Binder学习—— C++实现分析

一、测试Demo的实现

1.Binder C++实现参考文件

frameworks/av/include/media/IMediaPlayerService.h
frameworks/av/media/libmedia/IMediaPlayerService.cpp
frameworks/av/media/libmediaplayerservice/MediaPlayerService.h
frameworks/av/media/libmediaplayerservice/MediaPlayerService.cpp
frameworks/av/media/mediaserver/Main_mediaserver.cpp

2.实现代码

实现Service端和Client端，test_server.cpp中注册两个服务"hello"和"goodbye"，test_client.cpp来获取使用服务。

定义抽象类，包含Service和Client两端都要实现的函数：
IHelloService.h
IGoodbyeService.h

Service端的实现(Bn: Binder native)：
BnHelloService.h
BnGoodbyeService.h
BnHelloService.cpp
BnGoodbyeService.cpp

Client端的实现(Bp: Binder proxy)：
BpHelloService.cpp
BpGoodbyeService.cpp

# tree
.
├── Android.mk
├── BnGoodbyeService.cpp
├── BnGoodbyeService.h
├── BnHelloService.cpp
├── BnHelloService.h
├── BpGoodbyeService.cpp
├── BpHelloService.cpp
├── IGoodbyeService.h
├── IHelloService.h
├── test_client.cpp
└── test_server.cpp

IHelloService.h

/* 参考: frameworksavincludemediaIMediaPlayerService.h */

#ifndef ANDROID_IHELLOERVICE_H
#define ANDROID_IHELLOERVICE_H

#include <utils/Errors.h>  // for status_t
#include <utils/KeyedVector.h>
#include <utils/RefBase.h>
#include <utils/String8.h>
#include <binder/IInterface.h>
#include <binder/Parcel.h>

#define HELLO_SVR_CMD_SAYHELLO     0
#define HELLO_SVR_CMD_SAYHELLO_TO  1

#if 1
/*-----DECLARE_META_INTERFACE(HelloService);等效如下:-----*/

static const android::String16 descriptor;
static android::sp<IHelloService> asInterface(const android::sp<android::IBinder>& obj);
virtual const android::String16& getInterfaceDescriptor() const;
IHelloService();
virtual ~IHelloService();
/*--------------------------------------------------------*/

#endif


namespace android {

class IHelloService: public IInterface
{
public:
    DECLARE_META_INTERFACE(HelloService);
    /*使用纯虚函数做成抽象类*/
    virtual void sayhello(void) = 0;
    virtual int sayhello_to(const char *name) = 0;
};

}

#endif

IGoodbyeService.h

/* 参考: frameworksavincludemediaIMediaPlayerService.h */

#ifndef ANDROID_IGOODBYEERVICE_H
#define ANDROID_IGOODBYEERVICE_H

#include <utils/Errors.h>  // for status_t
#include <utils/KeyedVector.h>
#include <utils/RefBase.h>
#include <utils/String8.h>
#include <binder/IInterface.h>
#include <binder/Parcel.h>

#define GOODBYE_SVR_CMD_SAYGOODBYE     0
#define GOODBYE_SVR_CMD_SAYGOODBYE_TO  1


namespace android {

class IGoodbyeService: public IInterface
{
public:
    DECLARE_META_INTERFACE(GoodbyeService);
    virtual void saygoodbye(void) = 0;
    virtual int saygoodbye_to(const char *name) = 0;
};

}

#endif

BnHelloService.h

#ifndef ANDROID_BNHELLOERVICE_H
#define ANDROID_BNHELLOERVICE_H

#include "IHelloService.h"

namespace android {

class BnHelloService: public BnInterface<IHelloService>
{
public:
    /*自己又添加了一个函数*/
    virtual status_t onTransact( uint32_t code,
                                    const Parcel& data,
                                    Parcel* reply,
                                    uint32_t flags = 0);

    /*继承来的纯虚函数需要实现*/
    virtual void sayhello(void);
    virtual int sayhello_to(const char *name);

};

