2019独角兽企业重金招聘Python工程师标准>>>

   1: sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)

   2: {

   3:     sp<IBinder> result;

   4: 

   5:     AutoMutex _l(mLock);

   6: 

   7:     handle_entry* e = lookupHandleLocked(handle);

   8: 

   9:     if (e != NULL) {

  10:         // We need to create a new BpBinder if there isn't currently one, OR we

  11:         // are unable to acquire a weak reference on this current one.  See comment

  12:         // in getWeakProxyForHandle() for more info about this.

  13:         IBinder* b = e->binder;

  14:         if (b == NULL || !e->refs->attemptIncWeak(this)) {

  15:             b = new BpBinder(handle);

  16:             e->binder = b;

  17:             if (b) e->refs = b->getWeakRefs();

  18:             result = b;

  19:         } else {

  20:             // This little bit of nastyness is to allow us to add a primary

  21:             // reference to the remote proxy when this team doesn't have one

  22:             // but another team is sending the handle to us.

  23:             result.force_set(b);

  24:             e->refs->decWeak(this);

  25:         }

  26:     }

  27: 

  28:     return result;

  29: }

    getWeakProxyForHandle函数的作用是根据一个binder句柄（上文《 Android系统的Binder机制之一——Service Manager 》提到Binder驱动为每个Service维护一个Binder句柄，客户端可以通过句柄来和Service通讯）创建对应的Service代理对象。

   1: ProcessState::ProcessState()

   2:     : mDriverFD(open_driver())

   3:     , mVMStart(MAP_FAILED)

   4:     , mManagesContexts(false)

   5:     , mBinderContextCheckFunc(NULL)

   6:     , mBinderContextUserData(NULL)

   7:     , mThreadPoolStarted(false)

   8:     , mThreadPoolSeq(1)

   9: {

  10:     if (mDriverFD >= 0) {

  11:         // XXX Ideally, there should be a specific define for whether we

  12:         // have mmap (or whether we could possibly have the kernel module

  13:         // availabla).

  14: #if !defined(HAVE_WIN32_IPC)

  15:         // mmap the binder, providing a chunk of virtual address space to receive transactions.

  16:         mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);

  17:         if (mVMStart == MAP_FAILED) {

  18:             // *sigh*

  19:             LOGE("Using /dev/binder failed: unable to mmap transaction memory.\n");

  20:             close(mDriverFD);

  21:             mDriverFD = -1;

  22:         }

  23: #else

  24:         mDriverFD = -1;

  25: #endif

  26:     }

  27:     if (mDriverFD < 0) {

  28:         // Need to run without the driver, starting our own thread pool.

  29:     }

  30: }

    mDriverFD保存了/dev/binder设备的句柄，如果仔细查看ProcessState的源码会发现这个句柄不会被ProcessState对象使用。那么保存这个句柄做什么用呢？被谁使用呢？非常奇怪。经过查看ProcessState的头文件，发现如下代码：

   1: friend class IPCThreadState;

    发现IPCThreadState是ProcessState的友元类，那么就可以怀疑这个句柄是被IPCThreadState的对象使用的，然后查看代码发现确实如此。

   1: ...........

   2: if (ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr) >= 0)

   3:     err = NO_ERROR;

   4: else

   5:     err = -errno;

   6: ...........

    IPCThreadState通过ioctl系统调用对ProcessState打开的句柄进行读写。这样我们也可以看出IPCThreadState对象的作用：

     我们这里可以再深入地聊一下，不管是客户端进程和Service进程都是需要用IPCThreadState来和binder设备通讯的。如果是客户端进程则通过服务代理BpBinder对象，调用transact函数，该函数作用就是把客户端的请求写入binder设备另一端的Service进程，具体请参阅IPCThreadState类的transact方法。作为Service进程，当他完成初始化工作之后，他需要他们需要进入循环状态等待客户端的请求，Service进程调用它的IPCThreadState对象的joinThreadPool方法，开始轮询binder设备，等待客户端请求的到来，后面我们讨论Service时候会进一步讨论joinThreadPool方法。有兴趣的朋友可以先通过查看代码来了解joinThreadPool方法。

    上文关于ProcessState的介绍提到了，客户端进程创建的Service代理对象其实就是BpBinder对象。

    我们首先了解怎样创建BpBinder对象。

   1: BpBinder::BpBinder(int32_t handle)

   2:     : mHandle(handle)

   3:     , mAlive(1)

   4:     , mObitsSent(0)

   5:     , mObituaries(NULL)

   6: {

   7:     LOGV("Creating BpBinder %p handle %d\n", this, mHandle);

   8: 

   9:     extendObjectLifetime(OBJECT_LIFETIME_WEAK);

  10:     IPCThreadState::self()->incWeakHandle(handle);

  11: }

    我们可以看出首先是通过IPCThreadState读写binder设备增加中相应binder句柄上的Service的引用计数。然后本地保存代理Service的binder句柄mHandle。

   1: status_t BpBinder::transact(

   2:     uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)

   3: {

   4:     // Once a binder has died, it will never come back to life.

   5:     if (mAlive) {

   6:         status_t status = IPCThreadState::self()->transact(

   7:             mHandle, code, data, reply, flags);

   8:         if (status == DEAD_OBJECT) mAlive = 0;

   9:         return status;

  10:     }

  11: 

  12:     return DEAD_OBJECT;

  13: }

在transact方法中，还是调用客户进程的IPCThreadState对象来完成对相应Service请求。注意transact方法是同步方法，将会挂住客户进程的当前线程，直到service把请求处理完成，并返回结果。这时客户进程当前线程的transact方法返回。

   1: sp<IServiceManager> defaultServiceManager()

   2: {

   3:     if (gDefaultServiceManager != NULL) return gDefaultServiceManager;

   4:

   5:     {

   6:         AutoMutex _l(gDefaultServiceManagerLock);

   7:         if (gDefaultServiceManager == NULL) {

   8:             gDefaultServiceManager = interface_cast<IServiceManager>(

   9:                 ProcessState::self()->getContextObject(NULL));

  10:         }

  11:     }

  12:

  13:     return gDefaultServiceManager;

  14: }

   1: sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& caller)

   2: {

   3:     if (supportsProcesses()) {

   4:         return getStrongProxyForHandle(0);

   5:     } else {

   6:         return getContextObject(String16("default"), caller);

   7:     }

   8: }

   1: android::sp<I##INTERFACE> I##INTERFACE::asInterface(                \

   2:         const android::sp<android::IBinder>& obj)                   \

   3: {                                                                   \

   4:     android::sp<I##INTERFACE> intr;                                 \

   5:     if (obj != NULL) {                                              \

   6:         intr = static_cast<I##INTERFACE*>(                          \

   7:             obj->queryLocalInterface(                               \

   8:                     I##INTERFACE::descriptor).get());               \

   9:         if (intr == NULL) {                                         \

  10:             intr = new Bp##INTERFACE(obj);                          \

  11:         }                                                           \

  12:     }                                                               \

  13:     return intr;                                                    \

  14: }                                                                   \