接着上一篇，MediaPlayerService已经被注册到ServiceManager中了，本篇将接着分析MediaPlayerService服务的获取，以及通过MediaPlayerService服务创建播放器2个流程。

从<Binder(一)>一篇知道，MediaPlayer.java调用setDataSource方法，最终会调用MediaPlayer.cpp的setDataSource函数。

status_t MediaPlayer::setDataSource(
        const sp<IMediaHTTPService> &httpService,
        const char *url, const KeyedVector<String8, String8> *headers)
{
    ALOGV("setDataSource(%s)", url);
    status_t err = BAD_VALUE;
    if (url != NULL) {
        //1，获取IMediaPlayerService服务
        const sp<IMediaPlayerService>& service(getMediaPlayerService());
        if (service != 0) {
            //2，让远程服务创建播放器
            sp<IMediaPlayer> player(service->create(this, mAudioSessionId));
            if ((NO_ERROR != doSetRetransmitEndpoint(player)) ||
                    //通过IMediaPlayer操作播放器
                (NO_ERROR != player->setDataSource(httpService, url, headers))) {
                player.clear();
            }
            err = attachNewPlayer(player);
        }
    }
    return err;
}

我们先看getMediaPlayerService()函数的执行过程。

IMediaDeathNotifier::getMediaPlayerService()
{
    ALOGV("getMediaPlayerService");
    Mutex::Autolock _l(sServiceLock);
    if (sMediaPlayerService == 0) {
        //获取IServiceManager
        sp<IServiceManager> sm = defaultServiceManager();
        sp<IBinder> binder;
        do {
            //使用String16("media.player")获取服务
            binder = sm->getService(String16("media.player"));
            if (binder != 0) {
                break;
            }
            //如果服务还未注册，等待
            usleep(500000); // 0.5 s
        } while (true);

        if (sDeathNotifier == NULL) {
            sDeathNotifier = new DeathNotifier();
        }
        binder->linkToDeath(sDeathNotifier);
        //将IBinder保存到BpMediaPlayerService的成员变量mRemote中
        sMediaPlayerService = interface_cast<IMediaPlayerService>(binder);
    }

    return sMediaPlayerService;
}

defaultServiceManager()返回BpServiceManager。

class BpServiceManager : public BpInterface<IServiceManager>
{
public:
    BpServiceManager(const sp<IBinder>& impl)
        : BpInterface<IServiceManager>(impl)
    {
    }

    virtual sp<IBinder> getService(const String16& name) const
    {
        unsigned n;
        //最多查询5次
        for (n = 0; n < 5; n++){
            
            sp<IBinder> svc = checkService(name);
            if (svc != NULL) return svc;
            ALOGI("Waiting for service %s...\n", String8(name).string());
            sleep(1);
        }
        return NULL;
    }
//发送查找指令
 virtual sp<IBinder> checkService( const String16& name) const
    {
        Parcel data, reply;
        data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
        data.writeString16(name);
        //发送CHECK_SERVICE_TRANSACTION指令
        remote()->transact(CHECK_SERVICE_TRANSACTION, data, &reply);
        //读取响应数据
        return reply.readStrongBinder();
    }

transact会通过BpBinder(0)发送数据给ServiceManager查找名字为"media.player"的Service，在上一篇分析过，ServiceManager会通过svcmgr_handler函数来处理请求。

int svcmgr_handler(struct binder_state *bs,
                   struct binder_transaction_data *txn,
                   struct binder_io *msg,
                   struct binder_io *reply)
{
    ......

