android binder机制,注册系统服务---Java层注册系统服务

6 Java注册系统服务

Java获取的ServiceManager代理是ServiceManagerProxy,

ServiceManagerProxy的addService如下,

public void addService(String name, IBinder service, boolean allowIsolated)            throws RemoteException {        Parcel data = Parcel.obtain();        Parcel reply = Parcel.obtain();        data.writeInterfaceToken(IServiceManager.descriptor);        data.writeString(name);        data.writeStrongBinder(service);        data.writeInt(allowIsolated ? 1 : 0);        mRemote.transact(ADD_SERVICE_TRANSACTION, data, reply, 0);        reply.recycle();        data.recycle();    }

BinderProxy是Binder的内部类, mRemote变量指向BinderProxy对象。因此调用将数据打包后调用

BinderProxy的transact方法,

public boolean transact(int code, Parcel data, Parcel reply, int flags) throws RemoteException {        Binder.checkParcel(this, code, data, "Unreasonably large binder buffer");        return transactNative(code, data, reply, flags);    }

transactNative对应的是android_util_Binder.cpp的android_os_BinderProxy_transact方法,

static jboolean android_os_BinderProxy_transact(JNIEnv* env, jobject obj,    jint code, jobject dataObj, jobject replyObj, jint flags){    ...    //java Parcel转为native Parcel    Parcel* data = parcelForJavaObject(env, dataObj);    Parcel* reply = parcelForJavaObject(env, replyObj);    ...        //gBinderProxyOffsets.mObject中保存的是new BpBinder(0)对象    IBinder* target = (IBinder*)        env->GetLongField(obj, gBinderProxyOffsets.mObject);    ...    //此处便是BpBinder::transact(), 经过native层，进入Binder驱动程序    status_t err = target->transact(code, *data, reply, flags);    ...    return JNI_FALSE;}

Java层的BinderProxy.transact()最终交由Native层BpBinder的BpBinder::transact()完成。

BpBinder的transact方法在上个章节中已经论述了。

由此看出,Java注册系统服务最后也会走native方法。