InnerConnection直接将连接的处理逻辑交给了ServiceDispatcher。

static final class ServiceDispatcher {
    public void connected(ComponentName name, IBinder service, boolean dead) {
        if (mActivityThread != null) {
            mActivityThread.post(new RunConnection(name, service, 0, dead));
        } else {
            doConnected(name, service, dead);
        }
    }
    
    public void doConnected(ComponentName name, IBinder service, boolean dead) {
        ServiceDispatcher.ConnectionInfo old;
        ServiceDispatcher.ConnectionInfo info;

        synchronized (this) {
            // 已经unbind，不做处理
            if (mForgotten) {
                return;
            }
            // old不为null，表示此ServiceConnection进行了其他连接
            old = mActiveConnections.get(name);
            // 同一个Connection已进行过连接，不做处理
            if (old != null && old.binder == service) {
                return;
            }

            // IBinder对象不为null，表示建立新连接
            if (service != null) {
                info = new ConnectionInfo();
                info.binder = service;
                info.deathMonitor = new DeathMonitor(name, service);
                try {
                    // linkToDeath
                    service.linkToDeath(info.deathMonitor, 0);
                    // 保存连接信息
                    mActiveConnections.put(name, info);
                } catch (RemoteException e) {
                    mActiveConnections.remove(name);
                    return;
                }
            } else {
                // IBinder对象为null，表示断开连接
                mActiveConnections.remove(name);
            }

            if (old != null) {
                old.binder.unlinkToDeath(old.deathMonitor, 0);
            }
        }

        // 先移除旧连接
        if (old != null) {
            mConnection.onServiceDisconnected(name);
        }
        if (dead) {
            mConnection.onBindingDied(name);
        }
        // 新连接，回调onServiceConnected
        if (service != null) {
            mConnection.onServiceConnected(name, service);
        }
    }
    
    private final class DeathMonitor implements IBinder.DeathRecipient {
        DeathMonitor(ComponentName name, IBinder service) {
            mName = name;
            mService = service;
        }
        public void binderDied() {
            death(mName, mService);
        }
        final ComponentName mName;
        final IBinder mService;
    }
    
    public void doDeath(ComponentName name, IBinder service) {
        synchronized (this) {
            ConnectionInfo old = mActiveConnections.get(name);
            if (old == null || old.binder != service) {
                return;
            }
            // 移除ConnectionInfo
            mActiveConnections.remove(name);
            // 调用unlinkToDeath
            old.binder.unlinkToDeath(old.deathMonitor, 0);
        }
        // 调用ServiceConnection.onServiceDisconnected
        mConnection.onServiceDisconnected(name);
    }
}

public ComponentName startForegroundService(Intent service) {
    warnIfCallingFromSystemProcess();
    return startServiceCommon(service, true, mUser);
}

public final void startForeground(int id, Notification notification) {
    try {
        mActivityManager.setServiceForeground(new ComponentName(this, mClassName), mToken, id, notification, 0);
    } catch (RemoteException ex) {
    }
}

public void setServiceForeground(ComponentName className, IBinder token, int id, Notification notification, int flags) {
    synchronized(this) {
        mServices.setServiceForegroundLocked(className, token, id, notification, flags);
    }
}

