Android8.0 bindService源码解析

1.AMS的bindService

我们从调用bindService方法开始来看

bindService(intent,serviceConnection, Context.BIND_AUTO_CREATE);

我们点击进入bindService方法，进入到了Context中的bindService中，而这个方法是一个抽象方法，而这个方法的具体实现其实是ContextWrapper中，所以我们直接看ContextWrapper的bindService方法

@Overridepublic boolean bindService(Intent service, ServiceConnection conn,int flags) {return mBase.bindService(service, conn, flags);}

我们可以看到在ContextWrapper中的bindService又调用了mBase的bindService方法，mBase是Context类型，是一个抽象类，具体的实现类是ContextImpl，所以我们看ContextImpl中的bindService方法

    @Overridepublic boolean bindService(Intent service, ServiceConnection conn,int flags) {warnIfCallingFromSystemProcess();return bindServiceCommon(service, conn, flags, mMainThread.getHandler(),Process.myUserHandle());}

调用了bindServiceCommon方法

    private boolean bindServiceCommon(Intent service, ServiceConnection conn, int flags, Handlerhandler, UserHandle user) {...try {...int res = ActivityManager.getService().bindService(mMainThread.getApplicationThread(), getActivityToken(), service,service.resolveTypeIfNeeded(getContentResolver()),sd, flags, getOpPackageName(), user.getIdentifier());...} catch (RemoteException e) {throw e.rethrowFromSystemServer();}}

在这个方法中，我们清楚的看见调用了ActivityManager.getService方法，我们看下getService方法：

    public static IActivityManager getService() {return IActivityManagerSingleton.get();}private static final Singleton<IActivityManager> IActivityManagerSingleton =new Singleton<IActivityManager>() {@Overrideprotected IActivityManager create() {final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE);final IActivityManager am = IActivityManager.Stub.asInterface(b);return am;}};

和Android7.0相比，这里有了明显的不同：Android7.0中，create方法中通过asInstance方法来获取IActivityManager对象的，并且可以进出查看asInstance方法，返回的对象为ActivityManagerProxy类；而这里的asInterface方法是IActivityManager.Stub持有的方法，并且查看不了，因为Android8.0之后使用了IActivityManager是使用AIDL进行生成的，细节被隐藏了。了解Android7.0的同学应该知道，这里实现的功能和Android7.0实现的功能是一样的，不了解的话可以先阅读我的上篇文章Android7.0 bindService源码解析_紫气东来_life的博客-CSDN博客

所以能，我们直接看AMS的bindService方法即可

2.Service的绑定过程

接着上面的，我们看AMS的bindService

    public int bindService(IApplicationThread caller, IBinder token, Intent service,String resolvedType, IServiceConnection connection, int flags, String callingPackage,int userId) throws TransactionTooLargeException {...synchronized(this) {return mServices.bindServiceLocked(caller, token, service,resolvedType, connection, flags, callingPackage, userId);}}

mService是ActiveServices，我们看ActiveServices的bindServiceLocked方法

    int bindServiceLocked(IApplicationThread caller, IBinder token, Intent service,String resolvedType, final IServiceConnection connection, int flags,String callingPackage, final int userId) throws TransactionTooLargeException {...try {....if (s.app != null && b.intent.received) {....if (b.intent.apps.size() == 1 && b.intent.doRebind) {requestServiceBindingLocked(s, b.intent, callerFg, true);}} else if (!b.intent.requested) {requestServiceBindingLocked(s, b.intent, callerFg, false);}}
}

这里的代码很多，我阉割了无关的代码。调用requestServiceBindingLocked方法，并且第三个参数是为false，第三个参数是rebind，重新绑定的意思，我们看下代码

    private final boolean requestServiceBindingLocked(ServiceRecord r, IntentBindRecord i,boolean execInFg, boolean rebind) throws TransactionTooLargeException {...if ((!i.requested || rebind) && i.apps.size() > 0) {try {bumpServiceExecutingLocked(r, execInFg, "bind");r.app.forceProcessStateUpTo(ActivityManager.PROCESS_STATE_SERVICE);r.app.thread.scheduleBindService(r, i.intent.getIntent(), rebind,r.app.repProcState);if (!rebind) {i.requested = true;}i.hasBound = true;i.doRebind = false;} ...}return true;}

我们可以看到，调用了thread的scheduleBindService方法，这里thread其实就是ActivityThread，所以我们直接到ActivityThread中寻找scheduleBindService方法

        public final void scheduleBindService(IBinder token, Intent intent,boolean rebind, int processState) {...sendMessage(H.BIND_SERVICE, s);}

sendMessage方法大家应该比较熟悉，所以直接找到接收H.BIND_SERVICE的地方就行了，同样是在ActivityThread方法中，如下：

                case BIND_SERVICE:Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceBind");handleBindService((BindServiceData)msg.obj);Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);break;

查看handleBindService方法

    private void handleBindService(BindServiceData data) {Service s = mServices.get(data.token);if (s != null) {try {...try {if (!data.rebind) {IBinder binder = s.onBind(data.intent);ActivityManagerNative.getDefault().publishService(data.token, data.intent, binder);} else {...}ensureJitEnabled();} catch (RemoteException ex) {throw ex.rethrowFromSystemServer();}} catch (Exception e) {...}}}

上面我们说了，ActivityManagerNative.getDefault是ActivityManagerProxy，所以我们直接看这个类的publishService方法

    public void publishService(IBinder token,Intent intent, IBinder service) throws RemoteException {Parcel data = Parcel.obtain();Parcel reply = Parcel.obtain();data.writeInterfaceToken(IActivityManager.descriptor);data.writeStrongBinder(token);intent.writeToParcel(data, 0);data.writeStrongBinder(service);mRemote.transact(PUBLISH_SERVICE_TRANSACTION, data, reply, 0);reply.readException();data.recycle();reply.recycle();}

查看接收PUBLISH_SERVICE_TRANSACTION的地方，还是在ActivityManagerNative中

        case PUBLISH_SERVICE_TRANSACTION: {data.enforceInterface(IActivityManager.descriptor);IBinder token = data.readStrongBinder();Intent intent = Intent.CREATOR.createFromParcel(data);IBinder service = data.readStrongBinder();publishService(token, intent, service);reply.writeNoException();return true;}

publishService的方法是在AMS中实现的，和之前的bindService是一样的，我们查看publishService方法

public void publishService(IBinder token, Intent intent, IBinder service) {...synchronized(this) {....mServices.publishServiceLocked((ServiceRecord)token, intent, service);}}

查看publishServiceLocked方法

    void publishServiceLocked(ServiceRecord r, Intent intent, IBinder service) {...c.conn.connected(r.name, service);...}

关键的方法如上，这里的conn是IServiceConnection，而具体的实现类是LoadedApk.ServiceDispatcher，我们在ContextImpl的bindServiceCommon可以找到，如下

    private boolean bindServiceCommon(Intent service, ServiceConnection conn, int flags, Handlerhandler, UserHandle user) {...if (mPackageInfo != null) {sd = mPackageInfo.getServiceDispatcher(conn, getOuterContext(), handler, flags);}...}

感兴趣的同学可以从这里去递进的查找，我这里就不贴代码了，最后会调用到LoadedApk.ServiceDispatcher的doConnected方法，如下：

        public void doConnected(ComponentName name, IBinder service) {...// If there is a new service, it is now connected.if (service != null) {mConnection.onServiceConnected(name, service);}}

mConnection就是我们调用bindService时传入的ServiceConnection，绑定成功后，从这里回调

bindService到此结束了