相關文章鏈接：
1. Android Framework - 學習啓動篇
2. Android Binder 驅動 - Media 服務的添加過程
3. Android Binder 驅動 - 啓動 ServiceManager 進程
4. Android Binder 驅動 - 內核驅動層源碼分析
5. Android Binder 驅動 - 從驅動層來分析服務的添加過程
6. Android Binder 驅動 - 從 Java 層來跟蹤服務的查找過程
7. Android 四大組件 - 進程的 fork 創建過程
相關源碼文件：
/frameworks/base/core/java/android/app/ContextImpl.java
/frameworks/base/core/java/android/app/ActivityManagerNative.java
/frameworks/base/core/jni/android_util_Binder.cpp
/frameworks/base/core/jni/android_os_Parcel.cpp
/frameworks/native/libs/binder/Parcel.cpp
/drivers/staging/android/binder.c
/frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
/frameworks/base/core/java/android/app/ActivityThread.java
1. 代碼示例
本文主要從 bindService 的跨進程通信與數據交互來入手分析，關於其具體的創建和綁定流程，大家可以看看之前的內容。aidl 一直都是一個晦澀難懂的內容，筆者在幾年前也曾反覆嘗試去了解其原理，其過程至今想想仍然是心有餘悸，因此建議大家如果是剛入手 Android ，只需要瞭解開發套路就可以了。但還是倡導大家，等有了一定技術沉澱之後，要嘗試着去理解其內部實現原理。我們先來看一個簡單的示例代碼
// 客戶端
public class MainActivity extends AppCompatActivity {
// 客戶端一定要獲取aidl的實例
private UserAidl mUserAidl;
private ServiceConnection mServiceConn = new ServiceConnection() {
@Override
public void onServiceConnected(ComponentName name, IBinder service) {
// 鏈接好了 service就是服務端給我們的 IBinder
mUserAidl = UserAidl.Stub.asInterface(service);
}
@Override
public void onServiceDisconnected(ComponentName name) {
// 斷開鏈接
}
};
@Override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.activity_main);
Intent intent = new Intent(this,MessageService.class);
bindService(intent, mServiceConn, Context.BIND_AUTO_CREATE);
}
public void testClick(View view) {
try {
Log.e("TAG","userName = "+mUserAidl.getUserName());
} catch (RemoteException e) {
e.printStackTrace();
}
}
}
// 服務端
public class MessageService extends Service {
@Override
public IBinder onBind(Intent intent) {
// 綁定
return mBinder;
}
private final UserAidl.Stub mBinder = new UserAidl.Stub()
{
@Override
public String getUserName() throws RemoteException {
return "[email protected]";
}
@Override
public String getUserPassword() throws RemoteException {
return "19940223";
}
};
}
2. Binder 對象初始化
服務端返回的是 Aidl.Stub 服務對象，這個對象是我們自定義 aidl 後，編譯器幫我們自動生成的一個對象，該對象繼承自 Binder.java 對象，子類在構建對象時默認會執行父類的構造函數，也就是說會執行 Binder.java 的構造函數：
public Binder() {
// 調用初始化方法
init();
}
// 調用 native 方法
private native final void init();
static void android_os_Binder_init(JNIEnv* env, jobject obj)
{
JavaBBinderHolder* jbh = new JavaBBinderHolder();
...
env->SetLongField(obj, gBinderOffsets.mObject, (jlong)jbh);
}
由上面的源碼可以看出，Stub 對象在構建的時候，會對應綁定 native 層的一個 JavaBBinderHolder 對象，至於爲什麼要創建 native 層對象，是因爲跨進程通信的核心是要基於 binder 驅動。
3. Stub 對象傳遞
@Override
public boolean bindService(Intent service, ServiceConnection conn,
int flags) {
warnIfCallingFromSystemProcess();
return bindServiceCommon(service, conn, flags, Process.myUserHandle());
}
private boolean bindServiceCommon(Intent service, ServiceConnection conn, int flags,
UserHandle user) {
IServiceConnection sd;
...
