Binder 解析(從客戶端到服務端程式碼流程)

首先從一個例子開始
服務端程式碼：

public class WeatherService extends Service{

    IWeatherInterface.Stub stub = new IWeatherInterface.Stub(){
        @Override
        public String getWeatherInfo(long timeMilli) throws RemoteException {
            return "五一勞動節，用勞動者的體溫定義城市的溫度。";
        }
    };

    @Nullable
 

    @Override
    public IBinder onBind(Intent intent) {
        return stub;
    }
}

IWeatherInterface的aidl檔案定義如下：

// IWeatherInterface.aidl
package binder.demo.kj.com.binderdemo;

// Declare any non-default types here with import statements

interface IWeatherInterface {
    String getWeatherInfo(long
 
 timeMilli);
}

此aidl檔案生成了了個類IWeatherInterface.java

/*
 * This file is auto-generated.  DO NOT MODIFY.
 * Original file: /home/caokeji/demo/google-example/android-architecture-todo-mvp/StartWeather/app/src/main/aidl/binder/demo/kj/com/binderdemo/IWeatherInterface.aidl
 */
package binder.demo.kj.com.binderdemo;
// Declare any non-default types here with import statements
 


public interface IWeatherInterface extends android.os.IInterface {
    /**
     * Local-side IPC implementation stub class.
     */
    public static abstract class Stub extends android.os.Binder implements binder.demo.kj.com.binderdemo.IWeatherInterface {
        private static final java.lang.String DESCRIPTOR = "binder.demo.kj.com.binderdemo.IWeatherInterface";

        /**
         * Construct the stub at attach it to the interface.
         */
        public Stub() {
            this.attachInterface(this, DESCRIPTOR);
        }

        /**
         * Cast an IBinder object into an binder.demo.kj.com.binderdemo.IWeatherInterface interface,
         * generating a proxy if needed.
         */
        public static binder.demo.kj.com.binderdemo.IWeatherInterface asInterface(android.os.IBinder obj) {
            if ((obj == null)) {
                return null;
            }
            android.os.IInterface iin = obj.queryLocalInterface(DESCRIPTOR);
            if (((iin != null) && (iin instanceof binder.demo.kj.com.binderdemo.IWeatherInterface))) {
                return ((binder.demo.kj.com.binderdemo.IWeatherInterface) iin);
            }
            return new binder.demo.kj.com.binderdemo.IWeatherInterface.Stub.Proxy(obj);
        }

        @Override
        public android.os.IBinder asBinder() {
            return this;
        }

        @Override
        public boolean onTransact(int code, android.os.Parcel data, android.os.Parcel reply, int flags) throws android.os.RemoteException {
            switch (code) {
                case INTERFACE_TRANSACTION: {
                    reply.writeString(DESCRIPTOR);
                    return true;
                }
                case TRANSACTION_getWeatherInfo: {
                    data.enforceInterface(DESCRIPTOR);
                    long _arg0;
                    _arg0 = data.readLong();
                    java.lang.String _result = this.getWeatherInfo(_arg0);
                    reply.writeNoException();
                    reply.writeString(_result);
                    return true;
                }
            }
            return super.onTransact(code, data, reply, flags);
        }

        private static class Proxy implements binder.demo.kj.com.binderdemo.IWeatherInterface {
            private android.os.IBinder mRemote;

            Proxy(android.os.IBinder remote) {
                mRemote = remote;
            }

            @Override
            public android.os.IBinder asBinder() {
                return mRemote;
            }

            public java.lang.String getInterfaceDescriptor() {
                return DESCRIPTOR;
            }

            @Override
            public java.lang.String getWeatherInfo(long timeMilli) throws android.os.RemoteException {
                android.os.Parcel _data = android.os.Parcel.obtain();
                android.os.Parcel _reply = android.os.Parcel.obtain();
                java.lang.String _result;
                try {
                    _data.writeInterfaceToken(DESCRIPTOR);
                    _data.writeLong(timeMilli);
                    mRemote.transact(Stub.TRANSACTION_getWeatherInfo, _data, _reply, 0);
                    _reply.readException();
                    _result = _reply.readString();
                } finally {
                    _reply.recycle();
                    _data.recycle();
                }
                return _result;
            }
        }

        static final int TRANSACTION_getWeatherInfo = (android.os.IBinder.FIRST_CALL_TRANSACTION + 0);
    }

    public java.lang.String getWeatherInfo(long timeMilli) throws android.os.RemoteException;
}

