Android启动Service流程

其实启动Service和我们上一篇启动App的流程差不多，通过学习老罗的Android系统在新进程中启动自定义服务过程（startService）的原理分析，补充了一些不太清楚的知识点。这里做一下笔记。
老罗的例子，Service是设置了一个android:process属性，表明要在新建的进程运行Service。例子xml代码：

<manifest xmlns:android="http://schemas.android.com/apk/res/android"  
    package="shy.luo.ashmem"  
    android:sharedUserId="android.uid.system"  
    android:versionCode="1"  
    android:versionName="1.0">  
        <application android:icon="@drawable/icon" android:label="@string/app_name">  
            ......  
            <service   
                android:enabled="true"   
                android:name=".Server"  
                android:process=".Server" ><!-- 设置了process属性 -->  
                    <intent-filter>  
                        <action android:name="shy.luo.ashmem.server"/>  
                        <category android:name="android.intent.category.DEFAULT"/>  
                    </intent-filter>  
            </service>  
        </application>  
</manifest>   

在这篇博文中，讲述了ActivityManagerService是在一个ServerThread类（有种熟悉的感觉，ActivityThread，不过没有联系的，哈哈）中启动的，代码如下：

class ServerThread extends Thread {   
    ......  
    @Override  
    public void run() {  
        ......  
        // Critical services...  
        try {  
            ......  
            context = ActivityManagerService.main(factoryTest);  
            ......  
            ActivityManagerService.setSystemProcess();  
            ......  
        } catch (RuntimeException e) {  
            Slog.e("System", "Failure starting core service", e);  
        }  
        ......  
    }  
    ......
}  

调用了ActivityManagerService的main和setSystemProcess方法，我们接着看代码：

public final class ActivityManagerService extends ActivityManagerNative  
        implements Watchdog.Monitor, BatteryStatsImpl.BatteryCallback {  
    ......  
    static ActivityManagerService mSelf;  
    ......  
    public static void setSystemProcess() {  
        try {  
            ActivityManagerService m = mSelf;  
            ServiceManager.addService("activity", m);  
            ......  
        } catch (PackageManager.NameNotFoundException e) {  
            ......  
        }  
    }  
    ......  
    public static final Context main(int factoryTest) {  
        ......  
        ActivityManagerService m = thr.mService;  
        mSelf = m;  
        ......  
    }  
}  

在setSystemProcess方法里，调用了ServiceManager的addService方法，这样ActivityManagerService作为Service注册到ServiceManager中，Client就可以在ServiceManager中获取到ActivityManagerService的代理对象，并与之通信。这样ActivityManagerService就算是“启动”起来了。
当我们通过startService启动Service时，和启动App一样，其实是调用ActivityManagerService代理对象ActivityManagerProxy 的startService方法：

class ActivityManagerProxy implements IActivityManager {  
    ......  
    public ComponentName startService(IApplicationThread caller, Intent service,  
        String resolvedType) throws RemoteException {  
        Parcel data = Parcel.obtain();  
        Parcel reply = Parcel.obtain();  
        data.writeInterfaceToken(IActivityManager.descriptor);  
        data.writeStrongBinder(caller != null ? caller.asBinder() : null);  
        service.writeToParcel(data, 0);  
        data.writeString(resolvedType);  
        mRemote.transact(START_SERVICE_TRANSACTION, data, reply, 0);  
        reply.readException();  
        ComponentName res = ComponentName.readFromParcel(reply);  
        data.recycle();  
        reply.recycle();  
        return res;  
    }  
    ......  
}  

参数service是一个Intent实例，它里面指定了要启动的服务的名称，也就是例子定义的服务名称“shy.luo.ashmem.server”了。

参数caller是一个IApplicationThread实例，它是一个在主进程创建的一个Binder对象。在Android应用程序中，每一个进程都用一个ActivityThread实例来表示，而在ActivityThread类中，有一个成员变量mAppThread，它是一个ApplicationThread实例，实现了IApplicationThread接口，它的作用是用来辅助ActivityThread类来执行一些操作（其实mAppThread是ActivityManagerService持有与App进程通信的Binder代理对象，ActivityManagerService利用调用IApplicationThread代理对象，实现通知ActivityThread执行对应的方法），这个我们在后面会看到它是如何用来启动服务的。

参数resolvedType是一个字符串，它表示service这个Intent的MIME类型，它是在解析Intent时用到的。在这个例子中，我们没有指定这个Intent 的MIME类型，因此，这个参数为null。

ActivityManagerProxy类的startService函数把这三个参数写入到data本地变量去，接着通过mRemote.transact函数进入到Binder驱动程序，然后Binder驱动程序唤醒正在等待Client请求的ActivityManagerService进程，最后进入到ActivityManagerService的startService函数中。

