android—调试命令service
在android中，可以利用service命令去做很多调试工作，例如service list命令显示系统当前所有在service manager注册的service，其命令具体使用如下，
# service
service
Usage: service [-h|-?]
service list
service check SERVICE
service call SERVICE CODE [i32 INT | s16 STR] ...
Options:
i32: Write the integer INT into the send parcel.
s16: Write the UTF-16 string STR into the send parcel.主要用法有三个：
1.service list，显示系统当前所有在service manager注册的service；
2.service check SERVICE，查询SERVICE是否存在；
3.service call SERVICE，可以通过binder给service发送code，还可以向service发送intent等，具体代码分析如下。
代码在frameworks\native\cmds\service\service.cpp，其makefile为
LOCAL_PATH:= $(call my-dir)
include $(CLEAR_VARS)
LOCAL_SRC_FILES:= \
service.cpp
LOCAL_SHARED_LIBRARIES := libutils libbinder
ifeq ($(TARGET_OS),linux)
LOCAL_CFLAGS += -DXP_UNIX
#LOCAL_SHARED_LIBRARIES += librt
endif
#编译为应用程序service
LOCAL_MODULE:= service
include $(BUILD_EXECUTABLE)在main()函数中，
int main(int argc, char* const argv[])
{
//① 获取service manager的BpServiceManager
sp<IServiceManager> sm = defaultServiceManager();
//② 调用service check SERVICE
if (strcmp(argv[optind], "check") == 0) {
optind++;
if (optind < argc) {
sp<IBinder> service = sm->checkService(String16(argv[optind]));
aout << "Service " << argv[optind] <<
(service == NULL ? ": not found" : ": found") << endl;
} else {
aerr << "service: No service specified for check" << endl;
wantsUsage = true;
result = 10;
}
}
//③ 调用service list
else if (strcmp(argv[optind], "list") == 0) {
Vector<String16> services = sm->listServices();
aout << "Found " << services.size() << " services:" << endl;
for (unsigned i = 0; i < services.size(); i++) {
String16 name = services[i];
sp<IBinder> service = sm->checkService(name);
aout << i
<< "\t" << good_old_string(name)
<< ": [" << good_old_string(get_interface_name(service)) << "]"
<< endl;
}
}
//④ 调用service call
else if (strcmp(argv[optind], "call") == 0) {
optind++;
if (optind+1 < argc) {
int serviceArg = optind;
//获取service的BpBinder
sp<IBinder> service = sm->checkService(String16(argv[optind++]));
String16 ifName = get_interface_name(service);
int32_t code = atoi(argv[optind++]);
if (service != NULL && ifName.size() > 0) {
Parcel data, reply;
// the interface name is first
data.writeInterfaceToken(ifName);
// then the rest of the call arguments
while (optind < argc) {
//传递int
if (strcmp(argv[optind], "i32") == 0) {
optind++;
if (optind >= argc) {
aerr << "service: no integer supplied for 'i32'" << endl;
wantsUsage = true;
result = 10;
break;
}
data.writeInt32(atoi(argv[optind++]));
}//传递string
else if (strcmp(argv[optind], "s16") == 0) {
optind++;
if (optind >= argc) {
aerr << "service: no string supplied for 's16'" << endl;
wantsUsage = true;
result = 10;
break;
}
data.writeString16(String16(argv[optind++]));
}//传递个null，只写个StrongBinder
else if (strcmp(argv[optind], "null") == 0) {
optind++;
data.writeStrongBinder(NULL);
} //还能发送intent，这个应该是发送给ActivityManagerService
//然后ActivityManagerService将intent重组，
//启动需要的activity等
else if (strcmp(argv[optind], "intent") == 0) {
char* action = NULL;
char* dataArg = NULL;
char* type = NULL;
int launchFlags = 0;
char* component = NULL;
int categoryCount = 0;
char* categories[16];
char* context1 = NULL;
optind++;
while (optind < argc)
{
char* key = strtok_r(argv[optind], "=", &context1);
char* value = strtok_r(NULL, "=", &context1);
// we have reached the end of the XXX=XXX args.
if (key == NULL) break;
if (strcmp(key, "action") == 0)
{
action = value;
}
else if (strcmp(key, "data") == 0)
{
dataArg = value;
}
else if (strcmp(key, "type") == 0)
{
type = value;
}
else if (strcmp(key, "launchFlags") == 0)
{
launchFlags = atoi(value);
}
else if (strcmp(key, "component") == 0)
{
component = value;
}
else if (strcmp(key, "categories") == 0)
{
char* context2 = NULL;
int categoryCount = 0;
categories[categoryCount] = strtok_r(value, ",", &context2);
while (categories[categoryCount] != NULL)
{
categoryCount++;
categories[categoryCount] = strtok_r(NULL, ",", &context2);
}
}
optind++;
}
writeString16(data, action);
writeString16(data, dataArg);
writeString16(data, type);
data.writeInt32(launchFlags);
writeString16(data, component);
if (categoryCount > 0)
{
data.writeInt32(categoryCount);
for (int i = 0 ; i < categoryCount ; i++)
{
writeString16(data, categories[i]);
}
}
else
{
data.writeInt32(0);
}
// for now just set the extra field to be null.
data.writeInt32(-1);
} else {
aerr << "service: unknown option " << argv[optind] << endl;
wantsUsage = true;
result = 10;
break;
}
}
//直接在BpBinder上调用transact，发送code
service->transact(code, data, &reply);
aout << "Result: " << reply << endl;
}
}上面代码主要包括4部分：
1.获取service manager的代理对象BpServiceManager；
2.调用service check SERVICE，其实就是调用BpServiceManager->checkService；
3.调用service list，其实就是调用BpServiceManager->listServices；
4.调用service call，首先去获取service的BpBinder，后续直接调用transact函数向service发送code，其中命令参数可以包含i32(int)，s16(string)，null，intent(intent后需要自己组织intent的参数，这个应该是发送给ActivityManagerService，然后ActivityManagerService将intent重组，启动需要的activity)。
举个call的例子，在《android graphic(9)—开发者选项关闭HW overlays 》中分析了通过开发者选项关闭HW overlays，这里也可以通过service 命令向SurfaceFlinger命令发送1008的code。
//关闭HW overlays，code为1008，一个参数为int的1
# service call SurfaceFlinger 1008 i32 1