Android binder -- Binder应用实例
来源:互联网 发布:主人网络个访问网络 编辑:程序博客网 时间:2024/05/01 07:40
Binder应用实例
(一)binder机制中的Java层
(1)ServiceManager类型和对象
Framework\base\core\android\os\ServiceManager.java
public final class ServiceManager {
private static final String TAG = "ServiceManager";
private static IServiceManager sServiceManager;
……
}
private static IServiceManager getIServiceManager() {
if (sServiceManager != null) {
return sServiceManager;
}
// Find the service manager
sServiceManager = ServiceManagerNative.asInterface(BinderInternal.getContextObject());
return sServiceManager;
}
sServiceManager = ServiceManagerNative.asInterface(BinderInternal.getContextObject());
Framework\base\core\com\java\android\os\BinderInternal.java
public class BinderInternal {
……
public static final native IBinder getContextObject();
……
}
Framework\base\core\jni\android_util_binder.cpp
static jobject android_os_BinderInternal_getContextObject(JNIEnv* env, jobject clazz)
{
sp b = ProcessState::self()->getContextObject(NULL);
return javaObjectForIBinder(env, b);
}
sp ProcessState::getContextObject(const sp& caller)
{
if (supportsProcesses()) {
return getStrongProxyForHandle(0);
} else {
return getContextObject(String16("default"), caller);
}
}
哦,这里不又是回到前文的内容里了嘛!再说一边就没有意思了,如果忘记了,可以回头看看,呵呵,还是要“经常回头看看自己走过的路。”
gDefaultServiceManager = interface_cast(ProcessState::self()->getContextObject(NULL));//创建代理对象
就是这段代码,既然也走到了这里,他们的参数一样,唯一不同的就是这个主体函数喽!那么我们Java层面的这段代码:
sServiceManager = ServiceManagerNative.asInterface(BinderInternal.getContextObject());
static public IServiceManager asInterface(IBinder obj)
{
if (obj == null) {
return null;
}
IServiceManager in = (IServiceManager)obj.queryLocalInterface(descriptor);
if (in != null) {
return in;
}
return new ServiceManagerProxy(obj); //如果没有查询到,创建一个本地服务代理对象
}
public ServiceManagerProxy(IBinder remote) {
mRemote = remote;
} //底层传来的IBinder对象赋给自己的成员变量,以备后用
sServiceManager = ServiceManagerNative.asInterface(BinderInternal.getContextObject());
public IBinder getService(String name) throws RemoteException {
Parcel data = Parcel.obtain();
Parcel reply = Parcel.obtain();
data.writeInterfaceToken(IServiceManager.descriptor);
data.writeString(name);
mRemote.transact(GET_SERVICE_TRANSACTION, data, reply, 0);
IBinder binder = reply.readStrongBinder();
reply.recycle();
data.recycle();
return binder;
}
(二)Camera模块binder机制分析
(1)服务端的启动
int main(int argc, char** argv)
{
sp proc(ProcessState::self());
sp sm = defaultServiceManager();
LOGI("ServiceManager: %p", sm.get());
AudioFlinger::instantiate();
MediaPlayerService::instantiate();
CameraService::instantiate();
AudioPolicyService::instantiate();
ProcessState::self()->startThreadPool();
IPCThreadState::self()->joinThreadPool();
}
CameraService::instantiate()—> IServiceManager:: defaultServiceManager() à IServiceManager ::addService()//将服务加入服务管理系统
(2)客户服务端联系的建立
sp Camera::connect()
{
LOGV("connect");
sp c = new Camera();
const sp& cs = getCameraService();
if (cs != 0) {
c->mCamera = cs->connect(c);
}
if (c->mCamera != 0) {
c->mCamera->asBinder()->linkToDeath(c);
c->mStatus = NO_ERROR;
} else {
c.clear();
}
return c;
}
Camera::Camera()
{
init();
}
void Camera::init()
{
mStatus = UNKNOWN_ERROR;
}
const sp& Camera::getCameraService()
{
Mutex::Autolock _l(mLock);
if (mCameraService.get() == 0) {
sp sm = defaultServiceManager(); //获取服务管家代理,//这在前面已经详细介绍过
sp binder;
do {
binder = sm->getService(String16("media.camera"));//通过描述符调用获取CameraService服务的代理对象,这个前面也已经详细介绍过了,可以回头看看
if (binder != 0)
break;
LOGW("CameraService not published, waiting...");