這個類裡面包含了兩個類，類關係圖為

其中 Stub是服務端使用的，Proxy是客戶端使用的

另一個程式中，呼叫此服務的客戶端通過下面的方法收到服務端返回的Binder

Intent intent = new Intent();
      intent.setComponent(new ComponentName("binder.demo.kj.com.binderdemo","binder.demo.kj.com.binderdemo.WeatherService"));
      bindService(intent, new ServiceConnection() {
          @Override
          public void onServiceConnected(ComponentName name, IBinder service) {
              iWeatherInterface = IWeatherInterface.Stub.asInterface(service);
              String weatherInfo = iWeatherInterface.getWeatherInfo(System.currentTimeMillis())
          }

          @Override
          public void onServiceDisconnected(ComponentName name) {

          }
      },BIND_AUTO_CREATE);

返回的此IBinder其實是一個BinderProxy,那BinderProxy又是什麼呢，BinderProxy是在android.os.Binder.java檔案中定義的

final class BinderProxy implements IBinder {
    public native boolean pingBinder();
    public native boolean isBinderAlive();

    public IInterface queryLocalInterface(String descriptor) {
        return null;
    }

    public boolean transact(int code, Parcel data, Parcel reply, int flags) throws RemoteException {
        Binder.checkParcel(this, code, data, "Unreasonably large binder buffer");
        return transactNative(code, data, reply, flags);
    }

    public native String getInterfaceDescriptor() throws RemoteException;
    public native boolean transactNative(int code, Parcel data, Parcel reply,
            int flags) throws RemoteException;
    public native void linkToDeath(DeathRecipient recipient, int flags)
            throws RemoteException;
    public native boolean unlinkToDeath(DeathRecipient recipient, int flags);

    public void dump(FileDescriptor fd, String[] args) throws RemoteException {
        Parcel data = Parcel.obtain();
        Parcel reply = Parcel.obtain();
        data.writeFileDescriptor(fd);
        data.writeStringArray(args);
        try {
            transact(DUMP_TRANSACTION, data, reply, 0);
            reply.readException();
        } finally {
            data.recycle();
            reply.recycle();
        }
    }

    public void dumpAsync(FileDescriptor fd, String[] args) throws RemoteException {
        Parcel data = Parcel.obtain();
        Parcel reply = Parcel.obtain();
        data.writeFileDescriptor(fd);
        data.writeStringArray(args);
        try {
            transact(DUMP_TRANSACTION, data, reply, FLAG_ONEWAY);
        } finally {
            data.recycle();
            reply.recycle();
        }
    }

    BinderProxy() {
        mSelf = new WeakReference(this);
    }

    @Override
    protected void finalize() throws Throwable {
        try {
            destroy();
        } finally {
            super.finalize();
        }
    }

    private native final void destroy();

    private static final void sendDeathNotice(DeathRecipient recipient) {
        if (false) Log.v("JavaBinder", "sendDeathNotice to " + recipient);
        try {
            recipient.binderDied();
        }
        catch (RuntimeException exc) {
            Log.w("BinderNative", "Uncaught exception from death notification",
                    exc);
        }
    }

    final private WeakReference mSelf;
    private long mObject;
    private long mOrgue;
}

類的繼承關係為

客戶端獲取服務端資訊的這行程式碼

String weatherInfo = iWeatherInterface.getWeatherInfo(System.currentTimeMillis());

