Service代理对象的获取过程

Service 组件将自己注册到 ServiceManager 后,就在 Server 进程中等待 Client 进程发送进程间通信数据.Client 进程要和 Service 组件通信,需要首先获取一个代理对象,这是通过 ServiceManager 提供的 Service 组件查询服务来实现的.

//#define LOG_NDEBUG 0
#define LOG_TAG "FregClient"
#include <utils/Log.h>

#include <utils/Log.h>
#include <utils/RefBase.h>
#include <binder/IServiceManager.h>

#include "../common/IFregService.h"

using namespace android;

int main()
{
   sp<IBinder> binder = defaultServiceManager()->getService(String16(FREG_SERVICE));
   if (binder == NULL) {
       printf("%s: Failed to get freg service: %s.\n", __func__, FREG_SERVICE);
       return -1;
   }

   sp<IFregService> service = IFregService::asInterface(binder);
   if (service == NULL) {
       ALOGE("Failed to get freg service interface.");
       return -1;
   }

   printf("Read original value from FregService:\n");

   int32_t val = service->getVal();
   printf(" %d .\n", val);

   printf("Add value 1 to FregService.");

   val +=1 ;

   service->setVal(val);

   printf("Read the value from FregService anain:\n");

   val = service->getVal();

   printf(" %d .\n", val);

   return 0;
}

getService

defaultServiceManager() 已经分析过,拿到的是 BpBinder -> BpServiceManager -> IServiceManager.

class BpServiceManager : public BpInterface<IServiceManager>
{
public:
    explicit BpServiceManager(const sp<IBinder>& impl)
        : BpInterface<IServiceManager>(impl)
    {
    }

    virtual sp<IBinder> getService(const String16& name) const
    {
        unsigned n;
        for (n = 0; n < 5; n++){
            if (n > 0) {
                if (!strcmp(ProcessState::self()->getDriverName().c_str(), "/dev/vndbinder")) {
                    ALOGI("Waiting for vendor service %s...", String8(name).string());
                    CallStack stack(LOG_TAG);
                } else {
                    ALOGI("Waiting for service %s...", String8(name).string());
                }
                sleep(1);
            }
            sp<IBinder> svc = checkService(name);
            if (svc != NULL) return svc;
        }
        return NULL;
    }

    virtual sp<IBinder> checkService( const String16& name) const
    {
        Parcel data, reply;
        data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
        data.writeString16(name);
        remote()->transact(CHECK_SERVICE_TRANSACTION, data, &reply);
        return reply.readStrongBinder();
    }

    virtual status_t addService(const String16& name, const sp<IBinder>& service,
            bool allowIsolated)
    {
        Parcel data, reply;
        data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
        data.writeString16(name);
        data.writeStrongBinder(service);
        data.writeInt32(allowIsolated ? 1 : 0);
        status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);
        return err == NO_ERROR ? reply.readExceptionCode() : err;
    }

    virtual Vector<String16> listServices()
    {
        Vector<String16> res;
        int n = 0;

        for (;;) {
            Parcel data, reply;
            data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
            data.writeInt32(n++);
            status_t err = remote()->transact(LIST_SERVICES_TRANSACTION, data, &reply);
            if (err != NO_ERROR)
                break;
            res.add(reply.readString16());
        }
        return res;
    }
};

• FregClient 进程将通信数据,即要获取的代理对象的 Service 组件 FregService 的名称封装到 Parcel 中,用来传递给 Binder Dirver.
• FregClient 向 Driver 发送 BC_TRANSACTION 命令,Drver 根据协议内容找到 ServiceManager 后,向 FregClient 发送 BR_TRANSACTION_COMPLETE,表示进程间通信请求已经被接受.FregClient收到Driver发送给的 BR_TRANSACTION_COMPLETE 后,对它进行处理,然后再次进入到Driver中等待 ServiceManager 将它要获取的 Binder 代理对象的句柄值返回来.
• Driver 在向 Client 发送 BR_TRANSACTION_COMPLETE 的同时,也会想 ServiceManager 发送 BR_TRANSACTION ,请求执行 CHECK_SERVICE_TRANSACTION 操作.
• ServiceManager 执行完 Client 的 CHECK_SERVICE_TRANSACTION 操作之后,就会向 Driver 发送一个 BC_REPLY ,该协议内容包含了 Service 组件 FregService 的信息.Driver 根据协议内容中的 Service 组件 FregService 信息为 FregClient 创建一个 binder_ref,接着会向 ServiceManager 发送 BR_TRANSACTION_COMPLETE,表示 Service 组件FregService已经找到.ServiceManager接收到 Driver 发送的 BR_TRANSACTION_COMPLETE 后对它进行处理之后,一次进程间通信就结束了,接着会进入下一次进程间通信请求.
• Driver 在向 ServiceManager 发送 BR_TRANSACTION_COMPLETE 的同时,也会向 Client 发送 BR_REPLY 返回协议,协议内容包含了 binder_ref 的句柄值,这时 Client 就通过句柄值来创建一个 BpBinder.