通過AMS分析Binder流程(Java到Kernel)
阿新 • • 發佈：2019-01-08
栗子： public class MainActivity extends Activity{ @Override protected void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); Intent intent = new Intent(this, DisplayMessageActivity.class); startActivity(intent);//啟動一個Activity } } 1.frameworks/base/core/java/android/app/Activity.java <1>.public void startActivity(Intent intent) { this.startActivity(intent, null); } <2>.注意：這裡繼承關係: Activity —-—> ContextThemeWrapper ——> ContextWrapper ——> Context ————>public class Activity extends ContextThemeWrapper{} ————>public class ContextThemeWrapper extends ContextWrapper{} ————>public class ContextWrapper extends Context {} <3>.在frameworks/base/core/java/android/content/Context.java中定義抽象方法startActivity() public abstract void startActivity(@RequiresPermission Intent intent); 並且在frameworks/base/core/java/android/app/ContextImpl.java中實現了startActivity()抽象方法. public void startActivity(Intent intent) { mMainThread.getInstrumentation().execStartActivity(); } 2.frameworks/base/core/java/android/app/Instrumentation.java public ActivityResult execStartActivity(){ int result = ActivityManagerNative.getDefault().startActivity(); } 3.frameworks/base/core/java/android/app/ActivityManagerNative.java <1>.static public IActivityManager getDefault(){ return gDefault.get(); } <2>.private static final Singleton<IActivityManager> gDefault = new Singleton<IActivityManager>(){ IBinder b = ServiceManager.getService("activity"); IActivityManager am = asInterface(b); return am; } 4.frameworks/base/core/java/android/os/ServiceManager.java public static void addService(String name, IBinder service){ } <1>.public static IBinder getService(String name) { return getIServiceManager().getService(name); } <2>.private static IServiceManager getIServiceManager() { sServiceManager = ServiceManagerNative.asInterface(BinderInternal.getContextObject()); return sServiceManager; } 5.frameworks/base/core/java/com/android/internal/os/BinderInternal.java public static final native IBinder getContextObject();//jni函式 6.frameworks/base/core/jni/android_util_Binder.cpp static jobject android_os_BinderInternal_getContextObject(JNIEnv* env, jobject clazz){ sp<IBinder> b = ProcessState::self()->getContextObject(NULL); return javaObjectForIBinder(env, b); } 7.frameworks/native/libs/binder/ProcessState.cpp <1>.sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& /*caller*/){ //這裡引數為0，就是ServiceManager的binder handle值。所以這裡你給個0，就返回給你servicemanager的Binder代理物件。 return getStrongProxyForHandle(0); } 8.sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle){ sp<IBinder> result; Parcel data; status_t status = IPCThreadState::self()->transact(0, IBinder::PING_TRANSACTION, data, NULL, 0); b = new BpBinder(handle); result = b; //把BpBinder物件傳給了IBinder物件,並且返回IBinder return result;//返回的result是IBinder*型別 } 注意：frameworks/native/include/binder/BpBinder.h這裡BpBinder類是繼承於IBinder的. class BpBinder : public IBinder{ } 9.分析BpBinder(Proxy Binder)和BBinder(Base Binder)怎麼聯絡起來的？ 所以在frameworks/native/libs/binder/IServiceManager.cpp裡 //frameworks/native/libs/binder/Static.cpp sp<IServiceManager> gDefaultServiceManager; gDefaultServiceManager = interface_cast<IServiceManager>(ProcessState::self()->getContextObject(NULL)); 注意：sp<IBinder> result; b = new BpBinder(handle); result = b; return result; IBinder就是new BpBinder(0); ======>interface_cast<IServiceManager>(new BpBinder(handle)/*handle為0;*/); ======>interface_cast<IServiceManager>(new BpBinder(0)//返回IBinder型別); ======>IServiceManager::asInterface(obj);//obj就是傳進來：new BpBinder(0);即IBinder ======>new BpServiceManager(obj);//obj就是傳進來：new BpBinder(0);即IBinder ======>class BpServiceManager : public BpInterface<IServiceManager>{} ======>inline BpInterface<INTERFACE>::BpInterface(const sp<IBinder>& obj) : BpRefBase(remote){} ======>BpRefBase::BpRefBase(const sp<IBinder>& o): mRemote(o.get()), mRefs(NULL), mState(0){} 注意：sp<IBinder>& o型別初始化函式列表：把o傳給mRemote，這裡o就是new BpServiceManager(obj)的obj==>new BpBinder(0);即IBinder 最終目的：把BpBinder傳給了mRemote,mRemote就是remote()，就是IBinder*型別物件; 後邊使用remote()->transact()傳輸到kernel層,就調到BpBinder.cpp裡的transact()函式，這條路就打通了.