这个算是个加餐，应对完整binder通信中的一些细节问题#

1
interface IHelloInterface {
2
    void hello(String msg);
3
}

1
class RemoteService : Service() {
2
    private val serviceBinder = object : IHelloInterface.Stub() {
3
        override fun hello(msg: String) {
4
            Log.e("remote", "hello from client: $msg")
5
        }
6
    }
7
    override fun onBind(intent: Intent): IBinder = serviceBinder
8
}

1
class MainActivity : AppCompatActivity() {
2
    private val conn = object : ServiceConnection {
3
        override fun onServiceConnected(name: ComponentName, service: IBinder) {
4
            // 这里的service就是一个BinderProxy
5
            // asInterface返回一个IHelloInterface.Stub.Proxy实例
6
            val proxy = IHelloInterface.Stub.asInterface(service)
7
            proxy.hello("client msg")
8
        }
9

10
        override fun onServiceDisconnected(name: ComponentName?) {
11
        }
12
    }
13
    override fun onCreate(savedInstanceState: Bundle?) {
14
        super.onCreate(savedInstanceState)
15
        setContentView(R.layout.activity_main)
16
        bindService(Intent("com.test.RemoteService"), conn, Service.BIND_AUTO_CREATE)
17
    }
18
}

1
public interface IHelloInterface extends android.os.IInterface {
2
    public void hello(java.lang.String msg) throws android.os.RemoteException;
3
}

1
public static abstract class Stub extends android.os.Binder implements com.lyj.bindertest.IHelloInterface {
2
    // 类型标识
3
    private static final java.lang.String DESCRIPTOR = "com.lyj.bindertest.IHelloInterface";
4
    // 客户端服务端以此code标识hello方法
5
    static final int TRANSACTION_hello = (android.os.IBinder.FIRST_CALL_TRANSACTION + 0);
6

7
    public Stub() {
8
        this.attachInterface(this, DESCRIPTOR);
9
    }
10

11
    // 此方法一般在ServiceConnection.onServiceConnected回调中调用，
12
    public static com.lyj.bindertest.IHelloInterface asInterface(android.os.IBinder obj) {
13
        if ((obj == null)) {
14
            return null;
15
        }
16
        android.os.IInterface iin = obj.queryLocalInterface(DESCRIPTOR);
17
        if (((iin != null) && (iin instanceof com.lyj.bindertest.IHelloInterface))) {
18
            return ((com.lyj.bindertest.IHelloInterface) iin);
19
        }
20
        return new com.lyj.bindertest.IHelloInterface.Stub.Proxy(obj);
21
    }
22

23
    @Override
24
    public android.os.IBinder asBinder() {
25
        return this;
26
    }
27

28
    // 解析客户端的调用
29
    @Override
30
    public boolean onTransact(int code, android.os.Parcel data, android.os.Parcel reply, int flags) throws android.os.RemoteException {
31
        java.lang.String descriptor = DESCRIPTOR;
32
        switch (code) {
33
            case INTERFACE_TRANSACTION: {
34
                reply.writeString(descriptor);
35
                return true;
36
            }
37
            case TRANSACTION_hello: {
38
                // code为TRANSACTION_hello时调用hello方法
39
                data.enforceInterface(descriptor);
40
                java.lang.String _arg0;
41
                // 从parcel中读取数据
42
                _arg0 = data.readString();
43
                this.hello(_arg0);
44
                reply.writeNoException();
45
                return true;
46
            }
47
            default: {
48
                return super.onTransact(code, data, reply, flags);
49
            }
50
        }
51
    }
52
}

1
private static class Proxy implements com.lyj.bindertest.IHelloInterface {
2
  // 远程服务Binder对应的BinderProxy
3
  private android.os.IBinder mRemote;
4

5
  Proxy(android.os.IBinder remote) {
6
      mRemote = remote;
7
  }
8

9
  @Override
10
  public android.os.IBinder asBinder() {
11
      return mRemote;
12
  }
13

14
  @Override
15
  public void hello(java.lang.String msg) throws android.os.RemoteException {
16
      android.os.Parcel _data = android.os.Parcel.obtain();
17
      android.os.Parcel _reply = android.os.Parcel.obtain();
18
      try {
19
          // 写类型标识
20
          _data.writeInterfaceToken(DESCRIPTOR);
21
          // 写参数
22
          _data.writeString(msg);
23
          // 调用BinderProxy.transact开始通讯
24
          boolean _status = mRemote.transact(Stub.TRANSACTION_hello, _data, _reply, 0);
25
          if (!_status && getDefaultImpl() != null) {
26
              getDefaultImpl().hello(msg);
27
              return;
28
          }
29
          _reply.readException();
30
      } finally {
31
          _reply.recycle();
32
          _data.recycle();
33
      }
34
  }

1
IPCThreadState* IPCThreadState::self()
2
{
3
    // 是否已创建
4
    if (gHaveTLS) {
5
restart:
6
        const pthread_key_t k = gTLS;
7
        // 从线程私有空间获取
8
        IPCThreadState* st = (IPCThreadState*)pthread_getspecific(k);
9
        if (st) return st;
10
        return new IPCThreadState;
11
    }
12
    if (gShutdown) {
13
        return NULL;
14
    }
15
    // 线程同步锁
16
    pthread_mutex_lock(&gTLSMutex);
17
    if (!gHaveTLS) {
18
        int key_create_value = pthread_key_create(&gTLS, threadDestructor);
19
        if (key_create_value != 0) {
20
            pthread_mutex_unlock(&gTLSMutex);
21
            return NULL;
22
        }
23
        gHaveTLS = true;
24
    }
25
    pthread_mutex_unlock(&gTLSMutex);
26
    goto restart;
27
}

