注意：一個(gè)Server進(jìn)程可以注冊(cè)多個(gè)Service，就像即將講解的MediaServer一樣。

int main(int argc, char** argv)

{

? //①獲得一個(gè)ProcessState實(shí)例

?sp<ProcessState>proc(ProcessState::self());

?

?//②MS作為ServiceManager的客戶(hù)端，需要向ServiceManger注冊(cè)服務(wù)

?//調(diào)用defaultServiceManager，得到一個(gè)IServiceManager。

?sp<IServiceManager>sm = defaultServiceManager();

?

?//初始化音頻系統(tǒng)的AudioFlinger服務(wù)

?AudioFlinger::instantiate();

?//③多媒體系統(tǒng)的MediaPlayer服務(wù)，我們將以它作為主切入點(diǎn)

?MediaPlayerService::instantiate();

?//CameraService服務(wù)

?CameraService::instantiate();

?//音頻系統(tǒng)的AudioPolicy服務(wù)

?AudioPolicyService::instantiate();

?

?//④根據(jù)名稱(chēng)來(lái)推斷，難道是要?jiǎng)?chuàng)建一個(gè)線(xiàn)程池嗎？

?ProcessState::self()->startThreadPool();

?//⑤下面的操作是要將自己加入到剛才的線(xiàn)程池中嗎？

?IPCThreadState::self()->joinThreadPool();

}

//①獲得一個(gè)ProcessState實(shí)例

sp<ProcessState> proc(ProcessState::self());

sp<ProcessState> ProcessState::self()

{

?? //gProcess是在Static.cpp中定義的一個(gè)全局變量

?? //程序剛開(kāi)始執(zhí)行，gProcess一定為空

??? if(gProcess != NULL) return gProcess;

??????? AutoMutex_l(gProcessMutex);

???? //創(chuàng)建一個(gè)ProcessState對(duì)象，并賦值給gProcess

??? if(gProcess == NULL) gProcess = new ProcessState;

?

???? returngProcess;

}

ProcessState::ProcessState()

?? // Android的中有很多代碼都是這么寫(xiě)的,稍不留神就容易忽略這里調(diào)用了一個(gè)很重要的函數(shù)

??? :mDriverFD(open_driver())

??? ,mVMStart(MAP_FAILED)//映射內(nèi)存的起始地址

??? ,mManagesContexts(false)

??? ,mBinderContextCheckFunc(NULL)

??? , mBinderContextUserData(NULL)

??? ,mThreadPoolStarted(false)

??? ,mThreadPoolSeq(1)

{

? if(mDriverFD >= 0) {

??/*

BIDNER_VM_SIZE定義為(1*1024*1024) - (4096 *2) = 1M-8K

?? mmap的用法希望讀者man一下，不過(guò)這個(gè)函數(shù)真正的實(shí)現(xiàn)和驅(qū)動(dòng)有關(guān)系，而B(niǎo)inder驅(qū)動(dòng)會(huì)分配一塊

內(nèi)存用來(lái)接收數(shù)據(jù)。

*/

??mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ,MAP_PRIVATE | MAP_NORESERVE,

???????????????????? mDriverFD, 0);

??? }

??? ......

}

static int open_driver()

{

??? int fd =open("/dev/binder", O_RDWR);//打開(kāi)/dev/binder設(shè)備

??? if (fd>= 0) {

?? ????? ......

???????size_t maxThreads = 15;

?????? //通過(guò)ioctl方式告訴binder驅(qū)動(dòng)，這個(gè)fd支持的最大線(xiàn)程數(shù)是15個(gè)

???????result = ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads);??

?? }

return fd;

......

