Android IPC

 Parcel

• Words with same meaning:

package,bunch,bundle,pack,packet, make into a wrapped container,a wrapped container, a collection of things wrapped or boxed together

• The implementation of Parcel, write or read data from data memory

• The header of Parcel 

#ifndef ANDROID_PARCEL_H
#define ANDROID_PARCEL_H
#include <cutils/native_handle.h>
#include <utils/Errors.h>
#include <utils/RefBase.h>
#include <utils/String16.h>
#include <utils/Vector.h>

namespace android {

class Flattenable;
class IBinder;
class IPCThreadState;
class ProcessState;
class String8;
class TextOutput;

struct flat_binder_object;  // defined in support_p/binder_module.h
class Parcel
{
public:
    class ReadableBlob;
    class WritableBlob;
    Parcel();
    ~Parcel();    
    const uint8_t*      data() const;
    size_t              dataSize() const;
    size_t              dataAvail() const;
    size_t              dataPosition() const;
    size_t              dataCapacity() const;
    status_t            setDataSize(size_t size);
    void                setDataPosition(size_t pos) const;
    status_t            setDataCapacity(size_t size);    
    status_t            setData(const uint8_t* buffer, size_t len);
    status_t            appendFrom(const Parcel *parcel,size_t start, size_t len);
    bool                pushAllowFds(bool allowFds);
    void                restoreAllowFds(bool lastValue);
    bool                hasFileDescriptors() const;
    status_t            writeInterfaceToken(const String16& interface);
    bool                enforceInterface(const String16& interface,IPCThreadState* threadState = NULL) const;
    bool                checkInterface(IBinder*) const;
    void                freeData();
    const size_t*       objects() const;
    size_t              objectsCount() const;    
    status_t            errorCheck() const;
    void                setError(status_t err);    
    status_t            write(const void* data, size_t len);
    void*               writeInplace(size_t len);
    status_t            writeUnpadded(const void* data, size_t len);
    status_t            writeInt32(int32_t val);
    status_t            writeInt64(int64_t val);
    status_t            writeFloat(float val);
    status_t            writeDouble(double val);
    status_t            writeIntPtr(intptr_t val);
    status_t            writeCString(const char* str);
    status_t            writeString8(const String8& str);
    status_t            writeString16(const String16& str);
    status_t            writeString16(const char16_t* str, size_t len);
    status_t            writeStrongBinder(const sp<IBinder>& val);
    status_t            writeWeakBinder(const wp<IBinder>& val);
    status_t            write(const Flattenable& val);
    status_t            writeNativeHandle(const native_handle* handle);
    status_t            writeFileDescriptor(int fd, bool takeOwnership = false);
    status_t            writeDupFileDescriptor(int fd);
    status_t            writeBlob(size_t len, WritableBlob* outBlob);
    status_t            writeObject(const flat_binder_object& val, bool nullMetaData);
    status_t            writeNoException();
    void                remove(size_t start, size_t amt);    
    status_t            read(void* outData, size_t len) const;
    const void*         readInplace(size_t len) const;
    int32_t             readInt32() const;
    status_t            readInt32(int32_t *pArg) const;
    int64_t             readInt64() const;
    status_t            readInt64(int64_t *pArg) const;
    float               readFloat() const;
    status_t            readFloat(float *pArg) const;
    double              readDouble() const;
    status_t            readDouble(double *pArg) const;
    intptr_t            readIntPtr() const;
    status_t            readIntPtr(intptr_t *pArg) const;
    const char*         readCString() const;
    String8             readString8() const;
    String16            readString16() const;
    const char16_t*     readString16Inplace(size_t* outLen) const;
    sp<IBinder>         readStrongBinder() const;
    wp<IBinder>         readWeakBinder() const;
    status_t            read(Flattenable& val) const;
    int32_t             readExceptionCode() const;
    native_handle*      readNativeHandle() const;
    int                 readFileDescriptor() const;
    status_t            readBlob(size_t len, ReadableBlob* outBlob) const;
    const flat_binder_object* readObject(bool nullMetaData) const;
    void                closeFileDescriptors();    
    typedef void        (*release_func)(Parcel* parcel,
                                        const uint8_t* data, size_t dataSize,
                                        const size_t* objects, size_t objectsSize,
                                        void* cookie);
    const uint8_t*      ipcData() const;
    size_t              ipcDataSize() const;
    const size_t*       ipcObjects() const;
    size_t              ipcObjectsCount() const;
    void                ipcSetDataReference(const uint8_t* data, size_t dataSize,
                                            const size_t* objects, size_t objectsCount,
                                            release_func relFunc, void* relCookie);    
    void                print(TextOutput& to, uint32_t flags = 0) const;
private:
    Parcel(const Parcel& o);
    Parcel&             operator=(const Parcel& o);    
    status_t            finishWrite(size_t len);
    void                releaseObjects();
    void                acquireObjects();
    status_t            growData(size_t len);
    status_t            restartWrite(size_t desired);
    status_t            continueWrite(size_t desired);
    void                freeDataNoInit();
    void                initState();
    void                scanForFds() const;                        
    template<class T>
    status_t            readAligned(T *pArg) const;
    template<class T>   
    T readAligned() const;
    template<class T>
    status_t            writeAligned(T val);
    status_t            mError;
    uint8_t*            mData;
    size_t              mDataSize;
    size_t              mDataCapacity;
    mutable size_t      mDataPos;
    size_t*             mObjects;
    size_t              mObjectsSize;
    size_t              mObjectsCapacity;
    mutable size_t      mNextObjectHint;
    mutable bool        mFdsKnown;
    mutable bool        mHasFds;
    bool                mAllowFds;    
    release_func        mOwner;
    void*               mOwnerCookie;
    class Blob {
    public:
        Blob();
        ~Blob();
        void release();
        inline size_t size() const { return mSize; }
    protected:
        void init(bool mapped, void* data, size_t size);
        void clear();
        bool mMapped;
        void* mData;
        size_t mSize;
    };

public:
    class ReadableBlob : public Blob {
        friend class Parcel;
    public:
        inline const void* data() const { return mData; }
    };
    class WritableBlob : public Blob {
        friend class Parcel;
    public:
        inline void* data() { return mData; }
    };
};
inline TextOutput& operator<<(TextOutput& to, const Parcel& parcel)
{
    parcel.print(to);
    return to;
}
void acquire_object(const sp<ProcessState>& proc,
                    const flat_binder_object& obj, const void* who);
void release_object(const sp<ProcessState>& proc,
                    const flat_binder_object& obj, const void* who);
void flatten_binder(const sp<ProcessState>& proc,
                    const sp<IBinder>& binder, flat_binder_object* out);
void flatten_binder(const sp<ProcessState>& proc,
                    const wp<IBinder>& binder, flat_binder_object* out);
status_t unflatten_binder(const sp<ProcessState>& proc,
                          const flat_binder_object& flat, sp<IBinder>* out);
status_t unflatten_binder(const sp<ProcessState>& proc,
                          const flat_binder_object& flat, wp<IBinder>* out);

};
#endif // ANDROID_PARCEL_H

• Variables and nested class in Parcle class. Everytime you want a parcle object, you must new it and allocate memory for it. But many parcle can share the same memory, only one of them is owner of shared memory.

• private:
      Parcel(const Parcel& o);
      Parcel&             operator=(const Parcel& o);    
      status_t            finishWrite(size_t len); //change mDataPos after writing
      void                initState();
      void                scanForFds() const;                        
      template<class T>
      status_t            readAligned(T *pArg) const; //read data from memory
      template<class T>   
      T readAligned() const; //read object from memory
      template<class T>
      status_t            writeAligned(T val); //write data into memory
      uint8_t*            mData;
      size_t              mDataSize;
      size_t              mDataCapacity;
      mutable size_t      mDataPos; //alway be changed after reading or writing
      size_t*             mObjects; //object pointer memeroy,store object's index by which we can get its pointer in data
      size_t              mObjectsSize;
      size_t              mObjectsCapacity;
      mutable size_t      mNextObjectHint;
      mutable bool        mFdsKnown;
      mutable bool        mHasFds;
      bool                mAllowFds;    
      release_func        mOwner;//release function for memory
      void*               mOwnerCookie;
      class Blob {
      public:
          Blob();
          ~Blob();
          void release();
          inline size_t size() const { return mSize; }
      protected:
          void init(bool mapped, void* data, size_t size);
          void clear();
          bool mMapped;
          void* mData;
          size_t mSize;
      };

• typedef void        (*release_func)(Parcel* parcel,
                                          const uint8_t* data, size_t dataSize,
                                          const size_t* objects, size_t objectsSize,
                                          void* cookie);

• use nested class

• public:
      class ReadableBlob : public Blob {
  friendclass Parcel;
      public:
          inline const void* data() const { return mData; }
      };
      class WritableBlob : public Blob {
  friend class Parcel;
      public:
          inline void* data() { return mData; }
      }; 

• allocate memory

• status_t Parcel::restartWrite(size_t desired)
  {
      if (mOwner) {
          freeData();
          return continueWrite(desired);
      }    
      uint8_t* data = (uint8_t*)realloc(mData, desired); //get memory on orginal address
      if (!data && desired > mDataCapacity) {
          mError = NO_MEMORY;
          return NO_MEMORY;
      }    
     releaseObjects();  //release all objects which is not building-in type by index
      if (data) {
          mData = data;
          mDataCapacity = desired;
      }    
      mDataSize = mDataPos = 0;
      LOGV("restartWrite Setting data size of %p to %d
  ", this, mDataSize);
      LOGV("restartWrite Setting data pos of %p to %d
  ", this, mDataPos);        
      free(mObjects);//free memory storing object index
      mObjects = NULL;
      mObjectsSize = mObjectsCapacity = 0;
      mNextObjectHint = 0;
      mHasFds = false;
      mFdsKnown = true;
      mAllowFds = true;
      
      return NO_ERROR;
  }

  status_t Parcel::continueWrite(size_t desired)
  {
      // If shrinking, first adjust for any objects that appear
      // after the new data size.
      size_t objectsSize = mObjectsSize;
      if (desired < mDataSize) {
          if (desired == 0) {
              objectsSize = 0;
          } else {
              while (objectsSize > 0) {
                  if (mObjects[objectsSize-1] < desired)
                      break;
                  objectsSize--;
              }
          }
      }    
      if (mOwner) {
          // If the size is going to zero, just release the owner's data.
          if (desired == 0) {
              freeData();
              return NO_ERROR;
          }
          // If there is a different owner, we need to take
          // posession.
          uint8_t* data = (uint8_t*)malloc(desired);
          if (!data) {
              mError = NO_MEMORY;
              return NO_MEMORY;
          }
          size_t* objects = NULL;
          
          if (objectsSize) {
              objects = (size_t*)malloc(objectsSize*sizeof(size_t));
              if (!objects) {
                  mError = NO_MEMORY;
                  return NO_MEMORY;
              }
  
              // Little hack to only acquire references on objects
              // we will be keeping.
              size_t oldObjectsSize = mObjectsSize;
              mObjectsSize = objectsSize;
              acquireObjects();
              mObjectsSize = oldObjectsSize;
          }        
          if (mData) {
              memcpy(data, mData, mDataSize < desired ? mDataSize : desired);
          }
          if (objects && mObjects) {
              memcpy(objects, mObjects, objectsSize*sizeof(size_t));
          }
          //LOGI("Freeing data ref of %p (pid=%d)
  ", this, getpid());
          mOwner(this, mData, mDataSize, mObjects, mObjectsSize, mOwnerCookie);
          mOwner = NULL;
          mData = data;
          mObjects = objects;
          mDataSize = (mDataSize < desired) ? mDataSize : desired;
          LOGV("continueWrite Setting data size of %p to %d
  ", this, mDataSize);
          mDataCapacity = desired;
          mObjectsSize = mObjectsCapacity = objectsSize;
          mNextObjectHint = 0;
      } else if (mData) {
          if (objectsSize < mObjectsSize) {
              // Need to release refs on any objects we are dropping.
              const sp<ProcessState> proc(ProcessState::self());
              for (size_t i=objectsSize; i<mObjectsSize; i++) {
                  const flat_binder_object* flat
                      = reinterpret_cast<flat_binder_object*>(mData+mObjects[i]);
                  if (flat->type == BINDER_TYPE_FD) {
                      // will need to rescan because we may have lopped off the only FDs
                      mFdsKnown = false;
                  }
                  release_object(proc, *flat, this);
              }
              size_t* objects =(size_t*)realloc(mObjects, objectsSize*sizeof(size_t));
              if (objects) {
                  mObjects = objects;
              }
              mObjectsSize = objectsSize;
              mNextObjectHint = 0;
          }
          // We own the data, so we can just do a realloc().
          if (desired > mDataCapacity) {
              uint8_t* data = (uint8_t*)realloc(mData, desired);
              if (data) {
                  mData = data;
                  mDataCapacity = desired;
              } else if (desired > mDataCapacity) {
                  mError = NO_MEMORY;
                  return NO_MEMORY;
              }
          } else {
              if (mDataSize > desired) {
                  mDataSize = desired;
                  LOGV("continueWrite Setting data size of %p to %d
  ", this, mDataSize);
              }
              if (mDataPos > desired) {
                  mDataPos = desired;
                  LOGV("continueWrite Setting data pos of %p to %d
  ", this, mDataPos);
              }
          }        
      } else {
          // This is the first data.  Easy!
          uint8_t* data = (uint8_t*)malloc(desired);
          if (!data) {
              mError = NO_MEMORY;
              return NO_MEMORY;
          }        
          if(!(mDataCapacity == 0 && mObjects == NULL
               && mObjectsCapacity == 0)) {
              LOGE("continueWrite: %d/%p/%d/%d", mDataCapacity, mObjects, mObjectsCapacity, desired);
          }        
          mData = data;
          mDataSize = mDataPos = 0;
          LOGV("continueWrite Setting data size of %p to %d
  ", this, mDataSize);
          LOGV("continueWrite Setting data pos of %p to %d
  ", this, mDataPos);
          mDataCapacity = desired;
      }
      return NO_ERROR;
  }

