《深入理解Android卷 I》- 第六章 - Binder - 读书笔记

Binder概要

Binser简述

Binder协议包含在IPC数据中，分为两类:

BINDER_COMMAND_PROTOCOL：binder请求码，以”BC_“开头，简称BC码，用于从IPC层传递到Binder Driver层；
BINDER_RETURN_PROTOCOL ：binder响应码，以”BR_“开头，简称BR码，用于从Binder Driver层传递到IPC层；

请求码	参数	说明
BC_TRANSACTION	binder_transaction_data	Client向Binder驱动发送请求数据
BC_REPLY	binder_transaction_data	Server向Binder驱动发送请求数据

省略部分

响应码	参数类型	作用
BR_ERROR	__s32	操作发生错误
BR_OK	无参数	操作完成
BR_NOOP	无参数	不做任何事
BR_SPAWN_LOOPER	无参数	创建新的Looper线程
BR_TRANSACTION	binder_transaction_data	Binder驱动向Server端发送请求数据
BR_REPLY	binder_transaction_data	Binder驱动向Client端发送回复数据

通信模型

通信模型

Binder是Android系统提供的一种IPC（进程间通信）机制。由于Android是基于Linux内核的，因此，除了Binder外，还存在其他的IPC机制，例如管道和socket等。Binder相对于其他IPC机制来说，就更加灵活和方便了。

在基于Binder通信的C/S架构体系中，除了C/S架构所包括的Client端和Server端外，Android还有一个全局的ServiceManager端，它的作用是管理系统中的各种服务（Service）。Client、Server和ServiceManager这三者之间的交互关系

模型.png

Server进程要先注册一些Server到ServiceManager中，所以Server是ServiceManger的客户端，而ServiceManager就是服务端了

Client进程要使用某个Server就先需要到ServiceManager中获取该Server的信息，所以Client是ServiceManger的客户端

Client更具获得的Server信息建立与Server所在的Server进程通信通道，然后直接与Server交互了，所以Client是Server的客户端

1 详解MediaServer

在MediaServer中存在许多重要的Service,包括

AudioFlinger: 音频系统中重要核心服务
AudioPolicyService:音频系统中关于音频策略的重要服务
MediaPlayerService:多媒体系统中重要服务
CameraService:有关摄像/照相的重要服务

1.1 MediaServer的入口函数

frameworks/av/media/mediaserver/Main_mediaserver.cpp

int main(int argc __unused, char **argv __unused)
{
    signal(SIGPIPE, SIG_IGN);
    //获得一个强引用的ProcessState实例 [#1.1.1]
    sp<ProcessState> proc(ProcessState::self());
    //调用defaultServiceManager，得到一个IServiceManager [#1.1.2]
    sp<IServiceManager> sm(defaultServiceManager());
    
    InitializeIcuOrDie();
    //MediaPlayer服务 [#1.2]
    MediaPlayerService::instantiate();
    ResourceManagerService::instantiate();
    registerExtensions();
    //[#1.3.1]
    ProcessState::self()->startThreadPool();
    //[#1.3.2]
    IPCThreadState::self()->joinThreadPool();
}

1.1.1 ProcessState

每个进程只有一个ProcessState.通过调用ProcessState::self()获得实例

frameworks/native/libs/binder/ProcessState.cpp

sp<ProcessState> ProcessState::self()
{
    Mutex::Autolock _l(gProcessMutex);
    //gProcess是在Static.cpp中定义的一个全局变量
    if (gProcess != NULL) {
        return gProcess;
    }
    //创建对象
    gProcess = new ProcessState; // [#1.1.1.1]
    return gProcess;
}

1.1.1.1 构造函数

frameworks/native/libs/binder/ProcessState.cpp

ProcessState::ProcessState()
    //打开binder 
    : mDriverFD(open_driver()) //[#1.1.1.2]
      //映射内存的起始地址
    , mVMStart(MAP_FAILED)
    , mThreadCountLock(PTHREAD_MUTEX_INITIALIZER)
    , mThreadCountDecrement(PTHREAD_COND_INITIALIZER)
    , mExecutingThreadsCount(0)
    , mMaxThreads(DEFAULT_MAX_BINDER_THREADS)
    , mStarvationStartTimeMs(0)
    , mManagesContexts(false)
    , mBinderContextCheckFunc(NULL)
    , mBinderContextUserData(NULL)
    , mThreadPoolStarted(false)
    , mThreadPoolSeq(1)
{
    if (mDriverFD >= 0) {
        // mmap the binder, providing a chunk of virtual address space to receive transactions.
      //分配虚拟地址空间，完成数据wirte/red，内存的memcpy等操作就相当于write/read(mDriverFD)
        mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
        if (mVMStart == MAP_FAILED) {
            // *sigh*
            close(mDriverFD);
            mDriverFD = -1;
        }
    }
}

