Service 组件将自己注册到 ServiceManager 后,就在 Server 进程中等待 Client 进程发送进程间通信数据.Client 进程要和 Service 组件通信,需要首先获取一个代理对象,这是通过 ServiceManager 提供的 Service 组件查询服务来实现的.
//#define LOG_NDEBUG 0
#define LOG_TAG "FregClient"
#include <utils/Log.h>
#include <utils/Log.h>
#include <utils/RefBase.h>
#include <binder/IServiceManager.h>
#include "../common/IFregService.h"
using namespace android;
int main()
{
sp<IBinder> binder = defaultServiceManager()->getService(String16(FREG_SERVICE));
if (binder == NULL) {
printf("%s: Failed to get freg service: %s.\n", __func__, FREG_SERVICE);
return -1;
}
sp<IFregService> service = IFregService::asInterface(binder);
if (service == NULL) {
ALOGE("Failed to get freg service interface.");
return -1;
}
printf("Read original value from FregService:\n");
int32_t val = service->getVal();
printf(" %d .\n", val);
printf("Add value 1 to FregService.");
val +=1 ;
service->setVal(val);
printf("Read the value from FregService anain:\n");
val = service->getVal();
printf(" %d .\n", val);
return 0;
}
getService
defaultServiceManager() 已经分析过,拿到的是 BpBinder -> BpServiceManager -> IServiceManager.
class BpServiceManager : public BpInterface<IServiceManager>
{
public:
explicit BpServiceManager(const sp<IBinder>& impl)
: BpInterface<IServiceManager>(impl)
{
}
virtual sp<IBinder> getService(const String16& name) const
{
unsigned n;
for (n = 0; n < 5; n++){
if (n > 0) {
if (!strcmp(ProcessState::self()->getDriverName().c_str(), "/dev/vndbinder")) {
ALOGI("Waiting for vendor service %s...", String8(name).string());
CallStack stack(LOG_TAG);
} else {
ALOGI("Waiting for service %s...", String8(name).string());
}
sleep(1);
}
sp<IBinder> svc = checkService(name);
if (svc != NULL) return svc;
}
return NULL;
}
virtual sp<IBinder> checkService( const String16& name) const
{
Parcel data, reply;
data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
data.writeString16(name);
remote()->transact(CHECK_SERVICE_TRANSACTION, data, &reply);
return reply.readStrongBinder();
}
virtual status_t addService(const String16& name, const sp<IBinder>& service,
bool allowIsolated)
{
Parcel data, reply;
data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
data.writeString16(name);
data.writeStrongBinder(service);
data.writeInt32(allowIsolated ? 1 : 0);
status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);
return err == NO_ERROR ? reply.readExceptionCode() : err;
}
virtual Vector<String16> listServices()
{
Vector<String16> res;
int n = 0;
for (;;) {
Parcel data, reply;
data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
data.writeInt32(n++);
status_t err = remote()->transact(LIST_SERVICES_TRANSACTION, data, &reply);
if (err != NO_ERROR)
break;
res.add(reply.readString16());
}
return res;
}
};
- FregClient 进程将通信数据,即要获取的代理对象的 Service 组件 FregService 的名称封装到 Parcel 中,用来传递给 Binder Dirver.
- FregClient 向 Driver 发送 BC_TRANSACTION 命令,Drver 根据协议内容找到 ServiceManager 后,向 FregClient 发送 BR_TRANSACTION_COMPLETE,表示进程间通信请求已经被接受.FregClient收到Driver发送给的 BR_TRANSACTION_COMPLETE 后,对它进行处理,然后再次进入到Driver中等待 ServiceManager 将它要获取的 Binder 代理对象的句柄值返回来.
- Driver 在向 Client 发送 BR_TRANSACTION_COMPLETE 的同时,也会想 ServiceManager 发送 BR_TRANSACTION ,请求执行 CHECK_SERVICE_TRANSACTION 操作.
- ServiceManager 执行完 Client 的 CHECK_SERVICE_TRANSACTION 操作之后,就会向 Driver 发送一个 BC_REPLY ,该协议内容包含了 Service 组件 FregService 的信息.Driver 根据协议内容中的 Service 组件 FregService 信息为 FregClient 创建一个 binder_ref,接着会向 ServiceManager 发送 BR_TRANSACTION_COMPLETE,表示 Service 组件FregService已经找到.ServiceManager接收到 Driver 发送的 BR_TRANSACTION_COMPLETE 后对它进行处理之后,一次进程间通信就结束了,接着会进入下一次进程间通信请求.
- Driver 在向 ServiceManager 发送 BR_TRANSACTION_COMPLETE 的同时,也会向 Client 发送 BR_REPLY 返回协议,协议内容包含了 binder_ref 的句柄值,这时 Client 就通过句柄值来创建一个 BpBinder.
