探究android-aidl---bindService的绑定及其内部原理

最新推荐文章于 2023-09-11 09:00:11 发布

不吹空调的咸鱼

最新推荐文章于 2023-09-11 09:00:11 发布

阅读量8.8k

点赞数 1

分类专栏： android原理剖析 app进程 android源码文章标签： android 移动开发

本文链接：https://blog.csdn.net/qq_37977070/article/details/114656074

版权

android原理剖析同时被 3 个专栏收录

8 篇文章 0 订阅

订阅专栏

android源码

7 篇文章 0 订阅

订阅专栏

app进程

5 篇文章 0 订阅

订阅专栏

bindService的用法

    private IMyAidlInterface iMyAidlInterface;

    private void bindService() {
        Intent intent = new Intent();
        intent.setComponent(new ComponentName("com.example.aidlserver", "MyService"));
        bindService(intent, serviceConnection, Context.BIND_AUTO_CREATE);
    }

    private ServiceConnection serviceConnection = new ServiceConnection() {
        @Override
        public void onServiceConnected(ComponentName name, IBinder service) {
            iMyAidlInterface = IMyAidlInterface.Stub.asInterface(service);
            try {
                iMyAidlInterface.hi("");
            } catch (RemoteException e) {
                e.printStackTrace();
            }
        }

        @Override
        public void onServiceDisconnected(ComponentName name) {
        }
    };

bindService的大致流程

bindService涉及哪些参与者

1.客户端进程（请求端） 2.系统进程   3.serviceManager进程  4. 服务端进程

通讯过程是怎样的？

1. bindService时传递的ServiceConnection参数
在绑定服务时调用bindService(Intent service, ServiceConnection conn, int flags),在绑定成功后的ServiceConnection对象里onServiceConnected()将会收到服务端传来的代理对象。所以先从bindService时传入的ServiceConnection对象开始探究，这个ServiceConnection对象如何被保存？如何通过ServiceConnection对象回调服务代理对象？
根据bindService()源码看下：
frameworks\base\core\java\android\app\ContextImpl.java

@Override
    public boolean bindService(Intent service, ServiceConnection conn,
            int flags) {
        warnIfCallingFromSystemProcess();
        return bindServiceCommon(service, conn, flags, mMainThread.getHandler(), getUser());
    }

接着看下bindServiceCommon()：
frameworks\base\core\java\android\app\ContextImpl.java

private boolean bindServiceCommon(Intent service, ServiceConnection conn, int flags, Handler
            handler, UserHandle user) {
        // Keep this in sync with DevicePolicyManager.bindDeviceAdminServiceAsUser.
        IServiceConnection sd;
        ...
        if (mPackageInfo != null) {
			//根据请求时传入的ServiceConnection获取IServiceConnection对象
            sd = mPackageInfo.getServiceDispatcher(conn, getOuterContext(), handler, flags);
        } 
        ...
			// IServiceConnection对象传入到ams中，进行bindService
         	int res = ActivityManager.getService().bindService(mMainThread.getApplicationThread(), getActivityToken(), service,
                		service.resolveTypeIfNeeded(getContentResolver()),  sd, flags, getOpPackageName(), user.getIdentifier());
          ...
    }

接下来再看下 mPackageInfo.getServiceDispatcher(conn, getOuterContext(), handler, flags);
这里怎么根据请求时传入的ServiceConnection获取IServiceConnection对象，这个IServiceConnection对象有什么用处?
frameworks\base\core\java\android\app\LoadedApk.java

    public final IServiceConnection getServiceDispatcher(ServiceConnection c,
            Context context, Handler handler, int flags) {
        synchronized (mServices) {
            LoadedApk.ServiceDispatcher sd = null;
			// ArrayMap<Context, ArrayMap<ServiceConnection, LoadedApk.ServiceDispatcher>> mServices
       		// mServices中存着当前进程所有请求绑定服务的context和对应的接收服务的派遣对象
            ArrayMap<ServiceConnection, LoadedApk.ServiceDispatcher> map = mServices.get(context);
			//如果当前上下文从未绑定过服务则map为空
            if (map != null) {
                if (DEBUG) Slog.d(TAG, "Returning existing dispatcher " + sd + " for conn " + c);
				// 根据ServiceConnection获取ServiceDispatcher对象;
				// ServiceDispatcher用于系统进程返回服务代理给客户端时的派遣
                sd = map.get(c);
            }
			//如果当前ServiceConnection首次传入绑定服务时，map里没有该sd
            if (sd == null) {
				//新建ServiceDispatcher对象
                sd = new ServiceDispatcher(c, context, handler, flags);
                if (DEBUG) Slog.d(TAG, "Creating new dispatcher " + sd + " for conn " + c);
                if (map == null) {
                    map = new ArrayMap<>();
                    mServices.put(context, map);
                }
				//把新建ServiceDispatcher对象存储在mServices和map里
                map.put(c, sd);
            } else {
                sd.validate(context, handler);
            }
			//返回ServiceDispatcher对象里的IServiceConnection
            return sd.getIServiceConnection();
        }
    }