private void setServiceForegroundInnerLocked(ServiceRecord r, int id, Notification notification, int flags) {
    // 1.如通知id不为0
    if (id != 0) {
        if (notification == null) {
            throw new IllegalArgumentException("null notification");
        }
        // Instant apps need permission to create foreground services.
        ......
        // 2.如是以前台服务方式启动的，移除ANR延时消息
        if (r.fgRequired) {
            r.fgRequired = false;
            r.fgWaiting = false;
                      mAm.mHandler.removeMessages(ActivityManagerService.SERVICE_FOREGROUND_TIMEOUT_MSG, r);
        }
        // 3.先取消已经绑定的通知
        if (r.foregroundId != id) {
            cancelForegroundNotificationLocked(r);
            r.foregroundId = id;
        }
        notification.flags |= Notification.FLAG_FOREGROUND_SERVICE;
        r.foregroundNoti = notification;
        // 4.如Service当前为非前台服务，更新Service状态
        if (!r.isForeground) {
            final ServiceMap smap = getServiceMapLocked(r.userId);
            if (smap != null) {
                ActiveForegroundApp active = smap.mActiveForegroundApps.get(r.packageName);
                if (active == null) {
                    active = new ActiveForegroundApp();
                    active.mPackageName = r.packageName;
                    active.mUid = r.appInfo.uid;
                    active.mShownWhileScreenOn = mScreenOn;
                    if (r.app != null) {
                        active.mAppOnTop = active.mShownWhileTop = r.app.uidRecord.curProcState <= ActivityManager.PROCESS_STATE_TOP;
                    }
                    active.mStartTime = active.mStartVisibleTime = SystemClock.elapsedRealtime();
smap.mActiveForegroundApps.put(r.packageName, active);
                    // 将通知与应用绑定，更新为前台应用
requestUpdateActiveForegroundAppsLocked(smap, 0);
                }
                active.mNumActive++;
            }
            r.isForeground = true;
        }
        // 5.加入通知展示队列
        r.postNotification();
        if (r.app != null) {
            updateServiceForegroundLocked(r.app, true);
        }
        getServiceMapLocked(r.userId).ensureNotStartingBackgroundLocked(r);
        mAm.notifyPackageUse(r.serviceInfo.packageName, PackageManager.NOTIFY_PACKAGE_USE_FOREGROUND_SERVICE);
    } else {
        // 通知id为0，与原有前台通知解绑，如flag为true则取消前台通知(即stopForeground(true))
        ......
    }
}

int getAppStartModeLocked(int uid, String packageName, int packageTargetSdk, int callingPid, boolean alwaysRestrict, boolean disabledOnly) {
    UidRecord uidRec = mActiveUids.get(uid);
    // uidRec.idle表示应用处于后台
    if (uidRec == null || alwaysRestrict || uidRec.idle) {
        if (ephemeral) {
            return ActivityManager.APP_START_MODE_DISABLED;
        } else {
            if (disabledOnly) {
                return ActivityManager.APP_START_MODE_NORMAL;
            }
            final int startMode = (alwaysRestrict) ? appRestrictedInBackgroundLocked(uid, packageName, packageTargetSdk) : appServicesRestrictedInBackgroundLocked(uid, packageName, packageTargetSdk);
            ......
            return startMode;
        }
    }
    // 前台应用直接返回APP_START_MODE_NORMAL
    return ActivityManager.APP_START_MODE_NORMAL;
}

int appServicesRestrictedInBackgroundLocked(int uid, String packageName, int packageTargetSdk) {
    // 1. Persistent app不受限制
    if (mPackageManagerInt.isPackagePersistent(packageName)) {
        return ActivityManager.APP_START_MODE_NORMAL;
    }
    // 2. uid处于后台白名单中的用户不受限制
    if (uidOnBackgroundWhitelist(uid)) {
        return ActivityManager.APP_START_MODE_NORMAL;
    }
    // 3. 处于耗电白名单的应用不受限制
    if (isOnDeviceIdleWhitelistLocked(uid)) {
        return ActivityManager.APP_START_MODE_NORMAL;
    }

    // 4. 以上条件均不满足，再检查app的后台限制条件
    return appRestrictedInBackgroundLocked(uid, packageName, packageTargetSdk);
}

int appRestrictedInBackgroundLocked(int uid, String packageName, int packageTargetSdk) {
    // target O(26)+的应用均后台限制
    if (packageTargetSdk >= Build.VERSION_CODES.O) {
        return ActivityManager.APP_START_MODE_DELAYED_RIGID;
    }
    ......
}

int stopServiceLocked(IApplicationThread caller, Intent service, String resolvedType, int userId) {
    // 查找Service
    ServiceLookupResult r = retrieveServiceLocked(service, resolvedType, null, Binder.getCallingPid(), Binder.getCallingUid(), userId, false, false, false);
    ......
    stopServiceLocked(r.record);
    ......
    return 0;
}

private void stopServiceLocked(ServiceRecord service) {
    ......
    // 将service.startRequested置为false
    service.startRequested = false;
    ......
    bringDownServiceIfNeededLocked(service, false, false);
}

