Cubietruck---15. binder分析_深入理解android第六章笔记

<深入理解android>卷1 邓凡平著 第六章笔记
mediaserver的目录
/work/ct/android42/frameworks/av/media/mediaserver/main_mediaserver.cpp

int main(int argc, char** argv)
{
    signal(SIGPIPE, SIG_IGN);
    sp<ProcessState> proc(ProcessState::self());         //1.打开设备结点
    //2.创建了两个对象,BpBinder与BpServiceManager,并让BpServiceManager的remote指向BpBinder
    sp<IServiceManager> sm = defaultServiceManager();
    AudioFlinger::instantiate();
    MediaPlayerService::instantiate();                  //3.
    CameraService::instantiate();
    AudioPolicyService::instantiate();
    ProcessState::self()->startThreadPool();
    IPCThreadState::self()->joinThreadPool();
}

1. 打开设备结点
/work/ct/android42/frameworks/native/libs/binder/ProcessState.cpp

sp<ProcessState> ProcessState::self()
{
    Mutex::Autolock _l(gProcessMutex);
    if (gProcess != NULL) {
        return gProcess;
    }
    gProcess = new ProcessState;     //第一次就new一个
    return gProcess;
}

new一个ProcessState,并保存/dev/binder结点的fd到mDriverFD中

ProcessState::ProcessState()
    : mDriverFD(open_driver())   //打开设备结点,并设置最大连接数为15
    , mVMStart(MAP_FAILED)
    , mManagesContexts(false)
    , mBinderContextCheckFunc(NULL)
    , mBinderContextUserData(NULL)
    , mThreadPoolStarted(false)
    , mThreadPoolSeq(1)
{
    mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
}

打开设备结点,并设转置最大连接数为15

static int open_driver()
{
    int fd = open("/dev/binder", O_RDWR);         //打开设备文件/dev/binder
    fcntl(fd, F_SETFD, FD_CLOEXEC);               //子进程关闭无用的fd,禁止exec
    result = ioctl(fd, BINDER_VERSION, &vers);    //获取binder的version,并检查
    size_t maxThreads = 15;
    ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads); //设置线程池中最多线程数为15
    return fd;
}

2.创建了两个对象,BpBinder与BpServiceManager
/work/ct/android42/frameworks/native/libs/binder/IServiceManager.cpp

sp<IServiceManager> defaultServiceManager()
{
    //不是第一次返回全局的IServiceManager
    if (gDefaultServiceManager != NULL)
        return gDefaultServiceManager;
    //第一次就new一个
    AutoMutex _l(gDefaultServiceManagerLock);
    if (gDefaultServiceManager == NULL) {
        //下面这一句创建了两个对象,BpBinder与BpServiceManager,
        //并让BpServiceManager的remote指向BpBinder
        gDefaultServiceManager = interface_cast<IServiceManager>(ProcessState::self()->getContextObject(NULL));   //2.1 - 2.2
    return gDefaultServiceManager;
}

2.1 创建BpBinder对象
./frameworks/native/libs/binder/ProcessState.cpp

sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& caller)
{
    return getStrongProxyForHandle(0);
}

./frameworks/native/libs/binder/ProcessState.cpp

sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)
{
    sp<IBinder> result;

    AutoMutex _l(mLock);

    handle_entry* e = lookupHandleLocked(handle);

    if (e != NULL) {
        IBinder* b = e->binder;
        if (b == NULL || !e->refs->attemptIncWeak(this)) {
            b = new BpBinder(handle);
            e->binder = b;
            if (b) e->refs = b->getWeakRefs();
            result = b;
        } else {
            result.force_set(b);
            e->refs->decWeak(this);
        }
    }

    return result;
}

./frameworks/native/libs/binder/BpBinder.cpp

BpBinder::BpBinder(int32_t handle)
    : mHandle(handle)
    , mAlive(1)
    , mObitsSent(0)
    , mObituaries(NULL)
{
    extendObjectLifetime(OBJECT_LIFETIME_WEAK);
    IPCThreadState::self()->incWeakHandle(handle);
}

