Generate AudioFlinger Service

media_server程序会启动AudioFlinger服务。相关代码如下：

// frameworks/base/media/mediaserver/main_mediaserver.cpp<br /> int main(int argc, char** argv)<br /> {<br /> sp<ProcessState> proc(ProcessState::self());<br /> sp<IServiceManager> sm = defaultServiceManager();<br /> LOGI("ServiceManager: %p", sm.get());<br /> AudioFlinger::instantiate();<br /> MediaPlayerService::instantiate();<br /> CameraService::instantiate();<br /> AudioPolicyService::instantiate();<br /> ProcessState::self()->startThreadPool();<br /> IPCThreadState::self()->joinThreadPool();<br /> }

AudioFlinger::instantiate()函数会调用IServiceManager::addService远程调用。

// frameworks/base/libs/audioflinger/AudioFlinger.cpp<br /> void AudioFlinger::instantiate() {<br /> defaultServiceManager()->addService(<br /> String16("media.audio_flinger"), new AudioFlinger());<br /> }

AudioFlinger继承自BnAudioFlinger，BnAudioFlinger是一个BnInterface模板类的实例。

// frameworks/base/include/media/IAudioFlinger.h<br /> class BnAudioFlinger : public BnInterface<IAudioFlinger><br /> {<br /> public:<br /> virtual status_t onTransact( uint32_t code,<br /> const Parcel& data,<br /> Parcel* reply,<br /> uint32_t flags = 0);<br /> };

BnInterface继承自BBinder。

// frameworks/base/include/binder/IInterface.h<br /> template<typename INTERFACE><br /> class BnInterface : public INTERFACE, public BBinder<br /> {<br /> public:<br /> virtual sp<IInterface> queryLocalInterface(const String16& _descriptor);<br /> virtual const String16& getInterfaceDescriptor() const;<br /> protected:<br /> virtual IBinder* onAsBinder();<br /> };<br /> template<typename INTERFACE><br /> IBinder* BnInterface<INTERFACE>::onAsBinder()<br /> {<br /> return this;<br /> }

根据BnInterface的实现，我们看到传递给IServiceManager::addService的参数是一个AudioFlinger实例的地址。BBinder继承自IBinder，它的transact()函数调用onTransact虚函数（多态）。

// frameworks/base/include/binder/Binder.cpp<br /> status_t BBinder::transact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)<br /> {<br /> data.setDataPosition(0);<br /> status_t err = NO_ERROR;<br /> switch (code) {<br /> case PING_TRANSACTION:<br /> reply->writeInt32(pingBinder());<br /> break;<br /> default:<br /> err = onTransact(code, data, reply, flags);<br /> break;<br /> }<br /> if (reply != NULL) {<br /> reply->setDataPosition(0);<br /> }<br /> return err;<br /> }

最重要的虚函数是onTransact()。BnAudioFlinger实现了该虚函数。在本文的例子中我们只需要关注SET_MODE分支。

// frameworks/base/media/libmedia/IaudioFlinger.cpp<br /> status_t BnAudioFlinger::onTransact(<br /> uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)<br /> {<br /> switch(code) {<br /> ……<br /> case SET_MODE: {<br /> CHECK_INTERFACE(IAudioFlinger, data, reply);<br /> int mode = data.readInt32();<br /> reply->writeInt32( setMode(mode) );<br /> return NO_ERROR;<br /> } break;<br /> ……<br /> }

media_server会通过IPCThreadState::joinThreadPool进入一个循环，就像service_manager，它会通过调用talkWithDriver()函数等待其他进程传入数据。