if (mPackageInfo != null) {
sd = mPackageInfo.getServiceDispatcher(conn, getOuterContext(),
mMainThread.getHandler(), flags);
} else {
throw new RuntimeException("Not supported in system context");
}
validateServiceIntent(service);
try {
IBinder token = getActivityToken();
if (token == null && (flags&BIND_AUTO_CREATE) == 0 && mPackageInfo != null
&& mPackageInfo.getApplicationInfo().targetSdkVersion
< android.os.Build.VERSION_CODES.ICE_CREAM_SANDWICH) {
flags |= BIND_WAIVE_PRIORITY;
}
service.prepareToLeaveProcess();
// 像 AMS 發起 bind 請求
int res = ActivityManagerNative.getDefault().bindService(
mMainThread.getApplicationThread(), getActivityToken(), service,
service.resolveTypeIfNeeded(getContentResolver()),
sd, flags, getOpPackageName(), user.getIdentifier());
if (res < 0) {
throw new SecurityException(
"Not allowed to bind to service " + service);
}
return res != 0;
} catch (RemoteException e) {
throw new RuntimeException("Failure from system", e);
}
}
由於 ServiceConnection 是一個普通對象，並不能用來做跨進程傳遞，所以在 bindService 的源碼底層，系統幫我包裝了一個可以跨進程傳遞的 IServiceConnection 對象，該對象是一個 Stub 對象。
public int bindService(IApplicationThread caller, IBinder token,
Intent service, String resolvedType, IServiceConnection connection,
int flags, String callingPackage, int userId) throws RemoteException {
Parcel data = Parcel.obtain();
Parcel reply = Parcel.obtain();
data.writeInterfaceToken(IActivityManager.descriptor);
data.writeStrongBinder(caller != null ? caller.asBinder() : null);
data.writeStrongBinder(token);
service.writeToParcel(data, 0);
data.writeString(resolvedType);
// asBinder 返回的是 connection 自身
data.writeStrongBinder(connection.asBinder());
data.writeInt(flags);
data.writeString(callingPackage);
data.writeInt(userId);
mRemote.transact(BIND_SERVICE_TRANSACTION, data, reply, 0);
reply.readException();
int res = reply.readInt();
data.recycle();
reply.recycle();
return res;
}
static void android_os_Parcel_writeStrongBinder(JNIEnv* env, jclass clazz, jlong nativePtr, jobject object)
{
Parcel* parcel = reinterpret_cast<Parcel*>(nativePtr);
if (parcel != NULL) {
const status_t err = parcel->writeStrongBinder(ibinderForJavaObject(env, object));
if (err != NO_ERROR) {
signalExceptionForError(env, clazz, err);
}
}
}
sp<IBinder> ibinderForJavaObject(JNIEnv* env, jobject obj)
{
if (obj == NULL) return NULL;
// 返回的其實是一個 JavaBBinder
if (env->IsInstanceOf(obj, gBinderOffsets.mClass)) {
JavaBBinderHolder* jbh = (JavaBBinderHolder*) env->GetLongField(obj, gBinderOffsets.mObject);
return jbh != NULL ? jbh->get(env, obj) : NULL;
}
...
return NULL;
}
// 這個之前的文章有講就不再貼代碼了
status_t Parcel::writeStrongBinder(const sp<IBinder>& val)
{
return flatten_binder(ProcessState::self(), val, this);
}
上面會調用 writeStrongBinder 方法將 IServiceConnection 對象寫入到 Parcel 內存中，其實也就是將 native 層的 JavaBBinder 對象寫入到 native 層的 Parcel 中，關於 flatten_binder 方法的實現原理大家可以參考之前的文章。
4. 客戶端驅動層處理過程
我們向 ServiceManager 查詢到的 AMS 對象，其實是一個 BindProxy.java 對象，對應 native 層的 BpBinder 對象，也就是說 mRemote.transact 最後會調用 BpBinder.cpp 的 transact 方法。
static void binder_transaction(struct binder_proc *proc,
struct binder_thread *thread,
struct binder_transaction_data *tr, int reply)
{
if (reply) {
...
} else {
if (tr->target.handle) {
struct binder_ref *ref;
// 找到 AMS 目標進程的 binder_node 和 binder_proc
ref = binder_get_ref(proc, tr->target.handle);
target_node = ref->node;
} else {
...
}
...
}
...
off_end = (void *)offp + tr->offsets_size;
for (; offp < off_end; offp++) {
struct flat_binder_object *fp;
...
fp = (struct flat_binder_object *)(t->buffer->data + *offp);
switch (fp->type) {
case BINDER_TYPE_BINDER:
case BINDER_TYPE_WEAK_BINDER: {
struct binder_ref *ref;
// 先通過 fp->binder 從自己進程找 binder_node
struct binder_node *node = binder_get_node(proc, fp->binder);
// 剛開始第一次是找不到的
if (node == NULL) {
// 把他添加到當前進程
node = binder_new_node(proc, fp->binder, fp->cookie);
...
}
// 添加到目標進程
ref = binder_get_ref_for_node(target_proc, node);
if (ref == NULL) {
return_error = BR_FAILED_REPLY;
goto err_binder_get_ref_for_node_failed;
}
// 替換 type 和 handle 值
if (fp->type == BINDER_TYPE_BINDER)
fp->type = BINDER_TYPE_HANDLE;
else
fp->type = BINDER_TYPE_WEAK_HANDLE;
fp->handle = ref->desc;
} break;
...