• Free memory

• void Parcel::freeData()
  {
      freeDataNoInit();//just free data
      initState();
  }

  void Parcel::freeDataNoInit()
  {
      if (mOwner) { //use customerized realse function to free memory
          //LOGI("Freeing data ref of %p (pid=%d)
  ", this, getpid());
          mOwner(this, mData, mDataSize, mObjects, mObjectsSize, mOwnerCookie);
      } else {
          releaseObjects(); //free object or reference count --
          if (mData) free(mData); //free data
          if (mObjects) free(mObjects);//free memory which save object pointer.
      }
  }

  void Parcel::releaseObjects()
  {
      const sp<ProcessState> proc(ProcessState::self());
      size_t i = mObjectsSize;
      uint8_t* const data = mData;
      size_t* const objects = mObjects;
      while (i > 0) {
          i--;
          const flat_binder_object* flat = reinterpret_cast<flat_binder_object*>(data+objects[i]);//get objects type and pointer
  release_object(proc, *flat, this);
      }
  }
  void release_object(const sp<ProcessState>& proc,const flat_binder_object& obj, const void* who)
  {
      switch (obj.type) {
          case BINDER_TYPE_BINDER:
              if (obj.binder) {
                  LOG_REFS("Parcel %p releasing reference on local %p", who, obj.cookie);
                  static_cast<IBinder*>(obj.cookie)->decStrong(who);//decrease
              }
              return;
          case BINDER_TYPE_WEAK_BINDER:
              if (obj.binder)
                  static_cast<RefBase::weakref_type*>(obj.binder)->decWeak(who);
              return;
          case BINDER_TYPE_HANDLE: {
              const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle);
              if (b != NULL) {
                  LOG_REFS("Parcel %p releasing reference on remote %p", who, b.get());
                  b->decStrong(who);
              }
              return;
          }
          case BINDER_TYPE_WEAK_HANDLE: {
              const wp<IBinder> b = proc->getWeakProxyForHandle(obj.handle);
              if (b != NULL) b.get_refs()->decWeak(who);//decrease
              return;
          }
          case BINDER_TYPE_FD: {
              if (obj.cookie != (void*)0) close(obj.handle);
              return;
          }
      }
      LOGE("Invalid object type 0x%08lx", obj.type);
  }

• Read data from memory

        Read building-in type

• template<class T>
  T Parcel::readAligned() const {
     T result;  //for building-in type
      if (readAligned(&result) != NO_ERROR) {
          result = 0;
      }
      return result;
  }

  template<class T>
  status_t Parcel::readAligned(T *pArg) const 
  {
      COMPILE_TIME_ASSERT_FUNCTION_SCOPE(PAD_SIZE(sizeof(T)) == sizeof(T));
      if ((mDataPos+sizeof(T)) <= mDataSize) {
          const void* data = mData+mDataPos;
          mDataPos += sizeof(T); //move backword 8         *pArg =  *reinterpret_cast<const T*>(data);//get value for int,long,float,bool,double
          return NO_ERROR;
      } else {
          return NOT_ENOUGH_DATA;
      }
  }

  Read String

• const char16_t* Parcel::readString16Inplace(size_t* outLen) const
  {
      int32_t size = readInt32();//for string.length
      // watch for potential int overflow from size+1
      if (size >= 0 && size < INT32_MAX) {
          *outLen = size;
          const char16_t* str = (const char16_t*)readInplace((size+1)*sizeof(char16_t));
          if (str != NULL) {
              return str;
          }
      }
      *outLen = 0;
      return NULL;
  }

  Read Object

• const flat_binder_object* Parcel::readObject(bool nullMetaData) const
  {
      const size_t DPOS = mDataPos;
      if ((DPOS+sizeof(flat_binder_object)) <= mDataSize) {
          const flat_binder_object* obj = reinterpret_cast<const flat_binder_object*>(mData+DPOS);
          mDataPos = DPOS + sizeof(flat_binder_object);
          if (!nullMetaData && (obj->cookie == NULL && obj->binder == NULL)) {            
              LOGV("readObject Setting data pos of %p to %d
  ", this, mDataPos);
              return obj;
          }
          size_t* const OBJS = mObjects;
          const size_t N = mObjectsSize;
          size_t opos = mNextObjectHint;        
          if (N > 0) {
              LOGV("Parcel %p looking for obj at %d, hint=%d
  ",
                   this, DPOS, opos);
              if (opos < N) {
                  while (opos < (N-1) && OBJS[opos] < DPOS) {
                      opos++;
                  }
              } else {
                  opos = N-1;
              }
  if (OBJS[opos] == DPOS) {
                  // Found it!
                  LOGV("Parcel found obj %d at index %d with forward search",
                       this, DPOS, opos);
                  mNextObjectHint = opos+1;
                  LOGV("readObject Setting data pos of %p to %d
  ", this, mDataPos);
                  return obj;
              }        
              // Look backwards for it...
              while (opos > 0 && OBJS[opos] > DPOS) {
                  opos--;
              }
              if (OBJS[opos] == DPOS) {
                  // Found it!
                  LOGV("Parcel found obj %d at index %d with backward search",
                       this, DPOS, opos);
                  mNextObjectHint = opos+1;
                  LOGV("readObject Setting data pos of %p to %d
  ", this, mDataPos);
                  return obj;
              }
          }
          LOGW("Attempt to read object from Parcel %p at offset %d that is not in the object list",
               this, DPOS);
      }
      return NULL;
  } 

• Write data into memory

 building-in type

template<class T>
status_t Parcel::writeAligned(T val) 
{
    COMPILE_TIME_ASSERT_FUNCTION_SCOPE(PAD_SIZE(sizeof(T)) == sizeof(T));
    if ((mDataPos+sizeof(val)) <= mDataCapacity) {
restart_write:
        *reinterpret_cast<T*>(mData+mDataPos) = val;
        return finishWrite(sizeof(val));
    }

    status_t err = growData(sizeof(val));
    if (err == NO_ERROR) goto restart_write;
    return err;
}

status_t Parcel::growData(size_t len)
{
    size_t newSize = ((mDataSize+len)*3)/2;
    return (newSize <= mDataSize)
            ? (status_t) NO_MEMORY
            : continueWrite(newSize);
}

status_t Parcel::finishWrite(size_t len)
{
    //printf("Finish write of %d
", len);
    mDataPos += len;
    LOGV("finishWrite Setting data pos of %p to %d
", this, mDataPos);
    if (mDataPos > mDataSize) {
        mDataSize = mDataPos;
        LOGV("finishWrite Setting data size of %p to %d
", this, mDataSize);
    }
    //printf("New pos=%d, size=%d
", mDataPos, mDataSize);
    return NO_ERROR;
}

      Write Object into memory

status_t Parcel::writeObject(const flat_binder_object& val, bool nullMetaData)
{
    const bool enoughData = (mDataPos+sizeof(val)) <= mDataCapacity;
    const bool enoughObjects = mObjectsSize < mObjectsCapacity;
    if (enoughData && enoughObjects) {
restart_write:
        *reinterpret_cast<flat_binder_object*>(mData+mDataPos) = val;
        
        // Need to write meta-data?
        if (nullMetaData || val.binder != NULL) {
            mObjects[mObjectsSize] = mDataPos;
            acquire_object(ProcessState::self(), val, this);
            mObjectsSize++;
        }
        
        // remember if it's a file descriptor
        if (val.type == BINDER_TYPE_FD) {
            if (!mAllowFds) {
                return FDS_NOT_ALLOWED;
            }
            mHasFds = mFdsKnown = true;
        }

        return finishWrite(sizeof(flat_binder_object));
    }

    if (!enoughData) {
        const status_t err = growData(sizeof(val));
        if (err != NO_ERROR) return err;
    }
    if (!enoughObjects) {
        size_t newSize = ((mObjectsSize+2)*3)/2;
        size_t* objects = (size_t*)realloc(mObjects, newSize*sizeof(size_t));
        if (objects == NULL) return NO_MEMORY;
        mObjects = objects;
        mObjectsCapacity = newSize;
    }
    
    goto restart_write;
}

 RefBase : use reference count when using strong or weak pointer to manage allocation and free of object

• RefBase.h

• /**
   * Copyright (C) 2005 The Android Open Source Project
   *
   * Licensed under the Apache License, Version 2.0 (the "License");
   * you may not use this file except in compliance with the License.
   * You may obtain a copy of the License at
   *
   *      http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  #define LOG_TAG "RefBase"
  
  #include <utils/RefBase.h>
  
  #include <utils/Atomic.h>
  #include <utils/CallStack.h>
  #include <utils/Log.h>
  #include <utils/threads.h>
  #include <utils/TextOutput.h>
  
  #include <stdlib.h>
  #include <stdio.h>
  #include <typeinfo>
  #include <sys/types.h>
  #include <sys/stat.h>
  #include <fcntl.h>
  #include <unistd.h>
  
  // compile with refcounting debugging enabled
  #define DEBUG_REFS                      0
  #define DEBUG_REFS_FATAL_SANITY_CHECKS  0
  #define DEBUG_REFS_ENABLED_BY_DEFAULT   1
  #define DEBUG_REFS_CALLSTACK_ENABLED    1
  
  // log all reference counting operations
  #define PRINT_REFS                      0
  
  // ---------------------------------------------------------------------------
  
  namespace android {
  
  #define INITIAL_STRONG_VALUE (1<<28)
  
  // ---------------------------------------------------------------------------
  
  class RefBase::weakref_impl : public RefBase::weakref_type
  {
  public:
      volatile int32_t    mStrong;
      volatile int32_t    mWeak;
      RefBase* const      mBase;
      volatile int32_t    mFlags;
  
  #if !DEBUG_REFS
  
      weakref_impl(RefBase* base)
          : mStrong(INITIAL_STRONG_VALUE)
          , mWeak(0)
          , mBase(base)
          , mFlags(0)
      {
      }
  
      void addStrongRef(const void* /**id*/) { }
      void removeStrongRef(const void* /**id*/) { }
      void renameStrongRefId(const void* /**old_id*/, const void* /**new_id*/) { }
      void addWeakRef(const void* /**id*/) { }
      void removeWeakRef(const void* /**id*/) { }
      void renameWeakRefId(const void* /**old_id*/, const void* /**new_id*/) { }
      void printRefs() const { }
      void trackMe(bool, bool) { }
  
  #else
  
      weakref_impl(RefBase* base)
          : mStrong(INITIAL_STRONG_VALUE)
          , mWeak(0)
          , mBase(base)
          , mFlags(0)
          , mStrongRefs(NULL)
          , mWeakRefs(NULL)
          , mTrackEnabled(!!DEBUG_REFS_ENABLED_BY_DEFAULT)
          , mRetain(false)
      {
      }
      
      ~weakref_impl()
      {
          bool dumpStack = false;
          if (!mRetain && mStrongRefs != NULL) {
              dumpStack = true;
  #if DEBUG_REFS_FATAL_SANITY_CHECKS
              LOG_ALWAYS_FATAL("Strong references remain!");
  #else
              LOGE("Strong references remain:");
  #endif
              ref_entry* refs = mStrongRefs;
              while (refs) {
                  char inc = refs->ref >= 0 ? '+' : '-';
                  LOGD("	%c ID %p (ref %d):", inc, refs->id, refs->ref);
  #if DEBUG_REFS_CALLSTACK_ENABLED
                  refs->stack.dump();
  #endif
                  refs = refs->next;
              }
          }
  
          if (!mRetain && mWeakRefs != NULL) {
              dumpStack = true;
  #if DEBUG_REFS_FATAL_SANITY_CHECKS
              LOG_ALWAYS_FATAL("Weak references remain:");
  #else
              LOGE("Weak references remain!");
  #endif
              ref_entry* refs = mWeakRefs;
              while (refs) {
                  char inc = refs->ref >= 0 ? '+' : '-';
                  LOGD("	%c ID %p (ref %d):", inc, refs->id, refs->ref);
  #if DEBUG_REFS_CALLSTACK_ENABLED
                  refs->stack.dump();
  #endif
                  refs = refs->next;
              }
          }
          if (dumpStack) {
              LOGE("above errors at:");
              CallStack stack;
              stack.update();
              stack.dump();
          }
      }
  
      void addStrongRef(const void* id) {
          //LOGD_IF(mTrackEnabled,
          //        "addStrongRef: RefBase=%p, id=%p", mBase, id);
          addRef(&mStrongRefs, id, mStrong);
      }
  
      void removeStrongRef(const void* id) {
          //LOGD_IF(mTrackEnabled,
          //        "removeStrongRef: RefBase=%p, id=%p", mBase, id);
          if (!mRetain) {
              removeRef(&mStrongRefs, id);
          } else {
              addRef(&mStrongRefs, id, -mStrong);
          }
      }
  
      void renameStrongRefId(const void* old_id, const void* new_id) {
          //LOGD_IF(mTrackEnabled,
          //        "renameStrongRefId: RefBase=%p, oid=%p, nid=%p",
          //        mBase, old_id, new_id);
          renameRefsId(mStrongRefs, old_id, new_id);
      }
  
      void addWeakRef(const void* id) {
          addRef(&mWeakRefs, id, mWeak);
      }
  
      void removeWeakRef(const void* id) {
          if (!mRetain) {
              removeRef(&mWeakRefs, id);
          } else {
              addRef(&mWeakRefs, id, -mWeak);
          }
      }
  
      void renameWeakRefId(const void* old_id, const void* new_id) {
          renameRefsId(mWeakRefs, old_id, new_id);
      }
  
      void trackMe(bool track, bool retain)
      { 
          mTrackEnabled = track;
          mRetain = retain;
      }
  
      void printRefs() const
      {
          String8 text;
  
