hidl get service flow

system/libhidl/transport/ServiceManagement.cpp

outsoong.intermediatessystemlibhidl ransportmanager1.0android.hidl.manager@1.0_genc++genandroidhidlmanager1.0ServiceManagerAll.cpp

IServiceManager::getService()

　　getServiceInternal();

 

system/libhidl/transport/include/hidllibHidlTransportSupport.h

template <typename BpType, typename IType = typename BpType::Pure,
          typename = std::enable_if_t<std::is_same<i_tag, typename IType::_hidl_tag>::value>,
          typename = std::enable_if_t<std::is_same<bphw_tag, typename BpType::_hidl_tag>::value>>
sp<IType> getServiceInternal(const std::string& instance, bool retry, bool getStub) {
    using ::android::hidl::base::V1_0::IBase;

    sp<IBase> base = getRawServiceInternal(IType::descriptor, instance, retry, getStub);

    if (base == nullptr) {
        return nullptr;
    }

    if (base->isRemote()) {
        // getRawServiceInternal guarantees we get the proper class
        return sp<IType>(new BpType(toBinder<IBase>(base)));
    }

    return IType::castFrom(base);
}

sp<::android::hidl::base::V1_0::IBase> getRawServiceInternal(const std::string& descriptor,
                                                             const std::string& instance,
                                                             bool retry, bool getStub) {
    using Transport = ::android::hidl::manager::V1_0::IServiceManager::Transport;
    using ::android::hidl::base::V1_0::IBase;
    using ::android::hidl::manager::V1_0::IServiceManager;
    sp<Waiter> waiter;

    const sp<IServiceManager1_1> sm = defaultServiceManager1_1();
　　 sm.get()

 

sp<IServiceManager1_1> defaultServiceManager1_1() {
    {
        AutoMutex _l(details::gDefaultServiceManagerLock);
        if (details::gDefaultServiceManager != nullptr) {
            return details::gDefaultServiceManager;
        }

        if (access("/dev/hwbinder", F_OK|R_OK|W_OK) != 0) {
            // HwBinder not available on this device or not accessible to
            // this process.
            return nullptr;
        }

        waitForHwServiceManager();

        while (details::gDefaultServiceManager == nullptr) {
            details::gDefaultServiceManager =
                    fromBinder<IServiceManager1_1, BpHwServiceManager, BnHwServiceManager>(
                        ProcessState::self()->getContextObject(nullptr));
            if (details::gDefaultServiceManager == nullptr) {
                LOG(ERROR) << "Waited for hwservicemanager, but got nullptr.";
                sleep(1);
            }
        }
    }

    return details::gDefaultServiceManager;
}

上面fromBinder函数在如下的文件中：

system/libhidl/transport/include/hidl/HidlBinderSupport.h

template <typename IType, typename ProxyType, typename StubType>
sp<IType> fromBinder(const sp<IBinder>& binderIface) {
    using ::android::hidl::base::V1_0::IBase;
    using ::android::hidl::base::V1_0::BnHwBase;

    if (binderIface.get() == nullptr) {
        return nullptr;
    }
    if (binderIface->localBinder() == nullptr) {
        return new ProxyType(binderIface);
    }

上面会走到return new ProxyType()，所以会new一个BpHwServiceManager对象，因为BpHwServiceManager是BpInterface的子类，所以在它的构造函数里，会调用BpInterface的构造函数，在BpInterface的构造函数里调用BpHwRefBase的构造函数。

BpInterface构造函数在system/libhwbinder/include/hwbinder/IInterface.h

BpHwRefBase声明在system/libhwbinder/include/hwbinder/Binder.h，实现在对应路径下的Binder.cpp里。

上面ProcessState::self()->getContextObject(nullptr)返回的即是一个sp<IBinder>，真实的为sp<BpHwBinder>。

在BpHwRefBase的构造函数中，将sp<BpHwBinder>保存到mRemote

所以getRawServiceInternal()里拿到的sm即是一个BpHwServiceManager。

上面getRawServiceInternal()里的sm.get()函数在如下的文件里：

outsoong.intermediatessystemlibhidl ransportmanager1.0android.hidl.manager@1.0_genc++genandroidhidlmanager1.0ServiceManagerAll.cpp

BpHwServiceManager::get()

::android::hardware::Return<::android::sp<::android::hidl::base::V1_0::IBase>> BpHwServiceManager::_hidl_get(::android::hardware::IInterface *_hidl_this, ::android::hardware::details::HidlInstrumentor *_hidl_this_instrumentor, const ::android::hardware::hidl_string& fqName, const ::android::hardware::hidl_string& name) {
_hidl_err = ::android::hardware::IInterface::asBinder(_hidl_this)->transact(1 /* get */, _hidl_data, &_hidl_reply);

 上面asBinder(_hidl_this)即是调用的system/libhwbinder/IInterface.cpp里的如下函数：

sp<IBinder> IInterface::asBinder(const IInterface* iface)
{

if (iface == NULL) return NULL;

return const_cast<IInterface*>(iface)->onAsBinder();

}

 如下文件中BpInterface继承了IInterface，所以上面的onAsBinder()即是调用了BpInterface的onAsBinder()

system/libhwbinder/include/hwbinder/IInterface.h

template<typename INTERFACE>
class BpInterface : public INTERFACE, public IInterface, public BpHwRefBase
{
public:
                                BpInterface(const sp<IBinder>& remote);
    virtual IBinder*            onAsBinder();
};

template<typename INTERFACE>
inline IBinder* BpInterface<INTERFACE>::onAsBinder()
{
    return remote();
}

 所以上面的android::hardware::IInterface::asBinder()返回的即是一个BpHwBinder

 BpHwBinder的transact函数声明如下，它有两个参数是有默认值的：

class BpHwBinder : public IBinder
{
public:
                        BpHwBinder(int32_t handle);

    inline  int32_t     handle() const { return mHandle; }

    virtual status_t    transact(   uint32_t code,
                                    const Parcel& data,
                                    Parcel* reply,
                                    uint32_t flags = 0,
                                    TransactCallback callback = nullptr);

它对应的实现在：

system/libhwbinder/BpHwBinder.cpp

status_t BpHwBinder::transact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags, TransactCallback /*callback*/)
{
    // Once a binder has died, it will never come back to life.
    if (mAlive) {
        status_t status = IPCThreadState::self()->transact(
            mHandle, code, data, reply, flags);
        if (status == DEAD_OBJECT) mAlive = 0;
        return status;
    }

    return DEAD_OBJECT;
}

 

 

 

 

BpHwServiceManager::get()