binder framework

2020-04-19 本文已影响0人龙遁流

binder framework

基于 Android 9.0 源码。编译出 libbinder 库，提供native IPC 通讯框架。
即Java层binder框架，AIDL相关

涉及文件

libbinder:
./frameworks/native/include/binder
./frameworks/native/libs/binder

jni:
framework/base/core/jni/

java/aidl:
framework/base/core/java/android/os/
framework/base/core/java/com/android/internal/os/

结构

顶层接口

有两个最顶层的接口，IInterface 和 IBinder。分别是对Service和Binder驱动的抽象。

从上到下依次为接口层、实现层、代理层

IInterface           IBinder
   <=>                 <=>
INTERFACE         BBinder/BpBinder(BpRefBase)
   <=>                 <=>
BnInterface         BpInterface

IInterface

所有Service都是此接口的子类，定义了从IInterface到IBinder接口的转换方法。
但是具体的转换细节onAsBinder()是由子类决定的。

static sp<IBinder> IInterface::asBinder(const sp<IInterface>&); // 内部直接调用onAsBinder
virtual IBinder* onAsBinder() = 0;

从IBinder对象获取其代表的Service。一般作为访问Service的入口。因为要使用Service的特定服务必须获取其
真正的Service类，父类(接口类)用来构建框架，是抽象的，无需关心子类特定行为。

template<typename INTERFACE>
inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj) {
  return INTERFACE::asInterface(obj);
}

所有Service都会有两个宏 DECLARE_META_INTERFACE, IMPLEMENT_META_INTERFACE
定义Service的专有信息，及定义了IBinder从IInterface的转换规则。

// 在Service类的定义处 .h
#define DECLARE_META_INTERFACE(INTERFACE) \
  static const String16 descriptor;\
  static sp<I##INTERFACE> asInterface(const sp<IBinder>& obj);\
  virtual const String16& getInterfaceDescriptor() const;\

// 在Service类实现处 .cpp, NAME 是唯一的
// asInterface获取的是BpInterface
#define IMPLEMENT_META_INTERFACE(INTERFACE, NAME) \
  const String16 I##INTERFACE::descriptor(NAME); \
  const String16& I##INTERFACE::getInterfaceDescriptor() const { \
      return I##INTERFACE::descriptor; \
  } \
  sp<I##INTERFACE> I##INTERFACE::asInterface(const sp<IBinder>& obj) { \
      sp<I##INTERFACE> intr; \
      if (obj != NULL) { \
          intr = static_cast<I##INTERFACE*>
          (\
              obj->queryLocalInterface(I##INTERFACE::descriptor).get()\
          );\
          if (intr == NULL) {                                         \
              intr = new Bp##INTERFACE(obj);                          \
          }                                                           \
      }                                                               \
      return intr;                                                    \
  }                                                                   \

IInterface 和 IBinder 是如何结合到一起的？两个重要的子类BnInterface, BpInterface将其关联到了一起。不直接使用Service本身，而是通过这两个子类。

Bn即Binder node，代表真正的binder实体；Bp即Binder proxy，代理

INTERFACE即自定义Service(本身实现IInterface接口)

// 定义
template<typename INTERFACE>
class BnInterface : public INTERFACE, public BBinder {
  public:
    virtual sp<IInterface> queryLocalInterface(const String16& _descriptor);
    virtual const String16& getInterfaceDescriptor() const;
  protected:
    virtual IBinder* onAsBinder();
};
template<typename INTERFACE>
class BpInterface : public INTERFACE, public BpRefBase {
  public:
    explicit BpInterface(const sp<IBinder>& remote);
  protected:
    virtual IBinder* onAsBinder();
};
// 实现
template<typename INTERFACE>
inline sp<IInterface> BnInterface<INTERFACE>::queryLocalInterface(
      const String16& _descriptor) {
  if (_descriptor == INTERFACE::descriptor) return this;
  return NULL;
}

template<typename INTERFACE>
inline const String16& BnInterface<INTERFACE>::getInterfaceDescriptor() const {
  return INTERFACE::getInterfaceDescriptor(); }

// 将Service转换为其对应的Binder对象，实际上获得的是其子类对象
template<typename INTERFACE>
IBinder* BnInterface<INTERFACE>::onAsBinder() { return this; }

