服务的注册

来源:互联网 时间:1970-01-01

Server获得了Service Manager远程接口之后,就要把自己的Service添加到Service Manager中去,然后把自己启动起来,等待Client的请求。本文将通过分析说明Server的启动过程是怎么样的。我们通过Android Binder实列篇中的实列来说明下服务启动的整个过程。
类的继承关系图:

从上图可以明显看出BnShareBuffer实际是继承了IShareBuffer和BBinder类。IShareBuffer和BBinder类又分别继承了IInterface和IBinder类,IInterface和IBinder类又同时继承了RefBase类。
实际上,BnShareBuffer并不是直接接收到Client处发送过来的请求,而是使用了IPCThreadState接收Client处发送过来的请求,而IPCThreadState又借助了ProcessState类来与Binder驱动程序交互。IPCThreadState接收到了Client处的请求后,就会调用BBinder类的transact函数,并传入相关参数,BBinder类的transact函数最终调用BnShareBuffer类的onTransact函数,于是,就开始真正地处理Client的请求了。
源码中通过:

SharedBufferService::instantiate();//add to the systemServerstatic void instantiate() { defaultServiceManager()->addService(String16(SHARED_BUFFER), new SharedBufferService()); }

前面分析过defaultServiceManager()是如何获取systemServices远程代理的。本文主要分析addService这个过程是如何一步一步在系统中添加服务的。
BpServiceManger::addService的实现在framworks/native/libs/binder/IServiceManager.cpp中。

class BpServiceManager : public BpInterface<IServiceManager>{public: BpServiceManager(const sp<IBinder>& impl) : BpInterface<IServiceManager>(impl) { } .... virtual status_t addService(const String16& name, const sp<IBinder>& service, bool allowIsolated) { Parcel data, reply; unsigned n; status_t err; /* *写入数据到parcel中,序列化数据 */ data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor()); data.writeString16(name); //写入一个binder引用 data.writeStrongBinder(service); data.writeInt32(allowIsolated ? 1 : 0); for (n = 1; n <= 5; n++) { err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply); if (err == -EPIPE) { ALOGI("%s is waiting for serviceManager... (retry %d)/n", String8(name).string(), n); sleep(1); } else { break; } } return err == NO_ERROR ? reply.readExceptionCode() : err; } ....};

下面我们看看data.writeStrongBinder(service); 这个是服务注册的关键之所在!

status_t Parcel::writeStrongBinder(const sp<IBinder>& val) { return flatten_binder(ProcessState::self(), val, this); }
status_t flatten_binder(const sp<ProcessState>& proc, const sp<IBinder>& binder, Parcel* out) { flat_binder_object obj; //内核中传输binder的结构 /* *0x7f表示处理本Binder实体请求数据包的线程的最低优先级,FLAT_BINDER_FLAG_ACCEPTS_FDS *表示这个Binder实体可以接受文件描述符,Binder实体在收到文件描述符时,就会在本进程中打开这个文件。 */ obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS; if (binder != NULL) { //binder为 新建立的SharedBufferService一定不为空 IBinder *local = binder->localBinder(); if (!local) { BpBinder *proxy = binder->remoteBinder(); if (proxy == NULL) { LOGE("null proxy"); } const int32_t handle = proxy ? proxy->handle() : 0; obj.type = BINDER_TYPE_HANDLE; obj.handle = handle; obj.cookie = NULL; } else { obj.type = BINDER_TYPE_BINDER; obj.binder = local->getWeakRefs(); obj.cookie = local; } } else { obj.type = BINDER_TYPE_BINDER; obj.binder = NULL; obj.cookie = NULL; } return finish_flatten_binder(binder, obj, out); //将binder写入Parcel中} 
inline static status_t finish_flatten_binder( const sp<IBinder>& binder, const flat_binder_object& flat, Parcel* out) { return out->writeObject(flat, false); //最终调用writeObject写入一个对像} 

接下来status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);
这里的remote成员函数来自于BpRefBase类,它返回一个BpBinder指针。

status_t BpBinder::transact( uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags) { // Once a binder has died, it will never come back to life. if (mAlive) { status_t status = IPCThreadState::self()->transact( mHandle, code, data, reply, flags); if (status == DEAD_OBJECT) mAlive = 0; return status; } return DEAD_OBJECT; } 

最终调用IPCThreadState::transact进执行实际的操作。这里的mHandle一定为0,因为这里表示的是Service Manager远程接口,它的句柄值一定是0,code为ADD_SERVICE_TRANSACTION。

status_t IPCThreadState::transact(int32_t handle, uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags) { status_t err = data.errorCheck(); flags |= TF_ACCEPT_FDS; IF_LOG_TRANSACTIONS() { TextOutput::Bundle _b(alog); alog << "BC_TRANSACTION thr " << (void*)pthread_self() << " / hand " << handle << " / code " << TypeCode(code) << ": " << indent << data << dedent << endl; } if (err == NO_ERROR) { LOG_ONEWAY(">>>> SEND from pid %d uid %d %s", getpid(), getuid(), (flags & TF_ONE_WAY) == 0 ? "READ REPLY" : "ONE WAY"); err = writeTransactionData(BC_TRANSACTION, flags, handle, code, data, NULL); } if (err != NO_ERROR) { if (reply) reply->setError(err); return (mLastError = err); } if ((flags & TF_ONE_WAY) == 0) { #if 0 if (code == 4) { // relayout LOGI(">>>>>> CALLING transaction 4"); } else { LOGI(">>>>>> CALLING transaction %d", code); } #endif if (reply) { err = waitForResponse(reply); } else { Parcel fakeReply; err = waitForResponse(&fakeReply); } #if 0 if (code == 4) { // relayout LOGI("<<<<<< RETURNING transaction 4"); } else { LOGI("<<<<<< RETURNING transaction %d", code); } #endif IF_LOG_TRANSACTIONS() { TextOutput::Bundle _b(alog); alog << "BR_REPLY thr " << (void*)pthread_self() << " / hand " << handle << ": "; if (reply) alog << indent << *reply << dedent << endl; else alog << "(none requested)" << endl; } } else { err = waitForResponse(NULL, NULL); } return err; } 

最终通过waitForResponse ==>talkWithDriver将注册信息写入驱动。最终会唤醒在等待数据的serviceManager线程,serviceManager线程接收到数据后,会对其进行解析并添加服务到管理的服务列表中!整个过程比较复杂,在老罗的博客中有较详细的讲述!
Android系统进程间通信(IPC)机制Binder中的Server启动过程源代码分析


相关阅读:
Top