binder 2 用户空间数据结构间关系
用户空间的数据结构关系图：
binder数据结构分为语义层和传输层：
语义层就是所说的接口层，具体提供什么样的服务，实现服务的类为xxx, 上面的服务接口为Ixxx, client: Bpxxx，server:Bnxxx分别继承BpInterface, BnInterface,且都继承Ixxx.
服务的具体实现为 xxxx, 实现具体的接口。
接口是多种多样的，为实现多样性，使用的方法是模板的形式
BpInterface使怎样通过传输数据的？BpInterface继承了BpRefBase,其中包含了 IBinder * mRemote.
class BpInterface : public INTERFACE, public BpRefBase
{
public:
BpInterface(const sp<IBinder>& remote);
protected:
virtual IBinder* onAsBinder();
};
class BpRefBase : public virtual RefBase
{
protected:
BpRefBase(const sp<IBinder>& o);
virtual ~BpRefBase();
virtual void onFirstRef();
virtual void onLastStrongRef(const void* id);
virtual bool onIncStrongAttempted(uint32_t flags, const void* id);
inline IBinder* remote() { return mRemote; }
inline IBinder* remote() const { return mRemote; }
private:
BpRefBase(const BpRefBase& o);
BpRefBase& operator=(const BpRefBase& o);
IBinder* const mRemote;
RefBase::weakref_type* mRefs;
std::atomic<int32_t> mState;
};
BnInferface通过Binder的通信是直接继承了BBinder
template<typename INTERFACE> class BnInterface : public INTERFACE, public BBinder { public: virtual sp<IInterface> queryLocalInterface(const String16& _descriptor); virtual const String16& getInterfaceDescriptor() const; protected: virtual IBinder* onAsBinder(); };
IInterface和IBinder间的关系：根据IBinder生成Bp##INTERFACE
template<typename INTERFACE> inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj) { return INTERFACE::asInterface(obj); }
#define DECLARE_META_INTERFACE(INTERFACE) \ static const android::String16 descriptor; \ static android::sp<I##INTERFACE> asInterface( \ const android::sp<android::IBinder>& obj); \ virtual const android::String16& getInterfaceDescriptor() const; \ I##INTERFACE(); \ virtual ~I##INTERFACE(); \
#define IMPLEMENT_META_INTERFACE(INTERFACE, NAME) \ const android::String16 I##INTERFACE::descriptor(NAME); \ const android::String16& \ I##INTERFACE::getInterfaceDescriptor() const { \ return I##INTERFACE::descriptor; \ } \ android::sp<I##INTERFACE> I##INTERFACE::asInterface( \ const android::sp<android::IBinder>& obj) \ { \ android::sp<I##INTERFACE> intr; \ if (obj != NULL) { \ intr = static_cast<I##INTERFACE*>( \ obj->queryLocalInterface( \ I##INTERFACE::descriptor).get()); \ if (intr == NULL) { \ intr = new Bp##INTERFACE(obj); \ } \ } \ return intr; \ } \ I##INTERFACE::I##INTERFACE() { } \ I##INTERFACE::~I##INTERFACE() { } \
通过获得服务的流程看数据结构间关系：
ServiceManager的client调用：checkService获得IBinder
virtual sp<IBinder> checkService( const String16& name) const
{
Parcel data, reply;
data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
data.writeString16(name);
remote()->transact(CHECK_SERVICE_TRANSACTION, data, &reply);
return reply.readStrongBinder();
}
这里的remote是serviceManger的代理端，通过binder调用远端serviceManager的获得名字固定的service的IBinder
返回给调用进程的数据包含在reply中，其中最重要的是clint对应的handle
sp<IBinder> Parcel::readStrongBinder() const
{
sp<IBinder> val;
readStrongBinder(&val);
return val;
}
/*这里还是调用了ProcessState::self()去打开设备文件*/
status_t Parcel::readStrongBinder(sp<IBinder>* val) const
{
return unflatten_binder(ProcessState::self(), *this, val);
}
这里有关全局变量的作用域，原来以为全局变量是进程间共享的，这样并不是每个进程都打开open(dev/binder文件)，解释不同
正确的是全局变量线程间共享，而不是进程间
sp<ProcessState> ProcessState::self() { Mutex::Autolock _l(gProcessMutex); if (gProcess != NULL) { return gProcess; } gProcess = new ProcessState; return gProcess; }
ProcessState::ProcessState()
: mDriverFD(open_driver())
, mVMStart(MAP_FAILED)
, mThreadCountLock(PTHREAD_MUTEX_INITIALIZER)
, mThreadCountDecrement(PTHREAD_COND_INITIALIZER)
, mExecutingThreadsCount(0)
, mMaxThreads(DEFAULT_MAX_BINDER_THREADS)
, mStarvationStartTimeMs(0)
, mManagesContexts(false)
, mBinderContextCheckFunc(NULL)
, mBinderContextUserData(NULL)
, mThreadPoolStarted(false)
, mThreadPoolSeq(1)
{
if (mDriverFD >= 0) {
// mmap the binder, providing a chunk of virtual address space to receive transactions.
mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
if (mVMStart == MAP_FAILED) {
// *sigh*
ALOGE("Using /dev/binder failed: unable to mmap transaction memory.\n");
close(mDriverFD);
mDriverFD = -1;
}
}
LOG_ALWAYS_FATAL_IF(mDriverFD < 0, "Binder driver could not be opened. Terminating.");
}
如果驱动和用户空间传递的数据为BpBinder相关则类型为BINDER_TYPE_HANDLE
status_t unflatten_binder(const sp<>& proc,
const Parcel& in, sp<IBinder>* out) { const flat_binder_object* flat = in.readObject(false); if (flat) { switch (flat->type) { case BINDER_TYPE_BINDER: *out = reinterpret_cast<IBinder*>(flat->cookie); return finish_unflatten_binder(NULL, *flat, in); case BINDER_TYPE_HANDLE: *out = proc->getStrongProxyForHandle(flat->handle); return finish_unflatten_binder( static_cast<BpBinder*>(out->get()), *flat, in); } } return BAD_TYPE; }
sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle){
b = new BpBinder(handle);
return b;
}
class OctVmService : public BinderService<OctVmService>, public BnOctVmService
通过interface_cast就可以得到Ixxxx, 就可以调用对应的服务
服务具体的数据结构使怎样创建的那？
服务侧的BBinder创建相对BnBinder的创建就直接的多：
如
sm->addService(String16(IQfpService::getServiceName()), qfpService, false);
sp<QfpService> qfpService = QfpService::instantiate(testMode ? &commandStub : 0);
class QfpService : public BinderService<QfpService>, public BnQfpService
在addService时创建了对象QfpService而QfpService继承了BnQfpService，BnQfpService继承了BBinder
static void joinThreadPool() { sp<ProcessState> ps(ProcessState::self()); ps->startThreadPool(); ps->giveThreadPoolName(); IPCThreadState::self()->joinThreadPool(); }这里ProcessStat::self创建了传输成的数据结构