图解 | 一图摸清 Android 系统服务

//ContextImpl.java
public Object getSystemService(String name) {
    //SystemServiceRegistry是系统服务的注册表，用来集中管理系统服务
    return SystemServiceRegistry.getSystemService(this, name);
}
//SystemServiceRegistry.java
public static Object getSystemService(ContextImpl ctx, String name) {
    //根据服务名字从HashMap中取出ServiceFetcher
    ServiceFetcher<?> fetcher = SYSTEM_SERVICE_FETCHERS.get(name);
    //传入上下文，借助ServiceFetcher来获取系统服务
    return fetcher != null ? fetcher.getService(ctx) : null;
}

//CachedServiceFetcher.java
public final T getService(ContextImpl ctx) {
    //每个上下文ctx都有一份系统服务缓存
    final Object[] cache = ctx.mServiceCache;
    synchronized (cache) {
        //从缓存里获取系统服务
        Object service = cache[mCacheIndex];
        if (service == null) {
            //缓存里没有，则创建
            service = createService(ctx);
            //存入缓存
            cache[mCacheIndex] = service;
        }
        return (T)service;
    }
}
//createService是个抽象方法
public abstract T createService(ContextImpl ctx);

//SystemServiceRegistry.java
registerService(
    Context.POWER_SERVICE, PowerManager.class,
    new CachedServiceFetcher<PowerManager>() {
        @Override
        public PowerManager createService(ContextImpl ctx){
            //ServiceManager根据服务名字获取系统服务的Binder对象
            IBinder b = ServiceManager.getServiceOrThrow(Context.POWER_SERVICE);
            //将服务端的Binder转成客户端所需的AIDL接口类型的对象IPowerManager
            IPowerManager service = IPowerManager.Stub.asInterface(b);
            //再用PowerManager类包一层，方便外部使用
            return new PowerManager(ctx.getOuterContext(),
                                    service, 
                                    ctx.mMainThread.getHandler());
        }});

//ServiceManager.java
public static IBinder getService(String name) {
    //取缓存
    IBinder service = sCache.get(name);
    if (service != null) {
        return service;
    } else {
        //取不到就继续，这里创建完并没有存入sCache，即sCache只是预置了一些启动阶段存入的服务
        //getService()获取系统服务的Binder对象，用allowBlocking包了一下，允许阻塞
        return Binder.allowBlocking(getIServiceManager().getService(name));
    }
    return null;
}
private static IServiceManager getIServiceManager() {
    if (sServiceManager != null) {
        return sServiceManager;
    }
    //binder跨进程通信：
    //BinderInternal.getContextObject()得到系统级别上下文的IBinder，可用来查找服务
    //asInterface将IBinder转成IServiceManager（本质是BpServiceManager）
    sServiceManager = ServiceManagerNative
        .asInterface(Binder.allowBlocking(BinderInternal.getContextObject()));
    return sServiceManager;
}

public interface IServiceManager extends IInterface{
    //从IServiceManager获取系统服务，如果服务不存在，会阻塞最多5秒，直到服务被发布注册
    public IBinder getService(String name);
}

//class BpServiceManager : public BpInterface<IServiceManager>
//这里的BpInterface是binder内部的细节了，不是很理解，后面抽时间看看
virtual sp<IBinder> getService(const String16& name) const
{
    unsigned n;
    //如果获取不到，则休眠1秒再取，最多阻塞5秒
    for (n = 0; n < 5; n++){
        if (n > 0) {
            //休眠1秒，待会再取
            sleep(1);
        }
        sp<IBinder> svc = checkService(name);
        //获取到系统服务，则返回
        if (svc != NULL) return svc;
    }
    return NULL;
}
//返回系统服务的binder，暂不深究
virtual sp<IBinder> checkService( const String16& name) const
{
    //binder使用Parcelable来序列化数据
    Parcel data, reply;
    data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
    data.writeString16(name);
    //remote()得到BpBinder，transact发送请求
    remote()->transact(CHECK_SERVICE_TRANSACTION, data, &reply);
    return reply.readStrongBinder();//Binder
}

//frameworks/native/services/surfaceflinger/surfaceflinger.rc
service surfaceflinger /system/bin/surfaceflinger
    class core animation
    user system
    group graphics drmrpc readproc
    onrestart restart zygote

int main(int, char**) {
    //ProcessState会启动binder机制（打开binder驱动、映射内存、分配缓冲区）
    sp<ProcessState> ps(ProcessState::self());
    //启动binder线程
    ps->startThreadPool();
    //初始化surfaceflinger
    sp<SurfaceFlinger> flinger = new SurfaceFlinger();
    flinger->init();
    //发布注册surfaceflinger
    sp<IServiceManager> sm(defaultServiceManager());
    sm->addService(String16(SurfaceFlinger::getServiceName()), flinger, false);
    //在当前线程运行surfaceflinger
    flinger->run();
    return 0;
}

sp<IServiceManager> defaultServiceManager()
{
    //有值，直接返回
    if (gDefaultServiceManager != NULL) return gDefaultServiceManager;
    {
        AutoMutex _l(gDefaultServiceManagerLock);
        while (gDefaultServiceManager == NULL) {
            //查找ServiceManager，强转为IServiceManager（本质是BpServiceManager）
            gDefaultServiceManager = interface_cast<IServiceManager>(
                ProcessState::self()->getContextObject(NULL));
            //如果IServiceManager还是null，则休眠1秒再取，直至取到才结束循环
            if (gDefaultServiceManager == NULL)
                sleep(1);
        }
    }
    return gDefaultServiceManager;
}

//class BpServiceManager : public BpInterface<IServiceManager>
//这里的BpInterface是binder内部的细节了，不是很理解，后面抽时间看看
//注册系统服务（的binder），暂不深究
virtual status_t addService(const String16& name, const sp<IBinder>& service,
                            bool allowIsolated)
{
    //binder使用Parcelable来序列化数据
    Parcel data, reply;
    data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
    data.writeString16(name);
    data.writeStrongBinder(service);//Binder
    data.writeInt32(allowIsolated ? 1 : 0);
    //remote()得到BpBinder，transact发送请求
    status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);
    return err == NO_ERROR ? reply.readExceptionCode() : err;
}

//SystemServer.java
private void startBootstrapServices() {
    //AMS由SSM创建启动
    mActivityManagerService = mSystemServiceManager
        //创建并启动AMS服务
        .startService(ActivityManagerService.Lifecycle.class)
        //通过binder获取AMS服务
        .getService();
    //注册AMS
    mActivityManagerService.setSystemProcess();
}

//ActivityManagerService.java
public void setSystemProcess() {
    //注册AMS
    ServiceManager.addService(Context.ACTIVITY_SERVICE, this, true);
}

//ServiceManager.java
public static void addService(String name, IBinder service, boolean allowIsolated) {
    //跟前边一样，通过binder跨进程通信，拿到ServiceManager进程的BpServiceManager对象
    //调用BpServiceManager的addService
    getIServiceManager().addService(name, service, allowIsolated);
}