}

sp<IServiceManager> defaultServiceManager()

{

??? //看樣子又是一個(gè)單例，英文名叫 Singleton，Android是一個(gè)優(yōu)秀的源碼庫(kù)，大量使用了

?? //設(shè)計(jì)模式，建議讀者以此為契機(jī)學(xué)習(xí)設(shè)計(jì)模式，首推GOF的《設(shè)計(jì)模式：可復(fù)用面向?qū)ο筌浖幕A(chǔ)》

??? if(gDefaultServiceManager != NULL) return gDefaultServiceManager;

???? {

???????AutoMutex _l(gDefaultServiceManagerLock);

??????? if(gDefaultServiceManager == NULL) {

??????? ? //真正的gDefaultServiceManager是在這里創(chuàng)建的。

???????????gDefaultServiceManager = interface_cast<IServiceManager>(

??????????? ?????????????????????? ProcessState::self()->getContextObject(NULL));

??????? }

??? }

?? returngDefaultServiceManager;

}

sp<IBinder>ProcessState::getContextObject(const sp<IBinder>& caller)

{

? ?/*

caller的值為0！注意，該函數(shù)返回的是IBinder。它是什么？我們后面再說(shuō)。

??? supportsProcesses函數(shù)根據(jù)openDriver函數(shù)打開(kāi)設(shè)備是否成功來(lái)判斷是否支持process

真實(shí)設(shè)備肯定支持process。

?? */

? if(supportsProcesses()) {

?? //真實(shí)設(shè)備上肯定是支持進(jìn)程的，所以會(huì)調(diào)用下面這個(gè)函數(shù)

???????return getStrongProxyForHandle(0);

??? } else {

???????return getContextObject(String16("default"), caller);

??? }

}

sp<IBinder>ProcessState::getStrongProxyForHandle(int32_t handle)

{

???sp<IBinder> result;

?AutoMutex_l(mLock);

/*

根據(jù)索引查找對(duì)應(yīng)資源。如果lookupHandleLocked發(fā)現(xiàn)沒(méi)有對(duì)應(yīng)的資源項(xiàng)，則會(huì)創(chuàng)建一個(gè)新的項(xiàng)并返回。

這個(gè)新項(xiàng)的內(nèi)容需要填充。

??? */

???handle_entry* e = lookupHandleLocked(handle);

??? if (e !=NULL) {

???????IBinder* b = e->binder;

??????? if (b== NULL || !e->refs->attemptIncWeak(this)) {

???????????//對(duì)于新創(chuàng)建的資源項(xiàng)，它的binder為空，所以走這個(gè)分支。注意，handle的值為0

??????????? b= new BpBinder(handle); //創(chuàng)建一個(gè)BpBinder

???????????e->binder = b; //填充entry的內(nèi)容

???????????if (b) e->refs = b->getWeakRefs();

???????????result = b;

??????? }else {

???????????result.force_set(b);

???????????e->refs->decWeak(this);

??????? }

??? }

??? returnresult; //返回BpBinder(handle)，注意，handle的值為0

}

注意：我們給BpBinder構(gòu)造函數(shù)傳的參數(shù)handle的值是0。這個(gè)0在整個(gè)Binder系統(tǒng)中有重要含義—因?yàn)?代表的就是ServiceManager所對(duì)應(yīng)的BBinder。

BpBinder::BpBinder(int32_t handle)

??? :mHandle(handle)//handle是0

??? ,mAlive(1)

??? ,mObitsSent(0)

??? ,mObituaries(NULL)

{

?? extendObjectLifetime(OBJECT_LIFETIME_WEAK);

?? //另一個(gè)重要對(duì)象是IPCThreadState，我們稍后會(huì)詳細(xì)講解。

???IPCThreadState::self()->incWeakHandle(handle);

}

gDefaultServiceManager =interface_cast<IServiceManager>(

???????????????????????????????????????????ProcessState::self()->getContextObject(NULL));

gDefaultServiceManager =interface_cast<IServiceManager>(new BpBinder(0));

template<typename INTERFACE>

inline sp<INTERFACE> interface_cast(constsp<IBinder>& obj)

{

??? returnINTERFACE::asInterface(obj);

}

inline sp<IServiceManager>interface_cast(const sp<IBinder>& obj)

{

??? return IServiceManager::asInterface(obj);

}

class IServiceManager : public IInterface

{

?public:

?? //關(guān)鍵無(wú)比的宏！

?? DECLARE_META_INTERFACE(ServiceManager);

?