接下来看看ServiceDispatcher的构造方法
frameworks\base\core\java\android\app\LoadedApk.java

 ServiceDispatcher(ServiceConnection conn,
                Context context, Handler activityThread, int flags) {
            // getIServiceConnection() 里返回的就是 mIServiceConnection 对象
            mIServiceConnection = new InnerConnection(this);
            mConnection = conn;
            mContext = context;
            mActivityThread = activityThread;
            mLocation = new ServiceConnectionLeaked(null);
            mLocation.fillInStackTrace();
            mFlags = flags;
        }

接下来看看InnerConnection的构造方法：
frameworks\base\core\java\android\app\LoadedApk.java

	private static class InnerConnection extends IServiceConnection.Stub {
            final WeakReference<LoadedApk.ServiceDispatcher> mDispatcher;

            InnerConnection(LoadedApk.ServiceDispatcher sd) {
				//弱引用持有传入的ServiceDispatcher对象
                mDispatcher = new WeakReference<LoadedApk.ServiceDispatcher>(sd);
            }
			//InnerConnection里只有一个实现方法connected()
            public void connected(ComponentName name, IBinder service, boolean dead)
                    throws RemoteException {
                LoadedApk.ServiceDispatcher sd = mDispatcher.get();
                if (sd != null) {
					//当有跨进程调用 InnerConnection.connected()时，调用 ServiceDispatcher.connect()
                    sd.connected(name, service, dead);
                }
            }
        }

frameworks\base\core\java\android\app\LoadedApk.java

public void connected(ComponentName name, IBinder service, boolean dead) {
            if (mActivityThread != null) {
				//在进程的主线程中执行RunConnection
                mActivityThread.post(new RunConnection(name, service, 0, dead));
            } else {
                doConnected(name, service, dead);
            }
        }

接下来看下RunConnection的run()方法：
frameworks\base\core\java\android\app\LoadedApk.java

private final class RunConnection implements Runnable {
			...
            public void run() {
                if (mCommand == 0) {
                //调用doConnected()方法
                    doConnected(mName, mService, mDead);
                } else if (mCommand == 1) {
                    doDeath(mName, mService);
                }
            }
			...
        }

再继续看下doConnected():
frameworks\base\core\java\android\app\LoadedApk.java

 public void doConnected(ComponentName name, IBinder service, boolean dead) {
            ServiceDispatcher.ConnectionInfo old;
            ServiceDispatcher.ConnectionInfo info;

            synchronized (this) {
                if (mForgotten) {
                    // We unbound before receiving the connection; ignore
                    // any connection received.
                    return;
                }
				//检查已绑定的服务中是否有包含该服务
                old = mActiveConnections.get(name);
				//如果已绑定的服务中有包含该服务，则返回
                if (old != null && old.binder == service) {
                    // Huh, already have this one.  Oh well!
                    return;
                }

                if (service != null) {
                    // A new service is being connected... set it all up.
                    info = new ConnectionInfo();
                    info.binder = service;
                    info.deathMonitor = new DeathMonitor(name, service);
                    try {
						//监听服务的生命周期
                        service.linkToDeath(info.deathMonitor, 0);
						//在mActiveConnections中加入已绑定这个服务的记录
                        mActiveConnections.put(name, info);
                    } catch (RemoteException e) {
                        // This service was dead before we got it...  just
                        // don't do anything with it.
                        mActiveConnections.remove(name);
                        return;
                    }

                } 
                ...
            if (old != null) {
				// 该ServiceConnection之前用于绑定别的服务，但一个ServiceConnection对象只能对应一个服务的绑定操作，
				// 所以要把ServiceConnection所绑定旧的服务给解绑
                mConnection.onServiceDisconnected(name);
            }
                ...
            if (service != null) {
				//在客户端传入的ServiceConnection对象mConnection中回调onServiceConnected()方法,把服务端代理对象返回传给客户端
                mConnection.onServiceConnected(name, service);
            } 
                ...
        }

在这里插入图片描述
在这小节中可得：客户端在绑定服务时，传入的ServiceConnection，会被封装成IServiceConnection对象，用于服务端回调代理类时的跨进程通讯到客户端中。

2. bindService在ams中的调度流程
接下来再来看下ams中bindService()：
frameworks\base\core\java\android\app\ActivityManagerService.java

public int bindService(IApplicationThread caller, IBinder token, Intent service,
            String resolvedType, IServiceConnection connection, int flags, String callingPackage,
            int userId) throws TransactionTooLargeException {
            ...
        synchronized(this) {
        //mServices为ActiveServices对象，ActiveServices用于系统内的所有服务的调度操作
            return mServices.bindServiceLocked(caller, token, service,
                    resolvedType, connection, flags, callingPackage, userId);
        }
    }