是呼叫Proxy類的getWeatherInfo方法

@Override
public java.lang.String getWeatherInfo(long timeMilli) throws android.os.RemoteException {
    android.os.Parcel _data = android.os.Parcel.obtain();
    android.os.Parcel _reply = android.os.Parcel.obtain();
    java.lang.String _result;
    try {
        _data.writeInterfaceToken(DESCRIPTOR);
        _data.writeLong(timeMilli);
        mRemote.transact(Stub.TRANSACTION_getWeatherInfo, _data, _reply, 0);
        _reply.readException();
        _result = _reply.readString();
    } finally {
        _reply.recycle();
        _data.recycle();
    }
    return _result;
}

此方法裡的mRemote就是上面的BinderProxy,它的transact方法如下,內部呼叫了本地方法transactNative(code, data, reply, flags)

public boolean transact(int code, Parcel data, Parcel reply, int flags) throws RemoteException {
        Binder.checkParcel(this, code, data, "Unreasonably large binder buffer");
        return transactNative(code, data, reply, flags);
    }

jni呼叫的transactNative方法

static const JNINativeMethod gBinderProxyMethods[] = {
     /* name, signature, funcPtr */
    {"pingBinder",          "()Z", (void*)android_os_BinderProxy_pingBinder},
    {"isBinderAlive",       "()Z", (void*)android_os_BinderProxy_isBinderAlive},
    {"getInterfaceDescriptor", "()Ljava/lang/String;", (void*)android_os_BinderProxy_getInterfaceDescriptor},
    {"transactNative",      "(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z", (void*)android_os_BinderProxy_transact},
    {"linkToDeath",         "(Landroid/os/IBinder$DeathRecipient;I)V", (void*)android_os_BinderProxy_linkToDeath},
    {"unlinkToDeath",       "(Landroid/os/IBinder$DeathRecipient;I)Z", (void*)android_os_BinderProxy_unlinkToDeath},
    {"destroy",             "()V", (void*)android_os_BinderProxy_destroy},
};
//從上面宣告中 transactNative對應的是 android_os_BinderProxy_transact

static jboolean android_os_BinderProxy_transact(JNIEnv* env, jobject obj,
        jint code, jobject dataObj, jobject replyObj, jint flags) // throws RemoteException
{
    if (dataObj == NULL) {
        jniThrowNullPointerException(env, NULL);
        return JNI_FALSE;
    }

    Parcel* data = parcelForJavaObject(env, dataObj);
    if (data == NULL) {
        return JNI_FALSE;
    }
    Parcel* reply = parcelForJavaObject(env, replyObj);
    if (reply == NULL && replyObj != NULL) {
        return JNI_FALSE;
    }

    //此target為BpBinder型別物件，gBinderProxyOffsets.mObject 為Java層的ProxyBinder中的mObject變數對應的偏移值，通過此方法可獲取Java層mObject的值
    IBinder* target = (IBinder*)
        env->GetLongField(obj, gBinderProxyOffsets.mObject);
    if (target == NULL) {
        jniThrowException(env, "java/lang/IllegalStateException", "Binder has been finalized!");
        return JNI_FALSE;
    }

    ALOGV("Java code calling transact on %p in Java object %p with code %" PRId32 "\n",
            target, obj, code);


    bool time_binder_calls;
    int64_t start_millis;
    if (kEnableBinderSample) {
        // Only log the binder call duration for things on the Java-level main thread.
        // But if we don't
        time_binder_calls = should_time_binder_calls();

        if (time_binder_calls) {
            start_millis = uptimeMillis();
        }
    }

    //呼叫BpBinder的transact方法
    //printf("Transact from Java code to %p sending: ", target); data->print();
    status_t err = target->transact(code, *data, reply, flags);
    //if (reply) printf("Transact from Java code to %p received: ", target); reply->print();

    if (kEnableBinderSample) {
        if (time_binder_calls) {
            conditionally_log_binder_call(start_millis, target, code);
        }
    }

    if (err == NO_ERROR) {
        return JNI_TRUE;
    } else if (err == UNKNOWN_TRANSACTION) {
        return JNI_FALSE;
    }

    signalExceptionForError(env, obj, err, true /*canThrowRemoteException*/, data->dataSize());
    return JNI_FALSE;
}