}

#endif

BnGoodbyeService.h

#ifndef ANDROID_BNGOODBYEERVICE_H
#define ANDROID_BNGOODBYEERVICE_H

#include "IGoodbyeService.h"

namespace android {

class BnGoodbyeService: public BnInterface<IGoodbyeService>
{
public:
    virtual status_t    onTransact( uint32_t code,
                                    const Parcel& data,
                                    Parcel* reply,
                                    uint32_t flags = 0);

    virtual void saygoodbye(void);
    virtual int saygoodbye_to(const char *name);

};


}

#endif

BnHelloService.cpp

/* 参考: frameworksavmedialibmediaIMediaPlayerService.cpp */

#define LOG_TAG "HelloService"

#include "BnHelloService.h"


namespace android {

status_t BnHelloService::onTransact(uint32_t code, const Parcel& data,
                                Parcel* reply, uint32_t flags)
{
    /* 解析数据,调用sayhello/sayhello_to */

    switch (code) {
        case HELLO_SVR_CMD_SAYHELLO: {
            sayhello();
            return NO_ERROR;
        } break;
        
        case HELLO_SVR_CMD_SAYHELLO_TO: {

            /* 从data中取出参数 */
            int32_t policy =  data.readInt32();
            String16 name16 = data.readString16();
            String8 name8(name16);

            int cnt = sayhello_to(name8.string());

            /* 把返回值写入reply传回去 */
            reply->writeInt32(cnt);
            
            return NO_ERROR;
        } break;
        default:
            return BBinder::onTransact(code, data, reply, flags);
    }
}

void BnHelloService::sayhello(void)
{
    static int cnt = 0;
    ALOGI("say hello : %d
", cnt++);

}

int BnHelloService::sayhello_to(const char *name)
{
    static int cnt = 0;
    ALOGI("say hello to %s : %d
", name, cnt++);
    return cnt;
}

}

BnGoodbyeService.cpp

/* 参考: frameworksavmedialibmediaIMediaPlayerService.cpp */

#define LOG_TAG "GoodbyeService"

#include "BnGoodbyeService.h"


namespace android {

status_t BnGoodbyeService::onTransact( uint32_t code,
                                const Parcel& data,
                                Parcel* reply,
                                uint32_t flags)
{
    /* 解析数据,调用saygoodbye/saygoodbye_to */

    switch (code) {
        case GOODBYE_SVR_CMD_SAYGOODBYE: {
            saygoodbye();
            return NO_ERROR;
        } break;
        
        case GOODBYE_SVR_CMD_SAYGOODBYE_TO: {

            /* 从data中取出参数 */
            int32_t policy =  data.readInt32();
            String16 name16 = data.readString16();
            String8 name8(name16);

            int cnt = saygoodbye_to(name8.string());

            /* 把返回值写入reply传回去 */
            reply->writeInt32(cnt);
            
            return NO_ERROR;
        } break;
        default:
            return BBinder::onTransact(code, data, reply, flags);
    }
}

void BnGoodbyeService::saygoodbye(void)
{
    static int cnt = 0;
    ALOGI("say goodbye : %d
", cnt++);

}

int BnGoodbyeService::saygoodbye_to(const char *name)
{
    static int cnt = 0;
    ALOGI("say goodbye to %s : %d
", name, cnt++);
    return cnt;
}

}

BpHelloService.cpp

/* 参考: frameworksavmedialibmediaIMediaPlayerService.cpp */

#include "IHelloService.h"

namespace android {

class BpHelloService: public BpInterface<IHelloService>
{
public:
    BpHelloService(const sp<IBinder>& impl) : BpInterface<IHelloService>(impl)
    {
    }

    void sayhello(void)
    {
        /* 构造/发送数据 */
        Parcel data, reply;

        /*为了兼容之前的C程序才写入这个垃圾数据的*/
        data.writeInt32(0);

        /*调用远端的hello函数*/
        remote()->transact(HELLO_SVR_CMD_SAYHELLO, data, &reply); /*remote() ?*/
    }
    
    int sayhello_to(const char *name)
    {
        /* 构造/发送数据 */
        Parcel data, reply;

        /*为了兼容之前的C程序才写入这个垃圾数据(0)的*/
        data.writeInt32(0);
        data.writeString16(String16(name));

        remote()->transact(HELLO_SVR_CMD_SAYHELLO_TO, data, &reply);

