Last Order
0%

Android-binder-java层

发表于 更新于 分类于

java层分为系统服务的binder 和 bindService的 binder

系统服务

以ServiceManager.java 为例 :

ServiceManager

addService的过程

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
//ServiceManager::getIServiceManager()
private static IServiceManager getIServiceManager() {
    if (sServiceManager != null) {
        return sServiceManager;
    }

    // Find the service manager
    sServiceManager = ServiceManagerNative.asInterface(Binder.allowBlocking(BinderInternal.getContextObject()));
    return sServiceManager;
}

//ServiceManagerNative::asInterface
static public IServiceManager asInterface(IBinder obj)
{
    if (obj == null) {
        return null;
    }
    IServiceManager in =
        (IServiceManager)obj.queryLocalInterface(descriptor);
    if (in != null) {
        return in;
    }

    return new ServiceManagerProxy(obj);
}

ServiceManager通过getIServiceManager()拿到远程接口，BinderInternal.getContextObject()是一个native方法：

1
2
3
4
5
6
7
8
static jobject android_os_BinderInternal_getContextObject(JNIEnv* env, jobject clazz)
{
    // 这里 new BpBinder(handle)，具体函数见下面
    // 注意这里 ProcessState::self() 会打开驱动，建立内存映射
    sp<IBinder> b = ProcessState::self()->getContextObject(NULL);
    //  返回的是BinderProxy，并且设置了这个BinderProxy的mNativeDatas指针指向这个bpBinder,具体函数见下面
    return javaObjectForIBinder(env, b);
}

在c++层调用ProcessState::getContextObject(NULL)得到一个c++的BpBinder(0)对象，并且通过jni的反射把它包装为一个BinderProxy的java对象返回给java，并且设置了BinderProxy(0)对象又有c++层BpBinder(0)对象的指针，因此

1
ServiceManagerNative.asInterface(Binder.allowBlocking(BinderInternal.getContextObject()))

等于

1
new ServiceManagerProxy(Binder.allowBlocking(new BinderProxy(0))`

从类的设计上来看，ServiceManagerProxy是ServiceManagerNative的一个静态代理类，通过asInterface()方法传入一个BinderProxy来构造，在ServiceManagerProxy的方法实现上，请求都转发给了BinderProxy,所以ServiceManagerProxy也是一个适配器类，把BinderProxy的方法适配成ServiceManagerProxy的方法来给用户调用。BinderProxy含有c++层BpBinder的指针，所以跨进程调用都是通过它来实现。

当java层调用 getIServiceManager().addService(…) 的时候，比如添加ActivityManagerService,因为继承了Binder,所以初始化的时候会设置一个mObject指针指向c++层的JavaBBinder类，这个JavaBBinder又有一个mObject指针指向JavaBBinder,这个JavaBBinder是c++层BBinder的子类，表示一个服务的实体，因此这里的Java层的getIServiceManager().addService(…) ，就转成了c++层的 BpBinder(0)::transact(…),transact的参数包含了name,JavaBBinder, 到这里就和前面的BpServiceManager.addService()一样了。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
//  android / platform / frameworks / base / master / . / core / java / android / os / ServiceManagerNative.java$ServiceManagerProxy
public void addService(String name, IBinder service, boolean allowIsolated, int dumpPriority)
        throws RemoteException {
    Parcel data = Parcel.obtain();
    Parcel reply = Parcel.obtain();
    data.writeInterfaceToken(IServiceManager.descriptor);
    data.writeString(name);
    data.writeStrongBinder(service);
    data.writeInt(allowIsolated ? 1 : 0);
    data.writeInt(dumpPriority);
    mRemote.transact(ADD_SERVICE_TRANSACTION, data, reply, 0);
    reply.recycle();
    data.recycle();
}

// android / platform / frameworks / base / master / . / core / jni / android_os_Parcel.cpp
static void android_os_Parcel_writeStrongBinder(JNIEnv* env, jclass clazz, jlong nativePtr, jobject object)
{
    Parcel* parcel = reinterpret_cast<Parcel*>(nativePtr);
    if (parcel != NULL) {
        const status_t err = parcel->writeStrongBinder(ibinderForJavaObject(env, object));
        if (err != NO_ERROR) {
            signalExceptionForError(env, clazz, err);
        }
    }
}

