Android Binder getService(java)源码分析(二)

本篇是继续上一篇进行分析的https://blog.csdn.net/we1less/article/details/120731185

代码回到ServiceManager.java  路径frameworks/base/core/java/android/os/ServiceManager.java

        上一篇文章说道 BinderInternal.getContextObject() 返回的是android/os/BinderProxy对象，它是java层的，这个对象的mObject成员变量带有native层ServiceManager代理类对象

        而getIServiceManager().getService(name) 其实调用的是ServiceManagerProxy的getService

public static IBinder getService(String name) {
    try {
        IBinder service = sCache.get(name);
        if (service != null) {
            return service;
        } else {
            return Binder.allowBlocking(getIServiceManager().getService(name));
        }
    } catch (RemoteException e) {
        Log.e(TAG, "error in getService", e);
    }
    return null;
}


private static IServiceManager getIServiceManager() {
        if (sServiceManager != null) {
            return sServiceManager;
        }
 
        // Find the service manager
        sServiceManager = ServiceManagerNative
                .asInterface(Binder.allowBlocking(BinderInternal.getContextObject()));
        return sServiceManager;
    }

---

ServiceManagerNative .asInterface

        路径  ：frameworks/base/core/java/android/os/ServiceManagerNative.java

        所以asInterface就是new ServiceManagerProxy(obj);

        这个obj就是上面返回的带有native层ServiceManager代理类对象的java层的android/os/BinderProxy对象。把它赋值给ServiceManagerProxy中的mRemote成员，通信就是调用mRemote成员的transact方法。

        到此我们知道getIServiceManager().getService(name) 其实调用的是ServiceManagerProxy的getService

static public IServiceManager asInterface(IBinder obj)
{
    if (obj == null) {
        return null;
    }
    IServiceManager in =
        (IServiceManager)obj.queryLocalInterface(descriptor);
    if (in != null) {
        return in;
    }
    
    return new ServiceManagerProxy(obj);
}

---

new ServiceManagerProxy(obj);

路径  frameworks/base/core/java/android/os/ServiceManagerNative.java 

          可以看出来构造器中就是将mRemote赋值android/os/BinderProxy对象

public ServiceManagerProxy(IBinder remote) {
        mRemote = remote;
    }

---

ServiceManagerProxy.getService

        路径  ：frameworks/base/core/java/android/os/ServiceManagerNative.java

        mRemote 就是  android/os/BinderProxy对象

        IServiceManager.descriptor ：

        static final String descriptor = "android.os.IServiceManager";

        int GET_SERVICE_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION;

        其实最后就是变成了与Binder驱动通信获取对应服务，Binder驱动填充reply的过程

public IBinder getService(String name) throws RemoteException {
    Parcel data = Parcel.obtain();
    Parcel reply = Parcel.obtain();
    data.writeInterfaceToken(IServiceManager.descriptor);
    data.writeString(name);
    //mRemote 就是  android/os/BinderProxy对象
    mRemote.transact(GET_SERVICE_TRANSACTION, data, reply, 0);
    IBinder binder = reply.readStrongBinder();
    reply.recycle();
    data.recycle();
    return binder;
}

---

 BinderProxy.transact

        路径 ：frameworks/base/core/java/android/os/Binder.java

        核心就是调用的 transactNative，这是一个native方法

public boolean transact(int code, Parcel data, Parcel reply, int flags) throws RemoteException {
    ...
    try {
        //native方法
        return transactNative(code, data, reply, flags);
    } finally {
        if (tracingEnabled) {
            Trace.traceEnd(Trace.TRACE_TAG_ALWAYS);
        }
    }
}

public native boolean transactNative(int code, Parcel data, Parcel reply,
            int flags) throws RemoteException;

---

 transactNative

        路径  frameworks/base/core/jni/android_util_Binder.cpp

        gBinderProxyOffsets 就是 android/os/BinderProxy

        gBinderProxyOffsets.mObject 就是native层的ServiceManager

        调用BpBinder(0)的transact方法

        最后就是填充reply  将replyObj填充为java的android/os/Parcel 可打包对象

static jboolean android_os_BinderProxy_transact(JNIEnv* env, jobject obj,
        jint code, jobject dataObj, jobject replyObj, jint flags) // throws RemoteException
{
    //一系列的判空 ...
    //填充reply  将replyObj填充为java的android/os/Parcel 可打包对象
    Parcel* reply = parcelForJavaObject(env, replyObj);

    IBinder* target = (IBinder*)
        env->GetLongField(obj, gBinderProxyOffsets.mObject);
    //一系列判空 ...
    status_t err = target->transact(code, *data, reply, flags);
    ...
    signalExceptionForError(env, obj, err, true /*canThrowRemoteException*/, data->dataSize());
    return JNI_FALSE;
}

这里补一下JNINativeMethod  

//路径  frameworks/base/core/jni/core_jni_helpers.h
static inline int RegisterMethodsOrDie(JNIEnv* env, const char* className,
                                       const JNINativeMethod* gMethods, int numMethods) {
    int res = AndroidRuntime::registerNativeMethods(env, className, gMethods, numMethods);
    LOG_ALWAYS_FATAL_IF(res < 0, "Unable to register native methods.");
    return res;
}

//路径  frameworks/base/core/jni/android_util_Binder.cpp

static const JNINativeMethod gBinderProxyMethods[] = {
     /* name, signature, funcPtr */
    {"pingBinder",          "()Z", (void*)android_os_BinderProxy_pingBinder},
    {"isBinderAlive",       "()Z", (void*)android_os_BinderProxy_isBinderAlive},
    {"getInterfaceDescriptor", "()Ljava/lang/String;", (void*)android_os_BinderProxy_getInterfaceDescriptor},
    {"transactNative",      "(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z", (void*)android_os_BinderProxy_transact},
    {"linkToDeath",         "(Landroid/os/IBinder$DeathRecipient;I)V", (void*)android_os_BinderProxy_linkToDeath},
    {"unlinkToDeath",       "(Landroid/os/IBinder$DeathRecipient;I)Z", (void*)android_os_BinderProxy_unlinkToDeath},
    {"destroy",             "()V", (void*)android_os_BinderProxy_destroy},
};