??? //下面是ServiceManager所提供的業(yè)務(wù)函數(shù)

??? virtualsp<IBinder>??? getService( constString16& name) const = 0;

??? virtualsp<IBinder>??? checkService( constString16& name) const = 0;

??? virtualstatus_t????? ??addService( const String16& name,

??????????????????????????? ???????????????????const sp<IBinder>&service) = 0;

?? ?virtual Vector<String16>??? listServices() = 0;

??? ......

};

#define DECLARE_META_INTERFACE(INTERFACE)?????????????????????????????? \

??? staticconst android::String16 descriptor;????????????????????????? \

??? staticandroid::sp<I##INTERFACE> asInterface(?????????????????????? \

???????????const android::sp<android::IBinder>& obj);???????????????? ?\

??? virtualconst android::String16& getInterfaceDescriptor() const;??? \

???I##INTERFACE();????????????????????????????????????????????????????\

??? virtual~I##INTERFACE();????

//定義一個(gè)描述字符串

static const android::String16 descriptor;

?

//定義一個(gè)asInterface函數(shù)

static android::sp< IServiceManager >

asInterface(constandroid::sp<android::IBinder>& obj)

?

//定義一個(gè)getInterfaceDescriptor函數(shù)，估計(jì)就是返回descriptor字符串

virtual const android::String16&getInterfaceDescriptor() const;

?

//定義IServiceManager的構(gòu)造函數(shù)和析構(gòu)函數(shù)

IServiceManager ();???????????????????????????????????????????????????

virtual ~IServiceManager();

IMPLEMENT_META_INTERFACE(ServiceManager,"android.os.IServiceManager");

const android::String16

IServiceManager::descriptor(“android.os.IServiceManager”);

//實(shí)現(xiàn)getInterfaceDescriptor函數(shù)

const android::String16& IServiceManager::getInterfaceDescriptor()const

?{?

??? //返回字符串descriptor，值是“android.os.IServiceManager”

????? return IServiceManager::descriptor;

? }????

//實(shí)現(xiàn)asInterface函數(shù)

?android::sp<IServiceManager>

?????????????IServiceManager::asInterface(constandroid::sp<android::IBinder>& obj)

{

???????android::sp<IServiceManager> intr;

??????? if(obj != NULL) {??????????? ??????????????????????????????????

???????????intr = static_cast<IServiceManager *>(?????????????????????????

???????????????obj->queryLocalInterface(IServiceManager::descriptor).get());??

???????????if (intr == NULL) {

?????????????//obj是我們剛才創(chuàng)建的那個(gè)BpBinder(0)

???????????????intr = new BpServiceManager(obj);

??????????? }

??????? }

???????return intr;

}

//實(shí)現(xiàn)構(gòu)造函數(shù)和析構(gòu)函數(shù)

IServiceManager::IServiceManager () { }

IServiceManager::~ IServiceManager() { }

intr = new BpServiceManager(obj);

重要說(shuō)明：以上這些關(guān)系很復(fù)雜，但ServiceManager并沒(méi)有使用錯(cuò)綜復(fù)雜的派生關(guān)系，它直接打開(kāi)Binder設(shè)備并與之交互。后文，還會(huì)詳細(xì)分析它的實(shí)現(xiàn)代碼。

//通過(guò)它的參數(shù)可得知，impl是IBinder類(lèi)型，看來(lái)與Binder有間接關(guān)系,它實(shí)際上是BpBinder對(duì)象

BpServiceManager(const sp<IBinder>& impl)

?? //調(diào)用基類(lèi)BpInterface的構(gòu)造函數(shù)

?? : BpInterface<IServiceManager>(impl)

{

}

template<typename INTERFACE>

inlineBpInterface<INTERFACE>::BpInterface(const sp<IBinder>& remote)

??? :BpRefBase(remote)//基類(lèi)構(gòu)造函數(shù)

{

}

BpRefBase::BpRefBase(const sp<IBinder>&o)

? //mRemote最終等于那個(gè)new 出來(lái)的BpBinder(0)

??? :mRemote(o.get()), mRefs(NULL), mState(0)

{

???extendObjectLifetime(OBJECT_LIFETIME_WEAK);

?

