Binder在Fwk层通过JNI访问到Binder Native的框架,并且主要的操作是交由Binder Native进行处理的。
Bp:BinderProxy 代理肯定是client端
Bn: BinderNative native是server端
Binder 服务的启动是由zygote进程调用AndroidRuntime.cpp 中的startReg 通过JNI进行注册的,本文主要侧重FWK层的其他流程,Binder启动过程可以参考一下其他的博客。
Fwk层的ServiceManager位于:
/frameworks/base/core/java/android/os/ServiceManager.java
添加服务:
ServiceManager 类中一共有三个重载的addService方法
最终都会附加参数调用到下面的方法:
前两个重载方法中的DUMP_FLAG_PRIORITY_DEFAULT 是dump的级别,这里采用默认级别即可。
addService中 首先通过getIServiceManager获取到ServiceManager的代理,然后执行addService方法将服务添加到ServiceManager的管理中。
getIServiceManager
:
拆解如下:
BinderInternal.getContextObject()
通过JNI 调用到 android_util_Binder中的方法,实现了Java到C++的转换。(需要再梳理下JNI的知识)
Process::self()->getContextObject 这块在Android Binder 之 ServiceManager 文章中有拆解
getContextObject最终会返回serviceManager的BpBinder对象。然后通过JavaObjectForIBinder()根据C++的BpBinder生成Java的BinderProxy对象。
// If the argument is a JavaBBinder, return the Java object that was used to create it.// Otherwise return a BinderProxy for the IBinder. If a previous call was passed the// same IBinder, and the original BinderProxy is still alive, return the same BinderProxy.
jobject javaObjectForIBinder(JNIEnv* env, const sp<IBinder>& val){
// N.B. This function is called from a @FastNative JNI method, so don't take locks around// calls to Java code or block the calling thread for a long time for any reason.
if (val == NULL) return NULL;
//已经有Java 对象了,直接返回
if (val->checkSubclass(&gBinderOffsets)) {
// It's a JavaBBinder created by ibinderForJavaObject. Already has Java object.
jobject object = static_cast<JavaBBinder*>(val.get())->object();
LOGDEATH("objectForBinder %p: it's our own %p!\n", val.get(), object);
return object;
}
BinderProxyNativeData* nativeData = new BinderProxyNativeData();
nativeData->mOrgue = new DeathRecipientList;
nativeData->mObject = val;
jobject object = env->CallStaticObjectMethod(gBinderProxyOffsets.mClass,
gBinderProxyOffsets.mGetInstance, (jlong) nativeData, (jlong) val.get());
if (env->ExceptionCheck()) {
// In the exception case, getInstance still took ownership of nativeData.return NULL;
}
BinderProxyNativeData* actualNativeData = getBPNativeData(env, object);
if (actualNativeData == nativeData) {
// Created a new Proxy
uint32_t numProxies = gNumProxies.fetch_add(1, std::memory_order_relaxed);
uint32_t numLastWarned = gProxiesWarned.load(std::memory_order_relaxed);
if (numProxies >= numLastWarned + PROXY_WARN_INTERVAL) {
// Multiple threads can get here, make sure only one of them gets to// update the warn counter.if (gProxiesWarned.compare_exchange_strong(numLastWarned,
numLastWarned + PROXY_WARN_INTERVAL, std::memory_order_relaxed)) {
ALOGW("Unexpectedly many live BinderProxies: %d\n", numProxies);
}
}
} else {
delete nativeData;
}
return object;
}
ServiceManagerNative.asInterface:
将 Binder 对象转换成 IServiceManager对象
class ServiceManagerProxy implements IServiceManager {
public ServiceManagerProxy(IBinder remote) {
mRemote = remote;
mServiceManager = IServiceManager.Stub.asInterface(remote);
}
public IBinder asBinder() { return mRemote;
}
@UnsupportedAppUsage
public IBinder getService(String name) throws RemoteException{
// Same as checkService (old versions of servicemanager had both methods).
