獲得service提供的服務，必須實現proxy，對應activity manager 就是BpActivityManager,
而實現BpActivityManager要先實現，介面類IActivityManager.


class IActivityManager : public IInterface {
  public:
    DECLARE_META_INTERFACE(ActivityManager);
 
    virtual status_t registerListener(const sp<IProcessObserver>& listener) = 0;
};
這裡只使用 am 提供的registerListener服務，所以這裡只寫一個對應介面，其他的可不寫。


介面類IActivityManager的成員函式是純虛擬函式，service 和 client端都要實現，service端在java層已經實現，
在native層，只實現：


enum {
    REGISTER_PROCESS_OBSERVER_TRANSACTION = IBinder::FIRST_CALL_TRANSACTION + 132,
};


class BpActivityManager : public BpInterface<IActivityManager>
{
  public:
    BpActivityManager(const sp<IBinder>& impl)
        : BpInterface<IActivityManager>(impl) {}


    virtual status_t registerListener(const sp<IProcessObserver>& listener) {
        Parcel data, reply;
        data.writeInterfaceToken(IActivityManager::getInterfaceDescriptor());
        data.writeStrongBinder(IInterface::asBinder(listener));
        status_t status = remote()->transact(REGISTER_PROCESS_OBSERVER_TRANSACTION, data, &reply);


        if (status == OK) {
            ALOGE("register BpActivityManager OK:\n");
            status = reply.readInt32();
        }


        return status;
    }
};
IMPLEMENT_META_INTERFACE(ActivityManager, "android.app.IActivityManager");




通過實名的bind　“activity” 使用服務registerListener 
    sp<IServiceManager> sm = defaultServiceManager();
    sp<IBinder> binder = sm->getService(String16("activity"));
    sp<IActivityManager> am = interface_cast<IActivityManager>(binder);
    sp<ProcessObserver> ps =  new ProcessObserver();
    am->registerListener(ps);




從上面看，在native層呼叫java實現的服務很簡單，遇到的最大問題是如何實現registerListener的引數IProcessObserver
先看下am服務端收到資料後，是怎樣處理的？
frameworks/base/core/java/android/app/ActivityManagerNative.java
    public boolean onTransact(int code, Parcel data, Parcel reply, int flags)
            throws RemoteException {
        switch (code) {
        case REGISTER_PROCESS_OBSERVER_TRANSACTION: {
            data.enforceInterface(IActivityManager.descriptor);
            IProcessObserver observer = IProcessObserver.Stub.asInterface(
                    data.readStrongBinder());
            registerProcessObserver(observer);
            return true;
        }


該檔案中有registerProcessObserver(observer)的實現，
    public void registerProcessObserver(IProcessObserver observer) throws RemoteException {
        Parcel data = Parcel.obtain();
        Parcel reply = Parcel.obtain();
        data.writeInterfaceToken(IActivityManager.descriptor);
        data.writeStrongBinder(observer != null ? observer.asBinder() : null);
        mRemote.transact(REGISTER_PROCESS_OBSERVER_TRANSACTION, data, reply, 0);
        reply.readException();
        data.recycle();
        reply.recycle();
    }
它的實現是有向外傳送，並沒有處理這個請求，看到這裡比較混亂
這時可以看下呼叫棧： 方法：
Exception e = new Exception();
e.printStackTrace();
07-12 11:27:16.368  1356  1756 W System.err: at com.android.server.am.ActivityManagerService.registerProcessObserver(ActivityManagerService.java:11200)
07-12 11:27:16.369  1356  1756 W System.err: at android.app.ActivityManagerNative.onTransact(ActivityManagerNative.java:1973)
07-12 11:27:16.369  1356  1756 W System.err: at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:2528)
07-12 11:27:16.369  1356  1756 W System.err: at android.os.Binder.execTransact(Binder.java:453)
從棧可以看出：am處理客戶端請求的總入口在
frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
註冊ProcessObserver的處理函式是：
    public void registerProcessObserver(IProcessObserver observer) {
        enforceCallingPermission(android.Manifest.permission.SET_ACTIVITY_WATCHER,
                "registerProcessObserver()");
        synchronized (this) {
            mProcessObservers.register(observer);
        }
    }
mProcessObserver的定義是：所謂的註冊就是向list中新增
final RemoteCallbackList<IProcessObserver> mProcessObservers = new RemoteCallbackList<>();


註冊進去的IProcessObserver是怎樣使用的哪？
    final class UiHandler extends Handler {
        @Override
        public void handleMessage(Message msg) {
            switch (msg.what) {


            case DISPATCH_PROCESSES_CHANGED: {
                dispatchProcessesChanged();
                break;
            }
}


    private void dispatchProcessesChanged() {
final IProcessObserver observer = mProcessObservers.getBroadcastItem(i);
ProcessChangeItem item = mActiveProcessChanges[j];
        if ((item.changes&ProcessChangeItem.CHANGE_PROCESS_STATE) != 0) {
            if (DEBUG_PROCESS_OBSERVERS) Slog.i(TAG_PROCESS_OBSERVERS,
                    "PROCSTATE CHANGED pid=" + item.pid + " uid=" + item.uid
                    + ": " + item.processState);
            observer.onProcessStateChanged(item.pid, item.uid, item.processState);
        }
    }
最後呼叫的是註冊物件的成員函式。
IProcessObserver沒有對應的java函式，使用IProcessObserver.aidl介面語音實現的，編譯framework會在目錄下生成檔案
./target/common/obj/JAVA_LIBRARIES/framework-full_intermediates/src/core/java/android/app/IProcessObserver.java
該檔案就是標準的java層實現binder的方法：


public interface IProcessObserver extends android.os.IInterface
{
/** Local-side IPC implementation stub class. */
public static abstract class Stub extends android.os.Binder implements android.app.IProcessObserver
{


　　private static final java.lang.String DESCRIPTOR = "android.app.IProcessObserver";


