系列文章Android 12 S ServiceManager原理Android 12 S Native Service的创建流程Android 12 S Binder原理之BpBinderBnBinder以及IInterface介绍Android 12 S HIDL Service创建流程Android 12 S 自定义Hal服务selinux权限添加Android 12 S 自定义Native服务selinux权限添加Android 12 S java服务调用native服务Android 12 S 自定义native服务访问java服务一Binder机制介绍Binder机制是Android系统提供的跨进程通讯机制。Client进程希望可以与Server进程沟通但由于是跨进程所以需要借助Binder驱动进程通信。Binder由以下模块组成* Binder驱动* Binder Server端 - Server进程* Binder Client端 - Client进程* ServiceManager - 管理者Binder的通信模型如下所示二创建Service模型如果要创建一个Service需要Server端继承BnInterface, Client端继承BpInterface。具体可用下图表示可在如下文件中找到关于Bn, Bp相关的声明frameworks/native/libs/binder/include/binder/IInterface.hframeworks/native/libs/binder/include/binder/IBinder.h具体代码如下frameworks/native/libs/binder/include/binder/IInterface.h class IInterface : public virtual RefBase { public: IInterface(); static spIBinder asBinder(const IInterface*); static spIBinder asBinder(const spIInterface); protected: virtual ~IInterface(); virtual IBinder* onAsBinder() 0; }; ----------------------------------------------------------- class BnInterface : public INTERFACE, public BBinder { public: virtual spIInterface queryLocalInterface(const String16 _descriptor); virtual const String16 getInterfaceDescriptor() const; protected: typedef INTERFACE BaseInterface; virtual IBinder* onAsBinder(); }; frameworks/native/libs/binder/include/binder/Binder.h class BBinder : public IBinder { public: BBinder(); virtual const String16 getInterfaceDescriptor() const; virtual bool isBinderAlive() const; virtual status_t pingBinder(); ... }; frameworks/native/libs/binder/include/binder/IBinder.h class [[clang::lto_visibility_public]] IBinder : public virtual RefBase { public: enum { FIRST_CALL_TRANSACTION 0x00000001, LAST_CALL_TRANSACTION 0x00ffffff, ... }; ------------------------------------------------------------------- class BpInterface : public INTERFACE, public BpRefBase { public: explicit BpInterface(const spIBinder remote); protected: typedef INTERFACE BaseInterface; virtual IBinder* onAsBinder(); }; frameworks/native/libs/binder/include/binder/Binder.h class BpRefBase : public virtual RefBase { protected: explicit BpRefBase(const spIBinder o); virtual ~BpRefBase(); virtual void onFirstRef(); virtual void onLastStrongRef(const void* id); virtual bool onIncStrongAttempted(uint32_t flags, const void* id); inline IBinder* remote() const { return mRemote; }//返回的是BpBinder inline spIBinder remoteStrong() const { return spIBinder::fromExisting(mRemote); ...三进程间传递数据的载体 - ParcelParcel代码位于如下目录Parcel用于传递进程间的数据。不管是Client发送数据给Server还是Server发送数据给Client都是通过Parcel进行传递。frameworks/native/include/binder/Parcel.hframeworks/native/include/binder/Parcel.cppwrite相关接口:status_t write(const void* data, size_t len); status_t writeInt32(int32_t val); status_t writeUint32(uint32_t val); status_t writeInt64(int64_t val); status_t writeUint64(uint64_t val); status_t writeFloat(float val); status_t writeDouble(double val); status_t writeStrongBinder(const spIBinder val); status_t writeInt32Array(size_t len, const int32_t *val); status_t writeByteArray(size_t len, const uint8_t *val); status_t writeBool(bool val); status_t writeChar(char16_t val); status_t writeByte(int8_t val); ......read相关接口:status_t read(void* outData, size_t len) const; const void* readInplace(size_t len) const; int32_t readInt32() const; status_t readInt32(int32_t *pArg) const; uint32_t readUint32() const; status_t readUint32(uint32_t *pArg) const; int64_t readInt64() const; status_t readInt64(int64_t *pArg) const; uint64_t readUint64() const; status_t readUint64(uint64_t *pArg) const; float readFloat() const; status_t readFloat(float *pArg) const; double readDouble() const; status_t readDouble(double *pArg) const; bool readBool() const; status_t readBool(bool *pArg) const; char16_t readChar() const; status_t readChar(char16_t *pArg) const; int8_t readByte() const; status_t readByte(int8_t *pArg) const; ......举个例子在native service中是如何通过Parcel传递数据的如下所示都是通过Parcel进行传递。class BpCustomizeManagerService : public BpInterfaceICustomizeManagerService { public: explicit BpCustomizeManagerService (const spIBinder impl) : BpInterface ICustomizeManagerService(impl) { ALOGD(create Service \n); } int customeize(int size){ Parcel data, reply; data.writeInterfaceToken(ICustomizeManagerService::getInterfaceDescriptor()); data.writeInt32(size); remote()-transact(CUSTOMIZE, data, reply); return reply.readInt32(); } }; status_t BnCustomizeManagerService ::onTransact(uint32_t code, const Parcel data, Parcel *reply, uint32_t flags){ switch (code) { case CUSTOMIZE: { CHECK_INTERFACE(ICustomizeManagerService, data, reply); int size data.readInt32(); int ret customeize(size); //函数返回值从Server传递给Client reply-writeInt32(); return NO_ERROR; } ... };