          {
              Mutex::Autolock _l(mMutex);
              char buf[128];
              sprintf(buf, "Strong references on RefBase %p (weakref_type %p):
  ", mBase, this);
              text.append(buf);
              printRefsLocked(&text, mStrongRefs);
              sprintf(buf, "Weak references on RefBase %p (weakref_type %p):
  ", mBase, this);
              text.append(buf);
              printRefsLocked(&text, mWeakRefs);
          }
  
          {
              char name[100];
              snprintf(name, 100, "/data/%p.stack", this);
              int rc = open(name, O_RDWR | O_CREAT | O_APPEND);
              if (rc >= 0) {
                  write(rc, text.string(), text.length());
                  close(rc);
                  LOGD("STACK TRACE for %p saved in %s", this, name);
              }
              else LOGE("FAILED TO PRINT STACK TRACE for %p in %s: %s", this,
                        name, strerror(errno));
          }
      }
  
  private:
      struct ref_entry
      {
          ref_entry* next;
          const void* id;
  #if DEBUG_REFS_CALLSTACK_ENABLED
          CallStack stack;
  #endif
          int32_t ref;
      };
  
      void addRef(ref_entry** refs, const void* id, int32_t mRef)
      {
          if (mTrackEnabled) {
              AutoMutex _l(mMutex);
  
              ref_entry* ref = new ref_entry;
              // Reference count at the time of the snapshot, but before the
              // update.  Positive value means we increment, negative--we
              // decrement the reference count.
              ref->ref = mRef;
              ref->id = id;
  #if DEBUG_REFS_CALLSTACK_ENABLED
              ref->stack.update(2);
  #endif
              ref->next = *refs;
              *refs = ref;
          }
      }
  
      void removeRef(ref_entry** refs, const void* id)
      {
          if (mTrackEnabled) {
              AutoMutex _l(mMutex);
              
              ref_entry* const head = *refs;
              ref_entry* ref = head;
              while (ref != NULL) {
                  if (ref->id == id) {
                      *refs = ref->next;
                      delete ref;
                      return;
                  }
                  refs = &ref->next;
                  ref = *refs;
              }
  
  #if DEBUG_REFS_FATAL_SANITY_CHECKS
              LOG_ALWAYS_FATAL("RefBase: removing id %p on RefBase %p"
                      "(weakref_type %p) that doesn't exist!",
                      id, mBase, this);
  #endif
  
              LOGE("RefBase: removing id %p on RefBase %p"
                      "(weakref_type %p) that doesn't exist!",
                      id, mBase, this);
  
              ref = head;
              while (ref) {
                  char inc = ref->ref >= 0 ? '+' : '-';
                  LOGD("	%c ID %p (ref %d):", inc, ref->id, ref->ref);
                  ref = ref->next;
              }
  
              CallStack stack;
              stack.update();
              stack.dump();
          }
      }
  
      void renameRefsId(ref_entry* r, const void* old_id, const void* new_id)
      {
          if (mTrackEnabled) {
              AutoMutex _l(mMutex);
              ref_entry* ref = r;
              while (ref != NULL) {
                  if (ref->id == old_id) {
                      ref->id = new_id;
                  }
                  ref = ref->next;
              }
          }
      }
  
      void printRefsLocked(String8* out, const ref_entry* refs) const
      {
          char buf[128];
          while (refs) {
              char inc = refs->ref >= 0 ? '+' : '-';
              sprintf(buf, "	%c ID %p (ref %d):
  ", 
                      inc, refs->id, refs->ref);
              out->append(buf);
  #if DEBUG_REFS_CALLSTACK_ENABLED
              out->append(refs->stack.toString("		"));
  #else
              out->append("		(call stacks disabled)");
  #endif
              refs = refs->next;
          }
      }
  
      mutable Mutex mMutex;
      ref_entry* mStrongRefs;
      ref_entry* mWeakRefs;
  
      bool mTrackEnabled;
      // Collect stack traces on addref and removeref, instead of deleting the stack references
      // on removeref that match the address ones.
      bool mRetain;
  
  #endif
  };
  
  // ---------------------------------------------------------------------------
  
  void RefBase::incStrong(const void* id) const
  {
      weakref_impl* const refs = mRefs;
      refs->incWeak(id);
      
      refs->addStrongRef(id);
      const int32_t c = android_atomic_inc(&refs->mStrong);
      LOG_ASSERT(c > 0, "incStrong() called on %p after last strong ref", refs);
  #if PRINT_REFS
      LOGD("incStrong of %p from %p: cnt=%d
  ", this, id, c);
  #endif
      if (c != INITIAL_STRONG_VALUE)  {
          return;
      }
  
      android_atomic_add(-INITIAL_STRONG_VALUE, &refs->mStrong);
      refs->mBase->onFirstRef();
  }
  
  void RefBase::decStrong(const void* id) const
  {
      weakref_impl* const refs = mRefs;
      refs->removeStrongRef(id);
      const int32_t c = android_atomic_dec(&refs->mStrong);
  #if PRINT_REFS
      LOGD("decStrong of %p from %p: cnt=%d
  ", this, id, c);
  #endif
      LOG_ASSERT(c >= 1, "decStrong() called on %p too many times", refs);
      if (c == 1) {
          refs->mBase->onLastStrongRef(id);
          if ((refs->mFlags&OBJECT_LIFETIME_MASK) == OBJECT_LIFETIME_STRONG) {
              delete this;
          }
      }
      refs->decWeak(id);
  }
  
  void RefBase::forceIncStrong(const void* id) const
  {
      weakref_impl* const refs = mRefs;
      refs->incWeak(id);
      
      refs->addStrongRef(id);
      const int32_t c = android_atomic_inc(&refs->mStrong);
      LOG_ASSERT(c >= 0, "forceIncStrong called on %p after ref count underflow",
                 refs);
  #if PRINT_REFS
      LOGD("forceIncStrong of %p from %p: cnt=%d
  ", this, id, c);
  #endif
  
      switch (c) {
      case INITIAL_STRONG_VALUE:
          android_atomic_add(-INITIAL_STRONG_VALUE, &refs->mStrong);
          // fall through...
      case 0:
          refs->mBase->onFirstRef();
      }
  }
  
  int32_t RefBase::getStrongCount() const
  {
      return mRefs->mStrong;
  }
  
  RefBase* RefBase::weakref_type::refBase() const
  {
      return static_cast<const weakref_impl*>(this)->mBase;
  }
  
  void RefBase::weakref_type::incWeak(const void* id)
  {
      weakref_impl* const impl = static_cast<weakref_impl*>(this);
      impl->addWeakRef(id);
      const int32_t c = android_atomic_inc(&impl->mWeak);
      LOG_ASSERT(c >= 0, "incWeak called on %p after last weak ref", this);
  }
  
  
  void RefBase::weakref_type::decWeak(const void* id)
  {
      weakref_impl* const impl = static_cast<weakref_impl*>(this);
      impl->removeWeakRef(id);
      const int32_t c = android_atomic_dec(&impl->mWeak);
      LOG_ASSERT(c >= 1, "decWeak called on %p too many times", this);
      if (c != 1) return;
  
      if ((impl->mFlags&OBJECT_LIFETIME_WEAK) == OBJECT_LIFETIME_STRONG) {
          // This is the regular lifetime case. The object is destroyed
          // when the last strong reference goes away. Since weakref_impl
          // outlive the object, it is not destroyed in the dtor, and
          // we'll have to do it here.
          if (impl->mStrong == INITIAL_STRONG_VALUE) {
              // Special case: we never had a strong reference, so we need to
              // destroy the object now.
              delete impl->mBase;
          } else {
              // LOGV("Freeing refs %p of old RefBase %p
  ", this, impl->mBase);
              delete impl;
          }
      } else {
          // less common case: lifetime is OBJECT_LIFETIME_{WEAK|FOREVER}
          impl->mBase->onLastWeakRef(id);
          if ((impl->mFlags&OBJECT_LIFETIME_MASK) == OBJECT_LIFETIME_WEAK) {
              // this is the OBJECT_LIFETIME_WEAK case. The last weak-reference
              // is gone, we can destroy the object.
              delete impl->mBase;
          }
      }
  }
  
  bool RefBase::weakref_type::attemptIncStrong(const void* id)
  {
      incWeak(id);
      
      weakref_impl* const impl = static_cast<weakref_impl*>(this);
      
      int32_t curCount = impl->mStrong;
      LOG_ASSERT(curCount >= 0, "attemptIncStrong called on %p after underflow",
                 this);
      while (curCount > 0 && curCount != INITIAL_STRONG_VALUE) {
          if (android_atomic_cmpxchg(curCount, curCount+1, &impl->mStrong) == 0) {
              break;
          }
          curCount = impl->mStrong;
      }
      
      if (curCount <= 0 || curCount == INITIAL_STRONG_VALUE) {
          bool allow;
          if (curCount == INITIAL_STRONG_VALUE) {
              // Attempting to acquire first strong reference...  this is allowed
              // if the object does NOT have a longer lifetime (meaning the
              // implementation doesn't need to see this), or if the implementation
              // allows it to happen.
              allow = (impl->mFlags&OBJECT_LIFETIME_WEAK) != OBJECT_LIFETIME_WEAK
                    || impl->mBase->onIncStrongAttempted(FIRST_INC_STRONG, id);
          } else {
              // Attempting to revive the object...  this is allowed
              // if the object DOES have a longer lifetime (so we can safely
              // call the object with only a weak ref) and the implementation
              // allows it to happen.
              allow = (impl->mFlags&OBJECT_LIFETIME_WEAK) == OBJECT_LIFETIME_WEAK
                    && impl->mBase->onIncStrongAttempted(FIRST_INC_STRONG, id);
          }
          if (!allow) {
              decWeak(id);
              return false;
          }
          curCount = android_atomic_inc(&impl->mStrong);
  
          // If the strong reference count has already been incremented by
          // someone else, the implementor of onIncStrongAttempted() is holding
          // an unneeded reference.  So call onLastStrongRef() here to remove it.
          // (No, this is not pretty.)  Note that we MUST NOT do this if we
          // are in fact acquiring the first reference.
          if (curCount > 0 && curCount < INITIAL_STRONG_VALUE) {
              impl->mBase->onLastStrongRef(id);
          }
      }
      
      impl->addStrongRef(id);
  
  #if PRINT_REFS
      LOGD("attemptIncStrong of %p from %p: cnt=%d
  ", this, id, curCount);
  #endif
  
      if (curCount == INITIAL_STRONG_VALUE) {
          android_atomic_add(-INITIAL_STRONG_VALUE, &impl->mStrong);
          impl->mBase->onFirstRef();
      }
      
      return true;
  }
  
  bool RefBase::weakref_type::attemptIncWeak(const void* id)
  {
      weakref_impl* const impl = static_cast<weakref_impl*>(this);
  
      int32_t curCount = impl->mWeak;
      LOG_ASSERT(curCount >= 0, "attemptIncWeak called on %p after underflow",
                 this);
      while (curCount > 0) {
          if (android_atomic_cmpxchg(curCount, curCount+1, &impl->mWeak) == 0) {
              break;
          }
          curCount = impl->mWeak;
      }
  
      if (curCount > 0) {
          impl->addWeakRef(id);
      }
  
      return curCount > 0;
  }
  
  int32_t RefBase::weakref_type::getWeakCount() const
  {
      return static_cast<const weakref_impl*>(this)->mWeak;
  }
  
  void RefBase::weakref_type::printRefs() const
  {
      static_cast<const weakref_impl*>(this)->printRefs();
  }
  
  void RefBase::weakref_type::trackMe(bool enable, bool retain)
  {
      static_cast<weakref_impl*>(this)->trackMe(enable, retain);
  }
  
  RefBase::weakref_type* RefBase::createWeak(const void* id) const
  {
      mRefs->incWeak(id);
      return mRefs;
  }
  
