main_mediaserver

来源：互联网发布：apache php7配置编辑：程序博客网时间：2024/05/29 18:51

1.main_mediaserver入口

int main(int argc, char** argv){        sp<ProcessState> proc(ProcessState::self());        sp<IServiceManager> sm = defaultServiceManager();        LOGI("ServiceManager: %p", sm.get());        AudioFlinger::instantiate();        MediaPlayerService::instantiate();        //CameraService::instantiate();        AudioPolicyService::instantiate();        ProcessState::self()->startThreadPool();        IPCThreadState::self()->joinThreadPool();}

2.分析sp<ProcessState> proc(ProcessState::self());

2.1 ProcessState类定义在ProcessState.h中。

ProcessState类的构造方法是私有的，只能通过ProcessState的静态成员方法ProcessState::self()来初始化ProcessState对象。

ProcessState::self()方法的代码：

sp<ProcessState> ProcessState::self(){    if (gProcess != NULL) return gProcess;        AutoMutex _l(gProcessMutex);    if (gProcess == NULL) gProcess = new ProcessState;    return gProcess;}

如果gProcess不为空直接返回gProcess，否则就new一个ProcessState，并把new的对象保存在gProcess。下次再调用ProcessState::self()的时候，gProcess不为空就直接返回gProcess。

2.2 ProcessState的构造函数代码：

ProcessState::ProcessState()    : mDriverFD(open_driver())    , mVMStart(MAP_FAILED)    , mManagesContexts(false)    , mBinderContextCheckFunc(NULL)    , mBinderContextUserData(NULL)    , mThreadPoolStarted(false)    , mThreadPoolSeq(1){    if (mDriverFD >= 0) {        // XXX Ideally, there should be a specific define for whether we        // have mmap (or whether we could possibly have the kernel module        // availabla).        // mmap the binder, providing a chunk of virtual address space to receive transactions.        mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);        if (mVMStart == MAP_FAILED) {            // *sigh*            LOGE("Using /dev/binder failed: unable to mmap transaction memory.\n");            close(mDriverFD);            mDriverFD = -1;        }    }    LOG_ALWAYS_FATAL_IF(mDriverFD < 0, "Binder driver could not be opened.  Terminating.");}

2.3 open_driver代码：

static int open_driver(){    int fd = open("/dev/binder", O_RDWR);    if (fd >= 0) {        fcntl(fd, F_SETFD, FD_CLOEXEC);        int vers;        status_t result = ioctl(fd, BINDER_VERSION, &vers);        if (result == -1) {            LOGE("Binder ioctl to obtain version failed: %s", strerror(errno));            close(fd);            fd = -1;        }        if (result != 0 || vers != BINDER_CURRENT_PROTOCOL_VERSION) {            LOGE("Binder driver protocol does not match user space protocol!");            close(fd);            fd = -1;        }        size_t maxThreads = 15;        result = ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads);        if (result == -1) {            LOGE("Binder ioctl to set max threads failed: %s", strerror(errno));        }    } else {        LOGW("Opening '/dev/binder' failed: %s\n", strerror(errno));    }    return fd;}

2.4 我们再来看一下什么地方会使用mDriverFD文件描述符：

bool ProcessState::becomeContextManager(context_check_func checkFunc, void* userData){    if (!mManagesContexts) {        AutoMutex _l(mLock);        mBinderContextCheckFunc = checkFunc;        mBinderContextUserData = userData;        int dummy = 0;        status_t result = ioctl(mDriverFD, BINDER_SET_CONTEXT_MGR, &dummy);        if (result == 0) {            mManagesContexts = true;        } else if (result == -1) {            mBinderContextCheckFunc = NULL;            mBinderContextUserData = NULL;            LOGE("Binder ioctl to become context manager failed: %s\n", strerror(errno));        }    }    return mManagesContexts;}

这个方法基本是不可能会被调用到的。因为serviceManager只能有一个。

2.5 我们在来看看ProcessState的startThreadPool方法：

void ProcessState::startThreadPool(){    AutoMutex _l(mLock);    if (!mThreadPoolStarted) {        mThreadPoolStarted = true;        spawnPooledThread(true);    }}

startThreadPool也是单实例的，如果mThreadPoolStarted为false才会spawnPooledThread.