usleep(500000); // 0.5 s
} while(true);
if (mDeathNotifier == NULL) {
mDeathNotifier = new DeathNotifier();//创建死亡通知对象,就是当该代理//对象消亡时,用来做进一步处理的东西
}
binder->linkToDeath(mDeathNotifier);//将这个通知对象绑定到特定的代理对象
mCameraService = interface_cast(binder);//哦,这个很熟悉//了,就是将BpBinder对象转换成BpCameraService类型,再赋值给其父类指针,多态的//使用
}
LOGE_IF(mCameraService==0, "no CameraService!?");
return mCameraService;
}
if (cs != 0) {
c->mCamera = cs->connect(c);
}
sp CameraService::connect(const sp& cameraClient)
{
……
……
// create a new Client object
client = new Client(this, cameraClient, callingPid); //创建Client对象
mClient = client; //初始化CameraService的成员变量
#if DEBUG_CLIENT_REFERENCES
// Enable tracking for this object, and track increments and decrements of
// the refcount.
client->trackMe(true, true);
#endif
LOGV("CameraService::connect X");
return client;
}
mCameraService = cameraService;//这是建立Client和CameraService的联系
mCameraClient = cameraClient;
(3)CameraService之由来
1) ICameraService
class ICameraService : public IInterface
{
public:
enum {
CONNECT = IBinder::FIRST_CALL_TRANSACTION,
};
public:
DECLARE_META_INTERFACE(CameraService);
virtual sp connect(const sp& cameraClient) = 0;
};
2) BpCameraService
class BpCameraService: public BpInterface
//这表明同时继承了BpInterface和ICameraService两个类
{
public:
BpCameraService(const sp& impl)//这里用服务代理对象BpBinder作为参
//数,这个是一定的需要的
: BpInterface(impl)
{
}
// connect to camera service
virtual sp connect(const sp& cameraClient)
{
Parcel data, reply;
data.writeInterfaceToken(ICameraService::getInterfaceDescriptor());
data.writeStrongBinder(cameraClient->asBinder());
remote()->transact(BnCameraService::CONNECT, data, &reply);
return interface_cast(reply.readStrongBinder());
}
};
3) BnCameraService
Framework\base\include\camera\ICameraService.cpp
class BnCameraClient: public BnInterface//相当于同时继承了BBinder和
//ICameraService两个类
{
public:
virtual status_tonTransact( uint32_t code,
const Parcel& data,
Parcel* reply,
uint32_t flags = 0);
};
这里只定义了一个onTransact()函数,它也在ICameraService.cpp文件中被实现:
status_t BnCameraService::onTransact(
uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
switch(code) {
case CONNECT: {
CHECK_INTERFACE(ICameraService, data, reply);
sp cameraClient = interface_cast(data.readStrongBinder());
sp camera = connect(cameraClient);
reply->writeStrongBinder(camera->asBinder());
return NO_ERROR;
} break;
default:
return BBinder::onTransact(code, data, reply, flags);
}
}
class CameraService : public BnCameraService //继承了上面的那个BnXXX类
{
class Client;
public:
static void instantiate();
// ICameraService interface
virtual spconnect(const sp& cameraClient);
//一个connect()函数的声明,在对应的.cpp文件中有具体定义,就是这个连接函数被最后调用的,没错它就是和BpCameraService里的函数一一对应的
……
……
class Client : public BnCamera {//与Camera类中的函数一一对应,作为Camera的客
//户端的服务,至于为什么叫Client,大概就是服务端里提供的对应Camera请求的服务部
//分意思吧
public:
virtual void disconnect();
// connect new client with existing camera remote
virtual status_t connect(const sp& client);
……
……
};
};
(四)binder机制的数据传输流程
virtual sp connect(const sp& cameraClient)
{
Parcel data, reply;
data.writeInterfaceToken(ICameraService::getInterfaceDescriptor());
data.writeStrongBinder(cameraClient->asBinder());
remote()->transact(BnCameraService::CONNECT, data, &reply);
//remote()返回传递给BpCameraService的那个代理Bpbinder对象,然后调用了
//这个代理对象的transact()函数
return interface_cast(reply.readStrongBinder());
}
下面是BpBinder的transact()函数:
status_t BpBinder::transact(
uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
// Once a binder has died, it will never come back to life.