  RefBase::weakref_type* RefBase::getWeakRefs() const
  {
      return mRefs;
  }
  
  RefBase::RefBase()
      : mRefs(new weakref_impl(this))
  {
  }
  
  RefBase::~RefBase()
  {
      if (mRefs->mStrong == INITIAL_STRONG_VALUE) {
          // we never acquired a strong (and/or weak) reference on this object.
          delete mRefs;
      } else {
          // life-time of this object is extended to WEAK or FOREVER, in
          // which case weakref_impl doesn't out-live the object and we
          // can free it now.
          if ((mRefs->mFlags & OBJECT_LIFETIME_MASK) != OBJECT_LIFETIME_STRONG) {
              // It's possible that the weak count is not 0 if the object
              // re-acquired a weak reference in its destructor
              if (mRefs->mWeak == 0) {
                  delete mRefs;
              }
          }
      }
      // for debugging purposes, clear this.
      const_cast<weakref_impl*&>(mRefs) = NULL;
  }
  
  void RefBase::extendObjectLifetime(int32_t mode)
  {
      android_atomic_or(mode, &mRefs->mFlags);
  }
  
  void RefBase::onFirstRef()
  {
  }
  
  void RefBase::onLastStrongRef(const void* /**id*/)
  {
  }
  
  bool RefBase::onIncStrongAttempted(uint32_t flags, const void* id)
  {
      return (flags&FIRST_INC_STRONG) ? true : false;
  }
  
  void RefBase::onLastWeakRef(const void* /**id*/)
  {
  }
  
  // ---------------------------------------------------------------------------
  
  void RefBase::moveReferences(void* dst, void const* src, size_t n,
          const ReferenceConverterBase& caster)
  {
  #if DEBUG_REFS
      const size_t itemSize = caster.getReferenceTypeSize();
      for (size_t i=0 ; i<n ; i++) {
          void*       d = reinterpret_cast<void      *>(intptr_t(dst) + i*itemSize);
          void const* s = reinterpret_cast<void const*>(intptr_t(src) + i*itemSize);
          RefBase* ref(reinterpret_cast<RefBase*>(caster.getReferenceBase(d)));
          ref->mRefs->renameStrongRefId(s, d);
          ref->mRefs->renameWeakRefId(s, d);
      }
  #endif
  }
  
  // ---------------------------------------------------------------------------
  
  TextOutput& printStrongPointer(TextOutput& to, const void* val)
  {
      to << "sp<>(" << val << ")";
      return to;
  }
  
  TextOutput& printWeakPointer(TextOutput& to, const void* val)
  {
      to << "wp<>(" << val << ")";
      return to;
  }
  
  
  }; // namespace android

• RefBase.cpp

• /**
   * Copyright (C) 2005 The Android Open Source Project
   *
   * Licensed under the Apache License, Version 2.0 (the "License");
   * you may not use this file except in compliance with the License.
   * You may obtain a copy of the License at
   *
   *      http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  #define LOG_TAG "RefBase"
  
  #include <utils/RefBase.h>
  
  #include <utils/Atomic.h>
  #include <utils/CallStack.h>
  #include <utils/Log.h>
  #include <utils/threads.h>
  #include <utils/TextOutput.h>
  
  #include <stdlib.h>
  #include <stdio.h>
  #include <typeinfo>
  #include <sys/types.h>
  #include <sys/stat.h>
  #include <fcntl.h>
  #include <unistd.h>
  
  // compile with refcounting debugging enabled
  #define DEBUG_REFS                      0
  #define DEBUG_REFS_FATAL_SANITY_CHECKS  0
  #define DEBUG_REFS_ENABLED_BY_DEFAULT   1
  #define DEBUG_REFS_CALLSTACK_ENABLED    1
  
  // log all reference counting operations
  #define PRINT_REFS                      0
  
  // ---------------------------------------------------------------------------
  
  namespace android {
  
  #define INITIAL_STRONG_VALUE (1<<28)
  
  // ---------------------------------------------------------------------------
  
  class RefBase::weakref_impl : public RefBase::weakref_type
  {
  public:
      volatile int32_t    mStrong;
      volatile int32_t    mWeak;
      RefBase* const      mBase;
      volatile int32_t    mFlags;
  
  #if !DEBUG_REFS
  
      weakref_impl(RefBase* base)
          : mStrong(INITIAL_STRONG_VALUE)
          , mWeak(0)
          , mBase(base)
          , mFlags(0)
      {
      }
  
      void addStrongRef(const void* /**id*/) { }
      void removeStrongRef(const void* /**id*/) { }
      void renameStrongRefId(const void* /**old_id*/, const void* /**new_id*/) { }
      void addWeakRef(const void* /**id*/) { }
      void removeWeakRef(const void* /**id*/) { }
      void renameWeakRefId(const void* /**old_id*/, const void* /**new_id*/) { }
      void printRefs() const { }
      void trackMe(bool, bool) { }
  
  #else
  
      weakref_impl(RefBase* base)
          : mStrong(INITIAL_STRONG_VALUE)
          , mWeak(0)
          , mBase(base)
          , mFlags(0)
          , mStrongRefs(NULL)
          , mWeakRefs(NULL)
          , mTrackEnabled(!!DEBUG_REFS_ENABLED_BY_DEFAULT)
          , mRetain(false)
      {
      }
      
      ~weakref_impl()
      {
          bool dumpStack = false;
          if (!mRetain && mStrongRefs != NULL) {
              dumpStack = true;
  #if DEBUG_REFS_FATAL_SANITY_CHECKS
              LOG_ALWAYS_FATAL("Strong references remain!");
  #else
              LOGE("Strong references remain:");
  #endif
              ref_entry* refs = mStrongRefs;
              while (refs) {
                  char inc = refs->ref >= 0 ? '+' : '-';
                  LOGD("	%c ID %p (ref %d):", inc, refs->id, refs->ref);
  #if DEBUG_REFS_CALLSTACK_ENABLED
                  refs->stack.dump();
  #endif
                  refs = refs->next;
              }
          }
  
          if (!mRetain && mWeakRefs != NULL) {
              dumpStack = true;
  #if DEBUG_REFS_FATAL_SANITY_CHECKS
              LOG_ALWAYS_FATAL("Weak references remain:");
  #else
              LOGE("Weak references remain!");
  #endif
              ref_entry* refs = mWeakRefs;
              while (refs) {
                  char inc = refs->ref >= 0 ? '+' : '-';
                  LOGD("	%c ID %p (ref %d):", inc, refs->id, refs->ref);
  #if DEBUG_REFS_CALLSTACK_ENABLED
                  refs->stack.dump();
  #endif
                  refs = refs->next;
              }
          }
          if (dumpStack) {
              LOGE("above errors at:");
              CallStack stack;
              stack.update();
              stack.dump();
          }
      }
  
      void addStrongRef(const void* id) {
          //LOGD_IF(mTrackEnabled,
          //        "addStrongRef: RefBase=%p, id=%p", mBase, id);
          addRef(&mStrongRefs, id, mStrong);
      }
  
      void removeStrongRef(const void* id) {
          //LOGD_IF(mTrackEnabled,
          //        "removeStrongRef: RefBase=%p, id=%p", mBase, id);
          if (!mRetain) {
              removeRef(&mStrongRefs, id);
          } else {
              addRef(&mStrongRefs, id, -mStrong);
          }
      }
  
      void renameStrongRefId(const void* old_id, const void* new_id) {
          //LOGD_IF(mTrackEnabled,
          //        "renameStrongRefId: RefBase=%p, oid=%p, nid=%p",
          //        mBase, old_id, new_id);
          renameRefsId(mStrongRefs, old_id, new_id);
      }
  
      void addWeakRef(const void* id) {
          addRef(&mWeakRefs, id, mWeak);
      }
  
      void removeWeakRef(const void* id) {
          if (!mRetain) {
              removeRef(&mWeakRefs, id);
          } else {
              addRef(&mWeakRefs, id, -mWeak);
          }
      }
  
      void renameWeakRefId(const void* old_id, const void* new_id) {
          renameRefsId(mWeakRefs, old_id, new_id);
      }
  
      void trackMe(bool track, bool retain)
      { 
          mTrackEnabled = track;
          mRetain = retain;
      }
  
      void printRefs() const
      {
          String8 text;
  
          {
              Mutex::Autolock _l(mMutex);
              char buf[128];
              sprintf(buf, "Strong references on RefBase %p (weakref_type %p):
  ", mBase, this);
              text.append(buf);
              printRefsLocked(&text, mStrongRefs);
              sprintf(buf, "Weak references on RefBase %p (weakref_type %p):
  ", mBase, this);
              text.append(buf);
              printRefsLocked(&text, mWeakRefs);
          }
  
          {
              char name[100];
              snprintf(name, 100, "/data/%p.stack", this);
              int rc = open(name, O_RDWR | O_CREAT | O_APPEND);
              if (rc >= 0) {
                  write(rc, text.string(), text.length());
                  close(rc);
                  LOGD("STACK TRACE for %p saved in %s", this, name);
              }
              else LOGE("FAILED TO PRINT STACK TRACE for %p in %s: %s", this,
                        name, strerror(errno));
          }
      }
  
  private:
      struct ref_entry
      {
          ref_entry* next;
          const void* id;
  #if DEBUG_REFS_CALLSTACK_ENABLED
          CallStack stack;
  #endif
          int32_t ref;
      };
  
      void addRef(ref_entry** refs, const void* id, int32_t mRef)
      {
          if (mTrackEnabled) {
              AutoMutex _l(mMutex);
  
              ref_entry* ref = new ref_entry;
              // Reference count at the time of the snapshot, but before the
              // update.  Positive value means we increment, negative--we
              // decrement the reference count.
              ref->ref = mRef;
              ref->id = id;
  #if DEBUG_REFS_CALLSTACK_ENABLED
              ref->stack.update(2);
  #endif
              ref->next = *refs;
              *refs = ref;
          }
      }
  
      void removeRef(ref_entry** refs, const void* id)
      {
          if (mTrackEnabled) {
              AutoMutex _l(mMutex);
              
              ref_entry* const head = *refs;
              ref_entry* ref = head;
              while (ref != NULL) {
                  if (ref->id == id) {
                      *refs = ref->next;
                      delete ref;
                      return;
                  }
                  refs = &ref->next;
                  ref = *refs;
              }
  
  #if DEBUG_REFS_FATAL_SANITY_CHECKS
              LOG_ALWAYS_FATAL("RefBase: removing id %p on RefBase %p"
                      "(weakref_type %p) that doesn't exist!",
                      id, mBase, this);
  #endif
  
              LOGE("RefBase: removing id %p on RefBase %p"
                      "(weakref_type %p) that doesn't exist!",
                      id, mBase, this);
  
              ref = head;
              while (ref) {
                  char inc = ref->ref >= 0 ? '+' : '-';
                  LOGD("	%c ID %p (ref %d):", inc, ref->id, ref->ref);
                  ref = ref->next;
              }
  
              CallStack stack;
              stack.update();
              stack.dump();
          }
      }
  
      void renameRefsId(ref_entry* r, const void* old_id, const void* new_id)
      {
          if (mTrackEnabled) {
              AutoMutex _l(mMutex);
              ref_entry* ref = r;
              while (ref != NULL) {
                  if (ref->id == old_id) {
                      ref->id = new_id;
                  }
                  ref = ref->next;
              }
          }
      }
  
      void printRefsLocked(String8* out, const ref_entry* refs) const
      {
          char buf[128];
          while (refs) {
              char inc = refs->ref >= 0 ? '+' : '-';
              sprintf(buf, "	%c ID %p (ref %d):
  ", 
                      inc, refs->id, refs->ref);
              out->append(buf);
  #if DEBUG_REFS_CALLSTACK_ENABLED
              out->append(refs->stack.toString("		"));
  #else
              out->append("		(call stacks disabled)");
  #endif
              refs = refs->next;
          }
      }
  
      mutable Mutex mMutex;
      ref_entry* mStrongRefs;
      ref_entry* mWeakRefs;
  
      bool mTrackEnabled;
      // Collect stack traces on addref and removeref, instead of deleting the stack references
      // on removeref that match the address ones.
      bool mRetain;
  
  #endif
  };
  