    switch(txn->code) {
    //获取某个Service，通过msg来取
    case SVC_MGR_GET_SERVICE:
    case SVC_MGR_CHECK_SERVICE:
        //s为对应Service名字
        s = bio_get_string16(msg, &len);
        if (s == NULL) {
            return -1;
        }
        //查找Service，返回handle值
        handle = do_find_service(bs, s, len, txn->sender_euid, txn->sender_pid);
        //不为0则找到
        if (!handle)
            break;
        //写入reply回传给客户端
        bio_put_ref(reply, handle);
        return 0;

do_find_service根据"media.player"进行查找，并返回它的句柄handle。

uint32_t do_find_service(struct binder_state *bs, const uint16_t *s, size_t len, uid_t uid, pid_t spid)
{
    struct svcinfo *si;
    //检查权限
    if (!svc_can_find(s, len, spid)) {
        ALOGE("find_service('%s') uid=%d - PERMISSION DENIED\n",
             str8(s, len), uid);
        return 0;
    }
    //查找服务
    si = find_svc(s, len);
     //si不为null，handle大于0
    if (si && si->handle) {
        if (!si->allow_isolated) {
          
            uid_t appid = uid % AID_USER;
            if (appid >= AID_ISOLATED_START && appid <= AID_ISOLATED_END) {
                return 0;
            }
        }
        //成功返回handle
        return si->handle;
    } else {
        return 0;
    }
}

继续看查找的关键函数find_svc。

struct svcinfo *find_svc(const uint16_t *s16, size_t len)
{
    struct svcinfo *si;
    //遍历
    for (si = svclist; si; si = si->next) {
        if ((len == si->len) &&
            !memcmp(s16, si->name, len * sizeof(uint16_t))) {
            return si;
        }
    }
    return NULL;
}

Service整个查找过程，就是根据Service名去遍历svcinfo链表，找到svcinfo结构体后，将svcinfo的handle值写入缓存，回传给客户端。

我们回头看reply.readStrongBinder()这个方法如何解析响应数据，和返回需要的服务对象。reply是一个Parcel类。

sp<IBinder> Parcel::readStrongBinder() const
{
    sp<IBinder> val;
    unflatten_binder(ProcessState::self(), *this, &val);
    return val;
}

status_t unflatten_binder(const sp<ProcessState>& proc,
    const Parcel& in, sp<IBinder>* out)
{
   //读取数据
    const flat_binder_object* flat = in.readObject(false);
    //此时为BINDER_TYPE_HANDLE类型
    if (flat) {
        switch (flat->type) {
            case BINDER_TYPE_BINDER:
                *out = reinterpret_cast<IBinder*>(flat->cookie);
                return finish_unflatten_binder(NULL, *flat, in);
            case BINDER_TYPE_HANDLE:
                //传入handle
                *out = proc->getStrongProxyForHandle(flat->handle);
                return finish_unflatten_binder(
                    static_cast<BpBinder*>(out->get()), *flat, in);
        }
    }
    return BAD_TYPE;
}

sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)
{
    sp<IBinder> result;

    AutoMutex _l(mLock);
    //构建一个entry
    handle_entry* e = lookupHandleLocked(handle);
    if (e != NULL) {
        IBinder* b = e->binder;
        if (b == NULL || !e->refs->attemptIncWeak(this)) {
            //此时handle不为0
            if (handle == 0) {
                 Parcel data;
                //ping下驱动是否通
                status_t status = IPCThreadState::self()->transact(
                        0, IBinder::PING_TRANSACTION, data, NULL, 0);
                if (status == DEAD_OBJECT)
                   return NULL;
            }
            //根据handle创建了一个BpBinder
            b = new BpBinder(handle); 
            e->binder = b;
            if (b) e->refs = b->getWeakRefs();
          //将创建的BpBinder返回
            result = b;
        } else {
             result.force_set(b);
            e->refs->decWeak(this);
        }
    }
    return result;
}

这里的流程和获取IServiceManger是相同的，只是此时的handle大于0，它通过ProcessState创建了一个BpBinder(handle)。

回到IMediaDeathNotifier::getMediaPlayerService函数，BpBinder(handle)同样通过interface_cast进行了强转，强转流程可以看前面IServiceManger的获取流程。

