图解 | 不得错过的 Binder 浅析（一）

//NoAidlActivity.java
protected void onCreate(Bundle savedInstanceState) {    Intent intent = new Intent(this, MyService.class);
    bindService(intent, new ServiceConnection() {        @Override        public void onServiceConnected(ComponentName name, IBinder service) {            //1. 从对象池拿到可复用的对象（享元模式）            Parcel data = Parcel.obtain();            Parcel reply = Parcel.obtain();
            Log.e("哈利迪", "--- 我是客户端 NoAidlActivity , pid = "                  + Process.myPid() + ", thread = "                  + Thread.currentThread().getName());
            String str = "666";            Log.e("哈利迪", "客户端向服务端发送：" + str);            //2. 往data写数据，作为请求参数            data.writeString(str);
            //3. 拿到服务端的IBinder句柄，调用transact            //约定行为码是1；需要服务端的返回值，所以flags传0表示同步调用            service.transact(1, data, reply, 0);
            Log.e("哈利迪", "--- 我是客户端 NoAidlActivity , pid = "                  + Process.myPid() + ", thread = "                  + Thread.currentThread().getName());
            //4. 从reply读取服务端的返回值            Log.e("哈利迪", "客户端接收服务端返回：" + reply.readString());        }    }, Context.BIND_AUTO_CREATE);}

class MyService extends Service {
    @Override    public IBinder onBind(Intent intent) {        //返回服务端的IBinder句柄        return new MyBinder();    }}

<service         android:name=".binder.no_aidl.MyService"         android:process=":remote" />

class MyBinder extends Binder {
    @Override    protected boolean onTransact(int code, Parcel data, Parcel reply, int flags){        if (code == 1) {//如果是约定好的行为码1            Log.e("哈利迪", "--- 我是服务端 MyBinder , pid = "                  + Process.myPid() + ", thread = "                  + Thread.currentThread().getName());            //1. 从data读取客户端参数            Log.e("哈利迪", "服务端收到：" + data.readString());
            String str = "777";            Log.e("哈利迪", "服务端返回：" + str);            //2. 从reply向客户端写返回值            reply.writeString(str);
            //3. 处理完成            return true;        }        return super.onTransact(code, data, reply, flags);    }}

//BinderProxy.java
public boolean transact(int code, Parcel data, Parcel reply, int flags){    //调用了native方法    return transactNative(code, data, reply, flags);}

//android_util_Binder.cpp
//JNI注册static const JNINativeMethod gBinderProxyMethods[] = {    { "transactNative",     "(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z",     (void*)android_os_BinderProxy_transact},};
//native方法具体实现static jboolean android_os_BinderProxy_transact(JNIEnv* env, jobject obj,        jint code, jobject dataObj, jobject replyObj, jint flags){    //转成native层的Parcel    Parcel* data = parcelForJavaObject(env, dataObj);    Parcel* reply = parcelForJavaObject(env, replyObj);    //拿到native层的句柄BpBinder    IBinder* target = (IBinder*)        env->GetLongField(obj, gBinderProxyOffsets.mObject);    //调用BpBinder的transact    status_t err = target->transact(code, *data, reply, flags);}

//BpBinder.cpp
status_t BpBinder::transact(...){    //交给线程单例处理，驱动会根据mHandle值来找到对应的binder句柄    status_t status = IPCThreadState::self()->transact(        mHandle, code, data, reply, flags);}