  // ---------------------------------------------------------------------------
  
  void RefBase::incStrong(const void* id) const
  {
      weakref_impl* const refs = mRefs;
      refs->incWeak(id);
      
      refs->addStrongRef(id);
      const int32_t c = android_atomic_inc(&refs->mStrong);
      LOG_ASSERT(c > 0, "incStrong() called on %p after last strong ref", refs);
  #if PRINT_REFS
      LOGD("incStrong of %p from %p: cnt=%d
  ", this, id, c);
  #endif
      if (c != INITIAL_STRONG_VALUE)  {
          return;
      }
  
      android_atomic_add(-INITIAL_STRONG_VALUE, &refs->mStrong);
      refs->mBase->onFirstRef();
  }
  
  void RefBase::decStrong(const void* id) const
  {
      weakref_impl* const refs = mRefs;
      refs->removeStrongRef(id);
      const int32_t c = android_atomic_dec(&refs->mStrong);
  #if PRINT_REFS
      LOGD("decStrong of %p from %p: cnt=%d
  ", this, id, c);
  #endif
      LOG_ASSERT(c >= 1, "decStrong() called on %p too many times", refs);
      if (c == 1) {
          refs->mBase->onLastStrongRef(id);
          if ((refs->mFlags&OBJECT_LIFETIME_MASK) == OBJECT_LIFETIME_STRONG) {
              delete this;
          }
      }
      refs->decWeak(id);
  }
  
  void RefBase::forceIncStrong(const void* id) const
  {
      weakref_impl* const refs = mRefs;
      refs->incWeak(id);
      
      refs->addStrongRef(id);
      const int32_t c = android_atomic_inc(&refs->mStrong);
      LOG_ASSERT(c >= 0, "forceIncStrong called on %p after ref count underflow",
                 refs);
  #if PRINT_REFS
      LOGD("forceIncStrong of %p from %p: cnt=%d
  ", this, id, c);
  #endif
  
      switch (c) {
      case INITIAL_STRONG_VALUE:
          android_atomic_add(-INITIAL_STRONG_VALUE, &refs->mStrong);
          // fall through...
      case 0:
          refs->mBase->onFirstRef();
      }
  }
  
  int32_t RefBase::getStrongCount() const
  {
      return mRefs->mStrong;
  }
  
  RefBase* RefBase::weakref_type::refBase() const
  {
      return static_cast<const weakref_impl*>(this)->mBase;
  }
  
  void RefBase::weakref_type::incWeak(const void* id)
  {
      weakref_impl* const impl = static_cast<weakref_impl*>(this);
      impl->addWeakRef(id);
      const int32_t c = android_atomic_inc(&impl->mWeak);
      LOG_ASSERT(c >= 0, "incWeak called on %p after last weak ref", this);
  }
  
  
  void RefBase::weakref_type::decWeak(const void* id)
  {
      weakref_impl* const impl = static_cast<weakref_impl*>(this);
      impl->removeWeakRef(id);
      const int32_t c = android_atomic_dec(&impl->mWeak);
      LOG_ASSERT(c >= 1, "decWeak called on %p too many times", this);
      if (c != 1) return;
  
      if ((impl->mFlags&OBJECT_LIFETIME_WEAK) == OBJECT_LIFETIME_STRONG) {
          // This is the regular lifetime case. The object is destroyed
          // when the last strong reference goes away. Since weakref_impl
          // outlive the object, it is not destroyed in the dtor, and
          // we'll have to do it here.
          if (impl->mStrong == INITIAL_STRONG_VALUE) {
              // Special case: we never had a strong reference, so we need to
              // destroy the object now.
              delete impl->mBase;
          } else {
              // LOGV("Freeing refs %p of old RefBase %p
  ", this, impl->mBase);
              delete impl;
          }
      } else {
          // less common case: lifetime is OBJECT_LIFETIME_{WEAK|FOREVER}
          impl->mBase->onLastWeakRef(id);
          if ((impl->mFlags&OBJECT_LIFETIME_MASK) == OBJECT_LIFETIME_WEAK) {
              // this is the OBJECT_LIFETIME_WEAK case. The last weak-reference
              // is gone, we can destroy the object.
              delete impl->mBase;
          }
      }
  }
  
  bool RefBase::weakref_type::attemptIncStrong(const void* id)
  {
      incWeak(id);
      
      weakref_impl* const impl = static_cast<weakref_impl*>(this);
      
      int32_t curCount = impl->mStrong;
      LOG_ASSERT(curCount >= 0, "attemptIncStrong called on %p after underflow",
                 this);
      while (curCount > 0 && curCount != INITIAL_STRONG_VALUE) {
          if (android_atomic_cmpxchg(curCount, curCount+1, &impl->mStrong) == 0) {
              break;
          }
          curCount = impl->mStrong;
      }
      
      if (curCount <= 0 || curCount == INITIAL_STRONG_VALUE) {
          bool allow;
          if (curCount == INITIAL_STRONG_VALUE) {
              // Attempting to acquire first strong reference...  this is allowed
              // if the object does NOT have a longer lifetime (meaning the
              // implementation doesn't need to see this), or if the implementation
              // allows it to happen.
              allow = (impl->mFlags&OBJECT_LIFETIME_WEAK) != OBJECT_LIFETIME_WEAK
                    || impl->mBase->onIncStrongAttempted(FIRST_INC_STRONG, id);
          } else {
              // Attempting to revive the object...  this is allowed
              // if the object DOES have a longer lifetime (so we can safely
              // call the object with only a weak ref) and the implementation
              // allows it to happen.
              allow = (impl->mFlags&OBJECT_LIFETIME_WEAK) == OBJECT_LIFETIME_WEAK
                    && impl->mBase->onIncStrongAttempted(FIRST_INC_STRONG, id);
          }
          if (!allow) {
              decWeak(id);
              return false;
          }
          curCount = android_atomic_inc(&impl->mStrong);
  
          // If the strong reference count has already been incremented by
          // someone else, the implementor of onIncStrongAttempted() is holding
          // an unneeded reference.  So call onLastStrongRef() here to remove it.
          // (No, this is not pretty.)  Note that we MUST NOT do this if we
          // are in fact acquiring the first reference.
          if (curCount > 0 && curCount < INITIAL_STRONG_VALUE) {
              impl->mBase->onLastStrongRef(id);
          }
      }
      
      impl->addStrongRef(id);
  
  #if PRINT_REFS
      LOGD("attemptIncStrong of %p from %p: cnt=%d
  ", this, id, curCount);
  #endif
  
      if (curCount == INITIAL_STRONG_VALUE) {
          android_atomic_add(-INITIAL_STRONG_VALUE, &impl->mStrong);
          impl->mBase->onFirstRef();
      }
      
      return true;
  }
  
  bool RefBase::weakref_type::attemptIncWeak(const void* id)
  {
      weakref_impl* const impl = static_cast<weakref_impl*>(this);
  
      int32_t curCount = impl->mWeak;
      LOG_ASSERT(curCount >= 0, "attemptIncWeak called on %p after underflow",
                 this);
      while (curCount > 0) {
          if (android_atomic_cmpxchg(curCount, curCount+1, &impl->mWeak) == 0) {
              break;
          }
          curCount = impl->mWeak;
      }
  
      if (curCount > 0) {
          impl->addWeakRef(id);
      }
  
      return curCount > 0;
  }
  
  int32_t RefBase::weakref_type::getWeakCount() const
  {
      return static_cast<const weakref_impl*>(this)->mWeak;
  }
  
  void RefBase::weakref_type::printRefs() const
  {
      static_cast<const weakref_impl*>(this)->printRefs();
  }
  
  void RefBase::weakref_type::trackMe(bool enable, bool retain)
  {
      static_cast<weakref_impl*>(this)->trackMe(enable, retain);
  }
  
  RefBase::weakref_type* RefBase::createWeak(const void* id) const
  {
      mRefs->incWeak(id);
      return mRefs;
  }
  
  RefBase::weakref_type* RefBase::getWeakRefs() const
  {
      return mRefs;
  }
  
  RefBase::RefBase()
      : mRefs(new weakref_impl(this))
  {
  }
  
  RefBase::~RefBase()
  {
      if (mRefs->mStrong == INITIAL_STRONG_VALUE) {
          // we never acquired a strong (and/or weak) reference on this object.
          delete mRefs;
      } else {
          // life-time of this object is extended to WEAK or FOREVER, in
          // which case weakref_impl doesn't out-live the object and we
          // can free it now.
          if ((mRefs->mFlags & OBJECT_LIFETIME_MASK) != OBJECT_LIFETIME_STRONG) {
              // It's possible that the weak count is not 0 if the object
              // re-acquired a weak reference in its destructor
              if (mRefs->mWeak == 0) {
                  delete mRefs;
              }
          }
      }
      // for debugging purposes, clear this.
      const_cast<weakref_impl*&>(mRefs) = NULL;
  }
  
  void RefBase::extendObjectLifetime(int32_t mode)
  {
      android_atomic_or(mode, &mRefs->mFlags);
  }
  
  void RefBase::onFirstRef()
  {
  }
  
  void RefBase::onLastStrongRef(const void* /**id*/)
  {
  }
  
  bool RefBase::onIncStrongAttempted(uint32_t flags, const void* id)
  {
      return (flags&FIRST_INC_STRONG) ? true : false;
  }
  
  void RefBase::onLastWeakRef(const void* /**id*/)
  {
  }
  
  // ---------------------------------------------------------------------------
  
  void RefBase::moveReferences(void* dst, void const* src, size_t n,
          const ReferenceConverterBase& caster)
  {
  #if DEBUG_REFS
      const size_t itemSize = caster.getReferenceTypeSize();
      for (size_t i=0 ; i<n ; i++) {
          void*       d = reinterpret_cast<void      *>(intptr_t(dst) + i*itemSize);
          void const* s = reinterpret_cast<void const*>(intptr_t(src) + i*itemSize);
          RefBase* ref(reinterpret_cast<RefBase*>(caster.getReferenceBase(d)));
          ref->mRefs->renameStrongRefId(s, d);
          ref->mRefs->renameWeakRefId(s, d);
      }
  #endif
  }
  
  // ---------------------------------------------------------------------------
  
  TextOutput& printStrongPointer(TextOutput& to, const void* val)
  {
      to << "sp<>(" << val << ")";
      return to;
  }
  
  TextOutput& printWeakPointer(TextOutput& to, const void* val)
  {
      to << "wp<>(" << val << ")";
      return to;
  }
  
  
  }; // namespace android

  void RefBase::incStrong(const void* id) const
  {
      weakref_impl* const refs = mRefs;
      refs->incWeak(id);    
      refs->addStrongRef(id);
      const int32_t c = android_atomic_inc(&refs->mStrong);
      LOG_ASSERT(c > 0, "incStrong() called on %p after last strong ref", refs);
  #if PRINT_REFS
      LOGD("incStrong of %p from %p: cnt=%d
  ", this, id, c);
  #endif
      if (c != INITIAL_STRONG_VALUE)  {
          return;
      }
      android_atomic_add(-INITIAL_STRONG_VALUE, &refs->mStrong);
      refs->mBase->onFirstRef();
  }
  void RefBase::decStrong(const void* id) const
  {
      weakref_impl* const refs = mRefs;
      refs->removeStrongRef(id);
      const int32_t c = android_atomic_dec(&refs->mStrong);
  #if PRINT_REFS
      LOGD("decStrong of %p from %p: cnt=%d
  ", this, id, c);
  #endif
      LOG_ASSERT(c >= 1, "decStrong() called on %p too many times", refs);
      if (c == 1) {
          refs->mBase->onLastStrongRef(id);
          if ((refs->mFlags&OBJECT_LIFETIME_MASK) == OBJECT_LIFETIME_STRONG) {
              delete this;
          }
      }
      refs->decWeak(id);
  }

IBinder

#ifndef ANDROID_IBINDER_H
#define ANDROID_IBINDER_H
#include <utils/Errors.h>
#include <utils/RefBase.h>
#include <utils/String16.h>
#include <utils/Vector.h>

#define B_PACK_CHARS(c1, c2, c3, c4) 
    ((((c1)<<24)) | (((c2)<<16)) | (((c3)<<8)) | (c4))
namespace android {
//forward declaration
class BBinder;
class BpBinder;
class IInterface;
class Parcel;

class IBinder : public virtual RefBase
{
public:
    enum {
        FIRST_CALL_TRANSACTION  = 0x00000001,
        LAST_CALL_TRANSACTION   = 0x00ffffff,
        PING_TRANSACTION        = B_PACK_CHARS('_','P','N','G'),
        DUMP_TRANSACTION        = B_PACK_CHARS('_','D','M','P'),
        INTERFACE_TRANSACTION   = B_PACK_CHARS('_', 'N', 'T', 'F'),
        FLAG_ONEWAY             = 0x00000001
    };
    IBinder();
    virtual sp<IInterface>  queryLocalInterface(const String16& descriptor);
    virtual const String16& getInterfaceDescriptor() const = 0;
    virtual bool            isBinderAlive() const = 0;
    virtual status_t        pingBinder() = 0;
    virtual status_t        dump(int fd, const Vector<String16>& args) = 0;
    virtual status_t        transact(   uint32_t code,
                                        const Parcel& data,
                                        Parcel* reply,
                                        uint32_t flags = 0) = 0;
    class DeathRecipient : public virtual RefBase
    {
    public:
        virtual void binderDied(const wp<IBinder>& who) = 0;
    };
    virtual status_t        linkToDeath(const sp<DeathRecipient>& recipient,
                                        void* cookie = NULL,
                                        uint32_t flags = 0) = 0;
    virtual status_t        unlinkToDeath(  const wp<DeathRecipient>& recipient,
                                            void* cookie = NULL,
                                            uint32_t flags = 0,
                                            wp<DeathRecipient>* outRecipient = NULL) = 0;

    virtual bool            checkSubclass(const void* subclassID) const;
    typedef void (*object_cleanup_func)(const void* id, void* obj, void* cleanupCookie);
    virtual void            attachObject(   const void* objectID,
                                            void* object,
                                            void* cleanupCookie,
                                            object_cleanup_func func) = 0;
    virtual void*           findObject(const void* objectID) const = 0;
    virtual void            detachObject(const void* objectID) = 0;
    virtual BBinder*        localBinder();
    virtual BpBinder*       remoteBinder();
protected:
    virtual          ~IBinder();
private:
};
}; 
#endif // ANDROID_IBINDER_H

namespace android {
//forward declaration
class BBinder;
class BpBinder;
class IInterface;
class Parcel;

class IBinder : public virtual RefBase
{
public:    
    IBinder();
    virtual sp<IInterface>  queryLocalInterface(const String16& descriptor);
    virtual const String16& getInterfaceDescriptor() const = 0;
    virtual bool  isBinderAlive() const = 0;
    virtual status_t  pingBinder() = 0;
    virtual status_t  dump(int fd, const Vector<String16>& args) = 0;
    virtual status_t  transact( uint32_t code,
                                const Parcel& data,
                                Parcel* reply,
                                uint32_t flags = 0) = 0;   
    virtual status_t  linkToDeath(const sp<DeathRecipient>& recipient,
                                        void* cookie = NULL,
                                        uint32_t flags = 0) = 0;
    virtual status_t  unlinkToDeath( const wp<DeathRecipient>& recipient,
                                     void* cookie = NULL,
                                      uint32_t flags = 0,
                                    wp<DeathRecipient>* outRecipient = NULL) = 0;
    virtual bool  checkSubclass(const void* subclassID) const;
    typedef void (*object_cleanup_func)(const void* id, void* obj, void* cleanupCookie);
    virtual void   attachObject(const void* objectID,
                                void* object,
                                void* cleanupCookie,
                                object_cleanup_func func) = 0;
    virtual void*  findObject(const void* objectID) const = 0;
    virtual void   detachObject(const void* objectID) = 0;
    virtual BBinder*  localBinder();
    virtual BpBinder* remoteBinder();
protected:
    virtual ~IBinder(); //stop from creating a Binder object on stack
private:
};
};

