frameworks/base/core/java/android/content/ContextWrapper.java
 public boolean bindService(Intent service, ServiceConnection conn,
              int flags) {
          return mBase.bindService(service, conn, flags);
      }

private boolean bindServiceCommon(Intent service, ServiceConnection conn, int flags,...

        IBinder token = getActivityToken();
        if (token == null && (flags&BIND_AUTO_CREATE) == 0 && mPackageInfo != null
                && mPackageInfo.getApplicationInfo().targetSdkVersion
                < android.os.Build.VERSION_CODES.ICE_CREAM_SANDWICH) {
            flags |= BIND_WAIVE_PRIORITY;
        }
        service.prepareToLeaveProcess(this);
        int res = ActivityManager.getService().bindIsolatedService(
            mMainThread.getApplicationThread(), getActivityToken(), service,
            service.resolveTypeIfNeeded(getContentResolver()),
            sd, flags, instanceName, getOpPackageName(), user.getIdentifier());

/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
      public int bindIsolatedService(IApplicationThread caller, IBinder token, Intent service,...

             return mServices.bindServiceLocked(caller, token, service,
                     resolvedType, connection, flags, instanceName, callingPackage, userId);

/frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
  int bindServiceLocked(IApplicationThread caller, IBinder token, Intent service,...

//启动service

 bringUpServiceLocked(serviceRecord,...

 final Intent intent = new Intent(Intent.ACTION_REVIEW_PERMISSIONS);

mAm.mContext.startActivityAsUser(intent, new UserHandle(userId));

c.conn.connected(s.name, b.intent.binder, false);

requestServiceBindingLocked(s, b.intent, callerFg, false); //第一次绑定

private final boolean requestServiceBindingLocked(ServiceRecord r, IntentBindRecord i,...

 r.app.thread.scheduleBindService(r, i.intent.getIntent(), rebind,...

/frameworks/base/core/java/android/app/ActivityThread.java
 sendMessage(H.BIND_SERVICE, s)

 public void handleMessage(Message msg) {
  case BIND_SERVICE:
    Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "serviceBind");
    handleBindService((BindServiceData)msg.obj);
    Trace.traceEnd(Trace.TRACE_TAG_ACTIVITY_MANAGER);

private void handleBindService(BindServiceData data) {
 Service s = mServices.get(data.token);
 if (DEBUG_SERVICE)
     Slog.v(TAG, "handleBindService s=" + s + " rebind=" + data.rebind);
 if (s != null) {
     try {
         data.intent.setExtrasClassLoader(s.getClassLoader());
         data.intent.prepareToEnterProcess();
         try {
             if (!data.rebind) {
                 IBinder binder = s.onBind(data.intent);  
                 ActivityManager.getService().publishService(
                         data.token, data.intent, binder);
             } else {
                 s.onRebind(data.intent);
                 ActivityManager.getService().serviceDoneExecuting(
                         data.token, SERVICE_DONE_EXECUTING_ANON, 0, 0);
             }

/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
  public void publishService(IBinder token, Intent intent, IBinder service) {

mServices.publishServiceLocked((ServiceRecord)token, intent, service);

 /frameworks/base/services/core/java/com/android/server/am/ActiveServices.java
  void publishServiceLocked(ServiceRecord r, Intent intent, IBinder service)
    c.conn.connected(r.name, service, false);

 /frameworks/base/core/java/android/app/IServiceConnection.aidl
  oneway interface IServiceConnection {
     @UnsupportedAppUsage
     void connected(in ComponentName name, IBinder service, boolean dead);
 }

 /frameworks/base/core/java/android/app/LoadedApk.java
 static final class ServiceDispatcher {
         private final ServiceDispatcher.InnerConnection mIServiceConnection;
         @UnsupportedAppUsage
         private final ServiceConnection mConnection;

             public void connected(ComponentName name, IBinder service, boolean dead)
                     throws RemoteException {
                 LoadedApk.ServiceDispatcher sd = mDispatcher.get();
                 if (sd != null) {
                     sd.connected(name, service, dead);
                 }
             }
         }
 

public void connected(ComponentName name, IBinder service, boolean dead) {
          if (mActivityExecutor != null) {
              mActivityExecutor.execute(new RunConnection(name, service, 0, dead));
          } else if (mActivityThread != null) {
              mActivityThread.post(new RunConnection(name, service, 0, dead));
          } else {
              doConnected(name, service, dead);
          }
      }

 public void doConnected(ComponentName name, IBinder service, boolean dead) {
  // If there is a new viable service, it is now connected.
        if (service != null) {
            mConnection.onServiceConnected(name, service);
        } else {
            // The binding machinery worked, but the remote returned null from onBind().
            mConnection.onNullBinding(name);
        }
    }

startService bindService区别

startService
onCreate onStartCommand
多次调用startService，onCreate仅一次，onStartCommand多次

stopService
onDestroy

bindService
onCreate   onBind
多次调用bindService， onCreate   onBind仅一次

unBindService
onUnbind

参考

https://blog.csdn.net/qq_23452385/article/details/125867400

（4） Android中Binder调用流程 --- bindService的Binder流程介绍_会说话的小鱼的博客-CSDN博客