　　/**
　　　* Cast an IBinder object into an android.app.IProcessObserver interface,
　　　* generating a proxy if needed.
　　　*/
　　public static android.app.IProcessObserver asInterface(android.os.IBinder obj)
　　{
if ((obj==null)) {
return null;
}
android.os.IInterface iin = obj.queryLocalInterface(DESCRIPTOR);
if (((iin!=null)&&(iin instanceof android.app.IProcessObserver))) {
return ((android.app.IProcessObserver)iin);
}
return new android.app.IProcessObserver.Stub.Proxy(obj);
　　}
　　@Override public android.os.IBinder asBinder()
　　{
return this;
　　}
@Override public boolean onTransact(int code, android.os.Parcel data, android.os.Parcel reply, int flags) throws android.os.RemoteException
{
　　　switch (code)｛
case TRANSACTION_onProcessStateChanged:
{
data.enforceInterface(DESCRIPTOR);
int _arg0;
_arg0 = data.readInt();
int _arg1;
_arg1 = data.readInt();
int _arg2;
_arg2 = data.readInt();
this.onProcessStateChanged(_arg0, _arg1, _arg2);
return true;
}
　｝
　　　｝


private static class Proxy implements android.app.IProcessObserver
{
private android.os.IBinder mRemote;
Proxy(android.os.IBinder remote)
{
mRemote = remote;
}
@Override public android.os.IBinder asBinder()
{
return mRemote;
}
public java.lang.String getInterfaceDescriptor()
{
return DESCRIPTOR;
}


@Override public void onProcessStateChanged(int pid, int uid, int procState) throws android.os.RemoteException
{
android.os.Parcel _data = android.os.Parcel.obtain();
try {
_data.writeInterfaceToken(DESCRIPTOR);
_data.writeInt(pid);
_data.writeInt(uid);
_data.writeInt(procState);
mRemote.transact(Stub.TRANSACTION_onProcessStateChanged, _data, null, android.os.IBinder.FLAG_ONEWAY);
}
finally {
_data.recycle();
}
}
｝
public void onForegroundActivitiesChanged(int pid, int uid, boolean foregroundActivities) throws android.os.RemoteException;
public void onProcessStateChanged(int pid, int uid, int procState) throws android.os.RemoteException;
public void onProcessDied(int pid, int uid) throws android.os.RemoteException;
}


從上面可以看出，am收到的資料結構是直接處理事件observer.onProcessStateChanged，而不是請求server去處理，所以傳遞的引數是個service，
實現service 就要先實現 介面層 IProcessObserver


class IProcessObserver : public IInterface {
  public:
    DECLARE_META_INTERFACE(ProcessObserver);
    virtual void onForegroundActivitiesChanged(int pid, int uid, bool foregroundActivities){};
    virtual void onProcessStateChanged(int pid, int uid, int procState) = 0;
    virtual void onProcessDied(int pid, int uid){};
};


實現BpProcessObserver,原則上不用實現客戶端，native端又不需要它。是為了編譯的問題，
enum {
    ON_PROCESS_STATE_CHANGED = IBinder::FIRST_CALL_TRANSACTION + 1,
};


class BpProcessObserver : public BpInterface<IProcessObserver>
{
    public:
        BpProcessObserver(const sp<IBinder>& impl)
            : BpInterface<IProcessObserver>(impl) {}


        virtual void onProcessStateChanged(int pid, int uid, int procState){
            Parcel data, reply;
            data.writeInterfaceToken(IProcessObserver::getInterfaceDescriptor());
            data.writeInt32(pid);
            data.writeInt32(uid);
            data.writeInt32(procState);
            status_t status = remote()->transact(ON_PROCESS_STATE_CHANGED, data, &reply);


            if (status == OK) {
                status = reply.readInt32();
            }
        }   
};
IMPLEMENT_META_INTERFACE(ProcessObserver, "android.app.IProcessObserver");


實現服務端，服務端ProcessObserver繼承了BnProcessOberver, 重新實現了函式onProcessStateChanged
當ProcessState改變時，該函式進行我們的處理。
class BnProcessObserver : public BnInterface<IProcessObserver> {
  public:
    virtual status_t onTransact(uint32_t code, const Parcel& data,
                                Parcel* reply, uint32_t flags = 0);
};


status_t BnProcessObserver::onTransact(
        uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags) {
    //ALOGE("BnProcessObserver\n");
    switch (code) {
        case ON_PROCESS_STATE_CHANGED:
        int pid = data.readInt32();
        int uid = data.readInt32();
        int procState = data.readInt32();
        onProcessStateChanged(pid, uid, procState);
        return true;
    }


    return BBinder::onTransact(code, data, reply, flags);
}


class ProcessObserver : public BnProcessObserver{
    void onProcessStateChanged(int pid, int uid, int procState){
        ALOGE("callinto BnProcessObserver:\n");
    }
};


總結：
native側呼叫java層的服務，就是在native 層建立客戶端，構造對應的引數傳入，至於傳入什麼樣的引數，就看服務端需要什麼樣的資料，
整形等資料沒什麼問題，麻煩的是Binder物件, 直到套路了，就很簡單。