Cubietruck---14. binder分析_深入理解android第六章笔记
来源:互联网 发布:rk3399平板 ubuntu 编辑:程序博客网 时间:2024/06/02 14:43
<深入理解android>卷1 邓凡平著 第六章笔记
mediaserver的目录
/work/ct/android42/frameworks/av/media/mediaserver/main_mediaserver.cpp
1. 打开设备结点
/work/ct/android42/frameworks/native/libs/binder/ProcessState.cpp
new一个ProcessState,并保存/dev/binder结点的fd到mDriverFD中
打开设备结点,并设转置最大连接数为15
2.创建了两个对象,BpBinder与BpServiceManager
/work/ct/android42/frameworks/native/libs/binder/IServiceManager.cpp
2.1 创建BpBinder对象
./frameworks/native/libs/binder/ProcessState.cpp
./frameworks/native/libs/binder/ProcessState.cpp
./frameworks/native/libs/binder/BpBinder.cpp
2.2 创建BpServiceManager并用remote指向BpBinder
知道ProcessState::self()->getContextObject(NULL)的作用之后,下述就可以重新定义为:
gDefaultServiceManager = interface_cast(ProcessState::self()->getContextObject(NULL));
即: gDefaultServiceManager = interface_cast(new BpBinder(0));
再看一下 interface_cast
对应到IServiceManager就是
其中 IServiceManager的asInterface函数是通过DECLARE_META_INTERFACE宏定义的,
其实现是./frameworks/native/libs/binder/IServiceManager.cpp中的宏IMPLEMENT_META_INTERFACE
3. addServer
在./frameworks/av/media/libmediaplayerservice/MediaPlayerService.cpp
defaultServiceManager()是一个BpServiceManager,所以调用BpServiceManager->addService
MediaPlayerService::initantiate
--> BpServiceManager::addService
在./frameworks/native/libs/binder/IServiceManager.cpp中
因为BpServiceManager的remote指向了BpBinder,所以remote()->transact就是BpBinder->transact();
MediaPlayerService::initantiate
--> BpServiceManager::addService
--> BpBinder::transact
在./frameworks/native/libs/binder/BpBinder.cpp中
MediaPlayerService::initantiate
--> BpServiceManager::addService
--> BpBinder::transact
--> IPCThreadState::transact
--> BpBinder::transact
在./frameworks/native/libs/binder/IPCThreadState.cpp中
MediaPlayerService::initantiate
--> BpServiceManager::addService
--> BpBinder::transact
--> IPCThreadState::transact
--> waitForResponse
在./frameworks/native/libs/binder/IPCThreadState.cpp中
mediaserver的目录
/work/ct/android42/frameworks/av/media/mediaserver/main_mediaserver.cpp
- int main(int argc, char** argv)
- {
- signal(SIGPIPE, SIG_IGN);
- sp<ProcessState> proc(ProcessState::self()); //1.打开设备结点
- //2.创建了两个对象,BpBinder与BpServiceManager,并让BpServiceManager的remote指向BpBinder
- sp<IServiceManager> sm = defaultServiceManager();
- AudioFlinger::instantiate();
- MediaPlayerService::instantiate(); //3.