        /*传送回返回值*/
        return reply.readInt32();
    }

};

IMPLEMENT_META_INTERFACE(HelloService, "android.media.IHelloService");

}

#if 1
/*------IMPLEMENT_META_INTERFACE(HelloService, "android.media.IHelloService"); 等效如下:-------*/


const android::String16 IHelloService::descriptor("android.media.IHelloService");
const android::String16& IHelloService::getInterfaceDescriptor() const {
    return IHelloService::descriptor;
}
android::sp<IHelloService> IHelloService::asInterface(
        const android::sp<android::IBinder>& obj)
{
    android::sp<IHelloService> intr;
    if (obj != NULL) {
        intr = static_cast<IHelloService*>(
            obj->queryLocalInterface(IHelloService::descriptor).
            get());
        if (intr == NULL) {
            intr = new BpHelloService(obj);
        }
    }
    return intr;
}
IHelloService::IHelloService() { }
IHelloService::~IHelloService() { }
#endif

BpGoodbyeService.cpp

/* 参考: frameworksavmedialibmediaIMediaPlayerService.cpp */

#include "IGoodbyeService.h"

namespace android {

class BpGoodbyeService: public BpInterface<IGoodbyeService>
{
public:
    BpGoodbyeService(const sp<IBinder>& impl)
        : BpInterface<IGoodbyeService>(impl)
    {
    }

    void saygoodbye(void)
    {
        /* 构造/发送数据 */

        Parcel data, reply;
        data.writeInt32(0);

        remote()->transact(GOODBYE_SVR_CMD_SAYGOODBYE, data, &reply);
    }
    
    int saygoodbye_to(const char *name)
    {
        /* 构造/发送数据 */
        Parcel data, reply;

        data.writeInt32(0);
        data.writeString16(String16(name));

        remote()->transact(GOODBYE_SVR_CMD_SAYGOODBYE_TO, data, &reply);

        return reply.readInt32();
    }

};

IMPLEMENT_META_INTERFACE(GoodbyeService, "android.media.IGoodbyeService");

}

参考：http://github.com/weidongshan/APP_0004_Binder_CPP_App.git

3.编译测试

将代码放在frameworks/testing/biner_cpp_v1下，然后mm编译。

二、分析

1.Service的注册过程处理过程分析(test_server.cpp)

(1)获取SM分析

defaultServiceManager    //IServiceManager.cpp
    gDefaultServiceManager = interface_cast<IServiceManager>(ProcessState::self()->getContextObject(NULL));
        obj = ProcessState::self()->getContextObject(NULL)
            getStrongProxyForHandle(0); //ProcessState.cpp 直接指定的是handle=0了，是SM
                return new BpBinder(0); //BpBinder.cpp SM就表示为一个handle=0的BpBinder对象。obj=此BpBinder对象
        IServiceManager::asInterface(obj); //obj=此BpBinder对象
            return new BpServiceManager(obj); //IServiceManager.cpp BpServiceManager充当SM的角色。

(2)addService()分析

sm->addService(String16("hello"), new BnHelloService()); //test_server.cpp
    virtual status_t addService(const String16& name, const sp<IBinder>& service, bool allowIsolated); //IServiceManager.cpp
    //allowIsolated声明的时候声明为: bool allowIsolated=false，使用的是默认参数
    data.writeStrongBinder(service); //service=BnHelloService
        flatten_binder(ProcessState::self(), val, this); //Parcel.cpp val=service=BnHelloService
            IBinder *local = binder->localBinder(); //binder=val,根据继承关系，localBinder直接return this, local也就是BnHelloService对象。
            flat_binder_object obj;
            obj.type = BINDER_TYPE_BINDER; //add service的时候的type
            obj.binder = reinterpret_cast<uintptr_t>(local->getWeakRefs());
            obj.cookie = reinterpret_cast<uintptr_t>(local); // BnHelloService对象赋值给flat_binder_object的cookie域
            finish_flatten_binder //Parcel.cpp 应该是写到驱动
                out->writeObject(flat, false); 