// android / platform / frameworks / base / master / . / core / jni / android_util_Binder.cpp
sp<IBinder> ibinderForJavaObject(JNIEnv* env, jobject obj)
{
    if (obj == NULL) return NULL;
    // Instance of Binder? 读取 Binder.java 的 mObject指针,得到JavaBBinderHolder，再get()，得到JavaBBinder,这个类是 BBinder.cpp的子类
    if (env->IsInstanceOf(obj, gBinderOffsets.mClass)) {
        JavaBBinderHolder* jbh = (JavaBBinderHolder*)
            env->GetLongField(obj, gBinderOffsets.mObject);
        return jbh->get(env, obj);
    }
    // Instance of BinderProxy? 读取 BinderProxy.java 的 mObject指针，得到 BpBinder
    if (env->IsInstanceOf(obj, gBinderProxyOffsets.mClass)) {
        return getBPNativeData(env, obj)->mObject;
    }
    ALOGW("ibinderForJavaObject: %p is not a Binder object", obj);
    return NULL;
}

//android / platform / frameworks / native / master / . / libs / binder / Parcel.cpp
status_t Parcel::writeStrongBinder(const sp<IBinder>& val)
{
    return flatten_binder(ProcessState::self(), val, this);
}

status_t flatten_binder(const sp<ProcessState>& /*proc*/,
    const sp<IBinder>& binder, Parcel* out)
{
    flat_binder_object obj;
    if (IPCThreadState::self()->backgroundSchedulingDisabled()) {
        /* minimum priority for all nodes is nice 0 */
        obj.flags = FLAT_BINDER_FLAG_ACCEPTS_FDS;
    } else {
        /* minimum priority for all nodes is MAX_NICE(19) */
        obj.flags = 0x13 | FLAT_BINDER_FLAG_ACCEPTS_FDS;
    }
    if (binder != nullptr) {
        IBinder *local = binder->localBinder();
        if (!local) {
            BpBinder *proxy = binder->remoteBinder();
            if (proxy == nullptr) {
                ALOGE("null proxy");
            }
            const int32_t handle = proxy ? proxy->handle() : 0;
            obj.hdr.type = BINDER_TYPE_HANDLE;
            obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */
            obj.handle = handle;
            obj.cookie = 0;
        } else {
            obj.hdr.type = BINDER_TYPE_BINDER;
            obj.binder = reinterpret_cast<uintptr_t>(local->getWeakRefs());
            obj.cookie = reinterpret_cast<uintptr_t>(local);
        }
    } else {
        obj.hdr.type = BINDER_TYPE_BINDER;
        obj.binder = 0;
        obj.cookie = 0;
    }
    return finish_flatten_binder(binder, obj, out);
}

inline static status_t finish_flatten_binder(
    const sp<IBinder>& /*binder*/, const flat_binder_object& flat, Parcel* out)
{
    return out->writeObject(flat, false);
}

binder示意图

getService的过程

首先是获取 getIServiceManager()，这个在上面已经分析过了。
之后是 getService(name)的方法，和上面类似，区别在于上面是writeStrongBinder写入service,这里是多了个readStrongBinder读取service,最后的结果是拿到了一个 BinderProxy. mRemote.transact(…)的过程可以去看c++流程部分。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
//  android / platform / frameworks / base / master / . / core / java / android / os / ServiceManagerNative.java$ServiceManagerProxy
public IBinder getService(String name) throws RemoteException {
    Parcel data = Parcel.obtain();
    Parcel reply = Parcel.obtain();
    data.writeInterfaceToken(IServiceManager.descriptor);
    data.writeString(name);
    mRemote.transact(GET_SERVICE_TRANSACTION, data, reply, 0);
    IBinder binder = reply.readStrongBinder();
    reply.recycle();
    data.recycle();
    return binder;
}

