Android开发之漫漫长途 Ⅷ——Android Binder（也许是最容易理解的） (5)

跟进[android_os_Parcel.cpp]

static void android_os_Parcel_writeStrongBinder(JNIEnv* env, jclass clazz, jlong nativePtr, jobject object) { Parcel* parcel = reinterpret_cast<Parcel*>(nativePtr); if (parcel != NULL) { //native层的parcel const status_t err = parcel->writeStrongBinder(ibinderForJavaObject(env, object)); if (err != NO_ERROR) { signalExceptionForError(env, clazz, err); } } } sp<IBinder> ibinderForJavaObject(JNIEnv* env, jobject obj) { if (obj == NULL) return NULL; //obj为Binder类 if (env->IsInstanceOf(obj, gBinderOffsets.mClass)) { JavaBBinderHolder* jbh = (JavaBBinderHolder*) env->GetLongField(obj, gBinderOffsets.mObject); //调用了JavaBBinderHolder的get方法 return jbh != NULL ? jbh->get(env, obj) : NULL; } //obj为BinderProxy类 if (env->IsInstanceOf(obj, gBinderProxyOffsets.mClass)) { return (IBinder*) env->GetLongField(obj, gBinderProxyOffsets.mObject); } ALOGW("ibinderForJavaObject: %p is not a Binder object", obj); return NULL; }

跟进[Pacel.cpp]

status_t Parcel::writeStrongBinder(const sp<IBinder>& val) { return flatten_binder(ProcessState::self(), val, this); } status_t flatten_binder(const sp<ProcessState>& /*proc*/, const sp<IBinder>& binder, Parcel* out) { flat_binder_object obj; obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS; if (binder != NULL) {//binder不为空 IBinder *local = binder->localBinder();//是不是本地binder，本地的意思是同一个进程中的调用 if (!local) { BpBinder *proxy = binder->remoteBinder(); if (proxy == NULL) { ALOGE("null proxy"); } const int32_t handle = proxy ? proxy->handle() : 0; obj.type = BINDER_TYPE_HANDLE; obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */ obj.handle = handle; obj.cookie = 0; } else {//我们这里明显不是 obj.type = BINDER_TYPE_BINDER; obj.binder = reinterpret_cast<uintptr_t>(local->getWeakRefs()); obj.cookie = reinterpret_cast<uintptr_t>(local); } } else {//错误信息 obj.type = BINDER_TYPE_BINDER; obj.binder = 0; obj.cookie = 0; } return finish_flatten_binder(binder, obj, out); }

通过上面的代码，我们可以看到当一个服务进行注册时，会将Java层的Binder对象和Native层的BBinder关联起来，于是服务端绑定到了Native层的Binder架构。
此外，addService中打包传入的其实不是ActivityManagerService本身，而是对应的JavaBBinder对象。
这里对应的结构如下图所示：

AMS代理是如何获得的？

我们上面SystemServer中的AMS已经在SM中准备好了，那我们ServiceManager.getService(Context.ACTIVITY_SERVICE);
一样的过程，我们知道最终会在service_manager.c中处理

switch(txn->code) { //这里有个case穿透，，好吧 case SVC_MGR_GET_SERVICE: case SVC_MGR_CHECK_SERVICE: s = bio_get_string16(msg, &len); if (s == NULL) { return -1; } //查询AMS保存在SM中对应的的那个handle handle = do_find_service(bs, s, len, txn->sender_euid, txn->sender_pid); if (!handle) break; bio_put_ref(reply, handle); return 0; } 把写入数据后的reply返回 bio_put_uint32(reply, 0);

回到我们的调用处
[ServiceManagerNative.java]

public IBinder getService(String name) throws RemoteException { Parcel data = Parcel.obtain(); Parcel reply = Parcel.obtain(); data.writeInterfaceToken(IServiceManager.descriptor); data.writeString(name); mRemote.transact(GET_SERVICE_TRANSACTION, data, reply, 0); //看这里readStrongBinder，是不是感觉跟我们上面的writeStrongBinder感觉是一对的 IBinder binder = reply.readStrongBinder(); reply.recycle(); data.recycle(); return binder; }

Parcel的readStrongBinder还是个JNI调用

[android_ os_Parcel.cpp]

static jobject android_os_Parcel_readStrongBinder(JNIEnv* env, jclass clazz, jlong nativePtr) { Parcel* parcel = reinterpret_cast<Parcel*>(nativePtr); if (parcel != NULL) { //这里我们看到了什么，，看函数名字应该是为Binder生成一个java对象吧 return javaObjectForIBinder(env, parcel->readStrongBinder()); } return NULL; }

我们先看Pacel的readStrongBinder方法
[Parcel.cpp]

sp<IBinder> Parcel::readStrongBinder() const { sp<IBinder> val; //看到这里，还记得writeStrongBinder中的flatten_binder，这里是unflatten_binder unflatten_binder(ProcessState::self(), *this, &val); return val; } status_t unflatten_binder(const sp<ProcessState>& proc, const Parcel& in, sp<IBinder>* out) { const flat_binder_object* flat = in.readObject(false); if (flat) { switch (flat->type) { case BINDER_TYPE_BINDER: *out = reinterpret_cast<IBinder*>(flat->cookie); return finish_unflatten_binder(NULL, *flat, in); case BINDER_TYPE_HANDLE: //到这里我们也清楚了进入这个分支 //调用ProcessState的getStrongProxyForHandle函数 *out = proc->getStrongProxyForHandle(flat->handle); return finish_unflatten_binder( static_cast<BpBinder*>(out->get()), *flat, in); } } return BAD_TYPE; }