Binder Framework 层(基于android 12.0/S)

最新推荐文章于 2024-07-10 00:15:00 发布

bai1995

最新推荐文章于 2024-07-10 00:15:00 发布

阅读量593

点赞数

分类专栏： android framework 文章标签： android binder

本文链接：https://blog.csdn.net/bai1995/article/details/127230493

版权

android framework 专栏收录该内容

4 篇文章 1 订阅

订阅专栏

Binder在Fwk层通过JNI访问到Binder Native的框架，并且主要的操作是交由Binder Native进行处理的。

Bp：BinderProxy 代理肯定是client端

Bn: BinderNative native是server端

Binder 服务的启动是由zygote进程调用AndroidRuntime.cpp 中的startReg 通过JNI进行注册的，本文主要侧重FWK层的其他流程，Binder启动过程可以参考一下其他的博客。

Fwk层的ServiceManager位于：

/frameworks/base/core/java/android/os/ServiceManager.java

添加服务：

ServiceManager 类中一共有三个重载的addService方法

最终都会附加参数调用到下面的方法：

前两个重载方法中的DUMP_FLAG_PRIORITY_DEFAULT 是dump的级别，这里采用默认级别即可。

addService中首先通过getIServiceManager获取到ServiceManager的代理，然后执行addService方法将服务添加到ServiceManager的管理中。

`getIServiceManager`：

拆解如下：

BinderInternal.getContextObject()

通过JNI 调用到 android_util_Binder中的方法，实现了Java到C++的转换。（需要再梳理下JNI的知识）

Process::self（）->getContextObject 这块在Android Binder 之 ServiceManager 文章中有拆解

getContextObject最终会返回serviceManager的BpBinder对象。然后通过JavaObjectForIBinder()根据C++的BpBinder生成Java的BinderProxy对象。

// If the argument is a JavaBBinder, return the Java object that was used to create it.// Otherwise return a BinderProxy for the IBinder. If a previous call was passed the// same IBinder, and the original BinderProxy is still alive, return the same BinderProxy.
    jobject javaObjectForIBinder(JNIEnv* env, const sp<IBinder>& val){
    // N.B. This function is called from a @FastNative JNI method, so don't take locks around// calls to Java code or block the calling thread for a long time for any reason.
    if (val == NULL) return NULL;
    //已经有Java 对象了，直接返回
    if (val->checkSubclass(&gBinderOffsets)) {
        // It's a JavaBBinder created by ibinderForJavaObject. Already has Java object.
        jobject object = static_cast<JavaBBinder*>(val.get())->object();
        LOGDEATH("objectForBinder %p: it's our own %p!\n", val.get(), object);
        return object;
    }

    BinderProxyNativeData* nativeData = new BinderProxyNativeData();
    nativeData->mOrgue = new DeathRecipientList;
    nativeData->mObject = val;

    jobject object = env->CallStaticObjectMethod(gBinderProxyOffsets.mClass,
            gBinderProxyOffsets.mGetInstance, (jlong) nativeData, (jlong) val.get());
    if (env->ExceptionCheck()) {
        // In the exception case, getInstance still took ownership of nativeData.return NULL;
    }
    BinderProxyNativeData* actualNativeData = getBPNativeData(env, object);
    if (actualNativeData == nativeData) {
        // Created a new Proxy
        uint32_t numProxies = gNumProxies.fetch_add(1, std::memory_order_relaxed);
        uint32_t numLastWarned = gProxiesWarned.load(std::memory_order_relaxed);
        if (numProxies >= numLastWarned + PROXY_WARN_INTERVAL) {
            // Multiple threads can get here, make sure only one of them gets to// update the warn counter.if (gProxiesWarned.compare_exchange_strong(numLastWarned,
                        numLastWarned + PROXY_WARN_INTERVAL, std::memory_order_relaxed)) {
                ALOGW("Unexpectedly many live BinderProxies: %d\n", numProxies);
            }
        }
    } else {
        delete nativeData;
    }
    return object;
}

ServiceManagerNative.asInterface：

将 Binder 对象转换成 IServiceManager对象

class ServiceManagerProxy implements IServiceManager {
    public ServiceManagerProxy(IBinder remote) {        
        mRemote = remote;
        mServiceManager = IServiceManager.Stub.asInterface(remote);
    }
    public IBinder asBinder() {        return mRemote;
    }