// remote ??? BpInterface 持有Service对应Binder的引用
template<typename INTERFACE>
inline BpInterface<INTERFACE>::BpInterface(const sp<IBinder>& remote)
  : BpRefBase(remote) {}

// remote() ???
template<typename INTERFACE>
inline IBinder* BpInterface<INTERFACE>::onAsBinder() { return remote(); }

IBinder

定义了binder IPC通讯的基本方法。

定义CODE

enum {
  FIRST_CALL_TRANSACTION, // Service定义的方法CODE必须以此为起始值
  LAST_CALL_TRANSACTION,
  // ... 其他一些通用 XXX_TRANSACTION
  FLAG_ONEWAY // 异步调用标致
};

定义方法

virtual sp<IInterface>  queryLocalInterface(const String16& descriptor);
virtual const String16& getInterfaceDescriptor() const = 0;
// tracnsact 通讯接口
virtual status_t transact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags = 0) = 0;
// 子类分别实现获取子类本身
virtual BBinder* localBinder();
virtual BpBinder* remoteBinder();
// 其他一些DeathRecipient相关类和方法；通用transaction的实现

BBinder 和 BpBinder

// BBinder及其引用类BpRefBase
class BBinder : public IBinder
{
public:
    virtual const String16& getInterfaceDescriptor() const;
    virtual status_t transact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags = 0);
    virtual BBinder* localBinder();
protected:
    virtual status_t onTransact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags = 0);
};

BBinder* BBinder::localBinder() { return this; }
bool BBinder::isBinderAlive() const { return true; }

// BBinder的包装，管理其引用计数，强引用或弱引用 ？？？
class BpRefBase : public virtual RefBase
{
protected:
    explicit BpRefBase(const sp<IBinder>& o);
    inline IBinder* remote() { return mRemote; }
    inline IBinder* remote() const { return mRemote; }
private:
    IBinder* const mRemote;
};

BBinder的角色是什么，从其功能上看，即transact()转调用了onTransact()，而onTransact()只是一些通用的
transact操作，比如interface，dump，shell_command_transact，sysprops transact。
一些transact调用了其他服务，一些没有经过IPC直接内部处理了，从onTransact名字即可看出。而BpRefBase包装了BBinder。

定义了一些通用的binder操作，如pingBinder，dump等都是通过其transact()来实现，而此方法是IPC方法。

class BpBinder : public IBinder
{
public:
    static BpBinder* create(int32_t handle);
    virtual status_t transact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags = 0);
    virtual BpBinder* remoteBinder();
protected:
    BpBinder(int32_t handle,int32_t trackedUid);
private:
    const int32_t mHandle;
    int32_t mTrackedUid;
};

// mAlive代表其代理的Binder实体是否还存在
bool BpBinder::isBinderAlive() const { return mAlive != 0; }
BpBinder* BpBinder::remoteBinder() { return this; }

// 关键的transact操作，转调用IPCThreadState的transact方法，该方法是真正和binder驱动通信的
status_t BpBinder::transact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    if (mAlive) {
        status_t status = IPCThreadState::self()->transact(mHandle, code, data, reply, flags);
        if (status == DEAD_OBJECT) mAlive = 0;
        return status;
    }
    return DEAD_OBJECT;
}

IPCThreadState

这是真正和binder驱动打交道的。分析两条线，一是client通过它和service交互，一是不断处理收到的命令

class IPCThreadState
{
public:
    static IPCThreadState* self();
    static IPCThreadState* selfOrNull();  // self(), but won't instantiate
    static void shutdown(); // 销毁IPCThreadState

    sp<ProcessState> process() {return mProcess;}

    status_t handlePolledCommands();
    void flushCommands();

    void joinThreadPool(bool isMain = true);

    // Stop the local process.
    void stopProcess(bool immediate = true);

    status_t transact(int32_t handle, uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags);
private:
    status_t sendReply(const Parcel& reply, uint32_t flags);
    status_t waitForResponse(Parcel *reply, status_t *acquireResult=NULL);
    status_t talkWithDriver(bool doReceive=true);
    status_t writeTransactionData(int32_t cmd, uint32_t binderFlags,
                                  int32_t handle, uint32_t code, const Parcel& data,
                                  status_t* statusBuffer);
    status_t getAndExecuteCommand();
    status_t executeCommand(int32_t command);
    static  void threadDestructor(void *st);
    static  void freeBuffer(Parcel* parcel, const uint8_t* data, size_t dataSize,
                            const binder_size_t* objects, size_t objectsSize, void* cookie);
    const   sp<ProcessState>    mProcess; // 此线程所在进程
            Vector<BBinder*>    mPendingStrongDerefs;
            Parcel              mIn; // 输入transact数据
            Parcel              mOut; // 回复transact的数据
};

