Android 12 S Binder原理之BpBinder，BnBinder以及IInterface介绍

系列文章

Android 12 S ServiceManager原理

Android 12 S Native Service的创建流程

Android 12 S Binder原理之BpBinder，BnBinder以及IInterface介绍

Android 12 S HIDL Service创建流程

Android 12 S 自定义Hal服务selinux权限添加

Android 12 S 自定义Native服务selinux权限添加

Android 12 S java服务调用native服务

Android 12 S 自定义native服务访问java服务

---

​

一：Binder机制介绍

Binder机制是Android系统提供的跨进程通讯机制。Client进程希望可以与Server进程沟通，但由于是跨进程，所以需要借助Binder驱动进程通信。

Binder由以下模块组成：

    *  Binder驱动

    *  Binder Server端 - Server进程

    *  Binder Client端 - Client进程

    *  ServiceManager - 管理者

Binder的通信模型如下所示：

 二：创建Service模型

如果要创建一个Service，需要Server端继承BnInterface, Client端继承BpInterface。具体可用下图表示：

可在如下文件中找到关于Bn, Bp相关的声明

frameworks/native/libs/binder/include/binder/IInterface.h

frameworks/native/libs/binder/include/binder/IBinder.h

 具体代码如下

frameworks/native/libs/binder/include/binder/IInterface.h
class IInterface : public virtual RefBase
{
public:
            IInterface();
            static sp<IBinder>  asBinder(const IInterface*);
            static sp<IBinder>  asBinder(const sp<IInterface>&);

protected:
    virtual                     ~IInterface();
    virtual IBinder*            onAsBinder() = 0;
};
-----------------------------------------------------------
class BnInterface : public INTERFACE, public BBinder
{
public:
    virtual sp<IInterface>      queryLocalInterface(const String16& _descriptor);
    virtual const String16&     getInterfaceDescriptor() const;

protected:
    typedef INTERFACE           BaseInterface;
    virtual IBinder*            onAsBinder();
};

frameworks/native/libs/binder/include/binder/Binder.h
class BBinder : public IBinder
{
public:
                        BBinder();

    virtual const String16& getInterfaceDescriptor() const;
    virtual bool        isBinderAlive() const;
    virtual status_t    pingBinder();
...
};
frameworks/native/libs/binder/include/binder/IBinder.h
class [[clang::lto_visibility_public]] IBinder : public virtual RefBase
{
public:
    enum {
        FIRST_CALL_TRANSACTION = 0x00000001,
        LAST_CALL_TRANSACTION = 0x00ffffff,
...
};
-------------------------------------------------------------------
class BpInterface : public INTERFACE, public BpRefBase
{
public:
    explicit                    BpInterface(const sp<IBinder>& remote);

protected:
    typedef INTERFACE           BaseInterface;
    virtual IBinder*            onAsBinder();
};

frameworks/native/libs/binder/include/binder/Binder.h
class BpRefBase : public virtual RefBase
{
protected:
    explicit                BpRefBase(const sp<IBinder>& o);
    virtual                 ~BpRefBase();
    virtual void            onFirstRef();
    virtual void            onLastStrongRef(const void* id);
    virtual bool            onIncStrongAttempted(uint32_t flags, const void* id);

    inline IBinder* remote() const { return mRemote; }//返回的是BpBinder
    inline sp<IBinder> remoteStrong() const { return sp<IBinder>::fromExisting(mRemote); ...

 三：进程间传递数据的载体 - Parcel

Parcel代码位于如下目录，Parcel用于传递进程间的数据。不管是Client发送数据给Server，还是Server发送数据给Client，都是通过Parcel进行传递。

frameworks/native/include/binder/Parcel.h

frameworks/native/include/binder/Parcel.cpp

write相关接口:

    status_t            write(const void* data, size_t len);
    status_t            writeInt32(int32_t val);
    status_t            writeUint32(uint32_t val);
    status_t            writeInt64(int64_t val);
    status_t            writeUint64(uint64_t val);
    status_t            writeFloat(float val);
    status_t            writeDouble(double val);
    status_t            writeStrongBinder(const sp<IBinder>& val);
    status_t            writeInt32Array(size_t len, const int32_t *val);
    status_t            writeByteArray(size_t len, const uint8_t *val);
    status_t            writeBool(bool val);
    status_t            writeChar(char16_t val);
    status_t            writeByte(int8_t val);
......

 read相关接口:

    status_t            read(void* outData, size_t len) const;
    const void*         readInplace(size_t len) const;
    int32_t             readInt32() const;
    status_t            readInt32(int32_t *pArg) const;
    uint32_t            readUint32() const;
    status_t            readUint32(uint32_t *pArg) const;
    int64_t             readInt64() const;
    status_t            readInt64(int64_t *pArg) const;
    uint64_t            readUint64() const;
    status_t            readUint64(uint64_t *pArg) const;
    float               readFloat() const;
    status_t            readFloat(float *pArg) const;
    double              readDouble() const;
    status_t            readDouble(double *pArg) const;
    bool                readBool() const;
    status_t            readBool(bool *pArg) const;
    char16_t            readChar() const;
    status_t            readChar(char16_t *pArg) const;
    int8_t              readByte() const;
    status_t            readByte(int8_t *pArg) const;
......

举个例子，在native service中是如何通过Parcel传递数据的，如下所示，都是通过Parcel进行传递。

class BpCustomizeManagerService : public BpInterface<ICustomizeManagerService>
{
public:
    explicit BpCustomizeManagerService (const sp<IBinder>& impl)
      : BpInterface <ICustomizeManagerService>(impl)
    {
        ALOGD("create Service \n");
    }

    int customeize(int size){
        Parcel data, reply;
        data.writeInterfaceToken(ICustomizeManagerService::getInterfaceDescriptor());
        data.writeInt32(size);
        remote()->transact(CUSTOMIZE, data, &reply);
        return reply.readInt32();
    }
};

status_t BnCustomizeManagerService ::onTransact(uint32_t code, const Parcel &data, Parcel *reply, uint32_t flags){
    switch (code)
    {
        case CUSTOMIZE:
        {
            CHECK_INTERFACE(ICustomizeManagerService, data, reply);
            int size = data.readInt32();
            int ret = customeize(size);
            //函数返回值从Server传递给Client
            reply->writeInt32();
            return NO_ERROR;
        }
...
};