Android Binder驱动分析六 addservice源码分析

谁借莪１个温暖的怀抱￠ 2022-10-22 07:57 4阅读 0赞

承接上文：  
[Android Binder驱动分析五 addservice源码分析  
][Android Binder_ addservice_]

`servicemanager`发送一个指令`BINDER_WORK_TRANSACTION`给`mediaplayservice`,而后唤醒其线程。

`mediaplayservice`唤醒后会在`binder_thread_read`，由于这个函数出现过很多次了这里直接简单略过

//drivers/staging/android/binder.c
    
    static int binder_thread_read(struct binder_proc *proc,
    			      struct binder_thread *thread,
    			      binder_uintptr_t binder_buffer, size_t size,
    			      binder_size_t *consumed, int non_block)
    {
        
    	void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
    	void __user *ptr = buffer + *consumed;
    	void __user *end = buffer + size;
    
    	int ret = 0;
    	int wait_for_proc_work;
    
    
    
    	//这里返回false.   binder_available_for_proc_work_ilocked如果有事务就返回true，没有就返回false
    	wait_for_proc_work = binder_available_for_proc_work_ilocked(thread);
    
    
    
    
    	if (non_block) {
        
    		//...
    	} else {
        
    		//如果没有任务就会被阻塞,servicemanager唤醒在这
    		ret = binder_wait_for_work(thread, wait_for_proc_work);
    	}
    
    
    	while (1) {
        
    		uint32_t cmd;
    		struct binder_transaction_data_secctx tr;
    		struct binder_transaction_data *trd = &tr.transaction_data;
    		struct binder_work *w = NULL;
    		struct list_head *list = NULL;
    		struct binder_transaction *t = NULL;
    		struct binder_thread *t_from;
    		size_t trsize = sizeof(*trd);
    
    		//待办事务可能存在线程对象todo 或者进程对象的proc的todo
    		if (!binder_worklist_empty_ilocked(&thread->todo))
    			list = &thread->todo;
    		else if (!binder_worklist_empty_ilocked(&proc->todo) &&
    			   wait_for_proc_work)
    			list = &proc->todo;
    		
    
    		if (end - ptr < sizeof(tr) + 4) {
        
    			binder_inner_proc_unlock(proc);
    			break;
    		}
    		
    		//binder_work * w
    		//从待办事务取出对象
    		w = binder_dequeue_work_head_ilocked(list);
    
    		switch (w->type) {
        
    			//这是mediaplayservice传入的事务类型
    			case BINDER_WORK_TRANSACTION: {
        
    				t = container_of(w, struct binder_transaction, work);
    			} break;
    		}
    
    		if (!t)
    			continue;
    
    		//这里是空需要注意
    		if (t->buffer->target_node) {
        
    			//略
    		} else {
        
    			trd->target.ptr = 0;
    			trd->cookie = 0;
    			//返回给用户空间的指令
    			cmd = BR_REPLY;
    		}
    
    	
    	//略
    	return 0;
    }

// frameworks\native\libs\binder\IPCThreadState.cpp
    status_t IPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult)
    {
        
        uint32_t cmd;
        int32_t err;
    
        while (1) {
        
        	//返回到这继续向下走
            if ((err=talkWithDriver()) < NO_ERROR) break;
            
          	//如果没有返回信息那么继续循环读取binder驱动
            if (mIn.dataAvail() == 0) continue;
            //读取binder驱动返回的前4字节，这四个字节表示binder驱动是什么消息类型
            cmd = (uint32_t)mIn.readInt32();
            
    		//根据返回的binder返回的命令做出操作
    		//首先读取BR_NOOP
            switch (cmd) {
        
            
    	     case BR_REPLY:
                {
        
                    binder_transaction_data tr;
                    err = mIn.read(&tr, sizeof(tr));
                    if (err != NO_ERROR) goto finish;
    
                    if (reply) {
        
                    	//重置一些内存变量，这里不重要
                    }
                }
                //可以看到退出了死循环
                goto finish;
    
               
            }
        }
        finish:
        if (err != NO_ERROR) {
        
            if (acquireResult) *acquireResult = err;
            if (reply) reply->setError(err);
            mLastError = err;
        }
        
        return err;
    }

上面便完成了整个addservice的全过程,于是MediaPlayerService::instantiate()就完成了任务了，后面便是其他的代码，

//frameworks/av/media/mediaserver/main_mediaserver.cpp
    
    int main(int argc __unused, char** argv)
    {
        
    		//知识点sp<xxx> 类似java的WeakReference<xxxxx>
    		//sp 内部的 泛型/模板 必须是RefBase,内部实际使用引用计数的方式实现
    
    		//每个进程都有一个单例ProcessState对象
    		//也就是说ProcessState::self()多次也是返回同一对象
            sp<ProcessState> proc;
            //IServiceManager是ServiceManager暴露出来的功能接口对象
    		//比如查询服务
            sp<IServiceManager> sm =  new BpServiceManager(obj);;
            //开启各类服务。我们只需要关注MediaPlayerService
            MediaPlayerService::instantiate();
            //开启其他各类服务，我们只以MediaPlayerService作为举例     
            //....
            registerExtensions();
            //开启子线程去相应binder驱动发来的信息
            ProcessState::self()->startThreadPool();
            IPCThreadState::self()->joinThreadPool();
    }

[Android Binder_ addservice_]: https://fanmingyi.blog.csdn.net/article/details/115442557