因為:BpBinder和BBinder就是通過IBinder聯絡起來的. //一.BBinder繼承表 class BBinder : public IBinder{}; class BnInterface : public INTERFACE, public BBinder{}; //二.BpBinder繼承表 class BpRefBase : public virtual RefBase{ IBinder* const mRemote; inline IBinder* remote() { return mRemote; } } class BpInterface : public INTERFACE, public BpRefBase{}; inline BpInterface<INTERFACE>::BpInterface(const sp<IBinder>& remote) : BpRefBase(remote){} <1>.分析interface_cast是個什麼鬼? frameworks/native/include/binder/IInterface.h template<typename INTERFACE> inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj){ return INTERFACE::asInterface(obj); } 僅僅是一個模板函式，所以interface_cast<IServiceManager>()等價於： inline sp<IServiceManager> interface_cast(const sp<IBinder>& obj){ return IServiceManager::asInterface(obj); } <2>.在frameworks/native/include/binder/IServiceManager.h中, IServiceManager類繼承於IInterface類 class IServiceManager : public IInterface{ //關鍵無比的巨集！ DECLARE_META_INTERFACE(ServiceManager);//巨集裡面的一些定義 IMPLEMENT_META_INTERFACE(ServiceManager, "android.os.IServiceManager”);//巨集力面的實現 } 將IServiceManager的DELCARE巨集進行相應的替換後得到的程式碼如下所示： #define DECLARE_META_INTERFACE(ServiceManager) //定義一個描述字串 static const android::String16 descriptor; //定義一個asInterface函式 static android::sp< IServiceManager>asInterface(constandroid::sp<android::IBinder>& obj) //定義一個getInterfaceDescriptor函式，返回就是descriptor字串 virtual const android::String16&getInterfaceDescriptor() const; //定義IServiceManager的建構函式和解構函式 IServiceManager (); virtual ~IServiceManager(); 將IServiceManager中的IMPLEMENT巨集的定義展開，如下所示： #define IMPLEMENT_META_INTERFACE(ServiceManager, "android.os.IServiceManager") //初始化函式列表:descriptor的賦值為：android.os.IServiceManager const android::String16 IServiceManager::descriptor(“android.os.IServiceManager”); //實現getInterfaceDescriptor函式 const android::String16& IServiceManager::getInterfaceDescriptor()const { //返回字串descriptor，值是“android.os.IServiceManager” return IServiceManager::descriptor; } //實現asInterface函式 android::sp<IServiceManager> IServiceManager::asInterface(constandroid::sp<android::IBinder>& obj) { android::sp<IServiceManager> intr; if(obj != NULL) { intr = static_cast<IServiceManager *>(obj->queryLocalInterface(IServiceManager::descriptor).get()); if (intr == NULL) { //obj是我們剛才建立的那個BpBinder(0) intr = new BpServiceManager(obj); } } return intr;//BpBinder(這裡已經把BpBinder轉換成了BpServiceManager)指標轉換成一個IServiceManager } //實現建構函式和解構函式 IServiceManager::IServiceManager() {} IServiceManager::~ IServiceManager() {} //如何BpBinder(這裡已經把BpBinder轉換成了BpServiceManager)指標轉換成一個IServiceManager? interface_cast是如何把BpBinder指標轉換成一個IServiceManager指標的呢？ 答案就在asInterface函式的一行程式碼中，如下所示：intr = new BpServiceManager(obj); <3>.frameworks/native/libs/binder/IServiceManager.cpp class BpServiceManager : public BpInterface<IServiceManager>{ public: BpServiceManager(const sp<IBinder>& impl):BpInterface<IServiceManager>(impl){} } <4>.frameworks/native/include/binder/IInterface.h //在這裡BpInterface類又繼承於BpRefBase類 template<typename INTERFACE> inline BpInterface<INTERFACE>::BpInterface(const sp<IBinder>& remote) : BpRefBase(remote){ } <5>.frameworks/native/libs/binder/Binder.cpp frameworks/native/include/binder/Binder.h std::atomic<int32_t> mState; IBinder* const mRemote; RefBase::weakref_type* mRefs; //注意：sp<IBinder>& o中初始化函式列表：給成員函式賦初值.mRemote=o.get();mRefs=NULL; mState=0;這裡o就是new BpServiceManager(obj)的obj==>new BpBinder(0);即IBinder BpRefBase::BpRefBase(const sp<IBinder>& o): mRemote(o.get()), mRefs(NULL), mState(0){ mRemote->incStrong(this); } 10.