hidl get service flow

Posted 2022-11-11 aspirs

system/libhidl/transport/ServiceManagement.cpp

 

out\soong\.intermediates\system\libhidl\transport\manager\1.0\android.hidl.manager@1.0_genc++\gen\android\hidl\manager\1.0\ServiceManagerAll.cpp

IServiceManager::getService()

　　getServiceInternal();

 

system/libhidl/transport/include/hidllibHidlTransportSupport.h

template <typename BpType, typename IType = typename BpType::Pure,
          typename = std::enable_if_t<std::is_same<i_tag, typename IType::_hidl_tag>::value>,
          typename = std::enable_if_t<std::is_same<bphw_tag, typename BpType::_hidl_tag>::value>>
sp<IType> getServiceInternal(const std::string& instance, bool retry, bool getStub) 
    using ::android::hidl::base::V1_0::IBase;

    sp<IBase> base = getRawServiceInternal(IType::descriptor, instance, retry, getStub);

    if (base == nullptr) 
        return nullptr;
    

    if (base->isRemote()) 
        // getRawServiceInternal guarantees we get the proper class
        return sp<IType>(new BpType(toBinder<IBase>(base)));
    

    return IType::castFrom(base);

 

sp<::android::hidl::base::V1_0::IBase> getRawServiceInternal(const std::string& descriptor,
                                                             const std::string& instance,
                                                             bool retry, bool getStub) 
    using Transport = ::android::hidl::manager::V1_0::IServiceManager::Transport;
    using ::android::hidl::base::V1_0::IBase;
    using ::android::hidl::manager::V1_0::IServiceManager;
    sp<Waiter> waiter;

    const sp<IServiceManager1_1> sm = defaultServiceManager1_1();
　　 sm.get()

 

 

sp<IServiceManager1_1> defaultServiceManager1_1() 
    
        AutoMutex _l(details::gDefaultServiceManagerLock);
        if (details::gDefaultServiceManager != nullptr) 
            return details::gDefaultServiceManager;
        

        if (access("/dev/hwbinder", F_OK|R_OK|W_OK) != 0) 
            // HwBinder not available on this device or not accessible to
            // this process.
            return nullptr;
        

        waitForHwServiceManager();

        while (details::gDefaultServiceManager == nullptr) 
            details::gDefaultServiceManager =
                    fromBinder<IServiceManager1_1, BpHwServiceManager, BnHwServiceManager>(
                        ProcessState::self()->getContextObject(nullptr));
            if (details::gDefaultServiceManager == nullptr) 
                LOG(ERROR) << "Waited for hwservicemanager, but got nullptr.";
                sleep(1);
            
        
    

    return details::gDefaultServiceManager;

上面fromBinder函数在如下的文件中：

system/libhidl/transport/include/hidl/HidlBinderSupport.h

template <typename IType, typename ProxyType, typename StubType>
sp<IType> fromBinder(const sp<IBinder>& binderIface) 
    using ::android::hidl::base::V1_0::IBase;
    using ::android::hidl::base::V1_0::BnHwBase;

    if (binderIface.get() == nullptr) 
        return nullptr;
    
    if (binderIface->localBinder() == nullptr) 
        return new ProxyType(binderIface);
    

 

上面会走到return new ProxyType()，所以会new一个BpHwServiceManager对象，因为BpHwServiceManager是BpInterface的子类，所以在它的构造函数里，会调用BpInterface的构造函数，在BpInterface的构造函数里调用BpHwRefBase的构造函数。

BpInterface构造函数在system/libhwbinder/include/hwbinder/IInterface.h

BpHwRefBase声明在system/libhwbinder/include/hwbinder/Binder.h，实现在对应路径下的Binder.cpp里。

上面ProcessState::self()->getContextObject(nullptr)返回的即是一个sp<IBinder>，真实的为sp<BpHwBinder>。

在BpHwRefBase的构造函数中，将sp<BpHwBinder>保存到mRemote

 

所以getRawServiceInternal()里拿到的sm即是一个BpHwServiceManager。

上面getRawServiceInternal()里的sm.get()函数在如下的文件里：

out\soong\.intermediates\system\libhidl\transport\manager\1.0\android.hidl.manager@1.0_genc++\gen\android\hidl\manager\1.0\ServiceManagerAll.cpp

BpHwServiceManager::get()

::android::hardware::Return<::android::sp<::android::hidl::base::V1_0::IBase>> BpHwServiceManager::_hidl_get(::android::hardware::IInterface *_hidl_this, ::android::hardware::details::HidlInstrumentor *_hidl_this_instrumentor, const ::android::hardware::hidl_string& fqName, const ::android::hardware::hidl_string& name) 
_hidl_err = ::android::hardware::IInterface::asBinder(_hidl_this)->transact(1 /* get */, _hidl_data, &_hidl_reply);

 

 上面asBinder(_hidl_this)即是调用的system/libhwbinder/IInterface.cpp里的如下函数：

sp<IBinder> IInterface::asBinder(const IInterface* iface)


if (iface == NULL) return NULL;

return const_cast<IInterface*>(iface)->onAsBinder();

 如下文件中BpInterface继承了IInterface，所以上面的onAsBinder()即是调用了BpInterface的onAsBinder()

system/libhwbinder/include/hwbinder/IInterface.h

template<typename INTERFACE>
class BpInterface : public INTERFACE, public IInterface, public BpHwRefBase

public:
                                BpInterface(const sp<IBinder>& remote);
    virtual IBinder*            onAsBinder();
;

template<typename INTERFACE>
inline IBinder* BpInterface<INTERFACE>::onAsBinder()

    return remote();

 所以上面的android::hardware::IInterface::asBinder()返回的即是一个BpHwBinder

 BpHwBinder的transact函数声明如下，它有两个参数是有默认值的：

class BpHwBinder : public IBinder

public:
                        BpHwBinder(int32_t handle);

    inline  int32_t     handle() const  return mHandle; 

    virtual status_t    transact(   uint32_t code,
                                    const Parcel& data,
                                    Parcel* reply,
                                    uint32_t flags = 0,
                                    TransactCallback callback = nullptr);

 

它对应的实现在：

system/libhwbinder/BpHwBinder.cpp

status_t BpHwBinder::transact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags, TransactCallback /*callback*/)

    // Once a binder has died, it will never come back to life.
    if (mAlive) 
        status_t status = IPCThreadState::self()->transact(
            mHandle, code, data, reply, flags);
        if (status == DEAD_OBJECT) mAlive = 0;
        return status;
    

    return DEAD_OBJECT;

 

 

 

 

 

 

BpHwServiceManager::get()