if (mAlive) {
status_t status = IPCThreadState::self()->transact(
mHandle, code, data, reply, flags);//哦,原来调用了它呀
if (status == DEAD_OBJECT) mAlive = 0;
return status;
}
return DEAD_OBJECT;
}
status_t IPCThreadState::transact(int32_t handle,
uint32_t code, const Parcel& data,
Parcel* reply, uint32_t flags)
{
……
……
if (err == NO_ERROR) {
LOG_ONEWAY(">>>> SEND from pid %d uid %d %s", getpid(), getuid(),
(flags & TF_ONE_WAY) == 0 ? "READ REPLY" : "ONE WAY");
//发送数据
err = writeTransactionData(BC_TRANSACTION, flags, handle, code, data, NULL);
}
……
if ((flags & TF_ONE_WAY) == 0) {
if (reply) {
err = waitForResponse(reply);
} else {
Parcel fakeReply;
err = waitForResponse(&fakeReply);
}
} else {
err = waitForResponse(NULL, NULL);
}
return err;
}
看看writeTransactionData()函数:
status_t IPCThreadState::writeTransactionData(int32_t cmd, uint32_t binderFlags,
int32_t handle, uint32_t code, const Parcel& data, status_t* statusBuffer)
{
binder_transaction_data tr;
tr.target.handle = handle;
tr.code = code;
tr.flags = binderFlags;
//封装数据成binder_transaction_data类型
const status_t err = data.errorCheck();
if (err == NO_ERROR) {
tr.data_size = data.ipcDataSize();
tr.data.ptr.buffer = data.ipcData();
tr.offsets_size = data.ipcObjectsCount()*sizeof(size_t);
tr.data.ptr.offsets = data.ipcObjects();
} else if (statusBuffer) {
tr.flags |= TF_STATUS_CODE;
*statusBuffer = err;
tr.data_size = sizeof(status_t);
tr.data.ptr.buffer = statusBuffer;
tr.offsets_size = 0;
tr.data.ptr.offsets = NULL;
} else {
return (mLastError = err);
}
//将数据写入mOut,但是这里没有和驱动设备的通讯,那肯定不是这个函数的写操作
mOut.writeInt32(cmd);
mOut.write(&tr, sizeof(tr));
return NO_ERROR;
}
那就看看那个waitForResponse()函数:
status_t IPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult)
{
int32_t cmd;
int32_t err;
while (1) {
//这个函数看着就像是和驱动打交道的,呵呵,没错就是它
if ((err=talkWithDriver()) < NO_ERROR) break;
……
cmd = mIn.readInt32(); //从mIn中读取命令
switch (cmd) {//处理命令
case BR_TRANSACTION_COMPLETE:
if (!reply && !acquireResult) goto finish;
break;
case BR_DEAD_REPLY:
err = DEAD_OBJECT;
goto finish;
……
default:
err = executeCommand(cmd);
……
}
那就来看看talkWithDriver()函数,看他怎么和驱动聊天的:
status_t IPCThreadState::talkWithDriver(bool doReceive)
{
LOG_ASSERT(mProcess->mDriverFD >= 0, "Binder driver is not opened");
binder_write_read bwr;
……
//将bwr初始化后仍给驱动,并从驱动中带回消息,这个mDriverFD就是那个processState
//打开的binder设备文件描述符,这里可是会阻塞等待消息返回的
if (ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr) >= 0)
err = NO_ERROR;
……
if (err >= NO_ERROR) {
if (bwr.write_consumed > 0) {