2.6 spawnPooledThread(bool isMain)代码：

void ProcessState::spawnPooledThread(bool isMain){    if (mThreadPoolStarted) {        int32_t s = android_atomic_add(1, &mThreadPoolSeq);        char buf[32];        sprintf(buf, "Binder Thread #%d", s);        LOGV("Spawning new pooled thread, name=%s\n", buf);        sp<Thread> t = new PoolThread(isMain);        t->run(buf);    }}

2.7 PoolThread类

class PoolThread : public Thread{public:    PoolThread(bool isMain)        : mIsMain(isMain)    {    }    protected:    virtual bool threadLoop()    {        IPCThreadState::self()->joinThreadPool(mIsMain);        return false;    }        const bool mIsMain;};

PoolThread继承了Thread类，当调用PoolThread类的run()方法的时候会调用到PoolThread::threadLoop()

2.8 我们先来看一下IPCThreadState类的定义

class IPCThreadState{public:    static  IPCThreadState*     self();    static  IPCThreadState*     selfOrNull();  // self(), but won't instantiate                sp<ProcessState>    process();                        status_t            clearLastError();            int                 getCallingPid();            int                 getCallingUid();            void                setStrictModePolicy(int32_t policy);            int32_t             getStrictModePolicy() const;            void                setLastTransactionBinderFlags(int32_t flags);            int32_t             getLastTransactionBinderFlags() const;            int64_t             clearCallingIdentity();            void                restoreCallingIdentity(int64_t token);                        void                flushCommands();            void                joinThreadPool(bool isMain = true);                        // Stop the local process.            void                stopProcess(bool immediate = true);                        status_t            transact(int32_t handle,                                         uint32_t code, const Parcel& data,                                         Parcel* reply, uint32_t flags);            void                incStrongHandle(int32_t handle);            void                decStrongHandle(int32_t handle);            void                incWeakHandle(int32_t handle);            void                decWeakHandle(int32_t handle);            status_t            attemptIncStrongHandle(int32_t handle);    static  void                expungeHandle(int32_t handle, IBinder* binder);            status_t            requestDeathNotification(   int32_t handle,                                                            BpBinder* proxy);             status_t            clearDeathNotification( int32_t handle,                                                        BpBinder* proxy);     static  void                shutdown();        // Call this to disable switching threads to background scheduling when    // receiving incoming IPC calls.  This is specifically here for the    // Android system process, since it expects to have background apps calling    // in to it but doesn't want to acquire locks in its services while in    // the background.    static  void                disableBackgroundScheduling(bool disable);    private:                                IPCThreadState();                                ~IPCThreadState();            status_t            sendReply(const Parcel& reply, uint32_t flags);            status_t            waitForResponse(Parcel *reply,                                                status_t *acquireResult=NULL);            status_t            talkWithDriver(bool doReceive=true);            status_t            writeTransactionData(int32_t cmd,                                                     uint32_t binderFlags,                                                     int32_t handle,                                                     uint32_t code,                                                     const Parcel& data,                                                     status_t* statusBuffer);            status_t            executeCommand(int32_t command);                        void                clearCaller();                static  void                threadDestructor(void *st);    static  void                freeBuffer(Parcel* parcel,                                           const uint8_t* data, size_t dataSize,                                           const size_t* objects, size_t objectsSize,                                           void* cookie);        const   sp<ProcessState>    mProcess;    const   pid_t               mMyThreadId;            Vector<BBinder*>    mPendingStrongDerefs;            Vector<RefBase::weakref_type*> mPendingWeakDerefs;                        Parcel              mIn;            Parcel              mOut;            status_t            mLastError;            pid_t               mCallingPid;            uid_t               mCallingUid;            int32_t             mStrictModePolicy;            int32_t             mLastTransactionBinderFlags;};}; // namespace android

我们发现PoolThread类的构造方法的也是私有的。所以我们还是只能通过PoolThread::self()方法来创建对象，我们来看一下PoolThread::self():

IPCThreadState* IPCThreadState::self(){    if (gHaveTLS) {restart:        const pthread_key_t k = gTLS;        IPCThreadState* st = (IPCThreadState*)pthread_getspecific(k);        if (st) return st;        return new IPCThreadState;    }        if (gShutdown) return NULL;        pthread_mutex_lock(&gTLSMutex);    if (!gHaveTLS) {        if (pthread_key_create(&gTLS, threadDestructor) != 0) {            pthread_mutex_unlock(&gTLSMutex);            return NULL;        }        gHaveTLS = true;    }    pthread_mutex_unlock(&gTLSMutex);    goto restart;}

IPCThreadState::self()方法返回一个单实例的IPCThreadState对象。IPCThreadState通过pthread_setspecific()保存在gTLS中；