也就是说，最终客户端得到一个BpMediaPlayerService，它的成员变量mRemote持有一个BpBinder(handle)，有了这个handle句柄，就能通过Binder驱动和MediaPlayerService进行通讯了。

流程1到此分析完成，即当前已获取到了IMediaPlayerService。继续分析流程2，IMediaPlayerService调用了create函数，创建播放器。

 virtual sp<IMediaPlayer> create(
            const sp<IMediaPlayerClient>& client, int audioSessionId) {
        Parcel data, reply;
        data.writeInterfaceToken(IMediaPlayerService::getInterfaceDescriptor());
        data.writeStrongBinder(client->asBinder());
        data.writeInt32(audioSessionId);
        //获取mRemote，发送创建指令CREATE，
        remote()->transact(CREATE, data, &reply);
        //返回播放器引用
        return interface_cast<IMediaPlayer>(reply.readStrongBinder());
    }

通过remote()获取mRemote，即BpBinder(0)发送CREATE创建指令。上一篇分析过，MediaPlayerService在MediaServer中创建，并开启了两个线程循环执行talkWithDriver函数，循环读写消息，假设其中一个线程收到CREATE这个指令，最终将执行executeCommand函数，

status_t IPCThreadState::executeCommand(int32_t cmd)
{
    BBinder* obj;
    RefBase::weakref_type* refs;
    status_t result = NO_ERROR;
    
    switch (cmd) {
      ......
    case BR_TRANSACTION:
        {
            binder_transaction_data tr;
            result = mIn.read(&tr, sizeof(tr));
        
            if (result != NO_ERROR) break;
            ......

            Parcel reply;
            status_t error;
           //转为BBinder对象，实际就是BnMediaPlayerService
            if (tr.target.ptr) {
                sp<BBinder> b((BBinder*)tr.cookie);
                error = b->transact(tr.code, buffer, &reply, tr.flags);

            } else {
                error = the_context_object->transact(tr.code, buffer, &reply, tr.flags);
            }

BpXXX对应着服务端在客户端的业务代理，而Bn则对应服务端本地的业务处理类，因此每个服务端都包含一个BnXXX内部类，它继承模板类BnInterface和BBinder对象。

class BnMediaPlayerService: public BnInterface<IMediaPlayerService>
{
public:
    virtual status_t    onTransact( uint32_t code,
                                    const Parcel& data,
                                    Parcel* reply,
                                    uint32_t flags = 0);
};

};

template<typename INTERFACE>
class BnInterface : public INTERFACE, public BBinder
{
public:
    virtual sp<IInterface>      queryLocalInterface(const String16& _descriptor);
    virtual const String16&     getInterfaceDescriptor() const;

protected:
    virtual IBinder*            onAsBinder();
};

而transact函数定义在BBinder中，直接看transact函数。

status_t BBinder::transact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    data.setDataPosition(0);

    status_t err = NO_ERROR;
    switch (code) {
        case PING_TRANSACTION:
            reply->writeInt32(pingBinder());
            break;
        default:
          //处理消息数据
            err = onTransact(code, data, reply, flags);
            break;
    }

    if (reply != NULL) {
        reply->setDataPosition(0);
    }

    return err;
}

onTransact用于处理消息数据，它是一个虚函数，由继承关系知道，它实现在BnMediaPlayerService中。

status_t BnMediaPlayerService::onTransact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    switch (code) {
          ......
        case CREATE: {
            CHECK_INTERFACE(IMediaPlayerService, data, reply);
            sp<IMediaPlayerClient> client =
                interface_cast<IMediaPlayerClient>(data.readStrongBinder());
            int audioSessionId = data.readInt32();
            //创建播放器
            sp<IMediaPlayer> player = create(client, audioSessionId);
            //将播放器转为Binder类型的数据，写入响应缓冲区
            reply->writeStrongBinder(player->asBinder());
            return NO_ERROR;
        } break;
     ......
        default:
            return BBinder::onTransact(code, data, reply, flags);
    }
}