  BBinder,BpRefBase

• Binder.h

• /**
   * Copyright (C) 2008 The Android Open Source Project
   *
   * Licensed under the Apache License, Version 2.0 (the "License");
   * you may not use this file except in compliance with the License.
   * You may obtain a copy of the License at
   *
   *      http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  #ifndef ANDROID_BINDER_H
  #define ANDROID_BINDER_H
  
  #include <binder/IBinder.h>
  
  // ---------------------------------------------------------------------------
  namespace android {
  
  class BBinder : public IBinder
  {
  public:
                          BBinder();
  
      virtual const String16& getInterfaceDescriptor() const;
      virtual bool        isBinderAlive() const;
      virtual status_t    pingBinder();
      virtual status_t    dump(int fd, const Vector<String16>& args);
  
      virtual status_t    transact(   uint32_t code,
                                      const Parcel& data,
                                      Parcel* reply,
                                      uint32_t flags = 0);
  
      virtual status_t    linkToDeath(const sp<DeathRecipient>& recipient,
                                      void* cookie = NULL,
                                      uint32_t flags = 0);
  
      virtual status_t    unlinkToDeath(  const wp<DeathRecipient>& recipient,
                                          void* cookie = NULL,
                                          uint32_t flags = 0,
                                          wp<DeathRecipient>* outRecipient = NULL);
  
      virtual void        attachObject(   const void* objectID,
                                          void* object,
                                          void* cleanupCookie,
                                          object_cleanup_func func);
      virtual void*       findObject(const void* objectID) const;
      virtual void        detachObject(const void* objectID);
  
      virtual BBinder*    localBinder();
  
  protected:
      virtual             ~BBinder();
  
      virtual status_t    onTransact( uint32_t code,
                                      const Parcel& data,
                                      Parcel* reply,
                                      uint32_t flags = 0);
  
  private:
                          BBinder(const BBinder& o);
              BBinder&    operator=(const BBinder& o);
  
      class Extras;
  
              Extras*     mExtras;
              void*       mReserved0;
  };
  
  // ---------------------------------------------------------------------------
  
  class BpRefBase : public virtual RefBase
  {
  protected:
                              BpRefBase(const sp<IBinder>& o);
      virtual                 ~BpRefBase();
      virtual void            onFirstRef();
      virtual void            onLastStrongRef(const void* id);
      virtual bool            onIncStrongAttempted(uint32_t flags, const void* id);
  
      inline  IBinder*        remote()                { return mRemote; }
      inline  IBinder*        remote() const          { return mRemote; }
  
  private:
                              BpRefBase(const BpRefBase& o);
      BpRefBase&              operator=(const BpRefBase& o);
  
      IBinder* const          mRemote;
      RefBase::weakref_type*  mRefs;
      volatile int32_t        mState;
  };
  
  }; // namespace android
  
  // ---------------------------------------------------------------------------
  
  #endif // ANDROID_BINDER_H

• Binder.cpp

/**
 * Copyright (C) 2005 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <binder/Binder.h>

#include <utils/Atomic.h>
#include <binder/BpBinder.h>
#include <binder/IInterface.h>
#include <binder/Parcel.h>

#include <stdio.h>

namespace android {

// ---------------------------------------------------------------------------

IBinder::IBinder()
    : RefBase()
{
}

IBinder::~IBinder()
{
}

// ---------------------------------------------------------------------------

sp<IInterface>  IBinder::queryLocalInterface(const String16& descriptor)
{
    return NULL;
}

BBinder* IBinder::localBinder()
{
    return NULL;
}

BpBinder* IBinder::remoteBinder()
{
    return NULL;
}

bool IBinder::checkSubclass(const void* /**subclassID*/) const
{
    return false;
}

// ---------------------------------------------------------------------------

class BBinder::Extras
{
public:
    Mutex mLock;
    BpBinder::ObjectManager mObjects;
};

// ---------------------------------------------------------------------------

BBinder::BBinder()
    : mExtras(NULL)
{
}

bool BBinder::isBinderAlive() const
{
    return true;
}

status_t BBinder::pingBinder()
{
    return NO_ERROR;
}

const String16& BBinder::getInterfaceDescriptor() const
{
    // This is a local static rather than a global static,
    // to avoid static initializer ordering issues.
    static String16 sEmptyDescriptor;
    LOGW("reached BBinder::getInterfaceDescriptor (this=%p)", this);
    return sEmptyDescriptor;
}

status_t BBinder::transact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    data.setDataPosition(0);

    status_t err = NO_ERROR;
    switch (code) {
        case PING_TRANSACTION:
            reply->writeInt32(pingBinder());
            break;
        default:
            err = onTransact(code, data, reply, flags);
            break;
    }

    if (reply != NULL) {
        reply->setDataPosition(0);
    }

    return err;
}

status_t BBinder::linkToDeath(
    const sp<DeathRecipient>& recipient, void* cookie, uint32_t flags)
{
    return INVALID_OPERATION;
}

status_t BBinder::unlinkToDeath(
    const wp<DeathRecipient>& recipient, void* cookie, uint32_t flags,
    wp<DeathRecipient>* outRecipient)
{
    return INVALID_OPERATION;
}

status_t BBinder::dump(int fd, const Vector<String16>& args)
{
    return NO_ERROR;
}

void BBinder::attachObject(
    const void* objectID, void* object, void* cleanupCookie,
    object_cleanup_func func)
{
    Extras* e = mExtras;

    if (!e) {
        e = new Extras;
        if (android_atomic_cmpxchg(0, reinterpret_cast<int32_t>(e),
                reinterpret_cast<volatile int32_t*>(&mExtras)) != 0) {
            delete e;
            e = mExtras;
        }
        if (e == 0) return; // out of memory
    }

    AutoMutex _l(e->mLock);
    e->mObjects.attach(objectID, object, cleanupCookie, func);
}

void* BBinder::findObject(const void* objectID) const
{
    Extras* e = mExtras;
    if (!e) return NULL;

    AutoMutex _l(e->mLock);
    return e->mObjects.find(objectID);
}

void BBinder::detachObject(const void* objectID)
{
    Extras* e = mExtras;
    if (!e) return;

    AutoMutex _l(e->mLock);
    e->mObjects.detach(objectID);
}

BBinder* BBinder::localBinder()
{
    return this;
}

BBinder::~BBinder()
{
    if (mExtras) delete mExtras;
}


status_t BBinder::onTransact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    switch (code) {
        case INTERFACE_TRANSACTION:
            reply->writeString16(getInterfaceDescriptor());
            return NO_ERROR;

        case DUMP_TRANSACTION: {
            int fd = data.readFileDescriptor();
            int argc = data.readInt32();
            Vector<String16> args;
            for (int i = 0; i < argc && data.dataAvail() > 0; i++) {
               args.add(data.readString16());
            }
            return dump(fd, args);
        }
        default:
            return UNKNOWN_TRANSACTION;
    }
}

// ---------------------------------------------------------------------------

enum {
    // This is used to transfer ownership of the remote binder from
    // the BpRefBase object holding it (when it is constructed), to the
    // owner of the BpRefBase object when it first acquires that BpRefBase.
    kRemoteAcquired = 0x00000001
};

BpRefBase::BpRefBase(const sp<IBinder>& o)
    : mRemote(o.get()), mRefs(NULL), mState(0)
{
    extendObjectLifetime(OBJECT_LIFETIME_WEAK);

    if (mRemote) {
        mRemote->incStrong(this);           // Removed on first IncStrong().
        mRefs = mRemote->createWeak(this);  // Held for our entire lifetime.
    }
}

BpRefBase::~BpRefBase()
{
    if (mRemote) {
        if (!(mState&kRemoteAcquired)) {
            mRemote->decStrong(this);
        }
        mRefs->decWeak(this);
    }
}

void BpRefBase::onFirstRef()
{
    android_atomic_or(kRemoteAcquired, &mState);
}

void BpRefBase::onLastStrongRef(const void* id)
{
    if (mRemote) {
        mRemote->decStrong(this);
    }
}

bool BpRefBase::onIncStrongAttempted(uint32_t flags, const void* id)
{
    return mRemote ? mRefs->attemptIncStrong(this) : false;
}

}; // namespace android

status_t BBinder::onTransact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    switch (code) {
        case INTERFACE_TRANSACTION:
            reply->writeString16(getInterfaceDescriptor());
            return NO_ERROR;

        case DUMP_TRANSACTION: {
            int fd = data.readFileDescriptor();
            int argc = data.readInt32();
            Vector<String16> args;
            for (int i = 0; i < argc && data.dataAvail() > 0; i++) {
               args.add(data.readString16());
            }
            return dump(fd, args);
        }
        default:
            return UNKNOWN_TRANSACTION;
    }
} 

BBinder* BBinder::localBinder()
{
    return this;
}

BpBinder

• BpBinder.h

• /**
   * Copyright (C) 2005 The Android Open Source Project
   *
   * Licensed under the Apache License, Version 2.0 (the "License");
   * you may not use this file except in compliance with the License.
   * You may obtain a copy of the License at
   *
   *      http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  #ifndef ANDROID_BPBINDER_H
  #define ANDROID_BPBINDER_H
  
  #include <binder/IBinder.h>
  #include <utils/KeyedVector.h>
  #include <utils/threads.h>
  
  // ---------------------------------------------------------------------------
  namespace android {
  
  class BpBinder : public IBinder
  {
  public:
      BpBinder(int32_t handle);
      inline  int32_t     handle() const { return mHandle; }
      virtual const String16&    getInterfaceDescriptor() const;
      virtual bool        isBinderAlive() const;
      virtual status_t    pingBinder();
      virtual status_t    dump(int fd, const Vector<String16>& args);
      virtual status_t    transact(   uint32_t code,
                                      const Parcel& data,
                                      Parcel* reply,
                                      uint32_t flags = 0);
      virtual status_t    linkToDeath(const sp<DeathRecipient>& recipient,
                                      void* cookie = NULL,
                                      uint32_t flags = 0);
      virtual status_t    unlinkToDeath(  const wp<DeathRecipient>& recipient,
                                          void* cookie = NULL,
                                          uint32_t flags = 0,
                                          wp<DeathRecipient>* outRecipient = NULL);
      virtual void        attachObject(   const void* objectID,
                                          void* object,
                                          void* cleanupCookie,
                                          object_cleanup_func func);
      virtual void*       findObject(const void* objectID) const;
      virtual void        detachObject(const void* objectID);
      virtual BpBinder*   remoteBinder();
      status_t    setConstantData(const void* data, size_t size);
      void        sendObituary();
      class ObjectManager
      {
      public:
          ObjectManager();
          ~ObjectManager();
          void        attach( const void* objectID,
                              void* object,
                              void* cleanupCookie,
                              IBinder::object_cleanup_func func);
          void*       find(const void* objectID) const;
          void        detach(const void* objectID);
          void        kill();
      private:
          ObjectManager(const ObjectManager&);
          ObjectManager& operator=(const ObjectManager&);
          struct entry_t
          {
              void* object;
              void* cleanupCookie;
              IBinder::object_cleanup_func func;
          };
          KeyedVector<const void*, entry_t> mObjects;
      };
  protected:
      virtual             ~BpBinder();
      virtual void        onFirstRef();
      virtual void        onLastStrongRef(const void* id);
      virtual bool        onIncStrongAttempted(uint32_t flags, const void* id);
  private:
      const   int32_t             mHandle;
      struct Obituary {
          wp<DeathRecipient> recipient;
          void* cookie;
          uint32_t flags;
      };
      void                reportOneDeath(const Obituary& obit);
      bool                isDescriptorCached() const;
      mutable Mutex               mLock;
              volatile int32_t    mAlive;
              volatile int32_t    mObitsSent;
              Vector<Obituary>*   mObituaries;
              ObjectManager       mObjects;
              Parcel*             mConstantData;
      mutable String16            mDescriptorCache;
  };
  
  }; // namespace android
  
  // ---------------------------------------------------------------------------
  
  #endif // ANDROID_BPBINDER_H

• BpBinder.cpp

• /**
   * Copyright (C) 2005 The Android Open Source Project
   *
   * Licensed under the Apache License, Version 2.0 (the "License");
   * you may not use this file except in compliance with the License.
   * You may obtain a copy of the License at
   *
   *      http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  #define LOG_TAG "BpBinder"
  //#define LOG_NDEBUG 0
  