接下来就是ActivityManagerService会做一系列检查，然后通过socket方式通知Zygote孵化新的进程，指定新的进程加载ActivityThread类，并执行main方法。代码过程请参考我上一篇博文Android应用App启动流程。这里我们还是着重看一下Service在新的进程启动过程。

先看看ActivityThread的main方法：

public final class ActivityThread {   
    ......  
    public static final void main(String[] args) {  
        ......  
        Looper.prepareMainLooper();  
        ......  
        ActivityThread thread = new ActivityThread();  
        thread.attach(false);  
        ......  
        Looper.loop();  
        ......  
        thread.detach();  
        ......  
    }  
}  

因为这段代码可以带我们了解App的启动和初始化过程，所以很重要。在这里初始化Looper，创建Looper和MessageQueue，然后调用attach方法，把自己的ApplicationThread代理对象通过IPC传给ActivityManagerService，调用Looper.loop方法，让Looper不断的从MessageQueue取出消息，实现消息机制。我们来看看attach方法（上一个博文没有写清楚attach方法，因为不清楚）：

public final class ActivityThread {  
    ......  
    private final void attach(boolean system) {  
        ......  
        if (!system) {  
            ......  
            IActivityManager mgr = ActivityManagerNative.getDefault();  
            try {  
                mgr.attachApplication(mAppThread);  
            } catch (RemoteException ex) {  
            }  
        } else {  
            ......  
        }  
        ......  
    }  
    ......  
}  

主要是调用ActivityManagerService的代理对象ActivityManagerProxy的attachApplication的方法：

class ActivityManagerProxy implements IActivityManager {  
    ......  
    public void attachApplication(IApplicationThread app) throws RemoteException {  
        Parcel data = Parcel.obtain();  
        Parcel reply = Parcel.obtain();  
        data.writeInterfaceToken(IActivityManager.descriptor);  
        data.writeStrongBinder(app.asBinder());  
        mRemote.transact(ATTACH_APPLICATION_TRANSACTION, data, reply, 0);  
        reply.readException();  
        data.recycle();  
        reply.recycle();  
    }  
    ......  
}  

这下应该清楚知道ActivityThread怎么把ApplicationThread的代理对象传给ActivityManagerService了吧。我们顺便往下看，ActivityManagerService调用attachApplication的方法：

public final class ActivityManagerService extends ActivityManagerNative  
                            implements Watchdog.Monitor, BatteryStatsImpl.BatteryCallback {  
    ......      
    public final void attachApplication(IApplicationThread thread) {  
        synchronized (this) {  
            int callingPid = Binder.getCallingPid();  
            final long origId = Binder.clearCallingIdentity();  
            attachApplicationLocked(thread, callingPid);  
            Binder.restoreCallingIdentity(origId);  
        }  
    }  
    ......  
}  

attachApplicationLocked方法代码：

public final class ActivityManagerService extends ActivityManagerNative  
                        implements Watchdog.Monitor, BatteryStatsImpl.BatteryCallback {    
    ......  
    private final boolean attachApplicationLocked(IApplicationThread thread,  
            int pid) {  
        // Find the application record that is being attached...  either via  
        // the pid if we are running in multiple processes, or just pull the  
        // next app record if we are emulating process with anonymous threads.  
        ProcessRecord app;  
        if (pid != MY_PID && pid >= 0) {  
            synchronized (mPidsSelfLocked) {  
                app = mPidsSelfLocked.get(pid);  
            }  
        } else if (mStartingProcesses.size() > 0) {  
            app = mStartingProcesses.remove(0);  
            app.setPid(pid);  
        } else {  
            app = null;  
        }  
        ......  

        String processName = app.processName;  
        ......  
        app.thread = thread;  
        ......  
        boolean badApp = false;  
        ......  
        // Find any services that should be running in this process...  
        if (!badApp && mPendingServices.size() > 0) {  
            ServiceRecord sr = null;  
            try {  
                for (int i=0; i<mPendingServices.size(); i++) {  
                    sr = mPendingServices.get(i);  
                    if (app.info.uid != sr.appInfo.uid  
                        || !processName.equals(sr.processName)) {  
                            continue;  
                    }  
                    mPendingServices.remove(i);  
                    i--;  
                    realStartServiceLocked(sr, app);  
                    didSomething = true;  
                }  
            } catch (Exception e) {  
                ......  
            }  
        }  
        ......  
        return true;  
    }  
    ......  
}  

最终调用realStartServiceLocked方法：

class ActivityManagerProxy implements IActivityManager {  
    ......  
    private final void realStartServiceLocked(ServiceRecord r,  
            ProcessRecord app) throws RemoteException {  
        ......  
        r.app = app;  
        ......  
        try {  
            ......  
            app.thread.scheduleCreateService(r, r.serviceInfo);  
            ......  
        } finally {  
            ......  
        }  
        ......  
    }  
    ......  
}  