1.1.1.2 open_driver()

open_driver的作用就是打开/dev/binder这个设备，它是android在内核中专门用于完成进程间通信而设置的一个虚拟设备.

frameworks/native/libs/binder/ProcessState.cpp

static int open_driver()
{
    int fd = open("/dev/binder", O_RDWR | O_CLOEXEC); //打开 /dev/binder
    if (fd >= 0) {
        int vers = 0;
        //通过ioctl通知binder驱动binder版本
        status_t result = ioctl(fd, BINDER_VERSION, &vers);
        if (result == -1) {
            ALOGE("Binder ioctl to obtain version failed: %s", strerror(errno));
            close(fd);
            fd = -1;
        }
        if (result != 0 || vers != BINDER_CURRENT_PROTOCOL_VERSION) {
            ALOGE("Binder driver protocol does not match user space protocol!");
            close(fd);
            fd = -1;
        }
      //设置当前fd最多支持DEFAULT_MAX_BINDER_THREADS线程数量
        size_t maxThreads = DEFAULT_MAX_BINDER_THREADS;
        result = ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads);
        if (result == -1) {
            ALOGE("Binder ioctl to set max threads failed: %s", strerror(errno));
        }
    } else {
        ALOGW("Opening '/dev/binder' failed: %s\n", strerror(errno));
    }
    return fd;
}

1.1.1.3 总结

打开/dev/binder设备，这就相当于与内核的Binder驱动有了交互的通道。
对返回的fd使用mmap，这样Binder驱动就会分配一块内存来接收数据。
由于ProcessState的唯一性，因此一个进程只打开设备一次。

1.1.2 defaultServiceManager()

frameworks/native/libs/binder/IServiceManager.cpp

sp<IServiceManager> defaultServiceManager()
{   //单例
    if (gDefaultServiceManager != NULL) return gDefaultServiceManager;

    {
        AutoMutex _l(gDefaultServiceManagerLock);
        while (gDefaultServiceManager == NULL) {
            //创建对象 ps:c/c++中 NULL == 0
            gDefaultServiceManager = interface_cast<IServiceManager>(
                ProcessState::self()->getContextObject(NULL)); //[#1.1.2.1]
            //[#1.1.2.4] interface_cast<IServiceManager>
            if (gDefaultServiceManager == NULL) 
                sleep(1);
        }
    }

    return gDefaultServiceManager;
}

IServiceManager对象时通过ProcessState获得的。

1.1.2.1 getContextObject()

sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& /*caller*/)
{   
    return getStrongProxyForHandle(0);
}

1.1.2.2 getStrongProxyForHandle()

getStrongProxyForHandle这个函数调用参数的名字叫handle,handle的值正是该资源项在集合中的索引.

sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)
{
    sp<IBinder> result;
    AutoMutex _l(mLock);
  
    //根据索引查找对应资源。如果lookupHandleLocked发现没有对应的资源项，则会创建一个新的项并返回。
    handle_entry* e = lookupHandleLocked(handle);

    if (e != NULL) {
        // We need to create a new BpBinder if there isn't currently one, OR we
        // are unable to acquire a weak reference on this current one.  See comment
        // in getWeakProxyForHandle() for more info about this.
        IBinder* b = e->binder;
        if (b == NULL || !e->refs->attemptIncWeak(this)) {
            if (handle == 0) {
                // Special case for context manager...
                // The context manager is the only object for which we create
                // a BpBinder proxy without already holding a reference.
                // Perform a dummy transaction to ensure the context manager
                // is registered before we create the first local reference
                // to it (which will occur when creating the BpBinder).
                // If a local reference is created for the BpBinder when the
                // context manager is not present, the driver will fail to
                // provide a reference to the context manager, but the
                // driver API does not return status.
                //
                // Note that this is not race-free if the context manager
                // dies while this code runs.
                //
                // TODO: add a driver API to wait for context manager, or
                // stop special casing handle 0 for context manager and add
                // a driver API to get a handle to the context manager with
                // proper reference counting.
                