BpBinder的transact方法如下,其實就是向驅動傳送請求指令，binder驅動將指令跨程序傳遞到服務端Binder，也就是真正的Binder實體，BpBinder所持有的只是一個Binder引用

status_t BpBinder::transact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    // Once a binder has died, it will never come back to life.
    if (mAlive) {
        status_t status = IPCThreadState::self()->transact(
            mHandle, code, data, reply, flags);
        if (status == DEAD_OBJECT) mAlive = 0;
        return status;
    }

    return DEAD_OBJECT;
}

指令傳送後，服務端是如何收到的呢，其實服務端是有一個執行緒阻塞著的等待接收到新任務的，有任務需要處理就會被喚醒，這和網路請求很類似，網路請求服務端也是一直阻塞這等待客戶端連線請求的，在IPCThreadState.cpp中，接收到任務後getAndExecuteCommand()中的talkWithDriver()方法就會從 ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr)中返回，沒有任務時此係統呼叫會被binder驅動掛起，有任務後才會被重新喚醒。喚醒後通過此方法 status_t IPCThreadState::executeCommand(int32_t cmd) 來解析執行客戶端傳來的指令,我們只看裡面的BR_TRANSACTION的程式碼片段

case BR_TRANSACTION:
       {
           binder_transaction_data tr;
           result = mIn.read(&tr, sizeof(tr));
           ALOG_ASSERT(result == NO_ERROR,
               "Not enough command data for brTRANSACTION");
           if (result != NO_ERROR) break;

           Parcel buffer;
           buffer.ipcSetDataReference(
               reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
               tr.data_size,
               reinterpret_cast<const binder_size_t*>(tr.data.ptr.offsets),
               tr.offsets_size/sizeof(binder_size_t), freeBuffer, this);

           const pid_t origPid = mCallingPid;
           const uid_t origUid = mCallingUid;
           const int32_t origStrictModePolicy = mStrictModePolicy;
           const int32_t origTransactionBinderFlags = mLastTransactionBinderFlags;

           mCallingPid = tr.sender_pid;
           mCallingUid = tr.sender_euid;
           mLastTransactionBinderFlags = tr.flags;

           int curPrio = getpriority(PRIO_PROCESS, mMyThreadId);
           if (gDisableBackgroundScheduling) {
               if (curPrio > ANDROID_PRIORITY_NORMAL) {
                   // We have inherited a reduced priority from the caller, but do not
                   // want to run in that state in this process.  The driver set our
                   // priority already (though not our scheduling class), so bounce
                   // it back to the default before invoking the transaction.
                   setpriority(PRIO_PROCESS, mMyThreadId, ANDROID_PRIORITY_NORMAL);
               }
           } else {
               if (curPrio >= ANDROID_PRIORITY_BACKGROUND) {
                   // We want to use the inherited priority from the caller.
                   // Ensure this thread is in the background scheduling class,
                   // since the driver won't modify scheduling classes for us.
                   // The scheduling group is reset to default by the caller
                   // once this method returns after the transaction is complete.
                   set_sched_policy(mMyThreadId, SP_BACKGROUND);
               }
           }

           //ALOGI(">>>> TRANSACT from pid %d uid %d\n", mCallingPid, mCallingUid);

           Parcel reply;
           status_t error;
           IF_LOG_TRANSACTIONS() {
               TextOutput::Bundle _b(alog);
               alog << "BR_TRANSACTION thr " << (void*)pthread_self()
                   << " / obj " << tr.target.ptr << " / code "
                   << TypeCode(tr.code) << ": " << indent << buffer
                   << dedent << endl
                   << "Data addr = "
                   << reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer)
                   << ", offsets addr="
                   << reinterpret_cast<const size_t*>(tr.data.ptr.offsets) << endl;
           }
           if (tr.target.ptr) {

               //通過tr.coocke轉換為BBinder,然後呼叫BBinder.transact方法
               // We only have a weak reference on the target object, so we must first try to
               // safely acquire a strong reference before doing anything else with it.
               if (reinterpret_cast<RefBase::weakref_type*>(
                       tr.target.ptr)->attemptIncStrong(this)) {
                   error = reinterpret_cast<BBinder*>(tr.cookie)->transact(tr.code, buffer,
                           &reply, tr.flags);
                   reinterpret_cast<BBinder*>(tr.cookie)->decStrong(this);
               } else {
                   error = UNKNOWN_TRANSACTION;
               }