??? if(mRemote) {

???????mRemote->incStrong(this);??????????

??????? mRefs= mRemote->createWeak(this);

??? }

}

void MediaPlayerService::instantiate() {

??? defaultServiceManager()->addService(

???????????String16("media.player"), new MediaPlayerService());

}

virtual status_t addService(const String16&name, const sp<IBinder>& service)

{

??? //Parcel:就把它當(dāng)作是一個(gè)數(shù)據(jù)包。

??? Parceldata, reply;

?? ?data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());

??? data.writeString16(name);

??? data.writeStrongBinder(service);

??? //remote返回的是mRemote，也就是BpBinder對(duì)象

??? status_terr = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);

??? returnerr == NO_ERROR ? reply.readInt32() : err;

}

status_t BpBinder::transact(uint32_t code, constParcel& data, Parcel* reply,

???????????????????????????????? uint32_tflags)

{

??? if(mAlive) {

?????//BpBinder果然是道具，它把transact工作交給了IPCThreadState

???????status_t status = IPCThreadState::self()->transact(

????? ???????????????????? mHandle,code, data, reply, flags);//mHandle也是參數(shù)

??????? if(status == DEAD_OBJECT) mAlive = 0;

???????return status;

??? }

?

??? returnDEAD_OBJECT;

}

IPCThreadState* IPCThreadState::self()

{

??? if(gHaveTLS) {//第一次進(jìn)來(lái)為false

restart:

??????? constpthread_key_t k = gTLS;

?/*

?? TLS是Thread Local Storage（線(xiàn)程本地存儲(chǔ)空間）的簡(jiǎn)稱(chēng)。

?? 這里只需知曉：這種空間每個(gè)線(xiàn)程都有，而且線(xiàn)程間不共享這些空間。

? ?通過(guò)pthread_getspecific/pthread_setspecific函數(shù)可以獲取/設(shè)置這些空間中的內(nèi)容。

? ?從線(xiàn)程本地存儲(chǔ)空間中獲得保存在其中的IPCThreadState對(duì)象。

?? 有調(diào)用pthread_getspecific的地方，肯定也有調(diào)用pthread_setspecific的地方

?*/

???????IPCThreadState* st = (IPCThreadState*)pthread_getspecific(k);

??????? if(st) return st;

// new一個(gè)對(duì)象，構(gòu)造函數(shù)中會(huì)調(diào)用pthread_setspecific

???????return new IPCThreadState;

??? }

???

??? if(gShutdown) return NULL;

????pthread_mutex_lock(&gTLSMutex);

??? if(!gHaveTLS) {

??????? if(pthread_key_create(&gTLS, threadDestructor) != 0) {

???????????pthread_mutex_unlock(&gTLSMutex);

???????????return NULL;

??????? }

???????gHaveTLS = true;

??? }

? pthread_mutex_unlock(&gTLSMutex);

//其實(shí)goto沒(méi)有我們說(shuō)的那么不好，匯編代碼也有很多跳轉(zhuǎn)語(yǔ)句（沒(méi)辦法，太低級(jí)的語(yǔ)言了），關(guān)鍵是要用好

? goto restart;

}

IPCThreadState::IPCThreadState()

??? :mProcess(ProcessState::self()), mMyThreadId(androidGetTid())

{

? //在構(gòu)造函數(shù)中，把自己設(shè)置到線(xiàn)程本地存儲(chǔ)中去。

???pthread_setspecific(gTLS, this);

??? clearCaller();

???//mIn和mOut是兩個(gè)Parcel。把它看成是發(fā)送和接收命令的緩沖區(qū)即可。

mIn.setDataCapacity(256);

??? ?mOut.setDataCapacity(256);

}

//注意，handle的值為0，代表了通信的目的端

status_t IPCThreadState::transact(int32_t handle,

????????????????????????????????? uint32_tcode, const Parcel& data,

?????????????????????? ???????????Parcel* reply, uint32_t flags)

{

??? status_terr = data.errorCheck();

?

??? flags |=TF_ACCEPT_FDS;

?

??? ......