              //确保在获得servicemanager的时候它已经构造好了，或者还活着，否则返回NULL
              //大概应该是这个意思
                Parcel data;
                status_t status = IPCThreadState::self()->transact(
                        0, IBinder::PING_TRANSACTION, data, NULL, 0);
                if (status == DEAD_OBJECT)
                   return NULL;
            }

            b = new BpBinder(handle); //创建一个BpBinder
            e->binder = b;
            if (b) e->refs = b->getWeakRefs();
            result = b;
        } else {
            // This little bit of nastyness is to allow us to add a primary
            // reference to the remote proxy when this team doesn't have one
            // but another team is sending the handle to us.
            result.force_set(b);
            e->refs->decWeak(this);
        }
    }
    return result; //返回BpBinder
}

1.1.2.3 BpBinder

frameworks/native/libs/binder/BpBinder

BpBinder::BpBinder(int32_t handle)
    : mHandle(handle)
    , mAlive(1)
    , mObitsSent(0)
    , mObituaries(NULL)
{
    ALOGV("Creating BpBinder %p handle %d\n", this, mHandle);
    //见过，常见类那一章，设置生命周期的Flag
    extendObjectLifetime(OBJECT_LIFETIME_WEAK);
    //
    IPCThreadState::self()->incWeakHandle(handle);
}

1.1.2.4 interface_cast

在defaultServiceManager()函数中通过ProcessState的getContextObject()返回了一个BpBinder(0),最后通过interface_cast<IServiceManager>()转换成了一个IServiceManager,神奇，快打开源码。

frameworks/native/include/binder/IInterface.h

template<typename INTERFACE>
inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)
{
    return INTERFACE::asInterface(obj);
}

那么INTERFACE::asInterface(obj)就等于是sp<IServiceManager>interface_cast(obj)

1.1.3 IServiceManager

frameworks/native/include/binder/IServiceManager.h

class IServiceManager : public IInterface
{
public:
  //坑爹的宏
    DECLARE_META_INTERFACE(ServiceManager)
    /**
     * Retrieve an existing service, blocking for a few seconds
     * if it doesn't yet exist.
     */
    virtual sp<IBinder>         getService( const String16& name) const = 0;

    /**
     * Retrieve an existing service, non-blocking.
     */
    virtual sp<IBinder>         checkService( const String16& name) const = 0;

    /**
     * Register a service.
     */
    virtual status_t            addService( const String16& name,
                                            const sp<IBinder>& service,
                                            bool allowIsolated = false) = 0;

    /**
     * Return list of all existing services.
     */
    virtual Vector<String16>    listServices() = 0;

    enum {
        GET_SERVICE_TRANSACTION = IBinder::FIRST_CALL_TRANSACTION,
        CHECK_SERVICE_TRANSACTION,
        ADD_SERVICE_TRANSACTION,
        LIST_SERVICES_TRANSACTION,
    };
};

是不是找不到asInterface(),坑爹，往下看。

1.1.3.1 DECLARE_META_INTERFACE

Android巧妙地通过DECLARE_META_INTERFACE和IMPLEMENT_META_INTERFACE宏，将业务和通信牢牢地钩在了一起。DECLARE_META_INTERFACE和IMPLEMENT_META_INTERFACE这两个宏都定义在刚才的IInterface.h

frameworks/native/include/binder/IInterface.h

#define DECLARE_META_INTERFACE(INTERFACE)                               \
    static const android::String16 descriptor;                          \
    static android::sp<I##INTERFACE> asInterface(                       \
            const android::sp<android::IBinder>& obj);                  \
    virtual const android::String16& getInterfaceDescriptor() const;    \
    I##INTERFACE();                                                     \
    virtual ~I##INTERFACE();                                            \

进行宏替换

static const android::String16 descriptor;  
static android::sp<IServiceManager>
asInterface(constandroid::sp<android::IBinder>& obj)
virtual const android::String16&getInterfaceDescriptor() const;
IServiceManager ();
virtual ~IServiceManager();

DECLARE_META_INTERFACE是进行函数声明。实现就是IMPLEMENT_META_INTERFACE这个宏

1.1.3.2 IMPLEMENT_META_INTERFACE

#define IMPLEMENT_META_INTERFACE(INTERFACE, NAME)                       \
    const android::String16 I##INTERFACE::descriptor(NAME);             \
    const android::String16&                                            \
            I##INTERFACE::getInterfaceDescriptor() const {              \
        return I##INTERFACE::descriptor;                                \
    }                                                                   \
    android::sp<I##INTERFACE> I##INTERFACE::asInterface(                \
            const android::sp<android::IBinder>& obj)                   \
    {                                                                   \
        android::sp<I##INTERFACE> intr;                                 \
        if (obj != NULL) {                                              \
            intr = static_cast<I##INTERFACE*>(                          \
                obj->queryLocalInterface(                               \
                        I##INTERFACE::descriptor).get());               \
            if (intr == NULL) {                                         \
                intr = new Bp##INTERFACE(obj);                          \
            }                                                           \
        }                                                               \
        return intr;                                                    \
    }                                                                   \
    I##INTERFACE::I##INTERFACE() { }                                    \
    I##INTERFACE::~I##INTERFACE() { }                                   \