    @UnsupportedAppUsage   
  public IBinder getService(String name) throws RemoteException{ 
     // Same as checkService (old versions of servicemanager had both methods).
     return mServiceManager.checkService(name);
   }
  public IBinder checkService(String name) throws RemoteException{        
    return mServiceManager.checkService(name);
 }
    public void addService(String name, IBinder service, boolean allowIsolated, int dumpPriority)            throws RemoteException {
        mServiceManager.addService(name, service, allowIsolated, dumpPriority);
    }
    public String[] listServices(int dumpPriority) throws RemoteException {       
     return mServiceManager.listServices(dumpPriority);
    }
    public void registerForNotifications(String name, IServiceCallback cb)            throws RemoteException {
        throw new RemoteException();
    }
    public void unregisterForNotifications(String name, IServiceCallback cb)            throws RemoteException {
        throw new RemoteException();
    }
    public boolean isDeclared(String name) throws RemoteException {        return mServiceManager.isDeclared(name);
    }
    public String[] getDeclaredInstances(String iface) throws RemoteException {      
      return mServiceManager.getDeclaredInstances(iface);
    }
    public String updatableViaApex(String name) throws RemoteException {        
    return mServiceManager.updatableViaApex(name);
    }
    public void registerClientCallback(String name, IBinder service, IClientCallback cb)            throws RemoteException {
        throw new RemoteException();
    }
    public void tryUnregisterService(String name, IBinder service) throws RemoteException {       
     throw new RemoteException();
    }
    public ServiceDebugInfo[] getServiceDebugInfo() throws RemoteException {        
    return mServiceManager.getServiceDebugInfo();
    }
    /**
     * Same as mServiceManager but used by apps.
     *
     * Once this can be removed, ServiceManagerProxy should be removed entirely.
     */
    @UnsupportedAppUsageprivate IBinder mRemote;
    private IServiceManager mServiceManager;
}

ServiceManagerNative.asInterface = new ServiceManagerProxy(),所以梳理一下获取服务的接口 getIServiceManager 就等于 new ServiceManagerProxy(new BinderProxy(BpBinder(0))),所以最后就拿到了native ServiceManager的代理。

继续看addService方法的拆解，下图是serviceManagerProxy中的addService方法：

其中mServiceManager是在构造方法中设置的：

获取服务：

sCache中记录了常见的服务的信息，在ActivityThread的bindApplication 中调用initServiceCache进行了初始化操作。

如果sCache中并没有我们想要找的service，那么会通过Binder.allowBlocking(rawGetService()) 获取到服务的IBinder对象

    private static IBinder rawGetService(String name) throws RemoteException {        
        final long start = sStatLogger.getTime();

       //通过BpBinder(0).getService去获取IBinder对象
        final IBinder binder = getIServiceManager().getService(name);

        final int time = (int) sStatLogger.logDurationStat(Stats.GET_SERVICE, start);

        final int myUid = Process.myUid();
        final boolean isCore = UserHandle.isCore(myUid);

        //getService的数据统计，性能分析打点
        final long slowThreshold = isCore
                ? GET_SERVICE_SLOW_THRESHOLD_US_CORE
                : GET_SERVICE_SLOW_THRESHOLD_US_NON_CORE;

        synchronized (sLock) {
            sGetServiceAccumulatedUs += time;
            sGetServiceAccumulatedCallCount++;

            final long nowUptime = SystemClock.uptimeMillis();

            // Was a slow call?if (time >= slowThreshold) {
                // We do a slow log:// - At most once in every SLOW_LOG_INTERVAL_MS// - OR it was slower than the previously logged slow call.
                if ((nowUptime > (sLastSlowLogUptime + SLOW_LOG_INTERVAL_MS))
                        || (sLastSlowLogActualTime < time)) {
                    EventLogTags.writeServiceManagerSlow(time / 1000, name);

                    sLastSlowLogUptime = nowUptime;
                    sLastSlowLogActualTime = time;
                }
            }

            // Every GET_SERVICE_LOG_EVERY_CALLS calls, log the total time spent in getService().final int logInterval = isCore
                    ? GET_SERVICE_LOG_EVERY_CALLS_CORE
                    : GET_SERVICE_LOG_EVERY_CALLS_NON_CORE;

            if ((sGetServiceAccumulatedCallCount >= logInterval)
                    && (nowUptime >= (sLastStatsLogUptime + STATS_LOG_INTERVAL_MS))) {

                EventLogTags.writeServiceManagerStats(
                        sGetServiceAccumulatedCallCount, // Total # of getService() calls.
                        sGetServiceAccumulatedUs / 1000, // Total time spent in getService() calls.
                        (int) (nowUptime - sLastStatsLogUptime)); // Uptime duration since last log.
                sGetServiceAccumulatedCallCount = 0;
                sGetServiceAccumulatedUs = 0;
                sLastStatsLogUptime = nowUptime;
            }
        }
        return binder;
    }

android 8.0.0_r36 之前都是如下结构，没有通过rawGetService方法，而是直接在getService中通过return getIServiceManager().getService(name);获取到Ibinder对象。

FWK 应用实例：

addService:

开机过程中在init 进程启动zygote 以后，zygote会通过fork操作创建出systemServer进程，PackageManagerService 就是systemSever中一个比较重要的线程。PackageManagerService 启动流程中会调用其中的main方法并在main方法中以“package”和“package_native”为名将PackageManagerService 和PackageManagerServiceNative添加到ServiceManager的管理中去。