Android IPC 通讯机制源码分析【中】

客户端如何设置这个句柄在下面会介绍。

CameraSerivce服务的注册(Main_mediaservice.c）

int main(int argc, char** argv)

{

sp<ProcessState> proc(ProcessState::self());

sp<IServiceManager> sm = defaultServiceManager();

LOGI("ServiceManager: %p", sm.get());

AudioFlinger::instantiate();              //Audio 服务

MediaPlayerService::instantiate();        //mediaPlayer服务

CameraService::instantiate();              //Camera 服务

ProcessState::self()->startThreadPool(); //为进程开启缓冲池

IPCThreadState::self()->joinThreadPool(); //将进程加入到缓冲池

}

CameraService.cpp

void CameraService::instantiate() {

     defaultServiceManager()->addService(

             String16("media.camera"), new CameraService());

}

创建CameraService服务对象并添加到ServiceManager进程中。

client获取remote IServiceManager IBinder接口：

sp<IServiceManager> defaultServiceManager()

{

     if (gDefaultServiceManager != NULL) return gDefaultServiceManager;

     {

         AutoMutex _l(gDefaultServiceManagerLock);

         if (gDefaultServiceManager == NULL) {

             gDefaultServiceManager = interface_cast<IServiceManager>(

                 ProcessState::self()->getContextObject(NULL));

         }

     }

     return gDefaultServiceManager;

}

任何一个进程在第一次调用defaultServiceManager的时候gDefaultServiceManager值为Null，所以该进程会通过ProcessState::self得到ProcessState实例。ProcessState将打开Binder驱动。

ProcessState.cpp

sp<ProcessState> ProcessState::self()

{

     if (gProcess != NULL) return gProcess;

     AutoMutex _l(gProcessMutex);

     if (gProcess == NULL) gProcess = new ProcessState;

     return gProcess;

}

ProcessState::ProcessState()

: mDriverFD(open_driver()) //打开/dev/binder驱动

...........................

{

}

sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& caller)

{

     if (supportsProcesses()) {

         return getStrongProxyForHandle(0);

     } else {

         return getContextObject(String16("default"), caller);

     }

}

Android是支持Binder驱动的所以程序会调用getStrongProxyForHandle。这里handle为0，正好与Service_manager中的BINDER_SERVICE_MANAGER一致。

sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)

{

     sp<IBinder> result;

     AutoMutex _l(mLock);

     handle_entry* e = lookupHandleLocked(handle);

     if (e != NULL) {

         IBinder* b = e->binder; //第一次调用该函数b为Null

         if (b == NULL || !e->refs->attemptIncWeak(this)) {

             b = new BpBinder(handle);

             e->binder = b;

             if (b) e->refs = b->getWeakRefs();

             result = b;

         } else {

             result.force_set(b);

             e->refs->decWeak(this);

         }

     }

     return result;

}

第一次调用的时候b为Null所以会为b生成一BpBinder对象：

BpBinder::BpBinder(int32_t handle)

     : mHandle(handle)

     , mAlive(1)

     , mObitsSent(0)

     , mObituaries(NULL)

{

     LOGV("Creating BpBinder %p handle %d\n", this, mHandle);

     extendObjectLifetime(OBJECT_LIFETIME_WEAK);

     IPCThreadState::self()->incWeakHandle(handle);

}

void IPCThreadState::incWeakHandle(int32_t handle)

{

     LOG_REMOTEREFS("IPCThreadState::incWeakHandle(%d)\n", handle);

     mOut.writeInt32(BC_INCREFS);

     mOut.writeInt32(handle);

}

getContextObject返回了一个BpBinder对象。

interface_cast<IServiceManager>(

                 ProcessState::self()->getContextObject(NULL));

template<typename INTERFACE>

inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)

{

     return INTERFACE::asInterface(obj);

}

将这个宏扩展后最终得到的是：

sp<IServiceManager> IServiceManager::asInterface(const sp<IBinder>& obj)

     {

         sp<IServiceManager> intr;

         if (obj != NULL) {

             intr = static_cast<IServiceManager*>(

                 obj->queryLocalInterface(

                         IServiceManager::descriptor).get());

             if (intr == NULL) {

                 intr = new BpServiceManager(obj);

             }

         }

         return intr;

}

返回一个BpServiceManager对象,这里obj就是前面我们创建的BpBInder对象。