进行宏替换

const android::String16 IServiceManager::descriptor(NAME);
const android::String16&
            IServiceManager::getInterfaceDescriptor() const {
        return IServiceManager::descriptor;
    }   
android::sp<IServiceManager> IServiceManager::asInterface(
            const android::sp<android::IBinder>& obj){
        android::sp<IServiceManager> intr;
        if (obj != NULL) {
            intr = static_cast<IServiceManager>(
                obj->queryLocalInterface(
                        IServiceManager::descriptor).get());
            if (intr == NULL) {
                intr = new BpServiceManager(obj);
            }
        }
        return intr;
    }   
IServiceManager::IServiceManager () { }
IServiceManager::~IServiceManager() { }

这下终于找到了。这个模板代码写的，厉害。

interface_cast不是指针的转换，而是利用BpBinder对象作为参数新建了一个BpServiceManager对象。又搞出一个新对象，BpBinder,IServiceManager还没搞定完

1.1.3.3 IServiceManager家族

IServiceManager.png

IServiceManager、BpServiceManager和BnServiceManager都与业务逻辑相关
BnServiceManager同时从BBinder派生，表示它可以直接参与Binder通信。
BpServiceManager虽然从BpInterface中派生，但是这条分支似乎与BpBinder没有关系。
BnServiceManager是一个虚类，它的业务函数最终需要子类来实现。

frameworks/native/libs/binder/IServiceManager.cpp

explicit BpServiceManager(const sp<IBinder>& impl)
    //基类构造
        : BpInterface<IServiceManager>(impl)
    {
    }

frameworks/native/include/binder/IInterface.h

template<typename INTERFACE>
inline BpInterface<INTERFACE>::BpInterface(const sp<IBinder>& remote)
    //
    : BpRefBase(remote)
{
}

frameworks/native/libs/binder/Binder.cpp

BpRefBase::BpRefBase(const sp<IBinder>& o)
  //mRemote = new BpBinder(0)
    : mRemote(o.get()), mRefs(NULL), mState(0)
{
    extendObjectLifetime(OBJECT_LIFETIME_WEAK);

    if (mRemote) {
        mRemote->incStrong(this);           // Removed on first IncStrong().
        mRefs = mRemote->createWeak(this);  // Held for our entire lifetime.
    }
}

1.1.4 总结

经过一系列的转换最终得到

一个BpBinder对象，handle值为0，也就是和它通信的服务端就是我们需要的ServiceManager

一个BpServiceManager对象，它的mRemote值为BpBinder

BpServiceManager对象实现了IServiceManager的业务函数，BpBinder作为通信。

1.2 注册MediaPlayerService

在MediaServer入口函数中，得到IServiceManager对象后，执行了MediaPlayerService::instantiate()来初始化MediaPlayerService

frameworks/av/media/libmediaplayerservice/MediaPlayService.cpp

void MediaPlayerService::instantiate() {
    defaultServiceManager()->addService(
            String16("media.player"), new MediaPlayerService());
}

defaultServiceManager()返回的是一个BpServiceManger,它是IServiceManager的子类

virtual status_t addService(const String16& name, const sp<IBinder>& service,
            bool allowIsolated)
    {
        //data 传输的数据； reply 回传数据
        Parcel data, reply;
        data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
        data.writeString16(name);
        data.writeStrongBinder(service);
        data.writeInt32(allowIsolated ? 1 : 0);
        //BpBinder::transact()
        status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);
        return err == NO_ERROR ? reply.readExceptionCode() : err;
    }

BpServiceManager的addService()是一个业务层函数，负责把数据打包到data中。

BpBinder的transcat()负责通信，把打包好的数据发送出去，并处理返回数据replay

1.2.1 通信工作

通过上面代码只知道，通信是通过BpBinder的transcat()完成的

status_t BpBinder::transact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    // Once a binder has died, it will never come back to life.
    if (mAlive) {
        //mHandle就是要通信的目标
        status_t status = IPCThreadState::self()->transact(
            mHandle, code, data, reply, flags);
        if (status == DEAD_OBJECT) mAlive = 0;
        return status;
    }

    return DEAD_OBJECT;
}

实际工作完成工作的是IPCThreadState::transact()