return mServiceManager.checkService(name);
}
public IBinder checkService(String name) throws RemoteException{
return mServiceManager.checkService(name);
}
public void addService(String name, IBinder service, boolean allowIsolated, int dumpPriority) throws RemoteException {
mServiceManager.addService(name, service, allowIsolated, dumpPriority);
}
public String[] listServices(int dumpPriority) throws RemoteException {
return mServiceManager.listServices(dumpPriority);
}
public void registerForNotifications(String name, IServiceCallback cb) throws RemoteException {
throw new RemoteException();
}
public void unregisterForNotifications(String name, IServiceCallback cb) throws RemoteException {
throw new RemoteException();
}
public boolean isDeclared(String name) throws RemoteException { return mServiceManager.isDeclared(name);
}
public String[] getDeclaredInstances(String iface) throws RemoteException {
return mServiceManager.getDeclaredInstances(iface);
}
public String updatableViaApex(String name) throws RemoteException {
return mServiceManager.updatableViaApex(name);
}
public void registerClientCallback(String name, IBinder service, IClientCallback cb) throws RemoteException {
throw new RemoteException();
}
public void tryUnregisterService(String name, IBinder service) throws RemoteException {
throw new RemoteException();
}
public ServiceDebugInfo[] getServiceDebugInfo() throws RemoteException {
return mServiceManager.getServiceDebugInfo();
}
/**
* Same as mServiceManager but used by apps.
*
* Once this can be removed, ServiceManagerProxy should be removed entirely.
*/
@UnsupportedAppUsageprivate IBinder mRemote;
private IServiceManager mServiceManager;
}
ServiceManagerNative.asInterface = new ServiceManagerProxy(),所以梳理一下获取服务的接口 getIServiceManager 就等于 new ServiceManagerProxy(new BinderProxy(BpBinder(0))),所以最后就拿到了native ServiceManager的代理。
继续看addService方法的拆解,下图是serviceManagerProxy中的addService方法:
其中mServiceManager是在构造方法中设置的:
获取服务:
sCache中记录了常见的服务的信息,在ActivityThread的bindApplication 中调用initServiceCache进行了初始化操作。
如果sCache中并没有我们想要找的service,那么会通过Binder.allowBlocking(rawGetService()) 获取到服务的IBinder对象
private static IBinder rawGetService(String name) throws RemoteException {
final long start = sStatLogger.getTime();
//通过BpBinder(0).getService去获取IBinder对象
final IBinder binder = getIServiceManager().getService(name);
final int time = (int) sStatLogger.logDurationStat(Stats.GET_SERVICE, start);
final int myUid = Process.myUid();
final boolean isCore = UserHandle.isCore(myUid);
//getService的数据统计,性能分析打点
final long slowThreshold = isCore
? GET_SERVICE_SLOW_THRESHOLD_US_CORE
: GET_SERVICE_SLOW_THRESHOLD_US_NON_CORE;
synchronized (sLock) {
sGetServiceAccumulatedUs += time;
sGetServiceAccumulatedCallCount++;
final long nowUptime = SystemClock.uptimeMillis();
// Was a slow call?if (time >= slowThreshold) {
// We do a slow log:// - At most once in every SLOW_LOG_INTERVAL_MS// - OR it was slower than the previously logged slow call.
if ((nowUptime > (sLastSlowLogUptime + SLOW_LOG_INTERVAL_MS))
|| (sLastSlowLogActualTime < time)) {
EventLogTags.writeServiceManagerSlow(time / 1000, name);
sLastSlowLogUptime = nowUptime;
sLastSlowLogActualTime = time;
}
}
// Every GET_SERVICE_LOG_EVERY_CALLS calls, log the total time spent in getService().final int logInterval = isCore
? GET_SERVICE_LOG_EVERY_CALLS_CORE
: GET_SERVICE_LOG_EVERY_CALLS_NON_CORE;
if ((sGetServiceAccumulatedCallCount >= logInterval)
&& (nowUptime >= (sLastStatsLogUptime + STATS_LOG_INTERVAL_MS))) {
EventLogTags.writeServiceManagerStats(
sGetServiceAccumulatedCallCount, // Total # of getService() calls.
sGetServiceAccumulatedUs / 1000, // Total time spent in getService() calls.
(int) (nowUptime - sLastStatsLogUptime)); // Uptime duration since last log.
sGetServiceAccumulatedCallCount = 0;
sGetServiceAccumulatedUs = 0;
sLastStatsLogUptime = nowUptime;
}
}
return binder;
}
android 8.0.0_r36 之前都是如下结构,没有通过rawGetService方法,而是直接在getService中通过return getIServiceManager().getService(name);
获取到Ibinder对象。
FWK 应用实例:
addService:
开机过程中在init 进程启动zygote 以后,zygote会通过fork操作创建出systemServer进程,PackageManagerService 就是systemSever中一个比较重要的线程。PackageManagerService 启动流程中会调用其中的main方法并在main方法中以“package”和“package_native”为名将PackageManagerService 和PackageManagerServiceNative添加到ServiceManager的管理中去。
值得一提的是 ,因为Fwk层的ServiceManager类是final的,所以不需要创建实例就可以直接调用类中方法。
getService: