Android Binder 初步分析之一

前言：

在看Android Binder 代码分析 addService() 时，看到 remote()->transact()，网上博客讲最终到了 BpBinder中，即 BpRefBase 中的mRemote 指针 指向了 BpBinder。

那 BpRefBase mRemote 指针究竟如何指向 BpBinder ？本文将进行粗略分析。

Service 注册流程

以 MediaPlayerService 为例分析

frameworks/av/media/mediaserver/main_mediaserver.cpp
  int main(int argc __unused, char **argv __unused)
  {
    sp<ProcessState> proc(ProcessState::self());
    sp<IServiceManager> sm(defaultServiceManager());
    MediaPlayerService::instantiate();
    ResourceManagerService::instantiate();
    
    registerExtensions();
    ProcessState::self()->startThreadPool();
    IPCThreadState::self()->joinThreadPool();
  }

frameworks/av/media/libmediaplayerservice/MediaPlayerService.cpp 
  void MediaPlayerService::instantiate() {
    defaultServiceManager()->addService(
            String16("media.player"), new MediaPlayerService());
  }

核心方法 defaultServiceManager()->addService(String16("media.player"), new MediaPlayerService());

addService() 分析

1. addService()
frameworks/native/include/binder/IServiceManager.h
class IServiceManager : public IInterface
{
    // 参数 3 和参数 4 有默认值
    virtual status_t addService(const String16& name, const sp<IBinder>& service,
                                bool allowIsolated = false,
                                int dumpsysFlags = DUMP_FLAG_PRIORITY_DEFAULT) = 0;
}

frameworks/native/libs/binder/IServiceManager.cpp
  virtual status_t addService(const String16& name, const sp<IBinder>& service,
                                bool allowIsolated, int dumpsysPriority) {
	Parcel data, reply;
	data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
	data.writeString16(name);
	data.writeStrongBinder(service);
	data.writeInt32(allowIsolated ? 1 : 0);
	data.writeInt32(dumpsysPriority);
	status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);
	return err == NO_ERROR ? reply.readExceptionCode() : err;
  }
  
  // inline  IBinder*        remote()                { return mRemote; }
  // IBinder* const          mRemote; 而 mRemote 实际指向 BpBinder，具体分析如下

2. transact()
frameworks/native/libs/binder/BpBinder.cpp
  status_t BpBinder::transact(
    uint32_t code, const Parcel& data, Parcel* reply, ui