这个方法有点绕，我们模拟写一个c代码验证一下是否确实返回一个单实例对象；

#include <stdio.h>#include <stdlib.h>#include <string.h>#include <pthread.h>static int gHaveTLS = 0;static pthread_key_t gTLS = 0;static pthread_mutex_t gTLSMutex = PTHREAD_MUTEX_INITIALIZER;typedef struct{    char name[16];    int age;}IPCThreadState;void threadDestructor(void *st){IPCThreadState* self = (IPCThreadState*)st;if (self) {free(self);}}IPCThreadState* self(){restart:    if (gHaveTLS) {        const pthread_key_t k = gTLS;        IPCThreadState* st = (IPCThreadState*)pthread_getspecific(k);        if (st)         {            printf("st is not null\n");            return st;        }        printf("malloc IPCThreadState\n");        IPCThreadState *this = malloc(sizeof(IPCThreadState));        pthread_setspecific(gTLS, this);        return this;     }        pthread_mutex_lock(&gTLSMutex);    if (!gHaveTLS) {        printf("pthread_key_create\n");        if (pthread_key_create(&gTLS, threadDestructor) != 0) {            pthread_mutex_unlock(&gTLSMutex);            return NULL;        }        gHaveTLS = 1;    }    pthread_mutex_unlock(&gTLSMutex);    goto restart;}int main(int argc, char *argv[]){    IPCThreadState* s1 = self();    printf("The address of s1 :%p\n",s1);    IPCThreadState* s2 = self();    printf("The address of s2 :%p\n",s2);    IPCThreadState* s3 = self();    printf("The address of s3 :%p\n",s3);    IPCThreadState* s4 = self();    printf("The address of s4 :%p\n",s4);    IPCThreadState* s5 = self();    printf("The address of s5 :%p\n",s5);    IPCThreadState* s6 = self();    printf("The address of s6 :%p\n",s6);    return 0;}

运行结果：

ubuntu:~/workspace/test_project$ ./main pthread_key_createmalloc IPCThreadStateThe address of s1 :0x8be2008st is not nullThe address of s2 :0x8be2008st is not nullThe address of s3 :0x8be2008st is not nullThe address of s4 :0x8be2008st is not nullThe address of s5 :0x8be2008st is not nullThe address of s6 :0x8be2008

2.9 我们来看一下IPCThreadState的构造函数IPCThreadState::IPCThreadState()

IPCThreadState::IPCThreadState()    : mProcess(ProcessState::self()),      mMyThreadId(androidGetTid()),      mStrictModePolicy(0),      mLastTransactionBinderFlags(0){    pthread_setspecific(gTLS, this);    clearCaller();    mIn.setDataCapacity(256);    mOut.setDataCapacity(256);}

这个构造函数把单实例的ProcessState对象保存在IPCThreadState的成员变量mProcess中，同时把单实例的IPCThreadState对象保存在gTLS中。

3.分析sp<IServiceManager> sm = defaultServiceManager();

3.1先看一下defaultServiceManager()定义（IServiceManager.cpp）：

sp<IServiceManager> defaultServiceManager(){    if (gDefaultServiceManager != NULL) return gDefaultServiceManager;        {        AutoMutex _l(gDefaultServiceManagerLock);        if (gDefaultServiceManager == NULL) {            gDefaultServiceManager = interface_cast<IServiceManager>(                ProcessState::self()->getContextObject(NULL));        }    }        return gDefaultServiceManager;}

defaultServiceManager()返回单实例对象gDefaultServiceManager，如果gDefaultServiceManager为空，调用：

 gDefaultServiceManager = interface_cast<IServiceManager>(                ProcessState::self()->getContextObject(NULL));

3.2 getContextObject(NULL)实现：

sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& caller){    return getStrongProxyForHandle(0);}

所以：

gDefaultServiceManager = interface_cast<IServiceManager>(ProcessState::self()->getStrongProxyForHandle(NULL));

相当于：

gDefaultServiceManager = interface_cast<IServiceManager>(ProcessState::self()->getStrongProxyForHandle(0));

3.3 getStrongProxyForHandle定义

sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle){    sp<IBinder> result;    AutoMutex _l(mLock);    handle_entry* e = lookupHandleLocked(handle);    if (e != NULL) {        // We need to create a new BpBinder if there isn't currently one, OR we        // are unable to acquire a weak reference on this current one.  See comment        // in getWeakProxyForHandle() for more info about this.        IBinder* b = e->binder;        if (b == NULL || !e->refs->attemptIncWeak(this)) {            b = new BpBinder(handle);             e->binder = b;            if (b) e->refs = b->getWeakRefs();            result = b;        } else {            // This little bit of nastyness is to allow us to add a primary            // reference to the remote proxy when this team doesn't have one            // but another team is sending the handle to us.            result.force_set(b);            e->refs->decWeak(this);        }    }    return result;}