private final void bringDownServiceIfNeededLocked(ServiceRecord r, boolean knowConn, boolean hasConn) {
    // 有些例外的场景，Service暂时不能被stop
    if (isServiceNeededLocked(r, knowConn, hasConn)) {
        return;
    }
    // Service还在挂起中，并未完成启动
    if (mPendingServices.contains(r)) {
        return;
    }
    bringDownServiceLocked(r);
}


private final boolean isServiceNeededLocked(ServiceRecord r, boolean knowConn, boolean hasConn) {
    // Service已启动但未被调用stop
    if (r.startRequested) {
        return true;
    }
    // 有Context.BIND_AUTO_CREATE类型的连接未解绑
    if (!knowConn) {
        hasConn = r.hasAutoCreateConnections();
    }
    if (hasConn) {
        return true;
    }
    return false;
}

private final void bringDownServiceLocked(ServiceRecord r) {
    // 1.解绑所有bind连接
    for (int conni=r.connections.size()-1; conni>=0; conni--) {
        ......
        cr.conn.connected(r.name, null, true);
    }

    // Tell the service that it has been unbound.
    if (r.app != null && r.app.thread != null) {
        for (int i=r.bindings.size()-1; i>=0; i--) {
            ......
            // 2.通知ActivityThread调用Service的onUnbind方法
            r.app.thread.scheduleUnbindService(r, ibr.intent.getIntent());
        }
    }

    // 3.如果启动的是前台服务，且stop时仍未展示通知，service所属应用将force close。r.fgRequired在展示前台通知后设置为false。
    if (r.fgRequired) {
        if (r.app != null) {
            Message msg = mAm.mHandler.obtainMessage(ActivityManagerService.SERVICE_FOREGROUND_CRASH_MSG);
            msg.obj = r.app;
            mAm.mHandler.sendMessage(msg);
        }
    }
    
    .....
    // 4.清除ServiceMap缓存
    final ServiceMap smap = getServiceMapLocked(r.userId);
    ServiceRecord found = smap.mServicesByName.remove(r.name);
    smap.mServicesByIntent.remove(r.intent);
    r.totalRestartCount = 0;
    unscheduleServiceRestartLocked(r, 0, true);
    
	......
    // 5.取消前台通知(如果此通知未绑定到其它前台服务)
    cancelForegroundNotificationLocked(r);
    if (r.isForeground) {
        decActiveForegroundAppLocked(smap, r);
    }
    
    ......
    // 6.更新进程优先级，通知ActivityThread调用Service的onDestroy
    mAm.updateOomAdjLocked(r.app, true);
    r.app.thread.scheduleStopService(r);
    ......
}

public void unbindService(ServiceConnection conn) {
    IServiceConnection sd = mPackageInfo.forgetServiceDispatcher(getOuterContext(), conn);
    ActivityManager.getService().unbindService(sd);
}

boolean unbindServiceLocked(IServiceConnection connection) {
    IBinder binder = connection.asBinder();
    ArrayList<ConnectionRecord> clist = mServiceConnections.get(binder);
    try {
        while (clist.size() > 0) {
            ConnectionRecord r = clist.get(0);
            //调用removeConnectionLocked移除连接
            removeConnectionLocked(r, null, null);
        }
        // 更新进程优先级
        mAm.updateOomAdjLocked();
    } finally {
        Binder.restoreCallingIdentity(origId);
    }
    return true;
}

void removeConnectionLocked(ConnectionRecord c, ProcessRecord skipApp, ActivityRecord skipAct) {
    //移除连接记录
    IBinder binder = c.conn.asBinder();
    AppBindRecord b = c.binding;
    ServiceRecord s = b.service;
    ArrayList<ConnectionRecord> clist = s.connections.get(binder);
    clist = mServiceConnections.get(binder);
    if (clist != null) {
        clist.remove(c);
        if (clist.size() == 0) {
            mServiceConnections.remove(binder);
        }
    }