/*

?注意這里的第一個(gè)參數(shù)BC_TRANSACTION，它是應(yīng)用程序向binder設(shè)備發(fā)送消息的消息碼，

而binder設(shè)備向應(yīng)用程序回復(fù)消息的消息碼以BR_開(kāi)頭。消息碼的定義在binder_module.h中，

?請(qǐng)求消息碼和回應(yīng)消息碼的對(duì)應(yīng)關(guān)系，需要查看Binder驅(qū)動(dòng)的實(shí)現(xiàn)才能將其理清楚，我們這里暫時(shí)用不上。

*/

???? err =writeTransactionData(BC_TRANSACTION, flags, handle, code, data, NULL);

??? ?......

?? ??err = waitForResponse(reply);

???? ......

???

??? returnerr;

}

status_tIPCThreadState::writeTransactionData(int32_t cmd, uint32_t binderFlags,

??? int32_thandle, uint32_t code, const Parcel& data, status_t* statusBuffer)

{

? ?//binder_transaction_data 是和binder設(shè)備通信的數(shù)據(jù)結(jié)構(gòu)。???

? ?binder_transaction_data tr;

?

? ?//果然，handle的值傳遞給了target，用來(lái)標(biāo)識(shí)目的端，其中0是ServiceManager的標(biāo)志。

?? tr.target.handle= handle;

?? //code是消息碼，用來(lái)switch/case的！

??? tr.code =code;

??? tr.flags= binderFlags;

???

??? conststatus_t err = data.errorCheck();

??? if (err== NO_ERROR) {

???????tr.data_size = data.ipcDataSize();

???????tr.data.ptr.buffer = data.ipcData();

???????tr.offsets_size = data.ipcObjectsCount()*sizeof(size_t);

???????tr.data.ptr.offsets = data.ipcObjects();

??? } else if(statusBuffer) {

???????tr.flags |= TF_STATUS_CODE;

???????*statusBuffer = err;

???????tr.data_size = sizeof(status_t);

???????tr.data.ptr.buffer = statusBuffer;

???????tr.offsets_size = 0;

???????tr.data.ptr.offsets = NULL;

??? } else {

???????return (mLastError = err);

??? }

?? //把命令寫(xiě)到mOut中， 而不是直接發(fā)出去，可見(jiàn)這個(gè)函數(shù)有點(diǎn)名不副實(shí)。

???mOut.writeInt32(cmd);

???mOut.write(&tr, sizeof(tr));

??? returnNO_ERROR;

}

status_t IPCThreadState::waitForResponse(Parcel*reply, status_t *acquireResult)

{

??? int32_tcmd;

??? int32_terr;

?

while (1) {

??????? //好家伙，talkWithDriver！

??????? if((err=talkWithDriver()) < NO_ERROR) break;

??????? err =mIn.errorCheck();

??????? if(err < NO_ERROR) break;

??????? if(mIn.dataAvail() == 0) continue;

???????

??????? cmd =mIn.readInt32();

?????? switch(cmd) {

??????? caseBR_TRANSACTION_COMPLETE:

???????????if (!reply && !acquireResult) goto finish;

???????????break;

??????? ......

??????? default:

???????????err = executeCommand(cmd);//看這個(gè)！

???????????if (err != NO_ERROR) goto finish;

???????????break;

??????? }

??? }

?

finish:

??? if (err!= NO_ERROR) {

??????? if(acquireResult) *acquireResult = err;

??????? if(reply) reply->setError(err);

???????mLastError = err;

??? }

???

??? returnerr;

}

status_t IPCThreadState::executeCommand(int32_tcmd)

{

??? BBinder*obj;

???RefBase::weakref_type* refs;

??? status_tresult = NO_ERROR;

???

??? switch(cmd) {

??? caseBR_ERROR:

???????result = mIn.readInt32();

???????break;

??????? ......

