Android Binder Mechanism (4) -- 如何使用已注册的系统Service

    上一篇文章中我们讨论了如何向系统注册Service。本篇文章我们将讨论如何使用这个已注册的系统Service。

    在本系列文章的第一篇中，客户端应用程序使用如下两条语句取得了ExampleService代理对象的引用。

]sp<IServiceManager> sm = defaultServiceManager();
binder = sm->getService(String16("byn.example"));

     第一句我们之前已经详细解释过了，全局函数defaultServiceManager()返回的是ServiceManager代理对象的引用。第二句话以ExampleService的方法名为参数调用getService()方法，返回的是ExampleService代理对象的引用。这个过程和上一篇文章介绍的addService的过程是非常类似的，这里就不详细展开了。

    客户应用程序获得了ExampleService代理对象的引用之后，通过如下语句调用服务：

]data.writeInt32(getpid());
data.writeInt32(n);
binder->transact(0, data, &reply);

    第一句话写入当前进程的进程ID，这里只是为了输出log用，没有实际意义；

    第二句话写入参数n；

    最后一句话调用ExampleService代理对象的transact方法发送请求。第一个参数0是请求代码(code)，如果一个服务提供了多个API接口，那么服务器端就通过这个参数区分调用的是哪一个API；第二个参数打包后的调用参数；最后一个参数保存返回值。因为ExampleService代理对象继承自BpBinder，所以这里调用的是BpBinder::transact()方法，进而调用IPCThreadState::transact()方法。这个过程在上一篇文章中已经介绍过。

    现在我们重点剖析一下服务器端的情况。

    服务器端在向系统注册服务之后，首先调用ProcessState::self()->startThreadPool()方法启动一个线程池；然后调用IPCThreadState::self()->joinThreadPool()方法进入一个无限循环，等待其它进程的服务请求。我们看一下joinThreadPool方法的源代码：

]// File: frameworks/base/libs/binder/IPCThreadState.cpp
void IPCThreadState::joinThreadPool(bool isMain)
{
LOG_THREADPOOL("**** THREAD %p (PID %d) IS JOINING THE THREAD POOL/n", (void*)pthread_self(), getpid());

mOut.writeInt32(isMain ? BC_ENTER_LOOPER : BC_REGISTER_LOOPER);

status_t result;
do {
int32_t cmd;

// When we've cleared the incoming command queue, process any pending derefs
if (mIn.dataPosition() >= mIn.dataSize()) {
size_t numPending = mPendingWeakDerefs.size();
if (numPending > 0) {
for (size_t i = 0; i < numPending; i++) {
RefBase::weakref_type* refs = mPendingWeakDerefs[i];
refs->decWeak(mProcess.get());
}
mPendingWeakDerefs.clear();
}

numPending = mPendingStrongDerefs.size();
if (numPending > 0) {
for (size_t i = 0; i < numPending; i++) {
BBinder* obj = mPendingStrongDerefs[i];
obj->decStrong(mProcess.get());
}
mPendingStrongDerefs.clear();
}
}

// now get the next command to be processed, waiting if necessary
result = talkWithDriver();
if (result >= NO_ERROR) {
size_t IN = mIn.dataAvail();
if (IN < sizeof(int32_t)) continue;
cmd = mIn.readInt32();
IF_LOG_COMMANDS() {
alog << "Processing top-level Command: "
<< getReturnString(cmd) << endl;
}

result = executeCommand(cmd);
}

// After executing the command, ensure that the thread is returned to the
// default cgroup and priority before rejoining the pool.  This is a failsafe
// in case the command implementation failed to properly restore the thread's
// scheduling parameters upon completion.
int my_id;
#ifdef HAVE_GETTID
my_id = gettid();
#else
my_id = getpid();
#endif
if (!set_sched_policy(my_id, SP_FOREGROUND)) {
// success; reset the priority as well
setpriority(PRIO_PROCESS, my_id, ANDROID_PRIORITY_NORMAL);
}

// Let this thread exit the thread pool if it is no longer
// needed and it is not the main process thread.
if(result == TIMED_OUT && !isMain) {
break;
}
} while (result != -ECONNREFUSED && result != -EBADF);

LOG_THREADPOOL("**** THREAD %p (PID %d) IS LEAVING THE THREAD POOL err=%p/n",
(void*)pthread_self(), getpid(), (void*)result);

mOut.writeInt32(BC_EXIT_LOOPER);
talkWithDriver(false);
}

    在joinThreadPool()方法中，通过调用talkWithDriver方法与binder设备进行通信，通常Service进程会阻塞在这里；一旦客户请求到来，该方法返回，并调用后面的executeCommand()方法进行处理。我们看一下executeCommand()方法的源代码：