// frameworks/base/libs/binder/IPCThreadState.cpp<br /> void IPCThreadState::joinThreadPool(bool isMain)<br /> {<br /> mOut.writeInt32(isMain ? BC_ENTER_LOOPER : BC_REGISTER_LOOPER);<br /> status_t result;<br /> do {<br /> int32_t cmd;</p> <p> ……</p> <p> // now get the next command to be processed, waiting if necessary<br /> result = talkWithDriver();<br /> if (result >= NO_ERROR) {<br /> size_t IN = mIn.dataAvail();<br /> if (IN < sizeof(int32_t)) continue;<br /> cmd = mIn.readInt32();<br /> IF_LOG_COMMANDS() {<br /> alog << "Processing top-level Command: "<br /> << getReturnString(cmd) << endl;<br /> }<br /> result = executeCommand(cmd);<br /> }<br /> ……<br /> } while (result != -ECONNREFUSED && result != -EBADF);<br /> mOut.writeInt32(BC_EXIT_LOOPER);<br /> talkWithDriver(false);<br /> }

假设你想要实现你自己的IFunnyTest服务，必须遵循以下步骤：

• 实现你自己的BnFunnyTest类；
• 在执行你的服务的进程中，调用IPCThreadState::joinThreadPool()函数

RPC Call IServiceManager::addService

当我们调用IServiceManager::addService时，实际上调用的是BpServiceManager::addService。

// frameworks/base/libs/binder/IServiceManager.cpp<br /> class BpServiceManager : public BpInterface<IServiceManager><br /> {<br /> public:<br /> ……<br /> virtual status_t addService(const String16& name, const sp<IBinder>& service)<br /> {<br /> Parcel data, reply;<br /> data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());<br /> data.writeString16(name);<br /> data.writeStrongBinder(service);<br /> status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);<br /> return err == NO_ERROR ? reply.readInt32() : err;<br /> }<br /> ……<br /> }

Parcel类型很简单。我们可以把它认为是一块连续的缓冲区。注意，参数service是指向BBinder对象（AudioFlinger从Bn继承来）的指针。

// frameworks/base/libs/binder/Parcel.cpp<br /> status_t Parcel::writeStrongBinder(const sp<IBinder>& val)<br /> {<br /> return flatten_binder(ProcessState::self(), val, this);<br /> }

flatten_binder会生成一个Binder命令。因为BBinder是一个本地的binder对象，因此该代码分支标为红色。

// frameworks/base/libs/binder/Parcel.cpp<br /> status_t flatten_binder(const sp<ProcessState>& proc,<br /> const sp<IBinder>& binder, Parcel* out)<br /> {<br /> flat_binder_object obj;</p> <p> obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;<br /> if (binder != NULL) {<br /> IBinder *local = binder->localBinder();<br /> if (!local) {<br /> BpBinder *proxy = binder->remoteBinder();<br /> if (proxy == NULL) {<br /> LOGE("null proxy");<br /> }<br /> const int32_t handle = proxy ? proxy->handle() : 0;<br /> obj.type = BINDER_TYPE_HANDLE;<br /> obj.handle = handle;<br /> obj.cookie = NULL;<br /> } else {<br /> obj.type = BINDER_TYPE_BINDER;<br /> obj.binder = local->getWeakRefs();<br /> obj.cookie = local;<br /> }<br /> } else {<br /> obj.type = BINDER_TYPE_BINDER;<br /> obj.binder = NULL;<br /> obj.cookie = NULL;<br /> }</p> <p> return finish_flatten_binder(binder, obj, out);<br /> }

注意红色的代码行。本地地址被放入到一个包（以后会用到）中。在该addService远程调用的包构造完成后，BpServiceManager::addService()将会调用BpBinder的transact()函数。

// frameworks/base/libs/binder/BpBinder.cpp<br /> status_t BpBinder::transact(<br /> uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)<br /> {<br /> // Once a binder has died, it will never come back to life.<br /> if (mAlive) {<br /> status_t status = IPCThreadState::self()->transact(<br /> mHandle, code, data, reply, flags);<br /> if (status == DEAD_OBJECT) mAlive = 0;<br /> return status;<br /> }<br /> return DEAD_OBJECT;<br /> }

BpBinder调用IPCThreadState::transact来根据mHandle启动一个针对binder对象的（处理）事务。在本文的例子中，mHandle为0。