2.2 创建BpServiceManager并用remote指向BpBinder
知道ProcessState::self()->getContextObject(NULL)的作用之后,下述就可以重新定义为:
gDefaultServiceManager = interface_cast(ProcessState::self()->getContextObject(NULL));
即: gDefaultServiceManager = interface_cast(new BpBinder(0));

再看一下 interface_cast

template<typename INTERFACE>
inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)
{
    return INTERFACE::asInterface(obj);
}

对应到IServiceManager就是

inline sp<IServiceManager> interface_cast(const sp<IBinder>& obj)
{
    return IServiceManager::asInterface(obj);
}

其中 IServiceManager的asInterface函数是通过DECLARE_META_INTERFACE宏定义的,
其实现是./frameworks/native/libs/binder/IServiceManager.cpp中的宏IMPLEMENT_META_INTERFACE

android::sp<IServiceManager> IServiceManager::asInterface(const android::sp<android::IBinder>&obj)
    {
        android::sp<IServiceManager> intr;
        if (obj != NULL) {
            intr = static_cast<IServiceManager*>(obj->queryLocalInterface(IServiceManager::descriptor).get());
            if (intr == NULL) {
                //重新创建了一个BpServiceManager对象,并且remote指向了上述2.1中new的BpBiner对象
                intr = new BpServiceManager(obj);
            }
        }
        return intr;
    }

3. addServer
在./frameworks/av/media/libmediaplayerservice/MediaPlayerService.cpp

void MediaPlayerService::instantiate() {
    defaultServiceManager()->addService(String16("media.player"), new MediaPlayerService());
}

defaultServiceManager()是一个BpServiceManager,所以调用BpServiceManager->addService

MediaPlayerService::initantiate
    --> BpServiceManager::addService
在./frameworks/native/libs/binder/IServiceManager.cpp中

virtual status_t addService(const String16& name, const sp<IBinder>& service,bool allowIsolated)
{
    //构造数据包data,结果的状态放在reply中
    Parcel data, reply;
    data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
    data.writeString16(name);
    data.writeStrongBinder(service);
    data.writeInt32(allowIsolated ? 1 : 0);
    //remote指向BpBinder,所以就是调用BpBinder的transact
    status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);
    return err == NO_ERROR ? reply.readExceptionCode() : err;
}

因为BpServiceManager的remote指向了BpBinder,所以remote()->transact就是BpBinder->transact();
MediaPlayerService::initantiate
    --> BpServiceManager::addService
        --> BpBinder::transact
在./frameworks/native/libs/binder/BpBinder.cpp中

status_t BpBinder::transact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    if (mAlive) {
        //BpBinder的transact没有干活,只是简单的把事情交给了IPCThreadState
        status_t status = IPCThreadState::self()->transact(mHandle, code, data, reply, flags);
        if (status == DEAD_OBJECT) mAlive = 0;
        return status;
    }

    return DEAD_OBJECT;
}

MediaPlayerService::initantiate
    --> BpServiceManager::addService
        --> BpBinder::transact
            --> IPCThreadState::transact
        --> BpBinder::transact
在./frameworks/native/libs/binder/IPCThreadState.cpp中

status_t IPCThreadState::transact(int32_t handle,uint32_t code, const Parcel& data,Parcel* reply, uint32_t flags)
{
   writeTransactionData(BC_TRANSACTION, flags, handle, code, data, NULL);    //将数据写到mOut中去,在下一步waitForResponse中正式发送
   waitForResponse(reply);     //真正的发送数据到/dev/binder并接收从/dev/binder中反馈的数据
   return err;
}

MediaPlayerService::initantiate
    --> BpServiceManager::addService
        --> BpBinder::transact
            --> IPCThreadState::transact
                --> waitForResponse
在./frameworks/native/libs/binder/IPCThreadState.cpp中

status_t IPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult)
{
    while (1) {
        talkWithDriver();          //与驱动进行通信并发送数据,利用ioctl
        cmd = mIn.readInt32();     //读取从驱动中反馈的信息,并作处理
        switch (cmd) {
        case BR_TRANSACTION_COMPLETE:
        case BR_DEAD_REPLY:
        case BR_FAILED_REPLY:
        case BR_ACQUIRE_RESULT:
        case BR_REPLY:
        default:
            executeCommand(cmd);
}