如上，BnMediaPlayerService将会创建一个播放器，返回给MediaPlayer.cpp客户端，这个MediaPlayer.cpp的远程服务端是一个MediaPlayerService的内部类，为Client，它继承自IMediaPlayer。

sp<IMediaPlayer> MediaPlayerService::create(const sp<IMediaPlayerClient>& client,
        int audioSessionId)
{
    pid_t pid = IPCThreadState::self()->getCallingPid();
    int32_t connId = android_atomic_inc(&mNextConnId);
   //创建Client对象，它是BnMediaPlayer的子类
    sp<Client> c = new Client(
            this, pid, connId, client, audioSessionId,
            IPCThreadState::self()->getCallingUid());

    wp<Client> w = c;
    {
        Mutex::Autolock lock(mLock);
        mClients.add(w);
    }
    return c;
}

Client是MediaPlayerService的内部类，它继承自BnMediaPlayer，也就是IMediaPlayer的服务端，函数返回后，也就是客户端得到Client的远程对象代理，那么紧接着会执行Client的setDataSource函数。

status_t MediaPlayerService::Client::setDataSource(int fd, int64_t offset, int64_t length)
{
    ALOGV("setDataSource fd=%d, offset=%lld, length=%lld", fd, offset, length);
    struct stat sb;
    int ret = fstat(fd, &sb);
    if (ret != 0) {
   
        return UNKNOWN_ERROR;
    }


    if (offset >= sb.st_size) {
        ALOGE("offset error");
        ::close(fd);
        return UNKNOWN_ERROR;
    }
    if (offset + length > sb.st_size) {
        length = sb.st_size - offset;
        ALOGV("calculated length = %lld", length);
    }
  //获取到当前适合播放该视频源的播放器类型
    player_type playerType = MediaPlayerFactory::getPlayerType(this,
                                                               fd,
                                                               offset,
                                                               length);
   // 根据得到的播放器类型去创建对应的播放器实例：
    sp<MediaPlayerBase> p = setDataSource_pre(playerType);
    if (p == NULL) {
        return NO_INIT;
    }
   
    setDataSource_post(p, p->setDataSource(fd, offset, length));
    return mStatus;
}

这里分两步执行，先获取到适合播放该视频源的播放器类型，再根据这个类型去创建播放器。MediaPlayerFactory保存的工厂类，在MediaPlayerService构造时就注册好了。

MediaPlayerService::MediaPlayerService()
{
    ALOGV("MediaPlayerService created");
    mNextConnId = 1;

    mBatteryAudio.refCount = 0;
    for (int i = 0; i < NUM_AUDIO_DEVICES; i++) {
        mBatteryAudio.deviceOn[i] = 0;
        mBatteryAudio.lastTime[i] = 0;
        mBatteryAudio.totalTime[i] = 0;
    }

    mBatteryAudio.deviceOn[SPEAKER] = 1;

    const sp<IServiceManager> sm(defaultServiceManager());
    if (sm != NULL) {
        const String16 name("batterystats");
        sp<IBatteryStats> batteryStats =
                interface_cast<IBatteryStats>(sm->getService(name));
        if (batteryStats != NULL) {
            batteryStats->noteResetVideo();
            batteryStats->noteResetAudio();
        }
    }
    //注册播放器工厂类
    MediaPlayerFactory::registerBuiltinFactories();
}