- CameraService::instantiate();
- AudioPolicyService::instantiate();
- ProcessState::self()->startThreadPool();
- IPCThreadState::self()->joinThreadPool();
- }
/work/ct/android42/frameworks/native/libs/binder/ProcessState.cpp
- sp<ProcessState> ProcessState::self()
- {
- Mutex::Autolock _l(gProcessMutex);
- if (gProcess != NULL) {
- return gProcess;
- }
- gProcess = new ProcessState; //第一次就new一个
- return gProcess;
- }
- ProcessState::ProcessState()
- : mDriverFD(open_driver()) //打开设备结点,并设置最大连接数为15
- , mVMStart(MAP_FAILED)
- , mManagesContexts(false)
- , mBinderContextCheckFunc(NULL)
- , mBinderContextUserData(NULL)
- , mThreadPoolStarted(false)
- , mThreadPoolSeq(1)
- {
- mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
- }
打开设备结点,并设转置最大连接数为15
- static int open_driver()
- {
- int fd = open("/dev/binder", O_RDWR); //打开设备文件/dev/binder
- fcntl(fd, F_SETFD, FD_CLOEXEC); //子进程关闭无用的fd,禁止exec
- result = ioctl(fd, BINDER_VERSION, &vers); //获取binder的version,并检查
- size_t maxThreads = 15;
- ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads); //设置线程池中最多线程数为15
- return fd;
- }
/work/ct/android42/frameworks/native/libs/binder/IServiceManager.cpp
- sp<IServiceManager> defaultServiceManager()
- {
- //不是第一次返回全局的IServiceManager
- if (gDefaultServiceManager != NULL)
- return gDefaultServiceManager;
- //第一次就new一个
- AutoMutex _l(gDefaultServiceManagerLock);
- if (gDefaultServiceManager == NULL) {
- //下面这一句创建了两个对象,BpBinder与BpServiceManager,
- //并让BpServiceManager的remote指向BpBinder
- gDefaultServiceManager = interface_cast<IServiceManager>(ProcessState::self()->getContextObject(NULL)); //2.1 - 2.2
- return gDefaultServiceManager;
- }
./frameworks/native/libs/binder/ProcessState.cpp
- sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& caller)
- {
- return getStrongProxyForHandle(0);
- }
- sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)
- {
- sp<IBinder> result;
- AutoMutex _l(mLock);
- handle_entry* e = lookupHandleLocked(handle);
- if (e != NULL) {
- IBinder* b = e->binder;
- if (b == NULL || !e->refs->attemptIncWeak(this)) {
- b = new BpBinder(handle);
- e->binder = b;
- if (b) e->refs = b->getWeakRefs();
- result = b;
- } else {
- result.force_set(b);
- e->refs->decWeak(this);
- }
- }
- return result;
- }
- BpBinder::BpBinder(int32_t handle)
- : mHandle(handle)
- , mAlive(1)
- , mObitsSent(0)
- , mObituaries(NULL)
- {
- extendObjectLifetime(OBJECT_LIFETIME_WEAK);
- IPCThreadState::self()->incWeakHandle(handle);
- }
知道ProcessState::self()->getContextObject(NULL)的作用之后,下述就可以重新定义为:
gDefaultServiceManager = interface_cast(ProcessState::self()->getContextObject(NULL));
即: gDefaultServiceManager = interface_cast(new BpBinder(0));
再看一下 interface_cast
- template<typename INTERFACE>
- inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)
- {
- return INTERFACE::asInterface(obj);
- }
- inline sp<IServiceManager> interface_cast(const sp<IBinder>& obj)
- {
- return IServiceManager::asInterface(obj);
- }
其实现是./frameworks/native/libs/binder/IServiceManager.cpp中的宏IMPLEMENT_META_INTERFACE
- android::sp<IServiceManager> IServiceManager::asInterface(const android::sp<android::IBinder>&obj)
- {
- android::sp<IServiceManager> intr;
- if (obj != NULL) {
- intr = static_cast<IServiceManager*>(obj->queryLocalInterface(IServiceManager::descriptor).get());
- if (intr == NULL) {