这里的app.thread是一个ApplicationThread的代理对象，通过调用这个代理对象scheduleCreateService方法，通知ActivityThread启动Service，回到App进程。

class ApplicationThreadProxy implements IApplicationThread {  
    ......  
    public final void scheduleCreateService(IBinder token, ServiceInfo info)  
                throws RemoteException {  
        Parcel data = Parcel.obtain();  
        data.writeInterfaceToken(IApplicationThread.descriptor);  
        data.writeStrongBinder(token);  
        info.writeToParcel(data, 0);  
        mRemote.transact(SCHEDULE_CREATE_SERVICE_TRANSACTION, data, null,  
            IBinder.FLAG_ONEWAY);  
        data.recycle();  
    }  
    ......  
}  

public final class ActivityThread {  
    ......  
    private final class ApplicationThread extends ApplicationThreadNative {  
        ......  
        public final void scheduleCreateService(IBinder token,  
        ServiceInfo info) {  
            CreateServiceData s = new CreateServiceData();  
            s.token = token;  
            s.info = info;  
            queueOrSendMessage(H.CREATE_SERVICE, s);  
        }  
        ......  
    }  
    ......  
}  

又见到熟悉的身形了，ApplicationThread作为ActivityThread内部类，直接代用queueOrSendMessage方法，分发消息到ActivityThread的MessageQueue，通知ActivityThread执行对应方法。所以整个Handler的消息机制，在Android中起了大多的作用。整个App运行，都是通过这个消息机制得以和谐运行，表示不禁感叹。上次都没看怎么ApplicationThread怎么分发消息，代码如下：

public final class ActivityThread {  
    ......  
    private final void queueOrSendMessage(int what, Object obj) {  
        queueOrSendMessage(what, obj, 0, 0);  
    }  
    private final void queueOrSendMessage(int what, Object obj, int arg1, int arg2) {  
        synchronized (this) {  
            ......  
            Message msg = Message.obtain();  
            msg.what = what;  
            msg.obj = obj;  
            msg.arg1 = arg1;  
            msg.arg2 = arg2;  
            mH.sendMessage(msg);  
        }  
    }  
    ......  
}  

很普通代码，通过Handler分发消息。看一下ActivityThread的Handler怎么处理启动Service的代码：

public final class ActivityThread {   
    ......  
    private final class H extends Handler {  
        ......  
        public void handleMessage(Message msg) {  
            ......  
            switch (msg.what) {  
                ......  
                case CREATE_SERVICE:  
                    handleCreateService((CreateServiceData)msg.obj);  
                    break;  
                ......  
            }  
            ......  
        }  
        ......  
    }  
    ......  
}  

调用了handleCreateService方法：

public final class ActivityThread {  
    ......  
    private final void handleCreateService(CreateServiceData data) {  
        // If we are getting ready to gc after going to the background, well  
        // we are back active so skip it.  
        unscheduleGcIdler();  
        LoadedApk packageInfo = getPackageInfoNoCheck(  
            data.info.applicationInfo);  
        Service service = null;  
        try {  
            java.lang.ClassLoader cl = packageInfo.getClassLoader();  
            service = (Service) cl.loadClass(data.info.name).newInstance();  
        } catch (Exception e) {  
            if (!mInstrumentation.onException(service, e)) {  
                throw new RuntimeException(  
                    "Unable to instantiate service " + data.info.name  
                    + ": " + e.toString(), e);  
            }  
        }  
        try {  
            if (localLOGV) Slog.v(TAG, "Creating service " + data.info.name);  
            ContextImpl context = new ContextImpl();  
            context.init(packageInfo, null, this);  
            Application app = packageInfo.makeApplication(false, mInstrumentation);  
            context.setOuterContext(service);  
            service.attach(context, this, data.info.name, data.token, app,  
                ActivityManagerNative.getDefault());  
            service.onCreate();  
            mServices.put(data.token, service);  
            try {  
                ActivityManagerNative.getDefault().serviceDoneExecuting(  
                    data.token, 0, 0, 0);  
            } catch (RemoteException e) {  
                // nothing to do.  
            }  
        } catch (Exception e) {  
            if (!mInstrumentation.onException(service, e)) {  
                throw new RuntimeException(  
                    "Unable to create service " + data.info.name  
                    + ": " + e.toString(), e);  
            }  
        }  
    }  
    ......  
}  

这段代码主要是加载要启动的Service类，并执行service.onCreate()方法。至此，启动Service代码分析完毕。跟着老罗的代码解析，的确学习了不少。

参考资料

Android系统在新进程中启动自定义服务过程（startService）的原理分析