分析addService()方法，解讀transact中Java和Kernel建立通訊流程. frameworks/base/core/java/android/os/ServiceManager.java <1>.mRemote.transact(ADD_SERVICE_TRANSACTION, data, reply, 0); <2>.frameworks/native/libs/binder/IServiceManager.cpp virtual status_t addService(const String16& name, const sp<IBinder>& service){ data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor()); //remote()其實就是BpBinder status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply); } 11.frameworks/native/libs/binder/IServiceManager.cpp <1>.//這裡注意BpInterface就是BpBinder class BpServiceManager : public BpInterface<IServiceManager>{ virtual status_t addService(){ //這裡remote()的new BpServiceManager就是BpBinder status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply); } } 在frameworks/native/include/binder/IServiceManager.h中,IServiceManager類繼承於IInterface類 class IServiceManager : public IInterface{ //這裡巨集定義和巨集實現,把BpBinder轉換為IServiceManager物件，前面已經分析過了. DECLARE_META_INTERFACE(INTERFACE) IMPLEMENT_META_INTERFACE(INTERFACE, NAME) } /*******************************************************************************************/ 分析remote()是從哪裡來的？ <6>.frameworks/native/include/binder/IInterface.h //在IInterface.h中BpInterface返回了remote() template<typename INTERFACE> inline IBinder* BpInterface<INTERFACE>::onAsBinder(){ return remote(); } 注意：mRemote和remote()的型別其實是IBinder，其實就是BpInterface（即BpBinder） <7>.在frameworks/native/include/binder/Binder.h中,remote()返回的是IBinder*型別的mRemote. IBinder* const mRemote; //這個是模版函式 template<typename INTERFACE> inline IBinder* remote(){ return mRemote; } //在這裡BpInterface類又繼承於BpRefBase類 template<typename INTERFACE> inline BpInterface<INTERFACE>::BpInterface(const sp<IBinder>& remote) : BpRefBase(remote){ } //BpRefBase定義mRemote就是BpBinder frameworks/native/include/binder/Binder.h class BpRefBase : public virtual RefBase{ protected: inline IBinder* remote(){ return mRemote; } private: IBinder* const mRemote; }; //BnInterface繼承於BBinder template<typename INTERFACE> class BnInterface : public INTERFACE, public BBinder{ protected: virtual IBinder* onAsBinder(); } 注意:BpInterface和BnInterface它們是基於 IBinder*型別連線起來的。 /*******************************************************************************************/ 12.frameworks/native/libs/binder/BpBinder.cpp status_t BpBinder::transact(){ status_t status = IPCThreadState::self()->transact(mHandle, code, data, reply, flags)); } 13.frameworks/native/libs/binder/IPCThreadState.cpp /*******************************************************************************************/ //開啟”/dev/binder”裝置節點和kernel通訊 //IPCThreadState建構函式,初始化成員變數列表：mProcess = ProcessState::self(); IPCThreadState::IPCThreadState(): mProcess(ProcessState::self()){ if(gHaveTLS) return new IPCThreadState; }; IPCThreadState::IPCThreadState(): mProcess(ProcessState::self())){ pthread_setspecific(gTLS, this); } //ProcessState建構函式,初始化成員變數列表:mDriverFD = open_driver(); frameworks/native/libs/binder/ProcessState.cpp ProcessState::ProcessState(): mDriverFD(open_driver()){ } //開啟/dev/binder static int open_driver(){ int fd = open("/dev/binder", O_RDWR | O_CLOEXEC); ioctl(fd, BINDER_VERSION, &vers); ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads) } /*******************************************************************************************/ <1>.status_t IPCThreadState::transact(){ err = waitForResponse(reply); } <2>.status_t IPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult){ talkWithDriver(); <3>.status_t IPCThreadState::talkWithDriver(bool doReceive){ ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr);//通過ioctl()和Kernel通訊. } 14.kernel/msm-3.18/drivers/staging/android/binder.c <1>.static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg){ case BINDER_WRITE_READ: ret = binder_ioctl_write_read(filp, cmd, arg, thread); } <2>.static int binder_ioctl_write_read(struct file *filp,struct binder_thread *thread){ binder_thread_write(); trace_binder_write_done(); binder_thread_read(); trace_binder_read_done(); }