- //重新创建了一个BpServiceManager对象,并且remote指向了上述2.1中new的BpBiner对象
- intr = new BpServiceManager(obj);
- }
- }
- return intr;
- }
在./frameworks/av/media/libmediaplayerservice/MediaPlayerService.cpp
- void MediaPlayerService::instantiate() {
- defaultServiceManager()->addService(String16("media.player"), new MediaPlayerService());
- }
MediaPlayerService::initantiate
--> BpServiceManager::addService
在./frameworks/native/libs/binder/IServiceManager.cpp中
- virtual status_t addService(const String16& name, const sp<IBinder>& service,bool allowIsolated)
- {
- //构造数据包data,结果的状态放在reply中
- Parcel data, reply;
- data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
- data.writeString16(name);
- data.writeStrongBinder(service);
- data.writeInt32(allowIsolated ? 1 : 0);
- //remote指向BpBinder,所以就是调用BpBinder的transact
- status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);
- return err == NO_ERROR ? reply.readExceptionCode() : err;
- }
MediaPlayerService::initantiate
--> BpServiceManager::addService
--> BpBinder::transact
在./frameworks/native/libs/binder/BpBinder.cpp中
- status_t BpBinder::transact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
- {
- if (mAlive) {
- //BpBinder的transact没有干活,只是简单的把事情交给了IPCThreadState
- status_t status = IPCThreadState::self()->transact(mHandle, code, data, reply, flags);
- if (status == DEAD_OBJECT) mAlive = 0;
- return status;
- }
- return DEAD_OBJECT;
- }
--> BpServiceManager::addService
--> BpBinder::transact
--> IPCThreadState::transact
--> BpBinder::transact
在./frameworks/native/libs/binder/IPCThreadState.cpp中
- status_t IPCThreadState::transact(int32_t handle,uint32_t code, const Parcel& data,Parcel* reply, uint32_t flags)
- {
- writeTransactionData(BC_TRANSACTION, flags, handle, code, data, NULL); //将数据写到mOut中去,在下一步waitForResponse中正式发送
- waitForResponse(reply); //真正的发送数据到/dev/binder并接收从/dev/binder中反馈的数据
- return err;
- }
--> BpServiceManager::addService
--> BpBinder::transact
--> IPCThreadState::transact
--> waitForResponse
在./frameworks/native/libs/binder/IPCThreadState.cpp中
- status_t IPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult)
- {
- while (1) {
- talkWithDriver(); //与驱动进行通信并发送数据,利用ioctl
- cmd = mIn.readInt32(); //读取从驱动中反馈的信息,并作处理
- switch (cmd) {
- case BR_TRANSACTION_COMPLETE:
- case BR_DEAD_REPLY:
- case BR_FAILED_REPLY:
- case BR_ACQUIRE_RESULT:
- case BR_REPLY:
- default:
- executeCommand(cmd);
- }
0 0
- Cubietruck---14. binder分析_深入理解android第六章笔记
- Cubietruck---13.sp与wp分析_深入理解android第五章笔记
- Cubietruck---22.vold深入理解android第九章笔记
- [深入理解Android卷一全文-第六章]深入理解Binder
- [深入理解Android卷一全文-第六章]深入理解Binder
- Binder学习笔记---深入理解Android
- JHTP自测题_第六章_深入理解方法
- 《深入理解jvm》笔记---第六章
- Cubietruck---27.android蓝牙分析5_其它
- Cubietruck---28.android蓝牙分析6_初始化
- 深入分析Android Binder 驱动
- 深入分析Android Binder 驱动
- 深入分析Android Binder 驱动
- 深入理解 Android 的 IPC 机制--------Binder
- 深入理解Android之Binder通信机制
- 深入理解 Android 的 IPC 机制--------Binder
- android中Binder的深入理解
- 深入理解Android中的Binder机制
- 有关国内的流氓软件和强制安装软件(上传附件防部分流氓软件)
- 欢迎使用CSDN-markdown编辑器
- Cubietruck---13.sp与wp分析_深入理解android第五章笔记
- linux source命令
- 问题 R: 赫夫曼编码
- Cubietruck---14. binder分析_深入理解android第六章笔记
- “个人总结”最基础博弈套路,实力山寨
- 东方输入法真的有流氓么?
- Multidex何弃疗
- Cubietruck---15. input系统分析2
- iOS开发 UITabBar角标 红点形式 (tabBarItem.badgeValue)
- Cubietruck---16.设备的添加及数据分析
- hdu_5221_Occupation(树剖)
- 手把手教你禁止流氓软件进入电脑!小白福因~~~~