(3)创建一个子线程循环read-parse-process

ProcessState::self()->startThreadPool(); //test_server.cpp 它会以一个线程的状态存在，可以通过/proc/$(PID)/task来验证。
    spawnPooledThread(true); //ProcessState.cpp isMain=true
        sp<Thread> t = new PoolThread(isMain);
        t->run(name.string()); //相当于执行PoolThread中的threadLoop
             IPCThreadState::self()->joinThreadPool(true);
                mOut.writeInt32(isMain ? BC_ENTER_LOOPER : BC_REGISTER_LOOPER); //IPCThreadState.cpp
                //若是isMain=true表示注册是主线程，为false表示新创建的子线程
                    //循环读取数据，解析数据，执行，答复
                    getAndExecuteCommand
                        executeCommand(cmd) //IPCThreadState.cpp
                            case BR_TRANSACTION:
                                sp<BBinder> b((BBinder*)tr.cookie); //cookie就是BnHelloService对象
                                b->transact(tr.code, buffer, &reply, tr.flags); //这里调用的就是BnHelloService.transact()
                            case BR_SPAWN_LOOPER:
                                mProcess->spawnPooledThread(false); //Service创建多线程   

IPCThreadState::self()->joinThreadPool(); //test_server.cpp 也是进入解析数据，执行，答复的循环     

补充：

① ProcessState::self()：获取ProcessState的单例模式，每个进程有一个唯一的实例

② IPCThreadState::self()：获取IPCThreadState的单例模式，每个线程都有一个唯一的实例，实现如下: ###################

处理涉及线程特有数据(Thread Specific Data)
这里，每个线程都有一个IPCThreadState对象，也就是说这个对象是每个线程特有的东西，各不相同，因此它应该存在这个线程的局部空间里。
K = pthread_key_create()
(K, V) 同一个K对于不同的线程可以设置不同的Value
每个线程设置不同的Value
线程1：pthread_setspecific(K, V1);
线程2：pthread_setspecific(K, V2); // V1和V2都存在于线程的局部空间里

线程1：pthread_getspecific(K); 得到V1
线程2：pthread_getspecific(K); 得到V2

这里不同的线程使用的是同一个键，但是不同的值，通过判断值是否为NULL来判断是否每个线程已经分配过了。

2.Client获取服务过程和使用服务分析(test_client.cpp)

(1)打开binder设备节点和获取SM

sp<ProcessState> proc(ProcessState::self()); //test_client.cpp 构造函数中打开binder设备并进行mmap了
sp<IServiceManager> sm = defaultServiceManager(); //test_client.cpp 获得BpServiceManager 在IServiceManager.cpp中定义的

(2)获取BpBinder对象的过程

sp<IBinder> binder = sm->getService(String16("hello")); //test_client.cpp 
//binder是BpBinder对象，里面含有HelloService的handle
    sp<IBinder> svc = checkService(name);
        remote()->transact(CHECK_SERVICE_TRANSACTION, data, &reply); //remote()?????
        return reply.readStrongBinder();
            unflatten_binder //Parcel.cpp 
                *out = proc->getStrongProxyForHandle(flat->handle); 
                //获取到一个flat_binder_object结构，里面有Service的handle,通过flat->handle获取一个sp<IBinder>对象。

(3)获得BpHelloService对象的过程

调用BpServiceManager的getService函数获得一个flat_binder_object，从中取出handle, 创建一个BpBinder(handle),
然后使用interface_cast使用这个BpBinder创建一个BpHelloService对象

sp<IHelloService> service = interface_cast<IHelloService>(binder);
//binder是BpBinder对象, 里面含有HelloService的handle，把binder转换为IHelloService接口(BpHelloService对象)

之后就可以通过service来访问这个服务里面提供的函数了。

补充：

IMPLEMENT_META_INTERFACE(ServiceManager, "android.os.IServiceManager");展开后：
android::sp<IServiceManager> IServiceManager::asInterface(const android::sp<android::IBinder>& obj)      
{                                                      
    android::sp<IServiceManager> intr;                    
    if (obj != NULL) { /*这个是Client端获取执行*/                              
        intr = static_cast<IServiceManager*>(obj->queryLocalInterface(IServiceManager::descriptor).get());  
        if (intr == NULL) {  /*这个是Service端注册执行*/                         
            intr = new BpServiceManager(obj);             
        }                                              
    }                                                  
    return intr;                                       
}