]// File: frameworks/base/libs/binder/IPCThreadState.cpp
status_t IPCThreadState::executeCommand(int32_t cmd)
{
BBinder* obj;
RefBase::weakref_type* refs;
status_t result = NO_ERROR;

switch (cmd) {
case BR_ERROR:
result = mIn.readInt32();
break;

case BR_OK:
break;

case BR_ACQUIRE:
refs = (RefBase::weakref_type*)mIn.readInt32();
obj = (BBinder*)mIn.readInt32();
LOG_ASSERT(refs->refBase() == obj,
"BR_ACQUIRE: object %p does not match cookie %p (expected %p)",
refs, obj, refs->refBase());
obj->incStrong(mProcess.get());
IF_LOG_REMOTEREFS() {
LOG_REMOTEREFS("BR_ACQUIRE from driver on %p", obj);
obj->printRefs();
}
mOut.writeInt32(BC_ACQUIRE_DONE);
mOut.writeInt32((int32_t)refs);
mOut.writeInt32((int32_t)obj);
break;

case BR_RELEASE:
refs = (RefBase::weakref_type*)mIn.readInt32();
obj = (BBinder*)mIn.readInt32();
LOG_ASSERT(refs->refBase() == obj,
"BR_RELEASE: object %p does not match cookie %p (expected %p)",
refs, obj, refs->refBase());
IF_LOG_REMOTEREFS() {
LOG_REMOTEREFS("BR_RELEASE from driver on %p", obj);
obj->printRefs();
}
mPendingStrongDerefs.push(obj);
break;

case BR_INCREFS:
refs = (RefBase::weakref_type*)mIn.readInt32();
obj = (BBinder*)mIn.readInt32();
refs->incWeak(mProcess.get());
mOut.writeInt32(BC_INCREFS_DONE);
mOut.writeInt32((int32_t)refs);
mOut.writeInt32((int32_t)obj);
break;

case BR_DECREFS:
refs = (RefBase::weakref_type*)mIn.readInt32();
obj = (BBinder*)mIn.readInt32();
// NOTE: This assertion is not valid, because the object may no
// longer exist (thus the (BBinder*)cast above resulting in a different
// memory address).
//LOG_ASSERT(refs->refBase() == obj,
//           "BR_DECREFS: object %p does not match cookie %p (expected %p)",
//           refs, obj, refs->refBase());
mPendingWeakDerefs.push(refs);
break;

case BR_ATTEMPT_ACQUIRE:
refs = (RefBase::weakref_type*)mIn.readInt32();
obj = (BBinder*)mIn.readInt32();

{
const bool success = refs->attemptIncStrong(mProcess.get());
LOG_ASSERT(success && refs->refBase() == obj,
"BR_ATTEMPT_ACQUIRE: object %p does not match cookie %p (expected %p)",
refs, obj, refs->refBase());

mOut.writeInt32(BC_ACQUIRE_RESULT);
mOut.writeInt32((int32_t)success);
}
break;

case BR_TRANSACTION:
{
binder_transaction_data tr;
result = mIn.read(&tr, sizeof(tr));
LOG_ASSERT(result == NO_ERROR,
"Not enough command data for brTRANSACTION");
if (result != NO_ERROR) break;

Parcel buffer;
buffer.ipcSetDataReference(
reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
tr.data_size,
reinterpret_cast<const size_t*>(tr.data.ptr.offsets),
tr.offsets_size/sizeof(size_t), freeBuffer, this);

const pid_t origPid = mCallingPid;
const uid_t origUid = mCallingUid;

mCallingPid = tr.sender_pid;
mCallingUid = tr.sender_euid;

//LOGI(">>>> TRANSACT from pid %d uid %d/n", mCallingPid, mCallingUid);

Parcel reply;
IF_LOG_TRANSACTIONS() {
TextOutput::Bundle _b(alog);
alog << "BR_TRANSACTION thr " << (void*)pthread_self()
<< " / obj " << tr.target.ptr << " / code "
<< TypeCode(tr.code) << ": " << indent << buffer
<< dedent << endl
<< "Data addr = "
<< reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer)
<< ", offsets addr="
<< reinterpret_cast<const size_t*>(tr.data.ptr.offsets) << endl;
}
if (tr.target.ptr) {
sp<BBinder> b((BBinder*)tr.cookie);
const status_t error = b->transact(tr.code, buffer, &reply, 0);
if (error < NO_ERROR) reply.setError(error);

} else {
const status_t error = the_context_object->transact(tr.code, buffer, &reply, 0);
if (error < NO_ERROR) reply.setError(error);
}

//LOGI("<<<< TRANSACT from pid %d restore pid %d uid %d/n",
//     mCallingPid, origPid, origUid);

if ((tr.flags & TF_ONE_WAY) == 0) {
LOG_ONEWAY("Sending reply to %d!", mCallingPid);
sendReply(reply, 0);
} else {
LOG_ONEWAY("NOT sending reply to %d!", mCallingPid);
}

mCallingPid = origPid;
mCallingUid = origUid;