if (bwr.write_consumed < (ssize_t)mOut.dataSize())
mOut.remove(0, bwr.write_consumed);
else
mOut.setDataSize(0);
}
//把带回的消息数据,放到mIn里面
if (bwr.read_consumed > 0) {
mIn.setDataSize(bwr.read_consumed);
mIn.setDataPosition(0);
}
}
status_t IPCThreadState::executeCommand(int32_t cmd)//这个函数代码很丰富,只列出重点部分
{
BBinder* obj;
RefBase::weakref_type* refs;
status_t result = NO_ERROR;
……
switch (cmd) {
case BR_ERROR:
result = mIn.readInt32();
break;
……
case BR_TRANSACTION:
{
binder_transaction_data tr;
result = mIn.read(&tr, sizeof(tr)); //将mIn的内容读入tr
……
If (tr.target.ptr) {
sp b((BBinder*)tr.cookie); //根据cookie字段获取BBinder对
//象,实际上这是一个类型转换,tr.cookie(这里已经是空指针了)是BnCameraService对
//象的首地址
const status_t error = b->transact(tr.code, buffer, &reply, 0); //调用
//BBinder对象的函数
if (error < NO_ERROR) reply.setError(error);
} else {
const status_t error = the_context_object->transact(tr.code, buffer, &reply, 0);
if (error < NO_ERROR) reply.setError(error)
}
……
}
……
}
status_t BBinder::transact(
uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
data.setDataPosition(0);
status_t err = NO_ERROR;
switch (code) {
case PING_TRANSACTION:
reply->writeInt32(pingBinder());
break;
default:
err = onTransact(code, data, reply, flags);//这个函数实际调用了谁?看看BnCameraService类的定义吧!
break;
}
if (reply != NULL) {
reply->setDataPosition(0);
}
return err;
}
status_t BnCameraService::onTransact(
uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
switch(code) {
case CONNECT: {
CHECK_INTERFACE(ICameraService, data, reply);
sp cameraClient = interface_cast(data.readStrongBinder()); //这里的参数是从驱动传入的
sp camera = connect(cameraClient);
//调用了CameraService::connect()函数
reply->writeStrongBinder(camera->asBinder());
return NO_ERROR;
} break;
default:
return BBinder::onTransact(code, data, reply, flags);
}
}
(五)总结
- Android binder -- Binder应用实例
- android Binder 实例
- Android Binder 简单实例
- Android------Binder 实例分析
- Android - Binder应用分析
- Android Binder -什么是binder
- Binder应用
- android binder机制之——(我是binder实例)
- android binder机制之——(我是binder实例)
- android binder机制之——(我是binder实例)
- Android binder机制之 4 --(我是binder实例)
- Android Binder
- Android Binder
- android Binder
- Android-binder
- android Binder
- Android--Binder
- android binder
- 《鸟哥的Linux私房菜:基础学习篇》书籍推荐
- Android 避免APP启动闪黑屏(Theme和Style)
- java_String类
- 正则表达式
- JAVA 的IO操作(五)简单文件复制
- Android binder -- Binder应用实例
- Avoid @throws in javadoc
- 关系型数据库与面向对象的冲突
- AppleScript学习笔记(六)处理程序Handler
- Avoid empty catch blocks
- Be specific in throws clause
- python安装及插件安装
- SICILY 1129. ISBN
- Beware of unknown root causes