Android Binder Mechanism (4) -- 如何使用已注册的系统Service

    上一篇文章中我们讨论了如何向系统注册Service。本篇文章我们将讨论如何使用这个已注册的系统Service。

    在本系列文章的第一篇中，客户端应用程序使用如下两条语句取得了ExampleService代理对象的引用。

sp<IServiceManager> sm = defaultServiceManager(); binder = sm->getService(String16("byn.example"));

     第一句我们之前已经详细解释过了，全局函数defaultServiceManager()返回的是ServiceManager代理对象的引用。第二句话以ExampleService的方法名为参数调用getService()方法，返回的是ExampleService代理对象的引用。这个过程和上一篇文章介绍的addService的过程是非常类似的，这里就不详细展开了。

    客户应用程序获得了ExampleService代理对象的引用之后，通过如下语句调用服务：

data.writeInt32(getpid()); data.writeInt32(n); binder->transact(0, data, &reply);

    第一句话写入当前进程的进程ID，这里只是为了输出log用，没有实际意义；

    第二句话写入参数n；

    最后一句话调用ExampleService代理对象的transact方法发送请求。第一个参数0是请求代码(code)，如果一个服务提供了多个API接口，那么服务器端就通过这个参数区分调用的是哪一个API；第二个参数打包后的调用参数；最后一个参数保存返回值。因为ExampleService代理对象继承自BpBinder，所以这里调用的是BpBinder::transact()方法，进而调用IPCThreadState::transact()方法。这个过程在上一篇文章中已经介绍过。

    现在我们重点剖析一下服务器端的情况。

    服务器端在向系统注册服务之后，首先调用ProcessState::self()->startThreadPool()方法启动一个线程池；然后调用IPCThreadState::self()->joinThreadPool()方法进入一个无限循环，等待其它进程的服务请求。我们看一下joinThreadPool方法的源代码：

// File: frameworks/base/libs/binder/IPCThreadState.cpp void IPCThreadState::joinThreadPool(bool isMain) { LOG_THREADPOOL("**** THREAD %p (PID %d) IS JOINING THE THREAD POOL/n", (void*)pthread_self(), getpid()); mOut.writeInt32(isMain ? BC_ENTER_LOOPER : BC_REGISTER_LOOPER); status_t result; do { int32_t cmd; // When we've cleared the incoming command queue, process any pending derefs if (mIn.dataPosition() >= mIn.dataSize()) { size_t numPending = mPendingWeakDerefs.size(); if (numPending > 0) { for (size_t i = 0; i < numPending; i++) { RefBase::weakref_type* refs = mPendingWeakDerefs[i]; refs->decWeak(mProcess.get()); } mPendingWeakDerefs.clear(); } numPending = mPendingStrongDerefs.size(); if (numPending > 0) { for (size_t i = 0; i < numPending; i++) { BBinder* obj = mPendingStrongDerefs[i]; obj->decStrong(mProcess.get()); } mPendingStrongDerefs.clear(); } } // now get the next command to be processed, waiting if necessary result = talkWithDriver(); if (result >= NO_ERROR) { size_t IN = mIn.dataAvail(); if (IN < sizeof(int32_t)) continue; cmd = mIn.readInt32(); IF_LOG_COMMANDS() { alog << "Processing top-level Command: " << getReturnString(cmd) << endl; } result = executeCommand(cmd); } // After executing the command, ensure that the thread is returned to the // default cgroup and priority before rejoining the pool. This is a failsafe // in case the command implementation failed to properly restore the thread's // scheduling parameters upon completion. int my_id; #ifdef HAVE_GETTID my_id = gettid(); #else my_id = getpid(); #endif if (!set_sched_policy(my_id, SP_FOREGROUND)) { // success; reset the priority as well setpriority(PRIO_PROCESS, my_id, ANDROID_PRIORITY_NORMAL); } // Let this thread exit the thread pool if it is no longer // needed and it is not the main process thread. if(result == TIMED_OUT && !isMain) { break; } } while (result != -ECONNREFUSED && result != -EBADF); LOG_THREADPOOL("**** THREAD %p (PID %d) IS LEAVING THE THREAD POOL err=%p/n", (void*)pthread_self(), getpid(), (void*)result); mOut.writeInt32(BC_EXIT_LOOPER); talkWithDriver(false); }

    在joinThreadPool()方法中，通过调用talkWithDriver方法与binder设备进行通信，通常Service进程会阻塞在这里；一旦客户请求到来，该方法返回，并调用后面的executeCommand()方法进行处理。我们看一下executeCommand()方法的源代码：