}
}
t->work.type = BINDER_WORK_TRANSACTION;
list_add_tail(&t->work.entry, target_list);
tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
list_add_tail(&tcomplete->entry, &thread->todo);
// 喚醒目標進程的等待隊列
if (target_wait)
wake_up_interruptible(target_wait);
return;
}
5. AMS 服務端處理 bind 過程
AMS 接收到 bindService 請求後會去讀取 IServiceConnection 對象，注意這裏讀取到的 IServiceConnection 其實已經是本地的一個 BpBinder 了，只不過我們可以通過 BpBinder 對象回調到客戶端的 onServiceConnected 綁定方法。
case BIND_SERVICE_TRANSACTION: {
data.enforceInterface(IActivityManager.descriptor);
IBinder b = data.readStrongBinder();
IApplicationThread app = ApplicationThreadNative.asInterface(b);
IBinder token = data.readStrongBinder();
Intent service = Intent.CREATOR.createFromParcel(data);
String resolvedType = data.readString();
b = data.readStrongBinder();
int fl = data.readInt();
String callingPackage = data.readString();
int userId = data.readInt();
IServiceConnection conn = IServiceConnection.Stub.asInterface(b);
int res = bindService(app, token, service, resolvedType, conn, fl, callingPackage, userId);
reply.writeNoException();
reply.writeInt(res);
return true;
}
static jobject android_os_Parcel_readStrongBinder(JNIEnv* env, jclass clazz, jlong nativePtr)
{
Parcel* parcel = reinterpret_cast<Parcel*>(nativePtr);
if (parcel != NULL) {
return javaObjectForIBinder(env, parcel->readStrongBinder());
}
return NULL;
}
sp<IBinder> Parcel::readStrongBinder() const
{
sp<IBinder> val;
unflatten_binder(ProcessState::self(), *this, &val);
return val;
}
status_t unflatten_binder(const sp<ProcessState>& proc,
const Parcel& in, sp<IBinder>* out)
{
const flat_binder_object* flat = in.readObject(false);
if (flat) {
switch (flat->type) {
case BINDER_TYPE_BINDER:
*out = reinterpret_cast<IBinder*>(flat->cookie);
return finish_unflatten_binder(NULL, *flat, in);
case BINDER_TYPE_HANDLE:
*out = proc->getStrongProxyForHandle(flat->handle);
return finish_unflatten_binder(
static_cast<BpBinder*>(out->get()), *flat, in);
}
}
return BAD_TYPE;
}
6. 進程循環等待處理請求
服務端處理客戶端的請求，肯定會有一個等待執行處理的過程，但整個交互邏輯流程分析下來，並沒有發現服務端有等待的過程。那服務端到底是怎樣進入等待的呢？這個得追溯到 Zygote 創建進程的流程去。
public static final void zygoteInit(int targetSdkVersion, String[] argv, ClassLoader classLoader)
throws ZygoteInit.MethodAndArgsCaller {
if (DEBUG) Slog.d(TAG, "RuntimeInit: Starting application from zygote");
Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "RuntimeInit");
redirectLogStreams();
commonInit();
nativeZygoteInit();
applicationInit(targetSdkVersion, argv, classLoader);
}
private static final native void nativeZygoteInit();
static void com_android_internal_os_RuntimeInit_nativeZygoteInit(JNIEnv* env, jobject clazz)
{
gCurRuntime->onZygoteInit();
}
virtual void onZygoteInit()
{
// 初始化 binder 驅動
sp<ProcessState> proc = ProcessState::self();
ALOGV("App process: starting thread pool.\n");
// 啓動一個線程進入循環處理客戶端 binder 請求
proc->startThreadPool();
}
void ProcessState::spawnPooledThread(bool isMain)
{
if (mThreadPoolStarted) {
String8 name = makeBinderThreadName();
ALOGV("Spawning new pooled thread, name=%s\n", name.string());
sp<Thread> t = new PoolThread(isMain);
t->run(name.string());
}
}
class PoolThread : public Thread
{
public:
PoolThread(bool isMain)
: mIsMain(isMain)
{
}
protected:
virtual bool threadLoop()
{
IPCThreadState::self()->joinThreadPool(mIsMain);
return false;
}
const bool mIsMain;
};
void IPCThreadState::joinThreadPool(bool isMain)
{
...
status_t result;
do {
...
// 進入 binder 驅動的 wait 隊列上進行等待
result = getAndExecuteCommand();
...
} while (result != -ECONNREFUSED && result != -EBADF);
...
}
視頻地址：https://pan.baidu.com/s/1qd2UafSGELpKwBsT30IuHw
視頻密碼：0tgv