// android / platform / frameworks / base / master / . / core / jni / android_os_Parcel.cpp
static jobject android_os_Parcel_readStrongBinder(JNIEnv* env, jobject clazz)
{
    Parcel* parcel = parcelForJavaObject(env, clazz);
    if (parcel != NULL) {
        return javaObjectForIBinder(env, parcel->readStrongBinder());
    }
    return NULL;
}

//android / platform / frameworks / native / master / . / libs / binder / Parcel.cpp
//得到一个 BpBinder
sp<IBinder> Parcel::readStrongBinder() const
{
    sp<IBinder> val;
    // Note that a lot of code in Android reads binders by hand with this
    // method, and that code has historically been ok with getting nullptr
    // back (while ignoring error codes).
    readNullableStrongBinder(&val);
    return val;
}

//android / platform / frameworks / native / master / . / libs / binder / Parcel.cpp
status_t Parcel::readNullableStrongBinder(sp<IBinder>* val) const
{
    return unflatten_binder(ProcessState::self(), *this, val);
}

//android / platform / frameworks / native / master / . / libs / binder / Parcel.cpp
status_t unflatten_binder(const sp<ProcessState>& proc,const Parcel& in, sp<IBinder>* out)
{
    const flat_binder_object* flat = in.readObject(false);
    if (flat) {
        switch (flat->hdr.type) {
            case BINDER_TYPE_BINDER:
                *out = reinterpret_cast<IBinder*>(flat->cookie);
                return finish_unflatten_binder(nullptr, *flat, in);
            case BINDER_TYPE_HANDLE:
                *out = proc->getStrongProxyForHandle(flat->handle);
                return finish_unflatten_binder(
                    static_cast<BpBinder*>(out->get()), *flat, in);
        }
    }
    return BAD_TYPE;
}

// android / platform / frameworks / native / master / . / libs / binder / ProcessState.cpp
// 根据handle 生成一个BpBinder
sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)
{
    sp<IBinder> result;
    AutoMutex _l(mLock);
    handle_entry* e = lookupHandleLocked(handle);
    if (e != nullptr) {
        // We need to create a new BpBinder if there isn't currently one, OR we
        // are unable to acquire a weak reference on this current one.  See comment
        // in getWeakProxyForHandle() for more info about this.
        IBinder* b = e->binder;
        if (b == nullptr || !e->refs->attemptIncWeak(this)) {
            if (handle == 0) {
                // Special case for context manager...
                // The context manager is the only object for which we create
                // a BpBinder proxy without already holding a reference.
                // Perform a dummy transaction to ensure the context manager
                // is registered before we create the first local reference
                // to it (which will occur when creating the BpBinder).
                // If a local reference is created for the BpBinder when the
                // context manager is not present, the driver will fail to
                // provide a reference to the context manager, but the
                // driver API does not return status.
                //
                // Note that this is not race-free if the context manager
                // dies while this code runs.
                //
                // TODO: add a driver API to wait for context manager, or
                // stop special casing handle 0 for context manager and add
                // a driver API to get a handle to the context manager with
                // proper reference counting.
                Parcel data;
                status_t status = IPCThreadState::self()->transact(
                        0, IBinder::PING_TRANSACTION, data, nullptr, 0);
                if (status == DEAD_OBJECT)
                   return nullptr;
            }
            b = BpBinder::create(handle);
            e->binder = b;
            if (b) e->refs = b->getWeakRefs();
            result = b;
        } else {
            // This little bit of nastyness is to allow us to add a primary
            // reference to the remote proxy when this team doesn't have one
            // but another team is sending the handle to us.
            result.force_set(b);
            e->refs->decWeak(this);
        }
    }
    return result;
}