IF_LOG_TRANSACTIONS() {
TextOutput::Bundle _b(alog);
alog << "BC_REPLY thr " << (void*)pthread_self() << " / obj "
<< tr.target.ptr << ": " << indent << reply << dedent << endl;
}

}
break;

case BR_DEAD_BINDER:
{
BpBinder *proxy = (BpBinder*)mIn.readInt32();
proxy->sendObituary();
mOut.writeInt32(BC_DEAD_BINDER_DONE);
mOut.writeInt32((int32_t)proxy);
} break;

case BR_CLEAR_DEATH_NOTIFICATION_DONE:
{
BpBinder *proxy = (BpBinder*)mIn.readInt32();
proxy->getWeakRefs()->decWeak(proxy);
} break;

case BR_FINISHED:
result = TIMED_OUT;
break;

case BR_NOOP:
break;

case BR_SPAWN_LOOPER:
mProcess->spawnPooledThread(false);
break;

default:
printf("*** BAD COMMAND %d received from Binder driver/n", cmd);
result = UNKNOWN_ERROR;
break;
}

if (result != NO_ERROR) {
mLastError = result;
}

return result;
}

    这里，函数会根据一系列枚举值作相应的处理。在binder协议中：

    BR_XXX等宏为BinderDriverReturnProtocol，表示Binder驱动返回协议。
    BC_XXX等宏为BinderDriverCommandProtocol，表示Binder驱动命令协议。

    因为这里是收到命令请求后要做相应的处理，所以这里的宏都是以BR开头的。这里会走到BR_TRANSACTION这个分支，调用BBinder的transact()方法做处理(b->transact(tr.code, buffer, &reply, 0))。我们看一下BBinder::transact()方法的源代码：

]// File: frameworks/base/libs/binder/binder.cpp
status_t BBinder::transact(
uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
data.setDataPosition(0);

status_t err = NO_ERROR;
switch (code) {
case PING_TRANSACTION:
reply->writeInt32(pingBinder());
break;
default:
err = onTransact(code, data, reply, flags);
break;
}

if (reply != NULL) {
reply->setDataPosition(0);
}

return err;
}

我们看到调用的是虚函数onTransact()。因为ExampleService类继承自BBinder类，并改写了onTransact()方法，所以这里会调用到ExampleService::onTransact()方法。

]    status_t ExampleService::onTransact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
switch(code)
{
case 0: {
pid_t pid = data.readInt32();
int num   = data.readInt32();
num = num + 100;
reply->writeInt32(num);
return NO_ERROR;
}
break;
default:
return BBinder::onTransact(code, data, reply, flags);
}
}

    看到这里首先根据请求代码作相应的处理。还记得我们发送请求时用的是代码0，所以这里会走到"case0"这个分支。程序先顺序读出两个参数：进程ID和被加数，将被加数加上100之后返回。至此，服务器端完成了客户端的服务请求。

    我们将总共四篇文章涉及到的主要类用下面的类图作一总结：



说明：

1. Android系统使用binder机制实现进程间通信(IPC)，这里主要涉及到以下几个类：

    1.1 IBinder是Android系统对binder机制的抽象，任何一个向系统注册的Service都必须继承IBinder接口(如：ExampleService继承BBinder，而BBinder继承IBinder)

    1.2 IInterface我们在这一系列文章里没有过多涉及。它的目的是进一步抽象binder机制。比如要使用我们的ExampleService，客户端应用程序必须显式调用IPCThreadState::transaction()方法，对用户来说还是不太友好。如果我们定义一个新的类IExampleServiceInterface继承Interface，在这个类中定义add100()接口，ExampleService的代理对象也拥有该接口，那么客户端应用程序直接调用代理对象的add100()方法就好了，这样做对用户更友好。比如ServiceManager就是这样实现的(IServiceManager继承IInterface)。客户端调用的是addService接口而不是transaction方法。

    1.3 ProcessState类是一个singleton类型，每个进程只能创建一个实例，它的作用是管理当前进程中的所有Service代理对象(BpBinder对象)。任何一个使用binder机制的进程都必须创建一个该类的实例。

    1.4 IPCThreadState类是processState类的友元类，它的作用是封装对binder设备的I/O操作。客户端通过调用它的transact()方法完成发送请求；服务器端调用他的joinThreadState()方法等待客户端的服务请求。

2. Android的binder机制本质上是Proxy模式的一个具体实现。

3. ServiceManager是整个Android系统的Service管理员，任何一个系统Service首先要向它注册才能提供服务。注册时，首先要获得它的代理对象(BpServiceManager)，然后通过调用它的addService()方法完成注册。客户端通过调用它的getService()获取系统服务的代理兑现。ServiceManager在系统中始终对应句柄0。

4. 客户端通过调用IPCThreadState的transaction方法发送请求；服务器端通过改写BBinder的onTransaction()方法实现接受请求。

 

(全文完)