection implements Runnable {
1971              RunConnection(ComponentName name, IBinder service, int command, boolean dead) {
1972                  mName = name;
1973                  mService = service;
1974                  mCommand = command;
1975                  mDead = dead;
1976              }
1977  
1978              public void run() {
1979                  if (mCommand == 0) {//调用doConnected方法
1980                      doConnected(mName, mService, mDead);
1981                  } else if (mCommand == 1) {
1982                      doDeath(mName, mService);
1983                  }
1984              }
1985  
1986              final ComponentName mName;
1987              final IBinder mService;
1988              final int mCommand;
1989              final boolean mDead;
1990          }1898          public void doConnected(ComponentName name, IBinder service, boolean dead) {
1899              ServiceDispatcher.ConnectionInfo old;
1900              ServiceDispatcher.ConnectionInfo info;
1901  
1902              synchronized (this) {
1903                  if (mForgotten) {
1904                      // We unbound before receiving the connection; ignore
1905                      // any connection received.
1906                      return;
1907                  }
1908                  old = mActiveConnections.get(name);
1909                  if (old != null && old.binder == service) {
1910                      // Huh, already have this one.  Oh well!
1911                      return;
1912                  }
1913  
1914                  if (service != null) {
1915                      // A new service is being connected... set it all up.
1916                      info = new ConnectionInfo();
1917                      info.binder = service;
1918                      info.deathMonitor = new DeathMonitor(name, service);
1919                      try {
1920                          service.linkToDeath(info.deathMonitor, 0);
1921                          mActiveConnections.put(name, info);
1922                      } catch (RemoteException e) {
1923                          // This service was dead before we got it...  just
1924                          // don't do anything with it.
1925                          mActiveConnections.remove(name);
1926                          return;
1927                      }
1928  
1929                  } else {
1930                      // The named service is being disconnected... clean up.
1931                      mActiveConnections.remove(name);
1932                  }
1933  
1934                  if (old != null) {
1935                      old.binder.unlinkToDeath(old.deathMonitor, 0);
1936                  }
1937              }
1938  
1939              // If there was an old service, it is now disconnected.
1940              if (old != null) {
1941                  mConnection.onServiceDisconnected(name);
1942              }
1943              if (dead) {
1944                  mConnection.onBindingDied(name);
1945              }
1946              // If there is a new viable service, it is now connected.
1947              if (service != null) {//调用ServiceConnection的onServiceConnected方法
1948                  mConnection.onServiceConnected(name, service);
1949              } else {
1950                  // The binding machinery worked, but the remote returned null from onBind().
1951                  mConnection.onNullBinding(name);
1952              }
1953          }

    我们最后调用了调用ServiceConnection的onServiceConnected方法，这样在客户端实现了ServiceConnection的onServiceConnected方法就会被执行，至此Service的绑定过程全部结束。