//IPCThreadState.cpp
status_t IPCThreadState::transact(...){    //将数据写入mOut，见1.1    err = writeTransactionData(BC_TRANSACTION, flags, handle, code, data, NULL);
    //...先忽略one way异步调用的代码，只看有返回值的同步调用    //跟binder驱动交互，传入reply接收返回数据，见1.2    err = waitForResponse(reply);}
//1.1 将数据写入mOutstatus_t IPCThreadState::writeTransactionData(...){    binder_transaction_data tr;    //...打包各种数据（data size、buffer、offsets）    tr.sender_euid = 0;    //将BC_TRANSACTION指令写入mOut    mOut.writeInt32(cmd);    //将打包好的binder_transaction_data写入mOut    mOut.write(&tr, sizeof(tr));}
//1.2 跟binder驱动交互，传入reply接收返回数据status_t IPCThreadState::waitForResponse(...){    //这个循环很重要，客户端就是在这里休眠等待服务端返回结果的    while (1) {        //跟驱动进行数据交互，往驱动写mOut，从驱动读mIn，见1.3        talkWithDriver();        //读取驱动回复的指令        cmd = (uint32_t)mIn.readInt32();        switch (cmd) {            case BR_TRANSACTION_COMPLETE:                //表示驱动已经收到客户端的transact请求                //如果是one way异步调用，到这就可以结束了                if (!reply && !acquireResult) goto finish;                break;            case BR_REPLY:                //表示客户端收到服务端的返回结果                binder_transaction_data tr;                //把服务端的数据读出来，打包进tr                err = mIn.read(&tr, sizeof(tr));                //再把tr的数据透传进reply                reply->ipcSetDataReference(...);                //结束                goto finish;        }    }}
//1.3 跟驱动进行数据交互，往驱动写mOut，从驱动读mInstatus_t IPCThreadState::talkWithDriver(bool doReceive){    binder_write_read bwr;    //指定写数据大小和写缓冲区    bwr.write_size = outAvail;    bwr.write_buffer = (uintptr_t)mOut.data();
    //指定读数据大小和读缓冲区    if (doReceive && needRead) {        bwr.read_size = mIn.dataCapacity();        bwr.read_buffer = (uintptr_t)mIn.data();    } else {        bwr.read_size = 0;        bwr.read_buffer = 0;    }
    //ioctl的调用进入了binder驱动层的binder_ioctl    ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr);
    if (bwr.write_consumed > 0) {        //数据已经写入驱动，从mOut移除        if (bwr.write_consumed < mOut.dataSize())            mOut.remove(0, bwr.write_consumed);        else            mOut.setDataSize(0);    }    if (bwr.read_consumed > 0) {        //从驱动读出数据存入mIn        mIn.setDataSize(bwr.read_consumed);        mIn.setDataPosition(0);    }}

//ProcessState.cpp
virtual bool threadLoop(){	//把binder线程注册进binder驱动程序的线程池中    IPCThreadState::self()->joinThreadPool(mIsMain);    return false;}

//IPCThreadState.cpp
void IPCThreadState::joinThreadPool(bool isMain){    //向binder驱动写数据，表示当前线程需要注册进binder驱动    mOut.writeInt32(isMain ? BC_ENTER_LOOPER : BC_REGISTER_LOOPER);    status_t result;    do {        //进入死循环，等待指令的到来，见1.1        result = getAndExecuteCommand();    } while (result != -ECONNREFUSED && result != -EBADF);    //向binder驱动写数据（退出循环，线程结束）    mOut.writeInt32(BC_EXIT_LOOPER);}
//1.1 等待指令的到来status_t IPCThreadState::getAndExecuteCommand(){    //跟驱动进行数据交互，驱动会把指令写进mIn    talkWithDriver();    //从mIn读出指令    cmd = mIn.readInt32();    //执行指令，见1.2    result = executeCommand(cmd);    return result;}
//1.2 执行指令status_t IPCThreadState::executeCommand(int32_t cmd){    //客户端发请求到驱动，驱动转发到服务端    switch ((uint32_t)cmd) {        case BR_TRANSACTION:{            //服务端收到BR_TRANSACTION指令            binder_transaction_data tr;            //读出客户端请求的参数            result = mIn.read(&tr, sizeof(tr));
            //准备数据，向上传给Java层            Parcel buffer; Parcel reply;            buffer.ipcSetDataReference(...);
            //cookie保存的是binder实体，对应服务端的native层对象就是BBinder            reinterpret_cast<BBinder*>(tr.cookie)->transact(tr.code, buffer,                                                            &reply, tr.flags);            //服务端向驱动写返回值，让驱动转发给客户端            sendReply(reply, 0);        }    }}
//1.3 服务端向驱动写返回值，让驱动转发给客户端status_t IPCThreadState::sendReply(const Parcel& reply, uint32_t flags){    err = writeTransactionData(BC_REPLY, flags, -1, 0, reply, &statusBuffer);    //服务端返回结果给客户端就行，不用等待客户端，所以传NULL    return waitForResponse(NULL, NULL);}

//Binder.cpp
status_t BBinder::transact(uint32_t code, const Parcel& data,                            Parcel* reply, uint32_t flags){    switch (code) {            //ping指令用来判断连通性，即binder句柄是否还活着        case PING_TRANSACTION:            reply->writeInt32(pingBinder());            break;        default:            //看这，通过JNI调用到Java层的execTransact，见1.1            err = onTransact(code, data, reply, flags);            break;    }    return err;}
//android_util_Binder.cpp
//1.1 通过JNI调用到Java层的execTransactvirtual status_t onTransact(...){    JNIEnv* env = javavm_to_jnienv(mVM);    jboolean res = env->CallBooleanMethod(mObject, gBinderOffsets.mExecTransact, ...);}

//android.os.Binder.java
private boolean execTransact(...) {    res = onTransact(code, data, reply, flags);}