native层Binder进程间通信机制学习

IBinder派生了一个重量级的类：BBinder，代表服务端；在Binder.h中还定义了一个类BpRefBase，来代表客户端，这个类有个属性mRemote是一个IBinder对象。

下面以SurfaceFlinger为例：

SurfaceFlinger运行在system_server进程中：

SystemServer.java    

 native public static void init1(String[] args);

public static void main(String[] args) {

     ........

     init1(args);

}

android_server_SystemServer.cpp

extern "C" int system_init();

static void android_server_SystemServer_init1(JNIEnv* env, jobject clazz)
{
    system_init();
}

System_init.cpp

extern "C" status_t system_init()
{

   .......

   char propBuf[PROPERTY_VALUE_MAX];
    property_get("system_init.startsurfaceflinger", propBuf, "1");
    if (strcmp(propBuf, "1") == 0) {
        // Start the SurfaceFlinger
        SurfaceFlinger::instantiate();
    }

    ......

}

SurfaceFlinger.cpp

void SurfaceFlinger::instantiate() {
    defaultServiceManager()->addService(
            String16("SurfaceFlinger"), new SurfaceFlinger());
}

以下说明相关类之间的继承关系，见谅，不会画UML图：

SurfaceFlinger.h、 ISurfaceComposer.h 、ISurfaceComposer.cpp

class SurfaceFlinger : public BnSurfaceComposer, protected Thread

class ISurfaceComposer : public IInterface

class BnSurfaceComposer : public ISurfaceComposer, public BBinder

class BpSurfaceComposer : public ISurfaceComposer, public BpRefbase

BpSurfaceComposer持有一个mRemote对象，继承自BpRefBase，这个mRemote实际就是BBinder(SurfaceFlinger)对象。

客户端使用SurfaceFlinger的方法，以SurfaceComposerClient.cpp为例：       

static sp<ISurfaceComposer> getComposerService()
{
    sp<ISurfaceComposer> sc;
    Mutex::Autolock _l(gLock);
    if (gSurfaceManager != 0) {
        sc = gSurfaceManager;
    } else {
        // release the lock while we're waiting...
        gLock.unlock();

        sp<IBinder> binder;
        sp<IServiceManager> sm = defaultServiceManager();
        do {
            binder = sm->getService(String16("SurfaceFlinger"));
            if (binder == 0) {
                LOGW("SurfaceFlinger not published, waiting...");
                usleep(500000); // 0.5 s
            }
        } while(binder == 0);

        // grab the lock again for updating gSurfaceManager
        gLock.lock();
        if (gSurfaceManager == 0) {
            sc = interface_cast<ISurfaceComposer>(binder);
            gSurfaceManager = sc;
        } else {
            sc = gSurfaceManager;
        }
    }
    return sc;
}

其中binder = sm->getService(String16("SurfaceFlinger"));

IServiceManager.cpp

virtual sp<IBinder> getService(const String16& name) const
    {
        unsigned n;
        for (n = 0; n < 5; n++){
            sp<IBinder> svc = checkService(name);
            if (svc != NULL) return svc;
            LOGI("Waiting for sevice %s...\n", String8(name).string());
            sleep(1);
        }
        return NULL;
    }
    
    virtual sp<IBinder> checkService( const String16& name) const
    {
        Parcel data, reply;
        data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
        data.writeString16(name);
        remote()->transact(CHECK_SERVICE_TRANSACTION, data, &reply);
        return reply.readStrongBinder();
    }

server端在onTransact()中回复：

sp<IBinder> b = const_cast<BnServiceManager*>(this)->checkService(which);

ServiceManager.cpp

sp<IBinder> BServiceManager::checkService(const String16& name) const
{
    AutoMutex _l(mLock);
    ssize_t i = mServices.indexOfKey(name);
    LOGV("ServiceManager: getService(%s) -> %d\n", String8(name).string(), i);

    //通过SurfaceFlinger::instantiate()的addService(String16("SurfaceFlinger"), new SurfaceFlinger())可知，

   //返回的是SurfaceFlinger对象，也就是BBinder对象。
    if (i >= 0) return mServices.valueAt(i);
    return NULL;
}

再说回sc = interface_cast<ISurfaceComposer>(binder);，interface_cast展开后是：

return ISurfaceComposer::asInterface(obj);

 sp<ISurfaceComposer> ISurfaceComposer::asInterface(const sp<IBinder>& obj)  \
    {                                                                   \
        sp<ISurfaceComposer> intr;                                          \
        if (obj != NULL) {                                              \
            intr = static_cast<ISurfaceComposer*>(                          \
                obj->queryLocalInterface(                               \
                        ISurfaceComposer::descriptor).get());               \
            if (intr == NULL) {                                         \

                //这句话把传进来的BBinder对象赋值给了BpSurfaceComposer所继承的mRemote
                intr = new BpSurfaceComposer(obj);                          \
            }                                                           \
        }                                                               \
        return intr;                                                    \
    }

所以说这个sp<ISurfaceComposer> sc实际就是BpSurfaceComposer对象。