// 全局变量 作用？？？
sp<BBinder> the_context_object;
void setTheContextObject(sp<BBinder> obj) { the_context_object = obj; }

// 单例，通过线程私有数据保存IPCThreadState对象，确保唯一，没有就new一个。selfOrNull只查找不new
IPCThreadState* IPCThreadState::self() {... return new IPCThreadState(); ... }
IPCThreadState* IPCThreadState::selfOrNull() {...}

// 被动触发IPC， 一般时client线程
status_t IPCThreadState::transact(int32_t handle,
                                  uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    status_t err;
    flags |= TF_ACCEPT_FDS;
    // 封装transact数据
    err = writeTransactionData(BC_TRANSACTION, flags, handle, code, data, NULL);

    if ((flags & TF_ONE_WAY) == 0) { // 不是单向的操作，可能需要等待回复
        if (reply) {
            // 调用talkWithDriver和executeCommand
            err = waitForResponse(reply); // 和驱动通信并处理回复
        } else {
            Parcel fakeReply;
            err = waitForResponse(&fakeReply);
        }
    } else {
        err = waitForResponse(NULL, NULL);
    }
    return err;
}
// 封住transact数据到发送Parcel
status_t IPCThreadState::writeTransactionData(int32_t cmd, uint32_t binderFlags,
    int32_t handle, uint32_t code, const Parcel& data, status_t* statusBuffer)
{
    binder_transaction_data tr; // binder驱动从此结构中解析处IPC数据

    tr.target.ptr = 0; /* Don't pass uninitialized stack data to a remote process */
    tr.target.handle = handle;
    tr.code = code;
    tr.flags = binderFlags;
    tr.cookie = 0;
    tr.sender_pid = 0;
    tr.sender_euid = 0;

    const status_t err = data.errorCheck();
    if (err == NO_ERROR) { // 数据无误正常封装
        tr.data_size = data.ipcDataSize();
        tr.data.ptr.buffer = data.ipcData();
        tr.offsets_size = data.ipcObjectsCount()*sizeof(binder_size_t);
        tr.data.ptr.offsets = data.ipcObjects();
    } else if (statusBuffer) { // 数据有误，封装状态信息
        tr.flags |= TF_STATUS_CODE;
        *statusBuffer = err;
        tr.data_size = sizeof(status_t);
        tr.data.ptr.buffer = reinterpret_cast<uintptr_t>(statusBuffer);
        tr.offsets_size = 0;
        tr.data.ptr.offsets = 0;
    } else {
        return (mLastError = err);
    }
    // 写入待发送Parcel缓冲
    mOut.writeInt32(cmd);
    mOut.write(&tr, sizeof(tr));

    return NO_ERROR;
}
status_t IPCThreadState::sendReply(const Parcel& reply, uint32_t flags)
{
    status_t err;
    status_t statusBuffer;
    err = writeTransactionData(BC_REPLY, flags, -1, 0, reply, &statusBuffer);
    if (err < NO_ERROR) return err;
    return waitForResponse(NULL, NULL);
}
status_t IPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult)
{
    uint32_t cmd;
    int32_t err;

    while (1) {
        // 将IPC数据传给驱动
        if ((err=talkWithDriver()) < NO_ERROR) break;
        err = mIn.errorCheck();
        if (err < NO_ERROR) break;
        if (mIn.dataAvail() == 0) continue;