3.4 lookupHandleLocked定义

ProcessState::handle_entry* ProcessState::lookupHandleLocked(int32_t handle){    const size_t N=mHandleToObject.size();    if (N <= (size_t)handle) {        handle_entry e;        e.binder = NULL;        e.refs = NULL;        status_t err = mHandleToObject.insertAt(e, N, handle+1-N);        if (err < NO_ERROR) return NULL;    }    return &mHandleToObject.editItemAt(handle);}

3.5 mHandleToObject定义

Vector<handle_entry>mHandleToObject;

3.6 handle_entry

            struct handle_entry {                IBinder* binder;                RefBase::weakref_type* refs;            };

3.7 IBinder

所以：

gDefaultServiceManager = interface_cast<IServiceManager>(ProcessState::self()->getContextObject(NULL));相当于：gDefaultServiceManager = interface_cast<IServiceManager>(new BpBinder(0));

3.8 interface_cast

template<typename INTERFACE>inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj){    return INTERFACE::asInterface(obj);}

所以：

gDefaultServiceManager = interface_cast<IServiceManager>(ProcessState::self()->getContextObject(NULL));相当于：gDefaultServiceManager = IServiceManager::asInterface(new BpBinder(0));

3.8 来看一下IServiceManager类

class IServiceManager : public IInterface{public:    DECLARE_META_INTERFACE(ServiceManager);    /**     * Retrieve an existing service, blocking for a few seconds     * if it doesn't yet exist.     */    virtual sp<IBinder>         getService( const String16& name) const = 0;    /**     * Retrieve an existing service, non-blocking.     */    virtual sp<IBinder>         checkService( const String16& name) const = 0;    /**     * Register a service.     */    virtual status_t            addService( const String16& name,                                            const sp<IBinder>& service) = 0;    /**     * Return list of all existing services.     */    virtual Vector<String16>    listServices() = 0;    enum {        GET_SERVICE_TRANSACTION = IBinder::FIRST_CALL_TRANSACTION,        CHECK_SERVICE_TRANSACTION,        ADD_SERVICE_TRANSACTION,        LIST_SERVICES_TRANSACTION,    };};

我们把宏DECLARE_META_INTERFACE(ServiceManager)展开：

class IServiceManager : public IInterface{public:                       static const android::String16 descriptor;                              static android::sp<ServiceManager> asInterface(                                   const android::sp<android::IBinder>& obj);                      virtual const android::String16& getInterfaceDescriptor() const;        IServiceManager();                                                         virtual ~IServiceManager();       /**     * Retrieve an existing service, blocking for a few seconds     * if it doesn't yet exist.     */    virtual sp<IBinder>         getService( const String16& name) const = 0;    /**     * Retrieve an existing service, non-blocking.     */    virtual sp<IBinder>         checkService( const String16& name) const = 0;    /**     * Register a service.     */    virtual status_t            addService( const String16& name,                                            const sp<IBinder>& service) = 0;    /**     * Return list of all existing services.     */    virtual Vector<String16>    listServices() = 0;    enum {        GET_SERVICE_TRANSACTION = IBinder::FIRST_CALL_TRANSACTION,        CHECK_SERVICE_TRANSACTION,        ADD_SERVICE_TRANSACTION,        LIST_SERVICES_TRANSACTION,    };};

3.9 展开IServiceManager中的IMPLEMENT_META_INTERFACE(ServiceManager, "android.os.IServiceManager");

 const android::String16 IServiceManager::descriptor("android.os.IServiceManager");                 const android::String16&                                                        IServiceManager::getInterfaceDescriptor() const {                      return IServiceManager::descriptor;                                    }                                                                       android::sp<IServiceManager> IServiceManager::asInterface(const android::sp<android::IBinder>& obj)                       {                                                                           android::sp<IServiceManager> intr;                                         if (obj != NULL) {                                                          intr = static_cast<IServiceManager*>(obj->queryLocalInterface(IServiceManager::descriptor).get());                           if (intr == NULL) {                                                         intr = new BpServiceManager（obj);                                      }                                                                   }                                                                       return intr;                                                        }                                                                       IServiceManager::IServiceManager() { }                                       IServiceManager::~IServiceManager() { }

queryLocalInterface

sp<IInterface>  IBinder::queryLocalInterface(const String16& descriptor){    return NULL;}

所以，IServiceManager::asInterface实际上就是：

    android::sp<IServiceManager> IServiceManager::asInterface(const android::sp<android::IBinder>& obj)                       {                                                                           android::sp<IServiceManager> intr;                                         if (obj != NULL) {                                                              intr = new BpServiceManager（obj);                                                                                            }                                                                       return intr;                                                        }

所以：

gDefaultServiceManager = interface_cast<IServiceManager>(ProcessState::self()->getContextObject(NULL));  相当于：  gDefaultServiceManager = new BpServiceManager（new BpBinder(0));

0 0