// File: frameworks/base/libs/binder/IPCThreadState.cpp status_t IPCThreadState::executeCommand(int32_t cmd) { BBinder* obj; RefBase::weakref_type* refs; status_t result = NO_ERROR; switch (cmd) { case BR_ERROR: result = mIn.readInt32(); break; case BR_OK: break; case BR_ACQUIRE: refs = (RefBase::weakref_type*)mIn.readInt32(); obj = (BBinder*)mIn.readInt32(); LOG_ASSERT(refs->refBase() == obj, "BR_ACQUIRE: object %p does not match cookie %p (expected %p)", refs, obj, refs->refBase()); obj->incStrong(mProcess.get()); IF_LOG_REMOTEREFS() { LOG_REMOTEREFS("BR_ACQUIRE from driver on %p", obj); obj->printRefs(); } mOut.writeInt32(BC_ACQUIRE_DONE); mOut.writeInt32((int32_t)refs); mOut.writeInt32((int32_t)obj); break; case BR_RELEASE: refs = (RefBase::weakref_type*)mIn.readInt32(); obj = (BBinder*)mIn.readInt32(); LOG_ASSERT(refs->refBase() == obj, "BR_RELEASE: object %p does not match cookie %p (expected %p)", refs, obj, refs->refBase()); IF_LOG_REMOTEREFS() { LOG_REMOTEREFS("BR_RELEASE from driver on %p", obj); obj->printRefs(); } mPendingStrongDerefs.push(obj); break; case BR_INCREFS: refs = (RefBase::weakref_type*)mIn.readInt32(); obj = (BBinder*)mIn.readInt32(); refs->incWeak(mProcess.get()); mOut.writeInt32(BC_INCREFS_DONE); mOut.writeInt32((int32_t)refs); mOut.writeInt32((int32_t)obj); break; case BR_DECREFS: refs = (RefBase::weakref_type*)mIn.readInt32(); obj = (BBinder*)mIn.readInt32(); // NOTE: This assertion is not valid, because the object may no // longer exist (thus the (BBinder*)cast above resulting in a different // memory address). //LOG_ASSERT(refs->refBase() == obj, // "BR_DECREFS: object %p does not match cookie %p (expected %p)", // refs, obj, refs->refBase()); mPendingWeakDerefs.push(refs); break; case BR_ATTEMPT_ACQUIRE: refs = (RefBase::weakref_type*)mIn.readInt32(); obj = (BBinder*)mIn.readInt32(); { const bool success = refs->attemptIncStrong(mProcess.get()); LOG_ASSERT(success && refs->refBase() == obj, "BR_ATTEMPT_ACQUIRE: object %p does not match cookie %p (expected %p)", refs, obj, refs->refBase()); mOut.writeInt32(BC_ACQUIRE_RESULT); mOut.writeInt32((int32_t)success); } break; case BR_TRANSACTION: { binder_transaction_data tr; result = mIn.read(&tr, sizeof(tr)); LOG_ASSERT(result == NO_ERROR, "Not enough command data for brTRANSACTION"); if (result != NO_ERROR) break; Parcel buffer; buffer.ipcSetDataReference( reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer), tr.data_size, reinterpret_cast<const size_t*>(tr.data.ptr.offsets), tr.offsets_size/sizeof(size_t), freeBuffer, this); const pid_t origPid = mCallingPid; const uid_t origUid = mCallingUid; mCallingPid = tr.sender_pid; mCallingUid = tr.sender_euid; //LOGI(">>>> TRANSACT from pid %d uid %d/n", mCallingPid, mCallingUid); Parcel reply; IF_LOG_TRANSACTIONS() { TextOutput::Bundle _b(alog); alog << "BR_TRANSACTION thr " << (void*)pthread_self() << " / obj " << tr.target.ptr << " / code " << TypeCode(tr.code) << ": " << indent << buffer << dedent << endl << "Data addr = " << reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer) << ", offsets addr=" << reinterpret_cast<const size_t*>(tr.data.ptr.offsets) << endl; } if (tr.target.ptr) { sp<BBinder> b((BBinder*)tr.cookie); const status_t error = b->transact(tr.code, buffer, &reply, 0); if (error < NO_ERROR) reply.setError(error); } else { const status_t error = the_context_object->transact(tr.code, buffer, &reply, 0); if (error < NO_ERROR) reply.setError(error); } //LOGI("<<<< TRANSACT from pid %d restore pid %d uid %d/n", // mCallingPid, origPid, origUid); if ((tr.flags & TF_ONE_WAY) == 0) { LOG_ONEWAY("Sending reply to %d!", mCallingPid); sendReply(reply, 0); } else { LOG_ONEWAY("NOT sending reply to %d!", mCallingPid); } mCallingPid = origPid; mCallingUid = origUid; IF_LOG_TRANSACTIONS() { TextOutput::Bundle _b(alog); alog << "BC_REPLY thr " << (void*)pthread_self() << " / obj " << tr.target.ptr << ": " << indent << reply << dedent << endl; } } break; case BR_DEAD_BINDER: { BpBinder *proxy = (BpBinder*)mIn.readInt32(); proxy->sendObituary(); mOut.writeInt32(BC_DEAD_BINDER_DONE); mOut.writeInt32((int32_t)proxy); } break; case BR_CLEAR_DEATH_NOTIFICATION_DONE: { BpBinder *proxy = (BpBinder*)mIn.readInt32(); proxy->getWeakRefs()->decWeak(proxy); } break; case BR_FINISHED: result = TIMED_OUT; break; case BR_NOOP: break; case BR_SPAWN_LOOPER: mProcess->spawnPooledThread(false); break; default: printf("*** BAD COMMAND %d received from Binder driver/n", cmd); result = UNKNOWN_ERROR; break; } if (result != NO_ERROR) { mLastError = result; } return result; }