        // 处理驱动的回复
        cmd = (uint32_t)mIn.readInt32();
        switch (cmd) {
        case BR_TRANSACTION_COMPLETE:
        case BR_DEAD_REPLY:
        case BR_FAILED_REPLY:
        case BR_ACQUIRE_RESULT:// 省略以上操作
        case BR_REPLY:
            {
                binder_transaction_data tr;
                err = mIn.read(&tr, sizeof(tr));
                if (reply) {
                    if ((tr.flags & TF_STATUS_CODE) == 0) {
                        reply->ipcSetDataReference(
                            reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer), tr.data_size,
                            reinterpret_cast<const binder_size_t*>(tr.data.ptr.offsets),
                            tr.offsets_size/sizeof(binder_size_t),
                            freeBuffer, this);
                    } else {
                        err = *reinterpret_cast<const status_t*>(tr.data.ptr.buffer);
                        freeBuffer(NULL,
                            reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
                            tr.data_size,
                            reinterpret_cast<const binder_size_t*>(tr.data.ptr.offsets),
                            tr.offsets_size/sizeof(binder_size_t), this);
                    }
                } else {
                    freeBuffer(NULL,
                        reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
                        tr.data_size,
                        reinterpret_cast<const binder_size_t*>(tr.data.ptr.offsets),
                        tr.offsets_size/sizeof(binder_size_t), this);
                    continue;
                }
            }
            goto finish;

        default:
            err = executeCommand(cmd);
            if (err != NO_ERROR) goto finish;
            break;
        }
    }

finish:
    if (err != NO_ERROR) {
        if (acquireResult) *acquireResult = err;
        if (reply) reply->setError(err);
        mLastError = err;
    }

    return err;
}
// 默认doReceive为true
status_t IPCThreadState::talkWithDriver(bool doReceive)
{
    binder_write_read bwr;

    // Is the read buffer empty?
    const bool needRead = mIn.dataPosition() >= mIn.dataSize();
    const size_t outAvail = (!doReceive || needRead) ? mOut.dataSize() : 0;
    bwr.write_size = outAvail;
    bwr.write_buffer = (uintptr_t)mOut.data();

    // This is what we'll read.
    if (doReceive && needRead) {
        bwr.read_size = mIn.dataCapacity();
        bwr.read_buffer = (uintptr_t)mIn.data();
    } else {
        bwr.read_size = 0;
        bwr.read_buffer = 0;
    }

    // 如果什么数据都没有立即返回
    if ((bwr.write_size == 0) && (bwr.read_size == 0)) return NO_ERROR;

    bwr.write_consumed = 0;
    bwr.read_consumed = 0;
    status_t err;
    // 不断循环和驱动通讯，将IPC数据传给驱动
    do {
        if (ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr) >= 0)
            err = NO_ERROR;
        else
            err = -errno;
    } while (err == -EINTR);
    return err;
}
// client的处理请求通过service来处理，此方法即中间者
status_t IPCThreadState::executeCommand(int32_t cmd)
{
    BBinder* obj;
    RefBase::weakref_type* refs;
    status_t result = NO_ERROR;

    switch ((uint32_t)cmd) {
    case BR_ERROR:
    case BR_OK:
    case BR_ACQUIRE:
    case BR_RELEASE:
    case BR_INCREFS:
    case BR_DECREFS:
    case BR_ATTEMPT_ACQUIRE: // 省略
    case BR_TRANSACTION:
        {
            binder_transaction_data tr;
            result = mIn.read(&tr, sizeof(tr));
            if (result != NO_ERROR) break;

            Parcel buffer;
            buffer.ipcSetDataReference(
                reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
                tr.data_size,
                reinterpret_cast<const binder_size_t*>(tr.data.ptr.offsets),
                tr.offsets_size/sizeof(binder_size_t), freeBuffer, this);

            const pid_t origPid = mCallingPid;
            const uid_t origUid = mCallingUid;
            const int32_t origStrictModePolicy = mStrictModePolicy;
            const int32_t origTransactionBinderFlags = mLastTransactionBinderFlags;
            mCallingPid = tr.sender_pid;
            mCallingUid = tr.sender_euid;
            mLastTransactionBinderFlags = tr.flags;

            Parcel reply;
            status_t error;
            if (tr.target.ptr) {
                // We only have a weak reference on the target object, so we must first try to
                // safely acquire a strong reference before doing anything else with it.
                if (reinterpret_cast<RefBase::weakref_type*>(tr.target.ptr)->attemptIncStrong(this)) {
                    // 调用实际Service(BnInterface)的transact方法
                    error = reinterpret_cast<BBinder*>(tr.cookie)->
                                transact(tr.code, buffer, &reply, tr.flags);
                    reinterpret_cast<BBinder*>(tr.cookie)->decStrong(this);
                } else {
                    error = UNKNOWN_TRANSACTION;
                }