  #include <binder/BpBinder.h>
  
  #include <binder/IPCThreadState.h>
  #include <utils/Log.h>
  
  #include <stdio.h>
  
  //#undef LOGV
  //#define LOGV(...) fprintf(stderr, __VA_ARGS__)
  
  namespace android {
  
  // ---------------------------------------------------------------------------
  
  BpBinder::ObjectManager::ObjectManager()
  {
  }
  
  BpBinder::ObjectManager::~ObjectManager()
  {
      kill();
  }
  
  void BpBinder::ObjectManager::attach(
      const void* objectID, void* object, void* cleanupCookie,
      IBinder::object_cleanup_func func)
  {
      entry_t e;
      e.object = object;
      e.cleanupCookie = cleanupCookie;
      e.func = func;
  
      if (mObjects.indexOfKey(objectID) >= 0) {
          LOGE("Trying to attach object ID %p to binder ObjectManager %p with object %p, but object ID already in use",
                  objectID, this,  object);
          return;
      }
  
      mObjects.add(objectID, e);
  }
  
  void* BpBinder::ObjectManager::find(const void* objectID) const
  {
      const ssize_t i = mObjects.indexOfKey(objectID);
      if (i < 0) return NULL;
      return mObjects.valueAt(i).object;
  }
  
  void BpBinder::ObjectManager::detach(const void* objectID)
  {
      mObjects.removeItem(objectID);
  }
  
  void BpBinder::ObjectManager::kill()
  {
      const size_t N = mObjects.size();
      LOGV("Killing %d objects in manager %p", N, this);
      for (size_t i=0; i<N; i++) {
          const entry_t& e = mObjects.valueAt(i);
          if (e.func != NULL) {
              e.func(mObjects.keyAt(i), e.object, e.cleanupCookie);
          }
      }
  
      mObjects.clear();
  }
  
  // ---------------------------------------------------------------------------
  
  BpBinder::BpBinder(int32_t handle)
      : mHandle(handle)
      , mAlive(1)
      , mObitsSent(0)
      , mObituaries(NULL)
  {
      LOGV("Creating BpBinder %p handle %d
  ", this, mHandle);
  
      extendObjectLifetime(OBJECT_LIFETIME_WEAK);
      IPCThreadState::self()->incWeakHandle(handle);
  }
  
  bool BpBinder::isDescriptorCached() const {
      Mutex::Autolock _l(mLock);
      return mDescriptorCache.size() ? true : false;
  }
  
  const String16& BpBinder::getInterfaceDescriptor() const
  {
      if (isDescriptorCached() == false) {
          Parcel send, reply;
          // do the IPC without a lock held.
          status_t err = const_cast<BpBinder*>(this)->transact(
                  INTERFACE_TRANSACTION, send, &reply);
          if (err == NO_ERROR) {
              String16 res(reply.readString16());
              Mutex::Autolock _l(mLock);
              // mDescriptorCache could have been assigned while the lock was
              // released.
              if (mDescriptorCache.size() == 0)
                  mDescriptorCache = res;
          }
      }
      
      // we're returning a reference to a non-static object here. Usually this
      // is not something smart to do, however, with binder objects it is 
      // (usually) safe because they are reference-counted.
      
      return mDescriptorCache;
  }
  
  bool BpBinder::isBinderAlive() const
  {
      return mAlive != 0;
  }
  
  status_t BpBinder::pingBinder()
  {
      Parcel send;
      Parcel reply;
      status_t err = transact(PING_TRANSACTION, send, &reply);
      if (err != NO_ERROR) return err;
      if (reply.dataSize() < sizeof(status_t)) return NOT_ENOUGH_DATA;
      return (status_t)reply.readInt32();
  }
  
  status_t BpBinder::dump(int fd, const Vector<String16>& args)
  {
      Parcel send;
      Parcel reply;
      send.writeFileDescriptor(fd);
      const size_t numArgs = args.size();
      send.writeInt32(numArgs);
      for (size_t i = 0; i < numArgs; i++) {
          send.writeString16(args[i]);
      }
      status_t err = transact(DUMP_TRANSACTION, send, &reply);
      return err;
  }
  
  status_t BpBinder::transact(
      uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
  {
      // Once a binder has died, it will never come back to life.
      if (mAlive) {
          status_t status = IPCThreadState::self()->transact(
              mHandle, code, data, reply, flags);
          if (status == DEAD_OBJECT) mAlive = 0;
          return status;
      }
  
      return DEAD_OBJECT;
  }
  
  status_t BpBinder::linkToDeath(
      const sp<DeathRecipient>& recipient, void* cookie, uint32_t flags)
  {
      Obituary ob;
      ob.recipient = recipient;
      ob.cookie = cookie;
      ob.flags = flags;
  
      LOG_ALWAYS_FATAL_IF(recipient == NULL,
                          "linkToDeath(): recipient must be non-NULL");
  
      {
          AutoMutex _l(mLock);
  
          if (!mObitsSent) {
              if (!mObituaries) {
                  mObituaries = new Vector<Obituary>;
                  if (!mObituaries) {
                      return NO_MEMORY;
                  }
                  LOGV("Requesting death notification: %p handle %d
  ", this, mHandle);
                  getWeakRefs()->incWeak(this);
                  IPCThreadState* self = IPCThreadState::self();
                  self->requestDeathNotification(mHandle, this);
                  self->flushCommands();
              }
              ssize_t res = mObituaries->add(ob);
              return res >= (ssize_t)NO_ERROR ? (status_t)NO_ERROR : res;
          }
      }
  
      return DEAD_OBJECT;
  }
  
  status_t BpBinder::unlinkToDeath(
      const wp<DeathRecipient>& recipient, void* cookie, uint32_t flags,
      wp<DeathRecipient>* outRecipient)
  {
      AutoMutex _l(mLock);
  
      if (mObitsSent) {
          return DEAD_OBJECT;
      }
  
      const size_t N = mObituaries ? mObituaries->size() : 0;
      for (size_t i=0; i<N; i++) {
          const Obituary& obit = mObituaries->itemAt(i);
          if ((obit.recipient == recipient
                      || (recipient == NULL && obit.cookie == cookie))
                  && obit.flags == flags) {
              const uint32_t allFlags = obit.flags|flags;
              if (outRecipient != NULL) {
                  *outRecipient = mObituaries->itemAt(i).recipient;
              }
              mObituaries->removeAt(i);
              if (mObituaries->size() == 0) {
                  LOGV("Clearing death notification: %p handle %d
  ", this, mHandle);
                  IPCThreadState* self = IPCThreadState::self();
                  self->clearDeathNotification(mHandle, this);
                  self->flushCommands();
                  delete mObituaries;
                  mObituaries = NULL;
              }
              return NO_ERROR;
          }
      }
  
      return NAME_NOT_FOUND;
  }
  
  void BpBinder::sendObituary()
  {
      LOGV("Sending obituary for proxy %p handle %d, mObitsSent=%s
  ",
          this, mHandle, mObitsSent ? "true" : "false");
  
      mAlive = 0;
      if (mObitsSent) return;
  
      mLock.lock();
      Vector<Obituary>* obits = mObituaries;
      if(obits != NULL) {
          LOGV("Clearing sent death notification: %p handle %d
  ", this, mHandle);
          IPCThreadState* self = IPCThreadState::self();
          self->clearDeathNotification(mHandle, this);
          self->flushCommands();
          mObituaries = NULL;
      }
      mObitsSent = 1;
      mLock.unlock();
  
      LOGV("Reporting death of proxy %p for %d recipients
  ",
          this, obits ? obits->size() : 0);
  
      if (obits != NULL) {
          const size_t N = obits->size();
          for (size_t i=0; i<N; i++) {
              reportOneDeath(obits->itemAt(i));
          }
  
          delete obits;
      }
  }
  
  void BpBinder::reportOneDeath(const Obituary& obit)
  {
      sp<DeathRecipient> recipient = obit.recipient.promote();
      LOGV("Reporting death to recipient: %p
  ", recipient.get());
      if (recipient == NULL) return;
  
      recipient->binderDied(this);
  }
  
  
  void BpBinder::attachObject(
      const void* objectID, void* object, void* cleanupCookie,
      object_cleanup_func func)
  {
      AutoMutex _l(mLock);
      LOGV("Attaching object %p to binder %p (manager=%p)", object, this, &mObjects);
      mObjects.attach(objectID, object, cleanupCookie, func);
  }
  
  void* BpBinder::findObject(const void* objectID) const
  {
      AutoMutex _l(mLock);
      return mObjects.find(objectID);
  }
  
  void BpBinder::detachObject(const void* objectID)
  {
      AutoMutex _l(mLock);
      mObjects.detach(objectID);
  }
  
  BpBinder* BpBinder::remoteBinder()
  {
      return this;
  }
  
  BpBinder::~BpBinder()
  {
      LOGV("Destroying BpBinder %p handle %d
  ", this, mHandle);
  
      IPCThreadState* ipc = IPCThreadState::self();
  
      mLock.lock();
      Vector<Obituary>* obits = mObituaries;
      if(obits != NULL) {
          if (ipc) ipc->clearDeathNotification(mHandle, this);
          mObituaries = NULL;
      }
      mLock.unlock();
  
      if (obits != NULL) {
          // XXX Should we tell any remaining DeathRecipient
          // objects that the last strong ref has gone away, so they
          // are no longer linked?
          delete obits;
      }
  
      if (ipc) {
          ipc->expungeHandle(mHandle, this);
          ipc->decWeakHandle(mHandle);
      }
  }
  
  void BpBinder::onFirstRef()
  {
      LOGV("onFirstRef BpBinder %p handle %d
  ", this, mHandle);
      IPCThreadState* ipc = IPCThreadState::self();
      if (ipc) ipc->incStrongHandle(mHandle);
  }
  
  void BpBinder::onLastStrongRef(const void* id)
  {
      LOGV("onLastStrongRef BpBinder %p handle %d
  ", this, mHandle);
      IF_LOGV() {
          printRefs();
      }
      IPCThreadState* ipc = IPCThreadState::self();
      if (ipc) ipc->decStrongHandle(mHandle);
  }
  
  bool BpBinder::onIncStrongAttempted(uint32_t flags, const void* id)
  {
      LOGV("onIncStrongAttempted BpBinder %p handle %d
  ", this, mHandle);
      IPCThreadState* ipc = IPCThreadState::self();
      return ipc ? ipc->attemptIncStrongHandle(mHandle) == NO_ERROR : false;
  }
  
  // ---------------------------------------------------------------------------
  
  }; // namespace android

  status_t BpBinder::transact(
      uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
  {
      // Once a binder has died, it will never come back to life.
      if (mAlive) {
          status_t status = IPCThreadState::self()->transact(
              mHandle, code, data, reply, flags);
          if (status == DEAD_OBJECT) mAlive = 0;
          return status;
      }
  
      return DEAD_OBJECT;
  }

IInterface

• IInterface.cpp

• #include <binder/IInterface.h>
  namespace android {
  IInterface::IInterface() 
      : RefBase() {
  }
  IInterface::~IInterface() {
  }
  sp<IBinder> IInterface::asBinder()
  {
      return this ? onAsBinder() : NULL;
  }
  sp<const IBinder> IInterface::asBinder() const
  {
      return this ? const_cast<IInterface*>(this)->onAsBinder() : NULL;
  }
  };

• IInterface.h

• class IInterface : public virtual RefBase
  {
  public:
              IInterface();
              sp<IBinder>         asBinder();
              sp<const IBinder>   asBinder() const;
              
  protected:
      virtual                     ~IInterface();
      virtual IBinder*            onAsBinder() = 0;
  };

  /**
   * Copyright (C) 2005 The Android Open Source Project
   *
   * Licensed under the Apache License, Version 2.0 (the "License");
   * you may not use this file except in compliance with the License.
   * You may obtain a copy of the License at
   *
   *      http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  //
  #ifndef ANDROID_IINTERFACE_H
  #define ANDROID_IINTERFACE_H
  
  #include <binder/Binder.h>
  
  namespace android {
  
  // ----------------------------------------------------------------------
  
  class IInterface : public virtual RefBase
  {
  public:
              IInterface();
              sp<IBinder>         asBinder();
              sp<const IBinder>   asBinder() const;
              
  protected:
      virtual                     ~IInterface();
      virtual IBinder*            onAsBinder() = 0;
  };
  
  // ----------------------------------------------------------------------
  
  template<typename INTERFACE>
  inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)
  {
      return INTERFACE::asInterface(obj);
  }
  
  // ----------------------------------------------------------------------
  
  template<typename INTERFACE>
  class BnInterface : public INTERFACE, public BBinder
  {
  public:
      virtual sp<IInterface>      queryLocalInterface(const String16& _descriptor);
      virtual const String16&     getInterfaceDescriptor() const;
  
  protected:
      virtual IBinder*            onAsBinder();
  };
  
  // ----------------------------------------------------------------------
  
  template<typename INTERFACE>
  class BpInterface : public INTERFACE, public BpRefBase
  {
  public:
                                  BpInterface(const sp<IBinder>& remote);
  
  protected:
      virtual IBinder*            onAsBinder();
  };
  
  // ----------------------------------------------------------------------
  
  #define DECLARE_META_INTERFACE(INTERFACE)                               
      static const android::String16 descriptor;                          
      static android::sp<I##INTERFACE> asInterface(                       
              const android::sp<android::IBinder>& obj);                  
      virtual const android::String16& getInterfaceDescriptor() const;    
      I##INTERFACE();                                                     
      virtual ~I##INTERFACE();                                            
  