// android / platform / frameworks / base / master / . / core / jni / android_util_Binder.cpp
// If the argument is a JavaBBinder, return the Java object that was used to create it.
// Otherwise return a BinderProxy for the IBinder. If a previous call was passed the
// same IBinder, and the original BinderProxy is still alive, return the same BinderProxy.
// // 根据 BpBinder 生成一个 BinderProxy并且返回
jobject javaObjectForIBinder(JNIEnv* env, const sp<IBinder>& val)
{
    if (val == NULL) return NULL;
    if (val->checkSubclass(&gBinderOffsets)) {
        // It's a JavaBBinder created by ibinderForJavaObject. Already has Java object.
        jobject object = static_cast<JavaBBinder*>(val.get())->object();
        LOGDEATH("objectForBinder %p: it's our own %p!\n", val.get(), object);
        return object;
    }
    // For the rest of the function we will hold this lock, to serialize
    // looking/creation/destruction of Java proxies for native Binder proxies.
    AutoMutex _l(gProxyLock);
    BinderProxyNativeData* nativeData = gNativeDataCache;
    if (nativeData == nullptr) {
        nativeData = new BinderProxyNativeData();
    }
    // gNativeDataCache is now logically empty.
    jobject object = env->CallStaticObjectMethod(gBinderProxyOffsets.mClass,
            gBinderProxyOffsets.mGetInstance, (jlong) nativeData, (jlong) val.get());
    if (env->ExceptionCheck()) {
        // In the exception case, getInstance still took ownership of nativeData.
        gNativeDataCache = nullptr;
        return NULL;
    }
    BinderProxyNativeData* actualNativeData = getBPNativeData(env, object);
    if (actualNativeData == nativeData) {
        // New BinderProxy; we still have exclusive access.
        nativeData->mOrgue = new DeathRecipientList;
        nativeData->mObject = val;
        gNativeDataCache = nullptr;
        ++gNumProxies;
        if (gNumProxies >= gProxiesWarned + PROXY_WARN_INTERVAL) {
            ALOGW("Unexpectedly many live BinderProxies: %d\n", gNumProxies);
            gProxiesWarned = gNumProxies;
        }
    } else {
        // nativeData wasn't used. Reuse it the next time.
        gNativeDataCache = nativeData;
    }
    return object;
}

当java层调用 getIServiceManager().getService(…) 的时候，执行完毕后，还会调用 reply.readStrongBinder() 去读取远程调用的返回值，根据 handle 生成一个 BpBinder , 再根据 BpBinder 生成一个BinderProxy,这样子就拿到了需要的service的代理对象了。

可以看到，ServiceManager 仅仅是对 IServiceManager 的一个管理类，ServiceManagerNative是一个Binder虚基类，因为 ServiceManager 作为一个管理类，c++层的BBinder已经实现了，所以这里不需要实现 ServiceManagerNative了，只是用了它的静态方法，如果java类想要c++的数据，通过parcel.readXXX 就可以得到。

bindService 的 binder

这里从网上找了一个 code example：

GetDeviceInfoInterface.aidl :

1
2
3
4
5
interface IRemote
{
  int add(int a, int b);
 
}

GetDeviceInfoService.java:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
public class ArithmeticService extends Service{
    @Override
    public IBinder onBind(Intent intent) {
        return mBinder;
    }

    private final IRemote.Stub mBinder = new IRemote.Stub() {
 
        @Override
        public int add(int a, int b) throws RemoteException {
            // TODO Auto-generated method stub
            return (a + b);
        }
 
    };
}

MainActivity.java:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
public class MainActivity extends Activity implements OnClickListener  {
 
    ServiceConnection mServiceConnection;

    @Override
    public void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
 
        initConnection();
 
    }

    private void initConnection(){
        mServiceConnection = new ServiceConnection() {

                @Override
                public void onServiceDisconnected(ComponentName name) {
                    // TODO Auto-generated method stub
                    mService = null;
                    Toast.makeText(getApplicationContext(), "no", Toast.LENGTH_SHORT).show();
                    Log.d("IRemote", "Binding - Service disconnected");
                }

                @Override
                public void onServiceConnected(ComponentName name, IBinder service)
                {
                    // TODO Auto-generated method stub
                    mService = IRemote.Stub.asInterface((IBinder) service);
                    Toast.makeText(getApplicationContext(), "yes", Toast.LENGTH_SHORT).show();
                    Log.d("IRemote", "Binding is done - Service connected");
                }
            };
        if(mService == null)
        {
            Intent it = new Intent();
            it.setAction("com.remote.service.CALCULATOR");
            bindService(it, mServiceConnection, Service.BIND_AUTO_CREATE);
        }
    }

    protected void onDestroy() {
        super.onDestroy();
        unbindService(mServiceConnection);
};