// frameworks/base/libs/binder/IPCThreadState.cpp<br /> status_t IPCThreadState::transact(int32_t handle,<br /> uint32_t code, const Parcel& data,<br /> Parcel* reply, uint32_t flags)<br /> {<br /> status_t err = data.errorCheck();<br /> flags |= TF_ACCEPT_FDS;<br /> IF_LOG_TRANSACTIONS() {<br /> TextOutput::Bundle _b(alog);<br /> alog << "BC_TRANSACTION thr " << (void*)pthread_self() << " / hand "<br /> << handle << " / code " << TypeCode(code) << ": "<br /> << indent << data << dedent << endl;<br /> }</p> <p> if (err == NO_ERROR) {<br /> LOG_ONEWAY(">>>> SEND from pid %d uid %d %s", getpid(), getuid(),<br /> (flags & TF_ONE_WAY) == 0 ? "READ REPLY" : "ONE WAY");<br /> err = writeTransactionData(BC_TRANSACTION, flags, handle, code, data, NULL);<br /> }</p> <p> if (err != NO_ERROR) {<br /> if (reply) reply->setError(err);<br /> return (mLastError = err);<br /> }</p> <p> if ((flags & TF_ONE_WAY) == 0) {<br /> if (reply) {<br /> err = waitForResponse(reply);<br /> } else {<br /> Parcel fakeReply;<br /> err = waitForResponse(&fakeReply);<br /> }</p> <p> IF_LOG_TRANSACTIONS() {<br /> TextOutput::Bundle _b(alog);<br /> alog << "BR_REPLY thr " << (void*)pthread_self() << " / hand "<br /> << handle << ": ";<br /> if (reply) alog << indent << *reply << dedent << endl;<br /> else alog << "(none requested)" << endl;<br /> }<br /> } else {<br /> err = waitForResponse(NULL, NULL);<br /> }</p> <p> return err;<br /> }

IPCThreadState::transact首先调用writeTransactionData函数为binder内核驱动构造一个transaction结构。注意以下几行，它对于binder内核驱动识别事务（transaction）目标非常重要

// frameworks/base/libs/binder/IPCThreadState.cpp<br /> status_t IPCThreadState::writeTransactionData(int32_t cmd, uint32_t binderFlags,<br /> int32_t handle, uint32_t code, const Parcel& data, status_t* statusBuffer)<br /> {<br /> binder_transaction_data tr;<br /> tr.target.handle = handle;<br /> tr.code = code;<br /> tr.flags = binderFlags;</p> <p> const status_t err = data.errorCheck();<br /> if (err == NO_ERROR) {<br /> tr.data_size = data.ipcDataSize();<br /> tr.data.ptr.buffer = data.ipcData();<br /> tr.offsets_size = data.ipcObjectsCount()*sizeof(size_t);<br /> tr.data.ptr.offsets = data.ipcObjects();<br /> } else if (statusBuffer) {<br /> tr.flags |= TF_STATUS_CODE;<br /> *statusBuffer = err;<br /> tr.data_size = sizeof(status_t);<br /> tr.data.ptr.buffer = statusBuffer;<br /> tr.offsets_size = 0;<br /> tr.data.ptr.offsets = NULL;<br /> } else {<br /> return (mLastError = err);<br /> }</p> <p> mOut.writeInt32(cmd);<br /> mOut.write(&tr, sizeof(tr));</p> <p> return NO_ERROR;<br /> }

然后waitForResponse()通过talkWithDriver()函数去调用BINDER_WRITE_READ的ioctl()。

// frameworks/base/libs/binder/IPCThreadState.cpp<br /> #if defined(HAVE_ANDROID_OS)<br /> if (ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr) >= 0)<br /> err = NO_ERROR;<br /> else<br /> err = -errno;<br /> #else

于是到现在为止，事务数据已经发送到了binder内核驱动。

小结：

Proxy（代理）对象会为RPC调用生成必需的包，然后调用BINDER_WRITE_READ将包写入binder内核驱动。该包为格式化的。对于RPC调用，它是BC_TRANSACTION类型的包。

假设你要实现你自己的IFunnyTest的服务，你必须要：

• 在服务运行的进程中调用IServiceManager::addService()函数将服务注册到servier_manger。