            } else {
                error = the_context_object->transact(tr.code, buffer, &reply, tr.flags);
            }
            // 发送回复
            if ((tr.flags & TF_ONE_WAY) == 0) {
                sendReply(reply, 0);
            }

            mCallingPid = origPid;
            mCallingUid = origUid;
            mStrictModePolicy = origStrictModePolicy;
            mLastTransactionBinderFlags = origTransactionBinderFlags;
        }
        break;

    case BR_DEAD_BINDER:
    case BR_CLEAR_DEATH_NOTIFICATION_DONE:
        {
            BpBinder *proxy = (BpBinder*)mIn.readPointer();
            proxy->getWeakRefs()->decWeak(proxy);
        } break;
    case BR_FINISHED:
    case BR_NOOP:
    case BR_SPAWN_LOOPER:
        mProcess->spawnPooledThread(false);
        break;
    default:
    }
    return result;
}

// 其他重要操作
// 将当前线程加入线程池执行，不断的取出要处理的命令。区别需要客户端触发，这是主动行为
void IPCThreadState::joinThreadPool(bool isMain)
{
    mOut.writeInt32(isMain ? BC_ENTER_LOOPER : BC_REGISTER_LOOPER);

    status_t result;
    do {
        processPendingDerefs();
        // now get the next command to be processed, waiting if necessary
        result = getAndExecuteCommand();
        // Let this thread exit the thread pool if it is no longer
        // needed and it is not the main process thread.
        if(result == TIMED_OUT && !isMain) {
            break;
        }
    } while (result != -ECONNREFUSED && result != -EBADF);

    mOut.writeInt32(BC_EXIT_LOOPER);
    talkWithDriver(false);
}
status_t IPCThreadState::getAndExecuteCommand()
{
    status_t result;
    int32_t cmd;

    result = talkWithDriver();
    if (result >= NO_ERROR) {
        size_t IN = mIn.dataAvail();
        cmd = mIn.readInt32();
        // 执行相关命令
        result = executeCommand(cmd);
    }
    return result;
}

获取和使用

获取Service Manager是通过defaultServiceManager()方法来完成，当进程注册服务(addService)或
获取服务(getService)的过程之前，都需要先调用defaultServiceManager()方法来获取gDefaultServiceManager对象。gDefaultServiceManager，实际是BpServiceManager，是service_manager服务的代理对象。
对于gDefaultServiceManager对象，如果存在则直接返回；如果不存在则创建该对象

binder分配的默认内存大小为1M-8k。binder默认的最大可并发访问的线程数为16

// IServiceManager.cpp/h  
// defaultServiceManager()
gDefaultServiceManager =
    interface_cast<IServiceManager>(ProcessState::self()->getContextObject(NULL));

//ProcessState::self()用于获取ProcessState对象(也是单例模式)，每个进程有且只有一个ProcessState对象，存在则直接返回，不存在则创建
//getContextObject(NULL)用于获取BpBinder对象，对于handle=0的BpBinder对象，存在则直接返回，不存在才创建
//interface_cast<IServiceManager>()用于获取BpServiceManager对象

ProcessState::self() ==> new ProcessState("/dev/binder") ==> open_driver/mmap

ProcessState::getContextObject() ==> getStrongProxyForHandle(0)
==> lookupHandleLocked()
==> BpBinder::create(0) ==> obj(handle=0的)

interface_cast<IServiceManager>(obj) ==> IServiceManager::asInterface(obj)
==> new BpServiceManager(obj)

BpServiceManager对象封装了getService、checkService、addService、listServices方法。而这些方法通过obj(实质是BpBinder)的
transact方法与service_manager服务通讯。即BpServiceManager起始相当于service_manager的客户端。

BpServiceManager巧妙将通信层与业务层逻辑合为一体:

通过继承接口IServiceManager实现了接口中的业务逻辑函数；

通过成员变量mRemote= new BpBinder(0)进行Binder通信工作。

BpBinder通过handler来指向所对应BBinder, 在整个Binder系统中handle=0代表ServiceManager所对应的BBinder。

binder framework

binder framework

涉及文件

结构

顶层接口

IInterface

IBinder

BBinder 和 BpBinder

IPCThreadState

获取和使用

猜你喜欢

热点阅读