接下来从bindService看起，bindService传入了一个类 ServiceConnection 作为回调。由于Activity的context实际上是ContextImpl,所以这里会到 ContextImpl.java里面去：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
//ContextImpl.java
@Override
public boolean bindService(Intent service, ServiceConnection conn,int flags) {
    warnIfCallingFromSystemProcess();
    return bindServiceCommon(service, conn, flags, mMainThread.getHandler(), getUser());
}

private boolean bindServiceCommon(Intent service, ServiceConnection conn, int flags, Handler
        handler, UserHandle user) {
    // Keep this in sync with DevicePolicyManager.bindDeviceAdminServiceAsUser.
    IServiceConnection sd;
    ...
    try {
        IBinder token = getActivityToken();
        if (token == null && (flags&BIND_AUTO_CREATE) == 0 && mPackageInfo != null
                && mPackageInfo.getApplicationInfo().targetSdkVersion
                < android.os.Build.VERSION_CODES.ICE_CREAM_SANDWICH) {
            flags |= BIND_WAIVE_PRIORITY;
        }
        service.prepareToLeaveProcess(this);
        int res = ActivityManager.getService().bindService(
            mMainThread.getApplicationThread(), getActivityToken(), service,
            service.resolveTypeIfNeeded(getContentResolver()),
            sd, flags, getOpPackageName(), user.getIdentifier());
        if (res < 0) {
            throw new SecurityException(
                    "Not allowed to bind to service " + service);
        }
        return res != 0;
    } catch (RemoteException e) {
        throw e.rethrowFromSystemServer();
    }
}

这里把传入的 ServiceConnection 类作为参数构造了一个 ServiceDispatcher, 然后返回了ServiceDispatcher的内部类mIServiceConnection，这是一个Binder类实体。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
// LoadedAPK.java
static final class ServiceDispatcher {
        private final ServiceDispatcher.InnerConnection mIServiceConnection;
        private final ServiceConnection mConnection;
        private final Context mContext;
        private final Handler mActivityThread;

        private static class InnerConnection extends IServiceConnection.Stub {
            final WeakReference<LoadedApk.ServiceDispatcher> mDispatcher;

            InnerConnection(LoadedApk.ServiceDispatcher sd) {
                mDispatcher = new WeakReference<LoadedApk.ServiceDispatcher>(sd);
            }

            public void connected(ComponentName name, IBinder service, boolean dead)
                    throws RemoteException {
                LoadedApk.ServiceDispatcher sd = mDispatcher.get();
                if (sd != null) {
                    sd.connected(name, service, dead);
                }
            }
        }

        private final ArrayMap<ComponentName, ServiceDispatcher.ConnectionInfo> mActiveConnections
            = new ArrayMap<ComponentName, ServiceDispatcher.ConnectionInfo>();

        ServiceDispatcher(ServiceConnection conn,
                Context context, Handler activityThread, int flags) {
            mIServiceConnection = new InnerConnection(this);
            mConnection = conn;
            mContext = context;
            mActivityThread = activityThread;
            mLocation = new ServiceConnectionLeaked(null);
            mLocation.fillInStackTrace();
            mFlags = flags;
        }

        ServiceConnection getServiceConnection() {
            return mConnection;
        }

        IServiceConnection getIServiceConnection() {
            return mIServiceConnection;
        }

        public void connected(ComponentName name, IBinder service, boolean dead) {
            if (mActivityThread != null) {
                mActivityThread.post(new RunConnection(name, service, 0, dead));
            } else {
                doConnected(name, service, dead);
            }
        }
    }

// IServiceConnection.aidl
interface IServiceConnection {
    void connected(in ComponentName name, IBinder service, boolean dead);
}

之后是ActivityManager.getService().bindService(…):