    //移除AMS中保存的连接信息
    mAm.stopAssociationLocked(b.client.uid, b.client.processName, s.appInfo.uid, s.name);
    if (b.connections.size() == 0) {
        b.intent.apps.remove(b.client);
    }

    if (!c.serviceDead) {
        // 如果该Service已经没有了任何连接，通知Service调用onUnbind
        if (s.app != null && s.app.thread != null && b.intent.apps.size() == 0 && b.intent.hasBound) {
            try {
                b.intent.hasBound = false;
                b.intent.doRebind = false;
                s.app.thread.scheduleUnbindService(s, b.intent.intent.getIntent());
            } catch (Exception e) {
                serviceProcessGoneLocked(s);
            }
        }

        // If unbound while waiting to start, remove the pending service
        mPendingServices.remove(s);
		// 如果bind时flag为BIND_AUTO_CREATE，尝试销毁Service
        if ((c.flags&Context.BIND_AUTO_CREATE) != 0) {
            boolean hasAutoCreate = s.hasAutoCreateConnections();
            bringDownServiceIfNeededLocked(s, true, hasAutoCreate);
        }
    }
}

public final void stopSelf(int startId) {
    mActivityManager.stopServiceToken(new ComponentName(this, mClassName), mToken, startId);
}

boolean stopServiceTokenLocked(ComponentName className, IBinder token, int startId) {
    ServiceRecord r = findServiceLocked(className, token, UserHandle.getCallingUserId());
    if (r != null) {
        if (startId >= 0) {
            ......
            // 如果调用的是stopSelfResult，则比较传入的startId是否为最近一次回调onStartCommand的startId
            if (r.getLastStartId() != startId) {
                return false;
            }
        }

        ......
        // 以下过程和stop/unbind一致
        bringDownServiceIfNeededLocked(r, false, false);
        Binder.restoreCallingIdentity(origId);
        return true;
    }
    return false;
}

final void updateOomAdjLocked() {
    ......
    // 遍历所有uid
    for (int i=mActiveUids.size()-1; i>=0; i--) {
        final UidRecord uidRec = mActiveUids.valueAt(i);
        int uidChange = UidRecord.CHANGE_PROCSTATE;
        if (uidRec.setProcState != uidRec.curProcState || uidRec.setWhitelist != uidRec.curWhitelist) {
            if (ActivityManager.isProcStateBackground(uidRec.curProcState) && !uidRec.curWhitelist) {
                // 进程当前处于后台，上一次状态为前台，且不处于白名单中
                if (!ActivityManager.isProcStateBackground(uidRec.setProcState) || uidRec.setWhitelist) {
                    // 将lastBackgroundTime设置为当前时间
                    uidRec.lastBackgroundTime = nowElapsed;
                    // 发出一个延时消息
                    if (!mHandler.hasMessages(IDLE_UIDS_MSG)) {                  mHandler.sendEmptyMessageDelayed(IDLE_UIDS_MSG, mConstants.BACKGROUND_SETTLE_TIME);
                                                              }
                }
            } else {
                // 进程当前不处于后台，如idle状态已为true，将idle置为false，同时将lasBackgroundTime置为0。
                if (uidRec.idle) {
                    uidChange = UidRecord.CHANGE_ACTIVE;
                    EventLogTags.writeAmUidActive(uidRec.uid);
                    uidRec.idle = false;
                }
                uidRec.lastBackgroundTime = 0;
            }
        }
    }
    ......
}

public static final boolean isProcStateBackground(int procState) {
    return procState >= PROCESS_STATE_TRANSIENT_BACKGROUND;
}

final void idleUids() {
    synchronized (this) {
        ......
        final long nowElapsed = SystemClock.elapsedRealtime();
        // maxBgTime值为当前时间减60s
        final long maxBgTime = nowElapsed - mConstants.BACKGROUND_SETTLE_TIME;
        ......
        // 遍历所有uid
        for (int i=N-1; i>=0; i--) {
            final UidRecord uidRec = mActiveUids.valueAt(i);
            final long bgTime = uidRec.lastBackgroundTime;
            if (bgTime > 0 && !uidRec.idle) {
                // 如果应用最近一次切换到后台的时间点 < maxBgTime
                // 即lastBackgroundTime + 60s <= maxBgTime
                // 即应用处于后台达到了60s
                if (bgTime <= maxBgTime) {
                    EventLogTags.writeAmUidIdle(uidRec.uid);
                    // 将uid状态置为空闲
                    uidRec.idle = true;
                    doStopUidLocked(uidRec.uid, uidRec);
                } 
                ......
            }
        }
    }
}