构造函数最后一行注册了所有类型播放器工厂。

void MediaPlayerFactory::registerBuiltinFactories() {
    Mutex::Autolock lock_(&sLock);

    if (sInitComplete)
        return;

    registerFactory_l(new StagefrightPlayerFactory(), STAGEFRIGHT_PLAYER);
    registerFactory_l(new NuPlayerFactory(), NU_PLAYER);
    registerFactory_l(new SonivoxPlayerFactory(), SONIVOX_PLAYER);
    registerFactory_l(new TestPlayerFactory(), TEST_PLAYER);

    sInitComplete = true;
}

我们回头看根据类型获取播放器的函数setDataSource_pre。

sp<MediaPlayerBase> MediaPlayerService::Client::setDataSource_pre(
        player_type playerType)
{
     //根据类型创建播放器
    sp<MediaPlayerBase> p = createPlayer(playerType);
    if (p == NULL) {
        return p;
    }

    if (!p->hardwareOutput()) {
        mAudioOutput = new AudioOutput(mAudioSessionId, IPCThreadState::self()->getCallingUid(),
                mPid, mAudioAttributes);
        static_cast<MediaPlayerInterface*>(p.get())->setAudioSink(mAudioOutput);
    }

    return p;
}

sp<MediaPlayerBase> MediaPlayerService::Client::createPlayer(player_type playerType)
{
  
    sp<MediaPlayerBase> p = mPlayer;
    if ((p != NULL) && (p->playerType() != playerType)) {
        ALOGV("delete player");
        p.clear();
    }
    //通过工厂类创建播放器
    if (p == NULL) {
        p = MediaPlayerFactory::createPlayer(playerType, this, notify);
    }

    if (p != NULL) {
        p->setUID(mUID);
    }

    return p;
}

关键代码所示，MediaPlayerFactory工厂类获取播放器。

sp<MediaPlayerBase> MediaPlayerFactory::createPlayer(
        player_type playerType,
        void* cookie,
        notify_callback_f notifyFunc) {
    sp<MediaPlayerBase> p;
    IFactory* factory;
    status_t init_result;
    Mutex::Autolock lock_(&sLock);

    if (sFactoryMap.indexOfKey(playerType) < 0) {
        ALOGE("Failed to create player object of type %d, no registered"
              " factory", playerType);
        return p;
    }
    //从sFactoryMap获取对应的工厂类
    factory = sFactoryMap.valueFor(playerType);
    CHECK(NULL != factory);

    //通过IFactory内部类的不同实现类，创建不同的MediaPlayer
    p = factory->createPlayer();

    if (p == NULL) {
        ALOGE("Failed to create player object of type %d, create failed",
               playerType);
        return p;
    }

    init_result = p->initCheck();
    if (init_result == NO_ERROR) {
        p->setNotifyCallback(cookie, notifyFunc);
    } else {
        p.clear();
    }

    return p;
}

在注册工厂类时已经将各类型工厂加入到成员sFactoryMap中，此时根据类型获取到特定的工厂，并通过createPlayer创建播放器，安卓有2种类型的播放器，以NuPlayerFactory为例来看下创建的函数。

class NuPlayerFactory : public MediaPlayerFactory::IFactory {
  public:
    virtual float scoreFactory(const sp<IMediaPlayer>& /*client*/,
                               const char* url,
                               float curScore) {
        static const float kOurScore = 0.8;

        if (kOurScore <= curScore)
            return 0.0;

        if (!strncasecmp("http://", url, 7)
                || !strncasecmp("https://", url, 8)
                || !strncasecmp("file://", url, 7)) {
            size_t len = strlen(url);
            if (len >= 5 && !strcasecmp(".m3u8", &url[len - 5])) {
                return kOurScore;
            }

            if (strstr(url,"m3u8")) {
                return kOurScore;
            }

            if ((len >= 4 && !strcasecmp(".sdp", &url[len - 4])) || strstr(url, ".sdp?")) {
                return kOurScore;
            }
        }

        if (!strncasecmp("rtsp://", url, 7)) {
            return kOurScore;
        }

        return 0.0;
    }

    virtual float scoreFactory(const sp<IMediaPlayer>& /*client*/,
                               const sp<IStreamSource>& /*source*/,
                               float /*curScore*/) {
        return 1.0;
    }
    //创建播放器
    virtual sp<MediaPlayerBase> createPlayer() {
        ALOGV(" create NuPlayer");
        return new NuPlayerDriver;
    }
};

到此播放器便创建完成，