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
//ActivityManager.java
public static IActivityManager getService() {
    return IActivityManagerSingleton.get();
}

private static final Singleton<IActivityManager> IActivityManagerSingleton =
        new Singleton<IActivityManager>() {
            @Override
            protected IActivityManager create() {
                final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE);
                final IActivityManager am = IActivityManager.Stub.asInterface(b);
                return am;
            }
        };

// ServiceManager.java
public static IBinder getService(String name) {
    try {
        IBinder service = sCache.get(name);
        if (service != null) {
            return service;
        } else {
            return Binder.allowBlocking(rawGetService(name));
        }
    } catch (RemoteException e) {
        Log.e(TAG, "error in getService", e);
    }
    return null;
}

private static IBinder rawGetService(String name) throws RemoteException {
    final long start = sStatLogger.getTime();
    final IBinder binder = getIServiceManager().getService(name);
    ...
}

在上面已经讲过，这里得到的是一个IActivityManager.Proxy类，是ActivityManagerService的远程接口.从app进程发起AMS的调用，参数中传递了一个Binder实体，在驱动的处理中，就会为app进程创建一个binder_node,同时在AMS的进程(也就是system_server)中创建一个binder_ref，然后还会把flat_binder_object的BINDER_TYPE_BINDER转成BINDER_TYPE_HANDLE类型，因此后面解析出来是一个BpBinder接口。对于AMS来说，binder线程唤醒后会执行executeCommand(…)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
status_t IPCThreadState::executeCommand(int32_t cmd)
{
    ...
    switch (cmd) {
    ......
    case BR_TRANSACTION:
        {
            ...
            if (tr.target.ptr) {
                // We only have a weak reference on the target object, so we must first try to
                // safely acquire a strong reference before doing anything else with it.
                if (reinterpret_cast<RefBase::weakref_type*>(
                        tr.target.ptr)->attemptIncStrong(this)) {
                    error = reinterpret_cast<BBinder*>(tr.cookie)->transact(tr.code, buffer,
                            &reply, tr.flags);
                    reinterpret_cast<BBinder*>(tr.cookie)->decStrong(this);
                } else {
                    error = UNKNOWN_TRANSACTION;
                }
            } else {
                error = the_context_object->transact(tr.code, buffer, &reply, tr.flags);
            }
           ...
        }
        break;

    .......
    }
    ...
}

这里有把tr.cookie保存的值强转为BBinder类型(cookie的值在binder_thread_read设置)，对于c++的服务来说，它们本身已经继承了BBinder,所以会进入到它们自己的transact方法中，对于这里的调用来说，保存的是一个JavaBBinder类(可以看上面，对于Binder,writeStrongBinder写入的是一个JavaBBinder类)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
class JavaBBinder : public BBinder
{
    protected:
        status_t onTransact(
            uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags = 0) override
        {
            ...
            jboolean res = env->CallBooleanMethod(mObject, gBinderOffsets.mExecTransact,
                code, reinterpret_cast<jlong>(&data), reinterpret_cast<jlong>(reply), flags);
            ...
        }
    private:
        JavaVM* const   mVM;
        jobject const   mObject;  // GlobalRef to Java Binder
        mutable std::once_flag mPopulateDescriptor;
        mutable String16 mDescriptor;
    };

JavaBBinder 会通过jni反射调到它对应的Binder类的 onTransact 方法，在这里是指 IActivityManagerService.Stub里的方法，又会继续调用到子类的ams的bindService方法，终于来到了ams类。。

service-bind

这里回到InnerConnection的connected()方法，依次调用到ServiceDispatcher.connected(),然后就是 mConnection.onServiceConnected。

总体上来说，这里还是binder的应用之一，因为serviceConnection不能跨进程，所以构造了一个InnerConnection，并且传给ams，这样ams就能主动通知app了，ams在创建service后，如果有bindservice,那么就会把 service 的成员变量，一个 Binder 作为参数通过 InnerConnection 的接口通知回app，这样app就拿到了 service 里面的 Binder 的远程接口，然后就可以调用这个 Binder 的方法了。