           } else {
               error = the_context_object->transact(tr.code, buffer, &reply, tr.flags);
           }

           //ALOGI("<<<< TRANSACT from pid %d restore pid %d uid %d\n",
           //     mCallingPid, origPid, origUid);

           if ((tr.flags & TF_ONE_WAY) == 0) {
               LOG_ONEWAY("Sending reply to %d!", mCallingPid);
               if (error < NO_ERROR) reply.setError(error);
               sendReply(reply, 0);
           } else {
               LOG_ONEWAY("NOT sending reply to %d!", mCallingPid);
           }

           mCallingPid = origPid;
           mCallingUid = origUid;
           mStrictModePolicy = origStrictModePolicy;
           mLastTransactionBinderFlags = origTransactionBinderFlags;

           IF_LOG_TRANSACTIONS() {
               TextOutput::Bundle _b(alog);
               alog << "BC_REPLY thr " << (void*)pthread_self() << " / obj "
                   << tr.target.ptr << ": " << indent << reply << dedent << endl;
           }

       }
       break;

通過這行程式碼

error = reinterpret_cast<BBinder*>(tr.cookie)->transact(tr.code, buffer,
         &reply, tr.flags); 

我們可以看出來其實是呼叫了BBinder.transact方法，這裡的BBinder是
一個JavaBBinder，此類的定義如下

class JavaBBinder : public BBinder
{
public:
    JavaBBinder(JNIEnv* env, jobject object)
        : mVM(jnienv_to_javavm(env)), mObject(env->NewGlobalRef(object))
    {
        ALOGV("Creating JavaBBinder %p\n", this);
        android_atomic_inc(&gNumLocalRefs);
        incRefsCreated(env);
    }

    bool    checkSubclass(const void* subclassID) const
    {
        return subclassID == &gBinderOffsets;
    }

    jobject object() const
    {
        return mObject;
    }

protected:
    virtual ~JavaBBinder()
    {
        ALOGV("Destroying JavaBBinder %p\n", this);
        android_atomic_dec(&gNumLocalRefs);
        JNIEnv* env = javavm_to_jnienv(mVM);
        env->DeleteGlobalRef(mObject);
    }

    virtual status_t onTransact(
        uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags = 0)
    {
        JNIEnv* env = javavm_to_jnienv(mVM);

        ALOGV("onTransact() on %p calling object %p in env %p vm %p\n", this, mObject, env, mVM);

        IPCThreadState* thread_state = IPCThreadState::self();
        const int32_t strict_policy_before = thread_state->getStrictModePolicy();

        //printf("Transact from %p to Java code sending: ", this);
        //data.print();
        //printf("\n");
        jboolean res = env->CallBooleanMethod(mObject, gBinderOffsets.mExecTransact,
            code, reinterpret_cast<jlong>(&data), reinterpret_cast<jlong>(reply), flags);

        if (env->ExceptionCheck()) {
            jthrowable excep = env->ExceptionOccurred();
            report_exception(env, excep,
                "*** Uncaught remote exception!  "
                "(Exceptions are not yet supported across processes.)");
            res = JNI_FALSE;

            /* clean up JNI local ref -- we don't return to Java code */
            env->DeleteLocalRef(excep);
        }

        // Check if the strict mode state changed while processing the
        // call.  The Binder state will be restored by the underlying
        // Binder system in IPCThreadState, however we need to take care
        // of the parallel Java state as well.
        if (thread_state->getStrictModePolicy() != strict_policy_before) {
            set_dalvik_blockguard_policy(env, strict_policy_before);
        }

        if (env->ExceptionCheck()) {
            jthrowable excep = env->ExceptionOccurred();
            report_exception(env, excep,
                "*** Uncaught exception in onBinderStrictModePolicyChange");
            /* clean up JNI local ref -- we don't return to Java code */
            env->DeleteLocalRef(excep);
        }