???? caseBR_TRANSACTION:

??????? {

???????????binder_transaction_data tr;

???????????result = mIn.read(&tr, sizeof(tr));

???????????if (result != NO_ERROR) break;

??? ????????Parcel buffer;

???????????Parcel reply;

???????????if (tr.target.ptr) {

????????? ?/*

?? ??????????看到了BBinder，想起圖6-3了嗎？BnServiceXXX從BBinder派生，

?? ??????????這里的b實(shí)際上就是實(shí)現(xiàn)BnServiceXXX的那個(gè)對(duì)象，關(guān)于它的作用，我們要在6.5節(jié)中講解。

??????????? */

???????????? ???sp<BBinder> b((BBinder*)tr.cookie);

???????????????const status_t error = b->transact(tr.code, buffer, &reply, 0);

?? ?????????????if (error < NO_ERROR)reply.setError(error);

?????????????} else {

?? ???????/*

? ?????????the_context_object是IPCThreadState.cpp中定義的一個(gè)全局變量，

??? ?????可通過(guò)setTheContextObject函數(shù)設(shè)置

?? ????????*/

???????????????const status_t error =

??????????? ?????????????????the_context_object->transact(tr.code,buffer, &reply, 0);

???????????????if (error < NO_ERROR) reply.setError(error);

???????? }

???????break;

??? ......

??? caseBR_DEAD_BINDER:

??????? {

???????? /*

?????????? 收到binder驅(qū)動(dòng)發(fā)來(lái)的service死掉的消息，看來(lái)只有Bp端能收到了，

?????????? 后面，我們將會(huì)對(duì)此進(jìn)行分析。

*/

???????????BpBinder *proxy = (BpBinder*)mIn.readInt32();

???????????proxy->sendObituary();

???????????mOut.writeInt32(BC_DEAD_BINDER_DONE);

???????????mOut.writeInt32((int32_t)proxy);

??????? }break;

??????? ......

case BR_SPAWN_LOOPER:

? //特別注意，這里將收到來(lái)自驅(qū)動(dòng)的指示以創(chuàng)建一個(gè)新線(xiàn)程，用于和Binder通信。

???????mProcess->spawnPooledThread(false);

???????break;

??????default:

????????result = UNKNOWN_ERROR;

???????break;

??? }

?? ......

??? if(result != NO_ERROR) {

???????mLastError = result;

??? }

??? returnresult;

}

status_t IPCThreadState::talkWithDriver(booldoReceive)

{

? // binder_write_read是用來(lái)與Binder設(shè)備交換數(shù)據(jù)的結(jié)構(gòu)

? ??binder_write_read bwr;

??? constbool needRead = mIn.dataPosition() >= mIn.dataSize();

??? constsize_t outAvail = (!doReceive || needRead) ? mOut.dataSize() : 0;

???

??? //請(qǐng)求命令的填充

???bwr.write_size = outAvail;

???bwr.write_buffer = (long unsigned int)mOut.data();

?

? if(doReceive && needRead) {

?????? //接收數(shù)據(jù)緩沖區(qū)信息的填充。如果以后收到數(shù)據(jù)，就直接填在mIn中了。

???????bwr.read_size = mIn.dataCapacity();

???????bwr.read_buffer = (long unsigned int)mIn.data();

??? } else {

???????bwr.read_size = 0;

??? }

???

??? if((bwr.write_size == 0) && (bwr.read_size == 0)) return NO_ERROR;

???

???bwr.write_consumed = 0;

???bwr.read_consumed = 0;

??? status_terr;

??? do {

? #ifdefined(HAVE_ANDROID_OS)

?? ?????//看來(lái)不是read/write調(diào)用，而是ioctl方式。

??????? if(ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr) >= 0)

???????????err = NO_ERROR;

??????? else

???????????err = -errno;

#else

??????? err =INVALID_OPERATION;

#endif

?????? }while (err == -EINTR);

???

???? if (err>= NO_ERROR) {

??????? if(bwr.write_consumed > 0) {

???????????if (bwr.write_consumed < (ssize_t)mOut.dataSize())

???????????????mOut.remove(0, bwr.write_consumed);

???????????else

???????????????mOut.setDataSize(0);

??????? }

??????? if(bwr.read_consumed > 0) {

???????????mIn.setDataSize(bwr.read_consumed);

???????????mIn.setDataPosition(0);