  
  #define IMPLEMENT_META_INTERFACE(INTERFACE, NAME)                       
      const android::String16 I##INTERFACE::descriptor(NAME);             
      const android::String16&                                            
              I##INTERFACE::getInterfaceDescriptor() const {              
          return I##INTERFACE::descriptor;                                
      }                                                                   
      android::sp<I##INTERFACE> I##INTERFACE::asInterface(                
              const android::sp<android::IBinder>& obj)                   
      {                                                                   
          android::sp<I##INTERFACE> intr;                                 
          if (obj != NULL) {                                              
              intr = static_cast<I##INTERFACE*>(                          
                  obj->queryLocalInterface(                               
                          I##INTERFACE::descriptor).get());               
              if (intr == NULL) {                                         
                  intr = new Bp##INTERFACE(obj);                          
              }                                                           
          }                                                               
          return intr;                                                    
      }                                                                   
      I##INTERFACE::I##INTERFACE() { }                                    
      I##INTERFACE::~I##INTERFACE() { }                                   
  
  
  #define CHECK_INTERFACE(interface, data, reply)                         
      if (!data.checkInterface(this)) { return PERMISSION_DENIED; }       
  
  
  // ----------------------------------------------------------------------
  // No user-serviceable parts after this...
  
  template<typename INTERFACE>
  inline sp<IInterface> BnInterface<INTERFACE>::queryLocalInterface(
          const String16& _descriptor)
  {
      if (_descriptor == INTERFACE::descriptor) return this;
      return NULL;
  }
  
  template<typename INTERFACE>
  inline const String16& BnInterface<INTERFACE>::getInterfaceDescriptor() const
  {
      return INTERFACE::getInterfaceDescriptor();
  }
  
  template<typename INTERFACE>
  IBinder* BnInterface<INTERFACE>::onAsBinder()
  {
      return this;
  }
  
  template<typename INTERFACE>
  inline BpInterface<INTERFACE>::BpInterface(const sp<IBinder>& remote)
      : BpRefBase(remote)
  {
  }
  
  template<typename INTERFACE>
  inline IBinder* BpInterface<INTERFACE>::onAsBinder()
  {
      return remote();
  }
      
  // ----------------------------------------------------------------------
  
  }; // namespace android
  
  #endif // ANDROID_IINTERFACE_H

   

  template<typename INTERFACE>
  IBinder* BnInterface<INTERFACE>::onAsBinder()
  {
      return this;
  }

  template<typename INTERFACE>
  inline IBinder* BpInterface<INTERFACE>::onAsBinder()
  {
      return remote();
  }

   

• Every process shall open "dev/binder" as shared memory used for communication between processes.

• ProcessState::ProcessState()
      : mDriverFD(open_driver())
      , mVMStart(MAP_FAILED)
      , mManagesContexts(false)
      , mBinderContextCheckFunc(NULL)
      , mBinderContextUserData(NULL)
      , mThreadPoolStarted(false)
      , mThreadPoolSeq(1)
  {
      if (mDriverFD >= 0) {
  #if !defined(HAVE_WIN32_IPC)        
          mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
          if (mVMStart == MAP_FAILED) {
              LOGE("Using /dev/binder failed: unable to mmap transaction memory.
  ");
              close(mDriverFD);
              mDriverFD = -1;
          }
  #else
          mDriverFD = -1;
  #endif
      }
      LOG_ALWAYS_FATAL_IF(mDriverFD < 0, "Binder driver could not be opened.  Terminating.");
  }

• Every service or client has a binder reference to service manager with default 0# reference, which is BpServiceManager

• sp<IServiceManager> defaultServiceManager()
  {
      if (gDefaultServiceManager != NULL) return gDefaultServiceManager;
      
      {
          AutoMutex _l(gDefaultServiceManagerLock);
          if (gDefaultServiceManager == NULL) {
              gDefaultServiceManager = interface_cast<IServiceManager>(
                  ProcessState::self()->getContextObject(NULL));
          }
      }    
      return gDefaultServiceManager;
  }
  sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& caller)
  {
      return getStrongProxyForHandle(0);
  }
  sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)
  {
      sp<IBinder> result;
  
      AutoMutex _l(mLock);
      handle_entry* e = lookupHandleLocked(handle);
      if (e != NULL) {
          IBinder* b = e->binder;
          if (b == NULL || !e->refs->attemptIncWeak(this)) {
              b = new BpBinder(handle); 
              e->binder = b;
              if (b) e->refs = b->getWeakRefs();
              result = b;
          } else {
              result.force_set(b);
              e->refs->decWeak(this);
          }
      }
      return result;
  }
  BpBinder::BpBinder(int32_t handle)
      : mHandle(handle)
      , mAlive(1)
      , mObitsSent(0)
      , mObituaries(NULL)
  {
      extendObjectLifetime(OBJECT_LIFETIME_WEAK);
      IPCThreadState::self()->incWeakHandle(handle);
  }
  template<typename INTERFACE>
  inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)
  {
      return INTERFACE::asInterface(obj);
  }
  #define DECLARE_META_INTERFACE(ServiceManager)                               
      static const android::String16 descriptor;                          
      static android::sp<IServiceManager> asServiceManager(                       
              const android::sp<android::IBinder>& obj);                  
      virtual const android::String16& getServiceManagerDescriptor() const;    
      IServiceManager();                                                     
      virtual ~IServiceManager();                                       
  #define IMPLEMENT_META_INTERFACE(ServiceManager, NAME)                       
      const android::String16 IServiceManager::descriptor(NAME);             
      const android::String16&                                            
              IServiceManager::getServiceManagerDescriptor() const {              
          return IServiceManager::descriptor;                                
      }                                                                   
      android::sp<IServiceManager> IServiceManager::asInterface(                
              const android::sp<android::IBinder>& obj)                   
      {                                                                   
          android::sp<IServiceManager> intr;                                 
          if (obj != NULL) {                                              
              intr = static_cast<IServiceManager*>(                          
                  obj->queryLocalServiceManager(                               
                          IServiceManager::descriptor).get());               
              if (intr == NULL) {                                         
                  intr = new BpServiceManager(obj); //obj is remote                         
              }                                                           
          }                                                               
          return intr;                                                    
      }                                                                   
      IServiceManager::IServiceManager() { }                                    
      IServiceManager::~IServiceManager() { }

• Now we have a BpServiceManager

• class BpServiceManager : public BpInterface<IServiceManager>
  {
  public:
      BpServiceManager(const sp<IBinder>& impl)
          : BpInterface<IServiceManager>(impl)
      {
      }
  
      virtual sp<IBinder> getService(const String16& name) const
      {
          unsigned n;
          for (n = 0; n < 5; n++){
              sp<IBinder> svc = checkService(name);
              if (svc != NULL) return svc;
              LOGI("Waiting for service %s...
  ", String8(name).string());
              sleep(1);
          }
          return NULL;
      }
  
      virtual sp<IBinder> checkService( const String16& name) const
      {
          Parcel data, reply;
          data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
          data.writeString16(name);
          remote()->transact(CHECK_SERVICE_TRANSACTION, data, &reply);
          return reply.readStrongBinder();
      }
  
      virtual status_t addService(const String16& name, const sp<IBinder>& service)
      {
          Parcel data, reply;
          data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
          data.writeString16(name);
          data.writeStrongBinder(service);
          status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);
          return err == NO_ERROR ? reply.readExceptionCode() : err;
      }
  
      virtual Vector<String16> listServices()
      {
          Vector<String16> res;
          int n = 0;
  
          for (;;) {
              Parcel data, reply;
              data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
              data.writeInt32(n++);
              status_t err = remote()->transact(LIST_SERVICES_TRANSACTION, data, &reply);
              if (err != NO_ERROR)
                  break;
              res.add(reply.readString16());
          }
          return res;
      }
  };

• Every service add itself into service manager

• void MediaPlayerService::instantiate() {
      defaultServiceManager()->addService(
              String16("media.player"), new MediaPlayerService());//create a new service object to give ServiceMananger
  }

• Now we call addService() of BpServiceManager

• virtual status_t addService(const String16& name, const sp<IBinder>& service)
      {
          Parcel data, reply;
          data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
          data.writeString16(name);
          data.writeStrongBinder(service);
          status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);
          return err == NO_ERROR ? reply.readExceptionCode() : err;
      }

• Where is remote()?

• class BpServiceManager : public BpInterface<IServiceManager>
  
  template<typename INTERFACE>
  IBinder* BnInterface<INTERFACE>::onAsBinder()
  {
      return this;
  }
  template<typename INTERFACE>
  inline BpInterface<INTERFACE>::BpInterface(const sp<IBinder>& remote)
      : BpRefBase(remote)
  {
  }
  template<typename INTERFACE>
  inline IBinder* BpInterface<INTERFACE>::onAsBinder()
  {
      return remote();
  }

• where is remote from??
  • Ohh.....for BpServiceManager,it is this

• intr = new BpServiceManager(obj);
  class BpServiceManager : public BpInterface<IServiceManager>
  {
  public:
      BpServiceManager(const sp<IBinder>& impl)
          : BpInterface<IServiceManager>(impl)
      {
      }
      .........
  }

• Write data to binder

• status_t BpBinder::transact(
      uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
  {
      // Once a binder has died, it will never come back to life.
      if (mAlive) {
          status_t status = 
                  IPCThreadState::self()->transact(mHandle, code, data, reply, flags);
          if (status == DEAD_OBJECT) mAlive = 0;
          return status;
      }
      return DEAD_OBJECT;
  }
  status_t IPCThreadState::transact(int32_t handle,
                                    uint32_t code, const Parcel& data,
                                    Parcel* reply, uint32_t flags)
  {
      status_t err = data.errorCheck();
      flags |= TF_ACCEPT_FDS;
      IF_LOG_TRANSACTIONS() {
          TextOutput::Bundle _b(alog);
          alog << "BC_TRANSACTION thr " << (void*)pthread_self() << " / hand "
              << handle << " / code " << TypeCode(code) << ": "
              << indent << data << dedent << endl;
      }    
      if (err == NO_ERROR) {
          LOG_ONEWAY(">>>> SEND from pid %d uid %d %s", getpid(), getuid(),
              (flags & TF_ONE_WAY) == 0 ? "READ REPLY" : "ONE WAY");
          err = writeTransactionData(BC_TRANSACTION, flags, handle, code, data, NULL);
      }
      ................
  }
  status_t IPCThreadState::writeTransactionData(int32_t cmd, uint32_t binderFlags,
      int32_t handle, uint32_t code, const Parcel& data, status_t* statusBuffer)
  {
      binder_transaction_data tr;
      tr.target.handle = handle;
      tr.code = code;
      tr.flags = binderFlags;
      tr.cookie = 0;
      tr.sender_pid = 0;
      tr.sender_euid = 0;
      
      const status_t err = data.errorCheck();
      if (err == NO_ERROR) {
          tr.data_size = data.ipcDataSize();
          tr.data.ptr.buffer = data.ipcData();
          tr.offsets_size = data.ipcObjectsCount()*sizeof(size_t);
          tr.data.ptr.offsets = data.ipcObjects();
      } else if (statusBuffer) {
          tr.flags |= TF_STATUS_CODE;
          *statusBuffer = err;
          tr.data_size = sizeof(status_t);
          tr.data.ptr.buffer = statusBuffer;
          tr.offsets_size = 0;
          tr.data.ptr.offsets = NULL;
      } else {
          return (mLastError = err);
      }    
      mOut.writeInt32(cmd);
      mOut.write(&tr, sizeof(tr));    
      return NO_ERROR;
  }

• BnServiceManager handle

• status_t BnServiceManager::onTransact(
      uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
  {
      //printf("ServiceManager received: "); data.print();
      switch(code) {
          case GET_SERVICE_TRANSACTION: {
              CHECK_INTERFACE(IServiceManager, data, reply);
              String16 which = data.readString16();
              sp<IBinder> b = const_cast<BnServiceManager*>(this)->getService(which);
              reply->writeStrongBinder(b);
              return NO_ERROR;
          } break;
          case CHECK_SERVICE_TRANSACTION: {
              CHECK_INTERFACE(IServiceManager, data, reply);
              String16 which = data.readString16();
              sp<IBinder> b = const_cast<BnServiceManager*>(this)->checkService(which);
              reply->writeStrongBinder(b);
              return NO_ERROR;
          } break;
          case ADD_SERVICE_TRANSACTION: {
              CHECK_INTERFACE(IServiceManager, data, reply);
              String16 which = data.readString16();
              sp<IBinder> b = data.readStrongBinder();
              status_t err = addService(which, b);
              reply->writeInt32(err);
              return NO_ERROR;
          } break;
          case LIST_SERVICES_TRANSACTION: {
              CHECK_INTERFACE(IServiceManager, data, reply);
              Vector<String16> list = listServices();
              const size_t N = list.size();
              reply->writeInt32(N);
              for (size_t i=0; i<N; i++) {
                  reply->writeString16(list[i]);
              }
              return NO_ERROR;
          } break;
          default:
              return BBinder::onTransact(code, data, reply, flags);
      }
  }

http://www.cnblogs.com/Hwangroid/archive/2011/07/13/2105310.html

http://www.cnblogs.com/bluestorm/archive/2011/11/05/2298125.html

http://www.cnblogs.com/freeliver54/archive/2012/06/13/2547739.html

http://www.cnblogs.com/-OYK/archive/2011/07/31/2122981.html

 http://www.cnblogs.com/yunsean/archive/2011/04/15/2017213.html

http://www.ibm.com/developerworks/cn/linux/l-ipc/part5/index1.html

http://www.cnblogs.com/ThinkingWorld/articles/1861739.html

http://www.cnblogs.com/linucos/archive/2012/05/24/2516623.html