        // Need to always call through the native implementation of
        // SYSPROPS_TRANSACTION.
        if (code == SYSPROPS_TRANSACTION) {
            BBinder::onTransact(code, data, reply, flags);
        }

        //aout << "onTransact to Java code; result=" << res << endl
        //    << "Transact from " << this << " to Java code returning "
        //    << reply << ": " << *reply << endl;
        return res != JNI_FALSE ? NO_ERROR : UNKNOWN_TRANSACTION;
    }

    virtual status_t dump(int fd, const Vector<String16>& args)
    {
        return 0;
    }

private:
    JavaVM* const   mVM;
    jobject const   mObject;
};

此類重寫了onTransact方法，此方法中關鍵的一行程式碼

jboolean res = env->CallBooleanMethod(mObject, gBinderOffsets.mExecTransact,
    code, reinterpret_cast<jlong>(&data), reinterpret_cast<jlong>(reply), flags);

此程式碼是呼叫java層和 gBinderOffsets.mExecTransact 對應的方法，此方法的註冊程式碼為：

gBinderOffsets.mExecTransact = GetMethodIDOrDie(env, clazz, "execTransact", "(IJJI)Z");

從這可以看出，其實是呼叫Binder裡的exeTransact方法

//Binder.java
// Entry point from android_util_Binder.cpp's onTransact
private boolean execTransact(int code, long dataObj, long replyObj,
        int flags) {
    Parcel data = Parcel.obtain(dataObj);
    Parcel reply = Parcel.obtain(replyObj);
    // theoretically, we should call transact, which will call onTransact,
    // but all that does is rewind it, and we just got these from an IPC,
    // so we'll just call it directly.
    boolean res;
    // Log any exceptions as warnings, don't silently suppress them.
    // If the call was FLAG_ONEWAY then these exceptions disappear into the ether.
    try {
        res = onTransact(code, data, reply, flags);
    } catch (RemoteException e) {
        if ((flags & FLAG_ONEWAY) != 0) {
            Log.w(TAG, "Binder call failed.", e);
        } else {
            reply.setDataPosition(0);
            reply.writeException(e);
        }
        res = true;
    } catch (RuntimeException e) {
        if ((flags & FLAG_ONEWAY) != 0) {
            Log.w(TAG, "Caught a RuntimeException from the binder stub implementation.", e);
        } else {
            reply.setDataPosition(0);
            reply.writeException(e);
        }
        res = true;
    } catch (OutOfMemoryError e) {
        // Unconditionally log this, since this is generally unrecoverable.
        Log.e(TAG, "Caught an OutOfMemoryError from the binder stub implementation.", e);
        RuntimeException re = new RuntimeException("Out of memory", e);
        reply.setDataPosition(0);
        reply.writeException(re);
        res = true;
    }
    checkParcel(this, code, reply, "Unreasonably large binder reply buffer");
    reply.recycle();
    data.recycle();

    // Just in case -- we are done with the IPC, so there should be no more strict
    // mode violations that have gathered for this thread.  Either they have been
    // parceled and are now in transport off to the caller, or we are returning back
    // to the main transaction loop to wait for another incoming transaction.  Either
    // way, strict mode begone!
    StrictMode.clearGatheredViolations();

    return res;
}

此方法呼叫了onTransact，而此方法被我們aidl檔案生成的Stub類重寫了

@Override
public boolean onTransact(int code, android.os.Parcel data, android.os.Parcel reply, int flags) throws android.os.RemoteException {
    switch (code) {
        case INTERFACE_TRANSACTION: {
            reply.writeString(DESCRIPTOR);
            return true;
        }
        case TRANSACTION_getWeatherInfo: {
            data.enforceInterface(DESCRIPTOR);
            long _arg0;
            _arg0 = data.readLong();
            java.lang.String _result = this.getWeatherInfo(_arg0);
            reply.writeNoException();
            reply.writeString(_result);
            return true;
        }
    }
    return super.onTransact(code, data, reply, flags);
}

最後終於調到我們實現的方法了 java.lang.String _result = this.getWeatherInfo(_arg0);