    这里，函数会根据一系列枚举值作相应的处理。在binder协议中：

    BR_XXX等宏为BinderDriverReturnProtocol，表示Binder驱动返回协议。
    BC_XXX等宏为BinderDriverCommandProtocol，表示Binder驱动命令协议。

    因为这里是收到命令请求后要做相应的处理，所以这里的宏都是以BR开头的。这里会走到BR_TRANSACTION这个分支，调用BBinder的transact()方法做处理(b->transact(tr.code, buffer, &reply, 0))。我们看一下BBinder::transact()方法的源代码：

// File: frameworks/base/libs/binder/binder.cpp status_t BBinder::transact( uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags) { data.setDataPosition(0); status_t err = NO_ERROR; switch (code) { case PING_TRANSACTION: reply->writeInt32(pingBinder()); break; default: err = onTransact(code, data, reply, flags); break; } if (reply != NULL) { reply->setDataPosition(0); } return err; }

我们看到调用的是虚函数onTransact()。因为ExampleService类继承自BBinder类，并改写了onTransact()方法，所以这里会调用到ExampleService::onTransact()方法。

status_t ExampleService::onTransact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags) { switch(code) { case 0: { pid_t pid = data.readInt32(); int num = data.readInt32(); num = num + 100; reply->writeInt32(num); return NO_ERROR; } break; default: return BBinder::onTransact(code, data, reply, flags); } }

    看到这里首先根据请求代码作相应的处理。还记得我们发送请求时用的是代码0，所以这里会走到"case0"这个分支。程序先顺序读出两个参数：进程ID和被加数，将被加数加上100之后返回。至此，服务器端完成了客户端的服务请求。

    我们将总共四篇文章涉及到的主要类用下面的类图作一总结：

说明：

1. Android系统使用binder机制实现进程间通信(IPC)，这里主要涉及到以下几个类：

    1.1 IBinder是Android系统对binder机制的抽象，任何一个向系统注册的Service都必须继承IBinder接口(如：ExampleService继承BBinder，而BBinder继承IBinder)

    1.2 IInterface我们在这一系列文章里没有过多涉及。它的目的是进一步抽象binder机制。比如要使用我们的ExampleService，客户端应用程序必须显式调用IPCThreadState::transaction()方法，对用户来说还是不太友好。如果我们定义一个新的类IExampleServiceInterface继承Interface，在这个类中定义add100()接口，ExampleService的代理对象也拥有该接口，那么客户端应用程序直接调用代理对象的add100()方法就好了，这样做对用户更友好。比如ServiceManager就是这样实现的(IServiceManager继承IInterface)。客户端调用的是addService接口而不是transaction方法。

    1.3 ProcessState类是一个singleton类型，每个进程只能创建一个实例，它的作用是管理当前进程中的所有Service代理对象(BpBinder对象)。任何一个使用binder机制的进程都必须创建一个该类的实例。

    1.4 IPCThreadState类是processState类的友元类，它的作用是封装对binder设备的I/O操作。客户端通过调用它的transact()方法完成发送请求；服务器端调用他的joinThreadState()方法等待客户端的服务请求。

2. Android的binder机制本质上是Proxy模式的一个具体实现。

3. ServiceManager是整个Android系统的Service管理员，任何一个系统Service首先要向它注册才能提供服务。注册时，首先要获得它的代理对象(BpServiceManager)，然后通过调用它的addService()方法完成注册。客户端通过调用它的getService()获取系统服务的代理兑现。ServiceManager在系统中始终对应句柄0。

4. 客户端通过调用IPCThreadState的transaction方法发送请求；服务器端通过改写BBinder的onTransaction()方法实现接受请求。

 

(全文完)