final void doStopUidLocked(int uid, final UidRecord uidRec) {
    mServices.stopInBackgroundLocked(uid);
    enqueueUidChangeLocked(uidRec, uid, UidRecord.CHANGE_IDLE);
}

void stopInBackgroundLocked(int uid) {
    // 查询此uid的所有Service
    ServiceMap services = mServiceMap.get(UserHandle.getUserId(uid));
    ArrayList<ServiceRecord> stopping = null;
    if (services != null) {
        for (int i=services.mServicesByName.size()-1; i>=0; i--) {
            ServiceRecord service = services.mServicesByName.valueAt(i);
            if (service.appInfo.uid == uid && service.startRequested) {
                // 如应用当前不处于APP_START_MODE_NORMAL，所有Service都加入stop列表
                if (mAm.getAppStartModeLocked(service.appInfo.uid, service.packageName, service.appInfo.targetSdkVersion, -1, false, false) != ActivityManager.APP_START_MODE_NORMAL) {
                    if (stopping == null) {
                        stopping = new ArrayList<>();
                    }
                    stopping.add(service);
                }
            }
        }
        if (stopping != null) {
            // 遍历stop所有Service
            for (int i=stopping.size()-1; i>=0; i--) {
                ServiceRecord service = stopping.get(i);
                service.delayed = false;
               services.ensureNotStartingBackgroundLocked(service);
                // stop service，流程与调用stopService一致
                stopServiceLocked(service);
            }
        }
    }
}

public void makePackageIdle(String packageName, int userId) {
    ......
    synchronized(this) {
        final int appId = UserHandle.getAppId(pkgUid);
        final int N = mActiveUids.size();
        for (int i=N-1; i>=0; i--) {
            final UidRecord uidRec = mActiveUids.valueAt(i);
            final long bgTime = uidRec.lastBackgroundTime;
            // bgTime>0，即应用已进入后台，且目前为非idle状态
            if (bgTime > 0 && !uidRec.idle) {
                if (UserHandle.getAppId(uidRec.uid) == appId) {
                    if (userId == UserHandle.USER_ALL || userId == UserHandle.getUserId(uidRec.uid)) {
                        EventLogTags.writeAmUidIdle(uidRec.uid);
                        uidRec.idle = true;
                        Slog.w(TAG, "Idling uid " + UserHandle.formatUid(uidRec.uid) + " from package " + packageName + " user " + userId);
                        doStopUidLocked(uidRec.uid, uidRec);
                    }
                }
            }
        }
    }

private final void bumpServiceExecutingLocked(ServiceRecord r, boolean fg, String why) {
    long now = SystemClock.uptimeMillis();
    if (r.executeNesting == 0) {
        r.executeFg = fg;
        if (r.app != null) {
            r.app.executingServices.add(r);
            r.app.execServicesFg |= fg;
            if (r.app.executingServices.size() == 1) {
                scheduleServiceTimeoutLocked(r.app);
            }
        }
    } else if (r.app != null && fg && !r.app.execServicesFg) {
        r.app.execServicesFg = true;
        scheduleServiceTimeoutLocked(r.app);
    }
    r.executeFg |= fg;
    r.executeNesting++;
    r.executingStart = now;
}

void scheduleServiceTimeoutLocked(ProcessRecord proc) {
    Message msg = mAm.mHandler.obtainMessage(ActivityManagerService.SERVICE_TIMEOUT_MSG);
    msg.obj = proc;
    mAm.mHandler.sendMessageDelayed(msg, proc.execServicesFg ? SERVICE_TIMEOUT : SERVICE_BACKGROUND_TIMEOUT);
}

void serviceTimeout(ProcessRecord proc) {
    ......
    if (anrMessage != null) {
        mAm.mAppErrors.appNotResponding(proc, null, null, false, anrMessage);
    }
}