---

BpBinder(0)的transact

        路径  frameworks/native/libs/binder/BpBinder.cpp

        调用了IPCThreadState::self()->transact

status_t BpBinder::transact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    // Once a binder has died, it will never come back to life.
    if (mAlive) {
        status_t status = IPCThreadState::self()->transact(
            mHandle, code, data, reply, flags);
        if (status == DEAD_OBJECT) mAlive = 0;
        return status;
    }

    return DEAD_OBJECT;
}

---

IPCThreadState::self()->transact

        路径：frameworks/native/libs/binder/IPCThreadState.cpp

        调用了writeTransactionData  

        //BC_TRANSACTION 一般代表客户端调用驱动端 BR_xxx  一般指驱动返回给客户端

        (flags & TF_ONE_WAY) == 0  判断是不是oneway函数  很显然获取服务不是

        填充reply

        然后调用waitForResponse

status_t IPCThreadState::transact(int32_t handle,
                                  uint32_t code, const Parcel& data,
                                  Parcel* reply, uint32_t flags)
{
    ...
        //BC_TRANSACTION 一般代表客户端调用驱动端
        err = writeTransactionData(BC_TRANSACTION, flags, handle, code, data, NULL);
    }
    ...
    //oneway ? 1 : 0  
    if ((flags & TF_ONE_WAY) == 0) {
        ...
        if (reply) {
            //填充reply
            err = waitForResponse(reply);
        ...

    return err;
}

writeTransactionData

        路径 ： frameworks/native/libs/binder/IPCThreadState.cpp

        主要是填充  binder_transaction_data  结构体向驱动发送

        code为java传递过来的GET_SERVICE_TRANSACTION == 0

status_t IPCThreadState::writeTransactionData(int32_t cmd, uint32_t binderFlags,
    int32_t handle, uint32_t code, const Parcel& data, status_t* statusBuffer)
{
    binder_transaction_data tr;
    ...
    mOut.writeInt32(cmd);
    mOut.write(&tr, sizeof(tr));

    return NO_ERROR;
}

waitForResponse

        路径 ： frameworks/native/libs/binder/IPCThreadState.cpp

        最终到这里就是跟驱动获取返回数据了

status_t IPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult)
{
    uint32_t cmd;
    int32_t err;

    while (1) {
        if ((err=talkWithDriver()) < NO_ERROR) break;
        err = mIn.errorCheck();
        if (err < NO_ERROR) break;
        if (mIn.dataAvail() == 0) continue;

        cmd = (uint32_t)mIn.readInt32();

        IF_LOG_COMMANDS() {
            alog << "Processing waitForResponse Command: "
                << getReturnString(cmd) << endl;
        }

        switch (cmd) {
        case BR_TRANSACTION_COMPLETE:
            if (!reply && !acquireResult) goto finish;
            break;

        case BR_DEAD_REPLY:
            err = DEAD_OBJECT;
            goto finish;

        case BR_FAILED_REPLY:
            err = FAILED_TRANSACTION;
            goto finish;

        case BR_ACQUIRE_RESULT:
            {
                ALOG_ASSERT(acquireResult != NULL, "Unexpected brACQUIRE_RESULT");
                const int32_t result = mIn.readInt32();
                if (!acquireResult) continue;
                *acquireResult = result ? NO_ERROR : INVALID_OPERATION;
            }
            goto finish;

        case BR_REPLY:
            {
                binder_transaction_data tr;
                err = mIn.read(&tr, sizeof(tr));
                ALOG_ASSERT(err == NO_ERROR, "Not enough command data for brREPLY");
                if (err != NO_ERROR) goto finish;

                if (reply) {
                    if ((tr.flags & TF_STATUS_CODE) == 0) {
                        reply->ipcSetDataReference(
                            reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
                            tr.data_size,
                            reinterpret_cast<const binder_size_t*>(tr.data.ptr.offsets),
                            tr.offsets_size/sizeof(binder_size_t),
                            freeBuffer, this);
                    } else {
                        err = *reinterpret_cast<const status_t*>(tr.data.ptr.buffer);
                        freeBuffer(NULL,
                            reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
                            tr.data_size,
                            reinterpret_cast<const binder_size_t*>(tr.data.ptr.offsets),
                            tr.offsets_size/sizeof(binder_size_t), this);
                    }
                } else {
                    freeBuffer(NULL,
                        reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
                        tr.data_size,
                        reinterpret_cast<const binder_size_t*>(tr.data.ptr.offsets),
                        tr.offsets_size/sizeof(binder_size_t), this);
                    continue;
                }
            }
            goto finish;

        default:
            err = executeCommand(cmd);
            if (err != NO_ERROR) goto finish;
            break;
        }
    }

finish:
    if (err != NO_ERROR) {
        if (acquireResult) *acquireResult = err;
        if (reply) reply->setError(err);
        mLastError = err;
    }

    return err;
}

其实后面与binder驱动相关的可以参考这篇原理Android Binder(C语言版本例子)_we1less的博客-CSDN博客 

这里返回结果为对应的Serivce的handle，然后利用这个handle构造出对应的BpBinder，这一部分就完全和IServiceManager的获取是一样的，只不过ServiceManager是直接new BpBinder(0)
而远程服务则是需要先从ServiceManager中获取handle，然后再new BpBinder(handle)