1
IPCThreadState::IPCThreadState()
2
    // 赋值ProcessState
3
    : mProcess(ProcessState::self()),
4
      mStrictModePolicy(0),
5
      mLastTransactionBinderFlags(0)
6
{
7
    // 当前对象存到当前线程私有空间
8
    pthread_setspecific(gTLS, this);
9
    clearCaller();
10
    // mIn、mOut两个parcel对象用于从binder驱动读写数据
11
    mIn.setDataCapacity(256);
12
    mOut.setDataCapacity(256);
13
}

1
sp<ProcessState> ProcessState::self()
2
{
3
    // 同步锁
4
    Mutex::Autolock _l(gProcessMutex);
5
    if (gProcess != NULL) {
6
        return gProcess;
7
    }
8
    gProcess = new ProcessState("/dev/binder");
9
    return gProcess;
10
}

1
ProcessState::ProcessState(const char *driver)
2
    // 打开binder，mDriverFD保存该文件描述符
3
    : mDriverFD(open_driver(driver))
4
    ......
5
    // 最大binder线程数，值为15
6
    : mMaxThreads(DEFAULT_MAX_BINDER_THREADS)
7
{
8
    if (mDriverFD >= 0) {
9
        // 调用binder_mmap建立（1M-8k）内存映射区
10
        mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
11
        if (mVMStart == MAP_FAILED) {
12
            close(mDriverFD);
13
            mDriverFD = -1;
14
            mDriverName.clear();
15
        }
16
    }
17
}

1
static int open_driver(const char *driver)
2
{
3
    int fd = open(driver, O_RDWR | O_CLOEXEC);
4
    if (fd >= 0) {
5
        int vers = 0;
6
        // 获取内核binder版本
7
        status_t result = ioctl(fd, BINDER_VERSION, &vers);
8
        if (result == -1) {
9
=            close(fd);
10
            fd = -1;
11
        }
12
        // 对比内核binder版本和framework中binder版本
13
        if (result != 0 || vers != BINDER_CURRENT_PROTOCOL_VERSION) {
14
            close(fd);
15
            fd = -1;
16
        }
17
        // 设置驱动binder_proc.max_threads = DEFAULT_MAX_BINDER_THREADS
18
        size_t maxThreads = DEFAULT_MAX_BINDER_THREADS;
19
        result = ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads);
20
        if (result == -1) {
21
        }
22
    }
23
    return fd;
24
}

1
void ProcessState::startThreadPool()
2
{
3
    AutoMutex _l(mLock);
4
    if (!mThreadPoolStarted) {
5
        mThreadPoolStarted = true;
6
        // 启动binder主线程
7
        spawnPooledThread(true);
8
    }
9
}

1
void ProcessState::spawnPooledThread(bool isMain)
2
{
3
    if (mThreadPoolStarted) {
4
      // 线程名称Binder:pid_序号  序号从1开始
5
        String8 name = makeBinderThreadName();
6
        // isMain Binder主线程
7
        sp<Thread> t = new PoolThread(isMain);
8
        // PoolThread::run最后会调用到PoolThread::threadLoop
9
        t->run(name.string());
10
    }
11
}

1
virtual bool threadLoop()
2
{
3
    // 此时已经运行在新线程中，将新线程注册为binder主线程
4
    IPCThreadState::self()->joinThreadPool(mIsMain);
5
    return false;
6
}

1
static int binder_thread_write(struct binder_proc *proc,
2
      struct binder_thread *thread,
3
      binder_uintptr_t binder_buffer, size_t size,
4
      binder_size_t *consumed)
5
{
6
    uint32_t cmd;
7
    // bwr->write_buffer
8
    void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
9
    // 跳过消费过的数据
10
    void __user *ptr = buffer + *consumed;
11
    void __user *end = buffer + size;
12
    ......
13
    while (ptr < end && thread->return_error == BR_OK) {
14
        // 获取mOut中的cmd
15
        if (get_user(cmd, (uint32_t __user *)ptr))
16
            return -EFAULT;
17
        ......
18
        switch (cmd) {
19
        case BC_TRANSACTION:
20
        case BC_REPLY: {
21
            struct binder_transaction_data tr;
22
            // 从用户空间拷贝数据，即mOut中tr
23
            if (copy_from_user(&tr, ptr, sizeof(tr)))
24
                return -EFAULT;
25
            ptr += sizeof(tr);
26
            // 开始一个binder_transaction
27
            binder_transaction(proc, thread, &tr, cmd == BC_REPLY);
28
            break;
29
        }
30
    }
31
}

1
private boolean execTransact(int code, long dataObj, long replyObj,
2
            int flags) {
3
        Parcel data = Parcel.obtain(dataObj);
4
        Parcel reply = Parcel.obtain(replyObj);
5
        final boolean tracingEnabled = Binder.isTracingEnabled();
6
        try {
7
            res = onTransact(code, data, reply, flags);
8
        }
9
        ......

1
status_t IPCThreadState::sendReply(const Parcel& reply, uint32_t flags)
2
{
3
    status_t err;
4
    status_t statusBuffer;
5
    err = writeTransactionData(BC_REPLY, flags, -1, 0, reply, &statusBuffer);
6
    if (err < NO_ERROR) return err;
7

8
    return waitForResponse(NULL, NULL);
9
}